@lesscap/baton-cli 0.8.3 → 0.8.4

package/dist/baton.mjs

@@ -2281,7 +2281,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash } = __require("crypto");
+    var { randomBytes, createHash: createHash2 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2949,7 +2949,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3230,7 +3230,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._final(callback);
           });
           return;
@@ -3251,7 +3251,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -3318,7 +3318,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash } = __require("crypto");
+    var { createHash: createHash2 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3625,7 +3625,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -5370,11 +5370,13 @@ var contentTypeForPath = (path) => src_default.getType(path) ?? "application/oct
 // src/output.ts
 var toJson = (data) => JSON.stringify(data, null, 2);
 var fmtWorkspace = (w) => `${w.id}  ${w.name}`;
+var fmtWorkerTemplate = (t) => `${t.id}  ${t.name}  [${t.available ? "available" : "unavailable"}]  ${t.agentKinds.join(", ")}`;
+var fmtWorkerCreation = (c) => `${c.id}  [${c.status}/${c.step ?? "pending"}]  ${c.name}  ${c.agentKind}${c.workerId === null ? "" : `  W-${c.workerId}`}${c.error ? `  ${c.error}` : ""}`;
 var fmtProject = (p) => `${p.id}  ${p.name}`;
 var fmtRequirement = (r) => `${r.code}  [${r.status}]  ${r.title}`;
 var fmtTask = (t) => `${t.code}  [${t.status}]  ${t.title}`;
 var fmtComment = (c) => `${c.workerId !== void 0 ? `worker#${c.workerId}` : "you"}  ${c.body}`;
-var fmtSession = (s) => `${s.id}  ${s.name}  ${s.attached ? "[active]" : "[inactive]"}  ${s.worktreePath ?? "(pending)"}`;
+var fmtSession = (s) => `${s.id}  ${s.name}  ${s.attached ? "[active]" : "[inactive]"}  ${s.cwd ?? "(pending)"}`;
 var fmtWorker = (w) => {
   const offline = w.connected === false ? "  [offline]" : "";
   return `W-${w.id}  ${w.name}  ${w.hostname}  ${w.agentKind}${offline}`;
@@ -5550,7 +5552,7 @@ var servicesClient = (baseUrl) => {
 };
 
 // src/client/retry.ts
-var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var sleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var withRetry = async (fn, opts = {}) => {
   const tries = Math.max(1, opts.tries ?? 4);
   const baseMs = opts.baseMs ?? 300;
@@ -5685,6 +5687,14 @@ var taskClient = (baseUrl) => {
   };
 };
 
+// src/client/worker-creations.ts
+var workerCreationsClient = (baseUrl) => ({
+  templates: (projectId) => request(`${baseUrl}/projects/${projectId}/worker-templates`, { method: "GET" }),
+  create: (projectId, input) => request(`${baseUrl}/projects/${projectId}/worker-creations`, { method: "POST", body: input }),
+  listByProject: (projectId) => request(`${baseUrl}/projects/${projectId}/worker-creations`, { method: "GET" }),
+  get: (id) => request(`${baseUrl}/worker-creations/${id}`, { method: "GET" })
+});
+
 // src/client/workers.ts
 var workersClient = (baseUrl) => {
   const u = (p) => `${baseUrl}${p}`;
@@ -5725,6 +5735,7 @@ var createClient = (baseUrl, opts) => {
   return clientFromBase(baseUrl);
 };
 var clientFromBase = (baseUrl) => ({
+  workerCreations: workerCreationsClient(baseUrl),
   artifacts: artifactsClient(baseUrl),
   workspaces: workspaceClient(baseUrl),
   projects: projectClient(baseUrl),
@@ -5783,7 +5794,6 @@ var viewWorker = (cfg) => {
   return {
     server,
     projectId: project2,
-    baseBranch: cfg.baseBranch,
     workerId: worker2.id,
     agentKind: worker2.agentKind ?? "claude-code",
     name: worker2.name,
@@ -5791,29 +5801,40 @@ var viewWorker = (cfg) => {
     apiToken: worker2.apiToken
   };
 };
-var worktreeConfig = (cfg, session2) => ({
+var workerProjectConfig = (cfg) => ({
   server: cfg.server,
   project: cfg.projectId,
-  baseBranch: cfg.baseBranch,
   worker: {
     id: cfg.workerId,
     name: cfg.name,
     agentKind: cfg.agentKind,
     machineId: cfg.machineId,
     apiToken: cfg.apiToken
-  },
-  ...session2 === void 0 ? {} : { session: session2 }
+  }
+});
+var workerEnv = (cfg) => ({
+  ...Object.fromEntries(
+    Object.entries(process.env).filter(
+      (entry) => entry[1] !== void 0
+    )
+  ),
+  BATON_SERVER: cfg.server,
+  BATON_PROJECT_ID: String(cfg.projectId),
+  BATON_WORKER_ID: String(cfg.workerId),
+  BATON_WORKER_TOKEN: cfg.apiToken
 });
 
 // src/config.ts
 var resolveBaseUrl = (urlArg, env = process.env) => {
   if (urlArg) return urlArg;
+  if (env.BATON_SERVER) return env.BATON_SERVER;
   const cfg = loadProjectConfigOrNull(projectConfigPath());
   if (cfg?.server) return cfg.server;
   return env.BATON_URL ?? "http://localhost:3280";
 };
 var resolveBaseUrlOrNull = (urlArg, env = process.env) => {
   if (urlArg) return urlArg;
+  if (env.BATON_SERVER) return env.BATON_SERVER;
   const cfg = loadProjectConfigOrNull(projectConfigPath());
   if (cfg?.server) return cfg.server;
   return env.BATON_URL ?? null;
@@ -5823,7 +5844,7 @@ var resolveBaseUrlOrNull = (urlArg, env = process.env) => {
 var common = {
   url: {
     type: "string",
-    description: "baton server url (--url > .baton.json > BATON_URL > http://localhost:3280)"
+    description: "baton server url (--url > BATON_SERVER > .baton.json > BATON_URL > http://localhost:3280)"
   },
   json: { type: "boolean", description: "output JSON" }
 };
@@ -5846,6 +5867,8 @@ var resolveBearer = () => {
 };
 var resolveProjectId = (args) => {
   if (args.project !== void 0 && args.project !== "") return Number(args.project);
+  if (process.env.BATON_PROJECT_ID !== void 0)
+    return contextId(process.env.BATON_PROJECT_ID, "BATON_PROJECT_ID");
   const cfg = loadProjectConfigOrNull(projectConfigPath());
   if (cfg?.project !== void 0) return cfg.project;
   throw new Error("no project in scope. pass --project <id> or run `baton init` in this directory.");
@@ -5870,6 +5893,18 @@ var parseDuration = (s) => {
   const mult = m[2] === "d" ? 86400 : m[2] === "h" ? 3600 : m[2] === "m" ? 60 : 1;
   return n * mult;
 };
+var contextId = (value, source) => {
+  const id = Number(value);
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error(`invalid ${source}`);
+  return id;
+};
+var resolveWorkerId = () => {
+  if (process.env.BATON_WORKER_ID !== void 0)
+    return contextId(process.env.BATON_WORKER_ID, "BATON_WORKER_ID");
+  const id = loadProjectConfigOrNull(projectConfigPath())?.worker?.id;
+  if (id === void 0) throw new Error("no worker in scope");
+  return id;
+};
 
 // src/commands/artifact.ts
 var formatArtifact = (artifact2) => `${artifact2.id}  ${artifact2.size} B  ${artifact2.filename}  ${artifact2.url}`;
@@ -6227,11 +6262,11 @@ var EventSource = class extends EventTarget {
         return;
       }
       const decoder = new TextDecoder(), reader = body.getReader();
-      let open = true;
+      let open2 = true;
       do {
         const { done, value } = await reader.read();
-        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open = false, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
-      } while (open);
+        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open2 = false, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
+      } while (open2);
     }), __privateAdd(this, _onFetchError, (err) => {
       __privateSet(this, _controller, void 0), !(err.name === "AbortError" || err.type === "aborted") && __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this, flattenError(err));
     }), __privateAdd(this, _onEvent, (event) => {
@@ -6776,10 +6811,10 @@ var runListen = async (o) => {
     onError: (e) => emit({ type: "channel.error", error: describe(e) })
   });
   emit({ type: "channel.listening", channel: o.channel, from: o.from, url: o.url });
-  await new Promise((resolve3) => {
+  await new Promise((resolve4) => {
     const stop = () => {
       close();
-      resolve3();
+      resolve4();
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
@@ -7034,10 +7069,6 @@ var init = defineCommand({
 });
 
 // src/commands/session/shared.ts
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
-var defaultWorktreeDir = (env = process.env) => env.BATON_WORKTREE_DIR ?? join3(env.XDG_DATA_HOME ?? join3(env.HOME ?? homedir(), ".local/share"), "baton", "worktrees");
-var slug = (s) => s.toLowerCase().replace(/[^a-z0-9_-]+/g, "-");
 var resolveSession = async (client, projectId, handle) => {
   const asInt = Number(handle);
   if (Number.isInteger(asInt) && asInt > 0) {
@@ -7264,10 +7295,466 @@ var project = defineCommand({
   }
 });
 
