@gatherthread/dsh-host 0.1.0-alpha.8 → 0.1.0-beta.2

package/dist/bundle/native-plugin.js

@@ -729,9 +729,9 @@ function floatSafeRemainder(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object2, key, getter) {
+function defineLazy(object3, key, getter) {
   let value = void 0;
-  Object.defineProperty(object2, key, {
+  Object.defineProperty(object3, key, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -743,7 +743,7 @@ function defineLazy(object2, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object3, key, {
         value: v
         // configurable: true,
       });
@@ -823,10 +823,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path10) {
-  if (!path10)
+function getElementAtPath(obj, path11) {
+  if (!path11)
     return obj;
-  return path10.reduce((acc, key) => acc?.[key], obj);
+  return path11.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1166,11 +1166,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path10, issues) {
+function prefixIssues(path11, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path10);
+    iss.path.unshift(path11);
     return iss;
   });
 }
@@ -1277,16 +1277,16 @@ function cleanEnum(obj) {
 }
 function base64ToUint8Array(base643) {
   const binaryString = atob(base643);
-  const bytes = new Uint8Array(binaryString.length);
+  const bytes2 = new Uint8Array(binaryString.length);
   for (let i = 0; i < binaryString.length; i++) {
-    bytes[i] = binaryString.charCodeAt(i);
+    bytes2[i] = binaryString.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToBase64(bytes) {
+function uint8ArrayToBase64(bytes2) {
   let binaryString = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binaryString += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.length; i++) {
+    binaryString += String.fromCharCode(bytes2[i]);
   }
   return btoa(binaryString);
 }
@@ -1295,22 +1295,22 @@ function base64urlToUint8Array(base64url3) {
   const padding = "=".repeat((4 - base643.length % 4) % 4);
   return base64ToUint8Array(base643 + padding);
 }
-function uint8ArrayToBase64url(bytes) {
-  return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function uint8ArrayToBase64url(bytes2) {
+  return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function hexToUint8Array(hex3) {
   const cleanHex = hex3.replace(/^0x/, "");
   if (cleanHex.length % 2 !== 0) {
     throw new Error("Invalid hex string length");
   }
-  const bytes = new Uint8Array(cleanHex.length / 2);
+  const bytes2 = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+    bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function uint8ArrayToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 var Class = class {
   constructor(..._args) {
@@ -1620,16 +1620,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path10 = []) => {
+  const processError = (error63, path11 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1668,17 +1668,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path10 = []) => {
+  const processError = (error63, path11 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1717,8 +1717,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path10 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path10) {
+  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path11) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -15810,8 +15810,8 @@ function foldObjects(members2) {
   }
   const properties = {};
   const required2 = /* @__PURE__ */ new Set();
-  for (const object2 of objects) {
-    for (const key in object2.properties) {
+  for (const object3 of objects) {
+    for (const key in object3.properties) {
       if (Object.prototype.hasOwnProperty.call(properties, key))
         continue;
       const parts = [];
@@ -15825,18 +15825,18 @@ function foldObjects(members2) {
       const merged = parts.length === 1 ? parts[0] : foldObjects(parts) ?? { allOf: parts };
       assignProp(properties, key, merged);
     }
-    for (const key of object2.required ?? [])
+    for (const key of object3.required ?? [])
       required2.add(key);
   }
   const folded = { type: "object", properties };
   if (required2.size)
     folded.required = [...required2];
-  if (objects.every((object2) => object2.additionalProperties === false)) {
+  if (objects.every((object3) => object3.additionalProperties === false)) {
     folded.additionalProperties = false;
   } else {
     const constraints = [];
-    for (const object2 of objects) {
-      const constraint = undeclaredConstraint(object2);
+    for (const object3 of objects) {
+      const constraint = undeclaredConstraint(object3);
       if (constraint && !constraints.some((seen) => JSON.stringify(seen) === JSON.stringify(constraint)))
         constraints.push(constraint);
     }
@@ -18820,13 +18820,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path10 = ref.slice(1).split("/").filter(Boolean);
-  if (path10.length === 0) {
+  const path11 = ref.slice(1).split("/").filter(Boolean);
+  if (path11.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path10[0] === defsKey) {
-    const key = path10[1] === void 0 ? void 0 : decodeJSONPointerSegment(path10[1]);
+  if (path11[0] === defsKey) {
+    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19675,6 +19675,28 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../protocol/dist/src/live-output.js
+var utf8 = (maximum) => external_exports.string().refine((value) => new TextEncoder().encode(value).length <= maximum, "Live output is too large");
+var LiveOutputPayloadSchema = external_exports.object({
+  content: utf8(24 * 1024),
+  phase: external_exports.literal("stream"),
+  stream_id: external_exports.string().uuid(),
+  stream_mode: external_exports.literal("snapshot"),
+  stream_kind: external_exports.enum(["answer", "reasoning", "tool", "plan"]),
+  stream_revision: external_exports.number().int().min(1).max(1200),
+  stream_state: external_exports.enum(["running", "completed", "failed"]),
+  title: utf8(256).optional(),
+  plan: external_exports.array(external_exports.object({ step: utf8(512), status: external_exports.enum(["pending", "in_progress", "completed"]) }).strict()).max(64).optional(),
+  status: external_exports.enum(["thinking", "running"]).optional(),
+  occurred_at: external_exports.string().datetime().optional(),
+  capture_fidelity: external_exports.literal("harness_transcript").optional(),
+  source_harness: external_exports.string().min(1).max(80).optional()
+}).strict().superRefine((value, context) => {
+  if (value.stream_kind === "plan" !== (value.plan !== void 0)) {
+    context.addIssue({ code: "custom", message: "Only plan snapshots carry plan steps" });
+  }
+});
+
 // ../protocol/dist/src/code-sync.js
 var CODE_SYNC_MAX_FILES = 1e3;
 var CODE_SYNC_MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -19685,16 +19707,16 @@ var Commit = external_exports.string().regex(/^[a-f0-9]{40}$/);
 var BranchId = external_exports.string().regex(/^branch-[a-f0-9]{24}$/);
 var pathEncoder = new TextEncoder();
 var hfsIgnoredCharacters = /[\u200c-\u200f\u202a-\u202e\u206a-\u206f\ufeff]/gu;
-function portablePathKey(path10) {
-  return path10.normalize("NFC").replace(hfsIgnoredCharacters, "").toLowerCase();
+function portablePathKey(path11) {
+  return path11.normalize("NFC").replace(hfsIgnoredCharacters, "").toLowerCase();
 }
 function containsCodeSyncSecret(text) {
-  return /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----|\b(?:gh[pousr]|github_pat|glpat|sk|xox[baprs])[-_][A-Za-z0-9_-]{16,}|\b(?:gt[abidp]|acp(?:i|d)?)_[A-Za-z0-9_-]{20,}|\bAKIA[A-Z0-9]{16}\b/u.test(text);
+  return /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----|\b(?:gh[pousr]|github_pat|glpat|sk|xox[baprs])[-_][A-Za-z0-9_-]{16,}|\b(?:(?:gt[abidp]|gteg?)|acp(?:i|d)?)_[A-Za-z0-9_-]{20,}|\bAKIA[A-Z0-9]{16}\b/u.test(text);
 }
-function isCodeSyncPathAllowed(path10) {
-  if (!path10 || path10.length > 500 || path10.startsWith("/") || /[\\\u0000-\u001f\u007f\ud800-\udfff:<>"|?*]/u.test(path10))
+function isCodeSyncPathAllowed(path11) {
+  if (!path11 || path11.length > 500 || path11.startsWith("/") || /[\\\u0000-\u001f\u007f\ud800-\udfff:<>"|?*]/u.test(path11))
     return false;
-  const components = path10.split("/");
+  const components = path11.split("/");
   return components.every((part) => {
     const lower = portablePathKey(part);
     if (!part || pathEncoder.encode(part).byteLength > 255 || part === "." || part === ".." || part.endsWith(".") || part.endsWith(" "))
@@ -19714,34 +19736,42 @@ function isCodeSyncPathAllowed(path10) {
     return !/\.(?:pem|p12|pfx|key)$/iu.test(lower) && !/^(?:id_rsa|id_ed25519)(?:\.|$)/iu.test(lower);
   });
 }
-var CodeFileSchema = external_exports.object({
-  path: external_exports.string().refine(isCodeSyncPathAllowed, "Unsafe or private code path"),
-  content_base64: external_exports.string().max(4 * Math.ceil(CODE_SYNC_MAX_FILE_BYTES / 3)).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/),
-  executable: external_exports.boolean()
-}).strict();
-var CodeFilesSchema = external_exports.array(CodeFileSchema).max(CODE_SYNC_MAX_FILES).superRefine((files, context) => {
-  let size = 0;
-  const names = /* @__PURE__ */ new Set();
-  for (const [index, file2] of files.entries()) {
-    const bytes = file2.content_base64.length * 3 / 4 - (file2.content_base64.endsWith("==") ? 2 : file2.content_base64.endsWith("=") ? 1 : 0);
-    size += bytes;
-    const normalized = portablePathKey(file2.path);
-    if (bytes > CODE_SYNC_MAX_FILE_BYTES || names.has(normalized))
-      context.addIssue({ code: "custom", path: [index], message: "File limit or duplicate portable path" });
-    names.add(normalized);
-  }
-  if (size > CODE_SYNC_MAX_SNAPSHOT_BYTES)
-    context.addIssue({ code: "custom", message: "Code snapshot exceeds 8 MiB" });
-  for (const name2 of names) {
-    const parts = name2.split("/");
-    parts.pop();
-    while (parts.length) {
-      if (names.has(parts.join("/")))
-        context.addIssue({ code: "custom", message: "File and directory paths overlap" });
+var CLOUD_CODE_SYNC_LIMITS = { maxFiles: CODE_SYNC_MAX_FILES, maxFileBytes: CODE_SYNC_MAX_FILE_BYTES, maxSnapshotBytes: CODE_SYNC_MAX_SNAPSHOT_BYTES };
+var GITHUB_CODE_SYNC_LIMITS = { maxFiles: 1e4, maxFileBytes: 20 * 1024 * 1024, maxSnapshotBytes: 128 * 1024 * 1024 };
+function createCodeFileSchema(limits) {
+  return external_exports.object({
+    path: external_exports.string().refine(isCodeSyncPathAllowed, "Unsafe or private code path"),
+    content_base64: external_exports.string().max(4 * Math.ceil(limits.maxFileBytes / 3)).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/),
+    executable: external_exports.boolean()
+  }).strict();
+}
+var CodeFileSchema = createCodeFileSchema(CLOUD_CODE_SYNC_LIMITS);
+function createCodeFilesSchema(limits) {
+  return external_exports.array(createCodeFileSchema(limits)).max(limits.maxFiles).superRefine((files, context) => {
+    let size = 0;
+    const names = /* @__PURE__ */ new Set();
+    for (const [index, file2] of files.entries()) {
+      const bytes2 = file2.content_base64.length * 3 / 4 - (file2.content_base64.endsWith("==") ? 2 : file2.content_base64.endsWith("=") ? 1 : 0);
+      size += bytes2;
+      const normalized = portablePathKey(file2.path);
+      if (bytes2 > limits.maxFileBytes || names.has(normalized))
+        context.addIssue({ code: "custom", path: [index], message: "File limit or duplicate portable path" });
+      names.add(normalized);
+    }
+    if (size > limits.maxSnapshotBytes)
+      context.addIssue({ code: "custom", message: "Code snapshot exceeds provider limit" });
+    for (const name2 of names) {
+      const parts = name2.split("/");
       parts.pop();
+      while (parts.length) {
+        if (names.has(parts.join("/")))
+          context.addIssue({ code: "custom", message: "File and directory paths overlap" });
+        parts.pop();
+      }
     }
-  }
-});
+  });
+}
+var CodeFilesSchema = createCodeFilesSchema(CLOUD_CODE_SYNC_LIMITS);
 var CodeEnableInputSchema = external_exports.object({ idempotency_key: Key }).strict();
 var CodeDisableInputSchema = external_exports.object({ idempotency_key: Key }).strict();
 var CodeCheckpointInputSchema = external_exports.object({
@@ -19803,6 +19833,159 @@ var CodeSnapshotResultSchema = external_exports.object({ snapshot: external_expo
 }).strict() }).strict();
 var codeSyncRequestKinds = ["code_sync_status", "code_upload", "code_download", "code_recover", "code_auto_upload_enable", "code_auto_upload_disable"];
 
+// ../protocol/dist/src/github-sync.js
+var GitHubRepositorySchema = external_exports.string().max(140).regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/).refine((value) => {
+  const repository = value.split("/")[1];
+  return repository !== "." && repository !== ".." && !repository.toLowerCase().endsWith(".git");
+}, "Use owner/repository without a .git suffix");
+function isGitHubBranchAllowed(value) {
+  return value.length > 0 && value.length <= 200 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value) && !value.includes("..") && value.split("/").every((part) => !!part && !part.startsWith(".") && !part.endsWith(".") && !part.toLowerCase().endsWith(".lock")) && value !== "HEAD";
+}
+var GitHubBranchSchema = external_exports.string().refine(isGitHubBranchAllowed, "Unsafe GitHub branch name");
+var GitHubBaseBranchSchema = GitHubBranchSchema.refine((value) => !value.startsWith("gatherthread/"), "The shared base cannot use the GatherThread personal branch namespace");
+var GitHubPersonalBranchSchema = external_exports.string().regex(/^gatherthread\/[a-f0-9]{24}\/[a-f0-9]{24}$/);
+var GitHubConnectionSchema = external_exports.object({
+  repository: GitHubRepositorySchema,
+  base_branch: GitHubBaseBranchSchema,
+  enabled: external_exports.boolean(),
+  revision: external_exports.string().uuid()
+}).strict();
+var GitHubProjectStatusSchema = external_exports.object({
+  connection: GitHubConnectionSchema.nullable(),
+  branch: GitHubPersonalBranchSchema,
+  can_configure: external_exports.boolean(),
+  // GatherThread membership only. GitHub permissions must be checked locally.
+  can_write: external_exports.boolean()
+}).strict();
+var GitHubConnectionInputSchema = external_exports.object({
+  repository: GitHubRepositorySchema,
+  base_branch: GitHubBaseBranchSchema,
+  enabled: external_exports.boolean(),
+  expected_revision: external_exports.string().uuid().nullable()
+}).strict();
+var githubCodeSyncRequestKinds = [
+  "github_auth_connect",
+  "github_code_sync_status",
+  "github_code_upload",
+  "github_code_download",
+  "github_code_recover",
+  "github_code_auto_upload_enable",
+  "github_code_auto_upload_disable",
+  "github_code_update"
+];
+
+// ../protocol/dist/src/registration.js
+var RegistrationEmailSchema = external_exports.string().max(254).trim().toLowerCase().regex(/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/).refine((value) => value.split("@")[0].length <= 64 && value.split("@")[1].split(".").every((part) => part.length <= 63));
+var Label = external_exports.string().regex(/^[^\u0000-\u001f\u007f-\u009f]*$/u).trim().min(1).max(120);
+var SendRegistrationInputSchema = external_exports.object({
+  email: RegistrationEmailSchema,
+  challenge_token: external_exports.string().min(1).max(2048),
+  idempotency_key: external_exports.string().uuid(),
+  locale: external_exports.enum(["en", "zh-CN"])
+}).strict();
+var AccountPasswordSchema = external_exports.string().min(8).max(128).refine((value) => new TextEncoder().encode(value).byteLength <= 512);
+var EmailLoginInputSchema = external_exports.object({
+  email: RegistrationEmailSchema,
+  password: AccountPasswordSchema,
+  device_name: Label,
+  remember_device: external_exports.boolean().default(false)
+}).strict();
+var LauncherProjectId = external_exports.string().min(1).max(128).refine((value) => /^[A-Za-z0-9]/u.test(value) && !/[^A-Za-z0-9._:-]/u.test(value));
+var CreateCodexLauncherAuthorizationInputSchema = external_exports.object({
+  project_id: LauncherProjectId,
+  email: RegistrationEmailSchema
+}).strict();
+var ClaimCodexLauncherAuthorizationInputSchema = external_exports.object({
+  authorization_id: external_exports.string().uuid().toLowerCase(),
+  project_id: LauncherProjectId,
+  email: RegistrationEmailSchema,
+  password: AccountPasswordSchema,
+  device_name: Label
+}).strict();
+var VerifyRegistrationInputSchema = external_exports.object({
+  registration_id: external_exports.string().uuid(),
+  code: external_exports.string().regex(/^\d{8}$/),
+  display_name: Label,
+  device_name: Label,
+  remember_device: external_exports.boolean().default(false),
+  privacy_acknowledged: external_exports.literal(true),
+  password: AccountPasswordSchema
+}).strict();
+var RegistrationStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  site_key: external_exports.string().nullable(),
+  challenge_binding: external_exports.string().nullable()
+}).strict();
+var RegistrationSentSchema = external_exports.object({
+  registration_id: external_exports.string().uuid(),
+  expires_in_seconds: external_exports.literal(600),
+  resend_after_seconds: external_exports.literal(60)
+}).strict();
+var PasswordResetSentSchema = external_exports.object({
+  reset_id: external_exports.string().uuid(),
+  expires_in_seconds: external_exports.literal(600),
+  resend_after_seconds: external_exports.literal(60)
+}).strict();
+var VerifyPasswordResetInputSchema = external_exports.object({
+  reset_id: external_exports.string().uuid(),
+  email: RegistrationEmailSchema,
+  code: external_exports.string().regex(/^\d{8}$/),
+  password: AccountPasswordSchema,
+  password_confirmation: AccountPasswordSchema,
+  locale: external_exports.enum(["en", "zh-CN"])
+}).strict().refine((value) => value.password === value.password_confirmation);
+var EmailAccountSessionSchema = external_exports.object({
+  actor: external_exports.object({ user_id: external_exports.string(), display_name: external_exports.string(), device_id: external_exports.string(), can_create_projects: external_exports.literal(true) }).strict(),
+  expires_at: external_exports.string().datetime()
+}).strict();
+
+// ../protocol/dist/src/cloud-api.js
+var CloudApiProviderIdSchema = external_exports.enum(["openai", "anthropic", "deepseek", "siliconflow-cn", "siliconflow-global", "openrouter", "qwen", "glm", "doubao"]);
+var CloudApiModelSchema = external_exports.string().trim().min(1).max(160).regex(/^[^\u0000-\u0020\u007f-\u009f]+$/u);
+var Label2 = external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u);
+var CloudApiPutInputSchema = external_exports.object({
+  expected_revision: external_exports.string().uuid().nullable(),
+  provider_id: CloudApiProviderIdSchema,
+  label: Label2,
+  model: CloudApiModelSchema,
+  enabled: external_exports.boolean(),
+  api_key: external_exports.string().min(8).max(4096).regex(/^[\x21-\x7e]+$/u).optional()
+}).strict();
+var CloudApiDeleteInputSchema = external_exports.object({ expected_revision: external_exports.string().uuid() }).strict();
+var CloudApiConfigurationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  revision: external_exports.string().uuid(),
+  provider_id: CloudApiProviderIdSchema,
+  profile_id: external_exports.string().regex(/^api-[0-9a-f-]{36}$/u),
+  label: Label2,
+  model: CloudApiModelSchema,
+  enabled: external_exports.boolean(),
+  has_key: external_exports.literal(true),
+  updated_at: external_exports.string().datetime()
+}).strict();
+var CloudApiProviderSchema = external_exports.object({
+  id: CloudApiProviderIdSchema,
+  label: external_exports.string().max(80),
+  transport: external_exports.enum(["openai-chat", "anthropic-messages"]),
+  base_url: external_exports.string().url().max(200),
+  docs_url: external_exports.string().url().max(300),
+  default_model: CloudApiModelSchema.optional()
+}).strict();
+var CloudApiStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  providers: external_exports.array(CloudApiProviderSchema).max(16),
+  configurations: external_exports.array(CloudApiConfigurationSchema).max(8)
+}).strict();
+var CloudApiSavedSchema = external_exports.object({ configuration: CloudApiConfigurationSchema }).strict();
+var PersonalCloudRevisionSchema = external_exports.string().uuid().optional();
+function hasValidPersonalCloudRevision(value) {
+  return value.profile_id.startsWith("api-") ? /^api-[0-9a-f-]{36}$/u.test(value.profile_id) && value.api_config_revision !== void 0 : value.api_config_revision === void 0;
+}
+var HostedAgentSelectionSchema = external_exports.object({
+  profile_id: external_exports.string().min(1).max(64),
+  api_config_revision: PersonalCloudRevisionSchema
+}).strict().refine(hasValidPersonalCloudRevision, "Personal Cloud Agent selection requires its exact revision");
+
 // ../protocol/dist/src/history-summary.js
 var HISTORY_SUMMARY_MAX_SOURCE_BYTES = 20 * 1024;
 var HISTORY_SUMMARY_MAX_PROMPT_BYTES = 30 * 1024;
@@ -19818,7 +20001,7 @@ function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function historySummaryMarker(event) {
-  if (event.type !== "agent_request")
+  if (event.deleted || event.type !== "agent_request")
     return void 0;
   const marker = record2(record2(event.payload)?.history_summary);
   const ids = marker?.source_event_ids;
@@ -19827,6 +20010,105 @@ function historySummaryMarker(event) {
   return { version: 1, source_event_ids: ids, source_digest: marker.source_digest };
 }
 
