@mrrlin-dev/mcp 0.4.57 → 0.4.60

package/dist/bin.cjs

@@ -7729,14 +7729,14 @@ var require_polyfills = __commonJS({
       fs11.fstatSync = statFixSync(fs11.fstatSync);
       fs11.lstatSync = statFixSync(fs11.lstatSync);
       if (fs11.chmod && !fs11.lchmod) {
-        fs11.lchmod = function(path24, mode, cb) {
+        fs11.lchmod = function(path25, mode, cb) {
           if (cb) process.nextTick(cb);
         };
         fs11.lchmodSync = function() {
         };
       }
       if (fs11.chown && !fs11.lchown) {
-        fs11.lchown = function(path24, uid, gid, cb) {
+        fs11.lchown = function(path25, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
         fs11.lchownSync = function() {
@@ -7803,9 +7803,9 @@ var require_polyfills = __commonJS({
         };
       }(fs11.readSync);
       function patchLchmod(fs12) {
-        fs12.lchmod = function(path24, mode, callback) {
+        fs12.lchmod = function(path25, mode, callback) {
           fs12.open(
-            path24,
+            path25,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -7821,8 +7821,8 @@ var require_polyfills = __commonJS({
             }
           );
         };
-        fs12.lchmodSync = function(path24, mode) {
-          var fd = fs12.openSync(path24, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs12.lchmodSync = function(path25, mode) {
+          var fd = fs12.openSync(path25, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
@@ -7843,8 +7843,8 @@ var require_polyfills = __commonJS({
       }
       function patchLutimes(fs12) {
         if (constants2.hasOwnProperty("O_SYMLINK") && fs12.futimes) {
-          fs12.lutimes = function(path24, at, mt, cb) {
-            fs12.open(path24, constants2.O_SYMLINK, function(er, fd) {
+          fs12.lutimes = function(path25, at, mt, cb) {
+            fs12.open(path25, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
@@ -7856,8 +7856,8 @@ var require_polyfills = __commonJS({
               });
             });
           };
-          fs12.lutimesSync = function(path24, at, mt) {
-            var fd = fs12.openSync(path24, constants2.O_SYMLINK);
+          fs12.lutimesSync = function(path25, at, mt) {
+            var fd = fs12.openSync(path25, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
@@ -7975,11 +7975,11 @@ var require_legacy_streams = __commonJS({
         ReadStream,
         WriteStream
       };
-      function ReadStream(path24, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path24, options);
+      function ReadStream(path25, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path25, options);
         Stream.call(this);
         var self = this;
-        this.path = path24;
+        this.path = path25;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -8024,10 +8024,10 @@ var require_legacy_streams = __commonJS({
           self._read();
         });
       }
-      function WriteStream(path24, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path24, options);
+      function WriteStream(path25, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path25, options);
         Stream.call(this);
-        this.path = path24;
+        this.path = path25;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -8170,14 +8170,14 @@ var require_graceful_fs = __commonJS({
       fs12.createWriteStream = createWriteStream;
       var fs$readFile = fs12.readFile;
       fs12.readFile = readFile9;
-      function readFile9(path24, options, cb) {
+      function readFile9(path25, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path24, options, cb);
-        function go$readFile(path25, options2, cb2, startTime) {
-          return fs$readFile(path25, options2, function(err) {
+        return go$readFile(path25, options, cb);
+        function go$readFile(path26, options2, cb2, startTime) {
+          return fs$readFile(path26, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path25, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path26, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -8187,14 +8187,14 @@ var require_graceful_fs = __commonJS({
       }
       var fs$writeFile = fs12.writeFile;
       fs12.writeFile = writeFile5;
-      function writeFile5(path24, data, options, cb) {
+      function writeFile5(path25, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path24, data, options, cb);
-        function go$writeFile(path25, data2, options2, cb2, startTime) {
-          return fs$writeFile(path25, data2, options2, function(err) {
+        return go$writeFile(path25, data, options, cb);
+        function go$writeFile(path26, data2, options2, cb2, startTime) {
+          return fs$writeFile(path26, data2, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path25, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path26, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -8205,14 +8205,14 @@ var require_graceful_fs = __commonJS({
       var fs$appendFile = fs12.appendFile;
       if (fs$appendFile)
         fs12.appendFile = appendFile2;
-      function appendFile2(path24, data, options, cb) {
+      function appendFile2(path25, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path24, data, options, cb);
-        function go$appendFile(path25, data2, options2, cb2, startTime) {
-          return fs$appendFile(path25, data2, options2, function(err) {
+        return go$appendFile(path25, data, options, cb);
+        function go$appendFile(path26, data2, options2, cb2, startTime) {
+          return fs$appendFile(path26, data2, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path25, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path26, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -8243,31 +8243,31 @@ var require_graceful_fs = __commonJS({
       var fs$readdir = fs12.readdir;
       fs12.readdir = readdir5;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir5(path24, options, cb) {
+      function readdir5(path25, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path25, options2, cb2, startTime) {
-          return fs$readdir(path25, fs$readdirCallback(
-            path25,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path26, options2, cb2, startTime) {
+          return fs$readdir(path26, fs$readdirCallback(
+            path26,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path25, options2, cb2, startTime) {
-          return fs$readdir(path25, options2, fs$readdirCallback(
-            path25,
+        } : function go$readdir2(path26, options2, cb2, startTime) {
+          return fs$readdir(path26, options2, fs$readdirCallback(
+            path26,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path24, options, cb);
-        function fs$readdirCallback(path25, options2, cb2, startTime) {
+        return go$readdir(path25, options, cb);
+        function fs$readdirCallback(path26, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path25, options2, cb2],
+                [path26, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -8338,7 +8338,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path24, options) {
+      function ReadStream(path25, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -8358,7 +8358,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path24, options) {
+      function WriteStream(path25, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -8376,22 +8376,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream2(path24, options) {
-        return new fs12.ReadStream(path24, options);
+      function createReadStream2(path25, options) {
+        return new fs12.ReadStream(path25, options);
       }
-      function createWriteStream(path24, options) {
-        return new fs12.WriteStream(path24, options);
+      function createWriteStream(path25, options) {
+        return new fs12.WriteStream(path25, options);
       }
       var fs$open = fs12.open;
       fs12.open = open;
-      function open(path24, flags, mode, cb) {
+      function open(path25, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path24, flags, mode, cb);
-        function go$open(path25, flags2, mode2, cb2, startTime) {
-          return fs$open(path25, flags2, mode2, function(err, fd) {
+        return go$open(path25, flags, mode, cb);
+        function go$open(path26, flags2, mode2, cb2, startTime) {
+          return fs$open(path26, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path25, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path26, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -8920,7 +8920,7 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js"(exports2, module2) {
     "use strict";
-    var path24 = require("path");
+    var path25 = require("path");
     var fs11 = require_graceful_fs();
     var retry = require_retry2();
     var onExit = require_signal_exit();
@@ -8931,7 +8931,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file2, options, callback) {
       if (!options.realpath) {
-        return callback(null, path24.resolve(file2));
+        return callback(null, path25.resolve(file2));
       }
       options.fs.realpath(file2, callback);
     }
@@ -10795,10 +10795,10 @@ var require_segments = __commonJS({
       const segs = getSegmentsFromString(data, Utils.isKanjiModeEnabled());
       const nodes = buildNodes(segs);
       const graph = buildGraph(nodes, version2);
-      const path24 = dijkstra.find_path(graph.map, "start", "end");
+      const path25 = dijkstra.find_path(graph.map, "start", "end");
       const optimizedSegs = [];
-      for (let i = 1; i < path24.length - 1; i++) {
-        optimizedSegs.push(graph.table[path24[i]].node);
+      for (let i = 1; i < path25.length - 1; i++) {
+        optimizedSegs.push(graph.table[path25[i]].node);
       }
       return exports2.fromArray(mergeSegments(optimizedSegs));
     };
@@ -13275,7 +13275,7 @@ var require_png2 = __commonJS({
       });
       png.pack();
     };
-    exports2.renderToFile = function renderToFile(path24, qrData, options, cb) {
+    exports2.renderToFile = function renderToFile(path25, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -13286,7 +13286,7 @@ var require_png2 = __commonJS({
         called = true;
         cb.apply(null, args);
       };
-      const stream = fs11.createWriteStream(path24);
+      const stream = fs11.createWriteStream(path25);
       stream.on("error", done);
       stream.on("close", done);
       exports2.renderToFileStream(stream, qrData, options);
@@ -13348,14 +13348,14 @@ var require_utf8 = __commonJS({
       }
       return output3;
     };
-    exports2.renderToFile = function renderToFile(path24, qrData, options, cb) {
+    exports2.renderToFile = function renderToFile(path25, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
       }
       const fs11 = require("fs");
       const utf8 = exports2.render(qrData, options);
-      fs11.writeFile(path24, utf8, cb);
+      fs11.writeFile(path25, utf8, cb);
     };
   }
 });
@@ -13476,7 +13476,7 @@ var require_svg_tag = __commonJS({
       return str;
     }
     function qrToPath(data, size, margin) {
-      let path24 = "";
+      let path25 = "";
       let moveBy = 0;
       let newRow = false;
       let lineLength = 0;
@@ -13487,19 +13487,19 @@ var require_svg_tag = __commonJS({
         if (data[i]) {
           lineLength++;
           if (!(i > 0 && col > 0 && data[i - 1])) {
-            path24 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
+            path25 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
             moveBy = 0;
             newRow = false;
           }
           if (!(col + 1 < size && data[i + 1])) {
-            path24 += svgCmd("h", lineLength);
+            path25 += svgCmd("h", lineLength);
             lineLength = 0;
           }
         } else {
           moveBy++;
         }
       }
-      return path24;
+      return path25;
     }
     exports2.render = function render(qrData, options, cb) {
       const opts = Utils.getOptions(options);
@@ -13507,10 +13507,10 @@ var require_svg_tag = __commonJS({
       const data = qrData.modules.data;
       const qrcodesize = size + opts.margin * 2;
       const bg = !opts.color.light.a ? "" : "<path " + getColorAttrib(opts.color.light, "fill") + ' d="M0 0h' + qrcodesize + "v" + qrcodesize + 'H0z"/>';
-      const path24 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
+      const path25 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
       const viewBox = 'viewBox="0 0 ' + qrcodesize + " " + qrcodesize + '"';
       const width = !opts.width ? "" : 'width="' + opts.width + '" height="' + opts.width + '" ';
-      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path24 + "</svg>\n";
+      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path25 + "</svg>\n";
       if (typeof cb === "function") {
         cb(null, svgTag);
       }
@@ -13524,7 +13524,7 @@ var require_svg = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/renderer/svg.js"(exports2) {
     var svgTagRenderer = require_svg_tag();
     exports2.render = svgTagRenderer.render;
-    exports2.renderToFile = function renderToFile(path24, qrData, options, cb) {
+    exports2.renderToFile = function renderToFile(path25, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -13532,7 +13532,7 @@ var require_svg = __commonJS({
       const fs11 = require("fs");
       const svgTag = exports2.render(qrData, options);
       const xmlStr = '<?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">' + svgTag;
-      fs11.writeFile(path24, xmlStr, cb);
+      fs11.writeFile(path25, xmlStr, cb);
     };
   }
 });
@@ -13690,8 +13690,8 @@ var require_server = __commonJS({
         cb
       };
     }
-    function getTypeFromFilename(path24) {
-      return path24.slice((path24.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
+    function getTypeFromFilename(path25) {
+      return path25.slice((path25.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
     }
     function getRendererFromType(type) {
       switch (type) {
@@ -13755,17 +13755,17 @@ var require_server = __commonJS({
       const renderer = getRendererFromType(params.opts.type);
       return render(renderer.renderToBuffer, text, params);
     };
-    exports2.toFile = function toFile(path24, text, opts, cb) {
-      if (typeof path24 !== "string" || !(typeof text === "string" || typeof text === "object")) {
+    exports2.toFile = function toFile(path25, text, opts, cb) {
+      if (typeof path25 !== "string" || !(typeof text === "string" || typeof text === "object")) {
         throw new Error("Invalid argument");
       }
       if (arguments.length < 3 && !canPromise()) {
         throw new Error("Too few arguments provided");
       }
       const params = checkParams(text, opts, cb);
-      const type = params.opts.type || getTypeFromFilename(path24);
+      const type = params.opts.type || getTypeFromFilename(path25);
       const renderer = getRendererFromType(type);
-      const renderToFile = renderer.renderToFile.bind(null, path24);
+      const renderToFile = renderer.renderToFile.bind(null, path25);
       return render(renderToFile, text, params);
     };
     exports2.toFileStream = function toFileStream(stream, text, opts) {
@@ -16983,8 +16983,8 @@ var require_utils3 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path24) {
-      let input = path24;
+    function removeDotSegments(path25) {
+      let input = path25;
       const output3 = [];
       let nextSlash = -1;
       let len = 0;
@@ -17236,8 +17236,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path24, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path24 && path24 !== "/" ? path24 : void 0;
+        const [path25, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path25 && path25 !== "/" ? path25 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -20644,11 +20644,11 @@ var require_dist = __commonJS({
 });
 