+// src/provisioner/config.ts
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { access, readFile, stat as stat2 } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { promisify } from "node:util";
+var forbiddenEnv = /* @__PURE__ */ new Set([
+  "BATON_PROVISIONER_TOKEN",
+  "BATON_TOKEN",
+  "BATON_WORKER_TOKEN",
+  "BATON_USER",
+  "BATON_PASS",
+  "HOME",
+  "XDG_DATA_HOME"
+]);
+var object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var absolutePath = (value, field) => {
+  if (typeof value !== "string" || !isAbsolute(value) || value.includes("\0"))
+    throw new Error(`${field} must be an absolute path`);
+  return value;
+};
+var commandEnvironment = (config) => ({
+  ...process.env,
+  PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin"
+});
+var loadProvisionerConfig = async (path) => {
+  if (process.platform !== "darwin") throw new Error("provisioner requires macOS");
+  absolutePath(path, "config");
+  if ((await stat2(path)).mode & 63) throw new Error("config must be private: chmod 600 <config>");
+  const text = await readFile(path, "utf8");
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error;
+    throw new Error("invalid provisioner JSON config");
+  }
+  if (!object(raw) || typeof raw.server !== "string" || typeof raw.token !== "string")
+    throw new Error("server and token required");
+  let server;
+  try {
+    server = new URL(raw.server);
+  } catch (error) {
+    if (!(error instanceof TypeError)) throw error;
+    throw new Error("server must be a valid HTTP(S) URL");
+  }
+  if (!["http:", "https:"].includes(server.protocol) || server.username || server.password || server.search || server.hash)
+    throw new Error("server must be an HTTP(S) URL without credentials, query, or fragment");
+  if (!raw.token.trim() || /[\r\n]/.test(raw.token))
+    throw new Error("valid provisioner token required");
+  if (!object(raw.workerEnv)) throw new Error("workerEnv must be an object");
+  const workerEnv2 = Object.fromEntries(
+    Object.entries(raw.workerEnv).map(([key, value]) => {
+      if (forbiddenEnv.has(key) || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof value !== "string" || value.includes("\0"))
+        throw new Error(`invalid worker environment key: ${key}`);
+      return [key, value];
+    })
+  );
+  const config = {
+    server: server.toString().replace(/\/$/, ""),
+    token: raw.token.trim(),
+    projectsRoot: absolutePath(raw.projectsRoot, "projectsRoot"),
+    cliPath: absolutePath(raw.cliPath, "cliPath"),
+    nodePath: absolutePath(raw.nodePath ?? process.execPath, "nodePath"),
+    workerEnv: workerEnv2
+  };
+  await access(config.cliPath, constants.R_OK);
+  await access(config.nodePath ?? process.execPath, constants.X_OK);
+  const env = commandEnvironment(config);
+  await promisify(execFile)("git", ["--version"], { env, timeout: 1e4 });
+  await promisify(execFile)("launchctl", ["help"], { env, timeout: 1e4 });
+  await promisify(execFile)("/usr/bin/plutil", ["-help"], { timeout: 1e4 });
+  return config;
+};
+
+// src/provisioner/client.ts
+var createProvisionerClient = (config) => {
+  const request2 = async (path, token, body, signal) => {
+    const timeout = AbortSignal.timeout(1e4);
+    const response = await fetch(`${config.server}${path}`, {
+      method: body === void 0 ? "GET" : "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new HttpError(response.status, `provisioner request ${path}: HTTP ${response.status}`);
+    }
+    return await response.json();
+  };
+  return {
+    get: (id, signal) => request2(`/provisioner/worker-creations/${id}`, config.token, void 0, signal),
+    report: (id, report, signal) => request2(`/provisioner/worker-creations/${id}/progress`, config.token, report, signal),
+    register: (id, hostname2, signal) => request2(`/provisioner/worker-creations/${id}/worker`, config.token, { hostname: hostname2 }, signal),
+    worker: (id, token, signal) => request2(`/workers/${id}`, token, void 0, signal)
+  };
+};
+
+// src/provisioner/executor.ts
+import { execFile as execFile3 } from "node:child_process";
+import { lstat, mkdir as mkdir2, realpath, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join as join4 } from "node:path";
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+import { promisify as promisify3 } from "node:util";
+
+// src/provisioner/launchd.ts
+import { execFile as execFile2 } from "node:child_process";
+import { mkdir, open } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join as join3 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+var workerStatePath = (config, creation) => join3(
+  config.projectsRoot,
+  ".worker-state",
+  `project-${creation.projectId}`,
+  `creation-${creation.id}`
+);
+var workerLogPath = (creation) => join3(homedir(), "Library/Logs", `baton-worker-creation-${creation.id}.log`);
+var startAgent = async (config, agent, signal) => {
+  signal?.throwIfAborted();
+  const plist = join3(homedir(), "Library/LaunchAgents", `${agent.label}.plist`);
+  await mkdir(dirname(plist), { recursive: true });
+  await mkdir(dirname(agent.log), { recursive: true });
+  const domain = `gui/${process.getuid?.()}`;
+  const env = commandEnvironment(config);
+  try {
+    await promisify2(execFile2)("launchctl", ["print", `${domain}/${agent.label}`], {
+      env,
+      timeout: 1e4,
+      signal
+    });
+    throw new Error(
+      `launchd service already exists: ${agent.label}; stop it manually before installing`
+    );
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === 113 && "stderr" in error && typeof error.stderr === "string" && error.stderr.includes("Could not find service")))
+      throw error;
+  }
+  const handle = await open(plist, "wx", 384);
+  try {
+    const payload = {
+      Label: agent.label,
+      ProgramArguments: agent.args,
+      WorkingDirectory: agent.cwd,
+      EnvironmentVariables: agent.env,
+      RunAtLoad: true,
+      KeepAlive: true,
+      ThrottleInterval: 10,
+      StandardOutPath: agent.log,
+      StandardErrorPath: agent.log
+    };
+    await handle.writeFile(JSON.stringify(payload));
+  } finally {
+    await handle.close();
+  }
+  const log = await open(agent.log, "a", 384);
+  await log.close();
+  try {
+    await promisify2(execFile2)("/usr/bin/plutil", ["-convert", "xml1", plist], {
+      timeout: 1e4,
+      signal
+    });
+    await promisify2(execFile2)("/usr/bin/plutil", ["-lint", plist], { timeout: 1e4, signal });
+    await promisify2(execFile2)("launchctl", ["bootstrap", domain, plist], {
+      env,
+      timeout: 1e4,
+      signal
+    });
+  } catch {
+    throw new Error(`launchd start failed; inspect ${plist} and ${agent.log}`);
+  }
+};
+var launchWorkerAgent = async (config, creation, repoPath, signal) => startAgent(
+  config,
+  {
+    label: `dev.fmap.baton-worker-creation-${creation.id}`,
+    args: [config.nodePath ?? process.execPath, config.cliPath, "worker", "run"],
+    cwd: repoPath,
+    env: {
+      PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin",
+      ...config.workerEnv,
+      HOME: homedir(),
+      XDG_DATA_HOME: workerStatePath(config, creation)
+    },
+    log: workerLogPath(creation)
+  },
+  signal
+);
+var installProvisionerAgent = async (config, configPath) => startAgent(config, {
+  label: "dev.fmap.baton-provisioner",
+  args: [
+    config.nodePath ?? process.execPath,
+    config.cliPath,
+    "provisioner",
+    "run",
+    "--config",
+    configPath
+  ],
+  cwd: dirname(configPath),
+  env: { HOME: homedir(), PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin" },
+  log: join3(homedir(), "Library/Logs/baton-provisioner.log")
+});
+
+// src/provisioner/executor.ts
+var directory = async (path) => {
+  try {
+    await mkdir2(path, { mode: 448 });
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+  }
+  const info = await lstat(path);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe directory: ${path}`);
+};
+var provisionWorker = async (config, creation, client, signal) => {
+  const repoPath = join4(
+    config.projectsRoot,
+    `project-${creation.projectId}`,
+    `creation-${creation.id}`
+  );
+  const progress = (step) => client.report(creation.id, { status: "running", step, repoPath }, signal);
+  await progress("directory");
+  signal.throwIfAborted();
+  await mkdir2(config.projectsRoot, { recursive: true, mode: 448 });
+  const root = await realpath(config.projectsRoot);
+  await directory(join4(root, `project-${creation.projectId}`));
+  await mkdir2(join4(root, `project-${creation.projectId}`, `creation-${creation.id}`), {
+    mode: 448
+  });
+  await progress("git");
+  const git = async (args) => {
+    try {
+      await promisify3(execFile3)("git", ["-C", repoPath, ...args], {
+        env: commandEnvironment(config),
+        signal,
+        timeout: 1e4
+      });
+    } catch (error) {
+      signal.throwIfAborted();
+      throw new Error("Git repository initialization failed", { cause: error });
+    }
+  };
+  await git(["init", "-b", "main"]);
+  await writeFile(join4(repoPath, ".git/info/exclude"), "\n.baton.json\n", { flag: "a" });
+  await git([
+    "-c",
+    "user.name=Baton",
+    "-c",
+    "user.email=baton@localhost",
+    "commit",
+    "--allow-empty",
+    "-m",
+    "chore: initialize repository"
+  ]);
+  await progress("register");
+  const result = await client.register(creation.id, hostname(), signal);
+  const state = workerStatePath(config, creation);
+  await directory(join4(root, ".worker-state"));
+  await directory(join4(root, ".worker-state", `project-${creation.projectId}`));
+  await mkdir2(state, { mode: 448 });
+  await mkdir2(join4(state, "baton"), { mode: 448 });
+  await writeFile(join4(state, "baton/machine-id"), `${creation.machineId}
+`, {
+    flag: "wx",
+    mode: 384
+  });
+  const cfg = workerProjectConfig({
+    server: config.server,
+    projectId: creation.projectId,
+    workerId: result.worker.id,
+    name: result.worker.name,
+    agentKind: result.worker.agentKind,
+    machineId: result.worker.machineId,
+    apiToken: result.apiToken
+  });
+  await writeFile(join4(repoPath, ".baton.json"), `${JSON.stringify(cfg, null, 2)}
+`, {
+    flag: "wx",
+    mode: 384
+  });
+  await progress("start");
+  signal.throwIfAborted();
+  await launchWorkerAgent(config, creation, repoPath, signal);
+  await progress("connect");
+  const deadline = Date.now() + 6e4;
+  while (Date.now() < deadline) {
+    const worker2 = await client.worker(result.worker.id, result.apiToken, signal);
+    if (worker2.connected) {
+      await client.report(creation.id, { status: "succeeded" }, signal);
+      return;
+    }
+    await setTimeout2(1e3, void 0, { signal });
+  }
+  throw new Error("Worker did not connect within 60 seconds");
+};
+
+// src/provisioner/daemon.ts
+var taskError = (error, config) => {
+  const message = error instanceof Error ? error.message : "unknown creation error";
+  return [config.token, ...Object.values(config.workerEnv)].filter((value) => value.length > 0).reduce((safe, secret) => safe.replaceAll(secret, "[redacted]"), message);
+};
+var processCreation = async (id, config, client, signal) => {
+  let creation;
+  try {
+    creation = await client.get(id, signal);
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404) {
+      console.error(`[provisioner] creation ${id} no longer exists`);
+      return;
+    }
+    throw error;
+  }
+  if (creation.status === "succeeded" || creation.status === "failed") return;
+  if (creation.status === "running") {
+    await client.report(
+      id,
+      {
+        status: "failed",
+        error: "Provisioner interrupted; inspect retained resources before creating again"
+      },
+      signal
+    );
+    return;
+  }
+  try {
+    await provisionWorker(config, creation, client, signal);
+  } catch (error) {
+    if (signal.aborted) {
+      console.error(`[provisioner] creation ${id} interrupted: ${taskError(error, config)}`);
+      return;
+    }
+    if (!(error instanceof HttpError) || ![401, 403].includes(error.status)) {
+      const message = `${taskError(error, config)}; worker log: ${workerLogPath(creation)}`;
+      console.error(`[provisioner] creation ${id}: ${message}`);
+      await client.report(id, { status: "failed", error: message }, signal);
+      return;
+    }
+    throw error;
+  }
+};
+var runProvisioner = async (config, signal) => {
+  const client = createProvisionerClient(config);
+  const abort = new AbortController();
+  const queued = /* @__PURE__ */ new Set();
+  let tail = Promise.resolve();
+  let fatal;
+  let finish = () => {
+  };
+  const ended = new Promise((resolve4) => {
+    finish = resolve4;
+  });
+  const stream = new EventSource(`${config.server}/provisioner/stream`, {
+    fetch: (url, init2) => fetch(url, {
+      ...init2,
+      headers: { ...init2?.headers, authorization: `Bearer ${config.token}` },
+      signal: abort.signal
+    })
+  });
+  const stop = () => {
+    stream.close();
+    abort.abort();
+    finish();
+  };
+  const fail = (error) => {
+    fatal = error;
+    console.error(`[provisioner] ${taskError(error, config)}`);
+    stop();
+  };
+  stream.onmessage = (event) => {
+    try {
+      const message = JSON.parse(event.data);
+      if (!message || !Number.isSafeInteger(message.creationId) || message.creationId <= 0 || !["create", "inspect"].includes(message.action))
+        throw new Error("invalid provisioner signal");
+      if (queued.has(message.creationId)) return;
+      queued.add(message.creationId);
+      tail = tail.then(async () => {
+        try {
+          if (!abort.signal.aborted)
+            await processCreation(message.creationId, config, client, abort.signal);
+        } finally {
+          queued.delete(message.creationId);
+        }
+      }).catch((error) => {
+        if (!abort.signal.aborted) fail(error);
+        else console.error(`[provisioner] stopped: ${taskError(error, config)}`);
+      });
+    } catch (error) {
+      fail(error);
+    }
+  };
+  stream.onerror = (event) => {
+    if (stream.readyState === EventSource.CLOSED || [401, 403, 409].includes(event.code ?? 0))
+      fail(new Error(`provisioner stream rejected: HTTP ${event.code}`));
+    else
+      console.error(`[provisioner] stream disconnected (${event.code ?? "network"}); reconnecting`);
+  };
+  signal.addEventListener("abort", stop, { once: true });
+  if (signal.aborted) stop();
+  console.log("[provisioner] waiting for worker creation requests");
+  try {
+    await ended;
+    await tail;
+  } finally {
+    stop();
+    signal.removeEventListener("abort", stop);
+  }
+  if (fatal !== void 0) throw new Error(taskError(fatal, config));
+};
+
+// src/commands/provisioner.ts
+var configArg = {
+  config: {
+    type: "string",
+    required: true,
+    description: "absolute path to private provisioner JSON config"
+  }
+};
+var provisioner = defineCommand({
+  meta: {
+    name: "provisioner",
+    description: "prepare local repositories and launch workers on macOS"
+  },
+  subCommands: {
+    run: defineCommand({
+      args: configArg,
+      run: async ({ args }) => {
+        const config = await loadProvisionerConfig(args.config);
+        const abort = new AbortController();
+        const stop = () => abort.abort();
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        try {
+          await runProvisioner(config, abort.signal);
+        } finally {
+          process.off("SIGINT", stop);
+          process.off("SIGTERM", stop);
+        }
+      }
+    }),
+    install: defineCommand({
+      args: configArg,
+      run: async ({ args }) => {
+        const config = await loadProvisionerConfig(args.config);
+        await installProvisionerAgent(config, args.config);
+        console.log(
+          "installed dev.fmap.baton-provisioner; inspect ~/Library/Logs/baton-provisioner.log"
+        );
+      }
+    })
+  }
+});
+
 // src/commands/relay.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 
 // src/client/relay.ts
 var relayClient = (baseUrl) => {
@@ -7395,11 +7882,11 @@ var listenCommand2 = defineCommand({
       process.stdout.write(`${JSON.stringify(o)}
 `);
     };
-    const spillDir = join4(tmpdir2(), "hotline", args.channel);
+    const spillDir = join5(tmpdir2(), "hotline", args.channel);
     mkdirSync2(spillDir, { recursive: true });
     const surface = (m) => {
       const text = typeof m.text === "string" ? m.text : "";
-      const file = join4(spillDir, `${m.seq}.txt`);
+      const file = join5(spillDir, `${m.seq}.txt`);
       writeFileSync4(file, text);
       const truncated = text.length > PREVIEW2;
       emit({
@@ -7426,10 +7913,10 @@ var listenCommand2 = defineCommand({
       onError: (e) => emit({ type: "relay.error", error: describe2(e) })
     });
     emit({ type: "relay.listening", channel: args.channel, from: me, url });
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       const stop = () => {
         close();
-        resolve3();
+        resolve4();
       };
       process.on("SIGINT", stop);
       process.on("SIGTERM", stop);
@@ -7553,6 +8040,9 @@ var requirement = defineCommand({
   }
 });
 
