@isarai/maestro 0.1.0 → 0.1.2

package/dist/server.js

@@ -461,7 +461,6 @@ function findCoveringSelfMount(requestedPath) {
   return best;
 }
 function getSharedAgentPaths(home) {
-  const maestroDir = path.join(home, ".maestro");
   const codexDir = path.join(home, ".codex");
   const claudeDir = path.join(home, ".claude");
   const claudeProjectsDir = path.join(claudeDir, "projects");
@@ -469,11 +468,10 @@ function getSharedAgentPaths(home) {
   const gitconfig = path.join(home, ".gitconfig");
   const ghConfigDir = path.join(home, ".config", "gh");
   return {
-    // Codex, Claude, and gh may all persist runtime/session state under their
-    // home config paths when started inside a sandbox. Keep those writable so
-    // the CLIs can boot and authenticate normally while leaving gitconfig
-    // itself read-only.
-    readwrite: [maestroDir, codexDir, claudeDir, claudeProjectsDir, claudeJson, ghConfigDir].filter(fs.existsSync),
+    // Keep only CLI/runtime config writable here. Maestro's own server state
+    // stays outside the generic sandbox mount set and terminal sandboxes use
+    // a dedicated isolated HOME under ~/.maestro/sandboxes/terminals/<id>.
+    readwrite: [codexDir, claudeDir, claudeProjectsDir, claudeJson, ghConfigDir].filter(fs.existsSync),
     readonly: [gitconfig].filter(fs.existsSync)
   };
 }
@@ -1191,27 +1189,76 @@ var init_terminal_replica = __esm({
   }
 });
 
-// ../server/src/agents/worktree.ts
+// ../server/src/state/files.ts
 import * as fs4 from "fs";
 import * as os4 from "os";
 import * as path4 from "path";
+function ensureDataDir() {
+  fs4.mkdirSync(MAESTRO_DATA_DIR, { recursive: true });
+  return MAESTRO_DATA_DIR;
+}
+function ensureDir(dirPath) {
+  fs4.mkdirSync(dirPath, { recursive: true });
+  return dirPath;
+}
+function readJsonFile(filePath, fallback) {
+  try {
+    if (!fs4.existsSync(filePath)) {
+      return fallback;
+    }
+    const raw = fs4.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+function writeJsonFile(filePath, value, options) {
+  ensureDir(path4.dirname(filePath));
+  const tempPath = `${filePath}.tmp`;
+  fs4.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}
+`, {
+    mode: options?.mode
+  });
+  fs4.renameSync(tempPath, filePath);
+  if (options?.mode != null) {
+    fs4.chmodSync(filePath, options.mode);
+  }
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var MAESTRO_DATA_DIR, MAESTRO_PROJECTS_DIR, MAESTRO_SANDBOXES_DIR, MAESTRO_SANDBOX_TERMINALS_DIR, MAESTRO_SANDBOX_WORKTREES_DIR;
+var init_files = __esm({
+  "../server/src/state/files.ts"() {
+    "use strict";
+    MAESTRO_DATA_DIR = path4.join(os4.homedir(), ".maestro");
+    MAESTRO_PROJECTS_DIR = path4.join(MAESTRO_DATA_DIR, "projects");
+    MAESTRO_SANDBOXES_DIR = path4.join(MAESTRO_DATA_DIR, "sandboxes");
+    MAESTRO_SANDBOX_TERMINALS_DIR = path4.join(MAESTRO_SANDBOXES_DIR, "terminals");
+    MAESTRO_SANDBOX_WORKTREES_DIR = path4.join(MAESTRO_SANDBOXES_DIR, "worktrees");
+  }
+});
+
+// ../server/src/agents/worktree.ts
+import * as fs5 from "fs";
+import * as path5 from "path";
 import { execSync as execSync2 } from "child_process";
 function createTerminalWorktree(projectPath, terminalId, startPoint = "HEAD") {
-  const worktreeDir = path4.join(WORKTREE_BASE, terminalId);
+  const worktreeDir = path5.join(WORKTREE_BASE, terminalId);
   const branchName = `agent/${terminalId}`;
-  fs4.mkdirSync(WORKTREE_BASE, { recursive: true });
+  fs5.mkdirSync(WORKTREE_BASE, { recursive: true });
   try {
     execSync2("git worktree prune", { cwd: projectPath, stdio: "ignore" });
   } catch {
   }
-  if (fs4.existsSync(worktreeDir)) {
+  if (fs5.existsSync(worktreeDir)) {
     try {
       execSync2(`git worktree remove --force ${JSON.stringify(worktreeDir)}`, {
         cwd: projectPath,
         stdio: "ignore"
       });
     } catch {
-      fs4.rmSync(worktreeDir, { recursive: true, force: true });
+      fs5.rmSync(worktreeDir, { recursive: true, force: true });
     }
   }
   try {
@@ -1231,16 +1278,16 @@ function createTerminalWorktree(projectPath, terminalId, startPoint = "HEAD") {
   return worktreeDir;
 }
 function removeTerminalWorktree(projectPath, terminalId) {
-  const worktreeDir = path4.join(WORKTREE_BASE, terminalId);
+  const worktreeDir = path5.join(WORKTREE_BASE, terminalId);
   const branchName = `agent/${terminalId}`;
-  if (fs4.existsSync(worktreeDir)) {
+  if (fs5.existsSync(worktreeDir)) {
     try {
       execSync2(
         `git worktree remove --force ${JSON.stringify(worktreeDir)}`,
         { cwd: projectPath, stdio: "ignore" }
       );
     } catch {
-      fs4.rmSync(worktreeDir, { recursive: true, force: true });
+      fs5.rmSync(worktreeDir, { recursive: true, force: true });
     }
   }
   try {
@@ -1271,82 +1318,82 @@ var DEFAULT_WORKTREE_BASE, WORKTREE_BASE;
 var init_worktree = __esm({
   "../server/src/agents/worktree.ts"() {
     "use strict";
-    DEFAULT_WORKTREE_BASE = path4.join(os4.homedir(), ".maestro", "worktrees");
+    init_files();
+    DEFAULT_WORKTREE_BASE = MAESTRO_SANDBOX_WORKTREES_DIR;
     WORKTREE_BASE = process.env.MAESTRO_WORKTREE_BASE?.trim() || DEFAULT_WORKTREE_BASE;
   }
 });
 