 // src/bin.ts
-var import_node_path36 = __toESM(require("node:path"), 1);
-var import_node_child_process18 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_os18 = require("node:os");
 var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_child_process18 = require("node:child_process");
+var import_node_fs24 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path38 = __toESM(require("node:path"), 1);
 
 // src/install-codex.ts
 var import_promises = __toESM(require("node:fs/promises"), 1);
@@ -21636,10 +21636,10 @@ async function verifyProviderReadiness(provider, run3, opts = {}) {
 }
 
 // src/director-bridge.ts
-var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_fs22 = __toESM(require("node:fs"), 1);
 var import_node_http = __toESM(require("node:http"), 1);
-var import_node_os14 = __toESM(require("node:os"), 1);
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_os15 = __toESM(require("node:os"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 var import_node_child_process15 = require("node:child_process");
 var import_node_crypto11 = __toESM(require("node:crypto"), 1);
 
@@ -23201,10 +23201,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path24) {
-  if (!path24)
+function getElementAtPath(obj, path25) {
+  if (!path25)
     return obj;
-  return path24.reduce((acc, key) => acc?.[key], obj);
+  return path25.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -23613,11 +23613,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path24, issues) {
+function prefixIssues(path25, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path24);
+    iss.path.unshift(path25);
     return iss;
   });
 }
@@ -23764,16 +23764,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path24 = []) => {
+  const processError = (error52, path25 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else {
-        const fullpath = [...path24, ...issue2.path];
+        const fullpath = [...path25, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -23800,17 +23800,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path24 = []) => {
+  const processError = (error52, path25 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else {
-        const fullpath = [...path24, ...issue2.path];
+        const fullpath = [...path25, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -23842,8 +23842,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path24 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path24) {
+  const path25 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path25) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -36535,13 +36535,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path24 = ref.slice(1).split("/").filter(Boolean);
-  if (path24.length === 0) {
+  const path25 = ref.slice(1).split("/").filter(Boolean);
+  if (path25.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path24[0] === defsKey) {
-    const key = path24[1];
+  if (path25[0] === defsKey) {
+    const key = path25[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -36969,7 +36969,7 @@ var ARTIFACT_CHECKS = {
 var ARTIFACT_DESTINATIONS = {
   document: "wiki",
   page: "git",
-  file_set: null,
+  file_set: "artifacts",
   code_change: "git",
   structured_data: null,
   message: null
@@ -36978,6 +36978,52 @@ function resolveKindCapability(kind) {
   return ARTIFACT_DESTINATIONS[kind];
 }
 
