@jpcasabiancai/cayenne 0.5.6 → 0.5.8

package/dist/cli.js

@@ -31,7 +31,7 @@ var init_cloud = __esm({
     CLOUD_SUPABASE_ANON_KEY = assertPublishable(
       "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im5kcXJrcXh3a3p4Z25oa3ZjdW5yIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODg3MTMyNzYsImV4cCI6MjEwNDI4OTI3Nn0.Dlsxw91E1QYZ4eoRDjP80Rf4feY77Z-T-fiIwUDY2k0"
     );
-    CLOUD_APP_ORIGIN = "https://cayenne-pink.vercel.app";
+    CLOUD_APP_ORIGIN = "https://app.cayenne.sh";
   }
 });
 
@@ -1325,7 +1325,7 @@ var init_local = __esm({
 
 // ../../packages/shared/src/protocol/runner.ts
 import { z as z14 } from "zod";
-var ProviderModel, ProviderCapability, UNAVAILABLE, RunnerCapabilities, CODEX_TOOL_NAMES;
+var ProviderModel, ProviderAuthMode, ProviderCapability, UNAVAILABLE, RunnerCapabilities, CODEX_TOOL_NAMES;
 var init_runner = __esm({
   "../../packages/shared/src/protocol/runner.ts"() {
     "use strict";
@@ -1338,13 +1338,21 @@ var init_runner = __esm({
       /** From the app-server's `supportedReasoningEfforts`; empty means the control is hidden. */
       efforts: z14.array(Effort).default([]),
       /** The effort a new chat on this model opens at, sent back on `session.start`. */
-      defaultEffort: Effort.optional()
+      defaultEffort: Effort.optional(),
+      /** One line about the model in the provider's own words (Claude's `ModelInfo.description`). */
+      description: z14.string().min(1).max(200).optional()
     });
+    ProviderAuthMode = z14.enum(["subscription", "api", "third_party"]);
     ProviderCapability = z14.object({
       available: z14.boolean(),
       reason: z14.enum(["not_installed", "not_logged_in", "error"]).optional(),
       version: z14.string().max(50).optional(),
-      models: z14.array(ProviderModel).max(50).default([])
+      models: z14.array(ProviderModel).max(50).default([]),
+      /**
+       * How the provider is signed in, when the runner can tell without opening a chat (Claude's
+       * `accountInfo`, protocol §9). Absent means unknown. Optional so an older row still parses.
+       */
+      authMode: ProviderAuthMode.optional()
     });
     UNAVAILABLE = { available: false, reason: "not_installed", models: [] };
     RunnerCapabilities = z14.object({
@@ -2624,13 +2632,200 @@ var init_version = __esm({
   }
 });
 
+// src/providers/env.ts
+function definedEnv(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
+  return out;
+}
+var init_env = __esm({
+  "src/providers/env.ts"() {
+    "use strict";
+  }
+});
+
+// src/claude/auth-mode.ts
+function authModeFrom(info) {
+  if (info.apiProvider && info.apiProvider !== "firstParty") return "third_party";
+  if (info.apiKeySource && info.apiKeySource !== "none") return "api";
+  if (info.subscriptionType) return "subscription";
+  return null;
+}
+var init_auth_mode = __esm({
+  "src/claude/auth-mode.ts"() {
+    "use strict";
+  }
+});
+
+// src/claude/pushable.ts
+var Pushable;
+var init_pushable = __esm({
+  "src/claude/pushable.ts"() {
+    "use strict";
+    Pushable = class {
+      queue = [];
+      waiters = [];
+      ended = false;
+      push(value) {
+        if (this.ended) throw new Error("Pushable already ended");
+        const waiter = this.waiters.shift();
+        if (waiter) waiter({ value, done: false });
+        else this.queue.push(value);
+      }
+      end() {
+        this.ended = true;
+        for (const waiter of this.waiters.splice(0)) waiter({ value: void 0, done: true });
+      }
+      [Symbol.asyncIterator]() {
+        return {
+          next: () => {
+            const value = this.queue.shift();
+            if (value !== void 0) return Promise.resolve({ value, done: false });
+            if (this.ended) return Promise.resolve({ value: void 0, done: true });
+            return new Promise((resolve6) => this.waiters.push(resolve6));
+          }
+        };
+      }
+    };
+  }
+});
+
+// src/claude/detect.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname3, join as join8 } from "path";
+import {
+  query as sdkQuery
+} from "@anthropic-ai/claude-agent-sdk";
+function claudeCodeVersion(resolve6 = createRequire2(import.meta.url).resolve) {
+  try {
+    const entry = resolve6("@anthropic-ai/claude-agent-sdk");
+    const pkg = JSON.parse(readFileSync4(join8(dirname3(entry), "package.json"), "utf8"));
+    return typeof pkg.claudeCodeVersion === "string" && pkg.claudeCodeVersion ? pkg.claudeCodeVersion.slice(0, MAX_VERSION) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function probeClaude(opts) {
+  const queryFn = opts.queryFn ?? sdkQuery;
+  const prompt = new Pushable();
+  const abortController = new AbortController();
+  let timer;
+  let q;
+  try {
+    q = queryFn({
+      prompt,
+      options: {
+        cwd: opts.cwd,
+        settingSources: opts.settingSources,
+        strictMcpConfig: true,
+        mcpServers: {},
+        settings: { disableAllHooks: true },
+        abortController,
+        stderr: () => {
+        },
+        env: definedEnv({ ...process.env, ...opts.env })
+      }
+    });
+    const init = q.initializationResult();
+    init.catch(() => {
+    });
+    const timeoutMs = opts.timeoutMs ?? PROBE_TIMEOUT_MS;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        abortController.abort();
+        reject(new Error(`Claude probe timed out after ${timeoutMs} ms`));
+      }, timeoutMs);
+    });
+    const res = await Promise.race([init, timeout]);
+    return { account: res.account ?? {}, models: res.models ?? [] };
+  } finally {
+    clearTimeout(timer);
+    prompt.end();
+    try {
+      q?.close();
+    } catch {
+    }
+  }
+}
+function toProviderModel(m, id, isDefault) {
+  const levels = m.supportedEffortLevels ?? [];
+  const efforts = levels.filter((e) => Effort.options.includes(e));
+  const description = (m.description ?? "").slice(0, MAX_NAME);
+  return {
+    id: id.slice(0, MAX_NAME),
+    // `||`, not `??`: an empty display name would fail `label.min(1)` and take the whole
+    // capability with it.
+    label: (m.displayName || id).slice(0, MAX_NAME),
+    ...isDefault ? { default: true } : {},
+    ...description ? { description } : {},
+    efforts
+  };
+}
+function toProviderModels(models) {
+  const fallback = models.find((m) => m.value === "default");
+  const resolved = fallback?.resolvedModel;
+  const rows = models.filter((m) => m.value !== "default");
+  const match = resolved ? rows.findIndex((m) => (m.resolvedModel ?? m.value) === resolved) : -1;
+  const mapped = rows.map((m, i) => toProviderModel(m, m.value ?? "", i === match));
+  if (fallback && resolved && match === -1) {
+    mapped.unshift(toProviderModel(fallback, resolved, true));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return mapped.filter((m) => !seen.has(m.id) && seen.add(m.id)).slice(0, MAX_MODELS).filter((m) => ProviderModel.safeParse(m).success);
+}
+async function detectClaude(deps) {
+  let version;
+  try {
+    version = deps.version();
+  } catch {
+    version = void 0;
+  }
+  const withVersion = version ? { version } : {};
+  let res;
+  try {
+    res = await deps.probe();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/native binary not found/i.test(message)) {
+      return { available: false, reason: "not_installed", ...withVersion, models: [] };
+    }
+    return { available: true, ...withVersion, models: [] };
+  }
+  const account = res.account ?? {};
+  const authMode = authModeFrom(account);
+  if (authMode === null && account.tokenSource === "none") {
+    return { available: false, reason: "not_logged_in", ...withVersion, models: [] };
+  }
+  return {
+    available: true,
+    ...withVersion,
+    models: toProviderModels(res.models ?? []),
+    ...authMode ? { authMode } : {}
+  };
+}
+var PROBE_TIMEOUT_MS, MAX_MODELS, MAX_NAME, MAX_VERSION;
+var init_detect = __esm({
+  "src/claude/detect.ts"() {
+    "use strict";
+    init_src();
+    init_env();
+    init_auth_mode();
+    init_pushable();
+    PROBE_TIMEOUT_MS = 15e3;
+    MAX_MODELS = 50;
+    MAX_NAME = 200;
+    MAX_VERSION = 50;
+  }
+});
+
 // src/exec-path.ts
 import { accessSync, constants, statSync as statSync3 } from "fs";
-import { delimiter, isAbsolute as isAbsolute5, join as join8 } from "path";
+import { delimiter, isAbsolute as isAbsolute5, join as join9 } from "path";
 function findOnPath(name, path) {
   for (const dir of (path ?? "").split(delimiter)) {
     if (!isAbsolute5(dir)) continue;
-    const candidate = join8(dir, name);
+    const candidate = join9(dir, name);
     try {
       if (!statSync3(candidate).isFile()) continue;
       accessSync(candidate, constants.X_OK);
@@ -2729,13 +2924,16 @@ var init_rpc = __esm({
         }
       }
       dispatch(line) {
-        let frame;
+        let parsed;
         try {
-          frame = JSON.parse(line);
+          parsed = JSON.parse(line);
         } catch {
           return;
         }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
+        const frame = parsed;
         if (frame.id !== void 0 && frame.method === void 0) {
+          if (typeof frame.id !== "number") return;
           const p = this.pending.get(frame.id);
           if (!p) return;
           this.pending.delete(frame.id);
@@ -2748,6 +2946,7 @@ var init_rpc = __esm({
           void (async () => {
             try {
               const result = await this.request_?.({
+                id,
                 method: frame.method,
                 params: frame.params
               });
@@ -2755,7 +2954,11 @@ var init_rpc = __esm({
             } catch (err) {
               this.write({
                 id,
-                error: { code: -32603, message: err instanceof Error ? err.message : String(err) }
+                error: {
+                  // A handler that knows the JSON-RPC code for its refusal says so; else "internal".
+                  code: err instanceof RpcError ? err.code : -32603,
+                  message: err instanceof Error ? err.message : String(err)
+                }
               });
             }
           })();
@@ -2770,6 +2973,17 @@ var init_rpc = __esm({
 // src/codex/detect.ts
 import { execFile as execFile2, spawn } from "child_process";
 import { promisify } from "util";
+async function allModels(request) {
+  const models = [];
+  let cursor;
+  do {
+    const page = await request(cursor ? { cursor } : {});
+    const data = page.data ?? [];
+    models.push(...data);
+    cursor = data.length > 0 && page.nextCursor ? page.nextCursor : void 0;
+  } while (cursor && models.length < MAX_MODELS2);
+  return models;
+}
 function findCodexOnPath(env) {
   return findOnPath("codex", env.PATH);
 }
@@ -2778,7 +2992,7 @@ function resolveCodexPath(cfg, env, onPath) {
 }
 async function runCodex(path, args) {
   try {
-    const { stdout, stderr } = await exec(path, args, { timeout: PROBE_TIMEOUT_MS });
+    const { stdout, stderr } = await exec(path, args, { timeout: PROBE_TIMEOUT_MS2 });
     return { code: 0, stdout, stderr };
   } catch (err) {
     const e = err;
@@ -2798,30 +3012,29 @@ async function listCodexModels(path) {
       clientInfo: { name: "cayenne-runner", title: "Cayenne", version: "0.0.1" }
     });
     rpc.notify("initialized", {});
-    const res = await rpc.request("model/list", {});
-    return res.data ?? [];
+    return await allModels((params) => rpc.request("model/list", params));
   } finally {
     clearTimeout(timer);
     rpc.close();
     child.kill();
   }
 }
-function toProviderModel(m) {
-  const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.effort).filter((e) => Effort.options.includes(e));
+function toProviderModel2(m) {
+  const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.reasoningEffort).filter((e) => Effort.options.includes(e));
   const fallback = Effort.options.includes(m.defaultReasoningEffort) ? m.defaultReasoningEffort : void 0;
   return {
-    id: (m.id ?? "").slice(0, MAX_NAME),
+    id: (m.id ?? "").slice(0, MAX_NAME2),
     // `||`, not `??`: an app-server that sends `displayName: ''` would otherwise publish an
     // empty label, which `ProviderModel.label.min(1)` rejects — taking the whole capability
     // with it.
-    label: (m.displayName || m.id || "").slice(0, MAX_NAME),
+    label: (m.displayName || m.id || "").slice(0, MAX_NAME2),
     ...m.isDefault ? { default: true } : {},
     efforts,
     ...fallback ? { defaultEffort: fallback } : {}
   };
 }
-function toProviderModels(models) {
-  return models.filter((m) => m.hidden !== true).slice(0, MAX_MODELS).map(toProviderModel).filter((m) => ProviderModel.safeParse(m).success);
+function toProviderModels2(models) {
+  return models.filter((m) => m.hidden !== true).slice(0, MAX_MODELS2).map(toProviderModel2).filter((m) => ProviderModel.safeParse(m).success);
 }
 async function detectCodex(deps) {
   if (!deps.path) return { available: false, reason: "not_installed", models: [] };
@@ -2829,33 +3042,37 @@ async function detectCodex(deps) {
   try {
     const probe = await deps.run(deps.path, ["--version"]);
     if (probe.code !== 0) return { available: false, reason: "not_installed", models: [] };
-    version = probe.stdout.trim().split(/\s+/).at(-1)?.slice(0, MAX_VERSION);
+    version = probe.stdout.trim().split(/\s+/).at(-1)?.slice(0, MAX_VERSION2);
     const login2 = await deps.run(deps.path, ["login", "status"]);
     if (login2.code !== 0) {
       return { available: false, reason: "not_logged_in", version, models: [] };
     }
     const models = await deps.listModels(deps.path);
-    return { available: true, version, models: toProviderModels(models) };
+    return { available: true, version, models: toProviderModels2(models) };
   } catch {
     return { available: false, reason: "error", ...version ? { version } : {}, models: [] };
   }
 }
 async function detectProviders(deps) {
-  return { claude: { available: true, models: [] }, codex: await detectCodex(deps) };
+  const [claude, codex] = await Promise.all([
+    deps.claude().catch(() => ({ available: true, models: [] })),
+    detectCodex(deps)
+  ]);
+  return { claude, codex };
 }
-var exec, PROBE_TIMEOUT_MS, LIST_TIMEOUT_MS, MAX_MODELS, MAX_NAME, MAX_VERSION;
-var init_detect = __esm({
+var exec, PROBE_TIMEOUT_MS2, LIST_TIMEOUT_MS, MAX_MODELS2, MAX_NAME2, MAX_VERSION2;
+var init_detect2 = __esm({
   "src/codex/detect.ts"() {
     "use strict";
     init_src();
     init_exec_path();
     init_rpc();
     exec = promisify(execFile2);
-    PROBE_TIMEOUT_MS = 5e3;
+    PROBE_TIMEOUT_MS2 = 5e3;
     LIST_TIMEOUT_MS = 1e4;
-    MAX_MODELS = 50;
-    MAX_NAME = 200;
-    MAX_VERSION = 50;
+    MAX_MODELS2 = 50;
+    MAX_NAME2 = 200;
+    MAX_VERSION2 = 50;
   }
 });
 