 // ../server/src/agents/terminal-isolation.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
+import * as path6 from "path";
 import * as os5 from "os";
-import * as path5 from "path";
 function getGlobalHome() {
   return os5.homedir();
 }
 function getTerminalIsolationPaths(terminalId) {
-  const rootDir = path5.join(TERMINAL_STATE_BASE, terminalId);
+  const rootDir = path6.join(TERMINAL_STATE_BASE, terminalId);
   return {
     rootDir,
-    homeDir: path5.join(rootDir, "home")
+    homeDir: path6.join(rootDir, "home")
   };
 }
 function copyPathIfPresent(source, target) {
-  if (!fs5.existsSync(source) || fs5.existsSync(target)) {
+  if (!fs6.existsSync(source) || fs6.existsSync(target)) {
     return;
   }
-  const stat = fs5.statSync(source);
-  fs5.mkdirSync(path5.dirname(target), { recursive: true });
+  const stat = fs6.statSync(source);
+  fs6.mkdirSync(path6.dirname(target), { recursive: true });
   if (stat.isDirectory()) {
-    fs5.cpSync(source, target, {
+    fs6.cpSync(source, target, {
       recursive: true,
       errorOnExist: false
     });
     return;
   }
-  fs5.copyFileSync(source, target);
+  fs6.copyFileSync(source, target);
 }
 function bootstrapTerminalHome(homeDir) {
-  const markerPath = path5.join(homeDir, BOOTSTRAP_MARKER);
-  if (fs5.existsSync(markerPath)) {
+  const markerPath = path6.join(homeDir, BOOTSTRAP_MARKER);
+  if (fs6.existsSync(markerPath)) {
     return;
   }
   const globalHome = getGlobalHome();
   const copies = [
-    [path5.join(globalHome, ".gitconfig"), path5.join(homeDir, ".gitconfig")],
-    [path5.join(globalHome, ".claude.json"), path5.join(homeDir, ".claude.json")],
-    [path5.join(globalHome, ".config", "gh"), path5.join(homeDir, ".config", "gh")],
-    [path5.join(globalHome, ".claude"), path5.join(homeDir, ".claude")],
-    [path5.join(globalHome, ".codex"), path5.join(homeDir, ".codex")]
+    [path6.join(globalHome, ".gitconfig"), path6.join(homeDir, ".gitconfig")],
+    [path6.join(globalHome, ".claude.json"), path6.join(homeDir, ".claude.json")],
+    [path6.join(globalHome, ".config", "gh"), path6.join(homeDir, ".config", "gh")],
+    [path6.join(globalHome, ".claude"), path6.join(homeDir, ".claude")],
+    [path6.join(globalHome, ".codex"), path6.join(homeDir, ".codex")]
   ];
   for (const [source, target] of copies) {
     copyPathIfPresent(source, target);
   }
-  fs5.writeFileSync(path5.join(homeDir, ".bash_history"), "", { flag: "a" });
-  fs5.writeFileSync(markerPath, (/* @__PURE__ */ new Date()).toISOString());
+  fs6.writeFileSync(path6.join(homeDir, ".bash_history"), "", { flag: "a" });
+  fs6.writeFileSync(markerPath, (/* @__PURE__ */ new Date()).toISOString());
 }
 function ensureTerminalIsolationHome(terminalId) {
   const paths = getTerminalIsolationPaths(terminalId);
-  fs5.mkdirSync(paths.homeDir, { recursive: true });
+  fs6.mkdirSync(paths.homeDir, { recursive: true });
   bootstrapTerminalHome(paths.homeDir);
   return paths;
 }
 function removeTerminalIsolationState(terminalId) {
   const paths = getTerminalIsolationPaths(terminalId);
-  fs5.rmSync(paths.rootDir, { recursive: true, force: true });
+  fs6.rmSync(paths.rootDir, { recursive: true, force: true });
 }
 var DEFAULT_TERMINAL_STATE_BASE, TERMINAL_STATE_BASE, BOOTSTRAP_MARKER;
 var init_terminal_isolation = __esm({
   "../server/src/agents/terminal-isolation.ts"() {
     "use strict";
-    DEFAULT_TERMINAL_STATE_BASE = path5.join(os5.homedir(), ".maestro", "terminals");
+    init_files();
+    DEFAULT_TERMINAL_STATE_BASE = MAESTRO_SANDBOX_TERMINALS_DIR;
     TERMINAL_STATE_BASE = process.env.MAESTRO_TERMINAL_STATE_BASE?.trim() || DEFAULT_TERMINAL_STATE_BASE;
     BOOTSTRAP_MARKER = ".bootstrap-complete";
   }
 });
 