+// ../protocol/dist/src/test-gate.js
+var TestGateExchangeInputSchema = external_exports.object({
+  admission_code: external_exports.string().regex(/^gte_[A-Za-z0-9_-]{43}$/)
+}).strict();
+var TestGateStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  admitted: external_exports.boolean(),
+  environment: external_exports.enum(["production", "test"])
+}).strict();
+
+// ../protocol/dist/src/hosted-github.js
+var Key2 = external_exports.string().min(8).max(200);
+var HostedGithubRepositoryInputSchema = external_exports.object({
+  repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u).max(140),
+  base_branch: external_exports.string().min(1).max(200).refine((v) => !/[\s~^:?*\[\\]/u.test(v) && !v.includes("..") && !v.startsWith("-") && !v.endsWith("/") && !v.endsWith(".lock"))
+}).strict();
+var HostedGithubTaskInputSchema = external_exports.object({
+  content: external_exports.string().trim().min(1).max(6e3),
+  profile_id: external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/u),
+  idempotency_key: Key2,
+  continue_task_id: external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u).optional(),
+  reply_to_event_id: external_exports.string().min(1).max(128).nullable().optional(),
+  api_config_revision: PersonalCloudRevisionSchema,
+  content_revision: external_exports.number().int().nonnegative().optional()
+}).strict().refine(hasValidPersonalCloudRevision, { message: "Personal cloud profiles require their exact configuration revision" });
+var HostedGithubCompleteInputSchema = external_exports.object({
+  state: external_exports.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  code: external_exports.string().min(1).max(500)
+}).strict();
+var HostedGithubPrInputSchema = external_exports.object({
+  title: external_exports.string().trim().min(1).max(200),
+  body: external_exports.string().max(6e3),
+  expected_revision: external_exports.string().regex(/^[a-f0-9]{64}$/u)
+}).strict();
+var Login = external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/u);
+var TaskId = external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u);
+var Sha = external_exports.string().regex(/^[a-f0-9]{40}$/u).nullable();
+var Revision = external_exports.string().regex(/^[a-f0-9]{64}$/u).nullable();
+var PullUrl = external_exports.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/u).nullable();
+var HostedGithubBindingSchema = HostedGithubRepositoryInputSchema;
+var HostedGithubStatusSchema = external_exports.union([
+  external_exports.object({ enabled: external_exports.literal(false) }).strict(),
+  external_exports.object({
+    enabled: external_exports.literal(true),
+    connected: external_exports.boolean(),
+    login: Login.nullable(),
+    binding: HostedGithubBindingSchema.nullable(),
+    installation_url: external_exports.string().max(2048).regex(/^https:\/\/github\.com\/apps\/[A-Za-z0-9_.-]+\/installations\/new$/u)
+  }).strict().refine((v) => v.connected ? v.login !== null : v.login === null && v.binding === null)
+]);
+var HostedGithubAuthorizationSchema = external_exports.object({ authorization_url: external_exports.string().max(4096).refine((value) => {
+  try {
+    const url2 = new URL(value);
+    return url2.origin === "https://github.com" && url2.pathname === "/login/oauth/authorize" && !url2.username && !url2.password && !url2.hash && /^[A-Za-z0-9_-]{43}$/u.test(url2.searchParams.get("state") ?? "") && [...url2.searchParams.keys()].every((key) => ["client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method", "prompt"].includes(key));
+  } catch {
+    return false;
+  }
+}) }).strict();
+var HostedGithubConnectionSchema = external_exports.object({ connected: external_exports.literal(true), login: Login }).strict();
+var HostedGithubDisconnectionSchema = external_exports.object({ connected: external_exports.literal(false) }).strict();
+var HostedGithubTaskSummarySchema = external_exports.object({
+  id: TaskId,
+  session_id: external_exports.string().min(1).max(128),
+  profile_id: HostedGithubTaskInputSchema.shape.profile_id,
+  resumable: external_exports.boolean(),
+  state: external_exports.enum(["running", "completed", "failed", "interrupted"]),
+  repository: HostedGithubRepositoryInputSchema.shape.repository,
+  base_branch: HostedGithubRepositoryInputSchema.shape.base_branch,
+  base_sha: Sha,
+  revision: Revision,
+  error_code: external_exports.string().regex(/^[a-z][a-z0-9_]{0,63}$/u).nullable(),
+  pull_request_url: PullUrl,
+  expires_at: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  api_config_revision: external_exports.string().uuid().optional()
+}).strict();
+var bytes = (value) => value.length / 4 * 3 - (value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0);
+var Source = external_exports.string().max(2796204).regex(/^[A-Za-z0-9+/]*={0,2}$/u).refine((value) => value.length % 4 === 0 && bytes(value) <= 2 * 1024 * 1024).nullable();
+var HostedGithubChangeSchema = external_exports.object({
+  path: external_exports.string().max(4096).refine(isCodeSyncPathAllowed),
+  before_base64: Source,
+  after_base64: Source,
+  before_executable: external_exports.boolean().nullable(),
+  after_executable: external_exports.boolean().nullable()
+}).strict().refine((v) => v.before_base64 === null === (v.before_executable === null) && v.after_base64 === null === (v.after_executable === null) && (v.before_base64 !== null || v.after_base64 !== null));
+var HostedGithubTaskSchema = HostedGithubTaskSummarySchema.extend({
+  answer: external_exports.string().max(14e3).nullable(),
+  changes: external_exports.array(HostedGithubChangeSchema).max(2e3)
+}).strict().refine((v) => {
+  if (new Set(v.changes.map((c) => c.path)).size !== v.changes.length)
+    return false;
+  for (const side of ["before_base64", "after_base64"]) {
+    const values = v.changes.map((c) => c[side]).filter((s) => s !== null);
+    if (values.length > 1e3 || values.reduce((sum, s) => sum + bytes(s), 0) > 8 * 1024 * 1024)
+      return false;
+  }
+  return !v.resumable || v.state !== "running" && v.pull_request_url === null;
+});
+var HostedGithubTaskListSchema = external_exports.object({ tasks: external_exports.array(HostedGithubTaskSummarySchema).max(10) }).strict();
+
 // ../protocol/dist/src/index.js
 var sessionModes = ["solo", "multi"];
 var membershipRoles = ["owner", "participant", "viewer"];
@@ -19841,7 +20123,8 @@ var eventTypes = [
   "attachment",
   "context_snapshot",
   "membership_change",
-  "session_state_change"
+  "session_state_change",
+  "message_deleted"
 ];
 var eventVisibilities = ["session", "owner_only"];
 var captureFidelities = [
@@ -19938,8 +20221,18 @@ var CanonicalEventSchema = external_exports.object({
   visibility: EventVisibilitySchema,
   reply_to_event_id: IdSchema.nullable(),
   payload: JsonValueSchema,
-  runtime_provenance: RuntimeProvenanceSchema.nullable()
+  runtime_provenance: RuntimeProvenanceSchema.nullable(),
+  content_revision: external_exports.number().int().nonnegative().optional(),
+  deleted: external_exports.object({ deleted_at: external_exports.string().datetime(), reason: external_exports.enum(["author", "request", "summary_invalidated"]) }).strict().optional()
 });
+var DeleteMessageInputSchema = external_exports.object({ idempotency_key: IdempotencyKeySchema }).strict();
+var DeleteMessageResultSchema = external_exports.object({
+  event: CanonicalEventSchema,
+  target_event_id: IdSchema,
+  content_revision: external_exports.number().int().nonnegative(),
+  affected_event_ids: external_exports.array(IdSchema).max(256),
+  affected_truncated: external_exports.boolean()
+}).strict();
 var MessageMentionsSchema = external_exports.array(external_exports.object({
   user_id: IdSchema,
   start: external_exports.number().int().nonnegative().max(1e6),
@@ -19968,9 +20261,70 @@ var AppendEventInputSchema = external_exports.object({
   payload: JsonValueSchema,
   runtime_id: IdSchema.optional(),
   claim_attempt: external_exports.number().int().positive().optional(),
+  content_revision: external_exports.number().int().nonnegative().optional(),
   observed_model: external_exports.string().trim().min(1).max(160).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional(),
   observed_reasoning_effort: external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional()
 });
+var HostedAgentRequestInputSchema = external_exports.object({
+  profile_id: external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/u).default("default"),
+  content: external_exports.string().trim().min(1).max(6e3),
+  include_code: external_exports.boolean().default(false),
+  idempotency_key: IdempotencyKeySchema,
+  reply_to_event_id: IdSchema.nullable().optional(),
+  github_task_id: external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u).optional(),
+  continue_from_event_id: IdSchema.optional(),
+  api_config_revision: PersonalCloudRevisionSchema,
+  content_revision: external_exports.number().int().nonnegative().optional()
+}).strict().refine(hasValidPersonalCloudRevision, { message: "Personal cloud profiles require their exact configuration revision" });
+var HostedAgentFailurePayloadSchema = external_exports.object({
+  content: external_exports.string().min(1).max(512),
+  status: external_exports.literal("failed"),
+  outcome: external_exports.enum(["timed_out", "failed"]),
+  error: external_exports.object({
+    code: external_exports.string().regex(/^[a-z][a-z0-9_]{0,63}$/u),
+    provider_attempts: external_exports.number().int().min(0).max(64).optional()
+  }).strict()
+}).strict();
+var HostedHistorySummaryInputSchema = CreateHistorySummaryInputSchema.omit({ execution_profile: true }).extend({ profile_id: HostedAgentRequestInputSchema.shape.profile_id.unwrap(), api_config_revision: PersonalCloudRevisionSchema, continue_from_event_id: IdSchema.optional() }).strict().refine(hasValidPersonalCloudRevision, { message: "Personal cloud profiles require their exact configuration revision" });
+var HostedAgentAcceptedSchema = external_exports.object({
+  request_event: CanonicalEventSchema,
+  replayed: external_exports.boolean()
+}).strict();
+var HostedAgentPausedSchema = external_exports.object({
+  request_event_id: IdSchema,
+  status: external_exports.literal("paused")
+}).strict();
+var HostedAgentStatusSchema = external_exports.discriminatedUnion("enabled", [
+  external_exports.object({ enabled: external_exports.literal(false) }).strict(),
+  external_exports.object({
+    enabled: external_exports.literal(true),
+    harness: external_exports.literal("opencode"),
+    utc_day: external_exports.string(),
+    user_limit_runs: external_exports.number().int().nonnegative().nullable(),
+    user_used_runs: external_exports.number().int().nonnegative(),
+    global_limit_runs: external_exports.number().int().nonnegative().nullable(),
+    global_used_runs: external_exports.number().int().nonnegative(),
+    rate_limits: external_exports.object({
+      user_min_interval_seconds: external_exports.number().int().min(1).max(3600),
+      user_max_concurrent: external_exports.number().int().min(1).max(8),
+      user_active_runs: external_exports.number().int().nonnegative(),
+      retry_after_seconds: external_exports.number().int().nonnegative()
+    }).strict().optional(),
+    profiles: external_exports.array(external_exports.object({
+      id: external_exports.string(),
+      label: external_exports.string(),
+      provider: external_exports.string(),
+      model: external_exports.string(),
+      available: external_exports.boolean(),
+      capacity: external_exports.number().int().nonnegative(),
+      status: external_exports.enum(["available", "busy", "daily_limit", "cooldown", "user_busy", "rate_limit"]),
+      source: external_exports.enum(["service", "personal"]).optional(),
+      api_config_revision: external_exports.string().uuid().optional()
+    }).strict()),
+    capabilities: external_exports.array(external_exports.string()),
+    privacy: external_exports.string()
+  }).strict()
+]);
 var SingleLineTitleSchema = external_exports.string().regex(/^[^\u0000-\u001f\u007f-\u009f]*$/u, "Title must not contain control characters").trim().min(1).max(200);
 var SessionTitleSchema = SingleLineTitleSchema;
 var ProjectTitleSchema = SingleLineTitleSchema;
@@ -20017,7 +20371,12 @@ var ProjectListItemSchema = ProjectRecordSchema.omit({ owner_user_id: true }).ex
   role: MembershipRoleSchema,
   session_count: external_exports.number().int().nonnegative()
 });
+var AvatarIdSchema = external_exports.enum(["cat", "fox", "bear", "rabbit", "penguin", "owl"]);
+var SetAccountAvatarInputSchema = external_exports.object({ avatar_id: AvatarIdSchema.nullable() }).strict();
+var AccountAvatarProfileSchema = external_exports.object({ user_id: IdSchema, avatar_id: AvatarIdSchema.nullable() });
+var SessionAvatarProfilesSchema = external_exports.object({ profiles: external_exports.array(AccountAvatarProfileSchema) });
 var ProjectMemberRecordSchema = external_exports.object({
+  avatar_id: AvatarIdSchema.nullable().optional(),
   user_id: IdSchema,
   display_name: external_exports.string().trim().min(1).max(120),
   role: MembershipRoleSchema
@@ -20072,6 +20431,17 @@ var ClaimInvitationInputSchema = external_exports.object({
 var AcceptInvitationInputSchema = external_exports.object({
   invite_token: external_exports.string().min(32).max(512)
 });
+var PreviewProjectInvitationInputSchema = external_exports.object({
+  invite_token: external_exports.string().regex(/^gti_[A-Za-z0-9_-]{32,508}$/)
+}).strict();
+var ProjectInvitationPreviewSchema = external_exports.object({
+  project: external_exports.object({ id: IdSchema, title: external_exports.string().min(1).max(200) }).strict(),
+  inviter_display_name: external_exports.string().min(1).max(120),
+  role: InvitationRoleSchema,
+  created_at: external_exports.string().datetime(),
+  expires_at: external_exports.string().datetime(),
+  already_member: external_exports.boolean()
+}).strict();
 var InvitationRecordSchema = external_exports.object({
   id: IdSchema,
   session_id: IdSchema,
@@ -20146,6 +20516,10 @@ var DeviceAuthorizationRecordSchema = external_exports.object({
   claimed_at: external_exports.string().datetime().nullable(),
   claimed_by_device_id: IdSchema.nullable()
 });
+var CodexLauncherAuthorizationSchema = external_exports.object({
+  authorization: DeviceAuthorizationRecordSchema.strict(),
+  email: RegistrationEmailSchema
+}).strict();
 var RotateDeviceTokenInputSchema = external_exports.object({
   expires_at: external_exports.string().datetime().nullable().optional()
 });
@@ -20180,6 +20554,7 @@ var RegisterRuntimeInputSchema = external_exports.object({
   provider: external_exports.string().trim().min(1).max(80),
   model: external_exports.string().trim().min(1).max(160),
   execution_profiles: RuntimeExecutionProfilesSchema.optional(),
+  context_deletion_version: external_exports.literal(1).optional(),
   local_session_id: external_exports.string().trim().min(1).max(512),
   capture_fidelity: CaptureFidelitySchema
 });
@@ -20193,11 +20568,13 @@ var AgentRequestClaimSchema = external_exports.object({
   // `paused` is a decision by the requester, not a claim a runtime can execute.
   // It is reported so a connector can skip the request without advancing past it.
   status: external_exports.enum(["claimed", "completed", "paused"]),
-  attempt_count: external_exports.number().int().positive().optional()
+  attempt_count: external_exports.number().int().positive().optional(),
+  content_revision: external_exports.number().int().nonnegative().optional()
 }).strict();
 var CompleteAgentRequestInputSchema = external_exports.object({
   runtime_id: IdSchema,
   claim_attempt: external_exports.number().int().positive().optional(),
+  content_revision: external_exports.number().int().nonnegative().optional(),
   idempotency_key: IdempotencyKeySchema,
   payload: JsonValueSchema,
   observed_model: external_exports.string().trim().min(1).max(160).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional(),
@@ -20212,6 +20589,7 @@ var CommitLocalTurnInputSchema = external_exports.object({
   local_turn_id: IdSchema,
   runtime_id: IdSchema,
   based_on_sequence: external_exports.number().int().nonnegative(),
+  content_revision: external_exports.number().int().nonnegative().optional(),
   occurred_at: external_exports.string().datetime(),
   observed_model: external_exports.string().trim().min(1).max(160).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional(),
   observed_reasoning_effort: external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional(),
@@ -20232,6 +20610,7 @@ var snapshotRequestStatuses = ["pending", "claimed", "completed", "failed"];
 var SnapshotRequestStatusSchema = external_exports.enum(snapshotRequestStatuses);
 var snapshotRequestKinds = [
   ...codeSyncRequestKinds,
+  ...githubCodeSyncRequestKinds,
   "immutable",
   "visible_history_replace",
   "local_sync_status",
@@ -20264,6 +20643,7 @@ var SnapshotRequestRecordSchema = external_exports.object({
   kind: SnapshotRequestKindSchema,
   through_sequence: external_exports.number().int().nonnegative(),
   status: SnapshotRequestStatusSchema,
+  content_revision: external_exports.number().int().nonnegative().optional(),
   target_runtime_id: IdSchema.nullable(),
   claimed_by_runtime_id: IdSchema.nullable(),
   created_at: external_exports.string().datetime(),
@@ -20289,7 +20669,8 @@ var SubscribeMessageSchema = external_exports.object({
 var ReplayResponseSchema = external_exports.object({
   events: external_exports.array(CanonicalEventSchema),
   cursor: external_exports.number().int().nonnegative(),
-  has_more: external_exports.boolean()
+  has_more: external_exports.boolean(),
+  content_revision: external_exports.number().int().nonnegative().optional()
 });
 var SessionListItemSchema = external_exports.object({
   id: IdSchema,
@@ -20300,6 +20681,7 @@ var SessionListItemSchema = external_exports.object({
   state: external_exports.enum(["active", "archived"]),
   role: MembershipRoleSchema,
   current_sequence: external_exports.number().int().nonnegative(),
+  content_revision: external_exports.number().int().nonnegative().optional(),
   member_count: external_exports.number().int().nonnegative().optional(),
   updated_at: external_exports.string().datetime()
 });
@@ -20403,7 +20785,8 @@ var HttpCollaborationClient = class {
     return {
       events,
       nextSequence: requiredNumber(body.cursor, "cursor"),
-      hasMore: body.has_more === true
+      hasMore: body.has_more === true,
+      ...body.content_revision === void 0 ? {} : { contentRevision: requiredRevision(body.content_revision, "events.content_revision") }
     };
   }
   async readContext(sessionId, view, throughSequence) {
@@ -20461,7 +20844,8 @@ var HttpCollaborationClient = class {
       status,
       requestId: requiredString(body.request_event_id, "claim.request_event_id"),
       runtimeId: requiredString(body.runtime_id, "claim.runtime_id"),
-      attemptCount
+      attemptCount,
+      ...body.content_revision === void 0 ? {} : { contentRevision: requiredRevision(body.content_revision, "claim.content_revision") }
     };
   }
   async completeAgentRequest(sessionId, requestId, input2) {
@@ -20470,6 +20854,7 @@ var HttpCollaborationClient = class {
       body: JSON.stringify({
         runtime_id: input2.runtimeId,
         ...input2.claimAttempt === void 0 ? {} : { claim_attempt: input2.claimAttempt },
+        ...input2.contentRevision === void 0 ? {} : { content_revision: input2.contentRevision },
         idempotency_key: input2.idempotencyKey,
         payload: truncateJsonValue(input2.payload, 160 * 1024),
         ...input2.observedModel === void 0 ? {} : { observed_model: input2.observedModel },
@@ -20484,6 +20869,7 @@ var HttpCollaborationClient = class {
       body: JSON.stringify({
         runtime_id: input2.runtimeId,
         ...input2.claimAttempt === void 0 ? {} : { claim_attempt: input2.claimAttempt },
+        ...input2.contentRevision === void 0 ? {} : { content_revision: input2.contentRevision },
         idempotency_key: input2.idempotencyKey,
         payload: truncateJsonValue(input2.payload, 32 * 1024),
         ...input2.observedModel === void 0 ? {} : { observed_model: input2.observedModel },
@@ -20500,6 +20886,7 @@ var HttpCollaborationClient = class {
         local_turn_id: input2.localTurnId,
         runtime_id: input2.runtimeId,
         based_on_sequence: input2.basedOnSequence,
+        ...input2.contentRevision === void 0 ? {} : { content_revision: input2.contentRevision },
         occurred_at: input2.occurredAt,
         ...input2.observedModel === void 0 ? {} : { observed_model: input2.observedModel },
         ...input2.observedReasoningEffort === void 0 ? {} : { observed_reasoning_effort: input2.observedReasoningEffort },
@@ -20553,9 +20940,9 @@ var HttpCollaborationClient = class {
     }));
     return fromWireSnapshotRequest(body.snapshot_request ?? body);
   }
-  async #request(path10, init = {}) {
+  async #request(path11, init = {}) {
     const signal = combineSignals(init.signal ?? void 0, this.#signal, AbortSignal.timeout(this.#requestTimeoutMs));
-    const response = await this.#fetch(`${this.#baseUrl}${path10}`, {
+    const response = await this.#fetch(`${this.#baseUrl}${path11}`, {
       ...init,
       redirect: "error",
       signal,
@@ -20606,6 +20993,7 @@ function toWireEvent(event) {
     visibility: event.visibility ?? "session",
     runtime_id: event.runtimeId ?? event.runtime?.runtimeId,
     claim_attempt: event.claimAttempt,
+    ...event.contentRevision === void 0 ? {} : { content_revision: event.contentRevision },
     observed_model: event.observedModel,
     observed_reasoning_effort: event.observedReasoningEffort
   };
@@ -20631,7 +21019,8 @@ function toWireRuntimeRegistration(runtime) {
     local_session_id: runtime.localSessionId,
     capture_fidelity: runtime.captureFidelity,
     ...runtime.capabilities === void 0 ? {} : { capabilities: [...runtime.capabilities] },
-    ...runtime.purpose === void 0 ? {} : { purpose: runtime.purpose }
+    ...runtime.purpose === void 0 ? {} : { purpose: runtime.purpose },
+    ...runtime.contextDeletionVersion === void 0 ? {} : { context_deletion_version: runtime.contextDeletionVersion }
   };
 }
 function validateContextReadInput(sessionId, view, throughSequence) {
@@ -20692,7 +21081,17 @@ function parseHistoryContext(value, expectedView, throughSequence) {
   if (items.some((item) => sourceIds.has(item.event_id))) {
     throw new Error("Collaboration API context repeats summarized sources");
   }
-  return { view: value.view, through_sequence: Number(value.through_sequence), items };
+  return {
+    view: value.view,
+    through_sequence: Number(value.through_sequence),
+    items,
+    ...value.content_revision === void 0 ? {} : { content_revision: requiredRevision(value.content_revision, "context.content_revision") }
+  };
+}
+function requiredRevision(value, label) {
+  if (!Number.isSafeInteger(value) || Number(value) < 0)
+    throw new Error(`Collaboration API returned invalid ${label}`);
+  return Number(value);
 }
 function isContextId(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
@@ -20711,9 +21110,17 @@ function fromWireEvent(value) {
     ...typeof input2.reply_to_event_id === "string" ? { replyTo: input2.reply_to_event_id } : {},
     timestamp: requiredString(input2.created_at, "event.created_at"),
     payload: input2.payload,
+    ...input2.content_revision === void 0 ? {} : { contentRevision: requiredRevision(input2.content_revision, "event.content_revision") },
+    ...input2.deleted === void 0 ? {} : { deleted: fromWireDeletion(input2.deleted) },
     ...runtime === void 0 ? {} : { runtime }
   };
 }
+function fromWireDeletion(value) {
+  const input2 = requiredObject(value);
+  if (input2.reason !== "author" && input2.reason !== "request" && input2.reason !== "summary_invalidated")
+    throw new Error("Collaboration API returned invalid event.deleted reason");
+  return { deletedAt: requiredString(input2.deleted_at, "event.deleted.deleted_at"), reason: input2.reason };
+}
 function fromWireSnapshotRequest(value) {
   const input2 = requiredObject(value);
   const status = requiredString(input2.status, "snapshot_request.status");
@@ -20749,6 +21156,7 @@ function fromWireSnapshotRequest(value) {
     kind,
     ...typeof input2.target_runtime_id === "string" ? { targetRuntimeId: input2.target_runtime_id } : {},
     throughSequence: requiredNumber(input2.through_sequence, "snapshot_request.through_sequence"),
+    ...input2.content_revision === void 0 ? {} : { contentRevision: requiredRevision(input2.content_revision, "snapshot_request.content_revision") },
     status,
     ...createdAt === void 0 ? {} : { createdAt },
     ..."result" in input2 ? { result: input2.result } : {},
@@ -20768,7 +21176,8 @@ function fromWireSession(value) {
     ...input2.state === "active" || input2.state === "archived" ? { state: input2.state } : {},
     ...name2 === void 0 ? {} : { name: name2 },
     ...role === void 0 ? {} : { role },
-    ...latestSequence === void 0 ? {} : { latestSequence }
+    ...latestSequence === void 0 ? {} : { latestSequence },
+    ...input2.content_revision === void 0 ? {} : { contentRevision: requiredRevision(input2.content_revision, "session.content_revision") }
   };
 }
 function fromWireProject(value) {
@@ -20815,7 +21224,8 @@ function fromWireRuntime(value) {
     ...input2.execution_profiles === void 0 || input2.execution_profiles === null ? {} : { executionProfiles: fromWireExecutionProfiles(input2.execution_profiles) },
     localSessionId: requiredString(input2.local_session_id, "runtime.local_session_id"),
     captureFidelity: requiredString(input2.capture_fidelity, "runtime.capture_fidelity"),
-    purpose
+    purpose,
+    ...input2.context_deletion_version === 1 ? { contextDeletionVersion: 1 } : {}
   };
 }
 function fromWireExecutionProfiles(value) {
@@ -20946,8 +21356,8 @@ function isObject2(value) {
 
 // ../adapters/dist/src/redaction.js
 var REDACTED = "[REDACTED]";
+var PRIVATE_KEY_PATTERN = /-----BEGIN (?:ENCRYPTED |RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:ENCRYPTED |RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----|$)/g;
 var DEFAULT_SECRET_PATTERNS = [
-  /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g,
   /\bAKIA[0-9A-Z]{16}\b/g,
   /\b(?:ghp|github_pat|glpat|sk|xox[baprs])[-_][A-Za-z0-9_-]{16,}\b/g,
   /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/gi,
@@ -20960,6 +21370,8 @@ var SENSITIVE_KEY_NAMES = /* @__PURE__ */ new Set([
   "accesstoken",
   "authtoken",
   "authorization",
+  "cookie",
+  "setcookie",
   "bearer",
   "clientsecret",
   "password",
@@ -20976,7 +21388,83 @@ var SENSITIVE_KEY_NAMES = /* @__PURE__ */ new Set([
 ]);
 function redactText(value, options = {}) {
   const replacement = options.replacement ?? REDACTED;
-  return [...DEFAULT_SECRET_PATTERNS, ...options.extraPatterns ?? []].reduce((redacted, pattern) => redacted.replace(cloneGlobal(pattern), (match, prefix) => typeof prefix === "string" && prefix.length < match.length ? `${prefix}${replacement}` : replacement), value);
+  return [...DEFAULT_SECRET_PATTERNS, ...options.extraPatterns ?? []].reduce(
+    (redacted, pattern) => redacted.replace(cloneGlobal(pattern), (match, prefix) => typeof prefix === "string" && prefix.length < match.length ? `${prefix}${replacement}` : replacement),
+    // Mask PEM first: scanning `private_key: -----BEGIN ...` as an ordinary
+    // assignment must not break its header and leave the following body public.
+    redactSensitiveFields(value.replace(cloneGlobal(PRIVATE_KEY_PATTERN), () => replacement), replacement)
+  );
+}
+function redactSensitiveFields(text, replacement) {
+  const fields = /("(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'|\b[A-Za-z_][A-Za-z0-9_.-]*)(\s*[:=]\s*)/gu;
+  const parts = [];
+  let retainedFrom = 0;
+  let match;
+  while ((match = fields.exec(text)) !== null) {
+    const encodedKey = match[1];
+    let key = encodedKey;
+    if (encodedKey.startsWith('"')) {
+      try {
+        key = JSON.parse(encodedKey);
+      } catch {
+        continue;
+      }
+    } else if (encodedKey.startsWith("'"))
+      key = encodedKey.slice(1, -1);
+    if (!isSensitiveKey(key))
+      continue;
+    const start = fields.lastIndex;
+    const end = sensitiveValueEnd(text, start, encodedKey[0] !== '"' && encodedKey[0] !== "'" && /^(?:authorization|cookie|set-cookie)$/iu.test(key));
+    const quote = text[start];
+    const masked = quote === "'" ? `'${replacement.replace(/\\/gu, "\\\\").replace(/'/gu, "\\'")}'` : quote === '"' || encodedKey.startsWith('"') ? JSON.stringify(replacement) : replacement;
+    parts.push(text.slice(retainedFrom, start), masked);
+    retainedFrom = end;
+    fields.lastIndex = end;
+  }
+  return parts.length === 0 ? text : parts.join("") + text.slice(retainedFrom);
+}
+function sensitiveValueEnd(text, start, header) {
+  if (header) {
+    const end = text.indexOf("\n", start);
+    return end < 0 ? text.length : end;
+  }
+  const first = text[start];
+  if (first === '"' || first === "'") {
+    for (let index2 = start + 1; index2 < text.length; index2++) {
+      if (text[index2] === "\\")
+        index2++;
+      else if (text[index2] === first)
+        return index2 + 1;
+    }
+    return text.length;
+  }
+  if (first === "{" || first === "[") {
+    const closing = [first === "{" ? "}" : "]"];
+    let quote;
+    for (let index2 = start + 1; index2 < text.length; index2++) {
+      const character = text[index2];
+      if (quote !== void 0) {
+        if (character === "\\")
+          index2++;
+        else if (character === quote)
+          quote = void 0;
+      } else if (character === '"' || character === "'")
+        quote = character;
+      else if (character === "{" || character === "[")
+        closing.push(character === "{" ? "}" : "]");
+      else if (character === "}" || character === "]") {
+        if (character !== closing.pop())
+          return text.length;
+        if (closing.length === 0)
+          return index2 + 1;
+      }
+    }
+    return text.length;
+  }
+  let index = start;
+  while (index < text.length && !/[\s,;}\]]/u.test(text[index]))
+    index++;
+  return index;
 }
 function redactValue(value, options = {}) {
   if (typeof value === "string")
@@ -20998,6 +21486,208 @@ function cloneGlobal(pattern) {
   return new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
 }
 