+// src/commands/service.ts
+import { resolve as resolve2 } from "node:path";
+
 // src/worker/service-child.ts
 import { spawn } from "node:child_process";
 
@@ -7633,25 +8123,15 @@ var formatUptime = (startedAt, now = Date.now()) => {
   if (seconds >= 60) return `${Math.floor(seconds / 60)}m`;
   return `${seconds}s`;
 };
-var currentContext = () => {
-  const config = loadProjectConfig(projectConfigPath());
-  if (!config.worker || !config.session)
-    throw new Error("service run requires a Baton session worktree");
-  return { workerId: config.worker.id, sessionId: config.session };
-};
-var currentWorker = () => {
-  const worker2 = loadProjectConfig(projectConfigPath()).worker;
-  if (!worker2) throw new Error("no worker in scope");
-  return worker2.id;
-};
 var parseTarget = (target) => {
   const explicit = target.match(/^W-(\d+)\/(.+)$/i);
-  return explicit ? { workerId: Number(explicit[1]), name: explicit[2] ?? "" } : { workerId: currentWorker(), name: target };
+  return explicit ? { workerId: Number(explicit[1]), name: explicit[2] ?? "" } : { workerId: resolveWorkerId(), name: target };
 };
 var runCommand2 = defineCommand({
   meta: { name: "run", description: "run a service on the current worker" },
   args: {
     name: { type: "positional", required: true, description: "service name" },
+    cwd: { type: "string", required: true, description: "service working directory on the Worker" },
     "public-url": { type: "string", description: "public HTTP(S) URL for this service" },
     note: { type: "string", description: "short note describing this service" },
     ...common
@@ -7666,9 +8146,9 @@ var runCommand2 = defineCommand({
       throw new Error("--public-url must be an absolute HTTP(S) URL");
     if (note && !isServiceNote(note))
       throw new Error("service note must be 500 characters or fewer");
-    const context = currentContext();
-    const result = await clientFor(args).services.run(context.workerId, {
-      sessionId: context.sessionId,
+    const workerId = resolveWorkerId();
+    const result = await clientFor(args).services.run(workerId, {
+      cwd: resolve2(args.cwd),
       name: args.name,
       argv,
       ...publicUrl ? { publicUrl } : {},
@@ -7676,7 +8156,7 @@ var runCommand2 = defineCommand({
     });
     if (!result.ok) throw new Error(result.error);
     if (args.json) return console.log(toJson(result));
-    console.log(`running W-${context.workerId}/${args.name}`);
+    console.log(`running W-${workerId}/${args.name}`);
     if (publicUrl) console.log(`public: ${publicUrl}`);
     if (result.logPath) console.log(`logs: ${result.logPath}`);
   }
@@ -7693,7 +8173,7 @@ var lsCommand = defineCommand({
     const workers = await client.workers.listByProject(projectId);
     const names = new Map(workers.map((worker2) => [worker2.id, worker2.name]));
     services.sort((a, b) => a.workerId - b.workerId || a.name.localeCompare(b.name)).map(
-      (item) => `${serviceHandle(item)}  ${names.get(item.workerId) ?? "unknown"}  session=${item.sessionId}  uptime=${formatUptime(item.startedAt)}`
+      (item) => `${serviceHandle(item)}  ${names.get(item.workerId) ?? "unknown"}  cwd=${item.cwd}  uptime=${formatUptime(item.startedAt)}`
     ).forEach((line) => {
       console.log(line);
     });
@@ -7743,7 +8223,7 @@ var sessionAbortCommand = defineCommand({
 var sessionClearCommand = defineCommand({
   meta: {
     name: "clear",
-    description: "reset the conversation context (keeps the session + worktree)"
+    description: "reset the conversation context (keeps the session + directory)"
   },
   args: {
     session: { type: "positional", required: true, description: "session int id or name" },
@@ -7852,7 +8332,7 @@ var sessionResumeCommand = defineCommand({
 
 // src/commands/session/rm.ts
 var sessionRmCommand = defineCommand({
-  meta: { name: "rm", description: "delete a session (irreversible; removes its worktree)" },
+  meta: { name: "rm", description: "delete a session (irreversible; removes its runtime files)" },
   args: {
     session: { type: "positional", required: true, description: "session int id or name" },
     project: { type: "string", description: "project id (overrides .baton.json)" },
@@ -7863,7 +8343,9 @@ var sessionRmCommand = defineCommand({
     const c = clientFor(args);
     const handle = await resolveSession(c, resolveProjectId(args), args.session);
     if (!args.confirm) {
-      console.log(`[dry-run] would delete session ${handle.name} (#${handle.id}) + its worktree`);
+      console.log(
+        `[dry-run] would delete session ${handle.name} (#${handle.id}) + its runtime files`
+      );
       console.log("re-run with --confirm to proceed.");
       return;
     }
@@ -7879,12 +8361,12 @@ import { query } from "@anthropic-ai/claude-agent-sdk";
 // src/session/runner/transcript.ts
 import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var findTranscriptPath = (agentSessionId) => {
-  const root = join5(homedir2(), ".claude", "projects");
+  const root = join6(homedir2(), ".claude", "projects");
   try {
     for (const dir of readdirSync(root)) {
-      const candidate = join5(root, dir, `${agentSessionId}.jsonl`);
+      const candidate = join6(root, dir, `${agentSessionId}.jsonl`);
       try {
         if (statSync(candidate).isFile()) return candidate;
       } catch {
@@ -7962,16 +8444,15 @@ var readFirstExchange = (agentSessionId) => {
 };
 
 // src/session/runner/turn.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { mkdir as mkdir4, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 
 // src/session/runner/attachments.ts
 import { createWriteStream } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { mkdir as mkdir3 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-var ATTACH_DIR = "attachments";
 var dedupe = (name, taken) => {
   if (!taken.has(name)) {
     taken.add(name);
@@ -7991,25 +8472,24 @@ var dedupe = (name, taken) => {
 };
 var materializeAttachments = async (opts) => {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const dir = join6(opts.worktreePath, ATTACH_DIR);
-  await mkdir(dir, { recursive: true });
-  await writeFile(join6(dir, ".gitignore"), "*\n", "utf8");
-  const taken = /* @__PURE__ */ new Set([".gitignore"]);
-  const relPaths = [];
+  const dir = opts.directory;
+  await mkdir3(dir, { recursive: true });
+  const taken = /* @__PURE__ */ new Set();
+  const paths = [];
   for (const att of opts.attachments) {
     const name = dedupe(att.filename, taken);
     const res = await fetchImpl(`${opts.serverBase}${att.url}`);
     if (!res.ok || !res.body) throw new Error(`attachment ${att.id} \u2192 ${res.status}`);
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(join6(dir, name)));
-    relPaths.push(`${ATTACH_DIR}/${name}`);
+    await pipeline(Readable.fromWeb(res.body), createWriteStream(join7(dir, name)));
+    paths.push(join7(dir, name));
   }
-  return relPaths;
+  return paths;
 };
-var augmentPrompt = (text, relPaths, labels) => {
-  if (relPaths.length === 0) return text;
+var augmentPrompt = (text, paths, labels) => {
+  if (paths.length === 0) return text;
   const header = [
-    "[Attached files \u2014 already saved in the working directory. Reference them by label:]",
-    ...relPaths.map((p, i) => `- {${labels[i]}} ${p}`)
+    "[Attached files \u2014 already saved locally. Reference them by label:]",
+    ...paths.map((p, i) => `- {${labels[i]}} ${p}`)
   ].join("\n");
   return text.length > 0 ? `${header}
 
@@ -8017,18 +8497,18 @@ ${text}` : header;
 };
 
 // src/session/runner/codex.ts
+import { join as join8 } from "node:path";
 import { Codex } from "@openai/codex-sdk";
 