 // ../server/src/agents/dind.ts
-import * as os6 from "os";
-import * as path6 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 function getTerminalDockerResourceSuffix(terminalId) {
   return terminalId.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
@@ -1369,8 +1416,8 @@ function getTerminalDockerRuntime(terminalId) {
 }
 function getSharedTerminalRuntimeMounts() {
   const requestedPaths = [
-    path6.join(os6.homedir(), ".maestro"),
-    path6.join(os6.homedir(), "maestro-projects")
+    MAESTRO_SANDBOXES_DIR,
+    MAESTRO_PROJECTS_DIR
   ];
   return requestedPaths.flatMap((requestedPath) => {
     const mount = resolveDockerMountForPath(requestedPath, false);
@@ -1496,6 +1543,7 @@ var DEFAULT_DIND_IMAGE, DEFAULT_DIND_READY_TIMEOUT_MS, DIND_SOCKET_DIR, DIND_SOC
 var init_dind = __esm({
   "../server/src/agents/dind.ts"() {
     "use strict";
+    init_files();
     init_sandbox();
     DEFAULT_DIND_IMAGE = process.env.MAESTRO_DIND_IMAGE || "docker:29-dind";
     DEFAULT_DIND_READY_TIMEOUT_MS = Number(
@@ -1507,8 +1555,8 @@ var init_dind = __esm({
 });
 
 // ../server/src/integrations/cli-auth.ts
-import * as fs6 from "node:fs";
-import * as os7 from "node:os";
+import * as fs7 from "node:fs";
+import * as os6 from "node:os";
 import * as path7 from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 import * as pty2 from "node-pty";
@@ -1518,7 +1566,7 @@ function stripAnsi(text) {
 function getCredentialHomes() {
   const candidates = [
     process.env.HOME,
-    os7.homedir(),
+    os6.homedir(),
     "/root",
     "/home/sandbox"
   ];
@@ -1570,13 +1618,13 @@ function getClaudeAuthStatusFromCredentials() {
   let bestExpiresAt = -Infinity;
   for (const home of getClaudeCredentialHomes()) {
     const credentialsPath = path7.join(home, ".claude", ".credentials.json");
-    if (!fs6.existsSync(credentialsPath)) {
+    if (!fs7.existsSync(credentialsPath)) {
       logClaudeAuth(`credentials file not found at ${credentialsPath}`);
       continue;
     }
     logClaudeAuth(`found credentials file at ${credentialsPath}`);
     try {
-      const raw = fs6.readFileSync(credentialsPath, "utf8");
+      const raw = fs7.readFileSync(credentialsPath, "utf8");
       const data = JSON.parse(raw);
       const oauth = data.claudeAiOauth;
       if (!oauth?.accessToken) {
@@ -1684,9 +1732,9 @@ function getCodexAuthStatusFromFile() {
   let bestScore = -Infinity;
   for (const home of getCredentialHomes()) {
     const authPath = path7.join(home, ".codex", "auth.json");
-    if (!fs6.existsSync(authPath)) continue;
+    if (!fs7.existsSync(authPath)) continue;
     try {
-      const raw = fs6.readFileSync(authPath, "utf8");
+      const raw = fs7.readFileSync(authPath, "utf8");
       const data = JSON.parse(raw);
       const apiKey = data.OPENAI_API_KEY?.trim();
       const tokens = data.tokens;
@@ -1808,55 +1856,9 @@ var init_cli_auth = __esm({
   }
 });
 