+// ../adapters/dist/src/live-output.js
+import { randomUUID } from "node:crypto";
+var MAX_ITEMS = 128;
+var MAX_INPUT_BYTES = 96 * 1024;
+var MAX_PUBLIC_BYTES = 24 * 1024;
+var MAX_PUBLICATIONS = 1200;
+function createLiveOutputPublisher(options) {
+  const items = /* @__PURE__ */ new Map();
+  const now = options.now ?? Date.now;
+  const intervalMs = options.intervalMs ?? 1500;
+  let lastPublished, publications = 0, closed = false;
+  let timer;
+  let queue = Promise.resolve();
+  let lastVisited;
+  const serial = (operation) => {
+    queue = queue.then(operation, operation);
+    return queue;
+  };
+  const itemFor = (key, kind, title) => {
+    let item = items.get(key);
+    if (!item && items.size < MAX_ITEMS) {
+      item = {
+        streamId: randomUUID(),
+        raw: "",
+        kind,
+        state: "running",
+        revision: 0,
+        acknowledged: "",
+        dirty: true,
+        truncated: false
+      };
+      items.set(key, item);
+    }
+    if (item && title !== void 0)
+      item.title = bound(redactText(title, options.redaction), 256);
+    return item;
+  };
+  const safe = (item) => {
+    let content = item.raw;
+    if (item.state === "running") {
+      content = content.replace(/(?:\bBearer\s+|\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|password|passwd|secret|token)["']?\s*[=:]\s*["']?)[^\n,;]*$/giu, "");
+      let end = content.length;
+      while (end > 0 && /[A-Za-z0-9_./~+=:@%\-]/u.test(content[end - 1]))
+        end--;
+      content = content.slice(0, end);
+    }
+    content = redactText(content, options.redaction);
+    return bound(content, MAX_PUBLIC_BYTES, item.truncated);
+  };
+  const signatureFor = (item) => JSON.stringify([safe(item), item.state, item.title, item.plan]);
+  const schedule = () => {
+    if (closed || options.schedule === false || timer || ![...items.values()].some((x) => x.dirty))
+      return;
+    timer = setTimeout(() => {
+      timer = void 0;
+      void flush().catch(() => void 0);
+    }, intervalMs);
+    timer.unref();
+  };
+  const publishOne = async (item) => {
+    if (!item.dirty || publications >= MAX_PUBLICATIONS)
+      return;
+    const content = safe(item);
+    const signature = JSON.stringify([content, item.state, item.title, item.plan]);
+    if (!item.pending && signature === item.acknowledged) {
+      item.dirty = false;
+      return;
+    }
+    if (!item.pending && !content.trim() && item.plan === void 0)
+      return;
+    const revision = item.revision + 1;
+    const update = {
+      id: `${item.streamId}:${revision}`,
+      content,
+      phase: "stream",
+      streamId: item.streamId,
+      streamMode: "snapshot",
+      streamKind: item.kind,
+      streamRevision: revision,
+      streamState: item.state,
+      ...item.title === void 0 ? {} : { title: item.title },
+      ...item.plan === void 0 ? {} : { plan: item.plan }
+    };
+    item.pending ??= { update, signature };
+    const pending = item.pending;
+    try {
+      if (await options.publish(pending.update) === false)
+        return;
+      item.revision = pending.update.streamRevision;
+      item.acknowledged = pending.signature;
+      delete item.pending;
+      item.dirty = signatureFor(item) !== item.acknowledged;
+      lastPublished = now();
+      publications++;
+    } catch {
+    }
+  };
+  const flush = () => serial(async () => {
+    if (closed || lastPublished !== void 0 && now() - lastPublished < intervalMs) {
+      schedule();
+      return;
+    }
+    const ordered = [...items.values()];
+    const start = lastVisited === void 0 ? 0 : (ordered.indexOf(lastVisited) + 1) % ordered.length;
+    for (let offset = 0; offset < ordered.length; offset++) {
+      const item = ordered[(start + offset) % ordered.length];
+      if (!item.dirty)
+        continue;
+      lastVisited = item;
+      await publishOne(item);
+      if (lastPublished !== void 0 && now() - lastPublished < intervalMs)
+        break;
+    }
+    schedule();
+  });
+  return {
+    async onDelta(key, delta, kind = "answer", title) {
+      if (closed || !delta)
+        return;
+      const item = itemFor(key, kind, title);
+      if (!item || item.state !== "running" || item.truncated)
+        return;
+      const raw = item.raw + delta;
+      item.raw = bound(raw, MAX_INPUT_BYTES);
+      item.truncated = Buffer.byteLength(raw) > MAX_INPUT_BYTES;
+      item.dirty = true;
+      await flush();
+    },
+    async onSnapshot(key, text, kind = "answer", title, state = "running") {
+      if (closed)
+        return;
+      const item = itemFor(key, kind, title);
+      if (!item)
+        return;
+      item.raw = bound(text, MAX_INPUT_BYTES);
+      item.truncated = Buffer.byteLength(text) > MAX_INPUT_BYTES;
+      item.state = state;
+      item.dirty = true;
+      await flush();
+    },
+    async onPlan(key, steps) {
+      if (closed)
+        return;
+      const item = itemFor(key, "plan");
+      if (!item)
+        return;
+      item.plan = steps.slice(0, 64).map((step) => ({ step: bound(redactText(step.step, options.redaction), 512), status: step.status }));
+      item.raw = item.plan.map((step) => `${step.status}: ${step.step}`).join("\n");
+      item.dirty = true;
+      await flush();
+    },
+    flush,
+    async finish(success2 = true) {
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+      await serial(async () => {
+        if (closed)
+          return;
+        for (const item of [...items.values()].slice(0, 64)) {
+          if (item.state === "running") {
+            item.state = success2 ? "completed" : "failed";
+            item.dirty = true;
+          }
+          await publishOne(item);
+          if (item.dirty && !item.pending)
+            await publishOne(item);
+        }
+        closed = true;
+        items.clear();
+      });
+    },
+    lastPublishedAt: () => lastPublished
+  };
+}
+function liveOutputPayload(update) {
+  return {
+    content: update.content,
+    phase: update.phase,
+    stream_id: update.streamId,
+    stream_mode: update.streamMode,
+    stream_kind: update.streamKind,
+    stream_revision: update.streamRevision,
+    stream_state: update.streamState,
+    ...update.title === void 0 ? {} : { title: update.title },
+    ...update.plan === void 0 ? {} : { plan: update.plan.map((step) => ({ step: step.step, status: step.status })) }
+  };
+}
+function bound(text, maxBytes, alreadyTruncated = false) {
+  if (!alreadyTruncated && Buffer.byteLength(text) <= maxBytes)
+    return text;
+  const suffix = "\n[TRUNCATED]";
+  const bytes2 = Buffer.from(text).subarray(0, maxBytes - Buffer.byteLength(suffix));
+  let end = bytes2.length;
+  while (end > 0 && (bytes2[end - 1] & 192) === 128)
+    end--;
+  if (end < bytes2.length || (bytes2[end - 1] & 128) !== 0)
+    end = Math.max(0, end - 1);
+  return bytes2.subarray(0, end).toString("utf8") + suffix;
+}
+
 // ../adapters/dist/src/jsonl.js
 var DEFAULT_MAX_READ_BYTES = 4 * 1024 * 1024;
 
@@ -21204,7 +21894,7 @@ function isNodeError(error62) {
 var MAX_FRAME_BYTES = 1024 * 1024;
 
 // ../bridge/dist/src/code-sync.js
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { execFile } from "node:child_process";
 import { constants } from "node:fs";
 import { chmod as chmod2, lstat as lstat2, mkdir as mkdir2, open as open3, readFile as readFile2, realpath, rename, unlink } from "node:fs/promises";
@@ -21228,10 +21918,14 @@ var ProjectCodeSync = class _ProjectCodeSync {
   #apiUrl;
   #root = "";
   #stateRoot = "";
+  #lockRoot = "";
   #initialized;
   #stableDigest = "";
   #stableSince = 0;
   #lastAutomaticAttempt = 0;
+  get #limits() {
+    return this.#options.storage?.limits ?? CLOUD_CODE_SYNC_LIMITS;
+  }
   constructor(options) {
     const url2 = new URL(options.apiUrl);
     if (url2.username || url2.password || url2.search || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) {
@@ -21265,6 +21959,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
       this.#root = path2.join(await realpath(path2.dirname(requestedRoot)), path2.basename(requestedRoot));
     }
     this.#stateRoot = this.#options.stateRoot ?? path2.join(homedir2(), ".gatherthread", "code-sync", digest(this.#root));
+    const sharedRoot = this.#stateRoot;
+    if (this.#options.storage)
+      this.#stateRoot = path2.join(this.#stateRoot, digest(this.#options.storage.key));
     if (isWithin(this.#root, path2.resolve(this.#stateRoot)))
       throw new CodeSyncError("code_sync_binding", "Code sync state must stay outside source files.");
     await mkdir2(this.#stateRoot, { recursive: true, mode: 448 });
@@ -21274,6 +21971,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
     if (isWithin(this.#root, this.#stateRoot))
       throw new CodeSyncError("code_sync_binding", "Private code sync state resolves inside source files.");
     await chmod2(this.#stateRoot, 448);
+    this.#lockRoot = await realpath(sharedRoot);
     await this.#locked(async () => {
       const inventoryPath = path2.join(this.#stateRoot, "inventory.git");
       try {
@@ -21284,6 +21982,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
           throw error62;
       }
       await git(["init", "--bare", "--quiet", inventoryPath], this.#stateRoot);
+      await this.#options.storage?.initialize(this.#stateRoot);
       const filename = path2.join(this.#stateRoot, "binding.json");
       try {
         await this.#readBinding();
@@ -21297,7 +21996,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
           actor_id: this.#options.actorId,
           workspace_path: this.#root,
           base_commit: null,
-          automatic_upload: false,
+          // GitHub authorization is an explicit local action. New GitHub
+          // bindings follow settled source edits automatically thereafter.
+          automatic_upload: this.#options.storage?.metadata.provider === "github",
           baseline: {}
         }));
       }
@@ -21348,7 +22049,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
         idempotency_key: `code-upload-${digest(JSON.stringify([this.#options.projectId, this.#options.actorId, uploadBase, inventory.hashes]))}`
       };
       await this.#requireWorkspace();
-      const parsed = CodeMutationResultSchema.safeParse(await this.#request("/checkpoints", body));
+      const parsed = CodeMutationResultSchema.safeParse(this.#options.storage ? await this.#options.storage.checkpoint(body) : await this.#request("/checkpoints", body));
       if (!parsed.success)
         throw invalidResponse();
       const verified = await this.#snapshot(parsed.data.status);
@@ -21383,13 +22084,13 @@ var ProjectCodeSync = class _ProjectCodeSync {
       if (!sameHashes(current.hashes, binding.baseline))
         throw new CodeSyncError("code_sync_dirty", "Local files have unuploaded changes. Upload first, or recover cloud code into a new folder.");
       await applySnapshot(this.#root, snapshot.files, binding.baseline, {
-        backupRoot: path2.join(this.#stateRoot, "download-backups", randomUUID()),
+        backupRoot: path2.join(this.#stateRoot, "download-backups", randomUUID2()),
         beforeWrite: async () => {
           binding.interrupted_download = true;
           await this.#save(binding);
         },
         baselineExecutables: new Set(binding.executable_paths ?? [])
-      });
+      }, this.#limits);
       const verified = await this.#inventory(new Set(snapshot.files.filter((file2) => file2.executable).map((file2) => file2.path)));
       if (!sameHashes(verified.hashes, nextHashes))
         throw new CodeSyncError("code_sync_conflict", "Local files changed during download. Check the workspace before retrying.");
@@ -21427,14 +22128,28 @@ var ProjectCodeSync = class _ProjectCodeSync {
       const recoveryStem = [...path2.basename(this.#root)];
       while (Buffer.byteLength(recoveryStem.join("")) > 180)
         recoveryStem.pop();
-      const recoveryName = `${recoveryStem.join("")}-recovered-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/gu, "").slice(0, 14)}-${randomUUID().slice(0, 8)}`;
+      const recoveryName = `${recoveryStem.join("")}-recovered-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/gu, "").slice(0, 14)}-${randomUUID2().slice(0, 8)}`;
       const recoveryPath = path2.join(path2.dirname(this.#root), recoveryName);
       await mkdir2(recoveryPath, { mode: 448 });
-      await applySnapshot(recoveryPath, snapshot.files, {});
+      await applySnapshot(recoveryPath, snapshot.files, {}, void 0, this.#limits);
       const restored = new _ProjectCodeSync({
         ...this.#options,
         workspacePath: recoveryPath,
-        stateRoot: path2.join(path2.dirname(this.#stateRoot), digest(recoveryPath))
+        ...this.#options.stateRoot ? { stateRoot: path2.join(path2.dirname(this.#options.stateRoot), digest(recoveryPath)) } : {},
+        // The transport has private mutable Git state; recovery only seeds the
+        // baseline and does not need another transport initialization here.
+        ...this.#options.storage ? { storage: {
+          ...this.#options.storage,
+          key: this.#options.storage.key,
+          limits: this.#limits,
+          metadata: this.#options.storage.metadata,
+          initialize: async () => {
+          },
+          status: () => this.#cloudStatus(),
+          snapshot: (status) => this.#snapshot(status),
+          checkpoint: (input2) => this.#options.storage.checkpoint(input2),
+          update: () => this.#options.storage.update()
+        } } : {}
       });
       await restored.initialize();
       await restored.#locked(async () => {
@@ -21460,7 +22175,18 @@ var ProjectCodeSync = class _ProjectCodeSync {
     await this.initialize();
     return this.#locked(async () => {
       const binding = await this.#readBinding();
-      const cloud = await this.#cloudStatus();
+      if (!enabled) {
+        binding.automatic_upload = false;
+        await this.#save(binding);
+      }
+      let cloud;
+      try {
+        cloud = await this.#cloudStatus();
+      } catch (error62) {
+        if (enabled)
+          throw error62;
+        return { ...this.#status(binding, { repository: { enabled: false, main_commit: null }, branches: [], own_branch_id: null }, { files: [], hashes: binding.baseline, excluded: 0 }), local_status_unknown: true };
+      }
       if (enabled)
         assertEnabled(cloud);
       binding.automatic_upload = enabled;
@@ -21505,7 +22231,12 @@ var ProjectCodeSync = class _ProjectCodeSync {
     return this.#upload(inventory.hashes);
   }
   async execute(kind, { busy = false, operationId } = {}) {
-    if (busy && ["code_upload", "code_download", "code_recover", "code_auto_upload_enable"].includes(kind)) {
+    if (kind.startsWith("github_") !== (this.#options.storage?.metadata.provider === "github")) {
+      throw new CodeSyncError("code_sync_unsupported", "The requested action belongs to a different code provider.");
+    }
+    if (kind.startsWith("github_"))
+      kind = kind.slice(7);
+    if (busy && ["code_upload", "code_download", "code_recover", "code_auto_upload_enable", "code_update"].includes(kind)) {
       throw new CodeSyncError("code_sync_busy", "An Agent is working in this workspace. Wait until it finishes before syncing code.");
     }
     switch (kind) {
@@ -21521,11 +22252,26 @@ var ProjectCodeSync = class _ProjectCodeSync {
         return this.setAutomaticUpload(true);
       case "code_auto_upload_disable":
         return this.setAutomaticUpload(false);
+      case "code_update": {
+        await this.initialize();
+        if (!this.#options.storage)
+          throw new CodeSyncError("code_sync_unsupported", "Use the cloud review controls to update this branch.");
+        return this.#locked(async () => {
+          const binding = await this.#readBinding();
+          const inventory = await this.#inventory();
+          if (!sameHashes(binding.baseline, inventory.hashes)) {
+            throw new CodeSyncError("code_sync_dirty", "Local source files have unuploaded changes. Upload them or recover the remote version before updating your GitHub branch.");
+          }
+          return this.#status(binding, await this.#options.storage.update(), inventory);
+        });
+      }
       default:
         throw new CodeSyncError("code_sync_unsupported", "Unsupported code sync action.");
     }
   }
   async #cloudStatus() {
+    if (this.#options.storage)
+      return this.#options.storage.status();
     const parsed = CodeStatusSchema.safeParse(await this.#request(""));
     if (!parsed.success)
       throw invalidResponse();
@@ -21534,6 +22280,8 @@ var ProjectCodeSync = class _ProjectCodeSync {
   async #snapshot(cloud) {
     if (!cloud.repository.main_commit && !cloud.own_branch_id)
       throw new CodeSyncError("code_sync_empty", "No code has been uploaded yet.");
+    if (this.#options.storage)
+      return this.#options.storage.snapshot(cloud);
     const parsed = CodeSnapshotResultSchema.safeParse(await this.#request(`/snapshot?branch_id=${encodeURIComponent(cloud.own_branch_id ?? "main")}`));
     if (!parsed.success)
       throw invalidResponse();
@@ -21542,6 +22290,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
   #status(binding, cloud, inventory) {
     const cloudCommit = cloud.branches.find((branch) => branch.id === cloud.own_branch_id)?.head_commit ?? cloud.repository.main_commit;
     return {
+      ...this.#options.storage?.metadata,
       enabled: cloud.repository.enabled,
       automatic_upload: binding.automatic_upload,
       local_changes: changedCount(binding.baseline, inventory.hashes),
@@ -21609,7 +22358,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
   async #readBinding() {
     const file2 = path2.join(this.#stateRoot, "binding.json");
     const info = await lstat2(file2);
-    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_BINDING_BYTES)
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_BINDING_BYTES * (this.#options.storage ? 10 : 1))
       throw new CodeSyncError("code_sync_binding", "Private code sync state is not a regular bounded file.");
     let binding;
     try {
@@ -21624,13 +22373,13 @@ var ProjectCodeSync = class _ProjectCodeSync {
     }
     if (binding.interrupted_download !== void 0 && typeof binding.interrupted_download !== "boolean")
       throw new CodeSyncError("code_sync_binding", "Private download recovery state is invalid.");
-    if (binding.executable_paths !== void 0 && (!Array.isArray(binding.executable_paths) || binding.executable_paths.length > CODE_SYNC_MAX_FILES || binding.executable_paths.some((name2) => typeof name2 !== "string" || !isCodeSyncPathAllowed(name2))))
+    if (binding.executable_paths !== void 0 && (!Array.isArray(binding.executable_paths) || binding.executable_paths.length > this.#limits.maxFiles || binding.executable_paths.some((name2) => typeof name2 !== "string" || !isCodeSyncPathAllowed(name2))))
       throw new CodeSyncError("code_sync_binding", "Private code file-mode state is invalid.");
     const baseline = Object.entries(binding.baseline);
-    if (baseline.length > CODE_SYNC_MAX_FILES)
+    if (baseline.length > this.#limits.maxFiles)
       throw new CodeSyncError("code_sync_binding", "Private code sync baseline exceeds the file limit.");
-    for (const [name2, hash2] of baseline) {
-      if (!isCodeSyncPathAllowed(name2) || typeof hash2 !== "string" || !/^[a-f0-9]{64}$/u.test(hash2))
+    for (const [name2, hash3] of baseline) {
+      if (!isCodeSyncPathAllowed(name2) || typeof hash3 !== "string" || !/^[a-f0-9]{64}$/u.test(hash3))
         throw new CodeSyncError("code_sync_binding", "Private code sync baseline is invalid.");
     }
     return binding;
@@ -21663,19 +22412,23 @@ var ProjectCodeSync = class _ProjectCodeSync {
     const nativeExecutables = /* @__PURE__ */ new Set();
     let candidates;
     let nativeRoot = "";
+    const inventoryOutputLimit = this.#options.storage ? this.#limits.maxFiles * 2100 : 2 * 1024 * 1024;
     try {
       nativeRoot = (await git(["rev-parse", "--show-toplevel"], this.#root)).trim();
     } catch {
     }
     if (nativeRoot && await realpath(nativeRoot) === this.#root) {
-      const trackedEntries = (await git(["ls-files", "--stage", "-z"], this.#root)).split("\0").filter(Boolean);
+      const trackedEntries = (await git(["ls-files", "--stage", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean);
       tracked = new Set(trackedEntries.map((entry) => entry.slice(entry.indexOf("	") + 1)));
+      if (this.#options.storage?.metadata.provider === "github" && trackedEntries.some((entry) => !/^(?:100644|100755) /u.test(entry))) {
+        throw new CodeSyncError("code_sync_unsupported", "Tracked links or submodules cannot be synchronized to GitHub. Remove them from the native Git index or use native Git.");
+      }
       for (const entry of trackedEntries)
         if (entry.startsWith("100755 "))
           nativeExecutables.add(entry.slice(entry.indexOf("	") + 1));
-      candidates = [...tracked, ...(await git(["ls-files", "--others", "--exclude-standard", "-z"], this.#root)).split("\0").filter(Boolean)];
+      candidates = [...tracked, ...(await git(["ls-files", "--others", "--exclude-standard", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean)];
     } else {
-      candidates = (await git([`--git-dir=${path2.join(this.#stateRoot, "inventory.git")}`, `--work-tree=${this.#root}`, "ls-files", "--others", "--exclude-standard", "-z"], this.#root)).split("\0").filter(Boolean);
+      candidates = (await git([`--git-dir=${path2.join(this.#stateRoot, "inventory.git")}`, `--work-tree=${this.#root}`, "ls-files", "--others", "--exclude-standard", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean);
     }
     const binding = await this.#readBinding();
     const executablePaths = executableHints ?? new Set(binding.executable_paths ?? []);
@@ -21688,6 +22441,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
     let totalBytes = 0;
     for (const name2 of [...new Set(candidates)].sort()) {
       if (!isCodeSyncPathAllowed(name2) || BUILD_PATH.test(name2)) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2)) {
+          throw new CodeSyncError("code_sync_unsupported", "A tracked private, unsafe or generated path cannot be synchronized to GitHub. Remove it from the native Git index or use native Git.");
+        }
         if (tracked.has(name2) && !BUILD_PATH.test(name2))
           throw new CodeSyncError("code_sync_secret", "A tracked private or unsafe file is excluded from code sync. Remove it from version control before uploading.");
         excluded += 1;
@@ -21695,6 +22451,8 @@ var ProjectCodeSync = class _ProjectCodeSync {
       }
       const target = path2.join(this.#root, ...name2.split("/"));
       if (!await safeAncestors(this.#root, name2)) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2))
+          throw new CodeSyncError("code_sync_unsupported", "A tracked path crosses a link or unsafe directory. Use native Git after reviewing it.");
         excluded += 1;
         continue;
       }
@@ -21707,26 +22465,28 @@ var ProjectCodeSync = class _ProjectCodeSync {
         throw error62;
       }
       if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2))
+          throw new CodeSyncError("code_sync_unsupported", "A tracked link or non-regular file cannot be synchronized to GitHub. Use native Git after reviewing it.");
         excluded += 1;
         continue;
       }
-      if (info.size > CODE_SYNC_MAX_FILE_BYTES)
-        throw new CodeSyncError("code_sync_limit", "A source file exceeds the 2 MiB code sync limit.");
-      const source = await readBoundedSource(target);
-      const bytes = source.bytes;
-      if (containsCodeSyncSecret(bytes.toString("utf8")))
+      if (info.size > this.#limits.maxFileBytes)
+        throw new CodeSyncError("code_sync_limit", "A source file exceeds the selected provider's file limit.");
+      const source = await readBoundedSource(target, this.#limits.maxFileBytes);
+      const bytes2 = source.bytes;
+      if (containsCodeSyncSecret(bytes2.toString("utf8")))
         throw new CodeSyncError("code_sync_secret", "A source file contains a recognizable credential or private key. Remove it before uploading.");
-      totalBytes += bytes.byteLength;
-      if (totalBytes > CODE_SYNC_MAX_SNAPSHOT_BYTES || files.length >= CODE_SYNC_MAX_FILES)
-        throw new CodeSyncError("code_sync_limit", "Code sync is limited to 1,000 files and 8 MiB per checkpoint.");
-      files.push({ path: name2, content_base64: bytes.toString("base64"), executable: process.platform === "win32" ? executablePaths.has(name2) || nativeExecutables.has(name2) : source.executable });
+      totalBytes += bytes2.byteLength;
+      if (totalBytes > this.#limits.maxSnapshotBytes || files.length >= this.#limits.maxFiles)
+        throw new CodeSyncError("code_sync_limit", "Source files exceed the selected provider's checkpoint limit.");
+      files.push({ path: name2, content_base64: bytes2.toString("base64"), executable: process.platform === "win32" ? executablePaths.has(name2) || nativeExecutables.has(name2) : source.executable });
     }
-    if (!CodeFilesSchema.safeParse(files).success)
+    if (!createCodeFilesSchema(this.#limits).safeParse(files).success)
       throw new CodeSyncError("code_sync_unsafe_path", "Source files contain non-portable or conflicting paths.");
     return { files, hashes: fileHashes(files), excluded };
   }
   async #locked(operation) {
-    const lockPath = path2.join(this.#stateRoot, "operation.lock");
+    const lockPath = path2.join(this.#lockRoot, "operation.lock");
     let handle;
     try {
       handle = await open3(lockPath, "wx", 384);
@@ -21798,14 +22558,14 @@ function isWithin(root, target) {
   const relative = path2.relative(root, target);
   return !relative || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
 }
-async function git(args, cwd) {
+async function git(args, cwd, maxBuffer = 2 * 1024 * 1024) {
   const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_") && !key.startsWith("GATHERTHREAD_")));
   try {
     const result = await execFileAsync("git", ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], {
       cwd,
       env: { ...env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null", GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" },
       timeout: 15e3,
-      maxBuffer: 2 * 1024 * 1024,
+      maxBuffer,
       encoding: "utf8",
       windowsHide: true
     });
@@ -21815,7 +22575,7 @@ async function git(args, cwd) {
   }
 }
 async function writePrivate(filename, content) {
-  const temporary = `${filename}.${randomUUID()}.tmp`;
+  const temporary = `${filename}.${randomUUID2()}.tmp`;
   const handle = await open3(temporary, "wx", 384);
   try {
     await handle.writeFile(content);
@@ -21844,7 +22604,7 @@ async function safeAncestors(root, relative, create = false) {
   }
   return true;
 }
-async function fileHash(root, name2, executableHint) {
+async function fileHash(root, name2, executableHint, maxBytes = CODE_SYNC_MAX_FILE_BYTES) {
   if (!await safeAncestors(root, name2))
     throw new CodeSyncError("code_sync_unsafe_path", "A destination directory is a symbolic link or not a directory.");
   const target = path2.join(root, ...name2.split("/"));
@@ -21856,17 +22616,17 @@ async function fileHash(root, name2, executableHint) {
       return;
     throw error62;
   }
-  if (!info.isFile() || info.isSymbolicLink() || info.size > CODE_SYNC_MAX_FILE_BYTES)
+  if (!info.isFile() || info.isSymbolicLink() || info.size > maxBytes)
     throw new CodeSyncError("code_sync_unsafe_path", "A destination is not a bounded regular source file.");
-  const source = await readBoundedSource(target);
+  const source = await readBoundedSource(target, maxBytes);
   const executable = process.platform === "win32" && executableHint !== void 0 ? executableHint : source.executable;
   return digest(`${executable ? "1" : "0"}\0${source.bytes.toString("base64")}`);
 }
-async function readBoundedSource(filename) {
+async function readBoundedSource(filename, maxBytes = CODE_SYNC_MAX_FILE_BYTES) {
   const handle = await open3(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const before = await handle.stat();
-    if (!before.isFile() || before.nlink !== 1 || before.size > CODE_SYNC_MAX_FILE_BYTES)
+    if (!before.isFile() || before.nlink !== 1 || before.size > maxBytes)
       throw new CodeSyncError("code_sync_unsafe_path", "A source path is not a bounded regular file.");
     const buffer = Buffer.alloc(before.size + 1);
     const result = await handle.read(buffer, 0, buffer.length, 0);
@@ -21878,18 +22638,18 @@ async function readBoundedSource(filename) {
     await handle.close();
   }
 }
-async function applySnapshot(root, files, baseline, options) {
-  if (!CodeFilesSchema.safeParse(files).success)
+async function applySnapshot(root, files, baseline, options, limits = CLOUD_CODE_SYNC_LIMITS) {
+  if (!createCodeFilesSchema(limits).safeParse(files).success)
     throw new CodeSyncError("code_sync_unsafe_path", "Cloud code contains unsafe paths.");
   const names = /* @__PURE__ */ new Set([...Object.keys(baseline), ...files.map((file2) => file2.path)]);
   for (const name2 of names) {
-    if (await fileHash(root, name2, options?.baselineExecutables?.has(name2)) !== baseline[name2])
+    if (await fileHash(root, name2, options?.baselineExecutables?.has(name2), limits.maxFileBytes) !== baseline[name2])
       throw new CodeSyncError("code_sync_dirty", "Cloud code would overwrite local or ignored files. Recover into a new folder instead.");
   }
   if (options) {
     await mkdir2(options.backupRoot, { recursive: true, mode: 448 });
     for (const name2 of Object.keys(baseline)) {
-      const source = await readBoundedSource(path2.join(root, ...name2.split("/")));
+      const source = await readBoundedSource(path2.join(root, ...name2.split("/")), limits.maxFileBytes);
       if (process.platform === "win32" && options.baselineExecutables)
         source.executable = options.baselineExecutables.has(name2);
       if (digest(`${source.executable ? "1" : "0"}\0${source.bytes.toString("base64")}`) !== baseline[name2])
@@ -21908,10 +22668,10 @@ async function applySnapshot(root, files, baseline, options) {
   }
   const targetNames = new Set(files.map((file2) => file2.path));
   for (const file2 of files) {
-    if (!await safeAncestors(root, file2.path, true) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path)) !== baseline[file2.path])
+    if (!await safeAncestors(root, file2.path, true) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path), limits.maxFileBytes) !== baseline[file2.path])
       throw new CodeSyncError("code_sync_busy", "Local files changed during download. No further files were applied.");
     const filename = path2.join(root, ...file2.path.split("/"));
-    const temporary = path2.join(path2.dirname(filename), `.gatherthread-${randomUUID()}.tmp`);
+    const temporary = path2.join(path2.dirname(filename), `.gatherthread-${randomUUID2()}.tmp`);
     const handle = await open3(temporary, "wx", file2.executable ? 448 : 384);
     try {
       await handle.writeFile(Buffer.from(file2.content_base64, "base64"));
@@ -21919,7 +22679,7 @@ async function applySnapshot(root, files, baseline, options) {
     } finally {
       await handle.close();
     }
-    if (!await safeAncestors(root, file2.path) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path)) !== baseline[file2.path]) {
+    if (!await safeAncestors(root, file2.path) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path), limits.maxFileBytes) !== baseline[file2.path]) {
       await unlink(temporary);
       throw new CodeSyncError("code_sync_busy", "Source files changed while preparing a download. Original files were backed up; no further files were applied.");
     }
@@ -21927,55 +22687,442 @@ async function applySnapshot(root, files, baseline, options) {
   }
   for (const name2 of Object.keys(baseline)) {
     if (!targetNames.has(name2)) {
-      if (await fileHash(root, name2, options?.baselineExecutables?.has(name2)) !== baseline[name2])
+      if (await fileHash(root, name2, options?.baselineExecutables?.has(name2), limits.maxFileBytes) !== baseline[name2])
         throw new CodeSyncError("code_sync_busy", "Local files changed during download. No further files were applied.");
       await unlink(path2.join(root, ...name2.split("/")));
     }
   }
 }
 
