@moxt-ai/mobius 0.0.336 → 0.0.337

package/dist/cli.js

@@ -2086,7 +2086,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@moxt-ai/mobius",
-      version: "0.0.336",
+      version: "0.0.337",
       description: "Mobius CLI for pairing and running local AI agent services.",
       type: "module",
       bin: {
@@ -70440,11 +70440,270 @@ var init_path_error = __esm({
 });
 
 // src/util/platform/posix.ts
-import { execFile as execFile2 } from "node:child_process";
-import { constants as constants3 } from "node:fs";
-import { access as access2, chmod, lstat as lstat2, realpath as realpath3, unlink as unlink3 } from "node:fs/promises";
+import { chmod, lstat as lstat2, unlink as unlink3 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join as join10 } from "node:path";
+async function removeControlSocket(path8) {
+  try {
+    await unlink3(path8);
+  } catch (cause) {
+    if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
+      throw cause;
+    }
+  }
+}
+var posixOperations;
+var init_posix = __esm({
+  "src/util/platform/posix.ts"() {
+    "use strict";
+    init_path_error();
+    posixOperations = {
+      controlSocketPath: (installationHash) => join10(tmpdir(), `mobius-${installationHash}.sock`),
+      prepareControlSocket: removeControlSocket,
+      secureControlSocket: async (path8) => {
+        await chmod(path8, 384);
+      },
+      removeControlSocket,
+      validatePathPermissions: async (path8, directory, privateAccess, signal) => {
+        signal.throwIfAborted();
+        const metadata = await lstat2(path8);
+        if (process.getuid === void 0 || metadata.uid !== process.getuid()) {
+          throw new LocalPathError("Path is not user-owned");
+        }
+        if (privateAccess) {
+          await chmod(path8, directory ? 448 : 384);
+        }
+        signal.throwIfAborted();
+      }
+    };
+  }
+});
+
+// src/util/platform/linux.ts
+import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+var linuxPlatform;
+var init_linux = __esm({
+  "src/util/platform/linux.ts"() {
+    "use strict";
+    init_posix();
+    linuxPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: (environment) => {
+        const homeDirectory = environment["HOME"];
+        return homeDirectory !== void 0 && isAbsolute5(homeDirectory) ? [join11(homeDirectory, ".local", "bin", "claude")] : [];
+      }
+    };
+  }
+});
+
+// src/util/platform/claude-desktop.ts
+import { readdirSync as readdirSync2 } from "node:fs";
+import { join as join12 } from "node:path";
+function installedDirectories(directory) {
+  try {
+    return readdirSync2(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (cause) {
+    if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR" || cause.code === "EACCES")) {
+      return [];
+    }
+    throw cause;
+  }
+}
+function claudeDesktopExecutablePaths(roots, executablePaths) {
+  const paths = [];
+  for (const root of roots) {
+    const versions = installedDirectories(root).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2)).toSorted((left, right) => right.localeCompare(left, "en", { numeric: true }));
+    for (const version2 of versions) {
+      const directory = join12(root, version2);
+      const installations = [
+        directory,
+        ...installedDirectories(directory).map((build) => join12(directory, build))
+      ];
+      for (const installation of installations) {
+        for (const executablePath of executablePaths) {
+          paths.push(join12(installation, ...executablePath));
+        }
+      }
+    }
+  }
+  return paths;
+}
+var init_claude_desktop = __esm({
+  "src/util/platform/claude-desktop.ts"() {
+    "use strict";
+  }
+});
+
+// src/util/platform/macos.ts
+import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
+var macosPlatform;
+var init_macos = __esm({
+  "src/util/platform/macos.ts"() {
+    "use strict";
+    init_claude_desktop();
+    init_posix();
+    macosPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: (environment) => {
+        const paths = ["/opt/homebrew/bin/claude", "/usr/local/bin/claude"];
+        const homeDirectory = environment["HOME"];
+        if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
+          paths.unshift(join13(homeDirectory, ".local", "bin", "claude"));
+          paths.push(
+            ...claudeDesktopExecutablePaths(
+              [join13(homeDirectory, "Library", "Application Support", "Claude", "claude-code")],
+              [["claude.app", "Contents", "MacOS", "claude"], ["claude"]]
+            )
+          );
+        }
+        return paths;
+      }
+    };
+  }
+});
+
+// src/util/platform/windows.ts
+import { execFile as execFile2 } from "node:child_process";
+import { isAbsolute as isAbsolute7, join as join14 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+function environmentValue(environment, name2) {
+  return Object.entries(environment).find(([key]) => key.toUpperCase() === name2.toUpperCase())?.[1];
+}
+function desktopClaudeExecutablePaths(environment) {
+  const roots = [];
+  const localAppData = environmentValue(environment, "LOCALAPPDATA");
+  if (localAppData !== void 0 && isAbsolute7(localAppData)) {
+    const dataDirectory = join14(localAppData, "Claude-Data");
+    for (const installation of installedDirectories(dataDirectory)) {
+      if (installation.startsWith("claude_")) {
+        roots.push(join14(dataDirectory, installation, "claude-code"));
+      }
+    }
+  }
+  const appData = environmentValue(environment, "APPDATA");
+  if (appData !== void 0 && isAbsolute7(appData)) {
+    roots.push(join14(appData, "Claude", "claude-code"));
+  }
+  return claudeDesktopExecutablePaths(roots, [["claude.exe"]]);
+}
+async function validatePathPermissions(path8, _directory, privateAccess, signal) {
+  signal.throwIfAborted();
+  const systemRoot = environmentValue(process.env, "SystemRoot");
+  if (systemRoot === void 0) {
+    throw new LocalPathError("Windows system directory is unavailable");
+  }
+  try {
+    await execute(
+      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(windowsPermissions, "utf16le").toString("base64")
+      ],
+      {
+        env: {
+          ...process.env,
+          MOBIUS_PERMISSION_PATH: path8,
+          MOBIUS_PERMISSION_PRIVATE: privateAccess ? "1" : "0"
+        },
+        windowsHide: true,
+        signal: AbortSignal.any([signal, AbortSignal.timeout(windowsPermissionsTimeoutMs)]),
+        timeout: windowsPermissionsTimeoutMs,
+        maxBuffer: 16384
+      }
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw new LocalPathError("The local path permissions could not be secured", { cause });
+  }
+}
+var execute, windowsPermissions, windowsPermissionsTimeoutMs, windowsPlatform;
+var init_windows = __esm({
+  "src/util/platform/windows.ts"() {
+    "use strict";
+    init_path_error();
+    init_claude_desktop();
+    execute = promisify2(execFile2);
+    windowsPermissions = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$item = Get-Item -LiteralPath $env:MOBIUS_PERMISSION_PATH -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Unsafe path' }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = $item.GetAccessControl()
+$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
+if ($owner -ne $sid -and -not ($owner.Value -eq 'S-1-5-32-544' -and ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) { throw 'Path is not user-owned' }
+if ($env:MOBIUS_PERMISSION_PRIVATE -eq '1') {
+    if ($item.PSIsContainer) {
+        $private = New-Object Security.AccessControl.DirectorySecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+    } else {
+        $private = New-Object Security.AccessControl.FileSecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow')
+    }
+    $private.SetOwner($sid)
+    $private.SetAccessRuleProtection($true, $false)
+    $private.AddAccessRule($rule)
+    $item.SetAccessControl($private)
+}
+`;
+    windowsPermissionsTimeoutMs = 3e4;
+    windowsPlatform = {
+      controlSocketPath: (installationHash) => `\\\\.\\pipe\\mobius-${installationHash}`,
+      prepareControlSocket: async () => {
+      },
+      secureControlSocket: async () => {
+      },
+      removeControlSocket: async () => {
+      },
+      validatePathPermissions,
+      claudeCodeExecutablePaths: (environment) => {
+        const paths = [];
+        const userProfile = environmentValue(environment, "USERPROFILE");
+        if (userProfile !== void 0 && isAbsolute7(userProfile)) {
+          paths.push(join14(userProfile, ".local", "bin", "claude.exe"));
+        }
+        const localAppData = environmentValue(environment, "LOCALAPPDATA");
+        if (localAppData !== void 0 && isAbsolute7(localAppData)) {
+          paths.push(join14(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"));
+        }
+        paths.push(...desktopClaudeExecutablePaths(environment));
+        return paths;
+      }
+    };
+  }
+});
+
+// src/util/platform/index.ts
+function platformSupportFor(platform2) {
+  return platforms.get(platform2) ?? fallbackPlatform;
+}
+var fallbackPlatform, platforms;
+var init_platform = __esm({
+  "src/util/platform/index.ts"() {
+    "use strict";
+    init_linux();
+    init_macos();
+    init_posix();
+    init_windows();
+    fallbackPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: () => []
+    };
+    platforms = /* @__PURE__ */ new Map([
+      ["linux", linuxPlatform],
+      ["darwin", macosPlatform],
+      ["win32", windowsPlatform]
+    ]);
+  }
+});
+
+// src/util/process/platform/posix.ts
+import { execFile as execFile3 } from "node:child_process";
+import { constants as constants3 } from "node:fs";
+import { access as access2, realpath as realpath3 } from "node:fs/promises";
 function parseProcessTable(output2) {
   const entries = [];
   for (const line of output2.split("\n")) {
@@ -70464,7 +70723,7 @@ function parseProcessTable(output2) {
 }
 function readProcessTableWithPs(executable) {
   return new Promise((resolveTable) => {
-    execFile2(
+    execFile3(
       executable,
       ["-axo", "pid=,ppid=,pgid="],
       {
@@ -70522,29 +70781,13 @@ function terminateProcess(child, signal) {
   }
   child.kill(signal);
 }
-async function removeControlSocket(path8) {
-  try {
-    await unlink3(path8);
-  } catch (cause) {
-    if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
-      throw cause;
-    }
-  }
-}
-var PROCESS_TABLE_TIMEOUT_MILLISECONDS, PROCESS_TABLE_OUTPUT_LIMIT_BYTES, posixOperations;
-var init_posix = __esm({
-  "src/util/platform/posix.ts"() {
+var PROCESS_TABLE_TIMEOUT_MILLISECONDS, PROCESS_TABLE_OUTPUT_LIMIT_BYTES, posixOperations2;
+var init_posix2 = __esm({
+  "src/util/process/platform/posix.ts"() {
     "use strict";
-    init_path_error();
     PROCESS_TABLE_TIMEOUT_MILLISECONDS = 1e3;
     PROCESS_TABLE_OUTPUT_LIMIT_BYTES = 1024 * 1024;
-    posixOperations = {
-      controlSocketPath: (installationHash) => join10(tmpdir(), `mobius-${installationHash}.sock`),
-      prepareControlSocket: removeControlSocket,
-      secureControlSocket: async (path8) => {
-        await chmod(path8, 384);
-      },
-      removeControlSocket,
+    posixOperations2 = {
       pathDelimiter: ":",
       environmentValue: (environment, name2) => environment[name2],
       executableExtensions: () => [""],
@@ -70556,26 +70799,15 @@ var init_posix = __esm({
       executableLaunch: (command, args) => ({ command, arguments: args }),
       spawnOptions: { detached: true, windowsHide: true },
       signalCapturedProcesses,
-      terminateProcess,
-      validatePathPermissions: async (path8, directory, privateAccess, signal) => {
-        signal.throwIfAborted();
-        const metadata = await lstat2(path8);
-        if (process.getuid === void 0 || metadata.uid !== process.getuid()) {
-          throw new LocalPathError("Path is not user-owned");
-        }
-        if (privateAccess) {
-          await chmod(path8, directory ? 448 : 384);
-        }
-        signal.throwIfAborted();
-      }
+      terminateProcess
     };
   }
 });
 