-// ../server/src/state/files.ts
-import * as fs7 from "fs";
-import * as os8 from "os";
-import * as path8 from "path";
-function ensureDataDir() {
-  fs7.mkdirSync(MAESTRO_DATA_DIR, { recursive: true });
-  return MAESTRO_DATA_DIR;
-}
-function ensureDir(dirPath) {
-  fs7.mkdirSync(dirPath, { recursive: true });
-  return dirPath;
-}
-function readJsonFile(filePath, fallback) {
-  try {
-    if (!fs7.existsSync(filePath)) {
-      return fallback;
-    }
-    const raw = fs7.readFileSync(filePath, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return fallback;
-  }
-}
-function writeJsonFile(filePath, value, options) {
-  ensureDir(path8.dirname(filePath));
-  const tempPath = `${filePath}.tmp`;
-  fs7.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}
-`, {
-    mode: options?.mode
-  });
-  fs7.renameSync(tempPath, filePath);
-  if (options?.mode != null) {
-    fs7.chmodSync(filePath, options.mode);
-  }
-}
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-var MAESTRO_DATA_DIR;
-var init_files = __esm({
-  "../server/src/state/files.ts"() {
-    "use strict";
-    MAESTRO_DATA_DIR = path8.join(os8.homedir(), ".maestro");
-  }
-});
-
 // ../server/src/integrations/github.ts
 import * as fs8 from "fs";
-import * as path9 from "path";
+import * as path8 from "path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 function readStoredGitHubConnection() {
   const record = readJsonFile(
@@ -2048,7 +2050,7 @@ var init_github = __esm({
   "../server/src/integrations/github.ts"() {
     "use strict";
     init_files();
-    GITHUB_CONNECTION_PATH = path9.join(ensureDataDir(), "github-connection.json");
+    GITHUB_CONNECTION_PATH = path8.join(ensureDataDir(), "github-connection.json");
   }
 });
 
@@ -2110,7 +2112,7 @@ var init_auth_status_checker = __esm({
 });
 
 // ../server/src/state/sqlite.ts
-import * as path10 from "path";
+import * as path9 from "path";
 import { randomUUID } from "crypto";
 import { DatabaseSync } from "node:sqlite";
 function parseJson(value, fallback) {
@@ -2431,7 +2433,7 @@ var init_sqlite = __esm({
   "../server/src/state/sqlite.ts"() {
     "use strict";
     init_files();
-    dbPath = path10.join(ensureDataDir(), "state.sqlite");
+    dbPath = path9.join(ensureDataDir(), "state.sqlite");
     db = new DatabaseSync(dbPath);
     db.exec(`
   CREATE TABLE IF NOT EXISTS scheduled_tasks (
@@ -2626,7 +2628,7 @@ var init_auto_spawn_provider = __esm({
 