+// ../../packages/schemas/dist/capability-refusal.js
+var REFUSAL_TEMPLATES = {
+  no_route: {
+    happened: ({ artifactKind, projectSlug }) => `Nothing is configured to deliver \`${artifactKind}\` for project \`${projectSlug}\`.`,
+    action: ({ capability }) => `Grant an MCP server that provides the "${capability}" capability and route it on the Integrations page. Retrying before that will refuse identically.`
+  },
+  no_grant: {
+    happened: ({ projectSlug, capability }) => `Project \`${projectSlug}\` routes "${capability}" to a server whose access has been revoked.`,
+    action: () => "Grant that server again on the Integrations page, or re-point the route. Retrying before that will refuse identically."
+  },
+  project_mismatch: {
+    happened: ({ capability }) => `The route for "${capability}" belongs to a different project than this task does.`,
+    action: () => "Mrrlin refuses rather than delivering one project's work into another project's destination. Re-point the route in the task's own project."
+  },
+  ambiguous_route: {
+    happened: ({ projectSlug, artifactKind }) => `Project \`${projectSlug}\` has more than one route that delivers \`${artifactKind}\`.`,
+    action: () => "Mrrlin will not guess which one. Name the capability explicitly, or remove the route you do not want."
+  },
+  blocked_kind: {
+    happened: ({ artifactKind }) => `Mrrlin has no destination for \`${artifactKind}\` yet.`,
+    action: () => "Produce a kind that does have one, or record the result on the task instead."
+  },
+  gate_refused: {
+    happened: ({ projectSlug }) => `The operator declined this action for project \`${projectSlug}\`.`,
+    action: () => "This is an answer, not a failure \u2014 do not retry it. Ask the operator directly if it should be allowed."
+  },
+  transport_error: {
+    happened: () => "Mrrlin could not reach the service that decides whether this delivery is allowed, so nothing was sent.",
+    action: () => "This is safe to retry."
+  },
+  delivery_failed: {
+    happened: ({ projectSlug }) => `The delivery was allowed, but the destination itself failed for project \`${projectSlug}\`.`,
+    action: () => "It may have partly completed, so do not blindly retry \u2014 check whether the result already exists first."
+  }
+};
+function describeCapabilityRefusal(input) {
+  const ctx = {
+    projectSlug: input.projectSlug,
+    capability: input.capability ?? "the requested capability",
+    artifactKind: input.artifactKind ?? "this artifact kind"
+  };
+  const template = REFUSAL_TEMPLATES[input.reason];
+  const happened = typeof input.detail === "string" && input.detail.length > 0 ? input.detail : template.happened(ctx);
+  return `${happened} ${template.action(ctx)}`;
+}
+
 // ../../packages/schemas/dist/operationIds.js
 var openApiOperationIds = {
   appendExecutionArtifact: "appendExecutionArtifact",
@@ -40855,18 +40901,18 @@ function createMrrlinClient(config2) {
   const customFetch = config2.fetch ?? globalThis.fetch;
   const baseUrl = config2.baseUrl.replace(/\/$/, "");
   const token = config2.token;
-  async function request(path24, init) {
+  async function request(path25, init) {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers ?? {});
     if (token && !headers.has("authorization")) {
       headers.set("authorization", `Bearer ${token}`);
     }
-    const response = await customFetch(`${baseUrl}${path24}`, { ...init, headers });
+    const response = await customFetch(`${baseUrl}${path25}`, { ...init, headers });
     if (!response.ok) {
       const body = await response.text();
       let code = `HTTP_${response.status}`;
       let violations = null;
-      let message = `Mrrlin API ${method} ${path24} failed: ${response.status}`;
+      let message = `Mrrlin API ${method} ${path25} failed: ${response.status}`;
       try {
         const parsed = JSON.parse(body);
         const violationsParsed = apiViolationsErrorSchema.safeParse(parsed);
@@ -40886,7 +40932,7 @@ function createMrrlinClient(config2) {
       throw new MrrlinApiError({
         code,
         method,
-        path: path24,
+        path: path25,
         responseBody: body,
         status: response.status,
         violations,
@@ -40895,18 +40941,18 @@ function createMrrlinClient(config2) {
     }
     return response.json();
   }
-  async function requestText(path24, init) {
+  async function requestText(path25, init) {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers ?? {});
     if (token && !headers.has("authorization")) {
       headers.set("authorization", `Bearer ${token}`);
     }
-    const response = await customFetch(`${baseUrl}${path24}`, { ...init, headers });
+    const response = await customFetch(`${baseUrl}${path25}`, { ...init, headers });
     if (!response.ok) {
       const body = await response.text();
       let code = `HTTP_${response.status}`;
       let violations = null;
-      let message = `Mrrlin API ${method} ${path24} failed: ${response.status}`;
+      let message = `Mrrlin API ${method} ${path25} failed: ${response.status}`;
       try {
         const parsed = JSON.parse(body);
         const violationsParsed = apiViolationsErrorSchema.safeParse(parsed);
@@ -40926,7 +40972,7 @@ function createMrrlinClient(config2) {
       throw new MrrlinApiError({
         code,
         method,
-        path: path24,
+        path: path25,
         responseBody: body,
         status: response.status,
         violations,
@@ -41191,16 +41237,16 @@ function createMrrlinClient(config2) {
     // rejected against the first, MrrlinTask[]-only overload) -- the `any` here is contained to
     // this one implementation signature; MrrlinClient's declared overloads keep callers precise.
     async listTasks(projectSlug, filters = {}, options) {
-      const path24 = buildTaskListPath(projectSlug, filters, options?.view);
-      const body = await request(path24);
+      const path25 = buildTaskListPath(projectSlug, filters, options?.view);
+      const body = await request(path25);
       if (options?.view === "summary") {
         return taskSummaryListResponseSchema.parse(body).data;
       }
       return taskListResponseSchema.parse(body).data;
     },
     async listTaskSummaries(projectSlug, filters = {}) {
-      const path24 = buildTaskListPath(projectSlug, filters, "summary");
-      const body = await request(path24);
+      const path25 = buildTaskListPath(projectSlug, filters, "summary");
+      const body = await request(path25);
       return taskSummaryListResponseSchema.parse(body).data;
     },
     async listTaxonomy(projectSlug) {
@@ -41208,22 +41254,22 @@ function createMrrlinClient(config2) {
       return taxonomyListResponseSchema.parse(body).data;
     },
     async listWikiPages(projectSlug, filters = {}) {
-      const path24 = appendQuery(`${projectPath(projectSlug)}/wiki`, {
+      const path25 = appendQuery(`${projectPath(projectSlug)}/wiki`, {
         folder: filters.folder,
         q: filters.q,
         taskId: filters.taskId
       });
-      const body = await request(path24);
+      const body = await request(path25);
       return wikiPageListResponseSchema.parse(body).data;
     },
     async searchWikiPages(projectSlug, query) {
-      const path24 = appendQuery(`${projectPath(projectSlug)}/wiki/search`, {
+      const path25 = appendQuery(`${projectPath(projectSlug)}/wiki/search`, {
         folder: query.folder,
         limit: query.limit === void 0 ? void 0 : String(query.limit),
         pathPrefix: query.pathPrefix,
         q: query.q
       });
-      const body = await request(path24);
+      const body = await request(path25);
       return wikiPageSearchResponseSchema.parse(body).data;
     },
     async updatePlan(projectSlug, planId, patch) {
@@ -42214,12 +42260,150 @@ function createTurnLock() {
 // src/self-update.ts
 var import_node_child_process7 = require("node:child_process");
 var import_node_crypto2 = require("node:crypto");
+var import_node_fs4 = require("node:fs");
+var import_node_path7 = __toESM(require("node:path"), 1);
+var import_semver3 = __toESM(require_semver2(), 1);
+
+// src/codex-auth-preflight.ts
 var import_node_fs3 = require("node:fs");
+var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_path6 = __toESM(require("node:path"), 1);
-var import_semver3 = __toESM(require_semver2(), 1);
+var DEFAULT_CODEX_AUTH_MIN_TTL_SECONDS = 15 * 60;
+function positiveInt(raw) {
+  if (!raw) return null;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function codexAuthMinTtlSeconds(env = process.env) {
+  return positiveInt(env.MRRLIN_DIRECTOR_BRIDGE_UPDATE_AUTH_MIN_TTL_SECONDS) ?? DEFAULT_CODEX_AUTH_MIN_TTL_SECONDS;
+}
+function resolveCodexAuthPath(opts = {}) {
+  const env = opts.env ?? process.env;
+  const codexHome = env.CODEX_HOME?.trim();
+  return import_node_path6.default.join(codexHome || import_node_path6.default.join(opts.homeDir ?? import_node_os6.default.homedir(), ".codex"), "auth.json");
+}
+function decodeJwtExpMs(token) {
+  const parts = token.split(".");
+  if (parts.length < 2 || !parts[1]) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function inspectCodexAuthForBridgeUpdate(opts = {}) {
+  const env = opts.env ?? process.env;
+  const nowMs = opts.nowMs ?? Date.now();
+  const minTtlSeconds = opts.minTtlSeconds ?? codexAuthMinTtlSeconds(env);
+  const authPath = resolveCodexAuthPath({ env, homeDir: opts.homeDir });
+  const readFile9 = opts.readFileSyncImpl ?? ((p, encoding) => (0, import_node_fs3.readFileSync)(p, encoding));
+  let raw;
+  try {
+    raw = readFile9(authPath, "utf8");
+  } catch (e) {
+    const code = typeof e === "object" && e !== null && "code" in e ? String(e.code) : "";
+    const status = code === "ENOENT" ? "missing" : "unreadable";
+    return {
+      ok: false,
+      status,
+      authPath,
+      checkedAtMs: nowMs,
+      minTtlSeconds,
+      tokenKinds: [],
+      expiresAtMs: null,
+      expiresInSeconds: null,
+      detail: status === "missing" ? "Codex CLI auth file is missing." : "Codex CLI auth file could not be read."
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      ok: false,
+      status: "malformed",
+      authPath,
+      checkedAtMs: nowMs,
+      minTtlSeconds,
+      tokenKinds: [],
+      expiresAtMs: null,
+      expiresInSeconds: null,
+      detail: "Codex CLI auth file is not valid JSON."
+    };
+  }
+  const tokenEntries = [
+    ["access_token", parsed.tokens?.access_token],
+    ["id_token", parsed.tokens?.id_token]
+  ];
+  const expiries = tokenEntries.flatMap(([kind, token]) => {
+    if (typeof token !== "string" || token.trim() === "") return [];
+    const expMs = decodeJwtExpMs(token);
+    return expMs === null ? [] : [{ kind, expMs }];
+  });
+  const earliest = expiries.reduce(
+    (current2, entry) => current2 === null || entry.expMs < current2.expMs ? entry : current2,
+    null
+  );
+  if (earliest === null) {
+    return {
+      ok: false,
+      status: "no_usable_jwt_exp",
+      authPath,
+      checkedAtMs: nowMs,
+      minTtlSeconds,
+      tokenKinds: [],
+      expiresAtMs: null,
+      expiresInSeconds: null,
+      detail: "Codex CLI auth file has no access_token or id_token JWT expiry to verify."
+    };
+  }
+  const expiresInSeconds = Math.floor((earliest.expMs - nowMs) / 1e3);
+  const tokenKinds = expiries.map((entry) => entry.kind).sort();
+  if (expiresInSeconds <= 0) {
+    return {
+      ok: false,
+      status: "expired",
+      authPath,
+      checkedAtMs: nowMs,
+      minTtlSeconds,
+      tokenKinds,
+      expiresAtMs: earliest.expMs,
+      expiresInSeconds,
+      detail: `Codex CLI ${earliest.kind} JWT is expired.`
+    };
+  }
+  if (expiresInSeconds < minTtlSeconds) {
+    return {
+      ok: false,
+      status: "expiring_soon",
+      authPath,
+      checkedAtMs: nowMs,
+      minTtlSeconds,
+      tokenKinds,
+      expiresAtMs: earliest.expMs,
+      expiresInSeconds,
+      detail: `Codex CLI ${earliest.kind} JWT expires too soon for a bridge update restart.`
+    };
+  }
+  return {
+    ok: true,
+    status: "ok",
+    authPath,
+    checkedAtMs: nowMs,
+    minTtlSeconds,
+    tokenKinds,
+    expiresAtMs: earliest.expMs,
+    expiresInSeconds,
+    detail: "Codex CLI JWT expiry is far enough in the future for a bridge update restart."
+  };
+}
+
+// src/self-update.ts
 var BIN_NAME = "mrrlin-mcp";
+var SELF_UPDATE_AUTH_PREFLIGHT_OFFER_PREFIX = "[bridge:update:auth-preflight]";
 function resolveBinPath(opts) {
-  if (opts.argv1 && import_node_path6.default.basename(opts.argv1).includes("mrrlin")) {
+  if (opts.argv1 && import_node_path7.default.basename(opts.argv1).includes("mrrlin")) {
     return { path: opts.argv1, source: "argv" };
   }
   const whichSync = opts.whichSync ?? ((name) => {
@@ -42229,15 +42413,15 @@ function resolveBinPath(opts) {
       return null;
     }
   });
-  const existsSync5 = opts.existsSync ?? import_node_fs3.existsSync;
+  const existsSync5 = opts.existsSync ?? import_node_fs4.existsSync;
   const resolved = whichSync(BIN_NAME);
   if (resolved && existsSync5(resolved)) {
     return { path: resolved, source: "which" };
   }
   const envPath = (opts.env ?? process.env).PATH ?? "";
-  for (const dir of envPath.split(import_node_path6.default.delimiter)) {
+  for (const dir of envPath.split(import_node_path7.default.delimiter)) {
     if (!dir) continue;
-    const candidate = import_node_path6.default.join(dir, BIN_NAME);
+    const candidate = import_node_path7.default.join(dir, BIN_NAME);
     if (existsSync5(candidate)) {
       return { path: candidate, source: "path-walk" };
     }
@@ -42249,6 +42433,7 @@ var DEFAULT_IDLE_MS = 2e3;
 var DEFAULT_REGISTRY_POLL_MS = 6 * 60 * 60 * 1e3;
 var DEFAULT_STARTUP_JITTER_MS = 30 * 1e3;
 var DEFAULT_COOLDOWN_MS = 48 * 60 * 60 * 1e3;
+var DEFAULT_AUTH_BLOCK_COOLDOWN_MS = 15 * 60 * 1e3;
 var REGISTRY_URL_DEFAULT = "https://registry.npmjs.org/@mrrlin-dev/mcp/latest";
 var STRICT_SEMVER = /^\d+\.\d+\.\d+(-[A-Za-z0-9.-]+)?(\+[A-Za-z0-9.-]+)?$/;
 var UPDATE_INBOX_BODY = "A newer version of the mrrlin bridge is available. Updating pulls the latest fixes and improvements. Changelog: https://mrrlin-changelog.s3.eu-central-1.amazonaws.com/index.html . Ask the Director to update, or run `npm install -g @mrrlin-dev/mcp@latest` yourself.";
@@ -42267,7 +42452,7 @@ function sha256(buf) {
 function startSelfUpdate(deps) {
   const log = deps.log ?? (() => {
   });
-  const readFile9 = deps.readFileSyncImpl ?? ((p) => (0, import_node_fs3.readFileSync)(p));
+  const readFile9 = deps.readFileSyncImpl ?? ((p) => (0, import_node_fs4.readFileSync)(p));
   const setIntervalFn = deps.setIntervalImpl ?? setInterval;
   const clearIntervalFn = deps.clearIntervalImpl ?? clearInterval;
   const intervalMs = deps.intervalMs ?? readIntervalEnv("MRRLIN_DIRECTOR_BRIDGE_SELF_UPDATE_INTERVAL_MS", DEFAULT_INTERVAL_MS);
@@ -42280,17 +42465,55 @@ function startSelfUpdate(deps) {
   const registryPollIntervalMs = deps.registryPollIntervalMs ?? readIntervalEnv("MRRLIN_DIRECTOR_BRIDGE_REGISTRY_POLL_INTERVAL_MS", DEFAULT_REGISTRY_POLL_MS);
   const startupJitterMs = deps.startupJitterMs ?? DEFAULT_STARTUP_JITTER_MS;
   const cooldownMs = deps.cooldownMs ?? readIntervalEnv("MRRLIN_DIRECTOR_BRIDGE_UPDATE_COOLDOWN_MS", DEFAULT_COOLDOWN_MS);
+  const authBlockCooldownMs = deps.authBlockCooldownMs ?? readIntervalEnv("MRRLIN_DIRECTOR_BRIDGE_UPDATE_AUTH_BLOCK_COOLDOWN_MS", DEFAULT_AUTH_BLOCK_COOLDOWN_MS);
   const nowFn = deps.now ?? (() => Date.now());
+  const codexAuthPreflight = deps.codexAuthPreflight ?? (() => inspectCodexAuthForBridgeUpdate({
+    nowMs: nowFn()
+  }));
   const disabled = isDisabled();
   let drainOnQuiet = false;
   let drainSource = null;
   let shutdownCalled = false;
   let latestVersion = null;
   let lastUpdateMentionAt = null;
+  let lastAuthBlockMentionAt = null;
+  function blockedAuthOffer(auth2) {
+    const expires = auth2.expiresInSeconds === null ? "unknown" : `${auth2.expiresInSeconds}s`;
+    return `${SELF_UPDATE_AUTH_PREFLIGHT_OFFER_PREFIX} An update for @mrrlin-dev/mcp is available: ${pkgVersion} -> ${latestVersion}.
+
+Do NOT install it yet. The local Codex CLI auth that the restarted bridge will use is not update-safe:
+- status: ${auth2.status}
+- auth file: ${auth2.authPath}
+- nearest JWT expiry: ${expires}
+- detail: ${auth2.detail}
+
+Tell the operator, in their language, that the bridge update is ready but the Codex CLI session should be refreshed first because the update restarts the bridge and starts a fresh headless Codex process.
+
+Ask the operator to run \`codex login\` as the re-auth action only. Do not present \`codex login\` as a readiness check; it opens the login flow even when auth is already fine.
+
+After the operator re-authenticates, ask them to verify the CLI with:
+\`codex exec --model gpt-5.4-mini 'Reply with exactly: OK'\`
+
+Once that returns OK, they can ask again and you may offer the normal update command \`npm install -g @mrrlin-dev/mcp@latest\`.`;
+  }
   function maybeUpdateOffer() {
     if (disabled) return null;
     if (latestVersion === null) return null;
     if (!import_semver3.default.gt(latestVersion, pkgVersion)) return null;
+    const auth2 = codexAuthPreflight();
+    if (!auth2.ok) {
+      if (lastAuthBlockMentionAt !== null && nowFn() - lastAuthBlockMentionAt < authBlockCooldownMs) return null;
+      lastAuthBlockMentionAt = nowFn();
+      log("warn", "bridge.self_update.auth_preflight_blocked", {
+        version: pkgVersion,
+        latestVersion,
+        status: auth2.status,
+        authPath: auth2.authPath,
+        expiresInSeconds: auth2.expiresInSeconds,
+        minTtlSeconds: auth2.minTtlSeconds
+      });
+      return blockedAuthOffer(auth2);
+    }
     if (lastUpdateMentionAt !== null && nowFn() - lastUpdateMentionAt < cooldownMs) return null;
     lastUpdateMentionAt = nowFn();
     log("info", "bridge.self_update.hint_injected", {
@@ -42488,17 +42711,17 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.57";
+var PKG_VERSION = "0.4.60";
 
 // src/api-base-url-migrate.ts
-var import_node_fs4 = __toESM(require("node:fs"), 1);
-var import_node_os6 = __toESM(require("node:os"), 1);
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs5 = __toESM(require("node:fs"), 1);
+var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_path9 = __toESM(require("node:path"), 1);
 
 // src/service-paths.ts
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_path8 = __toESM(require("node:path"), 1);
 function isWorktreePath(p) {
-  const norm = import_node_path7.default.normalize(p).split(import_node_path7.default.sep).join("/");
+  const norm = import_node_path8.default.normalize(p).split(import_node_path8.default.sep).join("/");
   return norm.includes("/.claude/worktrees/");
 }
 function resolveServiceCwd(opts) {
@@ -42551,20 +42774,20 @@ ${envLines}
 