-// src/util/platform/linux.ts
-import { constants as constants4, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+// src/util/process/platform/linux.ts
+import { constants as constants4, readdirSync as readdirSync3, readFileSync as readFileSync2 } from "node:fs";
 import { access as access3, readdir as readdir4, readFile as readFile4, realpath as realpath4, stat as stat4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { join as join15 } from "node:path";
 function appendLinuxProcessTableEntry(entries, processId, encoded) {
   const closingParenthesis = encoded.lastIndexOf(")");
   if (!encoded.startsWith(`${processId.toString()} (`) || closingParenthesis < 0) {
@@ -70605,7 +70837,7 @@ async function readLinuxProcessTable() {
         appendLinuxProcessTableEntry(
           entries,
           processId,
-          await readFile4(join11("/proc", directory.name, "stat"), "utf8")
+          await readFile4(join15("/proc", directory.name, "stat"), "utf8")
         );
       } catch {
       }
@@ -70617,7 +70849,7 @@ async function readLinuxProcessTable() {
 function readLinuxProcessTableSynchronously() {
   const entries = [];
   try {
-    const directories = readdirSync2("/proc", { withFileTypes: true });
+    const directories = readdirSync3("/proc", { withFileTypes: true });
     for (const directory of directories) {
       if (!directory.isDirectory() || !/^\d+$/.test(directory.name)) {
         continue;
@@ -70630,7 +70862,7 @@ function readLinuxProcessTableSynchronously() {
         appendLinuxProcessTableEntry(
           entries,
           processId,
-          readFileSync2(join11("/proc", directory.name, "stat"), "utf8")
+          readFileSync2(join15("/proc", directory.name, "stat"), "utf8")
         );
       } catch {
       }
@@ -70663,7 +70895,7 @@ async function readLinuxProcessTableWithFallback() {
 }
 function processExists2(processId) {
   try {
-    const encoded = readFileSync2(join11("/proc", processId.toString(), "stat"), "utf8");
+    const encoded = readFileSync2(join15("/proc", processId.toString(), "stat"), "utf8");
     const closingParenthesis = encoded.lastIndexOf(")");
     if (closingParenthesis >= 0) {
       const processState = encoded.slice(closingParenthesis + 1).trimStart().charAt(0);
@@ -70675,89 +70907,31 @@ function processExists2(processId) {
   }
   return processExists(processId);
 }
-var linuxPlatform;
-var init_linux = __esm({
-  "src/util/platform/linux.ts"() {
+var linuxProcessPlatform;
+var init_linux2 = __esm({
+  "src/util/process/platform/linux.ts"() {
     "use strict";
-    init_posix();
-    linuxPlatform = {
-      ...posixOperations,
+    init_posix2();
+    linuxProcessPlatform = {
+      ...posixOperations2,
       readProcessTable: readLinuxProcessTableWithFallback,
       readProcessTableSynchronously: readLinuxProcessTableSynchronously,
-      processExists: processExists2,
-      claudeCodeExecutablePaths: (environment) => {
-        const homeDirectory = environment["HOME"];
-        return homeDirectory !== void 0 && isAbsolute5(homeDirectory) ? [join11(homeDirectory, ".local", "bin", "claude")] : [];
-      }
+      processExists: processExists2
     };
   }
 });
 