 // src/session/runner/sdk-env.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { isAbsolute } from "node:path";
+import { isAbsolute as isAbsolute2 } from "node:path";
 var buildSdkEnv = (overlay) => overlay ? { ...process.env, ...overlay } : void 0;
 var claudeExecutable = () => process.env.BATON_CLAUDE_BIN;
-var additionalDirs = () => {
+var additionalDirs = (required = []) => {
   const raw = process.env.BATON_ADD_DIRS;
-  if (!raw) return void 0;
-  const dirs = raw.split(":").map((s) => s.trim()).filter((s) => s !== "" && isAbsolute(s) && existsSync3(s));
-  return dirs.length > 0 ? dirs : void 0;
+  const dirs = [...required, ...(raw ?? "").split(":")].map((s) => s.trim()).filter((s) => s !== "" && isAbsolute2(s) && existsSync3(s));
+  return dirs.length > 0 ? [...new Set(dirs)] : void 0;
 };
 var truthy = (value) => {
   if (value === void 0) return void 0;
@@ -8188,7 +8668,7 @@ async function* startCodexEvents(config, input, worker2, opts) {
   const env = compactEnv(buildSdkEnv(opts.envOverlay));
   const codex = new Codex(env ? { env } : void 0);
   const resuming = !config.agentSessionId.startsWith("pending:");
-  const addDirs = additionalDirs();
+  const addDirs = additionalDirs([join8(config.runtimeDir, "attachments")]);
   const sandboxMode = codexSandboxMode(opts.planMode ?? false);
   const approvalPolicy = codexApprovalPolicy();
   const networkAccessEnabled = codexNetworkAccess();
@@ -8199,7 +8679,7 @@ async function* startCodexEvents(config, input, worker2, opts) {
   if (opts.model) opts.log(`[model] ${opts.model}`);
   if (reasoningEffort) opts.log(`[effort] ${reasoningEffort}`);
   const threadOptions = {
-    workingDirectory: config.worktreePath,
+    workingDirectory: config.cwd,
     skipGitRepoCheck: true,
     sandboxMode,
     approvalPolicy,
@@ -8218,8 +8698,7 @@ async function* startCodexEvents(config, input, worker2, opts) {
     if (event.type === "thread.started" && !resuming && event.sessionId) {
       config.agentSessionId = event.sessionId;
       await worker2.materialize({
-        agentSessionId: event.sessionId,
-        worktreePath: config.worktreePath
+        agentSessionId: event.sessionId
       });
       opts.log(`[codex] thread ${event.sessionId}`);
     }
@@ -8228,17 +8707,18 @@ async function* startCodexEvents(config, input, worker2, opts) {
 }
 
 // src/session/runner/query.ts
+import { join as join9 } from "node:path";
 var startQuery = (config, text, resuming, queryFn, abortController, log, { envOverlay, planMode = false, model, effort } = {}) => {
   const env = buildSdkEnv(envOverlay);
   const exe = claudeExecutable();
-  const addDirs = additionalDirs();
+  const addDirs = additionalDirs([join9(config.runtimeDir, "attachments")]);
   const level = claudeEffort(effort);
   if (addDirs) log(`[add-dir] ${addDirs.join(", ")}`);
   if (planMode) log("[plan] read-only planning turn");
   if (model) log(`[model] ${model}`);
   if (level) log(`[effort] ${level}`);
   const options = {
-    cwd: config.worktreePath,
+    cwd: config.cwd,
     permissionMode: planMode ? "plan" : "bypassPermissions",
     // Headless relay: no TTY/TUI can answer an interactive ask, so AskUserQuestion
     // would fail the whole turn. Block it — the model asks in plain text instead,
@@ -8482,15 +8962,19 @@ var UnsettledExecution = class extends Error {
 var materializeImages = async (config, execution) => {
   const images = execution.message.payload.images ?? [];
   if (!images.length) return [];
-  const directory = join7(config.worktreePath, "attachments");
-  await mkdir2(directory, { recursive: true });
-  await writeFile2(join7(directory, ".gitignore"), "*\n");
+  const directory2 = join10(
+    config.runtimeDir,
+    "attachments",
+    `message-${execution.message.id}`,
+    "pasted"
+  );
+  await mkdir4(directory2, { recursive: true });
   return Promise.all(
     images.map(async (image, index) => {
       const match = /^data:image\/(png|jpeg|webp|gif);base64,([A-Za-z0-9+/=\r\n]+)$/.exec(image);
       if (!match) throw new Error("unsupported pasted image");
-      const path = `attachments/pasted-${execution.message.id}-${index + 1}.${match[1]}`;
-      await writeFile2(join7(config.worktreePath, path), Buffer.from(match[2] ?? "", "base64"));
+      const path = join10(directory2, `pasted-${index + 1}.${match[1]}`);
+      await writeFile2(path, Buffer.from(match[2] ?? "", "base64"));
       return path;
     })
   );
@@ -8498,7 +8982,12 @@ var materializeImages = async (config, execution) => {
 var buildPrompt = async (config, execution, fetchImpl) => {
   const { text: rawText, attachments = [] } = execution.message.payload;
   const paths = attachments.length ? await materializeAttachments({
-    worktreePath: config.worktreePath,
+    directory: join10(
+      config.runtimeDir,
+      "attachments",
+      `message-${execution.message.id}`,
+      "files"
+    ),
     serverBase: config.server,
     attachments,
     fetchImpl
@@ -8515,7 +9004,7 @@ var buildPrompt = async (config, execution, fetchImpl) => {
   ];
   const images = imagePaths.map((path) => ({
     type: "local_image",
-    path: join7(config.worktreePath, path)
+    path
   }));
   return { text, input: images.length ? [{ type: "text", text }, ...images] : text };
 };
@@ -8632,8 +9121,8 @@ var runDaemon = async (config, deps, signal) => {
   let lastActivity = Date.now();
   let stop = () => {
   };
-  const stopped = new Promise((resolve3) => {
-    stop = resolve3;
+  const stopped = new Promise((resolve4) => {
+    stop = resolve4;
   });
   const drain = async () => {
     if (draining || closed || stranded) return;
@@ -8745,6 +9234,19 @@ var runDaemon = async (config, deps, signal) => {
   }
 };
 
+// src/worker/runtime-paths.ts
+import { createHash } from "node:crypto";
+import { homedir as homedir3 } from "node:os";
+import { join as join11 } from "node:path";
+var workerRuntimeDir = (owner, env = process.env) => join11(
+  env.XDG_DATA_HOME ?? join11(env.HOME ?? homedir3(), ".local/share"),
+  "baton",
+  "runtime",
+  createHash("sha256").update(owner.server).digest("hex"),
+  `worker-${owner.workerId}`
+);
+var sessionRuntimeDir = (owner, sessionId, env = process.env) => join11(workerRuntimeDir(owner, env), "sessions", String(sessionId));
+
 // src/commands/session/run.ts
 var bearerFetch = (token) => (input, init2) => fetch(input, {
   ...init2,
@@ -8774,13 +9276,13 @@ var sessionRunCommand = defineCommand({
   },
   run: async ({ args }) => {
     if (!process.connected) throw new Error("session runner requires supervisor IPC");
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       const onMessage = (message) => {
         if (typeof message !== "object" || message === null || !("type" in message) || message.type !== "execute")
           return;
         process.off("message", onMessage);
         process.off("disconnect", onDisconnect);
-        resolve3();
+        resolve4();
       };
       const onDisconnect = () => {
         process.off("message", onMessage);
@@ -8799,7 +9301,7 @@ var sessionRunCommand = defineCommand({
       throw new Error(`invalid session id: ${args.session}`);
     const client = createClient(server, { bearer: workerToken });
     const s = await client.sessions.get(sessionId);
-    if (!s.agentSessionId || !s.worktreePath)
+    if (!s.agentSessionId || !s.cwd)
       throw new Error(`session #${sessionId} is not materialized yet`);
     const config = {
       server,
@@ -8807,7 +9309,8 @@ var sessionRunCommand = defineCommand({
       name: s.name,
       agentKind: s.agentKind,
       agentSessionId: s.agentSessionId,
-      worktreePath: s.worktreePath
+      cwd: s.cwd,
+      runtimeDir: sessionRuntimeDir({ server, workerId: s.workerId }, sessionId)
     };
     const worker2 = createWorkerClient(server, workerToken, sessionId);
     const ac = new AbortController();
@@ -9100,184 +9603,60 @@ var task = defineCommand({
 // src/commands/worker/index.ts
 import { hostname as osHostname } from "node:os";
 