 // src/api-base-url-migrate.ts
 function defaultDeps(deps) {
-  const home = deps.home ?? process.env.HOME ?? import_node_os6.default.homedir();
+  const home = deps.home ?? process.env.HOME ?? import_node_os7.default.homedir();
   return {
     home,
-    codexHome: deps.codexHome ?? process.env.CODEX_HOME?.trim() ?? import_node_path8.default.join(home, ".codex"),
-    readFile: deps.readFile ?? ((p) => import_node_fs4.default.readFileSync(p, "utf8")),
+    codexHome: deps.codexHome ?? process.env.CODEX_HOME?.trim() ?? import_node_path9.default.join(home, ".codex"),
+    readFile: deps.readFile ?? ((p) => import_node_fs5.default.readFileSync(p, "utf8")),
     // Temp-file + atomic rename so a concurrent `serve` and `director-bridge` startup can never
     // interleave partial writes into a config the next start has to parse. Note this normalizes the
     // file to 0o600 — deliberate, since both files can carry a credential-bearing URL.
     writeFile: deps.writeFile ?? ((p, c) => {
       const tmp = `${p}.tmp-${process.pid}`;
-      import_node_fs4.default.writeFileSync(tmp, c, { mode: 384 });
-      import_node_fs4.default.renameSync(tmp, p);
+      import_node_fs5.default.writeFileSync(tmp, c, { mode: 384 });
+      import_node_fs5.default.renameSync(tmp, p);
     }),
-    exists: deps.exists ?? ((p) => import_node_fs4.default.existsSync(p)),
+    exists: deps.exists ?? ((p) => import_node_fs5.default.existsSync(p)),
     log: deps.log ?? ((m) => process.stderr.write(`${m}
 `))
   };
@@ -42603,7 +42826,7 @@ function backupOnce(file2, text, deps) {
 }
 function migrateEcosystemConfig(deps = {}) {
   const d = defaultDeps(deps);
-  const file2 = import_node_path8.default.join(d.home, ".mrrlin", "ecosystem.config.cjs");
+  const file2 = import_node_path9.default.join(d.home, ".mrrlin", "ecosystem.config.cjs");
   if (!d.exists(file2)) return { file: file2, status: "absent" };
   const text = d.readFile(file2);
   if (!findRetiredHost(text) && !hasLiveLegacyStagingFlag(text, "js"))
@@ -42753,7 +42976,7 @@ ${envLines}
 }
 function migrateCodexConfig(deps = {}) {
   const d = defaultDeps(deps);
-  const file2 = import_node_path8.default.join(d.codexHome, "config.toml");
+  const file2 = import_node_path9.default.join(d.codexHome, "config.toml");
   if (!d.exists(file2)) return { file: file2, status: "absent" };
   const text = d.readFile(file2);
   const host = findRetiredHost(text);
@@ -42839,7 +43062,7 @@ $1`
 }
 function migrateClaudeConfig(deps = {}) {
   const d = defaultDeps(deps);
-  const file2 = import_node_path8.default.join(d.home, ".claude.json");
+  const file2 = import_node_path9.default.join(d.home, ".claude.json");
   if (!d.exists(file2)) return { file: file2, status: "absent" };
   const text = d.readFile(file2);
   let parsed;
@@ -42889,9 +43112,9 @@ function migrateRetiredApiBaseUrls(deps = {}) {
   const d = defaultDeps(deps);
   const results = [];
   const steps = [
-    { run: migrateEcosystemConfig, file: import_node_path8.default.join(d.home, ".mrrlin", "ecosystem.config.cjs") },
-    { run: migrateCodexConfig, file: import_node_path8.default.join(d.codexHome, "config.toml") },
-    { run: migrateClaudeConfig, file: import_node_path8.default.join(d.home, ".claude.json") }
+    { run: migrateEcosystemConfig, file: import_node_path9.default.join(d.home, ".mrrlin", "ecosystem.config.cjs") },
+    { run: migrateCodexConfig, file: import_node_path9.default.join(d.codexHome, "config.toml") },
+    { run: migrateClaudeConfig, file: import_node_path9.default.join(d.home, ".claude.json") }
   ];
   for (const step of steps) {
     try {
@@ -42917,8 +43140,8 @@ function migrateRetiredApiBaseUrls(deps = {}) {
 }
 
 // src/bridge-health.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_fs6 = require("node:fs");
+var import_node_path10 = __toESM(require("node:path"), 1);
 var SENTINEL_FILE_NAME = "bridge-health-circuit-breaker.json";
 var CRASH_WINDOW_MS = 60 * 60 * 1e3;
 var MAX_CRASHES_PER_WINDOW = 3;
@@ -42930,9 +43153,9 @@ function isCrashSentinel(value) {
   return typeof candidate.crashCount === "number" && Number.isInteger(candidate.crashCount) && candidate.crashCount >= 0 && typeof candidate.windowStartedAt === "string";
 }
 async function readCrashSentinel(stateDir, now = Date.now) {
-  const sentinelPath = import_node_path9.default.join(stateDir, SENTINEL_FILE_NAME);
+  const sentinelPath = import_node_path10.default.join(stateDir, SENTINEL_FILE_NAME);
   try {
-    const raw = await import_node_fs5.promises.readFile(sentinelPath, "utf8");
+    const raw = await import_node_fs6.promises.readFile(sentinelPath, "utf8");
     const parsed = JSON.parse(raw);
     if (isCrashSentinel(parsed)) return parsed;
   } catch {
@@ -42940,11 +43163,11 @@ async function readCrashSentinel(stateDir, now = Date.now) {
   return { crashCount: 0, windowStartedAt: new Date(now()).toISOString() };
 }
 async function writeCrashSentinel(stateDir, sentinel) {
-  await import_node_fs5.promises.mkdir(stateDir, { recursive: true });
-  const sentinelPath = import_node_path9.default.join(stateDir, SENTINEL_FILE_NAME);
+  await import_node_fs6.promises.mkdir(stateDir, { recursive: true });
+  const sentinelPath = import_node_path10.default.join(stateDir, SENTINEL_FILE_NAME);
   const tmpPath = `${sentinelPath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-  await import_node_fs5.promises.writeFile(tmpPath, JSON.stringify(sentinel), "utf8");
-  await import_node_fs5.promises.rename(tmpPath, sentinelPath);
+  await import_node_fs6.promises.writeFile(tmpPath, JSON.stringify(sentinel), "utf8");
+  await import_node_fs6.promises.rename(tmpPath, sentinelPath);
 }
 function withTimeout(fn, ms = DEFAULT_OPERATION_TIMEOUT_MS) {
   const controller = new AbortController();
@@ -43271,12 +43494,12 @@ function startSchedulerTickLoop(deps) {
 
 // src/retention/pruner.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path10 = __toESM(require("node:path"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
 function protectedDayFloor(protectedSinceMs) {
   return new Date(protectedSinceMs).toISOString().slice(0, 10);
 }
 async function prune(stateDir, bounds) {
-  const logsDir = import_node_path10.default.join(stateDir, "logs");
+  const logsDir = import_node_path11.default.join(stateDir, "logs");
   let entries;
   try {
     entries = await (0, import_promises4.readdir)(logsDir);
@@ -43292,7 +43515,7 @@ async function prune(stateDir, bounds) {
   for (const entry of entries) {
     const m = bridgeRe.exec(entry);
     if (!m?.[1]) continue;
-    const fullPath = import_node_path10.default.join(logsDir, entry);
+    const fullPath = import_node_path11.default.join(logsDir, entry);
     const s = await (0, import_promises4.stat)(fullPath);
     files.push({ day: m[1], size: s.size, fullPath });
   }
@@ -43301,7 +43524,7 @@ async function prune(stateDir, bounds) {
   const reasonByDay = {};
   let bytesRemoved = 0;
   async function isDaySafeToDelete(day) {
-    const telemetryDir = import_node_path10.default.join(stateDir, "telemetry");
+    const telemetryDir = import_node_path11.default.join(stateDir, "telemetry");
     let telemetryEntries;
     try {
       telemetryEntries = await (0, import_promises4.readdir)(telemetryDir);
@@ -43317,7 +43540,7 @@ async function prune(stateDir, bounds) {
     }
     if (projectSlugs.length === 0) return true;
     for (const slug of projectSlugs) {
-      const markerPath = import_node_path10.default.join(telemetryDir, `.processed-${slug}-${day}`);
+      const markerPath = import_node_path11.default.join(telemetryDir, `.processed-${slug}-${day}`);
       try {
         await (0, import_promises4.stat)(markerPath);
       } catch (err) {
@@ -43367,7 +43590,7 @@ async function prune(stateDir, bounds) {
   const budgetOvershootBytes = Math.max(0, totalSize2 - budgetBytes);
   await emitPruneLog(stateDir, daysRemoved, reasonByDay, bytesRemoved, oldestDayRemaining);
   if (daysRemoved.length > 0) {
-    const sessionsPath = import_node_path10.default.join(logsDir, ".sessions.json");
+    const sessionsPath = import_node_path11.default.join(logsDir, ".sessions.json");
     let sessionsObj = {};
     let fileExists = true;
     try {
@@ -43389,8 +43612,8 @@ async function prune(stateDir, bounds) {
   return { daysRemoved, reasonByDay, bytesRemoved, oldestDayRemaining, budgetOvershootBytes };
 }
 async function emitPruneLog(stateDir, daysRemoved, reasonByDay, bytesRemoved, oldestDayRemaining) {
-  const logsDir = import_node_path10.default.join(stateDir, "logs");
-  const logPath = import_node_path10.default.join(logsDir, ".pruned.jsonl");
+  const logsDir = import_node_path11.default.join(stateDir, "logs");
+  const logPath = import_node_path11.default.join(logsDir, ".pruned.jsonl");
   await (0, import_promises4.mkdir)(logsDir, { recursive: true });
   const record2 = { ts: Date.now(), dir: "logs", daysRemoved, reasonByDay, bytesRemoved, oldestDayRemaining };
   await (0, import_promises4.appendFile)(logPath, `${JSON.stringify(record2)}
@@ -43400,7 +43623,7 @@ async function emitPruneLog(stateDir, daysRemoved, reasonByDay, bytesRemoved, ol
 // src/telemetry/turn-aggregator.ts
 var import_node_crypto3 = require("node:crypto");
 var import_promises5 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 var BRIDGE_FILE_RE = /^bridge-(\d{4}-\d{2}-\d{2})\.jsonl$/;
 var PLUMBING_COUNTER_KEY = {
   socket_close: "socketCloses",
@@ -43429,7 +43652,7 @@ function inheritSlug(seeds, index) {
   return (preceding ?? following)?.slug;
 }
 async function foldClosedDays(stateDir, today) {
-  const logsDir = (0, import_node_path11.join)(stateDir, "logs");
+  const logsDir = (0, import_node_path12.join)(stateDir, "logs");
   let entries;
   try {
     entries = await (0, import_promises5.readdir)(logsDir);
@@ -43441,7 +43664,7 @@ async function foldClosedDays(stateDir, today) {
     if (!m) continue;
     const day = m[1];
     if (day === today) continue;
-    const raw = await (0, import_promises5.readFile)((0, import_node_path11.join)(logsDir, entry), "utf8");
+    const raw = await (0, import_promises5.readFile)((0, import_node_path12.join)(logsDir, entry), "utf8");
     const groups = /* @__PURE__ */ new Map();
     let groupCounter = 0;
     for (const line of raw.split("\n")) {
@@ -43552,10 +43775,10 @@ async function foldClosedDays(stateDir, today) {
       rowsByProject.set(slug, rows);
     }
     if (rowsByProject.size === 0) continue;
-    const telemetryDir = (0, import_node_path11.join)(stateDir, "telemetry");
+    const telemetryDir = (0, import_node_path12.join)(stateDir, "telemetry");
     await (0, import_promises5.mkdir)(telemetryDir, { recursive: true });
     for (const [slug, rows] of rowsByProject) {
-      const finalPath = (0, import_node_path11.join)(telemetryDir, `rows-${slug}-${day}.jsonl`);
+      const finalPath = (0, import_node_path12.join)(telemetryDir, `rows-${slug}-${day}.jsonl`);
       const tmpPath = `${finalPath}.tmp-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
       try {
         await (0, import_promises5.writeFile)(tmpPath, rows.map((r) => JSON.stringify(r)).join("\n") + "\n", "utf8");
@@ -43570,22 +43793,22 @@ async function foldClosedDays(stateDir, today) {
 