@@ -3499,7 +3716,7 @@ var init_source = __esm({
 
 // src/paths.ts
 import { lstatSync, realpathSync as realpathSync5 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute6, join as join9, relative as relative2, sep as sep2 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute6, join as join10, relative as relative2, sep as sep2 } from "path";
 function assertInsideRoots(target, roots) {
   return resolveInsideRoots(target, roots).real;
 }
@@ -3519,8 +3736,8 @@ function assertInsideRootsOrAncestor(target, roots) {
   assertRoots(roots);
   const absolute = isAbsolute6(target) ? target : `${process.cwd()}${sep2}${target}`;
   let walked = walk(target, absolute);
-  if (walked.tail.includes("..")) walked = walk(target, join9(walked.real, ...walked.tail));
-  const checked = walked.tail.length === 0 ? walked.real : join9(walked.real, ...walked.tail);
+  if (walked.tail.includes("..")) walked = walk(target, join10(walked.real, ...walked.tail));
+  const checked = walked.tail.length === 0 ? walked.real : join10(walked.real, ...walked.tail);
   if (!insideAny(checked, roots)) throw new Error(`ROOT_NOT_ALLOWED: ${target}`);
   return checked;
 }
@@ -3537,7 +3754,7 @@ function walk(target, absolute) {
       tail.push(segment);
       continue;
     }
-    const next = segment === ".." ? dirname3(real) : join9(real, segment);
+    const next = segment === ".." ? dirname4(real) : join10(real, segment);
     if (!lstatSync(next, { throwIfNoEntry: false })) {
       tail.push(segment);
       continue;
@@ -3585,8 +3802,8 @@ var init_paths = __esm({
 
 // src/git/introspect.ts
 import { execFile as execFile3 } from "child_process";
-import { readFileSync as readFileSync4, realpathSync as realpathSync6 } from "fs";
-import { delimiter as delimiter2, dirname as dirname4, isAbsolute as isAbsolute7, join as join10, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync5, realpathSync as realpathSync6 } from "fs";
+import { delimiter as delimiter2, dirname as dirname5, isAbsolute as isAbsolute7, join as join11, resolve as resolve2 } from "path";
 import { promisify as promisify2 } from "util";
 function parseGitHubRemote(url) {
   const trimmed = url.trim();
@@ -3672,10 +3889,10 @@ function insideRoot(path, root) {
   }
 }
 function isLinkedWorktree(gitDir, commonDir, repoRoot) {
-  if (gitDir === commonDir || dirname4(gitDir) !== join10(commonDir, "worktrees")) return false;
+  if (gitDir === commonDir || dirname5(gitDir) !== join11(commonDir, "worktrees")) return false;
   try {
-    const back = readFileSync4(join10(gitDir, "gitdir"), "utf8").trim();
-    const mine = canonical(join10(repoRoot, ".git"), repoRoot);
+    const back = readFileSync5(join11(gitDir, "gitdir"), "utf8").trim();
+    const mine = canonical(join11(repoRoot, ".git"), repoRoot);
     return mine !== null && canonical(back, gitDir) === mine;
   } catch {
     return false;
@@ -3683,7 +3900,7 @@ function isLinkedWorktree(gitDir, commonDir, repoRoot) {
 }
 async function introspectRepo(cwd, run, root, { names = true } = {}) {
   try {
-    const ceiling = dirname4(root);
+    const ceiling = dirname5(root);
     if (ceiling.includes(delimiter2)) return { ...NONE };
     const line = async (args) => {
       const { code, stdout } = await run(args, cwd, ceiling);
@@ -3780,9 +3997,9 @@ var init_introspect = __esm({
 });
 
 // src/repos/credentials.ts
-import { chmodSync as chmodSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { devNull, homedir as homedir4 } from "os";
-import { delimiter as delimiter3, isAbsolute as isAbsolute8, join as join11 } from "path";
+import { delimiter as delimiter3, isAbsolute as isAbsolute8, join as join12 } from "path";
 function gitWrapper(git, gitHome) {
   if (git === null || !isAbsolute8(git)) {
     return `#!/bin/sh
@@ -3797,7 +4014,7 @@ exec ${shellQuote(git)} "$@"
 `;
 }
 function repositoryGitHome(runDir) {
-  return join11(runDir, GIT_HOME);
+  return join12(runDir, GIT_HOME);
 }
 function gitCredentialEnv(token, readOnlyText, opts = {}) {
   const env = {
@@ -3818,7 +4035,7 @@ function gitCredentialEnv(token, readOnlyText, opts = {}) {
     CAYENNE_READ_ONLY: readOnlyText
   };
   if (token !== null) env.GH_TOKEN = token;
-  if (opts.runDir !== void 0) env.GIT_SSH_COMMAND = shellQuote(join11(opts.runDir, NO_SSH));
+  if (opts.runDir !== void 0) env.GIT_SSH_COMMAND = shellQuote(join12(opts.runDir, NO_SSH));
   if (opts.home !== void 0) env.HOME = opts.home;
   return env;
 }
@@ -3830,14 +4047,14 @@ function repositoryChatEnv(input) {
     SSH_AUTH_SOCK: void 0,
     GIT_CONFIG_PARAMETERS: void 0,
     ...Object.fromEntries(TRACE_AND_TLS_VARS.map((key) => [key, void 0])),
-    GH_CONFIG_DIR: join11(input.runDir, GH_CONFIG),
+    GH_CONFIG_DIR: join12(input.runDir, GH_CONFIG),
     GH_PROMPT_DISABLED: "1",
     // A replace ref another chat planted in the shared clone must not change what a sha reads as.
     GIT_NO_REPLACE_OBJECTS: "1",
     // Only git runs with HOME at the git home. Go, SwiftPM and python-requests read `$NETRC` first:
     // this one never exists. curl reads the first `.curlrc` of `$CURL_HOME`, then `$HOME`: the git
     // home's is empty, so the owner's (`netrc`, `user = …`) never applies.
-    NETRC: join11(repositoryGitHome(input.runDir), NETRC_NAME),
+    NETRC: join12(repositoryGitHome(input.runDir), NETRC_NAME),
     CURL_HOME: repositoryGitHome(input.runDir),
     // With it and CLAUDE_CONFIG_DIR both set, the CLI names its project dir by it rather than by
     // the cwd's slug: every chat's tool outputs would share one dir the worktree bound lets it read.
@@ -3852,8 +4069,8 @@ function repositoryChatEnv(input) {
   };
   if (input.token === null) env.GH_TOKEN = void 0;
   const bins = [
-    ...input.token === null ? [join11(input.runDir, READONLY_BIN)] : [],
-    join11(input.runDir, GIT_BIN)
+    ...input.token === null ? [join12(input.runDir, READONLY_BIN)] : [],
+    join12(input.runDir, GIT_BIN)
   ];
   env.PATH = [...bins, ...input.path ? [input.path] : []].join(delimiter3);
   for (const key of Object.keys(input.inherited ?? process.env)) {
@@ -3864,17 +4081,17 @@ function repositoryChatEnv(input) {
 }
 function prepareRunDir(runDir, opts) {
   mkdirSync4(runDir, { recursive: true, mode: 448 });
-  freshDir(join11(runDir, GH_CONFIG));
+  freshDir(join12(runDir, GH_CONFIG));
   freshDir(repositoryGitHome(runDir));
-  writeFileSync4(join11(repositoryGitHome(runDir), CURLRC_NAME), "", { mode: 384, flag: "wx" });
-  chmodSync4(join11(repositoryGitHome(runDir), CURLRC_NAME), 384);
-  const bin = join11(runDir, READONLY_BIN);
+  writeFileSync4(join12(repositoryGitHome(runDir), CURLRC_NAME), "", { mode: 384, flag: "wx" });
+  chmodSync4(join12(repositoryGitHome(runDir), CURLRC_NAME), 384);
+  const bin = join12(runDir, READONLY_BIN);
   freshDir(bin);
-  writeShim(join11(bin, "gh"), GH_SHIM);
-  writeShim(join11(runDir, NO_SSH), NO_SSH_SHIM);
-  const gitBin = join11(runDir, GIT_BIN);
+  writeShim(join12(bin, "gh"), GH_SHIM);
+  writeShim(join12(runDir, NO_SSH), NO_SSH_SHIM);
+  const gitBin = join12(runDir, GIT_BIN);
   freshDir(gitBin);
-  writeShim(join11(gitBin, "git"), gitWrapper(opts.git, repositoryGitHome(runDir)));
+  writeShim(join12(gitBin, "git"), gitWrapper(opts.git, repositoryGitHome(runDir)));
 }
 function freshDir(path) {
   rmSync3(path, { recursive: true, force: true });
@@ -3882,12 +4099,12 @@ function freshDir(path) {
   chmodSync4(path, 448);
 }
 function githubNetrcFiles(home = homedir4(), env = process.env) {
-  const candidates = [env.NETRC, join11(home, ".netrc")].filter(
+  const candidates = [env.NETRC, join12(home, ".netrc")].filter(
     (path) => typeof path === "string" && path !== ""
   );
   return [...new Set(candidates)].filter((path) => {
     try {
-      return netrcCoversGitHub(readFileSync5(path, "utf8"));
+      return netrcCoversGitHub(readFileSync6(path, "utf8"));
     } catch {
       return false;
     }
@@ -3968,13 +4185,13 @@ exit 1
 