-// src/util/platform/claude-desktop.ts
-import { readdirSync as readdirSync3 } from "node:fs";
-import { join as join12 } from "node:path";
-function installedDirectories(directory) {
-  try {
-    return readdirSync3(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch (cause) {
-    if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR" || cause.code === "EACCES")) {
-      return [];
-    }
-    throw cause;
-  }
-}
-function claudeDesktopExecutablePaths(roots, executablePaths) {
-  const paths = [];
-  for (const root of roots) {
-    const versions = installedDirectories(root).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2)).toSorted((left, right) => right.localeCompare(left, "en", { numeric: true }));
-    for (const version2 of versions) {
-      const directory = join12(root, version2);
-      const installations = [
-        directory,
-        ...installedDirectories(directory).map((build) => join12(directory, build))
-      ];
-      for (const installation of installations) {
-        for (const executablePath of executablePaths) {
-          paths.push(join12(installation, ...executablePath));
-        }
-      }
-    }
-  }
-  return paths;
-}
-var init_claude_desktop = __esm({
-  "src/util/platform/claude-desktop.ts"() {
+// src/util/process/platform/macos.ts
+var macosProcessPlatform;
+var init_macos2 = __esm({
+  "src/util/process/platform/macos.ts"() {
     "use strict";
-  }
-});
-
-// src/util/platform/macos.ts
-import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
-var macosPlatform;
-var init_macos = __esm({
-  "src/util/platform/macos.ts"() {
-    "use strict";
-    init_claude_desktop();
-    init_posix();
-    macosPlatform = {
-      ...posixOperations,
+    init_posix2();
+    macosProcessPlatform = {
+      ...posixOperations2,
       readProcessTable: () => readProcessTableWithPs("/bin/ps"),
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: (environment) => {
-        const paths = ["/opt/homebrew/bin/claude", "/usr/local/bin/claude"];
-        const homeDirectory = environment["HOME"];
-        if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
-          paths.unshift(join13(homeDirectory, ".local", "bin", "claude"));
-          paths.push(
-            ...claudeDesktopExecutablePaths(
-              [join13(homeDirectory, "Library", "Application Support", "Claude", "claude-code")],
-              [["claude.app", "Contents", "MacOS", "claude"], ["claude"]]
-            )
-          );
-        }
-        return paths;
-      }
+      processExists
     };
   }
 });
@@ -70778,36 +70952,18 @@ var init_process_error = __esm({
   }
 });
 
-// src/util/platform/windows.ts
-import { execFile as execFile3 } from "node:child_process";
+// src/util/process/platform/windows.ts
+import { execFile as execFile4 } from "node:child_process";
 import { readFile as readFile5, realpath as realpath5 } from "node:fs/promises";
-import { dirname as dirname7, extname, isAbsolute as isAbsolute7, join as join14, resolve as resolve8 } from "node:path";
-import { promisify as promisify2 } from "node:util";
-function environmentValue(environment, name2) {
+import { dirname as dirname7, extname, join as join16, resolve as resolve8 } from "node:path";
+function environmentValue2(environment, name2) {
   return Object.entries(environment).find(([key]) => key.toUpperCase() === name2.toUpperCase())?.[1];
 }
-function desktopClaudeExecutablePaths(environment) {
-  const roots = [];
-  const localAppData = environmentValue(environment, "LOCALAPPDATA");
-  if (localAppData !== void 0 && isAbsolute7(localAppData)) {
-    const dataDirectory = join14(localAppData, "Claude-Data");
-    for (const installation of installedDirectories(dataDirectory)) {
-      if (installation.startsWith("claude_")) {
-        roots.push(join14(dataDirectory, installation, "claude-code"));
-      }
-    }
-  }
-  const appData = environmentValue(environment, "APPDATA");
-  if (appData !== void 0 && isAbsolute7(appData)) {
-    roots.push(join14(appData, "Claude", "claude-code"));
-  }
-  return claudeDesktopExecutablePaths(roots, [["claude.exe"]]);
-}
 function executableExtensions(executableName, environment) {
   if (/\.[a-zA-Z0-9]+$/.test(executableName)) {
     return [""];
   }
-  const configured = environmentValue(environment, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD";
+  const configured = environmentValue2(environment, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD";
   const extensions = configured.split(";").map((extension) => extension.trim()).filter((extension) => extension.length > 0).map((extension) => extension.startsWith(".") ? extension : `.${extension}`);
   return extensions.length > 0 ? extensions : [".EXE"];
 }
@@ -70855,13 +71011,13 @@ function executableLaunch(command, args) {
   return { command, arguments: args };
 }
 function readProcessTable() {
-  const systemRoot = environmentValue(process.env, "SystemRoot");
+  const systemRoot = environmentValue2(process.env, "SystemRoot");
   if (systemRoot === void 0) {
     return Promise.resolve([]);
   }
   return new Promise((resolveTable) => {
-    execFile3(
-      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    execFile4(
+      join16(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
       [
         "-NoLogo",
         "-NoProfile",
@@ -70894,132 +71050,50 @@ function terminateProcess2(child, signal) {
   }
   child.kill(signal);
 }
-async function validatePathPermissions(path8, _directory, privateAccess, signal) {
-  signal.throwIfAborted();
-  const systemRoot = environmentValue(process.env, "SystemRoot");
-  if (systemRoot === void 0) {
-    throw new LocalPathError("Windows system directory is unavailable");
-  }
-  try {
-    await execute(
-      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-      [
-        "-NoLogo",
-        "-NoProfile",
-        "-NonInteractive",
-        "-EncodedCommand",
-        Buffer.from(windowsPermissions, "utf16le").toString("base64")
-      ],
-      {
-        env: {
-          ...process.env,
-          MOBIUS_PERMISSION_PATH: path8,
-          MOBIUS_PERMISSION_PRIVATE: privateAccess ? "1" : "0"
-        },
-        windowsHide: true,
-        signal: AbortSignal.any([signal, AbortSignal.timeout(windowsPermissionsTimeoutMs)]),
-        timeout: windowsPermissionsTimeoutMs,
-        maxBuffer: 16384
-      }
-    );
-  } catch (cause) {
-    signal.throwIfAborted();
-    throw new LocalPathError("The local path permissions could not be secured", { cause });
-  }
-}
-var execute, windowsPermissions, windowsPermissionsTimeoutMs, windowsPlatform;
-var init_windows = __esm({
-  "src/util/platform/windows.ts"() {
+var windowsProcessPlatform;
+var init_windows2 = __esm({
+  "src/util/process/platform/windows.ts"() {
     "use strict";
-    init_path_error();
     init_process_error();
-    init_claude_desktop();
-    init_posix();
-    execute = promisify2(execFile3);
-    windowsPermissions = `
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-$item = Get-Item -LiteralPath $env:MOBIUS_PERMISSION_PATH -Force
-if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Unsafe path' }
-$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
-$acl = $item.GetAccessControl()
-$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
-if ($owner -ne $sid -and -not ($owner.Value -eq 'S-1-5-32-544' -and ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) { throw 'Path is not user-owned' }
-if ($env:MOBIUS_PERMISSION_PRIVATE -eq '1') {
-    if ($item.PSIsContainer) {
-        $private = New-Object Security.AccessControl.DirectorySecurity
-        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
-    } else {
-        $private = New-Object Security.AccessControl.FileSecurity
-        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow')
-    }
-    $private.SetOwner($sid)
-    $private.SetAccessRuleProtection($true, $false)
-    $private.AddAccessRule($rule)
-    $item.SetAccessControl($private)
-}
-`;
-    windowsPermissionsTimeoutMs = 3e4;
-    windowsPlatform = {
-      controlSocketPath: (installationHash) => `\\\\.\\pipe\\mobius-${installationHash}`,
-      prepareControlSocket: async () => {
-      },
-      secureControlSocket: async () => {
-      },
-      removeControlSocket: async () => {
-      },
+    init_posix2();
+    windowsProcessPlatform = {
       pathDelimiter: ";",
-      environmentValue,
+      environmentValue: environmentValue2,
       executableExtensions,
       resolveExecutableTarget,
       executableLaunch,
       spawnOptions: { detached: false, windowsHide: true },
       signalCapturedProcesses: signalCapturedProcesses2,
       terminateProcess: terminateProcess2,
-      validatePathPermissions,
       readProcessTable,
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: (environment) => {
-        const paths = [];
-        const userProfile = environmentValue(environment, "USERPROFILE");
-        if (userProfile !== void 0 && isAbsolute7(userProfile)) {
-          paths.push(join14(userProfile, ".local", "bin", "claude.exe"));
-        }
-        const localAppData = environmentValue(environment, "LOCALAPPDATA");
-        if (localAppData !== void 0 && isAbsolute7(localAppData)) {
-          paths.push(join14(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"));
-        }
-        paths.push(...desktopClaudeExecutablePaths(environment));
-        return paths;
-      }
+      processExists
     };
   }
 });
 