 // ../server/src/state/terminals.ts
 import * as fs9 from "fs";
-import * as path11 from "path";
+import * as path10 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function readTerminals() {
   return readJsonFile(TERMINALS_PATH, []);
@@ -2635,13 +2637,13 @@ function writeTerminals(terminals) {
   writeJsonFile(TERMINALS_PATH, terminals);
 }
 function terminalDir(terminalId) {
-  return ensureDir(path11.join(TERMINAL_HISTORY_DIR, terminalId));
+  return ensureDir(path10.join(TERMINAL_HISTORY_DIR, terminalId));
 }
 function terminalSnapshotPath(terminalId) {
-  return path11.join(terminalDir(terminalId), "snapshot.json");
+  return path10.join(terminalDir(terminalId), "snapshot.json");
 }
 function syncTerminalMeta(terminal) {
-  writeJsonFile(path11.join(terminalDir(terminal.id), "meta.json"), terminal);
+  writeJsonFile(path10.join(terminalDir(terminal.id), "meta.json"), terminal);
 }
 function listTerminalRecords() {
   return readTerminals().sort((a, b) => b.createdAt.localeCompare(a.createdAt));
@@ -2689,7 +2691,7 @@ function deleteTerminalState(terminalId) {
   fs9.rmSync(terminalDir(terminalId), { recursive: true, force: true });
 }
 async function appendTerminalHistoryBatch(terminalId, data) {
-  const historyPath = path11.join(terminalDir(terminalId), "transcript.log");
+  const historyPath = path10.join(terminalDir(terminalId), "transcript.log");
   await fs9.promises.appendFile(historyPath, data);
 }
 function readTerminalSnapshot(terminalId) {
@@ -2714,7 +2716,7 @@ function trimPartialTerminalTail(content) {
   return content.slice(firstNewline + 1);
 }
 function readTerminalHistory(terminalId, maxBytes = 2 * 1024 * 1024) {
-  const historyPath = path11.join(terminalDir(terminalId), "transcript.log");
+  const historyPath = path10.join(terminalDir(terminalId), "transcript.log");
   if (!fs9.existsSync(historyPath)) return "";
   const stat = fs9.statSync(historyPath);
   if (stat.size === 0) return "";
@@ -2732,13 +2734,13 @@ var init_terminals = __esm({
   "../server/src/state/terminals.ts"() {
     "use strict";
     init_files();
-    TERMINALS_PATH = path11.join(ensureDataDir(), "agents.json");
-    TERMINAL_HISTORY_DIR = path11.join(ensureDataDir(), "agents");
+    TERMINALS_PATH = path10.join(ensureDataDir(), "agents.json");
+    TERMINAL_HISTORY_DIR = path10.join(ensureDataDir(), "agents");
   }
 });
 
 // ../server/src/state/projects.ts
-import * as path12 from "path";
+import * as path11 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function readProjects() {
   return readJsonFile(PROJECTS_PATH, []);
@@ -2801,14 +2803,14 @@ var init_projects = __esm({
   "../server/src/state/projects.ts"() {
     "use strict";
     init_files();
-    PROJECTS_PATH = path12.join(ensureDataDir(), "projects.json");
+    PROJECTS_PATH = path11.join(ensureDataDir(), "projects.json");
   }
 });
 
 // ../server/src/state/kanban.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import * as path13 from "path";
+import * as path12 from "path";
 function readOverlays() {
   return readJsonFile(TASK_OVERLAYS_PATH, {});
 }
@@ -3575,8 +3577,8 @@ var init_kanban = __esm({
     init_projects();
     init_github();
     init_terminals();
-    TASK_OVERLAYS_PATH = path13.join(ensureDataDir(), "kanban-overlays.json");
-    LOCAL_TASKS_PATH = path13.join(ensureDataDir(), "local-kanban-tasks.json");
+    TASK_OVERLAYS_PATH = path12.join(ensureDataDir(), "kanban-overlays.json");
+    LOCAL_TASKS_PATH = path12.join(ensureDataDir(), "local-kanban-tasks.json");
     STATUS_LABELS = {
       planned: "maestro:planned",
       ongoing: "maestro:ongoing",
@@ -3613,16 +3615,16 @@ function readCommandError(error, fallback) {
   }
   return error instanceof Error && error.message ? error.message : fallback;
 }
-function runGit2(path20, args) {
+function runGit2(path19, args) {
   return execFileSync6("git", args, {
-    cwd: path20,
+    cwd: path19,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   }).trim();
 }
-function tryRunGit(path20, args) {
+function tryRunGit(path19, args) {
   try {
-    return { ok: true, output: runGit2(path20, args) };
+    return { ok: true, output: runGit2(path19, args) };
   } catch (error) {
     return {
       ok: false,
@@ -3733,20 +3735,20 @@ function decideAutoWorktreeStartPoint(input) {
     reason: "Using local HEAD in a fresh worktree because no remote tracking branch was available."
   };
 }
-function resolveUpstreamRef(path20, currentBranch) {
-  const upstream = tryRunGit(path20, ["rev-parse", "--abbrev-ref", "@{upstream}"]);
+function resolveUpstreamRef(path19, currentBranch) {
+  const upstream = tryRunGit(path19, ["rev-parse", "--abbrev-ref", "@{upstream}"]);
   if (upstream.ok && upstream.output) {
     return upstream.output;
   }
   const originBranch = `refs/remotes/origin/${currentBranch}`;
-  const remoteBranch = tryRunGit(path20, ["show-ref", "--verify", "--quiet", originBranch]);
+  const remoteBranch = tryRunGit(path19, ["show-ref", "--verify", "--quiet", originBranch]);
   if (remoteBranch.ok) {
     return `origin/${currentBranch}`;
   }
   return null;
 }
-function hasGitRef(path20, ref) {
-  return tryRunGit(path20, ["show-ref", "--verify", "--quiet", ref]).ok;
+function hasGitRef(path19, ref) {
+  return tryRunGit(path19, ["show-ref", "--verify", "--quiet", ref]).ok;
 }
 async function resolveAutoWorktreeStartPoint(input) {
   const project = resolveProjectRecord(input);
@@ -5180,8 +5182,8 @@ async function registerTerminalRoutes(app) {
 init_terminal_manager();
 init_github();
 import * as fs12 from "fs";
-import * as os9 from "os";
-import * as path14 from "path";
+import * as os7 from "os";
+import * as path13 from "path";
 import { execFileSync as execFileSync7 } from "node:child_process";
 