 // src/git/commands.ts
 import { lstatSync as lstatSync2, realpathSync as realpathSync7, statSync as statSync4 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute9, join as join12, relative as relative3, resolve as resolve3, sep as sep3 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute9, join as join13, relative as relative3, resolve as resolve3, sep as sep3 } from "path";
 async function scopeRepo(cwd, run, root) {
   const identity = await introspectRepo(cwd, run, root, { names: false });
   if (identity.repo_root === null) {
     throw new Error(`VALIDATION: ${cwd} is not inside a git repository under an allowed root`);
   }
-  return { repoRoot: identity.repo_root, ceiling: dirname5(root) };
+  return { repoRoot: identity.repo_root, ceiling: dirname6(root) };
 }
 function fold(letter) {
   switch (letter) {
@@ -4134,13 +4351,13 @@ async function gitDirs(scope, run) {
   }
 }
 function isGitDirShape(dir) {
-  const head = lstatSync2(join12(dir, "HEAD"), { throwIfNoEntry: false });
+  const head = lstatSync2(join13(dir, "HEAD"), { throwIfNoEntry: false });
   if (!head || !(head.isFile() || head.isSymbolicLink())) return false;
-  const commondir = lstatSync2(join12(dir, "commondir"), { throwIfNoEntry: false });
+  const commondir = lstatSync2(join13(dir, "commondir"), { throwIfNoEntry: false });
   if (commondir?.isFile()) return true;
   const isDir = (name) => {
     try {
-      return statSync4(join12(dir, name), { throwIfNoEntry: false })?.isDirectory() === true;
+      return statSync4(join13(dir, name), { throwIfNoEntry: false })?.isDirectory() === true;
     } catch {
       return false;
     }
@@ -4161,13 +4378,13 @@ function enclosesHome(repoRoot, home) {
   } catch {
     return false;
   }
-  for (let cur = real; ; cur = dirname5(cur)) {
+  for (let cur = real; ; cur = dirname6(cur)) {
     try {
       const st = statSync4(cur, { bigint: true, throwIfNoEntry: false });
       if (st && st.dev === root.dev && st.ino === root.ino) return true;
     } catch {
     }
-    if (dirname5(cur) === cur) return false;
+    if (dirname6(cur) === cur) return false;
   }
 }
 function protectedTest(paths, exempt = []) {
@@ -4195,10 +4412,10 @@ function protectedTest(paths, exempt = []) {
   return (path) => {
     if (exempts.length === 0 && entries2.some((e) => within(path, e.real))) return true;
     let exempted = false;
-    for (let cur = path; ; cur = dirname5(cur)) {
+    for (let cur = path; ; cur = dirname6(cur)) {
       if (!exempted && isOneOf(cur, entries2)) return true;
       if (exempts.length > 0 && isOneOf(cur, exempts)) exempted = true;
-      if (dirname5(cur) === cur) return false;
+      if (dirname6(cur) === cur) return false;
     }
   };
 }
@@ -4215,7 +4432,7 @@ function identities(paths) {
   return out;
 }
 function insideOtherGitDir(real, repoRoot) {
-  for (let dir = dirname5(real); within(dir, repoRoot) && dir !== repoRoot; dir = dirname5(dir)) {
+  for (let dir = dirname6(real); within(dir, repoRoot) && dir !== repoRoot; dir = dirname6(dir)) {
     if (isGitDirShape(dir)) return true;
   }
   return false;
@@ -4225,7 +4442,7 @@ async function gitDiff(scope, run, opts, guard = {}) {
   const guarded = protectedTest(guard.protectedPaths ?? [], guard.exemptPaths ?? []);
   const isProtected = (p) => guarded?.(p) === true;
   if (opts.path) {
-    const named = join12(scope.repoRoot, opts.path);
+    const named = join13(scope.repoRoot, opts.path);
     let resolved = null;
     try {
       resolved = realpathSync7.native(named);
@@ -4255,7 +4472,7 @@ async function gitDiff(scope, run, opts, guard = {}) {
         `VALIDATION: untracked files are not diffed in a repository at or above the home directory (${scope.repoRoot})`
       );
     }
-    const absolute = join12(scope.repoRoot, opts.path);
+    const absolute = join13(scope.repoRoot, opts.path);
     if (!lstatSync2(absolute, { throwIfNoEntry: false })) {
       try {
         assertInsideRootsOrAncestor(absolute, [scope.repoRoot]);
@@ -4298,7 +4515,7 @@ async function gitDiff(scope, run, opts, guard = {}) {
   }
   const diff = splitDiff(first.stdout);
   if (guarded === null) return diff;
-  const keep = (p) => p === void 0 || !isProtected(join12(scope.repoRoot, p));
+  const keep = (p) => p === void 0 || !isProtected(join13(scope.repoRoot, p));
   return { ...diff, files: diff.files.filter((f) => keep(f.path) && keep(f.oldPath)) };
 }
 function parseBranches(raw, head) {
@@ -4367,16 +4584,16 @@ import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync5,
   openSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   realpathSync as realpathSync8,
   statSync as statSync5,
   writeSync
 } from "fs";
 import { readdir } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute10, join as join13, relative as relative4, sep as sep4 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join14, relative as relative4, sep as sep4 } from "path";
 import { setImmediate } from "timers/promises";
 function worktreePathFor(repoRoot, name) {
-  return join13(repoRoot, WORKTREES_DIR, name);
+  return join14(repoRoot, WORKTREES_DIR, name);
 }
 async function listedWorktrees(scope, run) {
   const r = await run(["worktree", "list", "--porcelain"], scope.repoRoot, scope.ceiling);
@@ -4399,7 +4616,7 @@ async function excludeCayenneDir(scope, run) {
   );
   const common = r.stdout.trim();
   if (r.code !== 0 || !isAbsolute10(common)) return;
-  const dotGit = join13(scope.repoRoot, ".git");
+  const dotGit = join14(scope.repoRoot, ".git");
   let dotGitIsRealDir;
   try {
     dotGitIsRealDir = lstatSync3(dotGit).isDirectory();
@@ -4416,16 +4633,16 @@ async function excludeCayenneDir(scope, run) {
     return;
   }
   if (commonReal !== dotGitReal) return;
-  const exclude = join13(commonReal, "info", "exclude");
+  const exclude = join14(commonReal, "info", "exclude");
   let checkedExclude;
   try {
     checkedExclude = assertInsideRootsOrAncestor(exclude, [scope.repoRoot]);
   } catch {
     return;
   }
-  const existing = existsSync4(checkedExclude) ? readFileSync6(checkedExclude, "utf8") : "";
+  const existing = existsSync4(checkedExclude) ? readFileSync7(checkedExclude, "utf8") : "";
   if (existing.split("\n").includes(".cayenne/")) return;
-  mkdirSync5(dirname6(checkedExclude), { recursive: true });
+  mkdirSync5(dirname7(checkedExclude), { recursive: true });
   const toAppend = `${existing.endsWith("\n") || existing === "" ? "" : "\n"}.cayenne/
 `;
   let fd;
@@ -4451,7 +4668,7 @@ function asNotADirectory(path, err) {
   return err instanceof Error ? err : new Error(String(err));
 }
 function canonicalWorktreesDir(scope) {
-  const dir = join13(scope.repoRoot, WORKTREES_DIR);
+  const dir = join14(scope.repoRoot, WORKTREES_DIR);
   try {
     assertInsideRootsOrAncestor(dir, [scope.repoRoot]);
   } catch (err) {
@@ -4474,7 +4691,7 @@ async function createWorktree(scope, run, name, base) {
     throw new Error(`VALIDATION: ${name} is not a worktree name`);
   }
   const worktreesDir = canonicalWorktreesDir(scope);
-  const path = join13(worktreesDir, name);
+  const path = join14(worktreesDir, name);
   if (lstatSync3(path, { throwIfNoEntry: false })) {
     try {
       resolveInsideRoots(path, [scope.repoRoot]);
@@ -4523,7 +4740,7 @@ async function findNestedRepository(top, limits = NESTED_WALK_LIMITS) {
       const lower = entry.name.toLowerCase();
       if (lower === ".git" && !(depth === 0 && entry.name === ".git")) return "repository";
       if (lower === "head") hasHead = true;
-      const path = join13(dir, entry.name);
+      const path = join14(dir, entry.name);
       let isDir;
       try {
         isDir = entry.isDirectory() || // Some filesystems report no type; lstat decides, still without following.
@@ -4559,7 +4776,7 @@ async function worktreeIdentity(scope, run) {
   }
 }
 async function removeWorktree(scope, run, worktreePath, force) {
-  const worktreesDir = join13(scope.repoRoot, WORKTREES_DIR);
+  const worktreesDir = join14(scope.repoRoot, WORKTREES_DIR);
   let base;
   try {
     base = realpathSync8.native(worktreesDir);
@@ -4664,10 +4881,10 @@ var init_ops = __esm({
 
 // src/git/worktree-owners.ts
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join15 } from "path";
 function createWorktreeOwners(dir) {
-  const fileFor = (path) => join14(dir, `${createHash("sha256").update(path).digest("hex")}.json`);
+  const fileFor = (path) => join15(dir, `${createHash("sha256").update(path).digest("hex")}.json`);
   return {
     record(path, rec) {
       const body = {
@@ -4710,7 +4927,7 @@ function writeRecordFile(dir, file, body) {
 }
 function readRecordFile(file) {
   try {
-    const parsed = JSON.parse(readFileSync7(file, "utf8"));
+    const parsed = JSON.parse(readFileSync8(file, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -4724,9 +4941,9 @@ var init_worktree_owners = __esm({
 
 // src/git/session-worktrees.ts
 import { rmSync as rmSync5 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function createSessionWorktrees(dir) {
-  const fileFor = (sessionId) => UUID2.test(sessionId) ? join15(dir, `${sessionId}.json`) : null;
+  const fileFor = (sessionId) => UUID2.test(sessionId) ? join16(dir, `${sessionId}.json`) : null;
   return {
     record(rec) {
       const file = fileFor(rec.sessionId);
@@ -5546,16 +5763,16 @@ import {
   mkdirSync as mkdirSync7,
   openSync as openSync2,
   readdirSync,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   realpathSync as realpathSync9,
   renameSync as renameSync3,
   rmSync as rmSync6,
   statSync as statSync6,
   writeSync as writeSync2
 } from "fs";
-import { dirname as dirname7, join as join16 } from "path";
+import { dirname as dirname8, join as join17 } from "path";
 function managedReposRoot(profileDir2) {
-  return join16(profileDir2, "repos");
+  return join17(profileDir2, "repos");
 }
 function githubRemoteUrl(repo) {
   return `https://github.com/${repo.owner}/${repo.name}.git`;
@@ -5590,9 +5807,9 @@ function createManagedRepos(deps) {
     }
   };
   async function cloneInto(repo, env) {
-    const ownerDir = join16(root, repo.owner);
-    const path = join16(ownerDir, repo.name);
-    const tmp = join16(ownerDir, `.${repo.name}.clone-${randomBytes2(4).toString("hex")}`);
+    const ownerDir = join17(root, repo.owner);
+    const path = join17(ownerDir, repo.name);
+    const tmp = join17(ownerDir, `.${repo.name}.clone-${randomBytes2(4).toString("hex")}`);
     inflight.add(tmp);
     try {
       mkdirSync7(ownerDir, { recursive: true, mode: 448 });
@@ -5637,7 +5854,7 @@ function createManagedRepos(deps) {
     const listed = await run(
       ["config", "--local", "--no-includes", "--list", "-z"],
       path,
-      dirname7(path)
+      dirname8(path)
     );
     const entries2 = listed.code === 0 ? parseConfigList(listed.stdout) : [];
     const mark = entries2.filter((e) => e.section === "cayenne" && e.subsection === null && e.name === "repositoryid").at(-1)?.value;
@@ -5662,8 +5879,8 @@ function createManagedRepos(deps) {
   }
   async function sync(repo, tok) {
     const slug = `${repo.owner}/${repo.name}`;
-    const ownerDir = join16(root, repo.owner);
-    const path = join16(ownerDir, repo.name);
+    const ownerDir = join17(root, repo.owner);
+    const path = join17(ownerDir, repo.name);
     assertRealDirs(ownerDir, path);
     const env = gitCredentialEnv(tok.token, "", { home: deps.gitHome });
     const run = makeGitRun({ timeoutMs: GIT_SLOW_TIMEOUT_MS, env });
@@ -5703,9 +5920,9 @@ function createManagedRepos(deps) {
     return { clonePath: real, defaultBranch: branch, baseSha };
   }
   function excludePlans(path) {
-    const gitDir = join16(path, ".git");
-    const info = join16(gitDir, "info");
-    const file = join16(info, "exclude");
+    const gitDir = join17(path, ".git");
+    const info = join17(gitDir, "info");
+    const file = join17(info, "exclude");
     try {
       if (!lstatSync4(gitDir).isDirectory()) throw new Error(".git is not a directory");
       const infoStat = lstatSync4(info, { throwIfNoEntry: false });
@@ -5721,7 +5938,7 @@ function createManagedRepos(deps) {
         420
       );
       try {
-        const text = readFileSync8(fd, "utf8");
+        const text = readFileSync9(fd, "utf8");
         const lines = text.split("\n");
         const isOld = (line) => line.replace(/\r$/, "") === OLD_PLANS_EXCLUDE_LINE;
         const has = lines.some((line) => line.replace(/\r$/, "") === PLANS_EXCLUDE_LINE);
@@ -5762,9 +5979,9 @@ function createManagedRepos(deps) {
   }
   async function markOf(path) {
     const { code, stdout } = await scanRun(
-      ["config", "--file", join16(path, ".git", "config"), "--get", ID_KEY],
+      ["config", "--file", join17(path, ".git", "config"), "--get", ID_KEY],
       path,
-      dirname7(path)
+      dirname8(path)
     );
     const text = stdout.trim();
     if (code !== 0 || !ID_TEXT.test(text)) return null;
@@ -5791,8 +6008,8 @@ function createManagedRepos(deps) {
       });
     },
     verifyConfig(repo) {
-      const ownerDir = join16(root, repo.owner);
-      const path = join16(ownerDir, repo.name);
+      const ownerDir = join17(root, repo.owner);
+      const path = join17(ownerDir, repo.name);
       const check = async () => {
         assertRealDirs(ownerDir, path);
         await checkConfig(repo, path, scanRun);
@@ -5813,12 +6030,12 @@ function createManagedRepos(deps) {
       const candidates = [];
       for (const owner of entries(root)) {
         if (!owner.isDirectory()) continue;
-        const ownerDir = join16(root, owner.name);
+        const ownerDir = join17(root, owner.name);
         for (const entry of entries(ownerDir)) {
-          const path = join16(ownerDir, entry.name);
+          const path = join17(ownerDir, entry.name);
           if (TEMP_CLONE.test(entry.name)) {
             if (inflight.has(path)) continue;
-            if (!present(join16(path, ".cayenne"))) {
+            if (!present(join17(path, ".cayenne"))) {
               rmSync6(path, { recursive: true, force: true });
               deps.log.info({ path }, "removed an interrupted managed clone");
               continue;
@@ -5894,7 +6111,7 @@ function keyText(e) {
   return `${e.section}.${subsection}.${e.name}`;
 }
 function recency(path) {
-  for (const file of [join16(path, ".git", "FETCH_HEAD"), join16(path, ".git")]) {
+  for (const file of [join17(path, ".git", "FETCH_HEAD"), join17(path, ".git")]) {
     try {
       const stat = statSync6(file, { throwIfNoEntry: false });
       if (stat) return stat.mtimeMs;
@@ -6023,7 +6240,7 @@ var init_managed = __esm({
 
 // src/repos/sweep.ts
 import { lstatSync as lstatSync5, realpathSync as realpathSync10 } from "fs";
-import { isAbsolute as isAbsolute12, join as join17, relative as relative5, sep as sep7 } from "path";
+import { isAbsolute as isAbsolute12, join as join18, relative as relative5, sep as sep7 } from "path";
 function createRepoWorktreeSweep(deps) {
   const { log } = deps;
   const said3 = /* @__PURE__ */ new Set();
@@ -6038,8 +6255,8 @@ function createRepoWorktreeSweep(deps) {
       return null;
     }
     const leaf = worktreeName(sessionId);
-    const repoRoot = join17(deps.managedRoot, owner, name);
-    if (leaf === null || rec.path !== join17(repoRoot, WORKTREES_DIR, leaf)) return null;
+    const repoRoot = join18(deps.managedRoot, owner, name);
+    if (leaf === null || rec.path !== join18(repoRoot, WORKTREES_DIR, leaf)) return null;
     return { sessionId, path: rec.path, repoRoot, record: rec };
   }
   async function readRows(ids) {
@@ -6481,7 +6698,7 @@ var init_roster = __esm({
 
 // src/sessions/attachments.ts
 import { readdirSync as readdirSync2, rmSync as rmSync7 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 async function loadAttachments(db, scope, attachments) {
   const prefix = `${scope.workspaceId.toLowerCase()}/${scope.sessionId.toLowerCase()}/`;
   const named = attachments.map(({ storagePath }, i) => {
@@ -6518,13 +6735,13 @@ async function loadAttachments(db, scope, attachments) {
   return loaded;
 }
 function attachmentsTempDir(home, runnerId, sessionId) {
-  return join18(home, "tmp", "attachments", runnerId, sessionId);
+  return join19(home, "tmp", "attachments", runnerId, sessionId);
 }
 function assertStagingInsideHome(home, dir) {
   return assertInsideRootsOrAncestor(dir, [home]);
 }
 function clearAttachmentsTemp(home, runnerId, heldBy) {
-  clearRunnerStaging(home, join18(home, "tmp", "attachments"), runnerId, heldBy);
+  clearRunnerStaging(home, join19(home, "tmp", "attachments"), runnerId, heldBy);
 }
 function clearRunnerStaging(home, dir, runnerId, heldBy = (id) => holderOf({ root: home, runnerId: id }) !== null) {
   const proved = assertStagingInsideHome(home, dir);
@@ -6535,9 +6752,9 @@ function clearRunnerStaging(home, dir, runnerId, heldBy = (id) => holderOf({ roo
     return;
   }
   for (const name of names) {
-    assertStagingInsideHome(home, join18(proved, name));
+    assertStagingInsideHome(home, join19(proved, name));
     if (name !== runnerId && heldBy(name)) continue;
-    rmSync7(join18(proved, name), { recursive: true, force: true });
+    rmSync7(join19(proved, name), { recursive: true, force: true });
   }
 }
 var ATTACHMENTS_BUCKET, TYPE_OF_EXT, refuse;
@@ -6557,7 +6774,7 @@ var init_attachments2 = __esm({
 