 // src/telemetry/daily-uploader.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 
 // src/consensus/wiring.ts
 var import_node_crypto4 = __toESM(require("node:crypto"), 1);
-var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_fs9 = __toESM(require("node:fs"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 
 // src/consensus/gate-usage-log.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path13 = require("node:path");
 function recordGateCall(stateDir, projectSlug, record2) {
   try {
-    const dir = (0, import_node_path12.join)(stateDir, "telemetry");
-    (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs6.appendFileSync)((0, import_node_path12.join)(dir, gateFileName(projectSlug, record2.day)), `${JSON.stringify(record2)}
+    const dir = (0, import_node_path13.join)(stateDir, "telemetry");
+    (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs7.appendFileSync)((0, import_node_path13.join)(dir, gateFileName(projectSlug, record2.day)), `${JSON.stringify(record2)}
 `, "utf8");
   } catch {
   }
@@ -44451,12 +44674,12 @@ ${issuesBlock}`,
 }
 
 // src/consensus/sterile-cwd.ts
-var import_node_fs7 = require("node:fs");
-var import_node_os7 = require("node:os");
-var import_node_path13 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_os8 = require("node:os");
+var import_node_path14 = require("node:path");
 var sterileDir = null;
 function sterileCwd() {
-  sterileDir ??= (0, import_node_fs7.mkdtempSync)((0, import_node_path13.join)((0, import_node_os7.tmpdir)(), "mrrlin-gate-"));
+  sterileDir ??= (0, import_node_fs8.mkdtempSync)((0, import_node_path14.join)((0, import_node_os8.tmpdir)(), "mrrlin-gate-"));
   return sterileDir;
 }
 
@@ -44692,15 +44915,15 @@ ${res.stdout}${res.stderr}`);
 var import_meta2 = {};
 function getPersonasDir() {
   if (typeof __dirname !== "undefined") {
-    return import_node_path14.default.join(__dirname, "consensus", "personas");
+    return import_node_path15.default.join(__dirname, "consensus", "personas");
   }
-  return import_node_path14.default.join(import_node_path14.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "personas");
+  return import_node_path15.default.join(import_node_path15.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "personas");
 }
 var personaCache = /* @__PURE__ */ new Map();
 function loadPersona(name) {
   const cached2 = personaCache.get(name);
   if (cached2 !== void 0) return cached2;
-  const content = import_node_fs8.default.readFileSync(import_node_path14.default.join(getPersonasDir(), `${name}.md`), "utf8");
+  const content = import_node_fs9.default.readFileSync(import_node_path15.default.join(getPersonasDir(), `${name}.md`), "utf8");
   personaCache.set(name, content);
   return content;
 }
@@ -45289,8 +45512,8 @@ You revise a deliverable to address the accepted issues so it satisfies the acce
 function isRecord2(v) {
   return v !== null && typeof v === "object";
 }
-function resolvePath(root, path24) {
-  const parts = path24.split(".");
+function resolvePath(root, path25) {
+  const parts = path25.split(".");
   let cur = root;
   for (let i = 0; i < parts.length - 1; i += 1) {
     const part = parts[i];
@@ -45358,9 +45581,9 @@ async function gate(artifact, prose, ctx) {
     return { ok: true, gated: true, artifact: withheldExcerptClone(artifact) };
   }
   const maskedClone = typeof structuredClone === "function" ? structuredClone(artifact) : JSON.parse(JSON.stringify(artifact));
-  for (const { path: path24, masked } of fields) {
-    const target = resolvePath(maskedClone, path24);
-    if (!target) throw new Error(`pii-gate: path "${path24}" failed to resolve on the clone after validating on the original`);
+  for (const { path: path25, masked } of fields) {
+    const target = resolvePath(maskedClone, path25);
+    if (!target) throw new Error(`pii-gate: path "${path25}" failed to resolve on the clone after validating on the original`);
     target.parent[target.key] = masked;
   }
   return { ok: true, gated: false, artifact: maskedClone };
@@ -45368,23 +45591,23 @@ async function gate(artifact, prose, ctx) {
 
 // src/telemetry/installation-id.ts
 var import_node_crypto5 = require("node:crypto");
-var import_node_fs9 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs10 = require("node:fs");
+var import_node_path16 = require("node:path");
 var FILE_NAME = "installation-id";
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var cache = /* @__PURE__ */ new Map();
 function resolveInstallationId(stateDir) {
   const cached2 = cache.get(stateDir);
   if (cached2 !== void 0) return cached2;
-  const path24 = (0, import_node_path15.join)(stateDir, FILE_NAME);
+  const path25 = (0, import_node_path16.join)(stateDir, FILE_NAME);
   let id;
   try {
-    id = (0, import_node_fs9.readFileSync)(path24, "utf8").trim();
+    id = (0, import_node_fs10.readFileSync)(path25, "utf8").trim();
     if (!UUID.test(id)) throw new Error("unusable");
   } catch {
     id = (0, import_node_crypto5.randomUUID)();
-    (0, import_node_fs9.mkdirSync)((0, import_node_path15.dirname)(path24), { recursive: true });
-    (0, import_node_fs9.writeFileSync)(path24, `${id}
+    (0, import_node_fs10.mkdirSync)((0, import_node_path16.dirname)(path25), { recursive: true });
+    (0, import_node_fs10.writeFileSync)(path25, `${id}
 `, "utf8");
   }
   cache.set(stateDir, id);
@@ -45401,7 +45624,7 @@ function truncateCause(err) {
   return `${message.slice(0, MAX_CAUSE_CHARS - 3)}...`;
 }
 async function uploadPendingDays(stateDir, client, bridgeHealth, gateCtx) {
-  const telemetryDir = (0, import_node_path16.join)(stateDir, "telemetry");
+  const telemetryDir = (0, import_node_path17.join)(stateDir, "telemetry");
   let files;
   try {
     files = await (0, import_promises6.readdir)(telemetryDir);
@@ -45417,14 +45640,14 @@ async function uploadPendingDays(stateDir, client, bridgeHealth, gateCtx) {
     const [, projectSlug, day] = match;
     const key = `${projectSlug}\0${day}`;
     const entry = discovered.get(key) ?? { projectSlug, day, rowsPath: null };
-    if (rowsMatch) entry.rowsPath = (0, import_node_path16.join)(telemetryDir, file2);
+    if (rowsMatch) entry.rowsPath = (0, import_node_path17.join)(telemetryDir, file2);
     discovered.set(key, entry);
   }
   const today = telemetryDay();
   const pending = [];
   const deferred = [];
   for (const { projectSlug, day, rowsPath } of discovered.values()) {
-    const markerPath = (0, import_node_path16.join)(telemetryDir, `.processed-${projectSlug}-${day}`);
+    const markerPath = (0, import_node_path17.join)(telemetryDir, `.processed-${projectSlug}-${day}`);
     if (rowsPath === null && day >= today) {
       try {
         await (0, import_promises6.access)(markerPath);
@@ -45444,7 +45667,7 @@ async function uploadPendingDays(stateDir, client, bridgeHealth, gateCtx) {
   const fullUnprocessed = [...pending.map((p) => ({ projectSlug: p.projectSlug, day: p.day })), ...deferred];
   pending.sort((a, b) => a.day.localeCompare(b.day));
   for (const cur of pending) {
-    const failurePath = (0, import_node_path16.join)(telemetryDir, `.failed-${cur.projectSlug}-${cur.day}.json`);
+    const failurePath = (0, import_node_path17.join)(telemetryDir, `.failed-${cur.projectSlug}-${cur.day}.json`);
     let failureState = null;
     try {
       const data = await (0, import_promises6.readFile)(failurePath, "utf8");
@@ -45478,7 +45701,7 @@ async function uploadPendingDays(stateDir, client, bridgeHealth, gateCtx) {
       }
       const gateCalls = [];
       try {
-        const rawGate = await (0, import_promises6.readFile)((0, import_node_path16.join)(telemetryDir, gateFileName(cur.projectSlug, cur.day)), "utf8");
+        const rawGate = await (0, import_promises6.readFile)((0, import_node_path17.join)(telemetryDir, gateFileName(cur.projectSlug, cur.day)), "utf8");
         for (const line of rawGate.split("\n")) {
           if (!line.trim()) continue;
           try {
@@ -45900,7 +46123,7 @@ function setSelectedProvider(value) {
 // src/execution-consumer.ts
 var import_node_child_process12 = require("node:child_process");
 var import_node_crypto7 = __toESM(require("node:crypto"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 var import_node_util = require("node:util");
 
 // src/consensus/deliverable-gate-outcome.ts
@@ -47196,18 +47419,18 @@ async function awaitTurnWithDeadline(opts) {
 
 // src/worktree.ts
 var import_node_child_process11 = require("node:child_process");
-var import_node_fs11 = require("node:fs");
-var import_node_os8 = require("node:os");
-var import_node_path18 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_os9 = require("node:os");
+var import_node_path19 = require("node:path");
 