-// src/util/platform/index.ts
-function platformSupportFor(platform2) {
-  return platforms.get(platform2) ?? fallbackPlatform;
+// src/util/process/platform/index.ts
+function processPlatformSupportFor(platform2) {
+  return platforms2.get(platform2) ?? fallbackPlatform2;
 }
-var fallbackPlatform, platforms;
-var init_platform = __esm({
-  "src/util/platform/index.ts"() {
+var fallbackPlatform2, platforms2;
+var init_platform2 = __esm({
+  "src/util/process/platform/index.ts"() {
     "use strict";
-    init_linux();
-    init_macos();
-    init_posix();
-    init_windows();
-    fallbackPlatform = {
-      ...posixOperations,
+    init_linux2();
+    init_macos2();
+    init_posix2();
+    init_windows2();
+    fallbackPlatform2 = {
+      ...posixOperations2,
       readProcessTable: () => readProcessTableWithPs("/usr/bin/ps"),
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: () => []
+      processExists
     };
-    platforms = /* @__PURE__ */ new Map([
-      ["linux", linuxPlatform],
-      ["darwin", macosPlatform],
-      ["win32", windowsPlatform]
+    platforms2 = /* @__PURE__ */ new Map([
+      ["linux", linuxProcessPlatform],
+      ["darwin", macosProcessPlatform],
+      ["win32", windowsProcessPlatform]
     ]);
   }
 });
@@ -71027,11 +71101,11 @@ var init_platform = __esm({
 // src/util/process/executable.ts
 import { spawn as spawn3 } from "node:child_process";
 import { stat as stat5 } from "node:fs/promises";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { join as join17, resolve as resolve9 } from "node:path";
 async function resolveExecutablePath(requestedPath2, platform2 = process.platform) {
   const absoluteRequestedPath = resolve9(requestedPath2);
   try {
-    const resolvedPath = await platformSupportFor(platform2).resolveExecutableTarget(absoluteRequestedPath);
+    const resolvedPath = await processPlatformSupportFor(platform2).resolveExecutableTarget(absoluteRequestedPath);
     const metadata = await stat5(resolvedPath);
     if (!metadata.isFile()) {
       return null;
@@ -71051,7 +71125,7 @@ async function resolveExecutablePath(requestedPath2, platform2 = process.platfor
   }
 }
 async function findExecutableOnPath(executableName, environment, platform2 = process.platform) {
-  const support = platformSupportFor(platform2);
+  const support = processPlatformSupportFor(platform2);
   const encodedPath = support.environmentValue(environment, "PATH") ?? "";
   const separator = support.pathDelimiter;
   const extensions = support.executableExtensions(executableName, environment);
@@ -71060,7 +71134,7 @@ async function findExecutableOnPath(executableName, environment, platform2 = pro
       continue;
     }
     for (const extension of extensions) {
-      const requestedPath2 = resolve9(join15(entry, `${executableName}${extension}`));
+      const requestedPath2 = resolve9(join17(entry, `${executableName}${extension}`));
       const executable = await resolveExecutablePath(requestedPath2, platform2);
       if (executable !== null) {
         return executable;
@@ -71309,10 +71383,10 @@ var hostPlatform, DEFAULT_OUTPUT_LIMIT_BYTES, PROCESS_GRACEFUL_STOP_TIMEOUT_MILL
 var init_executable = __esm({
   "src/util/process/executable.ts"() {
     "use strict";
-    init_platform();
+    init_platform2();
     init_process_error();
     init_process_error();
-    hostPlatform = platformSupportFor(process.platform);
+    hostPlatform = processPlatformSupportFor(process.platform);
     DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
     PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1e3;
     PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5e3;
@@ -78041,12 +78115,12 @@ var init_environment = __esm({
 });
 