 // src/fs/list.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync11, statSync as statSync7 } from "fs";
-import { join as join19, relative as relative6, sep as sep8 } from "path";
+import { join as join20, relative as relative6, sep as sep8 } from "path";
 function order(a, b) {
   const aDir = a.kind === "dir" ? 0 : 1;
   const bDir = b.kind === "dir" ? 0 : 1;
@@ -6598,7 +6815,7 @@ function listDirectory(dir, root, depth) {
       return;
     }
     const level = dirents.map((dirent) => {
-      const path = join19(current, dirent.name);
+      const path = join20(current, dirent.name);
       const link = dirent.isSymbolicLink();
       const resolved = link ? symlinkKind(path, root) : null;
       const isDir = link ? resolved?.kind === "dir" : dirent.isDirectory();
@@ -7043,7 +7260,7 @@ var init_broadcast = __esm({
 
 // src/documents/paths.ts
 import { realpathSync as realpathSync12 } from "fs";
-import { isAbsolute as isAbsolute13, join as join20, relative as relative7, sep as sep10 } from "path";
+import { isAbsolute as isAbsolute13, join as join21, relative as relative7, sep as sep10 } from "path";
 function contained(dir, candidate) {
   const rel = relative7(dir, candidate);
   return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep10}`) && !isAbsolute13(rel);
@@ -7080,7 +7297,7 @@ var init_paths2 = __esm({
   "src/documents/paths.ts"() {
     "use strict";
     init_src();
-    docsDir = (cwd) => join20(cwd, ...DOCUMENTS_DIR.split("/"));
+    docsDir = (cwd) => join21(cwd, ...DOCUMENTS_DIR.split("/"));
   }
 });
 
@@ -7160,10 +7377,10 @@ async function syncDocuments(deps, pass) {
         if (error2) throw new Error(error2.message);
         const row = data;
         if (!row?.id) throw new Error("the insert returned no row");
-        const failed4 = await publish2(row, doc);
-        if (failed4 !== null) {
+        const failed5 = await publish2(row, doc);
+        if (failed5 !== null) {
           log.warn(
-            { err: failed4, relPath: doc.relPath, sessionId: deps.sessionId },
+            { err: failed5, relPath: doc.relPath, sessionId: deps.sessionId },
             "could not upload a document; removing the row so the next pass retries it"
           );
           await takeBack(row.id, doc.relPath);
@@ -7176,10 +7393,10 @@ async function syncDocuments(deps, pass) {
       const restated = before.status !== "present" || before.title !== doc.title || before.kind !== doc.kind || before.size_bytes !== doc.size;
       if (!rewritten && !restated) continue;
       if (rewritten) {
-        const failed4 = await upload(before.storage_path, doc);
-        if (failed4 !== null) {
+        const failed5 = await upload(before.storage_path, doc);
+        if (failed5 !== null) {
           log.warn(
-            { err: failed4, relPath: doc.relPath, sessionId: deps.sessionId },
+            { err: failed5, relPath: doc.relPath, sessionId: deps.sessionId },
             "could not overwrite a document; its row still describes the bytes in the bucket"
           );
           continue;
@@ -7257,10 +7474,10 @@ import {
   lstatSync as lstatSync6,
   opendirSync,
   openSync as openSync3,
-  readFileSync as readFileSync9
+  readFileSync as readFileSync10
 } from "fs";
 import { open } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function isNew(baseline, relPath, contentHash) {
   const before = baseline.hashes.get(relPath);
   if (before === void 0) return baseline.complete;
@@ -7347,7 +7564,7 @@ function walk2(st, dir, rel, depth) {
   for (const entry of entries2) {
     if (st.stop) return;
     if (entry.name.startsWith(".")) continue;
-    const path = join21(dir, entry.name);
+    const path = join22(dir, entry.name);
     const relPath = rel === "" ? entry.name : `${rel}/${entry.name}`;
     if (entry.isSymbolicLink()) {
       st.log.warn({ path, relPath }, `document skipped: ${SYMLINK_SKIPPED}`);
@@ -7458,7 +7675,7 @@ function baselineOf(root, log) {
       continue;
     }
     try {
-      hashes.set(file.relPath, sha256(readFileSync9(fd)));
+      hashes.set(file.relPath, sha256(readFileSync10(fd)));
     } catch {
       hashes.set(file.relPath, UNREADABLE);
     } finally {
@@ -7580,31 +7797,6 @@ var init_service = __esm({
   }
 });
 
-// src/providers/env.ts
-function definedEnv(env) {
-  const out = {};
-  for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
-  return out;
-}
-var init_env = __esm({
-  "src/providers/env.ts"() {
-    "use strict";
-  }
-});
-
-// src/claude/auth-mode.ts
-function authModeFrom(info) {
-  if (info.apiProvider && info.apiProvider !== "firstParty") return "third_party";
-  if (info.apiKeySource && info.apiKeySource !== "none") return "api";
-  if (info.subscriptionType) return "subscription";
-  return null;
-}
-var init_auth_mode = __esm({
-  "src/claude/auth-mode.ts"() {
-    "use strict";
-  }
-});
-
 // src/claude/normalize.ts
 function normalizeSdkMessage(msg) {
   switch (msg.type) {
@@ -7708,43 +7900,10 @@ var init_normalize = __esm({
   }
 });
 
-// src/claude/pushable.ts
-var Pushable;
-var init_pushable = __esm({
-  "src/claude/pushable.ts"() {
-    "use strict";
-    Pushable = class {
-      queue = [];
-      waiters = [];
-      ended = false;
-      push(value) {
-        if (this.ended) throw new Error("Pushable already ended");
-        const waiter = this.waiters.shift();
-        if (waiter) waiter({ value, done: false });
-        else this.queue.push(value);
-      }
-      end() {
-        this.ended = true;
-        for (const waiter of this.waiters.splice(0)) waiter({ value: void 0, done: true });
-      }
-      [Symbol.asyncIterator]() {
-        return {
-          next: () => {
-            const value = this.queue.shift();
-            if (value !== void 0) return Promise.resolve({ value, done: false });
-            if (this.ended) return Promise.resolve({ value: void 0, done: true });
-            return new Promise((resolve6) => this.waiters.push(resolve6));
-          }
-        };
-      }
-    };
-  }
-});
-
 // src/claude/session.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
-import { query as sdkQuery } from "@anthropic-ai/claude-agent-sdk";
+import { query as sdkQuery2 } from "@anthropic-ai/claude-agent-sdk";
 async function askGuard(guard, toolName2, input) {
   try {
     const refusal = await guard(toolName2, input);
@@ -7805,7 +7964,7 @@ var init_session2 = __esm({
       stopAsked = false;
       start() {
         if (this.q) throw new Error("VALIDATION: session already started");
-        const queryFn = this.opts.queryFn ?? sdkQuery;
+        const queryFn = this.opts.queryFn ?? sdkQuery2;
         const guard = this.opts.toolGuard;
         const canUseTool = async (toolName2, input, options) => {
           if (guard) {
@@ -8047,15 +8206,37 @@ ${this.stderrTail.join("\n")}` : "";
 });
 
 // src/codex/normalize.ts
+function moveTarget(kind) {
+  const named = [kind.move_path, kind.movePath].filter((target) => target != null);
+  if (named.length === 0) return void 0;
+  const [first] = named;
+  return typeof first === "string" && named.every((target) => target === first) ? first : "";
+}
+function fileChanges(item) {
+  if (!Array.isArray(item.changes)) return [];
+  return item.changes.map((entry) => {
+    const change = isRecord(entry) ? entry : {};
+    const kind = isRecord(change.kind) ? change.kind : {};
+    const movePath = moveTarget(kind);
+    return {
+      path: typeof change.path === "string" ? change.path : "",
+      ...typeof kind.type === "string" ? { kind: kind.type } : {},
+      ...typeof change.diff === "string" ? { diff: change.diff } : {},
+      ...movePath === void 0 ? {} : { movePath }
+    };
+  });
+}
 function normalizeCodexItem(item, phase) {
   const base = { providerUuid: item.id, parentToolUseId: null, raw: item };
-  if (item.type === "agent_message") {
+  if (item.type === "agentMessage") {
     if (phase !== "completed") return null;
     return { role: "assistant", content: [{ type: "text", text: item.text ?? "" }], ...base };
   }
   if (item.type === "reasoning") {
     if (phase !== "completed") return null;
-    return { role: "assistant", content: [{ type: "thinking", text: item.text ?? "" }], ...base };
+    const text = (Array.isArray(item.summary) ? item.summary : []).join("\n\n");
+    if (!text) return null;
+    return { role: "assistant", content: [{ type: "thinking", text }], ...base };
   }
   const name = toolName(item);
   if (!name) return null;
@@ -8063,12 +8244,11 @@ function normalizeCodexItem(item, phase) {
     const block2 = { type: "tool_use", id: item.id, name, input: toolInput(item) };
     return { role: "assistant", content: [block2], ...base };
   }
-  const isError2 = item.status === "failed" || item.exit_code !== void 0 && item.exit_code !== 0;
   const block = {
     type: "tool_result",
     toolUseId: item.id,
     content: resultText(item),
-    isError: isError2
+    isError: failed4(item)
   };
   return { role: "tool", content: [block], ...base };
 }
@@ -8089,20 +8269,21 @@ function deltaEvents(_itemId, kind, text, first) {
 function stopEvents() {
   return [{ type: "content_block_stop", index: 0 }, { type: "message_stop" }];
 }
-var toolName, toolInput, resultText;
+var isRecord, toolName, toolInput, resultText, failed4;
 var init_normalize2 = __esm({
   "src/codex/normalize.ts"() {
     "use strict";
     init_src();
+    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     toolName = (item) => {
       switch (item.type) {
-        case "command_execution":
+        case "commandExecution":
           return CODEX_TOOL_NAMES.command;
-        case "file_change":
+        case "fileChange":
           return CODEX_TOOL_NAMES.fileChange;
-        case "web_search":
+        case "webSearch":
           return CODEX_TOOL_NAMES.webSearch;
-        case "mcp_tool_call":
+        case "mcpToolCall":
           return `codex.mcp.${(item.server ?? "server").replace(/[^A-Za-z0-9_.-]/g, "")}.${(item.tool ?? "tool").replace(/[^A-Za-z0-9_.-]/g, "")}`.slice(
             0,
             64
@@ -8113,21 +8294,25 @@ var init_normalize2 = __esm({
     };
     toolInput = (item) => {
       switch (item.type) {
-        case "command_execution":
+        case "commandExecution":
           return { command: item.command ?? "", ...item.cwd ? { cwd: item.cwd } : {} };
-        case "file_change":
-          return { changes: item.changes ?? [] };
-        case "web_search":
+        case "fileChange":
+          return { changes: fileChanges(item) };
+        case "webSearch":
           return { query: item.query ?? "" };
         default:
-          return item.arguments ?? {};
+          if (isRecord(item.arguments)) return item.arguments;
+          return item.arguments === void 0 ? {} : { arguments: item.arguments };
       }
     };
     resultText = (item) => {
-      if (item.type === "command_execution") return item.aggregated_output ?? "";
-      if (item.type === "file_change") return JSON.stringify(item.changes ?? []);
+      if (item.type === "commandExecution") return item.aggregatedOutput ?? "";
+      if (item.type === "fileChange") return JSON.stringify(fileChanges(item));
+      if (item.type === "webSearch") return JSON.stringify(item.action ?? null);
+      if (item.error?.message) return item.error.message;
       return typeof item.result === "string" ? item.result : JSON.stringify(item.result ?? null);
     };
+    failed4 = (item) => item.status === "failed" || item.status === "declined" || Boolean(item.error) || typeof item.exitCode === "number" && item.exitCode !== 0;
   }
 });
 
@@ -8142,6 +8327,9 @@ function sandboxFor(mode, cwd) {
       return { type: "workspaceWrite", writableRoots: [cwd], networkAccess: false };
   }
 }
+function sandboxMode(policy) {
+  return SANDBOX_MODES[policy.type];
+}
 function autoDecide(mode, kind) {
   if (mode === "bypassPermissions") return "accept";
   if (mode === "dontAsk") return "decline";
@@ -8149,9 +8337,15 @@ function autoDecide(mode, kind) {
   if (mode === "acceptEdits" && kind === "file_change") return "accept";
   return "ask";
 }
+var SANDBOX_MODES;
 var init_policy = __esm({
   "src/codex/policy.ts"() {
     "use strict";
+    SANDBOX_MODES = {
+      readOnly: "read-only",
+      workspaceWrite: "workspace-write",
+      dangerFullAccess: "danger-full-access"
+    };
   }
 });
 