 // src/checkout-lock.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path18 = require("node:path");
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 async function withCheckoutLock(locksDir, slug, fn) {
-  (0, import_node_fs10.mkdirSync)(locksDir, { recursive: true });
-  const target = (0, import_node_path17.join)(locksDir, `${slug}.lock`);
-  if (!(0, import_node_fs10.existsSync)(target)) (0, import_node_fs10.writeFileSync)(target, "");
+  (0, import_node_fs11.mkdirSync)(locksDir, { recursive: true });
+  const target = (0, import_node_path18.join)(locksDir, `${slug}.lock`);
+  if (!(0, import_node_fs11.existsSync)(target)) (0, import_node_fs11.writeFileSync)(target, "");
   const release = await import_proper_lockfile.default.lock(target, {
     retries: { retries: 600, factor: 1, minTimeout: 100, maxTimeout: 100 },
     stale: 5 * 6e4
@@ -47232,12 +47455,12 @@ function git(checkout, args) {
   });
 }
 async function createRunWorktree(opts) {
-  const worktreePath = (0, import_node_path18.join)(opts.worktreeRoot, opts.slug, opts.runId);
+  const worktreePath = (0, import_node_path19.join)(opts.worktreeRoot, opts.slug, opts.runId);
   await withCheckoutLock(opts.locksDir, opts.slug, async () => {
-    (0, import_node_fs11.mkdirSync)(opts.worktreeRoot, { recursive: true });
+    (0, import_node_fs12.mkdirSync)(opts.worktreeRoot, { recursive: true });
     try {
       git(opts.checkout, ["fetch", "origin", opts.defaultBranch]);
-      if (!(0, import_node_fs11.existsSync)(worktreePath)) {
+      if (!(0, import_node_fs12.existsSync)(worktreePath)) {
         git(opts.checkout, [
           "worktree",
           "add",
@@ -47309,15 +47532,15 @@ async function doPushRunBranch(opts, execGit) {
   if (localConfig.trim()) {
     throw new Error(`push aborted: agent-controlled git config present in worktree: ${localConfig.trim().split("\n")[0]}`);
   }
-  const dir = (0, import_node_fs11.mkdtempSync)((0, import_node_path18.join)((0, import_node_os8.tmpdir)(), "mrrlin-push-"));
-  const askpass = (0, import_node_path18.join)(dir, "askpass");
+  const dir = (0, import_node_fs12.mkdtempSync)((0, import_node_path19.join)((0, import_node_os9.tmpdir)(), "mrrlin-push-"));
+  const askpass = (0, import_node_path19.join)(dir, "askpass");
   try {
-    (0, import_node_fs11.writeFileSync)(
+    (0, import_node_fs12.writeFileSync)(
       askpass,
       '#!/bin/sh\ncase "$1" in *[Uu]sername*) printf %s "x-access-token" ;; *) printf %s "$MRRLIN_PUSH_TOKEN" ;; esac\n',
       { mode: 320 }
     );
-    (0, import_node_fs11.chmodSync)(askpass, 320);
+    (0, import_node_fs12.chmodSync)(askpass, 320);
     execGit(
       [
         "-C",
@@ -47336,18 +47559,18 @@ async function doPushRunBranch(opts, execGit) {
     );
     return { pushedSha: localSha };
   } finally {
-    (0, import_node_fs11.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs12.rmSync)(dir, { recursive: true, force: true });
   }
 }
 async function sweepOrphanWorktrees(opts) {
   const reaped = [];
   const ownedPrefix = (() => {
     try {
-      return (0, import_node_fs11.realpathSync)(opts.worktreeRoot);
+      return (0, import_node_fs12.realpathSync)(opts.worktreeRoot);
     } catch {
       return opts.worktreeRoot;
     }
-  })() + import_node_path18.sep + opts.slug + import_node_path18.sep;
+  })() + import_node_path19.sep + opts.slug + import_node_path19.sep;
   await withCheckoutLock(opts.locksDir, opts.slug, async () => {
     const listing = git(opts.checkout, ["worktree", "list", "--porcelain"]);
     for (const block of listing.split("\n\n")) {
@@ -47870,8 +48093,8 @@ function newArtifactId() {
   return `EA-${import_node_crypto7.default.randomUUID()}`;
 }
 var BLAST_RADIUS_FLOOR_PATTERNS = [/^supabase\/migrations\//, /^packages\/db\/src\/schema\.ts$/];
-function isBlastRadiusFloorPath(path24) {
-  return BLAST_RADIUS_FLOOR_PATTERNS.some((re) => re.test(path24));
+function isBlastRadiusFloorPath(path25) {
+  return BLAST_RADIUS_FLOOR_PATTERNS.some((re) => re.test(path25));
 }
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process12.execFile);
 async function defaultListRunDiffPaths(opts) {
@@ -48135,7 +48358,7 @@ async function driveRun(deps, projectSlug, runId) {
           task,
           runId,
           leaseId,
-          `capability_not_routed: run ${runId} targets ${task.id}, which requires artifact kind "${kind}" -- that kind has no capability at all`,
+          `capability_not_routed: run ${runId} targets ${task.id}, ${describeCapabilityRefusal({ reason: "blocked_kind", projectSlug, artifactKind: kind })}`,
           "capability_not_routed"
         );
         return;
@@ -48148,7 +48371,12 @@ async function driveRun(deps, projectSlug, runId) {
           task,
           runId,
           leaseId,
-          `capability_not_routed: run ${runId} targets ${task.id}, which requires artifact kind "${kind}" -- no route (${routeResolution.reason})`,
+          // Consensus round 1 (chunk 4): capability was omitted here, so no_route/no_grant/
+          // project_mismatch's action text (which interpolates it) fell back to the literal string
+          // "the requested capability" instead of naming "wiki"/"artifacts"/"git" -- resolveKindCapability
+          // is non-null on this branch (the blocked_kind check above already returned if it were),
+          // matching deliverBuiltIn's identical call in tools.ts.
+          `capability_not_routed: run ${runId} targets ${task.id}, ${describeCapabilityRefusal({ reason: routeResolution.reason, projectSlug, artifactKind: kind, capability: resolveKindCapability(kind), detail: routeResolution.message })}`,
           "capability_not_routed"
         );
         return;
@@ -49496,8 +49724,8 @@ async function runBackstopSweep(deps, drive = (slug, id) => driveRun(deps, slug,
 function isRunRecoverableByThisBridge(run3, worktreeRoot) {
   if (!worktreeRoot) return true;
   if (!run3.worktreeId) return false;
-  const relative = import_node_path19.default.relative(import_node_path19.default.resolve(worktreeRoot), import_node_path19.default.resolve(run3.worktreeId));
-  return relative === "" || relative.length > 0 && !relative.startsWith("..") && !import_node_path19.default.isAbsolute(relative);
+  const relative = import_node_path20.default.relative(import_node_path20.default.resolve(worktreeRoot), import_node_path20.default.resolve(run3.worktreeId));
+  return relative === "" || relative.length > 0 && !relative.startsWith("..") && !import_node_path20.default.isAbsolute(relative);
 }
 async function deployGateHandoff(deps, projectSlug, task, runId, reason, leaseId) {
   await deps.client.updateExecutionRun(projectSlug, runId, { status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), leaseId: leaseId ?? void 0 }).catch(() => {
@@ -49546,9 +49774,9 @@ function getAsyncToolDescriptor(toolName) {
 }
 
 // src/bridge-log.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // src/redact.ts
 var REDACTED = "[REDACTED]";
@@ -49824,14 +50052,14 @@ function resolvePromptsEnabled(env = process.env) {
 }
 function createBridgeLogger(stateDir, env = process.env) {
   if (!resolveBridgeLogEnabled(env)) return NOOP_LOGGER;
-  const logsDir = (0, import_node_path20.join)(stateDir, "logs");
+  const logsDir = (0, import_node_path21.join)(stateDir, "logs");
   try {
-    (0, import_node_fs12.mkdirSync)(logsDir, { recursive: true });
+    (0, import_node_fs13.mkdirSync)(logsDir, { recursive: true });
   } catch {
     return NOOP_LOGGER;
   }
   const includePrompts = resolvePromptsEnabled(env);
-  const fileFor = () => (0, import_node_path20.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+  const fileFor = () => (0, import_node_path21.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
   const MAX_TRACKED_SESSIONS = 64;
   const contextSlugBySession = /* @__PURE__ */ new Map();
   const rememberContextSlug = (sessionId, payload) => {
@@ -49872,10 +50100,10 @@ function createBridgeLogger(stateDir, env = process.env) {
     return { isGap, isNewTurn };
   };
   const gainDay = (sessionId) => {
-    const sessionsPath = (0, import_node_path20.join)(logsDir, ".sessions.json");
+    const sessionsPath = (0, import_node_path21.join)(logsDir, ".sessions.json");
     let sessionsObj = {};
     try {
-      const parsed = JSON.parse((0, import_node_fs12.readFileSync)(sessionsPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs13.readFileSync)(sessionsPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) sessionsObj = parsed;
     } catch {
       sessionsObj = {};
@@ -49885,8 +50113,8 @@ function createBridgeLogger(stateDir, env = process.env) {
     if (idsToday.includes(sessionId)) return;
     sessionsObj[day] = [...idsToday, sessionId];
     const tmpPath = `${sessionsPath}.tmp`;
-    (0, import_node_fs12.writeFileSync)(tmpPath, JSON.stringify(sessionsObj));
-    (0, import_node_fs12.renameSync)(tmpPath, sessionsPath);
+    (0, import_node_fs13.writeFileSync)(tmpPath, JSON.stringify(sessionsObj));
+    (0, import_node_fs13.renameSync)(tmpPath, sessionsPath);
   };
   const write = (dir, rec) => {
     try {
@@ -49977,7 +50205,7 @@ function createBridgeLogger(stateDir, env = process.env) {
         ...recordingObligationUnresolved ? { recordingObligationUnresolved } : {},
         ...recordingObligationMultiResolve ? { recordingObligationMultiResolve } : {}
       }) + "\n";
-      (0, import_node_fs12.appendFileSync)(fileFor(), line);
+      (0, import_node_fs13.appendFileSync)(fileFor(), line);
       if (rec.sessionId !== null) gainDay(rec.sessionId);
     } catch {
     }
@@ -49990,7 +50218,7 @@ function createBridgeLogger(stateDir, env = process.env) {
   };
 }
 async function findSessionDays(stateDir, sessionId) {
-  const sessionsPath = (0, import_node_path20.join)(stateDir, "logs", ".sessions.json");
+  const sessionsPath = (0, import_node_path21.join)(stateDir, "logs", ".sessions.json");
   let sessionsObj;
   try {
     const parsed = JSON.parse(await (0, import_promises7.readFile)(sessionsPath, "utf8"));
@@ -50172,12 +50400,12 @@ async function runAsyncBackstopSweep(deps, drive = (slug, jobId) => driveAsyncJo
 }
 
 // src/state-dir.ts
-var import_node_os9 = __toESM(require("node:os"), 1);
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 function resolveStateDir(env = process.env) {
   const codexHome = env.CODEX_HOME;
-  if (codexHome) return import_node_path21.default.join(codexHome, "mrrlin", "director-bridge");
-  return import_node_path21.default.join(import_node_os9.default.homedir(), ".mrrlin", "director-bridge");
+  if (codexHome) return import_node_path22.default.join(codexHome, "mrrlin", "director-bridge");
+  return import_node_path22.default.join(import_node_os10.default.homedir(), ".mrrlin", "director-bridge");
 }
 
 // src/consensus/deliverable-gate.ts
@@ -50433,19 +50661,19 @@ function agentIdleMs(provider) {
 }
 
 // src/operator-token.ts
-var import_node_fs13 = require("node:fs");
-var import_node_os10 = __toESM(require("node:os"), 1);
-var import_node_path22 = __toESM(require("node:path"), 1);
+var import_node_fs14 = require("node:fs");
+var import_node_os11 = __toESM(require("node:os"), 1);
+var import_node_path23 = __toESM(require("node:path"), 1);
 function operatorDir() {
-  const base = process.env.CODEX_HOME ? import_node_path22.default.join(process.env.CODEX_HOME, "mrrlin") : import_node_path22.default.join(import_node_os10.default.homedir(), ".mrrlin");
+  const base = process.env.CODEX_HOME ? import_node_path23.default.join(process.env.CODEX_HOME, "mrrlin") : import_node_path23.default.join(import_node_os11.default.homedir(), ".mrrlin");
   return base;
 }
 function operatorTokenPath() {
-  return import_node_path22.default.join(operatorDir(), "operator-token");
+  return import_node_path23.default.join(operatorDir(), "operator-token");
 }
 function readOperatorToken() {
   try {
-    const token = (0, import_node_fs13.readFileSync)(operatorTokenPath(), "utf8").trim();
+    const token = (0, import_node_fs14.readFileSync)(operatorTokenPath(), "utf8").trim();
     return token.length > 0 ? token : null;
   } catch {
     return null;
@@ -50453,24 +50681,24 @@ function readOperatorToken() {
 }
 function persistOperatorToken(token) {
   const dir = operatorDir();
-  (0, import_node_fs13.mkdirSync)(dir, { recursive: true, mode: 448 });
-  (0, import_node_fs13.writeFileSync)(operatorTokenPath(), `${token.trim()}
+  (0, import_node_fs14.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_node_fs14.writeFileSync)(operatorTokenPath(), `${token.trim()}
 `, { encoding: "utf8", mode: 384 });
 }
 function agentCredentialPath() {
-  return import_node_path22.default.join(operatorDir(), "agent-credential");
+  return import_node_path23.default.join(operatorDir(), "agent-credential");
 }
 function persistAgentSecret(secret) {
   const dir = operatorDir();
-  (0, import_node_fs13.mkdirSync)(dir, { recursive: true, mode: 448 });
-  (0, import_node_fs13.writeFileSync)(agentCredentialPath(), `${secret.trim()}
+  (0, import_node_fs14.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_node_fs14.writeFileSync)(agentCredentialPath(), `${secret.trim()}
 `, { encoding: "utf8", mode: 384 });
 }
 function readAgentSecret() {
   const fromEnv = process.env.MRRLIN_AGENT_SECRET?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const raw = (0, import_node_fs13.readFileSync)(agentCredentialPath(), "utf8").trim();
+    const raw = (0, import_node_fs14.readFileSync)(agentCredentialPath(), "utf8").trim();
     return raw || void 0;
   } catch {
     return void 0;
@@ -50478,16 +50706,16 @@ function readAgentSecret() {
 }
 