 // ../server/src/scheduler/scheduler.ts
@@ -5270,7 +5272,9 @@ init_terminals();
 init_kanban();
 init_projects();
 init_sqlite();
-var MANAGED_PROJECTS_DIR = path14.join(os9.homedir(), "maestro-projects");
+init_files();
+var LEGACY_MANAGED_PROJECTS_DIR = path13.join(os7.homedir(), "maestro-projects");
+var MANAGED_PROJECTS_DIR = MAESTRO_PROJECTS_DIR;
 function slugify(input) {
   return input.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
 }
@@ -5317,11 +5321,26 @@ function getUniqueSlug(name) {
   }
   return slug;
 }
+function ensureManagedProjectsDir() {
+  if (fs12.existsSync(MANAGED_PROJECTS_DIR)) {
+    return MANAGED_PROJECTS_DIR;
+  }
+  if (fs12.existsSync(LEGACY_MANAGED_PROJECTS_DIR)) {
+    fs12.mkdirSync(path13.dirname(MANAGED_PROJECTS_DIR), { recursive: true });
+    fs12.renameSync(LEGACY_MANAGED_PROJECTS_DIR, MANAGED_PROJECTS_DIR);
+    console.log(
+      `Migrated managed projects directory from ${LEGACY_MANAGED_PROJECTS_DIR} to ${MANAGED_PROJECTS_DIR}`
+    );
+    return MANAGED_PROJECTS_DIR;
+  }
+  fs12.mkdirSync(MANAGED_PROJECTS_DIR, { recursive: true });
+  return MANAGED_PROJECTS_DIR;
+}
 function deriveLocalPath(localPath, name) {
   if (localPath?.trim()) {
-    return path14.resolve(localPath.trim());
+    return path13.resolve(localPath.trim());
   }
-  return path14.join(MANAGED_PROJECTS_DIR, slugify(name));
+  return path13.join(ensureManagedProjectsDir(), slugify(name));
 }
 function runGitCommand(args) {
   try {
@@ -5354,7 +5373,7 @@ function cloneRepository(repo, localPath, defaultBranch) {
   if (!repo.repoUrl) {
     return;
   }
-  const parentDir = path14.dirname(localPath);
+  const parentDir = path13.dirname(localPath);
   fs12.mkdirSync(parentDir, { recursive: true });
   ensureProjectPathAvailable(localPath);
   const branch = defaultBranch?.trim();
@@ -5650,17 +5669,17 @@ init_terminal_manager();
 