+// ../bridge/dist/src/github-code-sync.js
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat3, mkdir as mkdir3, open as open4, unlink as unlink2 } from "node:fs/promises";
+import path3 from "node:path";
+var hash2 = (text) => createHash3("sha256").update(text).digest("hex");
+var Commit2 = /^[a-f0-9]{40}$/u;
+var filesSchema = createCodeFilesSchema(GITHUB_CODE_SYNC_LIMITS);
+var generatedPath = /(?:^|\/)(?:node_modules|dist|build|coverage|\.next|\.cache|\.turbo|\.venv|venv|__pycache__)(?:\/|$)/u;
+function createGitHubCodeSync(options, runner = runGitHubGit) {
+  return new ProjectCodeSync({ ...options, storage: new GitHubCodeStorage(options, runner) });
+}
+var GitHubCodeStorage = class {
+  limits = GITHUB_CODE_SYNC_LIMITS;
+  key;
+  metadata;
+  #options;
+  #run;
+  #remote;
+  #branchId;
+  #directory = "";
+  #revision;
+  constructor(options, runner) {
+    if (!GitHubConnectionSchema.safeParse({ repository: options.repository, base_branch: options.baseBranch, revision: options.revision, enabled: true }).success) {
+      throw new CodeSyncError("code_sync_binding", "GitHub requires an owner/repository and a valid base branch.");
+    }
+    const branch = `gatherthread/${hash2(options.projectId).slice(0, 24)}/${hash2(options.actorId).slice(0, 24)}`;
+    if (options.baseBranch.startsWith("gatherthread/"))
+      throw new CodeSyncError("code_sync_binding", "Choose a base branch outside GatherThread personal branches.");
+    this.#options = options;
+    this.#run = runner;
+    this.#revision = options.revision;
+    this.#remote = `https://github.com/${options.repository}.git`;
+    this.#branchId = `branch-${hash2(branch).slice(0, 24)}`;
+    this.key = JSON.stringify(["github", options.apiUrl.replace(/\/$/u, "").replace(/\/v1$/u, ""), options.projectId, options.actorId, options.repository.toLowerCase(), options.baseBranch, options.revision]);
+    this.metadata = { provider: "github", repository: options.repository, branch, base_branch: options.baseBranch };
+  }
+  async initialize(privateDirectory) {
+    this.#directory = path3.join(privateDirectory, "github.git");
+    try {
+      if ((await lstat3(this.#directory)).isSymbolicLink())
+        throw new CodeSyncError("code_sync_binding", "Private GitHub state cannot be a symbolic link.");
+    } catch (error62) {
+      if (error62.code !== "ENOENT")
+        throw error62;
+    }
+    await mkdir3(this.#directory, { recursive: true, mode: 448 });
+    await this.#git(["init", "--bare", "--quiet", "."]);
+    const info = path3.join(this.#directory, "info");
+    await mkdir3(info, { recursive: true, mode: 448 });
+    if ((await lstat3(info)).isSymbolicLink())
+      throw new CodeSyncError("code_sync_binding", "Private GitHub attributes directory is unsafe.");
+    const attributes = await open4(path3.join(info, "attributes"), constants2.O_WRONLY | constants2.O_CREAT | (constants2.O_NOFOLLOW ?? 0), 384);
+    try {
+      if (!(await attributes.stat()).isFile() || (await attributes.stat()).nlink !== 1)
+        throw new CodeSyncError("code_sync_binding", "Private GitHub attributes must be a regular file.");
+      await attributes.truncate(0);
+      await attributes.writeFile("* conflict-marker-size=7\n");
+    } finally {
+      await attributes.close();
+    }
+  }
+  async #authorize() {
+    const url2 = new URL(this.#options.apiUrl);
+    url2.pathname = url2.pathname.replace(/\/$/u, "").replace(/\/v1$/u, "") + `/v1/projects/${encodeURIComponent(this.#options.projectId)}/github`;
+    let response;
+    try {
+      response = await (this.#options.fetch ?? fetch)(url2.toString(), {
+        headers: { authorization: `Bearer ${this.#options.token}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new CodeSyncError("code_sync_unavailable", "GatherThread could not verify current GitHub project access.");
+    }
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new CodeSyncError("code_sync_forbidden", "Current GatherThread project access is required for GitHub synchronization.");
+    }
+    if (!response.body)
+      throw new CodeSyncError("code_sync_unavailable", "Invalid GitHub configuration response.");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (; ; ) {
+      const part = await reader.read();
+      if (part.done)
+        break;
+      size += part.value.length;
+      if (size > 16384) {
+        await reader.cancel();
+        throw new CodeSyncError("code_sync_limit", "GitHub configuration response is too large.");
+      }
+      chunks.push(part.value);
+    }
+    let data;
+    try {
+      data = GitHubProjectStatusSchema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8")).data);
+    } catch {
+      throw new CodeSyncError("code_sync_unavailable", "Invalid GitHub configuration response.");
+    }
+    const connection = data.connection;
+    if (!data.can_write || data.branch !== this.metadata.branch || !connection || connection.repository.toLowerCase() !== this.#options.repository.toLowerCase() || connection.base_branch !== this.#options.baseBranch) {
+      throw new CodeSyncError("code_sync_binding", "GitHub target or project permissions changed. Review the connection and authorize it locally again.");
+    }
+    if (!connection.enabled)
+      return false;
+    if (this.#revision !== connection.revision)
+      throw new CodeSyncError("code_sync_binding", "GitHub configuration changed. Reconnect and authorize the current target locally again.");
+    return true;
+  }
+  async #enabled() {
+    if (!await this.#authorize())
+      throw new CodeSyncError("code_sync_disabled", "GitHub synchronization is paused for this project.");
+  }
+  async status() {
+    if (!await this.#authorize())
+      return { repository: { enabled: false, main_commit: null }, branches: [], own_branch_id: null };
+    const refs = (await this.#git(["ls-remote", "--refs", this.#remote, `refs/heads/${this.#options.baseBranch}`, `refs/heads/${this.metadata.branch}`])).toString("utf8");
+    let main = null;
+    let own2 = null;
+    for (const line of refs.trim().split("\n")) {
+      const [oid, ref] = line.split("	");
+      if (!oid || !Commit2.test(oid))
+        continue;
+      if (ref === `refs/heads/${this.#options.baseBranch}`)
+        main = oid;
+      if (ref === `refs/heads/${this.metadata.branch}`)
+        own2 = oid;
+    }
+    return {
+      repository: { enabled: true, main_commit: main },
+      own_branch_id: own2 ? this.#branchId : null,
+      branches: own2 ? [{ id: this.#branchId, name: "My GitHub branch", user_id: this.#options.actorId, head_commit: own2, review_status: "draft" }] : []
+    };
+  }
+  #head(status) {
+    return status.branches[0]?.head_commit ?? status.repository.main_commit;
+  }
+  async #fetch(status) {
+    await this.#enabled();
+    const refs = [];
+    if (status.repository.main_commit)
+      refs.push(`+refs/heads/${this.#options.baseBranch}:refs/gt/base`);
+    if (status.own_branch_id)
+      refs.push(`+refs/heads/${this.metadata.branch}:refs/gt/own`);
+    if (refs.length)
+      await this.#git(["fetch", "--quiet", "--no-tags", "--no-recurse-submodules", this.#remote, ...refs]);
+    for (const [ref, expected] of [["refs/gt/base", status.repository.main_commit], ["refs/gt/own", status.branches[0]?.head_commit]]) {
+      if (expected && (await this.#git(["rev-parse", "--verify", ref])).toString().trim() !== expected)
+        throw conflict();
+    }
+  }
+  async snapshot(status) {
+    const commit = this.#head(status);
+    if (!commit)
+      throw new CodeSyncError("code_sync_empty", "No GitHub files have been uploaded yet.");
+    await this.#fetch(status);
+    return { commit, files: await this.#files(commit) };
+  }
+  async #files(commit) {
+    if (!Commit2.test(commit))
+      throw conflict();
+    const listing = await this.#git(["ls-tree", "-r", "-z", "-l", commit]);
+    if (!Buffer.from(listing.toString("utf8"), "utf8").equals(listing))
+      throw new CodeSyncError("code_sync_unsafe_path", "The GitHub tree contains non-UTF-8 filenames. Use native Git for this repository.");
+    const entries = listing.toString("utf8").split("\0").filter(Boolean).map((entry) => {
+      const match = /^(100644|100755) blob ([a-f0-9]{40})\s+(\d+)\t(.+)$/u.exec(entry);
+      if (!match)
+        throw new CodeSyncError("code_sync_unsupported", "This GitHub tree contains unsupported links, submodules or paths. Use native Git for this repository.");
+      return { mode: match[1], oid: match[2], size: Number(match[3]), path: match[4] };
+    });
+    if (entries.length > this.limits.maxFiles || entries.some((entry) => entry.size > this.limits.maxFileBytes) || entries.reduce((sum, entry) => sum + entry.size, 0) > this.limits.maxSnapshotBytes)
+      throw new CodeSyncError("code_sync_limit", "GitHub source exceeds the supported checkpoint limit. Use native Git for larger trees.");
+    const output2 = entries.length ? await this.#git(["cat-file", "--batch"], Buffer.from(entries.map((entry) => entry.oid).join("\n") + "\n")) : Buffer.alloc(0);
+    let offset = 0;
+    const files = [];
+    for (const entry of entries) {
+      const end = output2.indexOf(10, offset);
+      if (end < 0 || output2.subarray(offset, end).toString() !== `${entry.oid} blob ${entry.size}`)
+        throw conflict();
+      const content = output2.subarray(end + 1, end + 1 + entry.size);
+      offset = end + 2 + entry.size;
+      if (content.length !== entry.size || output2[offset - 1] !== 10)
+        throw conflict();
+      if (generatedPath.test(entry.path) || containsCodeSyncSecret(content.toString("utf8")) || content.subarray(0, 80).toString().startsWith("version https://git-lfs.github.com/spec/v1")) {
+        throw new CodeSyncError("code_sync_unsupported", "This GitHub tree contains excluded generated files, credentials or Git LFS pointers. Nothing was applied; use native Git or a source-only repository.");
+      }
+      files.push({ path: entry.path, content_base64: content.toString("base64"), executable: entry.mode === "100755" });
+    }
+    if (!filesSchema.safeParse(files).success)
+      throw new CodeSyncError("code_sync_unsafe_path", "The GitHub tree contains non-portable or private paths. Nothing was applied.");
+    return files;
+  }
+  async #tree(files) {
+    if (!filesSchema.safeParse(files).success)
+      throw new CodeSyncError("code_sync_limit", "Source tree exceeds GitHub checkpoint limits.");
+    const index = path3.join(this.#directory, `index-${randomUUID3()}`);
+    try {
+      await this.#git(["read-tree", "--empty"], void 0, index);
+      const records = [];
+      for (const file2 of files) {
+        const bytes2 = Buffer.from(file2.content_base64, "base64");
+        if (containsCodeSyncSecret(bytes2.toString("utf8")))
+          throw new CodeSyncError("code_sync_secret", "A recognizable credential was detected in source.");
+        if (generatedPath.test(file2.path) || bytes2.subarray(0, 80).toString().startsWith("version https://git-lfs.github.com/spec/v1"))
+          throw new CodeSyncError("code_sync_unsupported", "Use native Git for Git LFS or generated-file repositories.");
+        const oid = (await this.#git(["hash-object", "-w", "--stdin", "--no-filters"], bytes2)).toString().trim();
+        if (!Commit2.test(oid))
+          throw conflict();
+        records.push(`${file2.executable ? "100755" : "100644"} ${oid}	${file2.path}\0`);
+      }
+      await this.#git(["update-index", "-z", "--index-info"], Buffer.from(records.join("")), index);
+      return (await this.#git(["write-tree"], void 0, index)).toString().trim();
+    } finally {
+      await unlink2(index).catch(() => {
+      });
+    }
+  }
+  async checkpoint(input2) {
+    const status = await this.status();
+    await this.#enabled();
+    const current = this.#head(status);
+    await this.#fetch(status);
+    if (current)
+      await this.#files(current);
+    const tree = await this.#tree(input2.files);
+    if (current && (await this.#git(["rev-parse", `${current}^{tree}`])).toString().trim() === tree)
+      return { status, commit: current };
+    if (input2.base_commit !== current)
+      throw conflict();
+    const commit = (await this.#git(["commit-tree", tree, ...current ? ["-p", current] : [], "-m", "GatherThread workspace checkpoint"])).toString().trim();
+    await this.#push(commit, status);
+    const next = await this.status();
+    if (this.#head(next) !== commit)
+      throw conflict();
+    return { status: next, commit };
+  }
+  async #push(commit, expected) {
+    await this.#enabled();
+    const latest = await this.status();
+    if (this.#head(latest) !== this.#head(expected) || latest.own_branch_id !== expected.own_branch_id)
+      throw conflict();
+    await this.#git(["push", "--porcelain", "--no-verify", this.#remote, `${commit}:refs/heads/${this.metadata.branch}`]);
+  }
+  async update() {
+    const status = await this.status();
+    await this.#enabled();
+    if (!status.own_branch_id || !status.repository.main_commit)
+      return status;
+    await this.#fetch(status);
+    const own2 = this.#head(status);
+    const base = status.repository.main_commit;
+    await this.#files(own2);
+    await this.#files(base);
+    if (own2 === base)
+      return status;
+    try {
+      await this.#git(["merge-base", "--is-ancestor", base, own2]);
+      return status;
+    } catch {
+    }
+    let tree;
+    try {
+      tree = (await this.#git(["merge-tree", "--write-tree", own2, base])).toString().split("\n")[0].trim();
+    } catch {
+      throw new CodeSyncError("code_sync_conflict", "The base branch could not be merged automatically. Resolve conflicts using native Git or GitHub, then download again. Git 2.38 or newer is required.");
+    }
+    if (!Commit2.test(tree))
+      throw conflict();
+    await this.#files(tree);
+    const commit = (await this.#git(["commit-tree", tree, "-p", own2, "-p", base, "-m", "Merge shared GitHub base into my GatherThread branch"])).toString().trim();
+    await this.#push(commit, status);
+    return this.status();
+  }
+  #git(args, input2, index) {
+    return this.#run(args, { cwd: this.#directory, ...input2 ? { input: input2 } : {}, ...index ? { index } : {} });
+  }
+};
+function conflict() {
+  return new CodeSyncError("code_sync_conflict", "GitHub progress changed. Refresh, then download or recover before uploading again.");
+}
+async function runGitHubGit(args, options) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_") && !key.startsWith("GATHERTHREAD_") && !["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GH_HOST", "GH_PROMPT_DISABLED"].includes(key)));
+  return new Promise((resolve, reject) => {
+    const child = spawn("git", [
+      "-c",
+      "core.hooksPath=/dev/null",
+      "-c",
+      "core.fsmonitor=false",
+      "-c",
+      "commit.gpgSign=false",
+      "-c",
+      "protocol.allow=never",
+      "-c",
+      "protocol.https.allow=always",
+      "-c",
+      "http.followRedirects=false",
+      "-c",
+      "credential.helper=",
+      "-c",
+      "credential.helper=!gh auth git-credential",
+      "-c",
+      "credential.interactive=false",
+      "-c",
+      "user.name=GatherThread",
+      "-c",
+      "user.email=checkpoint@users.noreply.github.com",
+      ...args
+    ], {
+      cwd: options.cwd,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null", GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", ...options.index ? { GIT_INDEX_FILE: options.index } : {} }
+    });
+    const chunks = [];
+    let size = 0;
+    let failed = false;
+    const fail = () => {
+      if (failed)
+        return;
+      failed = true;
+      child.kill();
+      reject(new CodeSyncError("code_sync_unavailable", "GitHub Git operation failed. Check Git 2.38+, GitHub CLI login, repository access and network. No credentials are sent through GatherThread."));
+    };
+    const timer = setTimeout(fail, 12e4);
+    timer.unref();
+    child.stdout.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > GITHUB_CODE_SYNC_LIMITS.maxSnapshotBytes + 8 * 1024 * 1024)
+        fail();
+      else
+        chunks.push(chunk);
+    });
+    child.stderr.resume();
+    child.stdin.on("error", () => {
+    });
+    child.on("error", fail);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code !== 0)
+        fail();
+      else if (!failed)
+        resolve(Buffer.concat(chunks));
+    });
+    child.stdin.end(options.input);
+  });
+}
+
+// ../bridge/dist/src/github-auth.js
+import { spawn as spawn2 } from "node:child_process";
+async function connectGitHubAccount(command = runGitHubAuthCommand) {
+  if (await command(["auth", "status", "--hostname", "github.com"], 1e4))
+    return;
+  const signedIn = await command(["auth", "login", "--hostname", "github.com", "--git-protocol", "https", "--web", "--clipboard"], 24e4);
+  if (!signedIn || !await command(["auth", "status", "--hostname", "github.com"], 1e4)) {
+    throw new CodeSyncError("github_auth_failed", "GitHub sign-in was not completed on this device. Reopen the connection and finish in your browser.");
+  }
+}
+function runGitHubAuthCommand(args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GH_HOST", "GH_PROMPT_DISABLED"].includes(key)));
+    const child = spawn2("gh", [...args], { env, windowsHide: true, stdio: ["ignore", "ignore", "ignore"] });
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish(false);
+    }, timeoutMs);
+    child.on("error", (error62) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new CodeSyncError(error62.code === "ENOENT" ? "github_cli_unavailable" : "github_auth_failed", error62.code === "ENOENT" ? "Install GitHub CLI on this device before connecting." : "GitHub CLI could not start on this device."));
+    });
+    child.on("close", (code) => finish(code === 0));
+  });
+}
+
 // dist/src/native-plugin.js
-import { createHash as createHash8 } from "node:crypto";
-import path9 from "node:path";
+import { createHash as createHash10 } from "node:crypto";
+import path10 from "node:path";
 
 // dist/src/code-sync-controller.js
-import { constants as constants2 } from "node:fs";
-import { lstat as lstat4, mkdir as mkdir3, open as open4, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { randomUUID as randomUUID2 } from "node:crypto";
-import path4 from "node:path";
+import { constants as constants3 } from "node:fs";
+import { lstat as lstat5, mkdir as mkdir4, open as open5, rename as rename2, unlink as unlink3 } from "node:fs/promises";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import path5 from "node:path";
 