@@ -8160,7 +8354,8 @@ import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 import { chmodSync as chmodSync5, lstatSync as lstatSync7, mkdirSync as mkdirSync8, rmdirSync, rmSync as rmSync8, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname8, join as join22 } from "path";
+import { dirname as dirname9, join as join23 } from "path";
+import { z as z18 } from "zod";
 function newStop() {
   let resolve6;
   let reject;
@@ -8174,10 +8369,35 @@ function newStop() {
 function removeFiles(files) {
   for (const file of files) rmSync8(file, { force: true });
 }
+function readQuestions(params) {
+  const asked = AskedQuestions.safeParse(params);
+  if (!asked.success) return null;
+  const { questions } = asked.data;
+  const ids = questions.map((q) => q.id);
+  if (new Set(ids).size !== ids.length || questions.some((q) => q.isSecret)) return null;
+  const input = CodexQuestions.safeParse({
+    questions: questions.map((q) => ({
+      text: q.question,
+      ...q.options?.length ? { options: q.options.map((o) => o.label) } : {}
+    }))
+  });
+  return input.success ? { ids, input: input.data } : null;
+}
 function scrubSecrets(text) {
   return SECRET_PATTERNS.reduce((acc, [pattern, to]) => acc.replace(pattern, to), text);
 }
-var STDERR_TAIL_MAX, STOP_WAIT_MS, SIGKILL_AFTER_MS, SECRET_PATTERNS, APPROVAL_METHODS, CodexSession;
+function failureText(error) {
+  const message = error?.message;
+  if (typeof message !== "string" || !message.trim()) return null;
+  let text = message;
+  try {
+    const inner = JSON.parse(message)?.error?.message;
+    if (typeof inner === "string" && inner.trim()) text = inner;
+  } catch {
+  }
+  return scrubSecrets(text).trim().slice(0, TURN_ERROR_MAX);
+}
+var decided, NO_ANSWERS, REFUSALS, METHOD_NOT_FOUND, AskedQuestions, STDERR_TAIL_MAX, STOP_WAIT_MS, TURN_ERROR_MAX, SIGKILL_AFTER_MS, SECRET_PATTERNS, APPROVAL_METHODS, CodexSession;
 var init_session3 = __esm({
   "src/codex/session.ts"() {
     "use strict";
@@ -8187,8 +8407,27 @@ var init_session3 = __esm({
     init_normalize2();
     init_policy();
     init_rpc();
+    decided = (decision) => ({ decision });
+    NO_ANSWERS = { answers: {} };
+    REFUSALS = {
+      "item/permissions/requestApproval": { permissions: {} },
+      "mcpServer/elicitation/request": { action: "decline" },
+      "item/tool/call": { contentItems: [], success: false }
+    };
+    METHOD_NOT_FOUND = -32601;
+    AskedQuestions = z18.object({
+      questions: z18.array(
+        z18.object({
+          id: z18.string().min(1),
+          question: z18.string(),
+          isSecret: z18.boolean().nullish(),
+          options: z18.array(z18.object({ label: z18.string() })).nullish()
+        })
+      )
+    });
     STDERR_TAIL_MAX = 2 * 1024;
     STOP_WAIT_MS = 2e3;
+    TURN_ERROR_MAX = 500;
     SIGKILL_AFTER_MS = 5e3;
     SECRET_PATTERNS = [
       [
@@ -8234,8 +8473,17 @@ var init_session3 = __esm({
       resolvers = /* @__PURE__ */ new Map();
       /** Monotonic, so no two held requests can ever share a local id. */
       approvalSeq = 0;
-      /** How many questions each pending `codex.user_input` asked, so answers can be counted. */
-      questionCounts = /* @__PURE__ */ new Map();
+      /**
+       * The app-server's id of each question a pending `codex.user_input` asked, in the order the
+       * card shows them: an answer goes back under its question's id.
+       */
+      questionIds = /* @__PURE__ */ new Map();
+      /**
+       * The files of each `fileChange` item in progress, by item id. `item/fileChange/requestApproval`
+       * names the item and not its files: those came with `item/started`, which the app-server sends
+       * first (live 2026-10-13), and with any `item/fileChange/patchUpdated` after.
+       */
+      fileChanges = /* @__PURE__ */ new Map();
       start() {
         if (this.child) throw new Error("VALIDATION: session already started");
         const spawnFn = this.opts.spawnFn ?? ((p, a, env) => spawn2(p, a, { stdio: "pipe", env }));
@@ -8255,13 +8503,19 @@ var init_session3 = __esm({
 ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
           const error = this.stopping || code === 0 ? null : `PROVIDER_ERROR: codex exited with ${code}${tail}`;
           this.removeAllFiles();
+          this.withdrawAll();
           this.emit("exit", { error });
         });
         const rpc = new JsonRpc(child.stdin, child.stdout);
         this.rpc = rpc;
-        rpc.onNotification((n) => this.onNotification(n.method, n.params));
-        rpc.onRequest((r) => this.onRequest(r.method, r.params));
+        rpc.onNotification(
+          (n) => this.onNotification(n.method, n.params ?? {})
+        );
+        rpc.onRequest(
+          (r) => this.onRequest(r.id, r.method, r.params ?? {})
+        );
         void this.handshake().catch((err) => {
+          this.withdrawAll();
           this.emit("exit", {
             error: `PROVIDER_ERROR: ${err instanceof Error ? err.message : String(err)}`
           });
@@ -8277,17 +8531,24 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         const params = {
           cwd: this.opts.cwd,
           approvalPolicy: "on-request",
-          sandbox: this.sandbox,
+          // The mode word: opening a thread refuses a policy object (`unknown variant `type``, live
+          // 2026-10-13). The policy itself, with its writable root, goes with every `turn/start`.
+          sandbox: sandboxMode(this.sandbox),
           ...this.pendingModel ? { model: this.pendingModel } : {}
         };
         const res = this.opts.resume ? await rpc.request("thread/resume", {
           threadId: this.opts.resume,
           ...params
-        }) : await rpc.request("thread/start", params);
-        this.providerSessionId = res.threadId ?? this.opts.resume ?? null;
+        }) : await rpc.request("thread/start", {
+          ...params,
+          ...this.opts.ephemeral ? { ephemeral: true } : {}
+        });
+        const threadId = res?.thread?.id;
+        if (!threadId) throw new Error("codex app-server opened no thread");
+        this.providerSessionId = threadId;
         this.emit("init", {
-          providerSessionId: this.providerSessionId ?? "",
-          model: res.model ?? this.pendingModel ?? "",
+          providerSessionId: threadId,
+          model: res?.model ?? this.pendingModel ?? "",
           tools: [],
           slashCommands: [],
           permissionMode: this.mode
@@ -8325,7 +8586,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
           assertStagingInsideHome(home, dir);
           mkdirSync8(dir, { recursive: true, mode: 448 });
           assertStagingInsideHome(home, dir);
-          for (const path of [dirname8(dir), dir]) {
+          for (const path of [dirname9(dir), dir]) {
             const st = lstatSync7(path);
             if (st.isSymbolicLink() || !st.isDirectory()) {
               throw new Error(`${path} is not a plain directory`);
@@ -8333,7 +8594,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
           }
           chmodSync5(dir, 448);
           for (const image of images) {
-            const path = join22(dir, `${randomUUID4()}.${ATTACHMENT_MEDIA_TYPES[image.mediaType]}`);
+            const path = join23(dir, `${randomUUID4()}.${ATTACHMENT_MEDIA_TYPES[image.mediaType]}`);
             writeFileSync6(path, image.data, { mode: 384, flag: "wx" });
             written.push(path);
           }
@@ -8353,6 +8614,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         if (!turn) return;
         this.turn = null;
         removeFiles(turn.files);
+        this.fileChanges.clear();
         turn.stop?.resolve();
       }
       removeAllFiles() {
@@ -8399,7 +8661,11 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             isError: true,
             durationMs: 0,
             numTurns: 1,
-            stopReason: err instanceof Error ? err.message : String(err)
+            // The app-server's own words, broadcast like a failed turn's: scrubbed and kept short.
+            stopReason: scrubSecrets(err instanceof Error ? err.message : String(err)).slice(
+              0,
+              TURN_ERROR_MAX
+            )
           });
         });
       }
@@ -8469,6 +8735,10 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             const item = params.item;
             if (!item) return;
             const phase = method === "item/started" ? "started" : "completed";
+            if (item.type === "fileChange") {
+              if (phase === "started") this.setFiles(item.id, fileChanges(item));
+              else this.fileChanges.delete(item.id);
+            }
             if (phase === "completed" && this.streaming.delete(item.id)) {
               for (const event of stopEvents())
                 this.emit("stream", { event, parentToolUseId: null, uuid: item.id });
@@ -8477,15 +8747,32 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             if (row) this.emit("message", row);
             return;
           }
-          case "turn/completed":
-          case "turn/failed": {
+          case "item/fileChange/patchUpdated":
+            if (typeof params.itemId === "string" && this.fileChanges.has(params.itemId)) {
+              this.setFiles(params.itemId, fileChanges(params));
+            }
+            return;
+          case "serverRequest/resolved":
+            for (const [id, entry] of [...this.approvals]) {
+              if (entry.rpcId === params.requestId) this.withdraw(id);
+            }
+            return;
+          case "turn/completed": {
             this.endTurn();
-            const status = turn?.status ?? params.status ?? (method === "turn/failed" ? "failed" : "completed");
+            const ended = turn?.id ?? params.turnId;
+            for (const [id, entry] of [...this.approvals]) {
+              if (typeof ended !== "string" || entry.turnId === null || entry.turnId === ended) {
+                this.withdraw(id);
+              }
+            }
+            const status = turn?.status ?? params.status ?? "completed";
+            const isError2 = status === "failed";
             this.emit("result", {
-              isError: status === "failed",
+              isError: isError2,
               durationMs: turn?.durationMs ?? params.durationMs ?? 0,
               numTurns: 1,
-              stopReason: status
+              // A failed turn says why, when the app-server did.
+              stopReason: isError2 && failureText(turn?.error) || status
             });
             this.flush();
             return;
@@ -8494,6 +8781,45 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             return;
         }
       }
+      /**
+       * The files of a `fileChange` item, as last told. A card already up for that item shows the
+       * files as they were, and the roots check passed those: it is withdrawn and the approval
+       * declined, since the patch an answer would now allow is not the one the owner is reading.
+       */
+      setFiles(itemId, changes) {
+        const before = this.fileChanges.get(itemId);
+        this.fileChanges.set(itemId, changes);
+        if (before === void 0 || JSON.stringify(before) === JSON.stringify(changes)) return;
+        for (const [id, entry] of [...this.approvals]) {
+          if (entry.kind === "file_change" && entry.itemId === itemId) this.withdraw(id);
+        }
+      }
+      /**
+       * Take back a held request no answer can reach any more: nobody answered in time, its files
+       * changed under the card, the app-server settled it itself, its turn ended, the session is
+       * stopping, or the app-server is gone. The request is answered with its own refusal (an approval
+       * declines; a question's response is its answers, of which there are none), and
+       * `permissionTimeout` has the manager expire the card's row, after which an answer to it is
+       * refused. One place, so no way of withdrawing can leave behind what another clears.
+       */
+      withdraw(id) {
+        const entry = this.approvals.get(id);
+        if (!entry) return;
+        clearTimeout(entry.timer);
+        this.approvals.delete(id);
+        this.questionIds.delete(id);
+        this.resolvers.get(id)?.(entry.refusal);
+        this.resolvers.delete(id);
+        this.emit("permissionTimeout", { id });
+      }
+      /**
+       * Every held request, when nothing is left to answer: the session is stopping, the app-server
+       * has exited, or it never opened a thread. The refusals are written if there is still a pipe to
+       * write them to; into one that is gone they are dropped, without a throw (`rpc.test.ts`).
+       */
+      withdrawAll() {
+        for (const id of [...this.approvals.keys()]) this.withdraw(id);
+      }
       delta(params, kind, field) {
         const itemId = params.itemId ?? "";
         const text = params[field] ?? "";
@@ -8509,27 +8835,43 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
        * The reply is held until a human answers or the timer fires, which is what makes a Codex chat
        * behave like a Claude one — the SDK's `canUseTool` blocks the same way.
        */
-      onRequest(method, params) {
-        if (method === "tool/requestUserInput") return this.askQuestion(params);
-        const kind = APPROVAL_METHODS[method];
-        if (!kind) return "decline";
-        const toolName2 = kind === "command" ? CODEX_TOOL_NAMES.command : CODEX_TOOL_NAMES.fileChange;
-        const input = kind === "command" ? {
-          command: params.command ?? "",
-          cwd: params.cwd ?? this.opts.cwd,
-          ...params.reason ? { reason: params.reason } : {}
-        } : { changes: params.changes ?? [], ...params.reason ? { reason: params.reason } : {} };
+      onRequest(rpcId, method, params) {
+        const from = { rpcId, turnId: typeof params.turnId === "string" ? params.turnId : null };
+        if (method === "item/tool/requestUserInput") return this.askQuestion(from, params);
+        const kind = Object.hasOwn(APPROVAL_METHODS, method) ? APPROVAL_METHODS[method] : void 0;
+        if (!kind) {
+          if (Object.hasOwn(REFUSALS, method)) return REFUSALS[method];
+          throw new RpcError(METHOD_NOT_FOUND, `cayenne does not handle ${method}`);
+        }
+        const itemId = typeof params.itemId === "string" ? params.itemId : null;
+        const reason = params.reason ? { reason: params.reason } : {};
+        let toolName2;
+        let input;
+        if (kind === "command") {
+          toolName2 = CODEX_TOOL_NAMES.command;
+          const { command, cwd } = params;
+          if ((params.kind ?? "command") !== "command" || params.networkApprovalContext != null || typeof command !== "string" || command.trim() === "" || cwd != null && typeof cwd !== "string") {
+            return decided("decline");
+          }
+          input = { command, cwd: cwd ?? this.opts.cwd, ...reason };
+        } else {
+          toolName2 = CODEX_TOOL_NAMES.fileChange;
+          if (params.grantRoot != null) return decided("decline");
+          const changes = (itemId ? this.fileChanges.get(itemId) : void 0) ?? [];
+          if (changes.length === 0) return decided("decline");
+          input = { changes, ...reason };
+        }
         try {
-          this.opts.checkInput?.(toolName2, input);
+          this.opts.checkInput(toolName2, input);
         } catch {
-          return "decline";
+          return decided("decline");
         }
         const decision = autoDecide(this.mode, kind);
-        if (decision !== "ask") return decision;
-        return this.hold(this.nextApprovalId(kind), kind, "decline", {
+        if (decision !== "ask") return decided(decision);
+        return this.hold(this.nextApprovalId(kind), kind, decided("decline"), from, {
           toolName: toolName2,
           input,
-          toolUseId: params.itemId ?? null
+          toolUseId: itemId
         });
       }
       /**
@@ -8539,15 +8881,20 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
        * same answer RPC. The shape is validated here, before a row exists — a malformed or oversized
        * ask is cancelled rather than rendered, because the questions are text the model produced and
        * the card is the one surface where a human is asked to trust what they read.
-       */
-      askQuestion(params) {
-        const parsed = CodexQuestions.safeParse(params);
-        if (!parsed.success) return Promise.resolve("cancel");
+       *
+       * The app-server's question (`{ id, header, question, options: { label, description }[] }`) is
+       * not the one Cayenne stores (`CodexQuestions`: `{ text, options: string[] }`), and its answer is
+       * keyed by question id where `CodexAnswers` is a list in order. The adapter translates both
+       * ways, so the row, the card and the answer RPC are what they were.
+       */
+      askQuestion(from, params) {
+        const asked = readQuestions(params);
+        if (!asked) return Promise.resolve(NO_ANSWERS);
         const id = this.nextApprovalId("question");
-        this.questionCounts.set(id, parsed.data.questions.length);
-        return this.hold(id, "question", "cancel", {
+        this.questionIds.set(id, asked.ids);
+        return this.hold(id, "question", NO_ANSWERS, from, {
           toolName: CODEX_TOOL_NAMES.userInput,
-          input: parsed.data,
+          input: asked.input,
           toolUseId: null
         });
       }
@@ -8564,20 +8911,21 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         this.approvalSeq += 1;
         return `${kind}-${this.approvalSeq}`;
       }
-      /** Park a server request until a human answers it or the timer gives up on them. */
-      hold(id, kind, onTimeout, req) {
+      /**
+       * Park a server request until a human answers it, the timer gives up on them, or it is
+       * withdrawn (`withdraw`).
+       */
+      hold(id, kind, onTimeout, from, req) {
         if (this.approvals.has(id) || this.resolvers.has(id)) {
           throw new Error(`VALIDATION: approval id ${id} is already held`);
         }
         return new Promise((resolve6) => {
-          const timer = setTimeout(() => {
-            this.approvals.delete(id);
-            this.resolvers.delete(id);
-            this.questionCounts.delete(id);
-            this.emit("permissionTimeout", { id });
-            resolve6(onTimeout);
-          }, this.opts.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS);
-          this.approvals.set(id, { rpcId: 0, kind, refusal: onTimeout, timer });
+          const timer = setTimeout(
+            () => this.withdraw(id),
+            this.opts.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS
+          );
+          const itemId = kind === "question" ? null : req.toolUseId;
+          this.approvals.set(id, { ...from, kind, refusal: onTimeout, itemId, timer });
           this.resolvers.set(id, resolve6);
           this.emit("permission", { id, ...req, suggestions: null });
         });
@@ -8588,20 +8936,24 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         if (!entry || !resolve6) return false;
         let reply;
         if (entry.kind === "question") {
-          if (decision.behavior === "deny") reply = "cancel";
+          if (decision.behavior === "deny") reply = NO_ANSWERS;
           else {
+            const ids = this.questionIds.get(id) ?? [];
             const answers = CodexAnswers.safeParse(decision.updatedInput ?? {});
-            if (!answers.success || answers.data.answers.length !== this.questionCounts.get(id))
-              return false;
-            reply = { answers: answers.data.answers };
+            if (!answers.success || answers.data.answers.length !== ids.length) return false;
+            reply = {
+              answers: Object.fromEntries(
+                ids.map((questionId, n) => [questionId, { answers: [answers.data.answers[n] ?? ""] }])
+              )
+            };
           }
         } else {
-          reply = decision.behavior === "allow" ? "accept" : "decline";
+          reply = decided(decision.behavior === "allow" ? "accept" : "decline");
         }
         clearTimeout(entry.timer);
         this.approvals.delete(id);
         this.resolvers.delete(id);
-        this.questionCounts.delete(id);
+        this.questionIds.delete(id);
         resolve6(reply);
         return true;
       }
@@ -8657,13 +9009,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
       }
       async stop() {
         this.stopping = true;
-        for (const [id, entry] of [...this.approvals]) {
-          clearTimeout(entry.timer);
-          this.approvals.delete(id);
-          this.resolvers.get(id)?.(entry.refusal);
-          this.resolvers.delete(id);
-          this.emit("permissionTimeout", { id });
-        }
+        this.withdrawAll();
         const stoppable = this.turn?.started && this.turn.id;
         await (stoppable ? this.interrupt().catch(() => void 0) : void 0);
         this.removeAllFiles();
@@ -8715,9 +9061,9 @@ var init_types = __esm({
 