 // src/acp/harness/pi/upstream/dist/acp/paths.js
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 function getPiAcpDir(environment = process.env) {
-  return join16(environmentHome(environment), ".pi", "pi-acp");
+  return join18(environmentHome(environment), ".pi", "pi-acp");
 }
 function getPiAcpSessionMapPath(environment = process.env) {
-  return join16(getPiAcpDir(environment), "session-map.json");
+  return join18(getPiAcpDir(environment), "session-map.json");
 }
 var init_paths = __esm({
   "src/acp/harness/pi/upstream/dist/acp/paths.js"() {
@@ -78102,13 +78176,13 @@ var init_pi_commands = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/pi-sessions.js
 import { closeSync as closeSync2, existsSync as existsSync4, openSync as openSync2, readdirSync as readdirSync4, readFileSync as readFileSync3, readSync as readSync2, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute10, join as join17, resolve as resolve10 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join19, resolve as resolve10 } from "node:path";
 function getPiAgentDir(environment) {
   const configured = environment["PI_CODING_AGENT_DIR"];
-  return configured ? resolve10(configured) : join17(environmentHome(environment), ".pi", "agent");
+  return configured ? resolve10(configured) : join19(environmentHome(environment), ".pi", "agent");
 }
 function readSessionDirFromSettings(agentDir) {
-  const settingsPath = join17(agentDir, "settings.json");
+  const settingsPath = join19(agentDir, "settings.json");
   try {
     if (!existsSync4(settingsPath)) {
       return null;
@@ -78129,7 +78203,7 @@ function readSessionDirFromSettings(agentDir) {
 }
 function getPiSessionsDir(environment = process.env) {
   const agentDir = getPiAgentDir(environment);
-  return readSessionDirFromSettings(agentDir) ?? join17(agentDir, "sessions");
+  return readSessionDirFromSettings(agentDir) ?? join19(agentDir, "sessions");
 }
 function getPiSessionDiscoveryDirs(environment) {
   const discoveryDirectories = [getPiSessionsDir(environment)];
@@ -78140,7 +78214,7 @@ function getPiSessionDiscoveryDirs(environment) {
       if (!entry.isDirectory()) {
         continue;
       }
-      const directory = join17(mobiusSessionsRoot, entry.name);
+      const directory = join19(mobiusSessionsRoot, entry.name);
       if (!discoveryDirectories.includes(directory)) {
         discoveryDirectories.push(directory);
       }
@@ -78157,7 +78231,7 @@ function walkJsonlFiles(dir, out2) {
   }
   for (const e of entries) {
     const name2 = typeof e.name === "string" ? e.name : String(e.name);
-    const p = join17(dir, name2);
+    const p = join19(dir, name2);
     if (e.isDirectory()) {
       walkJsonlFiles(p, out2);
     } else if (e.isFile() && name2.endsWith(".jsonl")) {
@@ -78435,7 +78509,7 @@ var init_pi_sessions = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/pi-settings.js
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join as join18, resolve as resolve11 } from "node:path";
+import { join as join20, resolve as resolve11 } from "node:path";
 function isObject2(x) {
   return Boolean(x) && typeof x === "object" && !Array.isArray(x);
 }
@@ -78464,7 +78538,7 @@ function readJsonFile(path8) {
   }
 }
 function getMergedSettings(cwd, environment) {
-  const globalSettingsPath = join18(getAgentDir(environment), "settings.json");
+  const globalSettingsPath = join20(getAgentDir(environment), "settings.json");
   const projectSettingsPath = resolve11(cwd, ".pi", "settings.json");
   const global2 = readJsonFile(globalSettingsPath);
   const project = readJsonFile(projectSettingsPath);
@@ -78472,7 +78546,7 @@ function getMergedSettings(cwd, environment) {
 }
 function getAgentDir(environment = process.env) {
   const configured = environment["PI_CODING_AGENT_DIR"];
-  return configured ? resolve11(configured) : join18(environmentHome(environment), ".pi", "agent");
+  return configured ? resolve11(configured) : join20(environmentHome(environment), ".pi", "agent");
 }
 function getEnableSkillCommands(cwd, environment = process.env) {
   const merged = getMergedSettings(cwd, environment);
@@ -78742,7 +78816,7 @@ var init_session_store = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/slash-commands.js
 import { existsSync as existsSync6, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "node:fs";
-import { join as join19, resolve as resolve12 } from "node:path";
+import { join as join21, resolve as resolve12 } from "node:path";
 function parseFrontmatter(content) {
   const frontmatter = {};
   if (!content.startsWith("---")) {
@@ -78770,7 +78844,7 @@ function loadCommandsFromDir(dir, source, subdir = "") {
   try {
     const entries = readdirSync5(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join19(dir, entry.name);
+      const fullPath = join21(dir, entry.name);
       if (entry.isDirectory()) {
         const newSubdir = subdir ? `${subdir}:${entry.name}` : entry.name;
         commands.push(...loadCommandsFromDir(fullPath, source, newSubdir));
@@ -78810,7 +78884,7 @@ function loadCommandsFromDir(dir, source, subdir = "") {
 }
 function loadSlashCommands(cwd, environment = process.env) {
   const commands = [];
-  const userDir = join19(environmentHome(environment), ".pi", "agent", "prompts");
+  const userDir = join21(environmentHome(environment), ".pi", "agent", "prompts");
   const projectDir = resolve12(cwd, ".pi", "prompts");
   commands.push(...loadCommandsFromDir(userDir, "user"));
   commands.push(...loadCommandsFromDir(projectDir, "project"));
@@ -79902,7 +79976,7 @@ var init_prompt = __esm({
 import { spawnSync } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
-import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute12, join as join20 } from "node:path";
+import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute12, join as join22 } from "node:path";
 import { RequestError as RequestError10 } from "@agentclientprotocol/sdk";
 function thinkingLevelName(id) {
   return id.split(/[_-]/u).map((part) => part.length === 0 ? part : `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}`).join(" ");
@@ -80177,7 +80251,7 @@ function buildStartupInfo(opts) {
     md.push("");
   };
   const contextItems = [];
-  const contextPath = join20(opts.cwd, "AGENTS.md");
+  const contextPath = join22(opts.cwd, "AGENTS.md");
   if (existsSync7(contextPath)) {
     contextItems.push(contextPath);
   }
@@ -80186,7 +80260,7 @@ function buildStartupInfo(opts) {
   const pushSkillFromRoot = (root) => {
     try {
       for (const e of readdirSync6(root)) {
-        const p = join20(root, e);
+        const p = join22(root, e);
         try {
           const st2 = statSync3(p);
           if (st2.isFile() && e.toLowerCase().endsWith(".md")) {
@@ -80211,7 +80285,7 @@ function buildStartupInfo(opts) {
           if (name2 === "node_modules" || name2 === ".git") {
             continue;
           }
-          const p = join20(dir, name2);
+          const p = join22(dir, name2);
           let st2;
           try {
             st2 = statSync3(p);
@@ -80228,16 +80302,16 @@ function buildStartupInfo(opts) {
     } catch {
     }
   };
-  const globalSkillsDir = join20(getAgentDir(opts.environment), "skills");
+  const globalSkillsDir = join22(getAgentDir(opts.environment), "skills");
   pushSkillFromRoot(globalSkillsDir);
   const home = opts.environment["HOME"] ?? opts.environment["USERPROFILE"] ?? "";
-  const legacyAgentsSkillsDir = join20(home, ".agents", "skills");
+  const legacyAgentsSkillsDir = join22(home, ".agents", "skills");
   pushSkillFromRoot(legacyAgentsSkillsDir);
-  const projectSkillsDir = join20(opts.cwd, ".pi", "skills");
+  const projectSkillsDir = join22(opts.cwd, ".pi", "skills");
   pushSkillFromRoot(projectSkillsDir);
   addSection("Skills", skillsItems);
   const promptsItems = [];
-  const promptsDir = join20(home, ".pi", "agent", "prompts");
+  const promptsDir = join22(home, ".pi", "agent", "prompts");
   try {
     const prompts = readdirSync6(promptsDir).filter((f) => f.endsWith(".md"));
     for (const f of prompts) {
@@ -80247,17 +80321,17 @@ function buildStartupInfo(opts) {
   }
   addSection("Prompts", promptsItems);
   const extItems = [];
-  const extDir = join20(home, ".pi", "agent", "extensions");
+  const extDir = join22(home, ".pi", "agent", "extensions");
   try {
     const exts = readdirSync6(extDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
     for (const f of exts) {
-      extItems.push(join20(extDir, f));
+      extItems.push(join22(extDir, f));
     }
   } catch {
   }
   const settingsPaths = [
-    join20(getAgentDir(opts.environment), "settings.json"),
-    join20(opts.cwd, ".pi", "settings.json")
+    join22(getAgentDir(opts.environment), "settings.json"),
+    join22(opts.cwd, ".pi", "settings.json")
   ];
   for (const settingsPath of settingsPaths) {
     try {
@@ -80848,7 +80922,7 @@ ${JSON.stringify(stats, null, 2)}`;
                 if (piPath) {
                   const resolved = realpathSync3(piPath);
                   const pkgRoot = dirname9(dirname9(resolved));
-                  const p = join20(pkgRoot, "CHANGELOG.md");
+                  const p = join22(pkgRoot, "CHANGELOG.md");
                   if (existsSync7(p)) {
                     return p;
                   }
@@ -80859,7 +80933,7 @@ ${JSON.stringify(stats, null, 2)}`;
                 const npmRoot = spawnSync("npm", ["root", "-g"], { encoding: "utf-8" });
                 const root = String(npmRoot.stdout ?? "").trim();
                 if (root) {
-                  const p = join20(root, "@earendil-works", "pi-coding-agent", "CHANGELOG.md");
+                  const p = join22(root, "@earendil-works", "pi-coding-agent", "CHANGELOG.md");
                   if (existsSync7(p)) {
                     return p;
                   }
@@ -80953,7 +81027,7 @@ ${JSON.stringify(stats, null, 2)}`;
               return { stopReason: "end_turn" };
             }
             const safeSessionId = session.sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
-            const outputPath = join20(session.cwd, `pi-session-${safeSessionId}.html`);
+            const outputPath = join22(session.cwd, `pi-session-${safeSessionId}.html`);
             let resultPath = "";
             try {
               const result2 = await session.proc.exportHtml(outputPath);
@@ -81646,7 +81720,7 @@ var init_agent_probe_error = __esm({
 