 // ../server/src/setup/setup-manager.ts
 import * as fs13 from "fs";
-import * as path15 from "path";
-import * as os10 from "os";
+import * as path14 from "path";
+import * as os8 from "os";
 import * as pty3 from "node-pty";
-var FLAG_DIR = path15.join(os10.homedir(), ".maestro");
-var FLAG_FILE = path15.join(FLAG_DIR, "setup-complete");
+var FLAG_DIR = path14.join(os8.homedir(), ".maestro");
+var FLAG_FILE = path14.join(FLAG_DIR, "setup-complete");
 var SENTINEL = "__MAESTRO_SETUP_DONE__";
 var URL_RE = /https?:\/\/[^\s"'<>]+/g;
 var ANSI_RE2 = /\x1b(?:\][^\x07\x1b]*(?:\x07|\x1b\\)?|\[[0-9;]*[A-Za-z])/g;
 var STEP_BOUNDARY_RE = /(?:Running:|Checking|Do you want|Enter|Paste|Token)/i;
 var INSTALL_ROOT = process.env.MAESTRO_INSTALL_ROOT?.trim();
-var SCRIPT_PATH = INSTALL_ROOT ? path15.resolve(INSTALL_ROOT, "assets/setup.sh") : path15.resolve(
+var SCRIPT_PATH = INSTALL_ROOT ? path14.resolve(INSTALL_ROOT, "assets/setup.sh") : path14.resolve(
   import.meta.dirname ?? __dirname,
   "../../scripts/setup.sh"
 );
@@ -5701,7 +5720,7 @@ function startSetupPty(io3, cols, rows) {
     name: "xterm-256color",
     cols: cols ?? 120,
     rows: rows ?? 30,
-    cwd: os10.homedir(),
+    cwd: os8.homedir(),
     env: process.env
   });
   console.log(`[setup] PTY spawned, pid: ${activePty.pid}`);
@@ -6424,19 +6443,29 @@ function renderTemplate(template, item) {
 }
 
 // ../server/src/auth/auth.ts
+init_files();
 import * as crypto2 from "crypto";
 import * as fs14 from "fs";
-import * as os11 from "os";
-import * as path16 from "path";
+import * as path15 from "path";
 import jwt from "jsonwebtoken";
-var MAESTRO_DIR = path16.join(os11.homedir(), ".maestro");
-var SECRET_PATH = path16.join(MAESTRO_DIR, "jwt-secret");
-var TOKEN_PATH = path16.join(MAESTRO_DIR, "api-token");
+var MAESTRO_DIR = MAESTRO_DATA_DIR;
+var SECRET_PATH = path15.join(MAESTRO_DIR, "jwt-secret");
+var TOKEN_PATH = path15.join(MAESTRO_DIR, "token");
+var LEGACY_TOKEN_PATH = path15.join(MAESTRO_DIR, "api-token");
 var jwtSecret;
-function initAuth() {
-  if (!fs14.existsSync(MAESTRO_DIR)) {
-    fs14.mkdirSync(MAESTRO_DIR, { recursive: true });
+function resolveTokenPath() {
+  if (fs14.existsSync(TOKEN_PATH)) {
+    return TOKEN_PATH;
+  }
+  if (fs14.existsSync(LEGACY_TOKEN_PATH)) {
+    fs14.renameSync(LEGACY_TOKEN_PATH, TOKEN_PATH);
+    console.log(`Migrated API token path from ${LEGACY_TOKEN_PATH} to ${TOKEN_PATH}`);
+    return TOKEN_PATH;
   }
+  return TOKEN_PATH;
+}
+function initAuth() {
+  ensureDataDir();
   if (fs14.existsSync(SECRET_PATH)) {
     jwtSecret = fs14.readFileSync(SECRET_PATH, "utf-8").trim();
   } else {
@@ -6444,14 +6473,15 @@ function initAuth() {
     fs14.writeFileSync(SECRET_PATH, jwtSecret, { mode: 384 });
   }
   let apiToken;
-  if (fs14.existsSync(TOKEN_PATH)) {
-    apiToken = fs14.readFileSync(TOKEN_PATH, "utf-8").trim();
+  const tokenPath = resolveTokenPath();
+  if (fs14.existsSync(tokenPath)) {
+    apiToken = fs14.readFileSync(tokenPath, "utf-8").trim();
   } else {
     apiToken = `sym_${crypto2.randomBytes(32).toString("hex")}`;
-    fs14.writeFileSync(TOKEN_PATH, apiToken, { mode: 384 });
+    fs14.writeFileSync(tokenPath, apiToken, { mode: 384 });
     console.log(`
 API token generated: ${apiToken}`);
-    console.log(`Stored at: ${TOKEN_PATH}
+    console.log(`Stored at: ${tokenPath}
 `);
   }
   return { apiToken };
@@ -6467,8 +6497,9 @@ function verifySessionToken(token) {
   }
 }
 function getApiToken() {
-  if (fs14.existsSync(TOKEN_PATH)) {
-    return fs14.readFileSync(TOKEN_PATH, "utf-8").trim();
+  const tokenPath = resolveTokenPath();
+  if (fs14.existsSync(tokenPath)) {
+    return fs14.readFileSync(tokenPath, "utf-8").trim();
   }
   return "";
 }
@@ -6928,11 +6959,11 @@ function stopAutoUpdater() {
 }
 