 // dist/src/path-security.js
-import { lstat as lstat3, realpath as realpath2 } from "node:fs/promises";
-import path3 from "node:path";
+import { lstat as lstat4, realpath as realpath2 } from "node:fs/promises";
+import path4 from "node:path";
 async function prospectiveRealPath(candidate) {
-  let current = path3.resolve(candidate);
+  let current = path4.resolve(candidate);
   const missing = [];
   while (true) {
     try {
-      return path3.join(await realpath2(current), ...missing);
+      return path4.join(await realpath2(current), ...missing);
     } catch (error62) {
       if (!isNodeError2(error62) || error62.code !== "ENOENT")
         throw error62;
-      const parent = path3.dirname(current);
+      const parent = path4.dirname(current);
       if (parent === current)
         throw new Error(`No existing ancestor for path: ${candidate}`);
-      missing.unshift(path3.basename(current));
+      missing.unshift(path4.basename(current));
       current = parent;
     }
   }
 }
 async function secureDirectoryChain(directory) {
-  const absolute = path3.resolve(directory);
-  const root = path3.parse(absolute).root;
-  const relative = path3.relative(root, absolute);
-  const components = relative ? relative.split(path3.sep) : [];
+  const absolute = path4.resolve(directory);
+  const root = path4.parse(absolute).root;
+  const relative = path4.relative(root, absolute);
+  const components = relative ? relative.split(path4.sep) : [];
   const identities = [];
   let current = root;
   for (const component of components) {
-    current = path3.join(current, component);
+    current = path4.join(current, component);
     let metadata;
     try {
-      metadata = await lstat3(current);
+      metadata = await lstat4(current);
     } catch (error62) {
       if (isNodeError2(error62) && error62.code === "ENOENT")
         break;
@@ -22012,6 +23159,7 @@ var ACTIONS = /* @__PURE__ */ new Set([
   "code_auto_upload_enable",
   "code_auto_upload_disable"
 ]);
+var GITHUB_CODE_ACTIONS = githubCodeSyncRequestKinds.filter((kind) => kind !== "github_auth_connect");
 var DshCodeSyncController = class {
   #authorized = false;
   #status;
@@ -22021,8 +23169,10 @@ var DshCodeSyncController = class {
   #poll;
   #stopped = false;
   #options;
+  #actions;
   constructor(options) {
     this.#options = options;
+    this.#actions = options.actionKinds ? new Set(options.actionKinds) : ACTIONS;
   }
   view() {
     return {
@@ -22091,7 +23241,7 @@ var DshCodeSyncController = class {
           if (this.#stopped)
             return;
           const runtime = runtimes.get(job.sessionId);
-          if (!runtime || job.targetRuntimeId !== runtime || !ACTIONS.has(job.kind))
+          if (!runtime || job.targetRuntimeId !== runtime || !this.#actions.has(job.kind))
             continue;
           let claimed;
           try {
@@ -22134,11 +23284,11 @@ var DshCodeSyncController = class {
     await this.#tail;
   }
   async #execute(kind, operationId) {
-    if (!ACTIONS.has(kind))
+    if (!this.#actions.has(kind))
       throw new CodeSyncLocalError("code_action_invalid");
     if (!this.#authorized)
       throw new CodeSyncLocalError("code_sync_disabled");
-    if (this.#options.isBusy() && kind !== "code_sync_status" && kind !== "code_auto_upload_disable") {
+    if (this.#options.isBusy() && !["code_sync_status", "code_auto_upload_disable", "github_code_sync_status", "github_code_auto_upload_disable"].includes(kind)) {
       throw new CodeSyncLocalError("code_sync_busy");
     }
     return this.#requireEngine().execute(kind, {
@@ -22169,13 +23319,13 @@ var CodeSyncLocalError = class extends Error {
 };
 function codeSyncErrorCode(error62) {
   const code = typeof error62 === "object" && error62 !== null && "code" in error62 ? error62.code : void 0;
-  return typeof code === "string" && /^code_[a-z_]{1,60}$/u.test(code) ? code : "code_sync_failed";
+  return typeof code === "string" && /^(?:github_)?code_[a-z_]{1,60}$/u.test(code) ? code : "code_sync_failed";
 }
 async function loadConsent(file2, binding) {
-  const ancestors = await secureDirectoryChain(path4.dirname(file2));
+  const ancestors = await secureDirectoryChain(path5.dirname(file2));
   let before;
   try {
-    before = await lstat4(file2);
+    before = await lstat5(file2);
   } catch (error62) {
     if (error62.code === "ENOENT")
       return false;
@@ -22184,25 +23334,25 @@ async function loadConsent(file2, binding) {
   if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > 4096 || process.platform !== "win32" && (before.mode & 63) !== 0) {
     throw new CodeSyncLocalError("code_consent_invalid");
   }
-  const handle = await open4(file2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+  const handle = await open5(file2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
   try {
     const opened = await handle.stat();
     if (before.dev !== opened.dev || before.ino !== opened.ino)
       throw new CodeSyncLocalError("code_consent_invalid");
     const value = JSON.parse(await handle.readFile("utf8"));
-    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path4.dirname(file2)));
+    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path5.dirname(file2)));
     return value.version === 1 && value.binding === binding && value.enabled === true;
   } finally {
     await handle.close();
   }
 }
 async function saveConsent(file2, binding, enabled) {
-  await secureDirectoryChain(path4.dirname(file2));
-  await mkdir3(path4.dirname(file2), { recursive: true, mode: 448 });
-  const ancestors = await secureDirectoryChain(path4.dirname(file2));
+  await secureDirectoryChain(path5.dirname(file2));
+  await mkdir4(path5.dirname(file2), { recursive: true, mode: 448 });
+  const ancestors = await secureDirectoryChain(path5.dirname(file2));
   await loadConsent(file2, binding);
-  const temporary = `${file2}.${randomUUID2()}.tmp`;
-  const handle = await open4(temporary, "wx", 384);
+  const temporary = `${file2}.${randomUUID4()}.tmp`;
+  const handle = await open5(temporary, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify({ version: 1, binding, enabled }));
     await handle.sync();
@@ -22210,14 +23360,136 @@ async function saveConsent(file2, binding, enabled) {
     await handle.close();
   }
   try {
-    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path4.dirname(file2)));
+    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path5.dirname(file2)));
     await rename2(temporary, file2);
   } catch (error62) {
-    await unlink2(temporary).catch(() => void 0);
+    await unlink3(temporary).catch(() => void 0);
     throw error62;
   }
 }
 
+// dist/src/github-code-sync-controller.js
+import { createHash as createHash4 } from "node:crypto";
+var DshGitHubCodeSyncController = class {
+  options;
+  #controller;
+  #metadata;
+  #key;
+  #error;
+  #tail = Promise.resolve();
+  #stopped = false;
+  #poll;
+  constructor(options) {
+    this.options = options;
+  }
+  view() {
+    return {
+      ...this.#controller?.view() ?? { authorized: false },
+      connection: this.#metadata?.connection ? { ...this.#metadata.connection } : null,
+      branch: this.#metadata?.branch ?? null,
+      ...this.#error ? { error: this.#error } : {}
+    };
+  }
+  async start() {
+    await this.#serialize(async () => {
+      await this.#refresh();
+    });
+  }
+  authorize(enabled, expected) {
+    return this.#serialize(async () => {
+      if (!enabled) {
+        await this.#controller?.authorize(false);
+        return this.view();
+      }
+      await this.#refresh();
+      const target = this.#metadata?.connection;
+      if (!target || !expected || targetKey(target) !== targetKey(expected))
+        throw coded("code_github_binding_changed");
+      if (!this.#metadata?.can_write || !target.enabled)
+        throw coded("code_sync_forbidden");
+      await this.#controller.authorize(true);
+      return this.view();
+    });
+  }
+  execute(kind) {
+    return this.#serialize(async () => {
+      if (kind === "github_code_auto_upload_disable" && this.#controller) {
+        await this.#controller.execute(kind);
+        return this.view();
+      }
+      await this.#refresh();
+      if (kind === "github_code_sync_status" && !this.#controller?.view().authorized)
+        return this.view();
+      if (!this.#controller)
+        throw coded("code_github_not_configured");
+      if (!this.#metadata?.connection?.enabled && kind !== "github_code_sync_status")
+        throw coded("code_not_enabled");
+      await this.#controller.execute(kind);
+      return this.view();
+    });
+  }
+  poll() {
+    if (this.#stopped)
+      return Promise.resolve();
+    this.#poll ??= this.#serialize(async () => {
+      await this.#refresh();
+      await this.#controller?.poll();
+    }).finally(() => {
+      this.#poll = void 0;
+    });
+    return this.#poll;
+  }
+  async stop() {
+    this.#stopped = true;
+    await this.#tail;
+    await this.#controller?.stop();
+  }
+  async #refresh() {
+    const metadata = await this.options.readMetadata();
+    const target = metadata.connection;
+    const key = target && metadata.can_write ? targetKey(target) : void 0;
+    if (key !== this.#key) {
+      await this.#controller?.authorize(false);
+      await this.#controller?.stop();
+      this.#controller = void 0;
+      this.#key = void 0;
+      if (target && key) {
+        const capturedTarget = { ...target };
+        this.#controller = new DshCodeSyncController({
+          ...this.options,
+          binding: createHash4("sha256").update(JSON.stringify([this.options.binding, key])).digest("hex"),
+          actionKinds: GITHUB_CODE_ACTIONS,
+          createEngine: () => this.options.createEngine(capturedTarget)
+        });
+        await this.#controller.start();
+        this.#key = key;
+      }
+    }
+    this.#metadata = metadata;
+  }
+  #serialize(operation) {
+    const pending = this.#tail.then(async () => {
+      if (this.#stopped)
+        throw coded("code_sync_stopped");
+      this.#error = void 0;
+      try {
+        return await operation();
+      } catch (error62) {
+        this.#error = codeSyncErrorCode(error62);
+        throw coded(this.#error);
+      }
+    });
+    this.#tail = pending.catch(() => void 0);
+    return pending;
+  }
+};
+function targetKey(target) {
+  return JSON.stringify([target.repository, target.base_branch, target.revision]);
+}
+function coded(code) {
+  return Object.assign(new Error(code), { code });
+}
+
 // dist/src/collaboration-api.js
 function createHttpDshCollaborationApi(options) {
   const client = new HttpCollaborationClient({
@@ -22293,9 +23565,9 @@ function clipToUtf8Bytes(value, maxBytes) {
 }
 
 // dist/src/config.js
-import { createHash as createHash3 } from "node:crypto";
-import { lstat as lstat5 } from "node:fs/promises";
-import path5 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { lstat as lstat6 } from "node:fs/promises";
+import path6 from "node:path";
 var CONFIG_KEYS = /* @__PURE__ */ new Set([
   "enabled",
   "bindingMode",
@@ -22408,7 +23680,7 @@ async function assertSafeDshStateRoot(config2) {
   await assertRealStateSeparation(config2.workspacePath, config2.stateRoot, "config.stateRoot");
   await secureDirectoryChain(config2.stateRoot);
   try {
-    const target = await lstat5(config2.stateRoot);
+    const target = await lstat6(config2.stateRoot);
     if (target.isSymbolicLink() || !target.isDirectory()) {
       throw new Error("config.stateRoot must be a real directory, never a symbolic link");
     }
@@ -22437,11 +23709,11 @@ function rejectModeKeys(value, forbidden, bindingMode) {
   }
 }
 function deriveDshSessionId(projectId, sessionId, workspacePath) {
-  const digest3 = createHash3("sha256").update(JSON.stringify([projectId, sessionId, path5.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  const digest3 = createHash5("sha256").update(JSON.stringify([projectId, sessionId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
   return `gatherthread-${digest3}`;
 }
 function deriveNativeDshSessionId(projectId, sessionId, workspacePath) {
-  const digest3 = createHash3("sha256").update(JSON.stringify(["native-web-v2", projectId, sessionId, path5.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  const digest3 = createHash5("sha256").update(JSON.stringify(["native-web-v2", projectId, sessionId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
   return `gatherthread-${digest3}`;
 }
 function normalizeApiUrl(value) {
@@ -22479,13 +23751,13 @@ function safeText(value, label, maximum) {
 }
 function absolutePath(value, label) {
   const text = requiredString2(value, label, 4096);
-  if (!path5.isAbsolute(text))
+  if (!path6.isAbsolute(text))
     throw new Error(`${label} must be absolute`);
-  return path5.resolve(text);
+  return path6.resolve(text);
 }
 function isWithin2(parent, candidate) {
-  const relative = path5.relative(parent, candidate);
-  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== "..";
+  const relative = path6.relative(parent, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== "..";
 }
 function isNodeError3(error62) {
   return error62 instanceof Error && "code" in error62;
@@ -22524,7 +23796,7 @@ function rejectUnknownKeys(value, allowed, label) {
 }
 