-// src/session/worktree.ts
-import { execFile, execFileSync, spawnSync } from "node:child_process";
+// src/worker/bundled-skills.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { cpSync, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname3, join as join12 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/worker/git-exclude.ts
+import { spawnSync } from "node:child_process";
 import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "node:fs";
-import { dirname, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
-import { promisify } from "node:util";
-var git = (repo, args) => spawnSync("git", ["-C", repo, ...args], {
-  stdio: "pipe",
-  encoding: "utf8"
-});
-var commandError = (result) => {
-  const raw = result.stderr || result.stdout || result.error?.message || `exit ${result.status}`;
-  return raw.trim().replace(/(https?:\/\/)[^/@\s]+@/g, "$1***@");
-};
-var execFileAsync = promisify(execFile);
-var DEFAULT_SYNC_TIMEOUT_MS = 6e4;
-var asyncCommandError = (error, timeoutMs) => {
-  const failure = error;
-  if (failure.killed || failure.code === "ETIMEDOUT") return `timed out after ${timeoutMs}ms`;
-  const raw = failure.stderr || failure.stdout || failure.message || String(error);
-  return raw.trim().replace(/(https?:\/\/)[^/@\s]+@/g, "$1***@");
-};
-var validateBaseBranch = (branch) => {
-  const normalized = branch.trim();
-  const valid = spawnSync("git", ["check-ref-format", "--branch", normalized], {
-    stdio: "pipe",
-    encoding: "utf8"
-  });
-  if (valid.status !== 0)
-    throw new Error(`invalid base branch "${normalized}": ${commandError(valid)}`);
-  return normalized;
-};
-var createWorktree = (input) => {
-  if (existsSync4(input.worktreePath))
-    throw new Error(`worktree path already exists: ${input.worktreePath}`);
-  const head = spawnSync("git", ["-C", input.repo, "rev-parse", "--verify", "-q", "HEAD"], {
-    stdio: "pipe",
-    encoding: "utf8"
-  });
-  if (head.status !== 0)
-    throw new Error(
-      `repo has no commits (unborn HEAD) \u2014 create an initial commit before starting sessions`
-    );
-  mkdirSync3(dirname(input.worktreePath), { recursive: true });
-  const branch = `baton/${input.sessionCode}`;
-  const r = spawnSync(
-    "git",
-    ["-C", input.repo, "worktree", "add", "-b", branch, input.worktreePath, input.base],
-    { stdio: "pipe", encoding: "utf8" }
-  );
-  if (r.status !== 0) {
-    throw new Error(`git worktree add failed: ${r.stderr || r.stdout || `exit ${r.status}`}`);
-  }
-};
-var repoHeadBranch = (repo) => {
-  const r = git(repo, ["symbolic-ref", "--short", "HEAD"]);
-  const branch = r.status === 0 ? r.stdout.trim() : "";
-  return branch || "main";
-};
-var syncBaseBranch = async (repo, branch, options = {}) => {
-  const checkedBranch = validateBaseBranch(branch);
-  const env = options.env ?? process.env;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_SYNC_TIMEOUT_MS;
-  const origin = git(repo, ["remote", "get-url", "origin"]);
-  if (origin.status !== 0) {
-    const localRef = `refs/heads/${checkedBranch}`;
-    const verified2 = git(repo, ["rev-parse", "--verify", "-q", localRef]);
-    if (verified2.status !== 0) throw new Error(`local base branch does not exist: ${checkedBranch}`);
-    return localRef;
-  }
-  const helper = env.BATON_GIT_SYNC_BIN?.trim();
-  const command = helper ?? "git";
-  const args = helper ? [repo, checkedBranch] : [
-    "-C",
-    repo,
-    "fetch",
-    "--no-tags",
-    "origin",
-    `+refs/heads/${checkedBranch}:refs/remotes/origin/${checkedBranch}`
-  ];
-  let synced;
-  try {
-    synced = await execFileAsync(command, args, {
-      encoding: "utf8",
-      env: { ...env, GIT_TERMINAL_PROMPT: "0" },
-      timeout: timeoutMs
-    });
-  } catch (error) {
-    const via = helper ? ` via ${helper}` : "";
-    throw new Error(
-      `git sync failed for origin/${checkedBranch}${via}: ${asyncCommandError(error, timeoutMs)}`
-    );
-  }
-  const remoteRef = `refs/remotes/origin/${checkedBranch}`;
-  const verified = git(repo, ["rev-parse", "--verify", "-q", remoteRef]);
-  if (verified.status !== 0) throw new Error(`git sync succeeded but ${remoteRef} does not exist`);
-  if (helper) {
-    const reportedCommit = synced.stdout.trim();
-    const actualCommit = verified.stdout.trim();
-    if (!/^[0-9a-f]{40,64}$/i.test(reportedCommit))
-      throw new Error("git sync helper did not report the synced commit on stdout");
-    if (reportedCommit !== actualCommit)
-      throw new Error(`git sync helper reported a commit that does not match ${remoteRef}`);
-  }
-  return remoteRef;
-};
-var ensureExcluded = (repo, pattern) => {
-  try {
-    const r = spawnSync("git", ["-C", repo, "rev-parse", "--git-path", "info/exclude"], {
-      stdio: "pipe",
-      encoding: "utf8"
-    });
-    if (r.status !== 0) return;
-    const rel = r.stdout.trim();
-    const path = isAbsolute2(rel) ? rel : resolve2(repo, rel);
-    const current = existsSync4(path) ? readFileSync5(path, "utf8") : "";
-    if (current.split("\n").includes(pattern)) return;
-    mkdirSync3(dirname(path), { recursive: true });
-    const sep = current === "" || current.endsWith("\n") ? "" : "\n";
-    appendFileSync(path, `${sep}${pattern}
-`, "utf8");
-  } catch {
-  }
-};
-var removeWorktree = (repo, worktreePath) => {
-  if (!existsSync4(worktreePath)) return;
-  try {
-    execFileSync("git", ["-C", repo, "worktree", "remove", "--force", worktreePath], {
-      stdio: "pipe"
-    });
-  } catch {
-  }
-};
-var restoreWorktree = async (repo, worktreePath, sessionCode, baseBranch = repoHeadBranch(repo)) => {
-  spawnSync("git", ["-C", repo, "worktree", "prune"], { stdio: "pipe" });
-  mkdirSync3(dirname(worktreePath), { recursive: true });
-  const branch = `baton/${sessionCode}`;
-  const reuse = spawnSync("git", ["-C", repo, "worktree", "add", worktreePath, branch], {
-    stdio: "pipe",
-    encoding: "utf8"
-  });
-  if (reuse.status === 0) return;
-  createWorktree({
-    repo,
-    worktreePath,
-    sessionCode,
-    base: await syncBaseBranch(repo, baseBranch)
+import { dirname as dirname2, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+var ensureExcluded = (cwd, pattern) => {
+  const result = spawnSync("git", ["-C", cwd, "rev-parse", "--git-path", "info/exclude"], {
+    encoding: "utf8",
+    env: { ...process.env, LC_ALL: "C" }
   });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    if (result.stderr.includes("not a git repository")) return;
+    throw new Error(`cannot locate Git exclude file: ${result.stderr.trim()}`);
+  }
+  const location = result.stdout.trim();
+  const path = isAbsolute3(location) ? location : resolve3(cwd, location);
+  const current = existsSync4(path) ? readFileSync5(path, "utf8") : "";
+  if (current.split("\n").includes(pattern)) return;
+  mkdirSync3(dirname2(path), { recursive: true });
+  appendFileSync(path, `${current && !current.endsWith("\n") ? "\n" : ""}${pattern}
+`);
 };
 
 // src/worker/bundled-skills.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { cpSync, existsSync as existsSync5 } from "node:fs";
-import { dirname as dirname2, join as join8 } from "node:path";
-import { fileURLToPath } from "node:url";
 var SKILL_NAME = "baton-publish-artifact";
 var TARGETS = [`.claude/skills/${SKILL_NAME}`, `.agents/skills/${SKILL_NAME}`];
 var bundledSkillPath = () => {
-  const here = dirname2(fileURLToPath(import.meta.url));
+  const here = dirname3(fileURLToPath(import.meta.url));
   const candidates = [
-    join8(here, "..", "skills", SKILL_NAME),
-    join8(here, "..", "..", "skills", SKILL_NAME)
+    join12(here, "..", "skills", SKILL_NAME),
+    join12(here, "..", "..", "skills", SKILL_NAME)
   ];
   const found = candidates.find(existsSync5);
   if (!found) throw new Error(`bundled skill missing: ${SKILL_NAME}`);
   return found;
 };
-var isTracked = (worktreePath, relativePath) => {
-  const result = spawnSync2("git", ["-C", worktreePath, "ls-files", "--", relativePath], {
+var isTracked = (cwd, relativePath) => {
+  const result = spawnSync2("git", ["-C", cwd, "ls-files", "--", relativePath], {
     encoding: "utf8",
     stdio: "pipe"
   });
   return result.status === 0 && result.stdout.trim().length > 0;
 };
-var syncBundledArtifactSkill = (repo, worktreePath) => {
+var syncBundledArtifactSkill = (cwd) => {
   const source = bundledSkillPath();
-  TARGETS.filter((target) => !isTracked(worktreePath, target)).forEach((target) => {
-    ensureExcluded(repo, `${target}/`);
-    cpSync(source, join8(worktreePath, target), { recursive: true, force: true });
+  TARGETS.filter((target) => !isTracked(cwd, target)).forEach((target) => {
+    ensureExcluded(cwd, `${target}/`);
+    cpSync(source, join12(cwd, target), { recursive: true, force: true });
   });
 };
 
@@ -9339,12 +9718,13 @@ var createLiveness = (deps) => {
 
 // src/worker/service-supervisor.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join10 } from "node:path";
+import { stat as stat3 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 
 // src/worker/service-process.ts
 import { spawn as spawn2 } from "node:child_process";
 import { closeSync, existsSync as existsSync6, openSync } from "node:fs";
-import { dirname as dirname3, join as join9 } from "node:path";
+import { dirname as dirname4, join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var START_TIMEOUT_MS = 1e4;
 var isWrapperMessage = (message) => {
@@ -9354,8 +9734,8 @@ var isWrapperMessage = (message) => {
   return value.type === "error" && typeof value.error === "string";
 };
 var binPath = () => {
-  const here = dirname3(fileURLToPath2(import.meta.url));
-  const devShim = join9(here, "..", "..", "bin", "baton.mjs");
+  const here = dirname4(fileURLToPath2(import.meta.url));
+  const devShim = join13(here, "..", "..", "bin", "baton.mjs");
   return existsSync6(devShim) ? devShim : fileURLToPath2(import.meta.url);
 };
 var startServiceProcess = (input) => {
@@ -9370,7 +9750,7 @@ var startServiceProcess = (input) => {
   } finally {
     closeSync(logFd);
   }
-  const started = new Promise((resolve3, reject) => {
+  const started = new Promise((resolve4, reject) => {
     let settled = false;
     let timer;
     const cleanup = () => {
@@ -9384,7 +9764,7 @@ var startServiceProcess = (input) => {
       settled = true;
       cleanup();
       if (result instanceof Error) reject(result);
-      else resolve3(result);
+      else resolve4(result);
     };
     const onMessage = (message) => {
       if (!isWrapperMessage(message)) return;
@@ -9409,13 +9789,13 @@ var startServiceProcess = (input) => {
 };
 
 // src/worker/service-supervisor.ts
-var waitForExit = (child) => child.exitCode !== null ? Promise.resolve() : new Promise((resolve3) => child.once("exit", () => resolve3()));
+var waitForExit = (child) => child.exitCode !== null ? Promise.resolve() : new Promise((resolve4) => child.once("exit", () => resolve4()));
 var createServiceSupervisor = (deps) => {
-  const { getSession, sendReport, cfg, log } = deps;
+  const { sendReport, cfg, log } = deps;
   const entries = /* @__PURE__ */ new Map();
   let reportQueue = Promise.resolve();
-  const snapshot = () => [...entries.values()].filter((entry) => entry.appPid !== void 0).map(({ sessionId, name, startedAt, publicUrl, note }) => ({
-    sessionId,
+  const snapshot = () => [...entries.values()].filter((entry) => entry.appPid !== void 0).map(({ cwd, name, startedAt, publicUrl, note }) => ({
+    cwd,
     name,
     startedAt,
     ...publicUrl ? { publicUrl } : {},
@@ -9425,15 +9805,13 @@ var createServiceSupervisor = (deps) => {
     const body = { services: snapshot(), ...result ? { result } : {} };
     const request2 = reportQueue.then(() => sendReport(body)).then(() => {
     });
-    reportQueue = request2.catch(() => {
-    });
+    reportQueue = request2.catch((error) => log(`service report failed: ${String(error)}`));
     return request2;
   };
   const remove = (entry) => {
     if (entries.get(entry.name) !== entry) return;
     entries.delete(entry.name);
-    void report().catch(() => {
-    });
+    void report().catch((error) => log(`service removal report failed: ${String(error)}`));
   };
   const stopEntry = (entry) => {
     if (entry.wrapper.connected) {
@@ -9442,7 +9820,18 @@ var createServiceSupervisor = (deps) => {
     }
     if (entry.appPid) killPidGroup(entry.appPid, "SIGKILL");
   };
-  const runOne = async (requestId, sessionId, name, argv, publicUrl, note) => {
+  const runOne = async (requestId, cwd, name, argv, publicUrl, note) => {
+    try {
+      if (!(await stat3(cwd)).isDirectory())
+        return report({ requestId, ok: false, error: `not a directory: ${cwd}`, status: 400 });
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
+      return report({ requestId, ok: false, error: `directory not found: ${cwd}`, status: 400 });
+    }
+    const logDir = join14(workerRuntimeDir(cfg), "services");
+    const logPath = join14(logDir, `${name}.log`);
+    mkdirSync4(logDir, { recursive: true, mode: 448 });
     if (entries.has(name))
       return report({
         requestId,
@@ -9450,21 +9839,10 @@ var createServiceSupervisor = (deps) => {
         error: `service "${name}" is already running`,
         status: 409
       });
-    const session2 = await getSession(sessionId);
-    if (session2.workerId !== cfg.workerId || !session2.worktreePath)
-      return report({
-        requestId,
-        ok: false,
-        error: "session is not materialized on this worker",
-        status: 400
-      });
-    const logDir = join10(session2.worktreePath, ".baton-services");
-    const logPath = join10(logDir, `${name}.log`);
-    mkdirSync4(logDir, { recursive: true });
-    const { wrapper, started } = startServiceProcess({ argv, cwd: session2.worktreePath, logPath });
+    const { wrapper, started } = startServiceProcess({ argv, cwd, logPath });
     const entry = {
       wrapper,
-      sessionId,
+      cwd,
       name,
       startedAt: Date.now(),
       publicUrl,
@@ -9483,19 +9861,20 @@ var createServiceSupervisor = (deps) => {
     }
     const service2 = {
       workerId: cfg.workerId,
-      sessionId,
+      cwd,
       name,
       startedAt: entry.startedAt,
       ...publicUrl ? { publicUrl } : {},
       ...note ? { note } : {}
     };
-    log(`service ${name} started in ${session2.worktreePath}`);
+    log(`service ${name} started in ${cwd}`);
     await report({ requestId, ok: true, service: service2, logPath });
   };
-  const run2 = async (requestId, sessionId, name, argv, publicUrl, note) => {
+  const run2 = async (requestId, cwd, name, argv, publicUrl, note) => {
     try {
-      await runOne(requestId, sessionId, name, argv, publicUrl, note);
+      await runOne(requestId, cwd, name, argv, publicUrl, note);
     } catch (error) {
+      log(`service ${name} failed: ${String(error)}`);
       await report({ requestId, ok: false, error: String(error), status: 500 });
     }
   };
@@ -9508,21 +9887,16 @@ var createServiceSupervisor = (deps) => {
     remove(entry);
     await report({ requestId, ok: true });
   };
-  const stopSession = async (sessionId) => {
-    const matches = [...entries.values()].filter((entry) => entry.sessionId === sessionId);
-    matches.forEach(stopEntry);
-    await Promise.all(matches.map((entry) => waitForExit(entry.wrapper)));
-    matches.forEach(remove);
-  };
   const killAll = () => entries.forEach(stopEntry);
-  return { run: run2, stop, stopSession, report, killAll };
+  return { run: run2, stop, report, killAll };
 };
 