 // ../server/src/services/ollama.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync5, readFileSync as readFileSync6, existsSync as existsSync15 } from "node:fs";
-import { join as join17 } from "node:path";
-import { homedir as homedir12 } from "node:os";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync5, readFileSync as readFileSync6, existsSync as existsSync15 } from "node:fs";
+import { join as join16 } from "node:path";
+import { homedir as homedir9 } from "node:os";
 var OLLAMA_HOST = process.env.OLLAMA_HOST || "http://localhost:11434";
-var PI_MODELS_PATH = join17(homedir12(), ".pi", "agent", "models.json");
+var PI_MODELS_PATH = join16(homedir9(), ".pi", "agent", "models.json");
 async function getOllamaStatus() {
   try {
     const res = await fetch(`${OLLAMA_HOST}/api/version`);
@@ -7022,8 +7053,8 @@ async function pullOllamaModel(modelName) {
   }
 }
 function writePiModelsConfig(modelId) {
-  const dir = join17(homedir12(), ".pi", "agent");
-  mkdirSync7(dir, { recursive: true });
+  const dir = join16(homedir9(), ".pi", "agent");
+  mkdirSync6(dir, { recursive: true });
   let existing = {};
   if (existsSync15(PI_MODELS_PATH)) {
     try {
@@ -7111,12 +7142,12 @@ function getDisabledStatus(message) {
     latestRelease: null
   };
 }
-async function requestUpdater(path20, init) {
+async function requestUpdater(path19, init) {
   const config = getUpdaterConfig();
   if (!config) {
     throw new Error("Deployment updater is not configured");
   }
-  const res = await fetch(`${config.url}${path20}`, {
+  const res = await fetch(`${config.url}${path19}`, {
     ...init,
     headers: {
       ...config.token ? { Authorization: `Bearer ${config.token}` } : {},
@@ -7271,8 +7302,8 @@ You are a friendly, conversational AI assistant. You communicate via messaging (
 }
 
 // ../pi/src/channels/whatsapp/whatsapp.ts
-import * as os12 from "os";
-import * as path17 from "path";
+import * as os9 from "os";
+import * as path16 from "path";
 import makeWASocket, {
   useMultiFileAuthState,
   DisconnectReason,
@@ -7280,8 +7311,8 @@ import makeWASocket, {
   makeCacheableSignalKeyStore
 } from "@whiskeysockets/baileys";
 import * as QRCode from "qrcode";
-var DATA_DIR = path17.join(os12.homedir(), ".maestro");
-var AUTH_DIR = path17.join(DATA_DIR, "whatsapp-auth");
+var DATA_DIR = path16.join(os9.homedir(), ".maestro");
+var AUTH_DIR = path16.join(DATA_DIR, "whatsapp-auth");
 var sock = null;
 var io = null;
 var connectionStatus = "disconnected";
@@ -7436,13 +7467,13 @@ import {
 
 // ../pi/src/channels/whatsapp/store.ts
 import * as fs15 from "fs";
-import * as os13 from "os";
-import * as path18 from "path";
+import * as os10 from "os";
+import * as path17 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-var DATA_DIR2 = path18.join(os13.homedir(), ".maestro");
+var DATA_DIR2 = path17.join(os10.homedir(), ".maestro");
 fs15.mkdirSync(DATA_DIR2, { recursive: true });
-var dbPath2 = path18.join(DATA_DIR2, "pi.sqlite");
+var dbPath2 = path17.join(DATA_DIR2, "pi.sqlite");
 var db2 = new DatabaseSync2(dbPath2);
 db2.exec(`
   CREATE TABLE IF NOT EXISTS whatsapp_messages (
@@ -7858,13 +7889,13 @@ import {
 
 // ../pi/src/channels/telegram/store.ts
 import * as fs16 from "fs";
-import * as os14 from "os";
-import * as path19 from "path";
+import * as os11 from "os";
+import * as path18 from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-var DATA_DIR3 = path19.join(os14.homedir(), ".maestro");
+var DATA_DIR3 = path18.join(os11.homedir(), ".maestro");
 fs16.mkdirSync(DATA_DIR3, { recursive: true });
-var dbPath3 = path19.join(DATA_DIR3, "pi.sqlite");
+var dbPath3 = path18.join(DATA_DIR3, "pi.sqlite");
 var db3 = new DatabaseSync3(dbPath3);
 db3.exec(`
   CREATE TABLE IF NOT EXISTS telegram_messages (