 // dist/src/connector.js
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // dist/src/canonical-prompt.js
 var MAX_EVENT_TEXT_BYTES = 8 * 1024;
@@ -22597,12 +23869,12 @@ ${footer}`, "utf8");
   const retained = [];
   let used = 0;
   for (const line of contextLines.toReversed()) {
-    const bytes = Buffer.byteLength(`${line}
+    const bytes2 = Buffer.byteLength(`${line}
 `, "utf8");
-    if (used + bytes > contextBudget)
+    if (used + bytes2 > contextBudget)
       continue;
     retained.push(line);
-    used += bytes;
+    used += bytes2;
   }
   retained.reverse();
   const omitted = retained.length < contextLines.length ? [`[${contextLines.length - retained.length} older public context update(s) omitted by size limit]`] : [];
@@ -22816,41 +24088,290 @@ function safeJson(value) {
     return "[Unserializable tool value]";
   }
 }
-function boundText2(value, maximumBytes) {
-  if (Buffer.byteLength(value, "utf8") <= maximumBytes)
-    return value;
-  const suffix = "\n[TRUNCATED]";
-  const target = Math.max(0, maximumBytes - Buffer.byteLength(suffix, "utf8"));
-  let low = 0;
-  let high = value.length;
-  while (low < high) {
-    const middle = Math.ceil((low + high) / 2);
-    if (Buffer.byteLength(value.slice(0, middle), "utf8") <= target)
-      low = middle;
-    else
-      high = middle - 1;
+function boundText2(value, maximumBytes) {
+  if (Buffer.byteLength(value, "utf8") <= maximumBytes)
+    return value;
+  const suffix = "\n[TRUNCATED]";
+  const target = Math.max(0, maximumBytes - Buffer.byteLength(suffix, "utf8"));
+  let low = 0;
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(value.slice(0, middle), "utf8") <= target)
+      low = middle;
+    else
+      high = middle - 1;
+  }
+  return `${value.slice(0, low)}${suffix}`;
+}
+function checkedLimit(value, fallback) {
+  if (value === void 0)
+    return fallback;
+  if (!Number.isSafeInteger(value) || value < 1024 || value > 2 * 1024 * 1024) {
+    throw new Error("DSH event mapping byte limits must be integers from 1024 to 2097152");
+  }
+  return value;
+}
+function safeTimestamp(value) {
+  try {
+    const timestamp3 = new Date(value);
+    if (!Number.isFinite(timestamp3.getTime()))
+      return void 0;
+    return timestamp3.toISOString();
+  } catch {
+    return void 0;
+  }
+}
+function asObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+
+// dist/src/live-event-mapper.js
+var MAX_ATTEMPTS = 64;
+var MAX_BLOCKS = 128;
+var MAX_TEXT = 96 * 1024;
+function createDshLiveEventMapper(publisher) {
+  const attempts = /* @__PURE__ */ new Map();
+  const steps = /* @__PURE__ */ new Map();
+  const tools = /* @__PURE__ */ new Map();
+  let revision = 0;
+  const deliver = (operation) => {
+    void operation.catch(() => void 0);
+  };
+  const snapshot = (block, state) => deliver(publisher.onSnapshot(block.key, block.text, block.kind, block.title, state));
+  const toolFor = (id, fallbackKey) => {
+    let tool = tools.get(id);
+    if (tool === void 0 && tools.size < MAX_BLOCKS) {
+      tool = { key: fallbackKey, arguments: "" };
+      tools.set(id, tool);
+    }
+    return tool;
+  };
+  const settle2 = (attempt, state) => {
+    if (state === "failed")
+      attempt.failed = true;
+    for (const block of attempt.blocks.values()) {
+      if (block.kind !== "tool")
+        snapshot(block, state);
+      else if (state === "failed") {
+        const argumentsText = block.callId === void 0 ? void 0 : tools.get(block.callId)?.arguments;
+        deliver(publisher.onSnapshot(block.key, `Arguments:
+${argumentsText || "[Unparseable tool arguments]"}`, "tool", block.title, state));
+      }
+    }
+  };
+  const onFrame = (frame) => {
+    if (frame.revision <= revision)
+      return;
+    const identity = frame.attemptId;
+    if (frame.type === "start") {
+      if (attempts.has(identity) || attempts.size >= MAX_ATTEMPTS)
+        return;
+      revision = frame.revision;
+      const attempt2 = { turn: frame.turn, step: frame.step, nextIndex: 0, closed: false, failed: false, blocks: /* @__PURE__ */ new Map() };
+      attempts.set(identity, attempt2);
+      steps.set(`${frame.turn}:${frame.step}`, attempt2);
+      return;
+    }
+    const attempt = attempts.get(identity);
+    if (attempt === void 0 || attempt.closed || frame.index !== attempt.nextIndex)
+      return;
+    revision = frame.revision;
+    if (frame.type === "end") {
+      attempt.closed = true;
+      settle2(attempt, attempt.failed || frame.outcome.kind === "abandoned" || frame.outcome.eventType === "assistant/attempt" ? "failed" : "completed");
+      return;
+    }
+    attempt.nextIndex++;
+    const chunk = object2(frame.chunk);
+    if (chunk?.type === "finish") {
+      const reason = object2(chunk.reason)?.kind ?? chunk.reason;
+      if (reason === "error" || reason === "aborted")
+        settle2(attempt, "failed");
+      return;
+    }
+    if (!integer2(chunk?.index) || Number(chunk.index) >= MAX_BLOCKS)
+      return;
+    const index = Number(chunk.index);
+    if (chunk.type === "block-start") {
+      const kind = chunk.blockType === "text" ? "answer" : chunk.blockType === "reasoning" ? "reasoning" : chunk.blockType === "tool-call" ? "tool" : void 0;
+      if (kind !== void 0 && !attempt.blocks.has(index)) {
+        attempt.blocks.set(index, { key: `${identity}:${index}`, kind, text: "" });
+      }
+      return;
+    }
+    const block = attempt.blocks.get(index);
+    if (block === void 0)
+      return;
+    if (chunk.type === "text-delta" && block.kind === "answer" || chunk.type === "reasoning-delta" && block.kind === "reasoning") {
+      if (typeof chunk.text !== "string")
+        return;
+      block.text = bound2(block.text + chunk.text);
+      deliver(publisher.onDelta(block.key, chunk.text, block.kind));
+    } else if (chunk.type === "tool-call-delta" && block.kind === "tool") {
+      if (!identifier(chunk.id) || typeof chunk.argumentsDelta !== "string" || block.callId !== void 0 && block.callId !== chunk.id)
+        return;
+      block.callId = chunk.id;
+      if (typeof chunk.name === "string")
+        block.title = bound2(chunk.name).slice(0, 256);
+      const tool = toolFor(block.callId, block.key);
+      if (tool === void 0)
+        return;
+      block.key = tool.key;
+      block.text = bound2(block.text + chunk.argumentsDelta);
+      if (block.title !== void 0)
+        tool.title = block.title;
+      const argumentsText = parsedArguments(block.text);
+      if (argumentsText !== void 0)
+        tool.arguments = argumentsText;
+      deliver(publisher.onSnapshot(block.key, argumentsText === void 0 ? "Preparing tool arguments.\n" : `Arguments:
+${argumentsText}`, "tool", block.title));
+    } else if (chunk.type === "block-end") {
+      const content = object2(chunk.block);
+      if ((content?.type === "text" && block.kind === "answer" || content?.type === "reasoning" && block.kind === "reasoning") && typeof content.text === "string") {
+        block.text = bound2(content.text);
+        snapshot(block, "completed");
+      } else if (content?.type === "tool-call" && block.kind === "tool" && identifier(content.id) && typeof content.arguments === "string" && (block.callId === void 0 || content.id === block.callId)) {
+        const tool = toolFor(content.id, block.key);
+        if (tool === void 0)
+          return;
+        block.callId = content.id;
+        block.key = tool.key;
+        block.text = publicArguments(content.arguments);
+        if (typeof content.name === "string")
+          block.title = content.name.slice(0, 256);
+        tool.arguments = block.text;
+        if (block.title !== void 0)
+          tool.title = block.title;
+        snapshot(block, "running");
+      }
+    }
+  };
+  const onDurable = (event) => {
+    const data = object2(event.data);
+    if (data === void 0)
+      return;
+    if (event.type === "assistant/message" && integer2(data.turn) && integer2(data.step)) {
+      const attempt = steps.get(`${data.turn}:${data.step}`);
+      if (attempt !== void 0 && data.interrupted === true)
+        attempt.failed = true;
+      const message = object2(data.message);
+      if (!Array.isArray(message?.content))
+        return;
+      const nativeBlocks = [...attempt?.blocks.values() ?? []];
+      for (const [index, value] of message.content.slice(0, MAX_BLOCKS).entries()) {
+        const content = object2(value);
+        const kind = content?.type === "text" ? "answer" : content?.type === "reasoning" ? "reasoning" : void 0;
+        if (kind !== void 0 && typeof content.text === "string") {
+          const candidate = nativeBlocks[index];
+          const key = candidate?.kind === kind ? candidate.key : `assistant:${event.seq}:${index}`;
+          if (candidate?.kind === kind)
+            candidate.text = bound2(content.text);
+          deliver(publisher.onSnapshot(key, content.text, kind, void 0, data.interrupted === true ? "failed" : "completed"));
+        }
+      }
+    } else if (event.type === "assistant/attempt" && integer2(data.turn) && integer2(data.step)) {
+      const attempt = steps.get(`${data.turn}:${data.step}`);
+      if (attempt !== void 0)
+        settle2(attempt, "failed");
+    } else if (event.type === "tool/call" && identifier(data.callId) && typeof data.name === "string" && typeof data.arguments === "string") {
+      const tool = toolFor(data.callId, `tool:${event.seq}`);
+      if (tool === void 0)
+        return;
+      tool.arguments = publicArguments(data.arguments);
+      tool.title = data.name.slice(0, 256);
+      deliver(publisher.onSnapshot(tool.key, `Arguments:
+${tool.arguments}`, "tool", tool.title));
+    } else if (event.type === "tool/result") {
+      const message = object2(data.message);
+      const content = Array.isArray(message?.content) ? message.content : [];
+      const wrapped = content.map(object2).find((block) => block?.type === "tool-result");
+      const id = wrapped?.toolCallId ?? message?.toolCallId;
+      if (!identifier(id))
+        return;
+      const tool = tools.get(id);
+      if (tool === void 0)
+        return;
+      const blocks = wrapped === void 0 ? content : wrapped.content;
+      if (!Array.isArray(blocks))
+        return;
+      const text = blocks.slice(0, MAX_BLOCKS).flatMap((value) => {
+        const block = object2(value);
+        return block?.type === "text" && typeof block.text === "string" ? [bound2(block.text)] : [];
+      }).join("");
+      const failed = wrapped?.isError === true || message?.isError === true || data.error !== void 0;
+      deliver(publisher.onSnapshot(tool.key, `Arguments:
+${tool.arguments}
+
+Result:
+${bound2(text)}`, "tool", tool.title, failed ? "failed" : "completed"));
+    } else if (event.type === "todo/write" && Array.isArray(data.todos) && data.todos.length <= 64) {
+      const plan = [];
+      for (const value of data.todos) {
+        const item = object2(value);
+        if (typeof item?.content !== "string" || !["pending", "in_progress", "completed"].includes(String(item.status)))
+          return;
+        plan.push({ step: item.content, status: item.status });
+      }
+      deliver(publisher.onPlan("plan", plan));
+    }
+  };
+  return {
+    onEvent(event) {
+      if (event.kind === "assistant-stream")
+        onFrame(event.frame);
+      else
+        onDurable(event.event);
+    },
+    async finish(success2 = true) {
+      await publisher.finish(success2);
+    }
+  };
+}
+function parseDshAssistantStreamFrame(value) {
+  const frame = object2(value);
+  if (!identifier(frame?.attemptId) || !integer2(frame?.revision) || Number(frame.revision) < 1)
+    return void 0;
+  const shared = { attemptId: frame.attemptId, revision: Number(frame.revision) };
+  if (frame.type === "start" && integer2(frame.turn) && integer2(frame.step)) {
+    return { type: "start", ...shared, turn: Number(frame.turn), step: Number(frame.step) };
   }
-  return `${value.slice(0, low)}${suffix}`;
-}
-function checkedLimit(value, fallback) {
-  if (value === void 0)
-    return fallback;
-  if (!Number.isSafeInteger(value) || value < 1024 || value > 2 * 1024 * 1024) {
-    throw new Error("DSH event mapping byte limits must be integers from 1024 to 2097152");
+  if (frame.type === "chunk" && integer2(frame.index) && integer2(frame.time) && object2(frame.chunk) !== void 0) {
+    return { type: "chunk", ...shared, index: Number(frame.index), time: Number(frame.time), chunk: frame.chunk };
   }
-  return value;
+  const outcome = object2(frame.outcome);
+  if (frame.type === "end" && integer2(frame.index)) {
+    if (outcome?.kind === "abandoned")
+      return { type: "end", ...shared, index: Number(frame.index), outcome: { kind: "abandoned" } };
+    if (outcome?.kind === "committed" && integer2(outcome.seq) && (outcome.eventType === "assistant/message" || outcome.eventType === "assistant/attempt")) {
+      return { type: "end", ...shared, index: Number(frame.index), outcome: { kind: "committed", eventType: outcome.eventType, seq: Number(outcome.seq) } };
+    }
+  }
+  return void 0;
 }
-function safeTimestamp(value) {
+function publicArguments(text) {
+  return parsedArguments(text) ?? "[Unparseable tool arguments]";
+}
+function parsedArguments(text) {
+  if (text.length > MAX_TEXT)
+    return void 0;
   try {
-    const timestamp3 = new Date(value);
-    if (!Number.isFinite(timestamp3.getTime()))
-      return void 0;
-    return timestamp3.toISOString();
+    return JSON.stringify(redactValue(JSON.parse(text)));
   } catch {
     return void 0;
   }
 }
-function asObject2(value) {
+function bound2(text) {
+  return text.length > MAX_TEXT ? `${text.slice(0, MAX_TEXT)}
+[TRUNCATED]` : text;
+}
+function integer2(value) {
+  return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function identifier(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 512;
+}
+function object2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 
@@ -22881,6 +24402,7 @@ var DshHostConnector = class {
   #publicationPromise;
   #heartbeatOffline = false;
   #liveProgressPromise = Promise.resolve();
+  #activeLiveOutput;
   #lastLiveProgressKey;
   #lastLiveProgressAt = 0;
   #stopPromise;
@@ -22891,6 +24413,8 @@ var DshHostConnector = class {
   #activeExecutionSelection;
   #summaryScanSequence = 0;
   #hasSummaryHistory = false;
+  #revisionPollPromise;
+  #revisionSupported = false;
   #liveEventSequences = /* @__PURE__ */ new Set();
   #session;
   #visibleState = "connecting";
@@ -22916,6 +24440,15 @@ var DshHostConnector = class {
   get stopped() {
     return this.#stopped;
   }
+  /** Project refresh is authoritative for the mode of future DSH bubbles. */
+  updateSessionSummary(session) {
+    if (!this.#started || this.#stopped)
+      throw new Error("DSH connector is not running");
+    if (session.id !== this.#config.sessionId || session.projectId !== this.#config.projectId || session.state !== "active" || !isSessionWritableBy(session, this.#actorUserId)) {
+      throw new Error("Refreshed GatherThread Session is not this writable binding");
+    }
+    this.#session = session;
+  }
   /**
    * Adopt a refreshed execution-profile catalog on a running connection.
    *
@@ -22986,7 +24519,8 @@ var DshHostConnector = class {
       ...executionProfiles === void 0 ? {} : {
         executionProfiles: cloneExecutionProfiles(executionProfiles)
       },
-      purpose: "execution"
+      purpose: "execution",
+      ...this.#host.contextDeletionVersion === 1 ? { contextDeletionVersion: 1 } : {}
     };
   }
   get executionRuntimeId() {
@@ -23019,6 +24553,7 @@ var DshHostConnector = class {
   }
   uploadLocalTurns() {
     return this.#withLocalSyncControl(async () => {
+      await this.#refreshContentRevision();
       const before = this.localSyncStatus();
       await this.#flushOutbox(true);
       await this.#captureLocalTurns(0);
@@ -23041,6 +24576,15 @@ var DshHostConnector = class {
     this.#started = true;
     this.#automaticPolling = options.schedule !== false;
     this.#notifyLifecycle("connecting");
+    if (this.#host.onLiveOutput !== void 0) {
+      this.#listenerDisposers.push(this.#host.onLiveOutput((event) => {
+        const active = this.#state?.activeRequest;
+        const output2 = this.#activeLiveOutput;
+        if (this.#stopped || active === void 0 || output2 === void 0 || event.sourceSessionId !== output2.sourceSessionId || event.sourceSessionId !== (active.contextExecution?.sessionId ?? this.#host.sessionId))
+          return;
+        output2.mapper.onEvent(event);
+      }));
+    }
     this.#listenerDisposers.push(this.#host.onSessionEvent((event) => {
       const active = this.#state?.activeRequest;
       if (active?.contextExecution !== void 0 && event.sourceSessionId !== active.contextExecution.sessionId)
@@ -23086,6 +24630,7 @@ var DshHostConnector = class {
     }));
     try {
       const session = await this.#verifySessionBinding();
+      this.#revisionSupported = session.contentRevision !== void 0;
       this.#session = session;
       this.#notifyLifecycle("connecting");
       const storedState = await this.#stateStore.load();
@@ -23093,8 +24638,16 @@ var DshHostConnector = class {
         throw new Error("GatherThread Session head precedes the persisted DSH cursor; refusing identity reuse");
       }
       const mode = await this.#host.open();
+      if (storedState?.projectionSessionId && (storedState.contentRevision ?? 0) > 0) {
+        if (!this.#host.resetCanonicalContext)
+          throw new Error("DSH deletion-safe projection requires an updated native facade");
+        const restored = await this.#host.resetCanonicalContext(storedState.contentRevision);
+        if (restored.sessionId !== storedState.projectionSessionId)
+          throw new Error("DSH restored another native projection");
+      }
       this.#state = this.#reconcileState(storedState, mode);
       await this.#stateStore.save(this.#state);
+      await this.#refreshContentRevision();
       this.#runtime = await this.#api.registerRuntime(this.#runtimeRegistration());
       this.#assertRuntime(this.#runtime);
       this.#notifyLifecycle("idle");
@@ -23166,6 +24719,8 @@ var DshHostConnector = class {
   stop() {
     this.#stopPromise ??= (async () => {
       this.#stopped = true;
+      const liveOutput = this.#activeLiveOutput;
+      this.#activeLiveOutput = void 0;
       this.#notifyLifecycle("stopped");
       this.#lifecycleAbort.abort(new Error("DSH connector stopped"));
       if (this.#timer !== void 0) {
@@ -23179,6 +24734,7 @@ var DshHostConnector = class {
       for (const dispose of this.#listenerDisposers.splice(0))
         dispose();
       await this.#host.dispose();
+      void liveOutput?.mapper.finish(false).catch(() => void 0);
       try {
         await this.#pollPromise;
       } catch {
@@ -23191,6 +24747,7 @@ var DshHostConnector = class {
     return this.#stopPromise;
   }
   async #poll() {
+    await this.#refreshContentRevision();
     const state = this.#requireState();
     if (state.activeRequest !== void 0) {
       await this.#withExecutionPermit(() => this.#recoverActiveRequest());
@@ -23207,6 +24764,12 @@ var DshHostConnector = class {
     let scanned = 0;
     while (!this.#stopped) {
       const page = await this.#api.readEvents(this.#config.sessionId, scanCursor, this.#config.pollLimit);
+      if (page.contentRevision !== void 0)
+        this.#revisionSupported = true;
+      if ((page.contentRevision ?? 0) !== (state.contentRevision ?? 0)) {
+        await this.#refreshContentRevision();
+        return this.#poll();
+      }
       this.#validatePage(page.events, scanCursor);
       const passive = [];
       for (const event of page.events) {
@@ -23240,6 +24803,39 @@ var DshHostConnector = class {
     }
     throw new Error("DSH connector stopped during event replay");
   }
+  async #refreshContentRevision() {
+    const state = this.#requireState();
+    if (!this.#revisionSupported && (state.contentRevision ?? 0) === 0)
+      return;
+    const page = await this.#api.readEvents(this.#config.sessionId, 0, 1);
+    const revision = page.contentRevision ?? 0;
+    if (!Number.isSafeInteger(revision) || revision < (state.contentRevision ?? 0))
+      throw new Error("Stale DSH shared context revision");
+    if (revision === (state.contentRevision ?? 0)) {
+      if (revision > 0 && state.projectionSessionId && this.#host.resetCanonicalContext) {
+        const restored = await this.#host.resetCanonicalContext(revision);
+        if (restored.sessionId !== state.projectionSessionId)
+          throw new Error("DSH clean projection binding changed on reconnect");
+      }
+      return;
+    }
+    state.localOnlySessionIds = [.../* @__PURE__ */ new Set([...state.localOnlySessionIds ?? [], this.#config.dshSessionId, this.#host.sessionId])];
+    state.outbox = [];
+    delete state.activeRequest;
+    this.#activeStatuses = [];
+    this.#activeExecutionSelection = void 0;
+    this.#summaryScanSequence = 0;
+    this.#hasSummaryHistory = false;
+    await this.#stateStore.save(state);
+    if (this.#host.resetCanonicalContext) {
+      const replacement = await this.#host.resetCanonicalContext(revision);
+      state.projectionSessionId = replacement.sessionId;
+      state.projectionCursor = 0;
+      state.publishedDshSequence = this.#host.currentSequence();
+    }
+    state.contentRevision = revision;
+    await this.#stateStore.save(state);
+  }
   async #executeRequest(request, selection) {
     if (this.#stopped)
       throw new Error("DSH connector stopped before claiming an Agent request");
@@ -23258,6 +24854,8 @@ var DshHostConnector = class {
       await this.#projectCanonicalBatch([request], request.sequence);
       return { claimed: false, completed: false };
     }
+    if ((claim2.contentRevision ?? state.contentRevision ?? 0) !== (state.contentRevision ?? 0))
+      throw new Error("context_changed");
     const quotedEvent = request.replyTo ? (await this.#readThroughRequest(request.id, request.sequence)).find((event) => event.id === request.replyTo) : void 0;
     const prompt = buildDshRequestPrompt(request, quotedEvent);
     const context = await this.#contextForRequest(request);
@@ -23270,6 +24868,7 @@ var DshHostConnector = class {
     if (prepared !== void 0 && prepared.fromSequence !== baseline)
       throw new Error("DSH context preparation returned an inconsistent sequence");
     state.activeRequest = {
+      contentRevision: state.contentRevision ?? 0,
       requestId: request.id,
       requestSequence: request.sequence,
       dshFromSequence: baseline,
@@ -23283,7 +24882,7 @@ var DshHostConnector = class {
     this.#activeExecutionSelection = selection;
     this.#liveEventSequences.clear();
     await this.#stateStore.save(state);
-    const result = await this.#host.prompt(prompt, selection, prepared?.sessionId);
+    const result = await this.#promptWithLiveOutput(prompt, selection, prepared?.sessionId);
     if (result.fromSequence !== baseline || result.toSequence < result.fromSequence) {
       throw new Error("DSH Host prompt returned an inconsistent durable event range");
     }
@@ -23305,7 +24904,7 @@ var DshHostConnector = class {
       throw new Error("GatherThread history summary request has invalid source metadata");
     if (selectedOnly)
       this.#hasSummaryHistory = true;
-    if (!selectedOnly && !await this.#sessionHasSummaryBefore(request.sequence))
+    if (!selectedOnly && (this.#requireState().contentRevision ?? 0) === 0 && !await this.#sessionHasSummaryBefore(request.sequence))
       return void 0;
     if (!selectedOnly && this.#api.readContext === void 0) {
       throw new Error("GatherThread summarized context is unavailable; update the connector before continuing");
@@ -23313,7 +24912,9 @@ var DshHostConnector = class {
     if (this.#host.prepareContextExecution === void 0) {
       throw new Error("DSH isolated context execution is unavailable; refusing to run a summary-aware request in native history");
     }
-    const received = selectedOnly ? { view: "original", through_sequence: request.sequence - 1, items: [] } : parseHistoryContext(await this.#api.readContext(this.#config.sessionId, void 0, request.sequence - 1), void 0, request.sequence - 1);
+    const received = selectedOnly ? { view: "original", content_revision: this.#requireState().contentRevision ?? 0, through_sequence: request.sequence - 1, items: [] } : parseHistoryContext(await this.#api.readContext(this.#config.sessionId, void 0, request.sequence - 1), void 0, request.sequence - 1);
+    if ((received.content_revision ?? 0) !== (this.#requireState().contentRevision ?? 0))
+      throw new Error("context_changed");
     const historyContext = { ...received, items: received.items.map((item) => ({ ...item, content: redactText(item.content) })) };
     return { historyContext, selectedOnly };
   }
@@ -23411,6 +25012,10 @@ var DshHostConnector = class {
       throw new Error("Active GatherThread request no longer has a recoverable claim");
     }
     const claimAttempt = claim2.attemptCount ?? active.claimAttempt ?? 1;
+    if ((active.contentRevision ?? 0) !== (state.contentRevision ?? 0) || (claim2.contentRevision ?? active.contentRevision ?? 0) !== (active.contentRevision ?? 0)) {
+      await this.#retireFencedActiveRequest(state, active);
+      return;
+    }
     active.claimAttempt = claimAttempt;
     if (active.dshToSequence !== void 0) {
       state.outbox = state.outbox.map((operation) => {
@@ -23483,7 +25088,7 @@ var DshHostConnector = class {
     this.#activeStatuses = [];
     this.#liveEventSequences.clear();
     await this.#stateStore.save(state);
-    const result = await this.#host.prompt(continuation, selection, execution?.sessionId);
+    const result = await this.#promptWithLiveOutput(continuation, selection, execution?.sessionId);
     if (result.fromSequence !== baseline || result.toSequence < result.fromSequence) {
       throw new Error("DSH Host recovery prompt returned an inconsistent durable event range");
     }
@@ -23512,6 +25117,94 @@ var DshHostConnector = class {
     await this.#flushOutbox();
     await this.#finalizeDeliveredRequest();
   }
+  async #promptWithLiveOutput(text, selection, executionSessionId) {
+    const active = this.#requireState().activeRequest;
+    if (active === void 0)
+      throw new Error("No claimed DSH request owns live output");
+    const requestId = active.requestId;
+    const claimAttempt = active.claimAttempt ?? 1;
+    const fromSequence = active.dshFromSequence;
+    const runtime = this.#requireRuntime();
+    const sourceSessionId = executionSessionId ?? this.#host.sessionId;
+    const publisher = createLiveOutputPublisher({
+      publish: async (update) => {
+        const publication = this.#liveProgressPromise.then(async () => {
+          const current = this.#state?.activeRequest;
+          if (this.#stopped || this.#activeLiveOutput?.publisher !== publisher || current?.requestId !== requestId || (current.claimAttempt ?? 1) !== claimAttempt || current.dshFromSequence !== fromSequence || (current.contextExecution?.sessionId ?? this.#host.sessionId) !== sourceSessionId || this.#runtime?.id !== runtime.id || this.#activeExecutionSelection !== selection)
+            return false;
+          await this.#api.appendAgentProgress(this.#config.sessionId, requestId, {
+            runtimeId: runtime.id,
+            claimAttempt,
+            contentRevision: active.contentRevision ?? 0,
+            idempotencyKey: `${this.#config.deviceId}:${digest2(requestId).slice(0, 24)}:${claimAttempt}:live-${update.id}`,
+            payload: { ...liveOutputPayload(update), capture_fidelity: "harness_transcript", source_harness: "deepseek-harness" },
+            observedModel: selection.model,
+            ...selection.reasoningEffort === void 0 ? {} : { observedReasoningEffort: selection.reasoningEffort }
+          });
+          return true;
+        });
+        this.#liveProgressPromise = publication.then(() => void 0).catch((error62) => {
+          this.#onBackgroundError?.(publicError(error62));
+        });
+        return publication.catch(() => false);
+      }
+    });
+    const output2 = { publisher, mapper: createDshLiveEventMapper(publisher), sourceSessionId };
+    this.#activeLiveOutput = output2;
+    const abort = new AbortController();
+    const abortLifecycle = () => abort.abort(this.#lifecycleAbort.signal.reason);
+    this.#lifecycleAbort.signal.addEventListener("abort", abortLifecycle, { once: true });
+    const verifyRevision = async () => {
+      if (!this.#revisionSupported && (active.contentRevision ?? 0) === 0)
+        return;
+      try {
+        const page = await this.#api.readEvents(this.#config.sessionId, 0, 1);
+        if ((page.contentRevision ?? 0) !== (active.contentRevision ?? 0))
+          abort.abort(new Error("context_changed"));
+      } catch (error62) {
+        abort.abort(error62);
+      }
+    };
+    const timer = setInterval(() => {
+      if (this.#revisionPollPromise)
+        return;
+      const poll = verifyRevision();
+      this.#revisionPollPromise = poll;
+      void poll.finally(() => {
+        if (this.#revisionPollPromise === poll)
+          this.#revisionPollPromise = void 0;
+      });
+    }, 1e3);
+    timer.unref();
+    try {
+      await verifyRevision();
+      abort.signal.throwIfAborted();
+      const result = await this.#host.prompt(text, selection, executionSessionId, abort.signal);
+      await verifyRevision();
+      abort.signal.throwIfAborted();
+      await output2.mapper.finish();
+      return result;
+    } catch (error62) {
+      if (abort.signal.aborted) {
+        const state = this.#requireState();
+        state.outbox = state.outbox.filter((operation) => !outboxBelongsToRequest(operation, requestId));
+        delete state.activeRequest;
+        this.#activeExecutionSelection = void 0;
+        await this.#stateStore.save(state);
+      }
+      throw error62;
+    } finally {
+      clearInterval(timer);
+      this.#lifecycleAbort.signal.removeEventListener("abort", abortLifecycle);
+      await this.#revisionPollPromise;
+      if (this.#activeLiveOutput === output2)
+        this.#activeLiveOutput = void 0;
+      if (this.#stopped)
+        void output2.mapper.finish(false).catch(() => void 0);
+      else
+        await output2.mapper.finish(false);
+    }
+  }
   #queueLiveProgress(idSuffix, payload, throttle = true) {
     const active = this.#state?.activeRequest;
     const runtime = this.#runtime;
@@ -23521,6 +25214,9 @@ var DshHostConnector = class {
     const claimAttempt = active.claimAttempt ?? 1;
     const progressKey = `${requestId}:${String(claimAttempt)}`;
     const now = Date.now();
+    const streamedAt = this.#activeLiveOutput?.publisher.lastPublishedAt();
+    if (throttle && streamedAt !== void 0 && now - streamedAt < LIVE_PROGRESS_MIN_INTERVAL_MS)
+      return;
     if (throttle && this.#lastLiveProgressKey === progressKey && now - this.#lastLiveProgressAt < LIVE_PROGRESS_MIN_INTERVAL_MS) {
       return;
     }
@@ -23531,7 +25227,7 @@ var DshHostConnector = class {
     const idempotencyKey = `${this.#config.deviceId}:${digest2(requestId).slice(0, 24)}:${String(claimAttempt)}:${idSuffix}`;
     this.#liveProgressPromise = this.#liveProgressPromise.then(async () => {
       const current = this.#state?.activeRequest;
-      if (current?.requestId !== requestId || (current.claimAttempt ?? 1) !== claimAttempt)
+      if (this.#stopped || current?.requestId !== requestId || (current.claimAttempt ?? 1) !== claimAttempt || this.#runtime?.id !== runtime.id)
         return;
       const selection = this.#activeExecutionSelection;
       if (selection === void 0)
@@ -23539,6 +25235,7 @@ var DshHostConnector = class {
       await this.#api.appendAgentProgress(this.#config.sessionId, requestId, {
         runtimeId: runtime.id,
         claimAttempt,
+        contentRevision: active.contentRevision ?? 0,
         idempotencyKey,
         payload,
         observedModel: selection.model,
@@ -23556,11 +25253,15 @@ var DshHostConnector = class {
   }
   async #projectCanonicalBatch(events, throughSequence) {
     const state = this.#requireState();
+    if (state.localOnlySessionIds?.includes(this.#host.sessionId))
+      return;
     if (throughSequence <= state.projectionCursor)
       return;
     const runtime = this.#requireRuntime();
     const projections = [];
     for (const event of events) {
+      if (event.deleted)
+        continue;
       if (event.type === "agent_request" && asObject3(event.payload)?.history_summary !== void 0) {
         this.#hasSummaryHistory = true;
         continue;
@@ -23577,7 +25278,7 @@ var DshHostConnector = class {
           role: "user",
           content,
           occurredAt: event.timestamp,
-          ...event.actorDisplayName === void 0 ? {} : {
+          ...this.#session?.mode !== "multi" || event.actorDisplayName === void 0 ? {} : {
             actorDisplayName: event.actorDisplayName
           }
         });
@@ -23605,6 +25306,8 @@ var DshHostConnector = class {
   }
   async #captureLocalTurns(basedOnSequence) {
     const state = this.#requireState();
+    if (state.localOnlySessionIds?.includes(this.#host.sessionId))
+      return;
     if (state.activeRequest !== void 0 || state.outbox.length > 0)
       return;
     const current = this.#host.currentSequence();
@@ -23621,6 +25324,7 @@ var DshHostConnector = class {
       input: {
         localTurnId: turn.localTurnId,
         runtimeId: runtime.id,
+        contentRevision: state.contentRevision ?? 0,
         basedOnSequence: basedOnSequence ?? state.serverCursor,
         occurredAt: turn.occurredAt,
         observedModel: this.#config.model,
@@ -23734,7 +25438,10 @@ var DshHostConnector = class {
         }
       }
     });
-    return operations;
+    return operations.map((operation) => ({
+      ...operation,
+      input: { ...operation.input, contentRevision: this.#requireState().activeRequest?.contentRevision ?? 0 }
+    }));
   }
   async #flushOutbox(includeLocalTurns = true) {
     const state = this.#requireState();
@@ -23743,6 +25450,11 @@ var DshHostConnector = class {
       const operation = state.outbox[0];
       if (operation === void 0)
         break;
+      if ((operation.input.contentRevision ?? 0) !== (state.contentRevision ?? 0) || operation.kind === "local_turn" && state.localOnlySessionIds?.includes(this.#host.sessionId)) {
+        state.outbox.shift();
+        await this.#stateStore.save(state);
+        continue;
+      }
       if (operation.kind === "local_turn" && !includeLocalTurns)
         break;
       if (operation.input.runtimeId !== runtime.id) {
@@ -24011,7 +25723,7 @@ function turnSettlement(events) {
   return typeof reason?.kind === "string" ? reason.kind : void 0;
 }
 function digest2(value) {
-  return createHash4("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function cloneExecutionProfiles(profiles) {
   return profiles.map((profile) => ({
@@ -24077,6 +25789,8 @@ function captureCompletedLocalTurns(events, fromSequence, dshSessionId) {
   return { turns, safeThroughSequence };
 }
 function hasCompletedDshLocalTurn(events, dshSessionId) {
+  if (events.some((event) => event.type === "user/message" && /^gatherthread-retired:[0-9]+$/.test(String(asObject3(event.data)?.id)) && asObject3(asObject3(event.data)?.source)?.plugin === "gatherthread"))
+    return false;
   return captureCompletedLocalTurns(events, 0, dshSessionId).turns.length > 0;
 }
 function isDirectLocalUserMessage(event) {
@@ -24147,16 +25861,16 @@ function asObject3(value) {
 }
 