 // src/agent/specification/vendors/pi-agent.ts
 import { createHash as createHash3 } from "node:crypto";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 import {
   methods as methods7
 } from "@agentclientprotocol/sdk";
@@ -81666,7 +81740,7 @@ var init_pi_agent = __esm({
       // keeps the adapter's opt-in capability flag enabled for every launch it owns.
       createLaunchEnvironment = async (_agent, context) => {
         const workspaceHash = createHash3("sha256").update(context.defaultWorkspace).digest("hex").slice(0, 24);
-        const sessionDirectory = join21(context.dataDirectory, "agents", "pi", "sessions", workspaceHash);
+        const sessionDirectory = join23(context.dataDirectory, "agents", "pi", "sessions", workspaceHash);
         return Object.freeze({
           PI_ACP_ENABLE_EMBEDDED_CONTEXT: "true",
           MOBIUS_PI_SESSION_DIR: sessionDirectory
@@ -85145,7 +85219,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join39(chunks, separator) {
+      function join41(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -85153,7 +85227,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join39;
+      _sql.join = join41;
       function identifier2(value) {
         return new Name(value);
       }
@@ -87111,7 +87185,7 @@ var init_select = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join39) => join39.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join41) => join41.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -88708,7 +88782,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k2, join39]) => {
+          return sql.join(withEntries.map(([k2, join41]) => {
             const relation = tableConfig.relations[k2];
             const isSingle2 = is(relation, One2);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -88719,7 +88793,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join39,
+              queryConfig: join41,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -88733,7 +88807,7 @@ var init_dialect = __esm({
               key: k2,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join39 !== true && !!join39.where
+              isOptional: (relation.optional ?? false) || join41 !== true && !!join41.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -89155,7 +89229,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on2) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join39) => join39.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join41) => join41.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on2 === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on2 = on2(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -90041,12 +90115,12 @@ var init_local_sqlite_database = __esm({
 
 // src/storage/sqlite/local-databases.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 function channelSessionDatabasePaths(stateDirectory, channelId) {
   const channelHash = createHash4("sha256").update(channelId).digest("hex");
   return {
-    events: join22(stateDirectory, "sessions", `${channelHash}.events.sqlite`),
-    sessions: join22(stateDirectory, "sessions", `${channelHash}.sqlite`)
+    events: join24(stateDirectory, "sessions", `${channelHash}.events.sqlite`),
+    sessions: join24(stateDirectory, "sessions", `${channelHash}.sqlite`)
   };
 }
 var openAcpSessionDatabase, openSessionEventCacheDatabase;
@@ -90279,13 +90353,13 @@ var init_session_event_cache_table = __esm({
 // src/storage/session/temporary-session-event-cache.ts
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 function openTemporarySessionEventCache() {
-  const directory = mkdtempSync(join23(tmpdir2(), "mobius-preview-events-"));
+  const directory = mkdtempSync(join25(tmpdir2(), "mobius-preview-events-"));
   const removeFiles = () => rmSync2(directory, { recursive: true, force: true });
   try {
     return {
-      table: new SessionEventCacheTable(openSessionEventCacheDatabase(join23(directory, "events.sqlite"))),
+      table: new SessionEventCacheTable(openSessionEventCacheDatabase(join25(directory, "events.sqlite"))),
       removeFiles
     };
   } catch (error62) {
@@ -91134,10 +91208,10 @@ var init_catalog2 = __esm({
 });
 
 // src/runtime/config.ts
-import { join as join24, resolve as resolve14 } from "node:path";
+import { join as join26, resolve as resolve14 } from "node:path";
 function loadDefaultWorkspace(dataDirectory, environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join24(dataDirectory, "workspace");
+  return configuredWorkspace ?? join26(dataDirectory, "workspace");
 }
 function withRuntimeEnvironment(agent, environment) {
   const launchEnvironment = {};
@@ -91774,9 +91848,9 @@ var init_runtime_installation_store = __esm({
 // src/storage/daemon/version-data.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { cp as cp2, lstat as lstat4, mkdtemp, readFile as readFile7, rename as rename4, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join25, relative as relative2, sep as sep5 } from "node:path";
+import { join as join27, relative as relative2, sep as sep5 } from "node:path";
 async function readCurrentDataVersion(root, signal) {
-  const pointer = join25(root, STATE_ROOT_LAYOUT.currentData);
+  const pointer = join27(root, STATE_ROOT_LAYOUT.currentData);
   try {
     await validateLocalPath(pointer, false, true, signal);
     const value = (await readFile7(pointer, { encoding: "utf8", signal })).trim();
@@ -91793,7 +91867,7 @@ async function readCurrentDataVersion(root, signal) {
 }
 async function versionDataExists(root, version2, signal) {
   try {
-    await validateLocalPath(join25(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
+    await validateLocalPath(join27(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
     return true;
   } catch (cause) {
     if (!isNodeError(cause, "ENOENT")) {
@@ -91807,13 +91881,13 @@ function nestedRootEntry(segments) {
 }
 async function copyVersionData(root, sourceVersion, targetVersion, signal) {
   const leftBehind = [];
-  const versions = join25(root, STATE_ROOT_LAYOUT.versions);
-  const source = join25(versions, sourceVersion);
-  const target = join25(versions, targetVersion);
+  const versions = join27(root, STATE_ROOT_LAYOUT.versions);
+  const source = join27(versions, sourceVersion);
+  const target = join27(versions, targetVersion);
   await validateLocalPath(root, true, true, signal);
   await validateLocalPath(versions, true, true, signal);
   await validateLocalPath(source, true, true, signal);
-  const staging = await mkdtemp(join25(versions, `.${targetVersion}-`));
+  const staging = await mkdtemp(join27(versions, `.${targetVersion}-`));
   try {
     await cp2(source, staging, {
       recursive: true,
@@ -91850,10 +91924,10 @@ async function discardVersionData(root, version2, signal) {
   if (await readCurrentDataVersion(root, signal) === version2 || !await versionDataExists(root, version2, signal)) {
     return;
   }
-  const versions = join25(root, STATE_ROOT_LAYOUT.versions);
-  const discarded = join25(versions, `.${version2}-discarded-${randomUUID14()}`);
+  const versions = join27(root, STATE_ROOT_LAYOUT.versions);
+  const discarded = join27(versions, `.${version2}-discarded-${randomUUID14()}`);
   try {
-    await rename4(join25(versions, version2), discarded);
+    await rename4(join27(versions, version2), discarded);
   } catch (cause) {
     if (isNodeError(cause, "ENOENT")) {
       return;
@@ -91864,13 +91938,13 @@ async function discardVersionData(root, version2, signal) {
 }
 async function writeCurrentDataVersion(root, version2, signal) {
   await validateLocalPath(root, true, true, signal);
-  await validateLocalPath(join25(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
-  const temporary = join25(root, `.current-data-${randomUUID14()}.txt`);
+  await validateLocalPath(join27(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
+  const temporary = join27(root, `.current-data-${randomUUID14()}.txt`);
   try {
     await writeFile2(temporary, `versions/${version2}
 `, { mode: 384, flag: "wx", signal });
     signal.throwIfAborted();
-    await rename4(temporary, join25(root, STATE_ROOT_LAYOUT.currentData));
+    await rename4(temporary, join27(root, STATE_ROOT_LAYOUT.currentData));
   } finally {
     await rm3(temporary, { force: true });
   }
@@ -91891,7 +91965,7 @@ var init_version_data = __esm({
 