 // src/thread-index.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path23 = __toESM(require("node:path"), 1);
+var import_node_fs15 = require("node:fs");
+var import_node_path24 = __toESM(require("node:path"), 1);
 function threadIndexPath(stateDir) {
-  return import_node_path23.default.join(stateDir, "threads.json");
+  return import_node_path24.default.join(stateDir, "threads.json");
 }
 function loadThreadIndex(stateDir, ttlMs, now) {
   const result = /* @__PURE__ */ new Map();
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs14.readFileSync)(threadIndexPath(stateDir), "utf8"));
+    parsed = JSON.parse((0, import_node_fs15.readFileSync)(threadIndexPath(stateDir), "utf8"));
   } catch {
     return result;
   }
@@ -50510,8 +50738,8 @@ function loadThreadIndex(stateDir, ttlMs, now) {
   return result;
 }
 function saveThreadIndex(stateDir, entries) {
-  (0, import_node_fs14.mkdirSync)(stateDir, { recursive: true, mode: 448 });
-  (0, import_node_fs14.writeFileSync)(threadIndexPath(stateDir), `${JSON.stringify(Object.fromEntries(entries), null, 2)}
+  (0, import_node_fs15.mkdirSync)(stateDir, { recursive: true, mode: 448 });
+  (0, import_node_fs15.writeFileSync)(threadIndexPath(stateDir), `${JSON.stringify(Object.fromEntries(entries), null, 2)}
 `, {
     encoding: "utf8",
     mode: 384
@@ -50647,9 +50875,9 @@ function createToolBusyClock(opts) {
 
 // src/worker-token.ts
 var import_node_crypto10 = require("node:crypto");
-var import_node_fs15 = require("node:fs");
-var import_node_os11 = __toESM(require("node:os"), 1);
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_fs16 = require("node:fs");
+var import_node_os12 = __toESM(require("node:os"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
 var DEFAULT_WORKER_PORT = 8792;
 function workerPort() {
   const raw = process.env.MRRLIN_WORKER_PORT;
@@ -50658,15 +50886,15 @@ function workerPort() {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_WORKER_PORT;
 }
 function workerDir() {
-  const base = process.env.CODEX_HOME ? import_node_path24.default.join(process.env.CODEX_HOME, "mrrlin") : import_node_path24.default.join(import_node_os11.default.homedir(), ".mrrlin");
-  return import_node_path24.default.join(base, "worker");
+  const base = process.env.CODEX_HOME ? import_node_path25.default.join(process.env.CODEX_HOME, "mrrlin") : import_node_path25.default.join(import_node_os12.default.homedir(), ".mrrlin");
+  return import_node_path25.default.join(base, "worker");
 }
 function workerTokenPath() {
-  return import_node_path24.default.join(workerDir(), "token");
+  return import_node_path25.default.join(workerDir(), "token");
 }
 function readWorkerToken() {
   try {
-    const token = (0, import_node_fs15.readFileSync)(workerTokenPath(), "utf8").trim();
+    const token = (0, import_node_fs16.readFileSync)(workerTokenPath(), "utf8").trim();
     return token.length > 0 ? token : null;
   } catch {
     return null;
@@ -50676,18 +50904,18 @@ function readOrCreateWorkerToken() {
   const existing = readWorkerToken();
   if (existing) return existing;
   const dir = workerDir();
-  (0, import_node_fs15.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_node_fs16.mkdirSync)(dir, { recursive: true, mode: 448 });
   const token = (0, import_node_crypto10.randomBytes)(32).toString("hex");
-  (0, import_node_fs15.writeFileSync)(workerTokenPath(), `${token}
+  (0, import_node_fs16.writeFileSync)(workerTokenPath(), `${token}
 `, { encoding: "utf8", mode: 384 });
   return token;
 }
 
 // src/remote-phone-relay.ts
 var import_node_events2 = require("node:events");
-var import_node_fs16 = require("node:fs");
-var import_node_os12 = require("node:os");
-var import_node_path25 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_os13 = require("node:os");
+var import_node_path26 = require("node:path");
 
 // ../../node_modules/.pnpm/@noble+hashes@1.3.3/node_modules/@noble/hashes/esm/cryptoNode.js
 var nc = __toESM(require("node:crypto"), 1);
@@ -54258,9 +54486,9 @@ var DirectorRelay = class {
 
 // src/remote-phone-relay.ts
 function loadOrCreateAgentDeviceKey() {
-  const path24 = (0, import_node_path25.join)((0, import_node_os12.homedir)(), ".mrrlin", "agent-device-key");
+  const path25 = (0, import_node_path26.join)((0, import_node_os13.homedir)(), ".mrrlin", "agent-device-key");
   try {
-    const raw = JSON.parse((0, import_node_fs16.readFileSync)(path24, "utf8"));
+    const raw = JSON.parse((0, import_node_fs17.readFileSync)(path25, "utf8"));
     if (typeof raw.priv === "string" && typeof raw.pub === "string") {
       return { privateKey: fromBase64Url(raw.priv), publicKey: fromBase64Url(raw.pub) };
     }
@@ -54268,9 +54496,9 @@ function loadOrCreateAgentDeviceKey() {
   }
   const kp = generateIdentityKeyPair();
   try {
-    (0, import_node_fs16.mkdirSync)((0, import_node_path25.join)((0, import_node_os12.homedir)(), ".mrrlin"), { recursive: true });
-    (0, import_node_fs16.writeFileSync)(
-      path24,
+    (0, import_node_fs17.mkdirSync)((0, import_node_path26.join)((0, import_node_os13.homedir)(), ".mrrlin"), { recursive: true });
+    (0, import_node_fs17.writeFileSync)(
+      path25,
       JSON.stringify({ priv: toBase64Url(kp.privateKey), pub: toBase64Url(kp.publicKey) }),
       { mode: 384 }
     );
@@ -54278,10 +54506,10 @@ function loadOrCreateAgentDeviceKey() {
   }
   return kp;
 }
-var AGENT_PAIRING_PATH = (0, import_node_path25.join)((0, import_node_os12.homedir)(), ".mrrlin", "agent-pairing.json");
+var AGENT_PAIRING_PATH = (0, import_node_path26.join)((0, import_node_os13.homedir)(), ".mrrlin", "agent-pairing.json");
 function loadAgentPairing() {
   try {
-    const raw = JSON.parse((0, import_node_fs16.readFileSync)(AGENT_PAIRING_PATH, "utf8"));
+    const raw = JSON.parse((0, import_node_fs17.readFileSync)(AGENT_PAIRING_PATH, "utf8"));
     if (typeof raw.channelId === "string" && typeof raw.agentControlSecret === "string" && typeof raw.relayAuth === "string" && typeof raw.peerIdentityKey === "string") {
       return {
         channelId: raw.channelId,
@@ -54296,8 +54524,8 @@ function loadAgentPairing() {
 }
 function saveAgentPairing(record2) {
   try {
-    (0, import_node_fs16.mkdirSync)((0, import_node_path25.join)((0, import_node_os12.homedir)(), ".mrrlin"), { recursive: true });
-    (0, import_node_fs16.writeFileSync)(AGENT_PAIRING_PATH, JSON.stringify(record2), { mode: 384 });
+    (0, import_node_fs17.mkdirSync)((0, import_node_path26.join)((0, import_node_os13.homedir)(), ".mrrlin"), { recursive: true });
+    (0, import_node_fs17.writeFileSync)(AGENT_PAIRING_PATH, JSON.stringify(record2), { mode: 384 });
   } catch {
   }
 }
@@ -54475,18 +54703,18 @@ async function renderPairingQrSvg(payload) {
 }
 
 // src/checkout-registry.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path27 = require("node:path");
 var CheckoutRegistry = class {
   file;
   constructor(stateDir) {
-    this.file = (0, import_node_path26.join)(stateDir, "checkouts.json");
-    (0, import_node_fs17.mkdirSync)(stateDir, { recursive: true });
+    this.file = (0, import_node_path27.join)(stateDir, "checkouts.json");
+    (0, import_node_fs18.mkdirSync)(stateDir, { recursive: true });
   }
   read() {
-    if (!(0, import_node_fs17.existsSync)(this.file)) return {};
+    if (!(0, import_node_fs18.existsSync)(this.file)) return {};
     try {
-      return JSON.parse((0, import_node_fs17.readFileSync)(this.file, "utf8"));
+      return JSON.parse((0, import_node_fs18.readFileSync)(this.file, "utf8"));
     } catch {
       return {};
     }
@@ -54494,10 +54722,10 @@ var CheckoutRegistry = class {
   get(slug) {
     return this.read()[slug] ?? null;
   }
-  confirm(slug, path24, now) {
+  confirm(slug, path25, now) {
     const all = this.read();
-    all[slug] = { path: path24, confirmedAt: now };
-    (0, import_node_fs17.writeFileSync)(this.file, JSON.stringify(all, null, 2));
+    all[slug] = { path: path25, confirmedAt: now };
+    (0, import_node_fs18.writeFileSync)(this.file, JSON.stringify(all, null, 2));
   }
   /**
    * Task 5.2 (github-via-capabilities): another slug whose registered path resolves, via
@@ -54520,14 +54748,14 @@ var CheckoutRegistry = class {
     if (!own) return null;
     let ownReal;
     try {
-      ownReal = (0, import_node_fs17.realpathSync)(own.path);
+      ownReal = (0, import_node_fs18.realpathSync)(own.path);
     } catch {
       return null;
     }
     for (const [otherSlug, entry] of Object.entries(this.read())) {
       if (otherSlug === slug) continue;
       try {
-        if ((0, import_node_fs17.realpathSync)(entry.path) === ownReal) return otherSlug;
+        if ((0, import_node_fs18.realpathSync)(entry.path) === ownReal) return otherSlug;
       } catch {
         continue;
       }
@@ -54538,7 +54766,7 @@ var CheckoutRegistry = class {
 
 // src/checkout-handlers.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 
 // src/git-remote-match.ts
 function normalizeRemote(url2) {
@@ -54573,7 +54801,7 @@ function validateCheckoutPath(checkoutPath, repo) {
   }
   let resolvedPath;
   try {
-    resolvedPath = (0, import_node_fs18.realpathSync)(trimmedPath);
+    resolvedPath = (0, import_node_fs19.realpathSync)(trimmedPath);
   } catch {
     return {
       ok: false,
@@ -54879,9 +55107,9 @@ function extractVerificationSection(markdown) {
 }
 
 // src/director-reseed.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 var import_node_readline = require("node:readline");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 function estimateTokens(s) {
   return Buffer.byteLength(s, "utf8");
 }
@@ -55013,9 +55241,9 @@ async function readSessionRows(logsDir, files, sessionIds) {
   const lines2 = [];
   let missingFiles = 0;
   for (const f of files) {
-    const filePath = (0, import_node_path27.join)(logsDir, f);
+    const filePath = (0, import_node_path28.join)(logsDir, f);
     try {
-      const stream = (0, import_node_fs19.createReadStream)(filePath, { encoding: "utf8" });
+      const stream = (0, import_node_fs20.createReadStream)(filePath, { encoding: "utf8" });
       const rl = (0, import_node_readline.createInterface)({ input: stream, crlfDelay: Infinity });
       try {
         for await (const line of rl) {
@@ -55039,18 +55267,18 @@ async function readSessionRows(logsDir, files, sessionIds) {
 }
 