 // src/worker/session-supervisor.ts
 import { spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync7 } from "node:fs";
-import { dirname as dirname4, join as join13 } from "node:path";
+import { mkdir as mkdir5, rm as rm2, stat as stat4 } from "node:fs/promises";
+import { dirname as dirname5, join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 
@@ -9559,7 +9933,7 @@ var buildTitlePrompt = (userText, assistantText) => {
   ].join("\n");
 };
 var generateTitle = async (input) => {
-  const { worktreePath, userText, assistantText, queryFn } = input;
+  const { cwd, userText, assistantText, queryFn } = input;
   if (`${userText}${assistantText}`.trim().length < 4) return { kind: "declined" };
   const exe = claudeExecutable();
   const abort = new AbortController();
@@ -9572,7 +9946,7 @@ var generateTitle = async (input) => {
     const messages = queryFn({
       prompt: buildTitlePrompt(userText, assistantText),
       options: {
-        cwd: worktreePath,
+        cwd,
         // A one-shot summarizer, not an agent: replace the ~18k-token Claude
         // Code preset system prompt. Inside the agent harness the model
         // routinely answers NONE to this ask (verified against reclaude);
@@ -9616,7 +9990,7 @@ var generateTitle = async (input) => {
 // src/session/runner/title-codex.ts
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join15 } from "node:path";
 import { Codex as Codex2 } from "@openai/codex-sdk";
 var generateTitleWithCodex = async (input) => {
   const { userText, assistantText } = input;
@@ -9625,7 +9999,7 @@ var generateTitleWithCodex = async (input) => {
   const timer = setTimeout(() => abort.abort(), TITLE_TIMEOUT_MS);
   let cwd = "";
   try {
-    cwd = await mkdtemp(join11(tmpdir3(), "baton-title-"));
+    cwd = await mkdtemp(join15(tmpdir3(), "baton-title-"));
     const client = input.client ?? new Codex2();
     const thread = client.startThread({
       workingDirectory: cwd,
@@ -9652,18 +10026,18 @@ var generateTitleWithCodex = async (input) => {
 };
 
 // src/worker/session-process.ts
-import { execFile as execFile2 } from "node:child_process";
-import { readFile, rename, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
-import { promisify as promisify2 } from "node:util";
-var run = promisify2(execFile2);
+import { execFile as execFile4 } from "node:child_process";
+import { readFile as readFile2, rename, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join16 } from "node:path";
+import { promisify as promisify4 } from "node:util";
+var run = promisify4(execFile4);
 var RUNNER_RECORD = ".baton-runner.json";
-var recordPath = (worktreePath) => join12(worktreePath, RUNNER_RECORD);
+var recordPath = (cwd) => join16(cwd, RUNNER_RECORD);
 var codeOf = (error) => typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-var readRunnerRecord = async (worktreePath) => {
+var readRunnerRecord = async (cwd) => {
   let raw;
   try {
-    raw = await readFile(recordPath(worktreePath), "utf8");
+    raw = await readFile2(recordPath(cwd), "utf8");
   } catch (error) {
     if (codeOf(error) === "ENOENT") return null;
     throw error;
@@ -9673,8 +10047,8 @@ var readRunnerRecord = async (worktreePath) => {
     throw new Error("invalid session process record");
   return value;
 };
-var writeRunnerRecord = async (worktreePath, record) => {
-  const path = recordPath(worktreePath);
+var writeRunnerRecord = async (cwd, record) => {
+  const path = recordPath(cwd);
   const temporary = `${path}.${record.runnerToken}.tmp`;
   await writeFile3(temporary, JSON.stringify(record), { mode: 384, flag: "wx" });
   await rename(temporary, path);
@@ -9714,37 +10088,23 @@ var stopRecordedRunner = async (record, expected, graceMs = 5e3) => {
   signalGroup(record.pgid, "SIGTERM");
   const deadline = Date.now() + graceMs;
   while (groupExists(record.pgid) && Date.now() < deadline)
-    await new Promise((resolve3) => setTimeout(resolve3, 50));
+    await new Promise((resolve4) => setTimeout(resolve4, 50));
   if (!groupExists(record.pgid)) return;
   signalGroup(record.pgid, "SIGKILL");
   const killDeadline = Date.now() + graceMs;
   while (groupExists(record.pgid) && Date.now() < killDeadline)
-    await new Promise((resolve3) => setTimeout(resolve3, 50));
+    await new Promise((resolve4) => setTimeout(resolve4, 50));
   if (groupExists(record.pgid)) throw new Error("session process group has not exited");
 };
 