 // src/daemon/pairing/pair-local-machine.ts
 import { hostname as hostname3 } from "node:os";
-import { basename as basename7, join as join26, resolve as resolve16 } from "node:path";
+import { basename as basename7, join as join28, resolve as resolve16 } from "node:path";
 import { fetch as fetch3 } from "undici";
 function hasExactKeys2(value, expectedKeys) {
   const keys = Object.keys(value);
@@ -92152,7 +92226,7 @@ async function openMobiusVersionInstallation(version2, signal, environment) {
   return await openRuntimeInstallationStore(
     {
       applicationId: MOBIUS_CLI_APPLICATION_ID,
-      stateDirectory: join26(readStateDirectory(environment), "versions", version2)
+      stateDirectory: join28(readStateDirectory(environment), "versions", version2)
     },
     signal
   );
@@ -92425,9 +92499,9 @@ var init_agents = __esm({
 
 // src/storage/daemon/manager-lock.ts
 import { readFile as readFile8, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join29 } from "node:path";
 async function acquireManagerLock(stateDirectory, name2 = "manager.lock") {
-  const path8 = join27(stateDirectory, name2);
+  const path8 = join29(stateDirectory, name2);
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       await writeFile3(path8, `${process.pid.toString()}
@@ -92456,7 +92530,7 @@ async function acquireManagerLock(stateDirectory, name2 = "manager.lock") {
 }
 async function managerLockExists(stateDirectory) {
   try {
-    await readFile8(join27(stateDirectory, "manager.lock"), "utf8");
+    await readFile8(join29(stateDirectory, "manager.lock"), "utf8");
     return true;
   } catch (cause) {
     if (isNodeError(cause, "ENOENT")) {
@@ -92475,9 +92549,9 @@ var init_manager_lock = __esm({
 // src/storage/daemon/control-token.ts
 import { randomBytes } from "node:crypto";
 import { readFile as readFile9, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join30 } from "node:path";
 function controlTokenPath(stateDirectory) {
-  return join28(stateDirectory, "manager.token");
+  return join30(stateDirectory, "manager.token");
 }
 async function readOrCreateControlToken(stateDirectory) {
   const path8 = controlTokenPath(stateDirectory);
@@ -92801,7 +92875,7 @@ var init_data = __esm({
 
 // src/storage/logs/bounded-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync9, renameSync as renameSync2, statSync as statSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join31 } from "node:path";
 var BoundedLineLog;
 var init_bounded_log = __esm({
   "src/storage/logs/bounded-log.ts"() {
@@ -92814,7 +92888,7 @@ var init_bounded_log = __esm({
       #onWriteFailure;
       constructor(directory, filename, maximumBytes, onWriteFailure = () => void 0) {
         this.#directory = directory;
-        this.#path = join29(directory, filename);
+        this.#path = join31(directory, filename);
         this.#maximumBytes = maximumBytes;
         this.#onWriteFailure = onWriteFailure;
       }
@@ -92868,19 +92942,19 @@ var init_bounded_log = __esm({
 // src/storage/logs/log-files.ts
 import { readFileSync as readFileSync10 } from "node:fs";
 import { lstat as lstat5, readdir as readdir6, readFile as readFile10 } from "node:fs/promises";
-import { join as join30, relative as relative3 } from "node:path";
+import { join as join32, relative as relative3 } from "node:path";
 function unhandledRejectionLogFilename(role) {
   return `unhandled-rejections-${role}.log`;
 }
 function logDirectory(stateDirectory) {
-  return join30(stateDirectory, "logs");
+  return join32(stateDirectory, "logs");
 }
 function processLogPaths(stateDirectory) {
   return [
     WORKER_LIFECYCLE_LOG_FILENAME,
     unhandledRejectionLogFilename("manager"),
     unhandledRejectionLogFilename("worker")
-  ].map((filename) => join30(logDirectory(stateDirectory), filename));
+  ].map((filename) => join32(logDirectory(stateDirectory), filename));
 }
 function readLogText(path8) {
   try {
@@ -92893,17 +92967,17 @@ function isAbsent(cause) {
   return typeof cause === "object" && cause !== null && Reflect.get(cause, "code") === "ENOENT";
 }
 async function findLogDirectories(root, unreadable, signal) {
-  const versions = join30(root, VERSIONS_DIRECTORY);
-  const installationsRoots = [join30(root, INSTALLATIONS_DIRECTORY)];
+  const versions = join32(root, VERSIONS_DIRECTORY);
+  const installationsRoots = [join32(root, INSTALLATIONS_DIRECTORY)];
   for (const version2 of await listDirectories(versions, root, unreadable, signal)) {
-    installationsRoots.push(join30(versions, version2, INSTALLATIONS_DIRECTORY));
+    installationsRoots.push(join32(versions, version2, INSTALLATIONS_DIRECTORY));
   }
   const found = [];
   for (const installations of installationsRoots) {
     for (const applicationId of await listDirectories(installations, root, unreadable, signal)) {
-      const application = join30(installations, applicationId);
+      const application = join32(installations, applicationId);
       for (const installationId2 of await listDirectories(application, root, unreadable, signal)) {
-        const logs = join30(application, installationId2, "logs");
+        const logs = join32(application, installationId2, "logs");
         const status = await directoryStatus(logs);
         if (status === "listed") {
           found.push(logs);
@@ -93511,13 +93585,13 @@ var init_manager2 = __esm({
 
 // src/storage/daemon/release-files.ts
 import { readFile as readFile11, realpath as realpath8 } from "node:fs/promises";
-import { join as join31 } from "node:path";
+import { join as join33 } from "node:path";
 function releasePrefix(version2) {
-  return join31(readStateDirectory(), STATE_ROOT_LAYOUT.releases, version2);
+  return join33(readStateDirectory(), STATE_ROOT_LAYOUT.releases, version2);
 }
 async function readInstalledRelease(prefix) {
-  const packageRoot = await realpath8(join31(prefix, "node_modules", "@moxt-ai", "mobius"));
-  return { manifest: await readFile11(join31(packageRoot, "package.json"), "utf8"), packageRoot };
+  const packageRoot = await realpath8(join33(prefix, "node_modules", "@moxt-ai", "mobius"));
+  return { manifest: await readFile11(join33(packageRoot, "package.json"), "utf8"), packageRoot };
 }
 var init_release_files = __esm({
   "src/storage/daemon/release-files.ts"() {
@@ -93528,7 +93602,7 @@ var init_release_files = __esm({
 });
 
 // src/daemon/upgrades/package.ts
-import { isAbsolute as isAbsolute16, join as join32, relative as relative4 } from "node:path";
+import { isAbsolute as isAbsolute16, join as join34, relative as relative4 } from "node:path";
 async function prepareDaemonReleaseVersion(version2, signal) {
   runtimeUpgradeVersionSchema.parse(version2);
   signal.throwIfAborted();
@@ -93609,7 +93683,7 @@ async function verifyInstalledDaemonRelease(installed, prefix, version2, signal)
     bin: external_exports.object({ mobius: external_exports.literal("dist/cli.js") }),
     engines: external_exports.object({ node: external_exports.string().refine((value) => (0, import_semver.validRange)(value) !== null) })
   }).parse(JSON.parse(installed.manifest));
-  const entry = await canonicalPath(join32(installed.packageRoot, metadata.bin.mobius));
+  const entry = await canonicalPath(join34(installed.packageRoot, metadata.bin.mobius));
   const resolved = relative4(await canonicalPath(prefix), entry);
   if (resolved.startsWith("..") || isAbsolute16(resolved)) {
     throw new Error("Installed entry escaped npm prefix");
@@ -98127,7 +98201,7 @@ var init_session_turns = __esm({
 