 // dist/src/dsh-compat.js
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
 var DSH_COMPATIBILITY = Object.freeze({
-  tag: "dsh-v0.1.3-alpha.1",
-  version: "0.1.3-alpha.1",
-  commit: "d347e703908d0406b7a7ef80e3a0e594d86b2215",
+  tag: "dsh-v0.1.7-rc.2",
+  version: "0.1.7-rc.2",
+  commit: "477b4f420553e8a52c2fbccc464d7561b239c443",
   profile: "headless"
 });
 var DSH_NPM_COMPATIBILITY = Object.freeze({
   package: "@deepseek-ai/dsh",
-  version: "0.1.2-rc.1",
+  version: "0.1.7-rc.2",
   profile: "web",
   persistenceProbe: "list"
 });
@@ -24186,16 +25900,19 @@ function createDshHostFacade(options) {
   const sessionTitle = options.sessionTitle === void 0 ? void 0 : requireService(context, "sessionTitle", ["rename"]);
   const workspaceRegistry = options.workspaceTitle === void 0 ? void 0 : requireService(context, "workspaceRegistry", ["create"]);
   const eventSubscribers = /* @__PURE__ */ new Set();
+  const liveSubscribers = /* @__PURE__ */ new Set();
   const statusSubscribers = /* @__PURE__ */ new Set();
   const listenerDisposers = [];
   const lifecycleAbort = new AbortController();
   let handle;
   let executionHandle;
-  let contextPreparationPromise;
+  let nativeSessionId = options.sessionId;
+  let contentRevision = 0;
+  let contextOperationPromise;
   const executionBinding = JSON.stringify({ nativeSessionId: options.sessionId, ...options.contextBinding });
-  const executionSessionId = `gatherthread-execution-${createHash5("sha256").update(executionBinding).digest("hex").slice(0, 32)}`;
-  const executionOwnerId = `gatherthread-execution-owner:${createHash5("sha256").update(executionBinding).digest("hex")}`;
-  const executionOwnerText = JSON.stringify({
+  let executionSessionId = `gatherthread-execution-${createHash7("sha256").update(executionBinding).digest("hex").slice(0, 32)}`;
+  let executionOwnerId = `gatherthread-execution-owner:${createHash7("sha256").update(executionBinding).digest("hex")}`;
+  let executionOwnerText = JSON.stringify({
     version: 1,
     owner: "gatherthread",
     native_session_id: options.sessionId,
@@ -24208,19 +25925,76 @@ function createDshHostFacade(options) {
   let knownProjectionMessageIds;
   let disposePromise;
   let disposed = false;
+  let livePrompt;
+  const emitLive = (owner, event) => {
+    if (disposed || livePrompt !== owner || owner.closed)
+      return;
+    for (const subscriber of liveSubscribers)
+      subscriber(event);
+  };
   listenerDisposers.push(context.on("session/event", (...args) => {
     const session = asSession(args[0]);
     const event = asSessionEvent(args[1]);
-    if (session === void 0 || session.id !== options.sessionId && session.id !== executionHandle?.agent.session.id || event === void 0)
+    if (session === void 0 || session.id !== nativeSessionId && session.id !== executionHandle?.agent.session.id || event === void 0)
       return;
     for (const subscriber of eventSubscribers)
       subscriber({ ...event, sourceSessionId: session.id });
+    const owner = livePrompt;
+    if (owner === void 0 || owner.closed || session !== owner.agent.session)
+      return;
+    const data = asObject4(event.data);
+    if (event.type === "turn/start" && owner.turn === void 0 && Number.isSafeInteger(data?.turn)) {
+      owner.turn = Number(data.turn);
+    }
+    if (owner.turn === void 0 || data?.turn !== void 0 && data.turn !== owner.turn)
+      return;
+    if (event.type === "step/start" && Number.isSafeInteger(data?.step))
+      owner.step = Number(data.step);
+    if (["assistant/message", "assistant/attempt", "tool/call", "tool/result", "todo/write"].includes(event.type)) {
+      emitLive(owner, { kind: "session-event", sourceSessionId: session.id, event });
+    }
+    if (event.type === "turn/end")
+      owner.closed = true;
+  }, { global: true }));
+  listenerDisposers.push(context.on("agent/assistant-stream", (...args) => {
+    const owner = livePrompt;
+    const payload = asObject4(args[0]);
+    if (owner === void 0 || !owner.nativeFrames || owner.turn === void 0 || payload?.agent !== owner.agent)
+      return;
+    const frame = parseDshAssistantStreamFrame(payload.frame);
+    if (frame === void 0 || frame.type === "start" && frame.turn !== owner.turn)
+      return;
+    emitLive(owner, { kind: "assistant-stream", sourceSessionId: owner.agent.session.id, frame });
+  }, { global: true }));
+  listenerDisposers.push(context.on("llm/stream", (...args) => {
+    const request = asObject4(args[0]);
+    const next = args[1];
+    if (typeof next !== "function")
+      return;
+    const stream = next();
+    const owner = livePrompt;
+    if (owner === void 0 || owner.nativeFrames || owner.closed || owner.turn === void 0 || owner.step === void 0 || owner.isLoopRequest === void 0 || request === void 0 || !Object.isFrozen(args[0]) || request.sessionId !== owner.agent.session.id || request.provider !== owner.provider || request.model !== owner.model || typeof agents.get !== "function" || agents.get(owner.agent.session.id) !== owner.agent || !owner.isLoopRequest(args[0]))
+      return stream;
+    const attemptId = randomUUID5();
+    const publish = (frame) => emitLive(owner, {
+      kind: "assistant-stream",
+      sourceSessionId: owner.agent.session.id,
+      frame
+    });
+    return (async function* () {
+      let index = 0;
+      publish({ type: "start", attemptId, revision: ++owner.revision, turn: owner.turn, step: owner.step });
+      for await (const chunk of stream) {
+        publish({ type: "chunk", attemptId, revision: ++owner.revision, index: index++, time: Date.now(), chunk });
+        yield chunk;
+      }
+    })();
   }, { global: true }));
   listenerDisposers.push(context.on("agent/status", (...args) => {
     const payload = asObject4(args[0]);
     const agent = payload ? asAgent(payload.agent) : void 0;
     const status = payload?.status;
-    if (agent === void 0 || agent.session.id !== options.sessionId && agent.session.id !== executionHandle?.agent.session.id || status !== "running" && status !== "idle")
+    if (agent === void 0 || agent.session.id !== nativeSessionId && agent.session.id !== executionHandle?.agent.session.id || status !== "running" && status !== "idle")
       return;
     for (const subscriber of statusSubscribers)
       subscriber(status, agent.session.id);
@@ -24232,7 +26006,7 @@ function createDshHostFacade(options) {
       await releaseHandle();
       throw new Error("DSH host facade was disposed during open");
     }
-    if (acquired.agent.session.id !== options.sessionId) {
+    if (acquired.agent.session.id !== nativeSessionId) {
       await releaseHandle();
       throw new Error("DSH Host returned an agent for an unexpected Session identity");
     }
@@ -24259,13 +26033,13 @@ function createDshHostFacade(options) {
     const parent = requireAgent(handle);
     if (parent.status !== "idle")
       throw new Error("Native DSH Agent must be idle before isolated context execution");
-    if (parent.session.header?.cwd !== options.workspacePath || agents.get?.(options.sessionId) !== parent) {
+    if (parent.session.header?.cwd !== options.workspacePath || agents.get?.(nativeSessionId) !== parent) {
       throw new Error("Native DSH workspace or live owner does not match the isolated context binding");
     }
   };
   const assertExecutionOwnership = (agent) => {
     const session = agent.session;
-    if (session.id !== executionSessionId || session.header?.cwd !== options.workspacePath || session.header.parentSession !== options.sessionId || session.header.origin !== "subagent") {
+    if (session.id !== executionSessionId || session.header?.cwd !== options.workspacePath || session.header.parentSession !== nativeSessionId || session.header.origin !== "subagent") {
       throw new Error("DSH isolated execution Session ownership does not match this native binding");
     }
     if (agents.get !== void 0 && agents.get(executionSessionId) !== agent) {
@@ -24286,6 +26060,118 @@ function createDshHostFacade(options) {
       throw new Error("DSH isolated execution Session contains local manual input; refusing to replace or execute it");
     }
   };
+  const recordedRevision = (session) => session.snapshotEvents(0).reduce((highest, value) => {
+    const event = asObject4(value), data = asObject4(event?.data);
+    const id = data?.id;
+    if (event?.type !== "user/message" || typeof id !== "string" || !/^gatherthread-retired:[0-9]+$/.test(id) || asObject4(data?.source)?.kind !== "plugin" || asObject4(data?.source)?.plugin !== "gatherthread")
+      return highest;
+    const revision = Number(id.slice("gatherthread-retired:".length));
+    return Number.isSafeInteger(revision) ? Math.max(highest, revision) : highest;
+  }, 0);
+  const resetCanonicalContext = async (revision) => {
+    if (!Number.isSafeInteger(revision) || revision < 1 || revision < contentRevision)
+      throw new Error("Stale DSH content revision");
+    if (options.contextBinding === void 0 || Object.values(options.contextBinding).some((value) => !value) || typeof agents.get !== "function")
+      throw new Error("DSH context reset requires an explicit owned GatherThread binding");
+    throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+    await open7();
+    throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+    if (promptActive || projectionActive)
+      throw new Error("Wait for the active DSH turn before replacing its projection");
+    const parent = requireAgent(handle);
+    if (revision < recordedRevision(parent.session))
+      throw new Error("Retired DSH revision cannot resume");
+    assertExecutionParentIdle();
+    const targetId = `gatherthread-projection-${createHash7("sha256").update(`${executionBinding}:${revision}`).digest("hex").slice(0, 32)}`;
+    if (nativeSessionId === targetId && contentRevision === revision)
+      return { sessionId: targetId };
+    const ownerId = `gatherthread-projection-owner:${createHash7("sha256").update(`${executionBinding}:${revision}`).digest("hex")}`;
+    const ownerText = JSON.stringify({ version: 1, binding: options.contextBinding, native_session_id: options.sessionId, content_revision: revision });
+    projectionActive = true;
+    let candidate;
+    try {
+      const retired = await createIsolatedMessage(`gatherthread-retired:${revision}`, "GatherThread retired this context. Continue here locally only.", options);
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      if (recordedRevision(parent.session) < revision) {
+        parent.session.append("user/message", retired, { surfaceOp: "append" });
+        await sessions.flush(parent.session);
+        throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      }
+      if (agents.get?.(targetId) !== void 0)
+        throw new Error("DSH clean projection already has another live owner");
+      const stored = await hasPersistedSession(persistence, targetId, lifecycleAbort.signal);
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      const presets = asObject4(context.get("agentPresets"));
+      const setup = (ctx) => {
+        if (presets !== void 0) {
+          if (typeof presets.composeFrom !== "function" || typeof presets.composedPreset !== "function")
+            throw new Error("Native DSH tool inheritance unavailable");
+          const expected = presets.composedPreset(parent.ctx);
+          if (presets.composeFrom(ctx, parent.ctx) !== expected)
+            throw new Error("DSH clean projection did not inherit native tools");
+        }
+      };
+      candidate = await (stored ? agents.resume({
+        resumeSessionId: targetId,
+        agentOptions: { provider: options.provider, model: options.model },
+        signal: lifecycleAbort.signal,
+        setup
+      }) : agents.create({
+        sessionId: targetId,
+        meta: { cwd: options.workspacePath, parentSession: options.sessionId, origin: "subagent" },
+        agentOptions: { provider: options.provider, model: options.model },
+        signal: lifecycleAbort.signal,
+        setup
+      }));
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      const agent = candidate.agent;
+      if (agent.session.id !== targetId || agent.session.header?.cwd !== options.workspacePath || agent.status !== "idle" || agent.session.header.parentSession !== options.sessionId || agent.session.header.origin !== "subagent" || agents.get?.(targetId) !== agent)
+        throw new Error("DSH clean projection ownership is invalid");
+      if (!stored) {
+        if (agent.session.seq !== 0)
+          throw new Error("DSH clean projection is not fresh");
+        const owner = await createIsolatedMessage(ownerId, ownerText, options);
+        throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+        agent.session.append("user/message", owner, { surfaceOp: "append" });
+      }
+      const events = agent.session.snapshotEvents(0).map(asObject4);
+      if (!events.some((event) => {
+        const data = asObject4(event?.data), source = asObject4(data?.source);
+        return event?.type === "user/message" && data?.id === ownerId && source?.kind === "plugin" && source.plugin === "gatherthread" && Array.isArray(data?.content) && data.content.length === 1 && asObject4(data.content[0])?.text === ownerText;
+      })) {
+        throw new Error("DSH clean projection is missing its durable owner marker");
+      }
+      await sessions.flush(agent.session);
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      if (sessionTitle && options.sessionTitle) {
+        await sessionTitle.rename(agent.session, options.sessionTitle);
+        throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      }
+      if (workspaceRegistry && options.workspaceTitle) {
+        const workspace = await workspaceRegistry.create(options.workspacePath, options.workspaceTitle);
+        throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+        await workspace.attachSession(targetId);
+        throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      }
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      await releaseExecutionHandle();
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      await releaseHandle();
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      handle = candidate;
+      candidate = void 0;
+      nativeSessionId = targetId;
+      contentRevision = revision;
+      knownProjectionMessageIds = void 0;
+      return { sessionId: targetId };
+    } finally {
+      try {
+        await candidate?.dispose();
+      } finally {
+        projectionActive = false;
+      }
+    }
+  };
   const prepareContextExecution = async (input2) => {
     if (disposed)
       throw new Error("DSH host facade is disposed");
@@ -24302,10 +26188,34 @@ function createDshHostFacade(options) {
     if (input2.selectedOnly && historyContext.items.length !== 0) {
       throw new Error("Selected-only summary execution cannot include other shared history");
     }
-    await open6();
+    await open7();
     if (disposed || promptActive || projectionActive)
       throw new Error("DSH host facade permits only one active write");
     const parent = requireAgent(handle);
+    const revision = historyContext.content_revision ?? 0;
+    if (revision < Math.max(contentRevision, recordedRevision(parent.session)))
+      throw new Error("Stale retired DSH context revision");
+    if (revision !== contentRevision || revision > 0 && !executionSessionId.endsWith(createHash7("sha256").update(`${executionBinding}:${revision}`).digest("hex").slice(0, 32))) {
+      await releaseExecutionHandle();
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      contentRevision = revision;
+      const binding = `${executionBinding}:${revision}`;
+      executionSessionId = `gatherthread-execution-${createHash7("sha256").update(binding).digest("hex").slice(0, 32)}`;
+      executionOwnerId = `gatherthread-execution-owner:${createHash7("sha256").update(binding).digest("hex")}`;
+      executionOwnerText = JSON.stringify({
+        version: 1,
+        owner: "gatherthread",
+        native_session_id: options.sessionId,
+        execution_session_id: executionSessionId,
+        binding: options.contextBinding,
+        content_revision: revision
+      });
+      const marker = await createIsolatedMessage(`gatherthread-retired:${revision}`, "GatherThread previous execution context is local only.", options);
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+      parent.session.append("user/message", marker, { surfaceOp: "append" });
+      await sessions.flush(parent.session);
+      throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
+    }
     assertExecutionParentIdle();
     const presets = asObject4(context.get("agentPresets"));
     let parentPreset;
@@ -24314,7 +26224,8 @@ function createDshHostFacade(options) {
         throw new Error("Pinned DSH public preset inheritance API is unavailable; refusing an isolated Agent without native tools");
       }
       parentPreset = presets.composedPreset(parent.ctx);
-      if (parentPreset === void 0 && (!Array.isArray(presets.roots) || presets.roots.length > 0)) {
+      const roots = Array.isArray(presets.roots) ? presets.roots : void 0;
+      if (parentPreset === void 0 && roots !== void 0 && roots.length > 0) {
         throw new Error("Native DSH Agent has no composed preset; restore its tool composition before using summarized context");
       }
     }
@@ -24323,7 +26234,7 @@ function createDshHostFacade(options) {
         throw new Error("DSH isolated Agent did not inherit its native Agent's exact tool composition");
       }
     };
-    const markerId = `gatherthread-context:${createHash5("sha256").update(JSON.stringify({
+    const markerId = `gatherthread-context:${createHash7("sha256").update(JSON.stringify({
       requestId: input2.requestId,
       requestSequence: input2.requestSequence,
       selectedOnly: input2.selectedOnly,
@@ -24348,7 +26259,7 @@ function createDshHostFacade(options) {
           sessionId: executionSessionId,
           meta: {
             cwd: options.workspacePath,
-            parentSession: options.sessionId,
+            parentSession: nativeSessionId,
             origin: "subagent",
             ...parentPreset === void 0 ? {} : { agentPreset: parentPreset }
           },
@@ -24362,7 +26273,7 @@ function createDshHostFacade(options) {
         }
         const agent2 = operationAgent(executionSessionId);
         if (!stored) {
-          if (agent2.session.id !== executionSessionId || agent2.session.seq !== 0 || agent2.session.header?.parentSession !== options.sessionId || agent2.session.header.origin !== "subagent" || agent2.session.header.cwd !== options.workspacePath || agent2.status !== "idle") {
+          if (agent2.session.id !== executionSessionId || agent2.session.seq !== 0 || agent2.session.header?.parentSession !== nativeSessionId || agent2.session.header.origin !== "subagent" || agent2.session.header.cwd !== options.workspacePath || agent2.status !== "idle") {
             throw new Error("DSH did not create a fresh, owned isolated execution Session");
           }
           const ownerMessage = await createIsolatedMessage(executionOwnerId, executionOwnerText, options);
@@ -24398,7 +26309,7 @@ ${JSON.stringify(historyContext.items)}`;
         const nodes = agent.session.surface?.nodes;
         if (!Array.isArray(nodes) || nodes.some((seq) => !Number.isSafeInteger(seq) || seq < 0 || seq >= agent.session.seq) || new Set(nodes).size !== nodes.length)
           throw new Error("Pinned DSH public Session surface API is unavailable or invalid");
-        agent.session.append("user/message", message, nodes.length === 0 ? { surfaceOp: "append" } : { surfaceOp: { op: "replace", start: nodes[0], end: nodes.at(-1) }, sourceEventSeqs: [...nodes] });
+        agent.session.append("user/message", message, nodes.length === 0 ? { surfaceOp: "append" } : { surfaceOp: { op: "replace", startSeq: nodes[0], endSeq: nodes.at(-1) }, sourceEventSeqs: [...nodes] });
       }
       await sessions.flush(agent.session);
       throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
@@ -24407,11 +26318,11 @@ ${JSON.stringify(historyContext.items)}`;
       projectionActive = false;
     }
   };
-  const setupNativeAgent = async (agentContext) => {
+  const setupNativeAgent = async (agentContext, agentValue) => {
     const presets = asObject4(context.get("agentPresets"));
     if (presets === void 0 || Array.isArray(presets.roots) && presets.roots.length === 0)
       return;
-    const agent = asAgent(asObject4(agentContext)?.agent);
+    const agent = asAgent(agentValue);
     const projections = asObject4(context.get("sessionProjections"));
     if (agent === void 0 || typeof presets.mount !== "function" || typeof projections?.stateOf !== "function") {
       throw new Error("Pinned DSH public native preset composition API is unavailable");
@@ -24422,7 +26333,7 @@ ${JSON.stringify(historyContext.items)}`;
     }
     await presets.mount(agentContext, recorded ?? options.agentPreset);
   };
-  const open6 = () => {
+  const open7 = () => {
     if (disposed)
       return Promise.reject(new Error("DSH host facade is disposed"));
     if (openPromise !== void 0)
@@ -24514,7 +26425,8 @@ ${JSON.stringify(historyContext.items)}`;
       return parsed;
     });
   };
-  const prompt = async (text, requestedSelection, requestedExecutionId) => {
+  const prompt = async (text, requestedSelection, requestedExecutionId, signal) => {
+    signal?.throwIfAborted();
     if (disposed)
       throw new Error("DSH host facade is disposed");
     if (!text.trim())
@@ -24529,11 +26441,15 @@ ${JSON.stringify(historyContext.items)}`;
     promptActive = true;
     let disposeSelection;
     let selectionRef;
+    let abortPrompt;
     try {
       if (requestedExecutionId === void 0)
-        await open6();
+        await open7();
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
       const agent = operationAgent(requestedExecutionId);
+      signal?.throwIfAborted();
+      if (signal && typeof agent.cancel !== "function")
+        throw new Error("DSH public cancel API is required for deletion-safe execution");
       if (requestedExecutionId !== void 0) {
         assertExecutionParentIdle();
         assertExecutionOwnership(agent);
@@ -24551,7 +26467,7 @@ ${JSON.stringify(historyContext.items)}`;
         }
       }
       const fromSequence = agent.session.seq;
-      const message = requestedExecutionId === void 0 ? await createUserMessage(text, options) : await createIsolatedMessage(`gatherthread-request:${createHash5("sha256").update(`${requestedExecutionId}:${fromSequence}:${text}`).digest("hex")}`, text, options);
+      const message = requestedExecutionId === void 0 ? await createUserMessage(text, options) : await createIsolatedMessage(`gatherthread-request:${createHash7("sha256").update(`${requestedExecutionId}:${fromSequence}:${text}`).digest("hex")}`, text, options);
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
       if (agent.status !== "idle" || agent.session.seq !== fromSequence)
         throw new Error("DSH Agent changed while preparing a GatherThread prompt");
@@ -24559,8 +26475,41 @@ ${JSON.stringify(historyContext.items)}`;
         assertExecutionParentIdle();
         assertExecutionOwnership(agent);
       }
+      if (liveSubscribers.size > 0) {
+        let imported;
+        try {
+          imported = asObject4(await (options.moduleImporter ?? importDshModule)(USER_MESSAGE_MODULE));
+        } catch {
+        }
+        throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
+        if (agent.status !== "idle" || agent.session.seq !== fromSequence)
+          throw new Error("DSH Agent changed while preparing live output");
+        livePrompt = {
+          agent,
+          closed: false,
+          revision: 0,
+          nativeFrames: typeof imported?.expandAssistantStream === "function",
+          ...typeof imported?.isAgentLoopRequest === "function" ? { isLoopRequest: imported.isAgentLoopRequest } : {},
+          provider: requestedSelection?.provider ?? options.provider,
+          model: requestedSelection?.model ?? options.model
+        };
+      }
+      signal?.throwIfAborted();
       agent.followup(message);
+      abortPrompt = () => {
+        livePrompt = void 0;
+        if (typeof agent.cancel === "function")
+          agent.cancel({ kind: "user" });
+        else if (requestedExecutionId !== void 0)
+          void releaseExecutionHandle();
+        else
+          void releaseHandle();
+      };
+      signal?.addEventListener("abort", abortPrompt, { once: true });
+      if (signal?.aborted)
+        abortPrompt();
       await agent.whenIdle();
+      signal?.throwIfAborted();
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
       await sessions.flush(agent.session);
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
@@ -24571,18 +26520,21 @@ ${JSON.stringify(historyContext.items)}`;
         events: snapshotFrom(fromSequence, requestedExecutionId)
       };
     } finally {
+      if (abortPrompt)
+        signal?.removeEventListener("abort", abortPrompt);
       if (selectionRef !== void 0) {
         selectionRef.current = void 0;
         selectionRef.assembled = void 0;
       }
       disposeSelection?.();
+      livePrompt = void 0;
       promptActive = false;
     }
   };
   const flush = async () => {
     if (disposed)
       throw new Error("DSH host facade is disposed");
-    await open6();
+    await open7();
     throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
     await sessions.flush(requireAgent(handle).session);
     throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
@@ -24596,7 +26548,7 @@ ${JSON.stringify(historyContext.items)}`;
       return;
     projectionActive = true;
     try {
-      await open6();
+      await open7();
       throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
       const agent = requireAgent(handle);
       if (agent.status !== "idle") {
@@ -24639,7 +26591,7 @@ ${JSON.stringify(historyContext.items)}`;
       } catch {
       }
       try {
-        await contextPreparationPromise;
+        await contextOperationPromise;
       } catch {
       }
       try {
@@ -24654,20 +26606,33 @@ ${JSON.stringify(historyContext.items)}`;
     return disposePromise;
   };
   return {
-    sessionId: options.sessionId,
-    open: open6,
+    get sessionId() {
+      return nativeSessionId;
+    },
+    ...options.contextBinding === void 0 ? {} : { contextDeletionVersion: 1 },
+    resetCanonicalContext(revision) {
+      if (contextOperationPromise !== void 0)
+        return Promise.reject(new Error("DSH host facade permits only one active context operation"));
+      const operation = resetCanonicalContext(revision);
+      contextOperationPromise = operation;
+      return operation.finally(() => {
+        if (contextOperationPromise === operation)
+          contextOperationPromise = void 0;
+      });
+    },
+    open: open7,
     currentSequence(requestedExecutionId) {
       return operationAgent(requestedExecutionId).session.seq;
     },
     snapshotFrom,
     prepareContextExecution(input2) {
-      if (contextPreparationPromise !== void 0)
+      if (contextOperationPromise !== void 0)
         return Promise.reject(new Error("DSH host facade permits only one active context preparation"));
       const operation = prepareContextExecution(input2);
-      contextPreparationPromise = operation;
+      contextOperationPromise = operation;
       return operation.finally(() => {
-        if (contextPreparationPromise === operation)
-          contextPreparationPromise = void 0;
+        if (contextOperationPromise === operation)
+          contextOperationPromise = void 0;
       });
     },
     projectCanonicalEvents,
@@ -24679,6 +26644,12 @@ ${JSON.stringify(historyContext.items)}`;
       eventSubscribers.add(listener);
       return () => eventSubscribers.delete(listener);
     },
+    onLiveOutput(listener) {
+      if (disposed)
+        throw new Error("DSH host facade is disposed");
+      liveSubscribers.add(listener);
+      return () => liveSubscribers.delete(listener);
+    },
     onStatus(listener) {
       if (disposed)
         throw new Error("DSH host facade is disposed");
@@ -24711,6 +26682,7 @@ async function registerDshNativeWorkspace(contextValue, workspacePath, workspace
   const sessionQuery = requireService(context, "sessionQuery", ["readSession"]);
   const sessionTitle = requireService(context, "sessionTitle", ["rename", "get"]);
   const completed = /* @__PURE__ */ new Map();
+  const retired = /* @__PURE__ */ new Set();
   const observedSessionIds = new Set(workspace.sessionIds);
   const runningSessionIds = /* @__PURE__ */ new Set();
   const offActivity = context.on("agent/status", (...args) => {
@@ -24731,6 +26703,10 @@ async function registerDshNativeWorkspace(contextValue, workspacePath, workspace
       return;
     observedSessionIds.add(session.id);
     const event = asSessionEvent(args[1]);
+    if (event?.type === "user/message" && /^gatherthread-retired:[0-9]+$/.test(String(asObject4(event.data)?.id)) && asObject4(asObject4(event.data)?.source)?.plugin === "gatherthread") {
+      retired.add(session.id);
+      completed.delete(session.id);
+    }
     if (event?.type === "turn/start")
       runningSessionIds.add(session.id);
     if (event?.type === "turn/end")
@@ -24781,6 +26757,10 @@ async function registerDshNativeWorkspace(contextValue, workspacePath, workspace
       for (const localSessionId of [...currentIds]) {
         if (!isUserCreatedDshSessionId(localSessionId))
           continue;
+        if (retired.has(localSessionId)) {
+          candidates.delete(localSessionId);
+          continue;
+        }
         const cached2 = completed.get(localSessionId);
         if (cached2 !== void 0)
           continue;
@@ -24795,8 +26775,11 @@ async function registerDshNativeWorkspace(contextValue, workspacePath, workspace
             throw new Error("Pinned DSH Session reader returned an invalid event");
           return parsed;
         });
-        if (!hasCompletedDshLocalTurn(events, localSessionId))
+        if (!hasCompletedDshLocalTurn(events, localSessionId)) {
+          completed.delete(localSessionId);
+          candidates.delete(localSessionId);
           continue;
+        }
         const title = live === void 0 ? titleFromEvents(events) : normalizedLocalSessionTitle(sessionTitle.get(live)?.title) ?? titleFromEvents(events);
         const candidate = { localSessionId, title };
         completed.set(localSessionId, candidate);
@@ -24821,8 +26804,10 @@ async function registerDshNativeWorkspace(contextValue, workspacePath, workspace
             return;
           events.push(parsed);
         }
-        if (!hasCompletedDshLocalTurn(events, session.id))
+        if (!hasCompletedDshLocalTurn(events, session.id)) {
+          completed.delete(session.id);
           return;
+        }
         completed.set(session.id, {
           localSessionId: session.id,
           title: normalizedLocalSessionTitle(sessionTitle.get(session)?.title) ?? titleFromEvents(events)
@@ -24903,8 +26888,11 @@ async function createProjectionMessage(projection, options) {
   });
 }
 function formatProjectionText(projection) {
-  if (projection.role === "user")
-    return projection.content;
+  if (projection.role === "user") {
+    const sender = projection.actorDisplayName?.replace(/[\p{Cc}\p{Cf}【】]+/gu, " ").replace(/\s+/gu, " ").trim();
+    return sender ? `\u3010${sender} \xB7 GatherThread\u3011
+${projection.content}` : projection.content;
+  }
   const route = [projection.provider, projection.model].filter(Boolean).join(" / ");
   const attribution = [projection.actorDisplayName, route].filter(Boolean).join(" \xB7 ");
   return `[GatherThread remote Agent reply${attribution ? ` \xB7 ${attribution}` : ""}]
@@ -25069,9 +27057,9 @@ function asObject4(value) {
 }
 
 // dist/src/native-connection.js
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import path6 from "node:path";
+import path7 from "node:path";
 var DSH_NATIVE_CREDENTIAL_KEY = "gatherthread-dsh-host/default";
 var DSH_NATIVE_GRANT_SCHEMA_VERSION = 2;
 var DSH_NATIVE_PAIRING_CHANNEL = "/gatherthread";
@@ -25204,7 +27192,7 @@ function createNativeProjectConfig(options) {
     projectId: options.binding.projectId,
     projectName: options.binding.projectName,
     deviceId: options.grant.deviceId,
-    workspacePath: path6.resolve(options.workspacePath),
+    workspacePath: path7.resolve(options.workspacePath),
     stateRoot,
     provider: options.binding.provider,
     model: options.binding.model,
@@ -25293,12 +27281,12 @@ function normalizeDshServerUrl(value) {
   return { serverUrl, apiUrl: `${serverUrl}/v1` };
 }
 function nativeStateRoot(dshHome, serverUrl, projectId, workspacePath) {
-  const digest3 = createHash6("sha256").update(JSON.stringify([serverUrl, projectId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
-  return path6.join(path6.resolve(dshHome), "gatherthread", "state", digest3);
+  const digest3 = createHash8("sha256").update(JSON.stringify([serverUrl, projectId, path7.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  return path7.join(path7.resolve(dshHome), "gatherthread", "state", digest3);
 }
 function resolveDshHome(env) {
   const configured = env.DSH_HOME?.trim();
-  return path6.resolve(configured ? configured : path6.join(homedir3(), ".dsh"));
+  return path7.resolve(configured ? configured : path7.join(homedir3(), ".dsh"));
 }
 function parseBinding(value) {
   const input2 = exactObject(value, /* @__PURE__ */ new Set([
@@ -25442,8 +27430,8 @@ function isLoopback2(hostname3) {
 }
 
 // dist/src/project-manager.js
-import path7 from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import path8 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
 