 // src/worker/session-supervisor.ts
 var binPath2 = () => {
-  const here = dirname4(fileURLToPath3(import.meta.url));
-  const devShim = join13(here, "..", "..", "bin", "baton.mjs");
+  const here = dirname5(fileURLToPath3(import.meta.url));
+  const devShim = join17(here, "..", "..", "bin", "baton.mjs");
   return existsSync7(devShim) ? devShim : fileURLToPath3(import.meta.url);
 };
 var createSessionSupervisor = (deps) => {
-  const { client, cfg, repo, log, hasTerminal, closeTerminal } = deps;
-  const worktreeDir = defaultWorktreeDir();
-  const baseBranch = cfg.baseBranch ?? repoHeadBranch(repo);
-  const syncBase = deps.syncBase ?? syncBaseBranch;
-  let syncInFlight = null;
-  const syncedBase = () => {
-    if (syncInFlight) return syncInFlight;
-    const pending = syncBase(repo, baseBranch);
-    syncInFlight = pending;
-    const clear = () => {
-      if (syncInFlight === pending) syncInFlight = null;
-    };
-    void pending.then(clear, clear);
-    return pending;
-  };
+  const { client, cfg, cwd, log, hasTerminal, closeTerminal } = deps;
   const children = /* @__PURE__ */ new Map();
   const lifecycle = /* @__PURE__ */ new Map();
   const enqueue = (id, action) => {
@@ -9763,8 +10123,8 @@ var createSessionSupervisor = (deps) => {
   const cancelStart = (sessionId) => {
     startEpochs.set(sessionId, currentStartEpoch(sessionId) + 1);
   };
-  const stopRecord = async (sessionId, worktreePath, token) => {
-    const record = await readRunnerRecord(worktreePath);
+  const stopRecord = async (sessionId, token) => {
+    const record = await readRunnerRecord(sessionRuntimeDir(cfg, sessionId));
     if (!record) {
       if (token) throw new Error("missing record for an unfinished execution");
       return;
@@ -9773,9 +10133,9 @@ var createSessionSupervisor = (deps) => {
       throw new Error("runner identity does not match the attempt");
     await stopRecordedRunner(record, { server: cfg.server, workerId: cfg.workerId, sessionId });
   };
-  const spawnChild = async (sessionId, worktreePath, wasCanceled) => {
+  const spawnChild = async (sessionId, cwd2, wasCanceled) => {
     if (children.has(sessionId)) return;
-    await stopRecord(sessionId, worktreePath);
+    await stopRecord(sessionId);
     const runnerToken = randomUUID2();
     const child = spawn3(
       process.execPath,
@@ -9783,16 +10143,17 @@ var createSessionSupervisor = (deps) => {
       {
         detached: true,
         stdio: ["inherit", "inherit", "inherit", "ipc"],
-        env: { ...process.env, BATON_SERVER: cfg.server, BATON_WORKER_TOKEN: cfg.apiToken }
+        cwd: cwd2,
+        env: workerEnv(cfg)
       }
     );
-    const entry = { child, worktreePath };
+    const entry = { child };
     children.set(sessionId, entry);
     let readyTimer;
-    const ready = new Promise((resolve3, reject) => {
+    const ready = new Promise((resolve4, reject) => {
       child.on("message", (message) => {
         if (typeof message === "object" && message !== null && "type" in message && message.type === "ready")
-          resolve3();
+          resolve4();
       });
       child.once("error", reject);
       child.once("exit", () => reject(new Error("session child exited before ready")));
@@ -9812,8 +10173,8 @@ var createSessionSupervisor = (deps) => {
         void stop(sessionId).catch((error) => log(`stuck execution cleanup failed: ${String(error)}`));
     });
     try {
-      await new Promise((resolve3, reject) => {
-        child.once("spawn", resolve3);
+      await new Promise((resolve4, reject) => {
+        child.once("spawn", resolve4);
         child.once("error", reject);
       });
       if (!child.pid) throw new Error("session child has no PID");
@@ -9825,11 +10186,11 @@ var createSessionSupervisor = (deps) => {
         pid: child.pid,
         pgid: child.pid
       };
-      await writeRunnerRecord(worktreePath, record);
+      await writeRunnerRecord(sessionRuntimeDir(cfg, sessionId), record);
       await readiness;
       if (wasCanceled()) return;
       await new Promise(
-        (resolve3, reject) => child.send({ type: "execute" }, (error) => error ? reject(error) : resolve3())
+        (resolve4, reject) => child.send({ type: "execute" }, (error) => error ? reject(error) : resolve4())
       );
     } catch (error) {
       killProcessGroup(child);
@@ -9847,37 +10208,20 @@ var createSessionSupervisor = (deps) => {
     if (execution.paused || execution.contextResetRequested || execution.attempt?.status === "running" || execution.attempt?.status === "stopping")
       return;
     if (wasCanceled()) return log(`session #${sessionId} start canceled before materializing`);
-    let worktreePath = session2.worktreePath;
-    if (!session2.agentSessionId || !worktreePath) {
-      const sessionCode = randomUUID2();
-      const agentSessionId = session2.agentKind === "codex" ? `pending:${sessionCode}` : sessionCode;
-      worktreePath = join13(worktreeDir, slug(`${name}-${sessionCode.slice(0, 8)}`));
-      const base = await syncedBase();
-      if (wasCanceled()) return log(`session #${sessionId} start canceled during git sync`);
-      createWorktree({
-        repo,
-        worktreePath,
-        sessionCode: sessionCode.slice(0, 8),
-        base
-      });
-      await client.sessions.materialize(sessionId, { agentSessionId, worktreePath }, cfg.apiToken);
-      if (wasCanceled()) return log(`session #${sessionId} start canceled after materializing`);
-      log(`materialized session #${sessionId} \u2192 ${worktreePath}`);
-    } else if (!existsSync7(worktreePath)) {
-      await restoreWorktree(repo, worktreePath, session2.agentSessionId.slice(0, 8), baseBranch);
-      if (wasCanceled()) return log(`session #${sessionId} start canceled during worktree restore`);
-      log(`recreated session #${sessionId} worktree (was missing) \u2192 ${worktreePath}`);
-    }
-    ensureExcluded(repo, PROJECT_CONFIG_NAME);
-    ensureExcluded(repo, ".baton-services/");
-    ensureExcluded(repo, RUNNER_RECORD);
-    ensureExcluded(repo, ".baton-runner.json.*.tmp");
-    saveProjectConfig(join13(worktreePath, PROJECT_CONFIG_NAME), worktreeConfig(cfg, sessionId));
-    syncBundledArtifactSkill(repo, worktreePath);
+    const directory2 = session2.cwd ?? cwd;
+    if (!(await stat4(directory2)).isDirectory()) throw new Error(`not a directory: ${directory2}`);
+    if (wasCanceled()) return;
+    if (!session2.agentSessionId || !session2.cwd) {
+      const id = randomUUID2();
+      const agentSessionId = session2.agentKind === "codex" ? `pending:${id}` : id;
+      await client.sessions.materialize(sessionId, { agentSessionId, cwd: directory2 }, cfg.apiToken);
+      log(`materialized session #${sessionId} (${name}) \u2192 ${directory2}`);
+    }
+    await mkdir5(sessionRuntimeDir(cfg, sessionId), { recursive: true, mode: 448 });
     if (hasTerminal(sessionId))
       return log(`session #${sessionId} terminal opened mid-start \u2014 skipping headless start`);
     if (wasCanceled()) return;
-    await spawnChild(sessionId, worktreePath, wasCanceled);
+    await spawnChild(sessionId, directory2, wasCanceled);
   };
   const start = (sessionId, name) => {
     const epoch = currentStartEpoch(sessionId);
@@ -9895,25 +10239,21 @@ var createSessionSupervisor = (deps) => {
     cancelStart(sessionId);
     return enqueue(sessionId, async () => {
       const entry = children.get(sessionId);
-      const session2 = await client.sessions.get(sessionId);
-      if (session2.worktreePath) await stopRecord(sessionId, session2.worktreePath);
+      await stopRecord(sessionId);
       if (entry && children.get(sessionId) === entry) children.delete(sessionId);
     });
   };
-  const remove = (sessionId, worktreePath) => {
+  const remove = (sessionId) => {
     cancelStart(sessionId);
     closeTerminal(sessionId);
     return enqueue(sessionId, async () => {
       const entry = children.get(sessionId);
-      const path = entry?.worktreePath ?? worktreePath;
-      if (path) {
-        await stopRecord(sessionId, path);
-        removeWorktree(repo, path);
-      }
+      await stopRecord(sessionId);
+      await rm2(sessionRuntimeDir(cfg, sessionId), { recursive: true, force: true });
       if (children.get(sessionId) === entry) children.delete(sessionId);
     });
   };
-  const title = async (sessionId, agentSessionId, worktreePath) => {
+  const title = async (sessionId, agentSessionId, cwd2) => {
     const session2 = await client.sessions.get(sessionId);
     const events = await client.sessions.listEvents(sessionId);
     const exchange = parseFirstExchangeFromEvents(events) ?? (session2.agentKind === "claude-code" ? readFirstExchange(agentSessionId) : null);
@@ -9922,7 +10262,7 @@ var createSessionSupervisor = (deps) => {
       userText: exchange.userText,
       assistantText: exchange.assistantText
     }) : await generateTitle({
-      worktreePath,
+      cwd: cwd2,
       userText: exchange.userText,
       assistantText: exchange.assistantText,
       queryFn: query2
@@ -9942,10 +10282,10 @@ var createSessionSupervisor = (deps) => {
         const session2 = await client.sessions.get(candidate.id);
         let execution = await client.sessions.execution(session2.id);
         if (execution.attempt?.status === "stopping") {
-          if (!session2.worktreePath) throw new Error("unfinished execution without worktree");
+          if (!session2.cwd) throw new Error("unfinished execution without cwd");
           if (children.has(session2.id) && Date.now() - (execution.attempt.stopRequestedAt ?? 0) < 1e4)
             return;
-          await stopRecord(session2.id, session2.worktreePath, execution.attempt.runnerToken);
+          await stopRecord(session2.id, execution.attempt.runnerToken);
           children.delete(session2.id);
           await client.sessions.stopped(
             session2.id,
@@ -9955,12 +10295,12 @@ var createSessionSupervisor = (deps) => {
           execution = await client.sessions.execution(session2.id);
         }
         if (execution.paused) {
-          if (session2.worktreePath) await stopRecord(session2.id, session2.worktreePath);
+          if (session2.cwd) await stopRecord(session2.id);
           return;
         }
         if (execution.attempt?.status === "running") {
-          if (!children.has(session2.id) && session2.worktreePath)
-            await stopRecord(session2.id, session2.worktreePath, execution.attempt.runnerToken);
+          if (!children.has(session2.id) && session2.cwd)
+            await stopRecord(session2.id, execution.attempt.runnerToken);
           return;
         }
         if (execution.pendingCount || execution.turn?.status === "recovering")
@@ -9971,7 +10311,7 @@ var createSessionSupervisor = (deps) => {
       for (const [id, entry] of children) {
         if (!live.has(id))
           await enqueue(id, async () => {
-            await stopRecord(id, entry.worktreePath);
+            await stopRecord(id);
             if (children.get(id) === entry) children.delete(id);
           });
       }
@@ -9991,7 +10331,7 @@ var createSessionSupervisor = (deps) => {
 };
 
 // src/worker/terminal-manager.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { statSync as statSync2 } from "node:fs";
 import { spawn as spawn4 } from "node-pty";
 
 // ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
@@ -10007,8 +10347,8 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 // src/worker/pty.ts
 import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
 import { createRequire as createModuleRequire } from "node:module";
-import { homedir as homedir3 } from "node:os";
-import { join as join14 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join18 } from "node:path";
 var MAX_TERMINALS = 10;
 var claudePtyCommand = (agentSessionId, hasJsonl, env = process.env) => ({
   file: env.BATON_CLAUDE_BIN?.trim() || "claude",
@@ -10024,10 +10364,10 @@ var codexPtyCommand = (agentSessionId, env = process.env) => {
   };
 };
 var hasSessionJsonl = (agentSessionId) => {
-  const root = join14(homedir3(), ".claude", "projects");
+  const root = join18(homedir4(), ".claude", "projects");
   if (!existsSync8(root)) return false;
   for (const dir of readdirSync2(root))
-    if (existsSync8(join14(root, dir, `${agentSessionId}.jsonl`))) return true;
+    if (existsSync8(join18(root, dir, `${agentSessionId}.jsonl`))) return true;
   return false;
 };
 var serverTerminalWsUrl = (server, sessionId) => `${server.replace(/^http/, "ws")}/workers/me/terminal/ws?sessionId=${sessionId}`;
@@ -10035,27 +10375,21 @@ var isPositiveDim = (v) => typeof v === "number" && Number.isFinite(v) && v > 0;
 