 // src/session/workspace/workspace-directory.ts
 import { homedir as homedir4 } from "node:os";
-import { basename as basename8, dirname as dirname11, isAbsolute as isAbsolute17, join as join33, normalize as normalize2, relative as relative5 } from "node:path";
+import { basename as basename8, dirname as dirname11, isAbsolute as isAbsolute17, join as join35, normalize as normalize2, relative as relative5 } from "node:path";
 function encodePath(path8) {
   const encoded = Buffer.from(path8, "utf8").toString("base64url");
   if (path8.length === 0 || path8.length > MAX_WORKSPACE_PATH_LENGTH || encoded.length + "path-".length > MAX_DIRECTORY_IDENTIFIER_LENGTH) {
@@ -98256,7 +98330,7 @@ var init_workspace_directory = __esm({
               continue;
             }
             try {
-              const path8 = await this.resolvePath(join33(target, child.name), signal);
+              const path8 = await this.resolvePath(join35(target, child.name), signal);
               entries.push({ directoryId: encodePath(path8), name: child.name });
             } catch (cause) {
               signal.throwIfAborted();
@@ -98428,7 +98502,7 @@ var init_session_layer = __esm({
 // src/storage/files/scratch-directory.ts
 import { randomUUID as randomUUID18 } from "node:crypto";
 import { lstat as lstat6, mkdir as mkdir5, readdir as readdir7, readFile as readFile12, realpath as realpath9, rename as rename5, rm as rm4, stat as stat8, utimes, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { dirname as dirname12, join as join36 } from "node:path";
 async function atomicWrite(path8, bytes, signal) {
   const temporary = `${path8}.${randomUUID18()}.tmp`;
   try {
@@ -98446,7 +98520,7 @@ var init_scratch_directory = __esm({
     ScratchDirectory = class {
       #root;
       constructor(parent) {
-        this.#root = join34(parent, randomUUID18());
+        this.#root = join36(parent, randomUUID18());
       }
       /** Refreshes this directory's lease and removes sibling directories whose lease is older than `leaseMilliseconds`. */
       refreshLease = async (leaseMilliseconds) => {
@@ -98457,7 +98531,7 @@ var init_scratch_directory = __esm({
           if (!directory.isDirectory() || !/^[a-f0-9-]{36}$/u.test(directory.name)) {
             continue;
           }
-          const path8 = join34(dirname12(this.#root), directory.name);
+          const path8 = join36(dirname12(this.#root), directory.name);
           if (path8 === this.#root) {
             continue;
           }
@@ -98472,10 +98546,10 @@ var init_scratch_directory = __esm({
       };
       /** Writes `bytes` atomically to `<group>/<name>` with owner-only permissions and returns the path. */
       write = async (group, name2, bytes, signal) => {
-        const directory = join34(this.#root, group);
+        const directory = join36(this.#root, group);
         await mkdir5(directory, { mode: 448, recursive: true });
         signal.throwIfAborted();
-        const path8 = join34(directory, name2);
+        const path8 = join36(directory, name2);
         await atomicWrite(path8, bytes, signal);
         return path8;
       };
@@ -98510,7 +98584,7 @@ var init_scratch_directory = __esm({
 
 // src/session/content/external-content-store.ts
 import { createHash as createHash8 } from "node:crypto";
-import { join as join35 } from "node:path";
+import { join as join37 } from "node:path";
 var contentRequest, CONTENT_LIFETIME_MILLISECONDS, metadataSchema, LocalExternalContentStore;
 var init_external_content_store = __esm({
   "src/session/content/external-content-store.ts"() {
@@ -98532,7 +98606,7 @@ var init_external_content_store = __esm({
       #expirationTimer;
       #cleanup = Promise.resolve();
       constructor(stateDirectory) {
-        this.#scratch = new ScratchDirectory(join35(stateDirectory, "tmp", "session-content"));
+        this.#scratch = new ScratchDirectory(join37(stateDirectory, "tmp", "session-content"));
         this.#expirationTimer = setInterval(() => {
           void this.#expire().catch(() => void 0);
         }, 6e4);
@@ -98937,7 +99011,7 @@ var init_agent_process_pool = __esm({
 });
 
 // src/runtime/observability/diagnostic-log.ts
-import { join as join36 } from "node:path";
+import { join as join38 } from "node:path";
 function exportedFields(value) {
   const entry = {};
   for (const field of REMOTE_DIAGNOSTIC_FIELDS) {
@@ -99006,7 +99080,7 @@ var init_diagnostic_log = __esm({
         this.#maximumBytes = maximumBytes;
         const processLogsDirectory = options.processLogsDirectory;
         this.#sources = [
-          { maximumBytes, path: join36(directory, DAEMON_LOG_FILENAME) },
+          { maximumBytes, path: join38(directory, DAEMON_LOG_FILENAME) },
           // The process logs a Runtime does not own, but must read to explain its own deaths.
           ...processLogsDirectory === void 0 ? [] : processLogPaths(processLogsDirectory).map((path8) => ({ maximumBytes: null, path: path8 }))
         ];
@@ -100046,7 +100120,7 @@ var init_content_write = __esm({
 });
 
 // src/session/content/session-files.ts
-import { basename as basename9, extname as extname2, isAbsolute as isAbsolute18, join as join37, normalize as normalize3, resolve as resolve18 } from "node:path";
+import { basename as basename9, extname as extname2, isAbsolute as isAbsolute18, join as join39, normalize as normalize3, resolve as resolve18 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function requestedPath(value) {
   if (value.includes("\0")) {
@@ -100070,7 +100144,7 @@ async function resolveFile(value, workingDirectory, signal) {
   if (isAbsolute18(requested.path) && normalize3(requested.path) !== requested.path) {
     return null;
   }
-  const candidates = requested.explicitUrl || workingDirectory === null ? [requested.path] : isAbsolute18(requested.path) ? [join37(workingDirectory, requested.path), requested.path] : [resolve18(workingDirectory, requested.path)];
+  const candidates = requested.explicitUrl || workingDirectory === null ? [requested.path] : isAbsolute18(requested.path) ? [join39(workingDirectory, requested.path), requested.path] : [resolve18(workingDirectory, requested.path)];
   for (const candidate of candidates) {
     if (!isAbsolute18(candidate) || normalize3(candidate) !== candidate) {
       continue;
@@ -103117,7 +103191,7 @@ var init_daemon = __esm({
 });
 
 // src/cli/handler/logs/logic/collect-local-logs.ts
-import { join as join38, relative as relative6, resolve as resolve19 } from "node:path";
+import { join as join40, relative as relative6, resolve as resolve19 } from "node:path";
 async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   signal.throwIfAborted();
   const root = resolve19(stateDirectory);
@@ -103127,7 +103201,7 @@ async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   for (const directory of directories) {
     const names = await listLogFiles(directory, root, unreadable);
     for (const name2 of names) {
-      const path8 = join38(directory, name2);
+      const path8 = join40(directory, name2);
       const reported = relative6(root, path8);
       const read = await readOwnedLogFile(path8, signal);
       if (read.kind === "unreadable") {