 // src/skills/paths.ts
 import { realpathSync as realpathSync13 } from "fs";
-import { isAbsolute as isAbsolute14, join as join23, relative as relative8, sep as sep11 } from "path";
+import { isAbsolute as isAbsolute14, join as join24, relative as relative8, sep as sep11 } from "path";
 function clearSessionSkills(home, runnerId, heldBy) {
-  clearRunnerStaging(home, join23(home, "session-skills"), runnerId, heldBy);
+  clearRunnerStaging(home, join24(home, "session-skills"), runnerId, heldBy);
 }
 function assertInsideScopeDir(path, scopeDir) {
   let dirNow;
@@ -8742,8 +9088,8 @@ var init_paths3 = __esm({
     "use strict";
     init_paths();
     init_attachments2();
-    sessionSkillsRoot = (home, runnerId) => join23(home, "session-skills", runnerId);
-    sessionSkillsDir = (home, runnerId, sessionId) => join23(sessionSkillsRoot(home, runnerId), sessionId);
+    sessionSkillsRoot = (home, runnerId) => join24(home, "session-skills", runnerId);
+    sessionSkillsDir = (home, runnerId, sessionId) => join24(sessionSkillsRoot(home, runnerId), sessionId);
   }
 });
 
@@ -8882,7 +9228,7 @@ import {
   realpathSync as realpathSync14
 } from "fs";
 import { open as open2, opendir } from "fs/promises";
-import { isAbsolute as isAbsolute15, join as join24, relative as relative9, sep as sep12 } from "path";
+import { isAbsolute as isAbsolute15, join as join25, relative as relative9, sep as sep12 } from "path";
 function inside2(root, candidate) {
   const rel = relative9(root, candidate);
   return rel === "" || !rel.startsWith(`..${sep12}`) && rel !== ".." && !isAbsolute15(rel);
@@ -8911,7 +9257,7 @@ function scopeRoots(opts) {
   const isGitRepo = opts.isGitRepo ?? defaultIsGitRepo;
   const home = canonical2(opts.home);
   const homes = protectedHomes(opts);
-  const found = [{ scope: "personal", dir: join24(home, "skills"), base: home }];
+  const found = [{ scope: "personal", dir: join25(home, "skills"), base: home }];
   let skillsRepo;
   if (opts.skillsRepo !== void 0) {
     try {
@@ -8932,7 +9278,7 @@ function scopeRoots(opts) {
       continue;
     }
     if (!isGitRepo(real)) continue;
-    const dir = join24(real, ".cayenne", "skills");
+    const dir = join25(real, ".cayenne", "skills");
     const shared = skillsRepo !== void 0 && real === skillsRepo ? "workspace" : "project";
     if (overlapsHome(canonical2(dir), homes, shared, log)) continue;
     if (skillsRepo !== void 0 && real === skillsRepo) {
@@ -8994,7 +9340,7 @@ async function scanSkills(opts) {
       } catch (err) {
         log.warn(
           {
-            path: join24(root.dirReal, entry.name),
+            path: join25(root.dirReal, entry.name),
             scope: root.scope,
             err: err instanceof Error ? err.message : String(err)
           },
@@ -9039,13 +9385,13 @@ async function readAtMost2(fh, limit) {
   return buffer.subarray(0, filled);
 }
 async function readEntry(root, entry, log, budget) {
-  const path = join24(root.dirReal, entry.name);
+  const path = join25(root.dirReal, entry.name);
   const skip = (reason) => {
     log.warn({ path, scope: root.scope }, `skill skipped: ${reason}`);
     return null;
   };
   if (entry.isDirectory()) {
-    const nested = existsSync5(join24(path, "SKILL.md"));
+    const nested = existsSync5(join25(path, "SKILL.md"));
     return skip(
       nested ? `a directory holding SKILL.md: Cayenne's store is flat, so move it to ${entry.name}.md beside this directory` : "a directory, and the scan does not recurse"
     );
@@ -9205,7 +9551,7 @@ var init_scan2 = __esm({
     SKILL_SCAN_MAX_PER_DIR = 500;
     SKILL_SCAN_MAX_SKILLS = 500;
     SKILL_SCAN_MAX_BYTES = 32 * 1024 * 1024;
-    defaultIsGitRepo = (dir) => lstatSync8(join24(dir, ".git"), { throwIfNoEntry: false }) !== void 0;
+    defaultIsGitRepo = (dir) => lstatSync8(join25(dir, ".git"), { throwIfNoEntry: false }) !== void 0;
     summariesOf = (scan) => scan.map((s) => s.summary);
     FRONTMATTER = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
     KEY = /^([A-Za-z_][A-Za-z0-9_-]*):[ \t]*(.*)$/;
@@ -9224,7 +9570,7 @@ import {
   rmSync as rmSync9
 } from "fs";
 import { open as open3, writeFile } from "fs/promises";
-import { dirname as dirname9, isAbsolute as isAbsolute16, join as join25, relative as relative10, sep as sep13 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute16, join as join26, relative as relative10, sep as sep13 } from "path";
 function isSkillRefusal(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return msg.startsWith("ROOT_NOT_ALLOWED") || msg.startsWith(BUDGET) || msg.includes("is not a plain directory") || msg.includes("is not part of the session skills plugin");
@@ -9271,7 +9617,7 @@ async function materialiseSkills(scan, t) {
   }
   const path = plainDirectory(t.home, sessionSkillsDir(t.home, t.runnerId, t.sessionId));
   await writeFile(
-    join25(plainDirectory(t.home, join25(path, ".claude-plugin")), "plugin.json"),
+    join26(plainDirectory(t.home, join26(path, ".claude-plugin")), "plugin.json"),
     `${JSON.stringify(
       {
         name: SKILL_PLUGIN_NAME,
@@ -9301,13 +9647,13 @@ async function materialiseSkills(scan, t) {
       );
     }
     try {
-      const dir = plainDirectory(t.home, join25(path, "skills", slug));
-      await writeFile(join25(dir, "SKILL.md"), bytes, { mode: 384, flag: "wx" });
+      const dir = plainDirectory(t.home, join26(path, "skills", slug));
+      await writeFile(join26(dir, "SKILL.md"), bytes, { mode: 384, flag: "wx" });
       slugs.push(slug);
     } catch (err) {
       note(log, err, { slug, scope, path: skill.path }, "skill not materialised for this session");
       try {
-        rmSync9(assertStagingInsideHome(t.home, join25(path, "skills", slug)), {
+        rmSync9(assertStagingInsideHome(t.home, join26(path, "skills", slug)), {
           recursive: true,
           force: true
         });
@@ -9371,20 +9717,20 @@ function assertSealed(path, slugs) {
     const want = new Set(expected);
     for (const entry of entries2) {
       const ok = kind === "dir" ? entry.isDirectory() : entry.isFile();
-      if (!ok || !want.has(entry.name)) throw stray(join25(dir, entry.name));
+      if (!ok || !want.has(entry.name)) throw stray(join26(dir, entry.name));
     }
-    if (entries2.length !== want.size) throw stray(join25(dir, [...want].join("|")));
+    if (entries2.length !== want.size) throw stray(join26(dir, [...want].join("|")));
   };
   named(path, [".claude-plugin", "skills"], "dir");
-  named(join25(path, ".claude-plugin"), ["plugin.json"], "file");
-  named(join25(path, "skills"), slugs, "dir");
-  for (const slug of slugs) named(join25(path, "skills", slug), ["SKILL.md"], "file");
+  named(join26(path, ".claude-plugin"), ["plugin.json"], "file");
+  named(join26(path, "skills"), slugs, "dir");
+  for (const slug of slugs) named(join26(path, "skills", slug), ["SKILL.md"], "file");
 }
 function plainDirectory(home, dir) {
   const intended = assertStagingInsideHome(home, dir);
   mkdirSync9(intended, { recursive: true, mode: 448 });
   const proved = assertStagingInsideHome(home, intended);
-  for (const p of [dirname9(proved), proved]) {
+  for (const p of [dirname10(proved), proved]) {
     const st = lstatSync9(p);
     if (st.isSymbolicLink() || !st.isDirectory()) throw new Error(`${p} is not a plain directory`);
   }
@@ -9941,13 +10287,13 @@ var init_secret_files = __esm({
 
 // src/sessions/task-sessions.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function createTaskSessions(dir) {
   const fileFor = (sessionId) => {
     if (!UUID3.test(sessionId)) {
       throw new Error(`VALIDATION: ${sessionId.slice(0, 40)} is not a session id`);
     }
-    return join26(dir, `${sessionId.toLowerCase()}.json`);
+    return join27(dir, `${sessionId.toLowerCase()}.json`);
   };
   return {
     mark(sessionId) {
@@ -9968,10 +10314,10 @@ var init_task_sessions = __esm({
 });
 