 // src/worker/terminal-manager.ts
 var createTerminalManager = (deps) => {
-  const { cfg, log, hasChild, prepareWorktree } = deps;
+  const { cfg, log, hasChild } = deps;
   const terminals = /* @__PURE__ */ new Map();
-  const open = (sessionId, agentSessionId, worktreePath) => {
-    const why = terminals.has(sessionId) ? "already open" : hasChild(sessionId) ? "headless child running" : !existsSync9(worktreePath) ? `worktree missing (${worktreePath})` : terminals.size >= MAX_TERMINALS ? `cap ${MAX_TERMINALS} reached` : null;
+  const open2 = (sessionId, agentSessionId, cwd) => {
+    const why = terminals.has(sessionId) ? "already open" : hasChild(sessionId) ? "headless child running" : !statSync2(cwd, { throwIfNoEntry: false })?.isDirectory() ? `directory missing (${cwd})` : terminals.size >= MAX_TERMINALS ? `cap ${MAX_TERMINALS} reached` : null;
     if (why) {
       log(`terminal #${sessionId}: ${why} \u2014 refusing`);
       return;
     }
-    try {
-      prepareWorktree(worktreePath);
-    } catch (error) {
-      log(`terminal #${sessionId}: worktree preparation failed: ${String(error)}`);
-      return;
-    }
     const command = cfg.agentKind === "codex" ? codexPtyCommand(agentSessionId) : claudePtyCommand(agentSessionId, hasSessionJsonl(agentSessionId));
     const term = spawn4(command.file, command.args, {
       name: "xterm-color",
       cols: 80,
       rows: 24,
-      cwd: worktreePath,
-      env: process.env
+      cwd,
+      env: workerEnv(cfg)
     });
     const ws = new import_websocket.default(serverTerminalWsUrl(cfg.server, sessionId), {
       headers: { authorization: `Bearer ${cfg.apiToken}` }
@@ -10101,7 +10435,7 @@ var createTerminalManager = (deps) => {
     }
   };
   return {
-    open,
+    open: open2,
     close,
     has: (sessionId) => terminals.has(sessionId),
     killAll: () => {
@@ -10122,12 +10456,14 @@ var createTerminalManager = (deps) => {
 // src/worker/daemon.ts
 var ES_OPEN = 1;
 var runWorkerDaemon = async (cfg, client, signal) => {
-  const repo = process.cwd();
+  const cwd = process.cwd();
+  ensureExcluded(cwd, PROJECT_CONFIG_NAME);
+  syncBundledArtifactSkill(cwd);
   const log = (m) => console.log(`[worker #${cfg.workerId} ${cfg.name}] ${m}`);
   const supervisor = createSessionSupervisor({
     client,
     cfg,
-    repo,
+    cwd,
     log,
     hasTerminal: (id) => terminals.has(id),
     closeTerminal: (id) => terminals.close(id)
@@ -10135,11 +10471,9 @@ var runWorkerDaemon = async (cfg, client, signal) => {
   const terminals = createTerminalManager({
     cfg,
     log,
-    hasChild: (id) => supervisor.has(id),
-    prepareWorktree: (worktreePath) => syncBundledArtifactSkill(repo, worktreePath)
+    hasChild: (id) => supervisor.has(id)
   });
   const services = createServiceSupervisor({
-    getSession: (sessionId) => client.sessions.get(sessionId),
     sendReport: (report) => client.services.report(report),
     cfg,
     log
@@ -10184,15 +10518,14 @@ var runWorkerDaemon = async (cfg, client, signal) => {
       else if (cmd.cmd === "session.reconcile")
         void supervisor.reconcile(cmd.sessionId).catch((error) => log(`reconcile failed: ${String(error)}`));
       else if (cmd.cmd === "session.delete")
-        void services.stopSession(cmd.sessionId).then(() => supervisor.remove(cmd.sessionId, cmd.worktreePath)).catch((err) => log(`service cleanup failed: ${String(err)}`));
+        void supervisor.remove(cmd.sessionId).catch((err) => log(`session cleanup failed: ${String(err)}`));
       else if (cmd.cmd === "session.title")
-        void supervisor.title(cmd.sessionId, cmd.agentSessionId, cmd.worktreePath).catch((err) => log(`title failed: ${String(err)}`));
+        void supervisor.title(cmd.sessionId, cmd.agentSessionId, cmd.cwd).catch((err) => log(`title failed: ${String(err)}`));
       else if (cmd.cmd === "session.terminal") {
-        if (cmd.action === "open")
-          terminals.open(cmd.sessionId, cmd.agentSessionId, cmd.worktreePath);
+        if (cmd.action === "open") terminals.open(cmd.sessionId, cmd.agentSessionId, cmd.cwd);
         else terminals.close(cmd.sessionId);
       } else if (cmd.cmd === "service.run")
-        void services.run(cmd.requestId, cmd.sessionId, cmd.name, cmd.argv, cmd.publicUrl, cmd.note).catch((err) => log(`service run failed: ${String(err)}`));
+        void services.run(cmd.requestId, cmd.cwd, cmd.name, cmd.argv, cmd.publicUrl, cmd.note).catch((err) => log(`service run failed: ${String(err)}`));
       else if (cmd.cmd === "service.stop")
         void services.stop(cmd.requestId, cmd.name).catch((err) => log(`service stop failed: ${String(err)}`));
     } catch (error) {
@@ -10200,12 +10533,12 @@ var runWorkerDaemon = async (cfg, client, signal) => {
     }
   };
   es.onerror = () => log("command stream error (eventsource will retry)");
-  log(`listening for commands (server ${cfg.server}, repo ${repo})`);
+  log(`listening for commands (server ${cfg.server}, cwd ${cwd})`);
   liveness.start();
-  await new Promise((resolve3) => {
-    stop = resolve3;
-    if (signal.aborted) return resolve3();
-    signal.addEventListener("abort", () => resolve3(), { once: true });
+  await new Promise((resolve4) => {
+    stop = resolve4;
+    if (signal.aborted) return resolve4();
+    signal.addEventListener("abort", () => resolve4(), { once: true });
   });
   es.close();
   liveness.stop();
@@ -10217,22 +10550,87 @@ var runWorkerDaemon = async (cfg, client, signal) => {
 
 // src/worker/machine-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname5, join as join15 } from "node:path";
-var machineIdPath = (env = process.env) => join15(env.XDG_DATA_HOME ?? join15(env.HOME ?? homedir4(), ".local/share"), "baton", "machine-id");
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname6, join as join19 } from "node:path";
+var machineIdPath = (env = process.env) => join19(env.XDG_DATA_HOME ?? join19(env.HOME ?? homedir5(), ".local/share"), "baton", "machine-id");
 var readOrCreateMachineId = (path = machineIdPath()) => {
-  if (existsSync10(path)) {
+  if (existsSync9(path)) {
     const s = readFileSync6(path, "utf8").trim();
     if (s) return s;
   }
   const id = randomUUID3();
-  mkdirSync5(dirname5(path), { recursive: true });
+  mkdirSync5(dirname6(path), { recursive: true });
   writeFileSync5(path, `${id}
 `, "utf8");
   return id;
 };
 
+// src/commands/worker/provision.ts
+var projectArg = {
+  project: { type: "string", description: "project id (overrides .baton.json)" }
+};
+var positiveId = (raw) => {
+  const id = Number(raw);
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error("positive id required");
+  return id;
+};
+var workerTemplatesCommand = defineCommand({
+  meta: { name: "templates", description: "list worker creation templates for a project" },
+  args: { ...projectArg, ...common },
+  run: async ({ args }) => {
+    const list = await clientFor(args).workerCreations.templates(positiveId(resolveProjectId(args)));
+    console.log(renderList(list, fmtWorkerTemplate, Boolean(args.json)));
+  }
+});
+var workerCreateCommand = defineCommand({
+  meta: { name: "create", description: "request a worker from the mini template (asynchronous)" },
+  args: {
+    ...projectArg,
+    ...common,
+    template: { type: "string", required: true, description: "mini-local" },
+    name: { type: "string", required: true, description: "worker name" },
+    agentKind: { type: "string", default: "claude-code", description: "claude-code or codex" }
+  },
+  run: async ({ args }) => {
+    if (args.template !== "mini-local") throw new Error("template must be mini-local");
+    if (args.agentKind !== "claude-code" && args.agentKind !== "codex")
+      throw new Error("invalid agentKind");
+    const name = args.name.trim();
+    if (!name) throw new Error("worker name required");
+    const creation = await clientFor(args).workerCreations.create(
+      positiveId(resolveProjectId(args)),
+      {
+        templateId: "mini-local",
+        name,
+        agentKind: args.agentKind
+      }
+    );
+    console.log(renderOne(creation, fmtWorkerCreation, Boolean(args.json)));
+  }
+});
+var workerCreationCommand = defineCommand({
+  meta: { name: "creation", description: "inspect worker creation records" },
+  subCommands: {
+    ls: defineCommand({
+      args: { ...projectArg, ...common },
+      run: async ({ args }) => {
+        const list = await clientFor(args).workerCreations.listByProject(
+          positiveId(resolveProjectId(args))
+        );
+        console.log(renderList(list, fmtWorkerCreation, Boolean(args.json)));
+      }
+    }),
+    get: defineCommand({
+      args: { ...common, id: { type: "positional", required: true } },
+      run: async ({ args }) => {
+        const creation = await clientFor(args).workerCreations.get(positiveId(args.id));
+        console.log(renderOne(creation, fmtWorkerCreation, Boolean(args.json)));
+      }
+    })
+  }
+});
+
 // src/commands/worker/index.ts
 var resolveWorker = async (client, projectId, handle) => {
   const asId = parseWorkerHandle(handle);
@@ -10249,11 +10647,6 @@ var parseAgentKind = (value) => {
   if (raw === "claude-code" || raw === "codex") return raw;
   throw new Error(`invalid agent kind "${raw}" (expected claude-code or codex)`);
 };
-var nonEmptyString = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
-var resolveBaseBranch = (input) => {
-  const branch = nonEmptyString(input.flag) ?? nonEmptyString(input.env) ?? nonEmptyString(input.saved) ?? repoHeadBranch(input.repo ?? process.cwd());
-  return validateBaseBranch(branch);
-};
 var registerWorker = async (client, input, cfgPath = projectConfigPath()) => {
   const out = await client.workers.register({
     projectId: input.projectId,
@@ -10267,7 +10660,6 @@ var registerWorker = async (client, input, cfgPath = projectConfigPath()) => {
     ...existing,
     server: input.server,
     project: input.projectId,
-    baseBranch: input.baseBranch,
     worker: {
       id: out.worker.id,
       name: out.worker.name,
@@ -10281,6 +10673,9 @@ var registerWorker = async (client, input, cfgPath = projectConfigPath()) => {
 var worker = defineCommand({
   meta: { name: "worker", description: "register / inspect / close workers for a project" },
   subCommands: {
+    create: workerCreateCommand,
+    creation: workerCreationCommand,
+    templates: workerTemplatesCommand,
     register: defineCommand({
       meta: {
         name: "register",
@@ -10297,10 +10692,6 @@ var worker = defineCommand({
           type: "string",
           description: "agent engine for new sessions: claude-code or codex"
         },
-        baseBranch: {
-          type: "string",
-          description: "branch new session worktrees start from (default: current branch, then main)"
-        },
         ...common
       },
       run: async ({ args }) => {
@@ -10315,14 +10706,9 @@ var worker = defineCommand({
         const fileToken = savedConfig?.worker?.apiToken;
         const auth = resolveAuth(process.env, fileToken);
         const c = createClient(server, auth && auth !== "cookie" ? auth : void 0);
-        const baseBranch = resolveBaseBranch({
-          flag: args.baseBranch,
-          env: process.env.BATON_BASE_BRANCH,
-          saved: savedConfig?.baseBranch
-        });
-        const hostname = osHostname();
+        const hostname2 = osHostname();
         const machineId = readOrCreateMachineId();
-        const name = args.name ?? hostname;
+        const name = args.name ?? hostname2;
         const agentKind = parseAgentKind(args.agentKind ?? process.env.BATON_AGENT_KIND);
         const { out, configPath } = await registerWorker(
           c,
@@ -10330,20 +10716,18 @@ var worker = defineCommand({
             projectId: resolveProjectId(args),
             name,
             server,
-            hostname,
+            hostname: hostname2,
             machineId,
-            agentKind,
-            baseBranch
+            agentKind
           },
           cfgPath
         );
         if (args.json) {
-          console.log(toJson({ ...out, baseBranch, configPath, machineIdPath: machineIdPath() }));
+          console.log(toJson({ ...out, configPath, machineIdPath: machineIdPath() }));
           return;
         }
         console.log(`worker #${out.worker.id} (${out.worker.name}) \u2014 ${out.outcome}`);
         console.log(`  agentKind:      ${out.worker.agentKind}`);
-        console.log(`  baseBranch:     ${baseBranch}`);
         console.log(`  hostname:       ${out.worker.hostname}`);
         console.log(`  machineId:      ${out.worker.machineId}`);
         console.log(`  machineId file: ${machineIdPath()}`);
@@ -10452,14 +10836,12 @@ var worker = defineCommand({
           console.log("(no worker registered for this project \u2014 run `baton worker register`)");
           return;
         }
-        const baseBranch = resolveBaseBranch({ saved: cfg.baseBranch });
         if (args.json) {
           console.log(
             toJson({
               ...worker2,
               server: cfg.server,
-              projectId: cfg.project,
-              baseBranch
+              projectId: cfg.project
             })
           );
           return;
@@ -10467,7 +10849,6 @@ var worker = defineCommand({
         console.log(`worker #${worker2.id} (${worker2.name})`);
         console.log(`  machineId: ${worker2.machineId}`);
         console.log(`  agentKind: ${worker2.agentKind ?? "claude-code"}`);
-        console.log(`  baseBranch: ${baseBranch}`);
         console.log(`  server:    ${cfg?.server}`);
       }
     })
@@ -10541,6 +10922,7 @@ var main = defineCommand({
   subCommands: {
     init,
     worker,
+    provisioner,
     session,
     service,
     artifact,