 // dist/src/execution-gate.js
 var BoundedDshExecutionGate = class {
@@ -25722,6 +27710,27 @@ var DshProjectManager = class {
     for (const error62 of permissions.errors)
       this.#reportError(error62);
     const eligibleSessions = [...permissions.eligibleSessions];
+    const sessionUpdateErrors = [];
+    for (const session of eligibleSessions) {
+      const binding = this.#managed.get(session.id);
+      if (binding?.phase === "active" && !binding.connector.stopped) {
+        try {
+          binding.connector.updateSessionSummary(session);
+        } catch (error62) {
+          this.#managed.delete(session.id);
+          try {
+            await binding.connector.stop();
+          } catch (stopError) {
+            this.#reportError(publicError2(stopError, "DSH Session connector cleanup failed"));
+          }
+          if (!this.#stopped)
+            this.#recordFailure(session.id);
+          const failure2 = publicError2(error62, `DSH Session ${session.id} mode refresh failed`);
+          sessionUpdateErrors.push(failure2);
+          this.#reportError(failure2);
+        }
+      }
+    }
     if (this.#discoverLocalSessions !== void 0) {
       try {
         const candidates2 = await this.#discoverLocalSessions();
@@ -25765,7 +27774,7 @@ var DshProjectManager = class {
       status: "updated",
       eligibleSessionIds: [...eligibleIds].sort(),
       activeSessionIds: this.activeSessionIds(),
-      errors: [...permissions.errors, ...attachErrors]
+      errors: [...permissions.errors, ...sessionUpdateErrors, ...attachErrors]
     };
     this.#notifyStatus({
       state: "connected",
@@ -25880,7 +27889,7 @@ function projectSessionConfig(config2, sessionId, nativeSessionId) {
     sessionId,
     deviceId: config2.deviceId,
     workspacePath: config2.workspacePath,
-    statePath: path7.join(config2.stateRoot, `${dshSessionId}.json`),
+    statePath: path8.join(config2.stateRoot, `${dshSessionId}.json`),
     provider: config2.provider,
     model: config2.model,
     ...config2.executionProfiles === void 0 ? {} : {
@@ -25898,7 +27907,7 @@ function projectSessionConfig(config2, sessionId, nativeSessionId) {
   };
 }
 function nativeSessionCreationKey(projectId, localSessionId) {
-  const identity = createHash7("sha256").update(`${projectId}\0${localSessionId}`).digest("hex");
+  const identity = createHash9("sha256").update(`${projectId}\0${localSessionId}`).digest("hex");
   return `dsh-native:${identity}`;
 }
 function retryDelay(config2, attempts) {
@@ -25928,31 +27937,31 @@ function publicError2(error62, fallback) {
 }
 
 // dist/src/state-store.js
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { constants as constants3 } from "node:fs";
-import { lstat as lstat6, mkdir as mkdir4, open as open5, rename as rename3, unlink as unlink3 } from "node:fs/promises";
-import path8 from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { constants as constants4 } from "node:fs";
+import { lstat as lstat7, mkdir as mkdir5, open as open6, rename as rename3, unlink as unlink4 } from "node:fs/promises";
+import path9 from "node:path";
 var FileConnectorStateStore = class {
   #path;
   constructor(statePath) {
-    if (!path8.isAbsolute(statePath))
+    if (!path9.isAbsolute(statePath))
       throw new Error("DSH connector state path must be absolute");
-    this.#path = path8.resolve(statePath);
+    this.#path = path9.resolve(statePath);
   }
   async load() {
-    const directory = path8.dirname(this.#path);
+    const directory = path9.dirname(this.#path);
     const ancestorsBefore = await secureDirectoryChain(directory);
     let metadata;
     try {
-      metadata = await lstat6(this.#path);
+      metadata = await lstat7(this.#path);
     } catch (error62) {
       if (isNodeError4(error62) && error62.code === "ENOENT")
         return void 0;
       throw error62;
     }
     assertPrivateRegularFile(metadata, "DSH connector state");
-    const noFollow = "O_NOFOLLOW" in constants3 ? constants3.O_NOFOLLOW : 0;
-    const handle = await open5(this.#path, constants3.O_RDONLY | noFollow);
+    const noFollow = "O_NOFOLLOW" in constants4 ? constants4.O_NOFOLLOW : 0;
+    const handle = await open6(this.#path, constants4.O_RDONLY | noFollow);
     let raw;
     try {
       const opened = await handle.stat();
@@ -25974,17 +27983,17 @@ var FileConnectorStateStore = class {
   }
   async save(state) {
     const validated = validateConnectorState(structuredClone(state));
-    const directory = path8.dirname(this.#path);
+    const directory = path9.dirname(this.#path);
     await secureDirectoryChain(directory);
-    await mkdir4(directory, { recursive: true, mode: 448 });
+    await mkdir5(directory, { recursive: true, mode: 448 });
     const ancestorsBefore = await secureDirectoryChain(directory);
-    const directoryBefore = await lstat6(directory);
+    const directoryBefore = await lstat7(directory);
     assertSecureDirectory(directoryBefore);
     const targetBefore = await optionalLstat(this.#path);
     if (targetBefore !== void 0)
       assertPrivateRegularFile(targetBefore, "DSH connector state");
-    const temporaryPath = `${this.#path}.tmp-${process.pid}-${randomUUID3()}`;
-    const handle = await open5(temporaryPath, "wx", 384);
+    const temporaryPath = `${this.#path}.tmp-${process.pid}-${randomUUID6()}`;
+    const handle = await open6(temporaryPath, "wx", 384);
     try {
       await handle.writeFile(`${JSON.stringify(validated, null, 2)}
 `, { encoding: "utf8" });
@@ -25993,7 +28002,7 @@ var FileConnectorStateStore = class {
       await handle.close();
     }
     try {
-      const directoryAfter = await lstat6(directory);
+      const directoryAfter = await lstat7(directory);
       if (directoryAfter.isSymbolicLink() || directoryAfter.dev !== directoryBefore.dev || directoryAfter.ino !== directoryBefore.ino) {
         throw new Error("DSH connector state directory changed during atomic save");
       }
@@ -26004,9 +28013,9 @@ var FileConnectorStateStore = class {
       }
       await rename3(temporaryPath, this.#path);
       assertSameDirectoryChain(ancestorsBefore, await secureDirectoryChain(directory));
-      assertPrivateRegularFile(await lstat6(this.#path), "DSH connector state");
+      assertPrivateRegularFile(await lstat7(this.#path), "DSH connector state");
     } catch (error62) {
-      await unlink3(temporaryPath).catch(() => void 0);
+      await unlink4(temporaryPath).catch(() => void 0);
       throw error62;
     }
   }
@@ -26023,7 +28032,10 @@ function validateConnectorState(value) {
     "publishedDshSequence",
     ...legacyUploadPolicy ? [] : ["automaticUpload"],
     "activeRequest",
-    "outbox"
+    "outbox",
+    "contentRevision",
+    "projectionSessionId",
+    "localOnlySessionIds"
   ]), "state");
   if (state.version !== 1 && state.version !== 2 && state.version !== 3) {
     throw new Error("Unsupported DSH connector state version");
@@ -26038,6 +28050,9 @@ function validateConnectorState(value) {
     throw new Error("state.outbox must be an array");
   const outbox = state.outbox.map(parseOutboxOperation);
   const validated = {
+    ...state.contentRevision === void 0 ? {} : { contentRevision: nonNegativeInteger(state.contentRevision, "state.contentRevision") },
+    ...state.projectionSessionId === void 0 ? {} : { projectionSessionId: safeString(state.projectionSessionId, "state.projectionSessionId", 128) },
+    ...state.localOnlySessionIds === void 0 ? {} : { localOnlySessionIds: parseRetiredSessionIds(state.localOnlySessionIds) },
     version: 3,
     binding: {
       projectId: safeString(binding.projectId, "state.binding.projectId", 128),
@@ -26056,8 +28071,9 @@ function validateConnectorState(value) {
 }
 function parseActiveRequest(value) {
   const active = requiredObject4(value, "state.activeRequest");
-  exactKeys(active, /* @__PURE__ */ new Set(["requestId", "requestSequence", "dshFromSequence", "dshToSequence", "promptDigest", "claimAttempt", "contextExecution"]), "state.activeRequest");
+  exactKeys(active, /* @__PURE__ */ new Set(["requestId", "requestSequence", "dshFromSequence", "dshToSequence", "promptDigest", "claimAttempt", "contextExecution", "contentRevision"]), "state.activeRequest");
   const parsed = {
+    ...active.contentRevision === void 0 ? {} : { contentRevision: nonNegativeInteger(active.contentRevision, "state.activeRequest.contentRevision") },
     requestId: safeString(active.requestId, "state.activeRequest.requestId", 128),
     requestSequence: positiveInteger(active.requestSequence, "state.activeRequest.requestSequence"),
     dshFromSequence: nonNegativeInteger(active.dshFromSequence, "state.activeRequest.dshFromSequence"),
@@ -26133,7 +28149,8 @@ function parseLocalTurnInput(value, label) {
     "observedReasoningEffort",
     "requestPayload",
     "responsePayload",
-    "toolEvents"
+    "toolEvents",
+    "contentRevision"
   ]), label);
   const occurredAt = safeString(input2.occurredAt, `${label}.occurredAt`, 64);
   if (!Number.isFinite(Date.parse(occurredAt)))
@@ -26143,6 +28160,7 @@ function parseLocalTurnInput(value, label) {
   }
   return {
     localTurnId: safeString(input2.localTurnId, `${label}.localTurnId`, 200),
+    ...input2.contentRevision === void 0 ? {} : { contentRevision: nonNegativeInteger(input2.contentRevision, `${label}.contentRevision`) },
     runtimeId: safeString(input2.runtimeId, `${label}.runtimeId`, 128),
     basedOnSequence: nonNegativeInteger(input2.basedOnSequence, `${label}.basedOnSequence`),
     occurredAt,
@@ -26170,13 +28188,15 @@ function parseAppendInput(value, label) {
     "runtimeId",
     "claimAttempt",
     "observedModel",
-    "observedReasoningEffort"
+    "observedReasoningEffort",
+    "contentRevision"
   ]), label);
   if (input2.type !== "tool_call" && input2.type !== "tool_result") {
     throw new Error(`${label}.type must be tool_call or tool_result`);
   }
   return {
     type: input2.type,
+    ...input2.contentRevision === void 0 ? {} : { contentRevision: nonNegativeInteger(input2.contentRevision, `${label}.contentRevision`) },
     idempotencyKey: safeString(input2.idempotencyKey, `${label}.idempotencyKey`, 200),
     payload: jsonValue(input2.payload, `${label}.payload`),
     ...input2.replyTo === void 0 ? {} : { replyTo: safeString(input2.replyTo, `${label}.replyTo`, 128) },
@@ -26193,9 +28213,10 @@ function parseAppendInput(value, label) {
 }
 function parseCompletionInput(value, label) {
   const input2 = requiredObject4(value, label);
-  exactKeys(input2, /* @__PURE__ */ new Set(["runtimeId", "claimAttempt", "idempotencyKey", "payload", "observedModel", "observedReasoningEffort"]), label);
+  exactKeys(input2, /* @__PURE__ */ new Set(["runtimeId", "claimAttempt", "idempotencyKey", "payload", "observedModel", "observedReasoningEffort", "contentRevision"]), label);
   return {
     runtimeId: safeString(input2.runtimeId, `${label}.runtimeId`, 128),
+    ...input2.contentRevision === void 0 ? {} : { contentRevision: nonNegativeInteger(input2.contentRevision, `${label}.contentRevision`) },
     ...input2.claimAttempt === void 0 ? {} : {
       claimAttempt: positiveInteger(input2.claimAttempt, `${label}.claimAttempt`)
     },
@@ -26207,6 +28228,11 @@ function parseCompletionInput(value, label) {
     }
   };
 }
+function parseRetiredSessionIds(value) {
+  if (!Array.isArray(value) || value.length > 4096 || new Set(value).size !== value.length)
+    throw new Error("Invalid DSH retired Session identities");
+  return value.map((id, index) => safeString(id, `state.localOnlySessionIds[${index}]`, 128));
+}
 function assertAlreadyRedacted(state) {
   const encoded = JSON.stringify(state);
   const redacted = JSON.stringify(redactValue(state));
@@ -26269,7 +28295,7 @@ function isNodeError4(error62) {
 }
 async function optionalLstat(target) {
   try {
-    return await lstat6(target);
+    return await lstat7(target);
   } catch (error62) {
     if (isNodeError4(error62) && error62.code === "ENOENT")
       return void 0;
@@ -26526,7 +28552,10 @@ var RPC_ENDPOINTS = /* @__PURE__ */ new Set([
   "sync/set-auto-upload",
   "sync/upload",
   "code/authorize",
-  "code/action"
+  "code/action",
+  "github/authorize",
+  "github/action",
+  "github/connect"
 ]);
 var MAX_CATALOG_PROVIDERS = 64;
 var MAX_CATALOG_MODELS = 256;
@@ -26628,6 +28657,12 @@ var DshNativeHostController = class {
               projectName: this.#projects.get(projectId)?.name ?? projectId,
               ...view
             }];
+          }).slice(0, 100),
+          githubSync: [...this.#owners].flatMap(([projectId, owner]) => {
+            if (this.#projects.get(projectId)?.role === "viewer")
+              return [];
+            const view = owner.githubSyncView?.();
+            return view === void 0 ? [] : [{ projectId, projectName: this.#projects.get(projectId)?.name ?? projectId, ...view }];
           }).slice(0, 100)
         }
       },
@@ -26889,6 +28924,40 @@ var DshNativeHostController = class {
     }
     return this.publicState();
   }
+  async githubSyncAction(inputValue, authorize = false) {
+    this.#assertAvailable();
+    const input2 = exactInput(inputValue, new Set(authorize ? ["projectId", "enabled", "repository", "base_branch", "revision"] : ["projectId", "action"]));
+    const projectId = safeInputIdentifier(input2.projectId, "projectId");
+    const owner = this.#owners.get(projectId);
+    if (!owner || this.#projects.get(projectId)?.role === "viewer")
+      throw new Error("This Project is not writable on this DSH device");
+    if (authorize) {
+      if (typeof input2.enabled !== "boolean" || !owner.authorizeGitHubSync)
+        throw new Error("Invalid GitHub authorization");
+      let expected;
+      if (input2.enabled) {
+        if (typeof input2.repository !== "string" || typeof input2.base_branch !== "string" || typeof input2.revision !== "string" || input2.repository.length > 160 || input2.base_branch.length > 255 || input2.revision.length > 128)
+          throw new Error("Invalid GitHub target");
+        expected = { repository: input2.repository, base_branch: input2.base_branch, revision: input2.revision };
+      }
+      await owner.authorizeGitHubSync(input2.enabled, expected);
+    } else {
+      if (typeof input2.action !== "string" || !GITHUB_CODE_ACTIONS.includes(input2.action) || !owner.executeGitHubSync)
+        throw new Error("Invalid GitHub action");
+      await owner.executeGitHubSync(input2.action);
+    }
+    return this.publicState();
+  }
+  async connectGitHub(inputValue) {
+    this.#assertAvailable();
+    const input2 = exactInput(inputValue, /* @__PURE__ */ new Set(["projectId"]));
+    const projectId = safeInputIdentifier(input2.projectId, "projectId");
+    if (!this.#owners.has(projectId) || this.#projects.get(projectId)?.role === "viewer") {
+      throw new Error("This Project is not writable on this DSH device");
+    }
+    await connectGitHubAccount();
+    return this.publicState();
+  }
   dispose() {
     this.#disposePromise ??= (async () => {
       this.#disposed = true;
@@ -26990,9 +29059,13 @@ var DshNativeHostController = class {
     if (route === void 0)
       return;
     throwIfAborted(signal);
-    const profilesChanged = await this.#refreshExecutionProfiles(route, signal);
+    const catalogUpdate = await this.#refreshExecutionProfiles(route, signal);
     throwIfAborted(signal);
-    if (profilesChanged) {
+    if (catalogUpdate === "route_unavailable") {
+      await this.#abandonUnavailableRoute(grant);
+      return;
+    }
+    if (catalogUpdate === "changed") {
       for (const owner of this.#owners.values())
         this.#pendingProfileOwners.add(owner);
     }
@@ -27034,16 +29107,17 @@ var DshNativeHostController = class {
   /**
    * Re-read the harness catalog when the route changed or the entry went stale.
    *
-   * Returns whether the catalog differs from the one already advertised. Discovery
-   * is cached per route and also time-bounded: DSH publishes a model metadata
-   * catalog that can gain models while a connection stays open, so a connect-time
-   * snapshot would otherwise keep offering the old list for the life of the process.
+   * Returns whether the catalog differs from the one already advertised, or that
+   * DSH no longer offers the model this connection runs. Discovery is cached per
+   * route and also time-bounded: DSH publishes a model metadata catalog that can
+   * gain models while a connection stays open, so a connect-time snapshot would
+   * otherwise keep offering the old list for the life of the process.
    */
   async #refreshExecutionProfiles(route, signal) {
     const routeKey = `${route.provider}\0${route.model}`;
     const discoveredAt = this.#executionProfilesDiscoveredAt;
     if (this.#executionProfileRouteKey === routeKey && discoveredAt !== void 0 && this.#now() - discoveredAt < EXECUTION_PROFILE_REFRESH_INTERVAL_MS) {
-      return false;
+      return "unchanged";
     }
     const previous = this.#executionProfiles;
     const remember = (profiles2) => {
@@ -27051,18 +29125,44 @@ var DshNativeHostController = class {
       this.#executionProfiles = profiles2;
       this.#executionProfileRouteKey = routeKey;
       this.#executionProfilesDiscoveredAt = this.#now();
-      return changed;
+      return changed ? "changed" : "unchanged";
     };
     if (route.provider !== "deepseek-official")
       return remember(void 0);
     const discovered = this.#options.listExecutionProfiles === void 0 ? await listNativeExecutionProfiles(this.#options.context, route.provider, signal) : await this.#options.listExecutionProfiles(route.provider, signal);
     throwIfAborted(signal);
     const profiles = normalizeExecutionProfiles(discovered, route.provider);
-    if (!profiles.some((profile) => profile.model === route.model)) {
-      throw new Error("DeepSeek Harness did not advertise the configured model as an execution profile");
-    }
+    if (!profiles.some((profile) => profile.model === route.model))
+      return "route_unavailable";
     return remember(profiles);
   }
+  /**
+   * Drop the route after DSH stops offering the model this connection runs.
+   *
+   * A harness catalog is the authority on what a runtime can run, so the route is
+   * abandoned instead of being repointed at another model: registering a
+   * replacement silently would run a model this device never selected. Clearing the
+   * stored route returns the connection to the state it has before its first
+   * selection, where the panel asks for an explicit provider and model against the
+   * harness's current catalog. Owners and the cached declaration go with it, so
+   * nothing keeps advertising the profiles and bindings built from the dropped route.
+   */
+  async #abandonUnavailableRoute(grant) {
+    await this.#stopOwners();
+    this.#executionProfiles = void 0;
+    this.#executionProfileRouteKey = void 0;
+    this.#executionProfilesDiscoveredAt = void 0;
+    this.#grant = await this.#credentials.save({
+      schemaVersion: grant.schemaVersion,
+      serverUrl: grant.serverUrl,
+      apiUrl: grant.apiUrl,
+      deviceId: grant.deviceId,
+      deviceName: grant.deviceName,
+      token: grant.token
+    });
+    this.#recoverableError = "route_unavailable";
+    this.#options.status.setConnection("stopped");
+  }
   /**
    * Republish the current catalog to every owner that has not confirmed it.
    *
@@ -27192,7 +29292,7 @@ async function apply(context, rawConfig) {
     workspacePath: config2.workspacePath,
     ...dshHome === void 0 ? {} : {
       dshHome,
-      projectWorkspaceHomeDirectory: path9.dirname(dshHome)
+      projectWorkspaceHomeDirectory: path10.dirname(dshHome)
     },
     ...config2.officialServerUrl === void 0 ? {} : { officialServerUrl: config2.officialServerUrl }
   });
@@ -27250,6 +29350,12 @@ function registerNativeDshRpc(contextValue, controller) {
           return rpcSuccess(await controller.codeSyncAction(payload, true));
         case "code/action":
           return rpcSuccess(await controller.codeSyncAction(payload));
+        case "github/authorize":
+          return rpcSuccess(await controller.githubSyncAction(payload, true));
+        case "github/action":
+          return rpcSuccess(await controller.githubSyncAction(payload));
+        case "github/connect":
+          return rpcSuccess(await controller.connectGitHub(payload));
         default:
           return rpcFailure("gatherthread/not-found", "GatherThread DSH action is unavailable");
       }
@@ -27344,8 +29450,8 @@ async function createProductionOwner(options) {
     throw error62;
   }
   const codeSync = new DshCodeSyncController({
-    permissionPath: path9.join(config2.stateRoot, `code-consent-${createHash8("sha256").update(actor.id).digest("hex")}.json`),
-    binding: createHash8("sha256").update(JSON.stringify([
+    permissionPath: path10.join(config2.stateRoot, `code-consent-${createHash10("sha256").update(actor.id).digest("hex")}.json`),
+    binding: createHash10("sha256").update(JSON.stringify([
       config2.apiUrl,
       config2.projectId,
       actor.id,
@@ -27360,7 +29466,7 @@ async function createProductionOwner(options) {
       // A custom DSH home is an isolated profile, including its code-sync state.
       // Default profiles keep the harness-neutral state shared with Codex.
       ...options.dshHome === void 0 ? {} : {
-        stateRoot: path9.join(options.dshHome, "gatherthread-code-sync", createHash8("sha256").update(config2.workspacePath).digest("hex"))
+        stateRoot: path10.join(options.dshHome, "gatherthread-code-sync", createHash10("sha256").update(config2.workspacePath).digest("hex"))
       }
     }),
     api: new HttpCollaborationClient({
@@ -27372,8 +29478,77 @@ async function createProductionOwner(options) {
     isBusy: () => nativeWorkspace.isBusy()
   });
   await codeSync.start().catch(() => void 0);
+  const githubSync = new DshGitHubCodeSyncController({
+    permissionPath: path10.join(config2.stateRoot, `github-consent-${createHash10("sha256").update(actor.id).digest("hex")}.json`),
+    binding: createHash10("sha256").update(JSON.stringify([
+      "github",
+      config2.apiUrl,
+      config2.projectId,
+      actor.id,
+      config2.workspacePath
+    ])).digest("hex"),
+    readMetadata: async () => {
+      const response = await fetch(`${config2.apiUrl}/projects/${encodeURIComponent(config2.projectId)}/github`, {
+        headers: { authorization: `Bearer ${options.grant.token}` },
+        redirect: "error",
+        signal: AbortSignal.any([ownerAbort.signal, AbortSignal.timeout(15e3)])
+      });
+      if (!response.ok || !response.body)
+        throw Object.assign(new Error("GitHub metadata unavailable"), { code: "code_github_unavailable" });
+      const reader = response.body.getReader();
+      const chunks = [];
+      let size = 0;
+      try {
+        for (; ; ) {
+          const next = await reader.read();
+          if (next.done)
+            break;
+          size += next.value.byteLength;
+          if (size > 16 * 1024)
+            throw new Error("GitHub metadata too large");
+          chunks.push(next.value);
+        }
+      } finally {
+        await reader.cancel().catch(() => void 0);
+      }
+      const envelope = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      return GitHubProjectStatusSchema.parse(envelope.data);
+    },
+    createEngine: (target) => createGitHubCodeSync({
+      apiUrl: config2.apiUrl,
+      token: options.grant.token,
+      projectId: config2.projectId,
+      actorId: actor.id,
+      workspacePath: config2.workspacePath,
+      repository: target.repository,
+      baseBranch: target.base_branch,
+      revision: target.revision,
+      ...options.dshHome === void 0 ? {} : {
+        stateRoot: path10.join(options.dshHome, "gatherthread-code-sync", createHash10("sha256").update(config2.workspacePath).digest("hex"))
+      }
+    }),
+    api: new HttpCollaborationClient({ baseUrl: config2.apiUrl, bearerToken: options.grant.token, signal: ownerAbort.signal }),
+    runtimes: () => new Map([...codeRuntimes].flatMap(([id, connector]) => connector.stopped || !connector.executionRuntimeId ? [] : [[id, connector.executionRuntimeId]])),
+    isBusy: () => nativeWorkspace.isBusy()
+  });
+  await githubSync.start().catch(() => void 0);
+  let localCodeTail = Promise.resolve();
+  function scheduleCode(operation) {
+    const task = localCodeTail.then(operation);
+    localCodeTail = task.catch(() => void 0);
+    return task;
+  }
+  let codePolling = false;
   const codeTimer = setInterval(() => {
-    void codeSync.poll();
+    if (codePolling)
+      return;
+    codePolling = true;
+    void scheduleCode(async () => {
+      await codeSync.poll();
+      await githubSync.poll();
+    }).catch(() => void 0).finally(() => {
+      codePolling = false;
+    });
   }, 5e3);
   codeTimer.unref();
   let stopPromise;
@@ -27383,14 +29558,19 @@ async function createProductionOwner(options) {
     setLocalAutoUpload: (sessionId, enabled) => manager.setLocalAutoUpload(sessionId, enabled),
     uploadLocalTurns: (sessionId) => manager.uploadLocalTurns(sessionId),
     codeSyncView: () => codeSync.view(),
-    authorizeCodeSync: (enabled) => codeSync.authorize(enabled),
-    executeCodeSync: (action) => codeSync.execute(action),
+    authorizeCodeSync: (enabled) => scheduleCode(() => codeSync.authorize(enabled)),
+    executeCodeSync: (action) => scheduleCode(() => codeSync.execute(action)),
+    githubSyncView: () => githubSync.view(),
+    authorizeGitHubSync: (enabled, expected) => scheduleCode(() => githubSync.authorize(enabled, expected)),
+    executeGitHubSync: (action) => scheduleCode(() => githubSync.execute(action)),
     stop() {
       stopPromise ??= (async () => {
         options.signal.removeEventListener("abort", abortFromRoot);
         clearInterval(codeTimer);
         ownerAbort.abort(new Error("GatherThread native DSH manager stopped"));
+        await localCodeTail;
         await codeSync.stop();
+        await githubSync.stop();
         await manager.stop();
         nativeWorkspace.dispose();
       })();
@@ -27460,6 +29640,7 @@ function createNativeManagedConnector(options) {
       await connector.start();
     },
     updateExecutionProfiles: (profiles) => connector.updateExecutionProfiles(profiles),
+    updateSessionSummary: (session) => connector.updateSessionSummary(session),
     localSyncStatus: () => connector.localSyncStatus(),
     setLocalAutoUpload: (enabled) => connector.setLocalAutoUpload(enabled),
     uploadLocalTurns: () => connector.uploadLocalTurns(),
@@ -27486,7 +29667,7 @@ async function resolveNativeProjectWorkspace(grant, binding, signal, homeDirecto
 }
 function nativeDshHomeFromEnvironment() {
   const value = process.env.DSH_HOME?.trim();
-  return value ? path9.resolve(value) : void 0;
+  return value ? path10.resolve(value) : void 0;
 }
 async function listNativeLlmCatalog(contextValue, signal) {
   const llm = requireLlm(contextValue);