 // src/sessions/user-guards.ts
-import { closeSync as closeSync4, constants as constants4, fstatSync, openSync as openSync4, readFileSync as readFileSync10 } from "fs";
-import { isAbsolute as isAbsolute20, join as join27 } from "path";
+import { closeSync as closeSync4, constants as constants4, fstatSync, openSync as openSync4, readFileSync as readFileSync11 } from "fs";
+import { isAbsolute as isAbsolute20, join as join28 } from "path";
 function readUserGuards(configDir) {
-  const settingsFile = join27(configDir, "settings.json");
+  const settingsFile = join28(configDir, "settings.json");
   const none = { settingsFile, preToolUseHooks: 0, denyRules: 0 };
   if (!isAbsolute20(configDir)) return none;
   const text = readSmallFile(settingsFile);
@@ -10006,7 +10352,7 @@ function readSmallFile(path) {
   try {
     const stats = fstatSync(fd);
     if (!stats.isFile() || stats.size > USER_SETTINGS_MAX_BYTES) return null;
-    return readFileSync10(fd, "utf8");
+    return readFileSync11(fd, "utf8");
   } catch {
     return null;
   } finally {
@@ -10040,7 +10386,7 @@ var init_user_guards = __esm({
 // src/sessions/manager.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import { realpathSync as realpathSync17 } from "fs";
-import { isAbsolute as isAbsolute21, join as join28, relative as relative14, sep as sep17 } from "path";
+import { isAbsolute as isAbsolute21, join as join29, relative as relative14, sep as sep17 } from "path";
 import { isDeepStrictEqual } from "util";
 function releaseCreds(creds) {
   if (creds?.state === "ok") creds.release();
@@ -10071,7 +10417,7 @@ function assertRepoOwner(ownerId, createdBy) {
 }
 function narrowToSession(suggestions) {
   if (!suggestions) return suggestions;
-  return suggestions.map((s) => isRecord(s) ? { ...s, destination: "session" } : s);
+  return suggestions.map((s) => isRecord2(s) ? { ...s, destination: "session" } : s);
 }
 function shrink(event) {
   switch (event.type) {
@@ -10089,7 +10435,7 @@ function shrink(event) {
       return null;
   }
 }
-var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, DRAINED_AFTER_MS, roundUsd, UNIQUE_VIOLATION, ROW_WRITE_TIMEOUT_MS, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord, errorCode, SessionManager;
+var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, DRAINED_AFTER_MS, roundUsd, UNIQUE_VIOLATION, ROW_WRITE_TIMEOUT_MS, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord2, errorCode, SessionManager;
 var init_manager = __esm({
   "src/sessions/manager.ts"() {
     "use strict";
@@ -10176,7 +10522,7 @@ var init_manager = __esm({
       "LS"
     ]);
     PATH_INPUT_KEYS = ["file_path", "path", "cwd", "notebook_path"];
-    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     errorCode = (message) => message.startsWith("ROOT_NOT_ALLOWED") ? "ROOT_NOT_ALLOWED" : "VALIDATION";
     SessionManager = class {
       constructor(deps) {
@@ -11173,6 +11519,7 @@ var init_manager = __esm({
         turns.drainedAt = Date.now();
         turns.early = true;
         turns.chased = false;
+        turns.ended += 1;
       }
       /**
        * Put rows on this runner that claim a turn in progress back to `idle`, for the chats that have
@@ -11429,7 +11776,7 @@ var init_manager = __esm({
             const id = sessionId === void 0 ? null : this.live.get(sessionId)?.session.providerSessionId;
             if (projectDir === null || typeof id !== "string" || !PROVIDER_SESSION_ID.test(id))
               return [];
-            return [join28(projectDir, id, "tool-results")];
+            return [join29(projectDir, id, "tool-results")];
           };
           const policy2 = this.settingsPolicy(createdBy, cwd, permissionMode, []);
           this.warnBypassWithoutUserGuards(createdBy, permissionMode, policy2, sessionId);
@@ -11477,7 +11824,7 @@ var init_manager = __esm({
           canonical3 = realpathSync17.native(configDir);
         } catch {
         }
-        return join28(canonical3, "projects", claudeProjectDirName(cwd));
+        return join29(canonical3, "projects", claudeProjectDirName(cwd));
       }
       /** Whether one of `roots` contains the managed root, as an allowed root such as `~` can. */
       reachesManagedRoot(roots) {
@@ -11508,7 +11855,7 @@ var init_manager = __esm({
         return parsed.data;
       }
       taskSessions() {
-        return this.deps.taskSessions ?? createTaskSessions(join28(this.deps.cayenneHome ?? cayenneHome(), "task-sessions"));
+        return this.deps.taskSessions ?? createTaskSessions(join29(this.deps.cayenneHome ?? cayenneHome(), "task-sessions"));
       }
       markTaskSession(sessionId) {
         try {
@@ -11690,15 +12037,31 @@ var init_manager = __esm({
       /**
        * A tool's path as the provider opens it: relative means relative to the session's cwd. Every
        * judge of a tool's path goes through here (R28's `checkUpdatedInput`, a suggested directory,
-       * Codex's changes and command cwd). A value the Claude CLI would rewrite before it opens it
-       * (surrounding whitespace, a leading `~`, a non-NFC spelling) is refused, not judged: judged as
-       * written, `~/.ssh/id_rsa` was `<cwd>/~/.ssh/id_rsa`, inside any root (security re-review
-       * 2026-09-29).
+       * and Codex's paths by way of `codexPath`, which admits no relative one). A value the Claude CLI
+       * would rewrite before it opens it (surrounding whitespace, a leading `~`, a non-NFC spelling)
+       * is refused, not judged: judged as written, `~/.ssh/id_rsa` was `<cwd>/~/.ssh/id_rsa`, inside
+       * any root (security re-review 2026-09-29).
        */
       fromCwd(cwd, value) {
         if (!isPlainToolPath(value)) throw new Error(notPlainPathRefusal(value));
         return isAbsolute21(value) ? value : `${cwd}${sep17}${value}`;
       }
+      /**
+       * A path Codex named, for the roots check: absolute, or refused. The runner cannot prove what
+       * directory the app-server would resolve a relative one against: a turn's cwd is the
+       * app-server's, and a command can move it. Every live run against codex-cli 0.162 named
+       * absolute paths only, so a relative one is an unknown shape, refused exactly as an
+       * out-of-roots path is. An absolute value still passes through `fromCwd`, which refuses one
+       * that is not a plain path.
+       */
+      codexPath(cwd, value) {
+        if (!isAbsolute21(value)) {
+          throw new Error(
+            `ROOT_NOT_ALLOWED: ${JSON.stringify(value)} is not an absolute path; a Codex change or command names every path by its absolute path`
+          );
+        }
+        return this.fromCwd(cwd, value);
+      }
       /**
        * §2.9: a path in `updatedInput` passes the same boundary the session's `cwd` did, and the
        * SDK receives the canonical path the guard proved rather than the spelling typed (S2). The
@@ -11721,6 +12084,11 @@ var init_manager = __esm({
        * not admit is denied before a row exists: no answer the owner could give would make it
        * acceptable, exactly as R28 reasons for the Claude path.
        *
+       * A change writes its `path` and, when it moves the file, its `movePath`: both are read here,
+       * each as a path of its own, so the card and the auto-accept gate judge the same set. A command
+       * must name its `cwd`: absent, blank or not a string, the command is refused, not passed.
+       * Every path, and that `cwd`, must be absolute (`codexPath`).
+       *
        * When the roots reach the managed root (D50: an allowed root such as `~`), a file change is
        * also held to the managed `.git` guard Claude sessions get: a change under a managed clone's
        * git dir, or to a worktree's `.git` file, is refused with the same text. In `acceptEdits` or
@@ -11733,19 +12101,30 @@ var init_manager = __esm({
             throw new Error("VALIDATION: codex file change carries no changes to check");
           }
           const guarded = this.reachesManagedRoot(roots);
+          const check = (path) => {
+            assertInsideRootsOrAncestor(this.codexPath(cwd, path), roots);
+            if (guarded && writesManagedGit(path, this.deps.managedRoot, cwd)) {
+              throw new Error(MANAGED_GIT_REFUSAL);
+            }
+          };
           for (const change of changes) {
-            if (!isRecord(change) || typeof change.path !== "string" || change.path.trim() === "") {
+            if (!isRecord2(change) || typeof change.path !== "string" || change.path.trim() === "") {
               throw new Error("VALIDATION: codex file change entry names no path to check");
             }
-            assertInsideRootsOrAncestor(this.fromCwd(cwd, change.path), roots);
-            if (guarded && writesManagedGit(change.path, this.deps.managedRoot, cwd)) {
-              throw new Error(MANAGED_GIT_REFUSAL);
+            check(change.path);
+            if (change.movePath === void 0) continue;
+            if (typeof change.movePath !== "string" || change.movePath.trim() === "") {
+              throw new Error("VALIDATION: codex file change entry names no move target to check");
             }
+            check(change.movePath);
           }
           return;
         }
-        if (toolName2 === CODEX_TOOL_NAMES.command && typeof input.cwd === "string") {
-          assertInsideRoots(this.fromCwd(cwd, input.cwd), roots);
+        if (toolName2 === CODEX_TOOL_NAMES.command) {
+          if (typeof input.cwd !== "string" || input.cwd.trim() === "") {
+            throw new Error("VALIDATION: codex command names no cwd to check");
+          }
+          assertInsideRoots(this.codexPath(cwd, input.cwd), roots);
         }
       }
       /**
@@ -11818,7 +12197,7 @@ var init_manager = __esm({
       checkUpdatedPermissions(live, entry, updates) {
         if (!updates) return void 0;
         return updates.map((update) => {
-          if (!isRecord(update))
+          if (!isRecord2(update))
             throw new Error("VALIDATION: updatedPermissions entry is not an object");
           if (update.destination !== "session") {
             throw new Error(
@@ -12004,9 +12383,19 @@ var init_manager = __esm({
           status: "starting",
           echoed: /* @__PURE__ */ new Set(),
           permissions: /* @__PURE__ */ new Map(),
+          permissionsInFlight: /* @__PURE__ */ new Set(),
+          permissionsWithdrawn: /* @__PURE__ */ new Set(),
           cwd: opts.cwd,
           stopping: false,
-          turns: { owed: 0, begun: false, drainedAt: null, stops: 0, early: false, chased: false },
+          turns: {
+            owed: 0,
+            begun: false,
+            drainedAt: null,
+            stops: 0,
+            early: false,
+            chased: false,
+            ended: 0
+          },
           dropping: null,
           inflight: /* @__PURE__ */ new Set(),
           writes: Promise.resolve(),
@@ -12089,7 +12478,7 @@ var init_manager = __esm({
        */
       watchWorkingCopy(sessionId, live) {
         const factory = this.deps.watch ?? ((cwd, onChange2, onError2) => watchChanges(cwd, onChange2, CHANGES_DEBOUNCE_MS, onError2));
-        let failed4 = false;
+        let failed5 = false;
         let built = null;
         const closeFailed = (watcher) => {
           if (live.watcher === watcher) live.watcher = null;
@@ -12098,8 +12487,8 @@ var init_manager = __esm({
           );
         };
         const onError = (err) => {
-          if (failed4) return;
-          failed4 = true;
+          if (failed5) return;
+          failed5 = true;
           this.deps.log.warn(
             { err, sessionId },
             "working-copy watcher error; live change refresh stopped"
@@ -12107,7 +12496,7 @@ var init_manager = __esm({
           if (built) closeFailed(built);
         };
         const onChange = () => {
-          if (failed4 || this.live.get(sessionId) !== live) return;
+          if (failed5 || this.live.get(sessionId) !== live) return;
           this.bumpChanges(sessionId, live);
         };
         try {
@@ -12116,7 +12505,7 @@ var init_manager = __esm({
           this.deps.log.warn({ err, sessionId }, "working-copy watcher failed to start");
           return null;
         }
-        if (failed4) {
+        if (failed5) {
           closeFailed(built);
           return null;
         }
@@ -12218,89 +12607,95 @@ var init_manager = __esm({
             );
           })();
         });
+        const raise = async (rawReq) => {
+          const req = { ...rawReq, suggestions: narrowToSession(rawReq.suggestions) };
+          try {
+            this.checkUpdatedInput(live, req.toolName, req.input);
+            this.checkCodexInput(live.cwd, live.roots, req.toolName, req.input);
+          } catch (err) {
+            const message = this.cap(err instanceof Error ? err.message : String(err));
+            session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
+            this.deps.log.warn(
+              { sessionId, tool: req.toolName, err: message },
+              "permission request refused before a row existed"
+            );
+            await this.broadcast(sessionId, { type: "error", code: errorCode(message), message });
+            return;
+          }
+          const input = this.secrets.redact(req.input);
+          const suggestions = this.secrets.redact(req.suggestions);
+          const { data, error } = await this.deps.db.from("permission_requests").insert({
+            session_id: sessionId,
+            workspace_id: this.deps.workspaceId,
+            tool_use_id: req.toolUseId,
+            tool_name: req.toolName,
+            input,
+            suggestions
+          }).select("*").single();
+          if (error || !data) {
+            const message = this.cap(
+              `VALIDATION: could not persist the permission request for ${req.toolName}: ${error?.message ?? "no row"}`
+            );
+            session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
+            await this.broadcast(sessionId, { type: "error", code: "VALIDATION", message });
+            throw new Error(message);
+          }
+          if (live.permissionsWithdrawn.has(req.id)) {
+            await this.expirePermission(sessionId, data.id);
+            return;
+          }
+          live.permissions.set(data.id, {
+            localId: req.id,
+            toolName: req.toolName,
+            input,
+            suggestions
+          });
+          await this.setStatus(sessionId, "awaiting_permission");
+          if (!live.permissions.has(data.id)) return;
+          try {
+            await this.broadcast(sessionId, {
+              type: "permission.request",
+              request: data
+            });
+          } catch (err) {
+            if (!(err instanceof Error) || !err.message.startsWith("VALIDATION:")) throw err;
+            this.deps.log.warn(
+              { sessionId, requestId: data.id, err: err.message },
+              "permission request too large to broadcast; clients reconcile from the row"
+            );
+            await this.broadcast(sessionId, {
+              type: "error",
+              code: "VALIDATION",
+              message: err.message
+            });
+          }
+        };
         session.on(
           "permission",
           (rawReq) => guard(async () => {
-            const req = { ...rawReq, suggestions: narrowToSession(rawReq.suggestions) };
-            try {
-              this.checkUpdatedInput(live, req.toolName, req.input);
-              this.checkCodexInput(live.cwd, live.roots, req.toolName, req.input);
-            } catch (err) {
-              const message = this.cap(err instanceof Error ? err.message : String(err));
-              session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
-              this.deps.log.warn(
-                { sessionId, tool: req.toolName, err: message },
-                "permission request refused before a row existed"
-              );
-              await this.broadcast(sessionId, { type: "error", code: errorCode(message), message });
-              return;
-            }
-            const input = this.secrets.redact(req.input);
-            const suggestions = this.secrets.redact(req.suggestions);
-            const { data, error } = await this.deps.db.from("permission_requests").insert({
-              session_id: sessionId,
-              workspace_id: this.deps.workspaceId,
-              tool_use_id: req.toolUseId,
-              tool_name: req.toolName,
-              input,
-              suggestions
-            }).select("*").single();
-            if (error || !data) {
-              const message = this.cap(
-                `VALIDATION: could not persist the permission request for ${req.toolName}: ${error?.message ?? "no row"}`
-              );
-              session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
-              await this.broadcast(sessionId, { type: "error", code: "VALIDATION", message });
-              throw new Error(message);
-            }
-            live.permissions.set(data.id, {
-              localId: req.id,
-              toolName: req.toolName,
-              input,
-              suggestions
-            });
-            await this.setStatus(sessionId, "awaiting_permission");
+            live.permissionsInFlight.add(rawReq.id);
             try {
-              await this.broadcast(sessionId, {
-                type: "permission.request",
-                request: data
-              });
-            } catch (err) {
-              if (!(err instanceof Error) || !err.message.startsWith("VALIDATION:")) throw err;
-              this.deps.log.warn(
-                { sessionId, requestId: data.id, err: err.message },
-                "permission request too large to broadcast; clients reconcile from the row"
-              );
-              await this.broadcast(sessionId, {
-                type: "error",
-                code: "VALIDATION",
-                message: err.message
-              });
+              await raise(rawReq);
+            } finally {
+              live.permissionsInFlight.delete(rawReq.id);
+              live.permissionsWithdrawn.delete(rawReq.id);
             }
           })()
         );
         session.on(
           "permissionTimeout",
           ({ id }) => guard(async () => {
+            const ended = live.turns.ended;
             const requestId = [...live.permissions.entries()].find(
               ([, entry]) => entry.localId === id
             )?.[0];
-            if (!requestId) return;
-            live.permissions.delete(requestId);
-            const { data, error } = await this.deps.db.from("permission_requests").update({ status: "expired" }).eq("id", requestId).eq("status", "pending").select("id");
-            if (error) {
-              this.deps.log.warn(
-                { requestId, err: error.message },
-                "could not expire permission request"
-              );
-            } else if (data && data.length > 0) {
-              await this.broadcast(sessionId, {
-                type: "permission.resolved",
-                requestId,
-                status: "expired"
-              });
+            if (!requestId) {
+              if (live.permissionsInFlight.has(id)) live.permissionsWithdrawn.add(id);
+              return;
             }
-            if (live.permissions.size === 0 && !live.stopping) {
+            live.permissions.delete(requestId);
+            await this.expirePermission(sessionId, requestId);
+            if (live.permissions.size === 0 && !live.stopping && live.status === "awaiting_permission" && live.turns.ended === ended) {
               await this.setStatus(sessionId, "running");
             }
           })()
@@ -12343,6 +12738,26 @@ var init_manager = __esm({
           })();
         });
       }
+      /**
+       * Expire a request the session settled itself, and say so when this write is what settled the
+       * row. `permissions_expire_by_runner` is the one transition the runner may write. Filtered on
+       * status = 'pending' so an owner answer in the same instant wins: the row is then terminal and
+       * this matches nothing rather than failing. A write that fails is logged, never thrown.
+       */
+      async expirePermission(sessionId, requestId) {
+        const { data, error } = await this.deps.db.from("permission_requests").update({ status: "expired" }).eq("id", requestId).eq("status", "pending").select("id");
+        if (error) {
+          this.deps.log.warn({ requestId, err: error.message }, "could not expire permission request");
+          return;
+        }
+        if (data && data.length > 0) {
+          await this.broadcast(sessionId, {
+            type: "permission.resolved",
+            requestId,
+            status: "expired"
+          });
+        }
+      }
       /**
        * Forget `live` and release its channel — once, and only if it is still the current entry.
        *
@@ -12584,10 +12999,10 @@ var init_manager = __esm({
 });
 
 // src/sessions/repo-sessions.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11 } from "fs";
-import { join as join29 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
+import { join as join30 } from "path";
 function createRepoSessions(dir) {
-  const fileFor = (sessionId) => UUID4.test(sessionId) ? join29(dir, `${sessionId.toLowerCase()}.json`) : null;
+  const fileFor = (sessionId) => UUID4.test(sessionId) ? join30(dir, `${sessionId.toLowerCase()}.json`) : null;
   return {
     mark(sessionId, mark) {
       const file = fileFor(sessionId);
@@ -12607,7 +13022,7 @@ function createRepoSessions(dir) {
       if (file === null) return null;
       let text;
       try {
-        text = readFileSync11(file, "utf8");
+        text = readFileSync12(file, "utf8");
       } catch (err) {
         return isMissing(err) ? null : "unreadable";
       }
@@ -12991,9 +13406,9 @@ function createTerminalChannels({
       const inflight = joining.get(terminalId);
       if (inflight) return inflight;
       if (joined.has(terminalId)) return;
-      const join32 = attachOne(terminalId).finally(() => joining.delete(terminalId));
-      joining.set(terminalId, join32);
-      return join32;
+      const join33 = attachOne(terminalId).finally(() => joining.delete(terminalId));
+      joining.set(terminalId, join33);
+      return join33;
     },
     flush,
     detach,
@@ -13054,9 +13469,9 @@ var init_channels = __esm({
 });
 
 // src/terminal/env.ts
-import { readFileSync as readFileSync12, realpathSync as realpathSync19 } from "fs";
+import { readFileSync as readFileSync13, realpathSync as realpathSync19 } from "fs";
 import { lstat } from "fs/promises";
-import { dirname as dirname10, isAbsolute as isAbsolute22, relative as relative15 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute22, relative as relative15 } from "path";
 function terminalEnv(base, { runnerOwner, claudeConfigDir }) {
   const env = {};
   for (const [key, value] of Object.entries(base)) {
@@ -13115,7 +13530,7 @@ async function rootOwnedPath(fs, real) {
       return false;
     }
     if (st.isSymbolicLink() || st.uid !== 0 || (st.mode & 18) !== 0) return false;
-    const parent = dirname10(path);
+    const parent = dirname11(path);
     if (parent === path) return true;
     path = parent;
   }
@@ -13154,7 +13569,7 @@ var init_env2 = __esm({
     nodeShellFs = {
       readEtcShells: () => {
         try {
-          return readFileSync12("/etc/shells", "utf8");
+          return readFileSync13("/etc/shells", "utf8");
         } catch {
           return "";
         }
@@ -14200,7 +14615,7 @@ __export(start_exports, {
   start: () => start
 });
 import { homedir as homedir6, hostname } from "os";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function protectedPaths(claudeConfigDir, home = homedir6()) {
   const inHome = [
     ".claude",
@@ -14208,12 +14623,12 @@ function protectedPaths(claudeConfigDir, home = homedir6()) {
     ".codex",
     ".ssh",
     ".aws",
-    join30(".config", "gh"),
+    join31(".config", "gh"),
     ".gnupg",
     ".git-credentials",
     ".npmrc",
     ".netrc"
-  ].map((p) => join30(home, p));
+  ].map((p) => join31(home, p));
   return [cayenneHome(), ...claudeConfigDir ? [claudeConfigDir] : [], ...inHome];
 }
 function withRepoClone(repoClone) {
@@ -14229,6 +14644,16 @@ function logCodex(codex) {
     `codex available on ${codex.models.map((m) => m.id).join(", ") || "its default model"}`
   );
 }
+function logClaude(claude) {
+  if (!claude.available) {
+    logger.info({ reason: claude.reason }, `claude ${claude.reason ?? "unavailable"}`);
+    return;
+  }
+  logger.info(
+    { version: claude.version, models: claude.models.map((m) => m.id), authMode: claude.authMode },
+    `claude available on ${claude.models.map((m) => m.id).join(", ") || "the curated model list"}`
+  );
+}
 function holdLock(root, record) {
   let held;
   return {
@@ -14321,7 +14746,6 @@ async function compose(cfg, lock, host, preflight) {
     );
   });
   const codexPath = resolveCodexPath(cfg, process.env, () => findCodexOnPath(process.env));
-  const detect = () => detectProviders({ path: codexPath, run: runCodex, listModels: listCodexModels });
   let providers = {
     claude: { available: true, models: [] },
     codex: { available: false, reason: "not_installed", models: [] }
@@ -14329,9 +14753,23 @@ async function compose(cfg, lock, host, preflight) {
   const pty = await loadPty();
   const memberTerminalIds = memberTerminalIdsOf(cfg);
   const kinds2 = handledKinds({ terminal: pty !== null });
-  const runDir = join30(cayenneDir(), "run");
+  const runDir = join31(cayenneDir(), "run");
   prepareRunDir(runDir, { git: findOnPath("git", process.env.PATH) });
   const gitHome = repositoryGitHome(runDir);
+  const claudeProbeEnv = claudeEnv(claudeConfigDir);
+  const detect = () => detectProviders({
+    path: codexPath,
+    run: runCodex,
+    listModels: listCodexModels,
+    claude: () => detectClaude({
+      version: claudeCodeVersion,
+      probe: () => probeClaude({
+        env: claudeProbeEnv,
+        cwd: runDir,
+        settingSources: cfg.loadUserSettings ? ["user"] : []
+      })
+    })
+  });
   for (const path of githubNetrcFiles()) {
     logger.warn(
       { path },
@@ -14411,6 +14849,7 @@ async function compose(cfg, lock, host, preflight) {
   });
   const registered = capabilities();
   let loggedCodex = null;
+  let loggedClaude = null;
   const refresh = async () => {
     providers = await detect();
     const line = JSON.stringify(providers.codex);
@@ -14418,6 +14857,11 @@ async function compose(cfg, lock, host, preflight) {
       loggedCodex = line;
       logCodex(providers.codex);
     }
+    const claudeLine = JSON.stringify(providers.claude);
+    if (claudeLine !== loggedClaude) {
+      loggedClaude = claudeLine;
+      logClaude(providers.claude);
+    }
     return capabilities();
   };
   let identity;
@@ -14478,15 +14922,15 @@ async function compose(cfg, lock, host, preflight) {
     const trustedRoots = trustedRepoRoots(cfg.trustRepoSettings);
     if (!cfg.loadUserSettings) {
       const guards = readUserGuards(sessionClaudeConfigDir(claudeEnv(claudeConfigDir)));
-      const warning = userGuardsWarning(guards, join30(cayenneDir(), "config.json"));
+      const warning = userGuardsWarning(guards, join31(cayenneDir(), "config.json"));
       if (warning) {
         const { settingsFile, preToolUseHooks, denyRules } = guards;
         logger.warn({ settingsFile, preToolUseHooks, denyRules }, warning);
       }
     }
-    const repoSessions = createRepoSessions(join30(cayenneHome(), "repo-sessions"));
-    const worktreeOwners = createWorktreeOwners(join30(cayenneHome(), "worktrees"));
-    const sessionWorktrees = createSessionWorktrees(join30(cayenneHome(), "session-worktrees"));
+    const repoSessions = createRepoSessions(join31(cayenneHome(), "repo-sessions"));
+    const worktreeOwners = createWorktreeOwners(join31(cayenneHome(), "worktrees"));
+    const sessionWorktrees = createSessionWorktrees(join31(cayenneHome(), "session-worktrees"));
     const git = createGitOps({
       protectedPaths: protectedPaths(claudeConfigDir),
       home: homedir6(),
@@ -14514,7 +14958,7 @@ async function compose(cfg, lock, host, preflight) {
       worktreeOwners,
       sessionWorktrees,
       // And which sessions were started from a task, so their secret-file guard outlives a restart.
-      taskSessions: createTaskSessions(join30(cayenneHome(), "task-sessions")),
+      taskSessions: createTaskSessions(join31(cayenneHome(), "task-sessions")),
       // The paths no `git.diff` returns are paths no task session reads (protocol §2.8).
       protectedPaths: protectedPaths(claudeConfigDir),
       // D50: where repository chats run, which of them are, and their credentials' run dir. A
@@ -14873,9 +15317,10 @@ var init_start = __esm({
   "src/start.ts"() {
     "use strict";
     init_src();
+    init_detect();
     init_claude_dir();
     init_cloud();
-    init_detect();
+    init_detect2();
     init_dispatcher();
     init_source();
     init_config();
@@ -14918,9 +15363,9 @@ var init_start = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync13, realpathSync as realpathSync20, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync14, realpathSync as realpathSync20, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir7, hostname as hostname2, userInfo } from "os";
-import { dirname as dirname11, join as join31 } from "path";
+import { dirname as dirname12, join as join32 } from "path";
 import { Command } from "commander";
 import prompts from "prompts";
 
@@ -15418,14 +15863,14 @@ var configForWrite = () => {
   });
   return cfg;
 };
-var WEB_URL = "https://cayenne-pink.vercel.app";
+var WEB_URL = "https://app.cayenne.sh";
 var PKG = "@jpcasabiancai/cayenne";
 var service = () => {
   const exec4 = nodeExec();
   return { exec: exec4, launchd: makeLaunchd(exec4, userInfo().uid), label: plistLabel(currentProfile()) };
 };
 var writePlistFile = (path, xml2) => {
-  mkdirSync10(dirname11(path), { recursive: true });
+  mkdirSync10(dirname12(path), { recursive: true });
   writeFileSync7(path, xml2, { mode: 420 });
 };
 var requireMac = () => {
@@ -15574,7 +16019,7 @@ program.command("doctor").description("Check the install and say how to fix what
   if (checks.some((c) => !c.ok)) process.exitCode = 1;
 });
 program.command("logs").description("Show the service log").option("-f, --follow", "keep streaming").action(async (opts) => {
-  const file = join31(cayenneDir(), "logs", "runner.log");
+  const file = join32(cayenneDir(), "logs", "runner.log");
   if (!existsSync7(file)) throw new Error(`no log yet at ${file}. Run \`cayenne up\` first.`);
   const print = (chunk) => {
     for (const line of chunk.split("\n")) {
@@ -15587,12 +16032,12 @@ program.command("logs").description("Show the service log").option("-f, --follow
       }
     }
   };
-  print(readFileSync13(file, "utf8"));
+  print(readFileSync14(file, "utf8"));
   if (opts.follow) {
     const { watch: watch2 } = await import("fs");
-    let size = readFileSync13(file).length;
+    let size = readFileSync14(file).length;
     watch2(file, () => {
-      const buf = readFileSync13(file);
+      const buf = readFileSync14(file);
       if (buf.length > size) print(buf.subarray(size).toString("utf8"));
       size = buf.length;
     });
@@ -15620,7 +16065,7 @@ program.command("update").description("Re-pin the installed app and restart the
       cliPath: record.cliPath,
       profile: currentProfile(),
       pathEnv: record.pathEnv,
-      logDir: join31(dir, "logs")
+      logDir: join32(dir, "logs")
     })
   );
   await launchd.bootout(label);
@@ -15641,7 +16086,7 @@ program.command("uninstall").description("Stop the service and remove the launch
   if (dir === "/" || dir === home || home.startsWith(`${dir}/`)) {
     throw new Error(`refusing to purge ${dir}: it is the home directory or an ancestor of it`);
   }
-  if (!existsSync7(join31(dir, "config.json")) && !existsSync7(join31(dir, "app", "install.json"))) {
+  if (!existsSync7(join32(dir, "config.json")) && !existsSync7(join32(dir, "app", "install.json"))) {
     throw new Error(`refusing to purge ${dir}: it does not look like a Cayenne profile`);
   }
   if (!opts.yes) {