 // src/external-agents-scrub.ts
-var import_node_fs20 = __toESM(require("node:fs"), 1);
-var import_node_os13 = __toESM(require("node:os"), 1);
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_os14 = __toESM(require("node:os"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 var REDACTION = "[REDACTED]";
 var SHORT_VALUE_THRESHOLD = 8;
-var KEYS_ENV_PATH = () => import_node_path28.default.join(import_node_os13.default.homedir(), ".local", "state", "external-agents", "keys.env");
+var KEYS_ENV_PATH = () => import_node_path29.default.join(import_node_os14.default.homedir(), ".local", "state", "external-agents", "keys.env");
 var keysEnvCache = null;
 function readKeysEnv() {
   const filePath = KEYS_ENV_PATH();
   let mtimeMs = 0;
   try {
-    mtimeMs = import_node_fs20.default.statSync(filePath).mtimeMs;
+    mtimeMs = import_node_fs21.default.statSync(filePath).mtimeMs;
   } catch {
     mtimeMs = 0;
   }
@@ -55059,7 +55287,7 @@ function readKeysEnv() {
   }
   const map2 = /* @__PURE__ */ new Map();
   try {
-    const content = import_node_fs20.default.readFileSync(filePath, "utf8");
+    const content = import_node_fs21.default.readFileSync(filePath, "utf8");
     for (const rawLine of content.split(/\r?\n/)) {
       const line = rawLine.trim();
       if (line === "" || line.startsWith("#")) continue;
@@ -55477,7 +55705,7 @@ function addBridgeModel(target, model) {
 }
 function readTextIfExists(filePath) {
   try {
-    return import_node_fs21.default.readFileSync(filePath, "utf8");
+    return import_node_fs22.default.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -55488,9 +55716,9 @@ function readKnownGptSlugsFromTomlFile(filePath) {
   return Array.from(raw.matchAll(/^\s*model\s*=\s*"([^"]+)"/gm)).map((match) => match[1]?.trim() ?? "").filter(isSelectableModelSlug);
 }
 function readCodexFallbackModels() {
-  const codexHome = process.env.CODEX_HOME?.trim() || import_node_path29.default.join(import_node_os14.default.homedir(), ".codex");
+  const codexHome = process.env.CODEX_HOME?.trim() || import_node_path30.default.join(import_node_os15.default.homedir(), ".codex");
   const models = /* @__PURE__ */ new Map();
-  const cachePath = import_node_path29.default.join(codexHome, "models_cache.json");
+  const cachePath = import_node_path30.default.join(codexHome, "models_cache.json");
   const cacheRaw = readTextIfExists(cachePath);
   if (cacheRaw) {
     try {
@@ -55540,7 +55768,7 @@ function readCodexFallbackModels() {
       );
     }
   }
-  for (const slug of readKnownGptSlugsFromTomlFile(import_node_path29.default.join(codexHome, "config.toml"))) {
+  for (const slug of readKnownGptSlugsFromTomlFile(import_node_path30.default.join(codexHome, "config.toml"))) {
     addBridgeModel(
       models,
       mapBridgeModel({
@@ -55554,11 +55782,11 @@ function readCodexFallbackModels() {
       })
     );
   }
-  const automationsDir = import_node_path29.default.join(codexHome, "automations");
+  const automationsDir = import_node_path30.default.join(codexHome, "automations");
   try {
-    for (const entry of import_node_fs21.default.readdirSync(automationsDir, { withFileTypes: true })) {
+    for (const entry of import_node_fs22.default.readdirSync(automationsDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      for (const slug of readKnownGptSlugsFromTomlFile(import_node_path29.default.join(automationsDir, entry.name, "automation.toml"))) {
+      for (const slug of readKnownGptSlugsFromTomlFile(import_node_path30.default.join(automationsDir, entry.name, "automation.toml"))) {
         addBridgeModel(
           models,
           mapBridgeModel({
@@ -55584,9 +55812,9 @@ function selfUpdateInboxItemId(offeredVersion) {
   return `II-MCPUPD-${offeredVersion.replace(/[^A-Za-z0-9._-]/g, "-")}-${hash3}`;
 }
 function neutralCheckoutCwd(stateDir) {
-  const dir = import_node_path29.default.join(stateDir, "no-checkout");
+  const dir = import_node_path30.default.join(stateDir, "no-checkout");
   try {
-    import_node_fs21.default.mkdirSync(dir, { recursive: true });
+    import_node_fs22.default.mkdirSync(dir, { recursive: true });
   } catch {
   }
   return dir;
@@ -56096,7 +56324,7 @@ async function runOrphanWorktreeSweep(client, opts) {
   const cutoff = Date.now() - worktreeRetentionMs();
   const isReapable = (worktreePath) => {
     try {
-      return import_node_fs21.default.statSync(worktreePath).mtimeMs < cutoff;
+      return import_node_fs22.default.statSync(worktreePath).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -56572,7 +56800,7 @@ function createBridgeMessageHandler(deps) {
           sendForSpan({ type: "checkout-state", ok: false, error: { code: "invalid_input", fields: { projectSlug: "required" } } });
           return;
         }
-        const state = readCheckoutState(deps.checkoutRegistry, projectSlug, import_node_os14.default.hostname());
+        const state = readCheckoutState(deps.checkoutRegistry, projectSlug, import_node_os15.default.hostname());
         if (!state) {
           sendForSpan({ type: "checkout-state", ok: false, error: { code: "checkout_missing" } });
           return;
@@ -56604,7 +56832,7 @@ function createBridgeMessageHandler(deps) {
         const result = registerCheckout(
           deps.checkoutRegistry,
           { projectSlug, path: typeof msg.path === "string" ? msg.path : "", repo },
-          import_node_os14.default.hostname()
+          import_node_os15.default.hostname()
         );
         if (!result.ok) {
           sendForSpan({ type: "checkout-register", ok: false, error: { code: result.code, detail: result.detail } });
@@ -57320,7 +57548,7 @@ function createBridgeMessageHandler(deps) {
             if (effectiveText.length > 0) {
               const updateOffer = deps.maybeUpdateOffer ? deps.maybeUpdateOffer() : null;
               const updateOfferProjectSlug = msg.context?.projectSlug?.trim();
-              if (updateOffer !== null && updateOfferProjectSlug && deps.fileUpdateInboxItem) {
+              if (updateOffer !== null && !updateOffer.startsWith(SELF_UPDATE_AUTH_PREFLIGHT_OFFER_PREFIX) && updateOfferProjectSlug && deps.fileUpdateInboxItem) {
                 void deps.fileUpdateInboxItem(updateOfferProjectSlug);
               }
               let reseedPrefix = null;
@@ -57706,8 +57934,8 @@ async function startDirectorBridge() {
     codexCwd: config2.codexCwd,
     codexExecutable: config2.codexExecutable,
     checkoutRegistry,
-    worktreeRoot: import_node_path29.default.join(config2.stateDir, "worktrees"),
-    locksDir: import_node_path29.default.join(config2.stateDir, "locks"),
+    worktreeRoot: import_node_path30.default.join(config2.stateDir, "worktrees"),
+    locksDir: import_node_path30.default.join(config2.stateDir, "locks"),
     // Wire the executor server for code-execution runs. Each run gets its own provider process
     // (app-server for codex, a resident CLI child for claude) at the run worktree, running
     // UNRESTRICTED from the real operator config (owner no-sandbox decision — auth + mrrlin MCP
@@ -57751,13 +57979,13 @@ async function startDirectorBridge() {
         // egressDomains is retained in the seam signature (verification-turn.ts still computes the
         // env host) but no longer constrains anything — the executor is unrestricted.
         startSandbox: async (_egressDomains, providerId) => {
-          const cwd = import_node_fs21.default.mkdtempSync(import_node_path29.default.join(import_node_os14.default.tmpdir(), "mrrlin-verify-"));
+          const cwd = import_node_fs22.default.mkdtempSync(import_node_path30.default.join(import_node_os15.default.tmpdir(), "mrrlin-verify-"));
           let executor;
           try {
             executor = await startExecutorServer({ worktree: cwd, provider: providerId });
           } catch (error51) {
             try {
-              import_node_fs21.default.rmSync(cwd, { recursive: true, force: true });
+              import_node_fs22.default.rmSync(cwd, { recursive: true, force: true });
             } catch {
             }
             throw error51;
@@ -57768,7 +57996,7 @@ async function startDirectorBridge() {
             dispose: () => {
               executor.dispose();
               try {
-                import_node_fs21.default.rmSync(cwd, { recursive: true, force: true });
+                import_node_fs22.default.rmSync(cwd, { recursive: true, force: true });
               } catch {
               }
             }
@@ -57979,7 +58207,7 @@ async function startDirectorBridge() {
     }
     const files = dayFilesInWindow(/* @__PURE__ */ new Date(), reseedWindowMs);
     const sessionIds = [args.directorSessionId, ...args.priorSessionIds];
-    const { lines: lines2, missingFiles } = await readSessionRows(import_node_path29.default.join(config2.stateDir, "logs"), files, sessionIds);
+    const { lines: lines2, missingFiles } = await readSessionRows(import_node_path30.default.join(config2.stateDir, "logs"), files, sessionIds);
     const { items, skipped: skipped2 } = extractItems(lines2, sessionIds);
     if (items.length === 0) return refuse2("no-rows");
     const budget = Math.max(0, Math.min(config2.reseedMaxTokens, config2.turnMaxTokens - args.otherBytes));
@@ -58086,7 +58314,7 @@ async function startDirectorBridge() {
   const bridgeLogger = createBridgeLogger(config2.stateDir, process.env);
   let bridgeBinShaShort = "unknown00000";
   try {
-    bridgeBinShaShort = import_node_crypto11.default.createHash("sha256").update(import_node_fs21.default.readFileSync(process.argv[1] ?? "")).digest("hex").slice(0, 12);
+    bridgeBinShaShort = import_node_crypto11.default.createHash("sha256").update(import_node_fs22.default.readFileSync(process.argv[1] ?? "")).digest("hex").slice(0, 12);
   } catch {
   }
   attachBridgeWss(server, {
@@ -58222,8 +58450,8 @@ async function startDirectorBridge() {
       );
       void runOrphanWorktreeSweep(client, {
         checkoutRegistry,
-        worktreeRoot: import_node_path29.default.join(config2.stateDir, "worktrees"),
-        locksDir: import_node_path29.default.join(config2.stateDir, "locks")
+        worktreeRoot: import_node_path30.default.join(config2.stateDir, "worktrees"),
+        locksDir: import_node_path30.default.join(config2.stateDir, "locks")
       });
       {
         const { retainedBuffers, retainedBytes, tombstonesRemoved } = sweepReplayBuffers(threads, tombstones, {
@@ -58548,15 +58776,15 @@ function readDispatchBody(req) {
 function readOrCreateBridgeToken(stateDir) {
   const explicit = (process.env.MRRLIN_DIRECTOR_BRIDGE_TOKEN ?? "").trim();
   if (explicit) return explicit;
-  const tokenPath = import_node_path29.default.join(stateDir, "token.txt");
+  const tokenPath = import_node_path30.default.join(stateDir, "token.txt");
   try {
-    const existing = import_node_fs21.default.readFileSync(tokenPath, "utf8").trim();
+    const existing = import_node_fs22.default.readFileSync(tokenPath, "utf8").trim();
     if (existing) return existing;
   } catch {
   }
-  import_node_fs21.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
+  import_node_fs22.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
   const token = import_node_crypto11.default.randomBytes(32).toString("base64url");
-  import_node_fs21.default.writeFileSync(tokenPath, `${token}
+  import_node_fs22.default.writeFileSync(tokenPath, `${token}
 `, { mode: 384 });
   return token;
 }
@@ -61947,15 +62175,15 @@ var StdioServerTransport = class {
 // src/tools.ts
 var import_node_crypto14 = require("node:crypto");
 var import_promises10 = require("node:fs/promises");
-var import_node_path32 = __toESM(require("node:path"), 1);
-var import_node_os15 = __toESM(require("node:os"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_os16 = __toESM(require("node:os"), 1);
 
 // ../../packages/wiki/dist/index.js
 var import_promises8 = __toESM(require("node:fs/promises"), 1);
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var INCLUDED_DOC_FOLDERS = /* @__PURE__ */ new Set(["_meta", "explanation", "how-to", "reference", "sdd", "tutorials"]);
 function toPosixPath(input) {
-  return input.split(import_node_path30.default.sep).join("/");
+  return input.split(import_node_path31.default.sep).join("/");
 }
 function slugifyWikiSegment(input) {
   return input.trim().toLowerCase().replace(/`/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -61969,12 +62197,12 @@ async function pathExists3(input) {
   }
 }
 async function findWorkspaceRoot(start = process.cwd()) {
-  let current2 = import_node_path30.default.resolve(start);
+  let current2 = import_node_path31.default.resolve(start);
   while (true) {
-    if (await pathExists3(import_node_path30.default.join(current2, "pnpm-workspace.yaml")) && await pathExists3(import_node_path30.default.join(current2, "docs"))) {
+    if (await pathExists3(import_node_path31.default.join(current2, "pnpm-workspace.yaml")) && await pathExists3(import_node_path31.default.join(current2, "docs"))) {
       return current2;
     }
-    const parent = import_node_path30.default.dirname(current2);
+    const parent = import_node_path31.default.dirname(current2);
     if (parent === current2) {
       throw new Error(`Unable to find Mrrlin workspace root from ${start}`);
     }
@@ -61983,28 +62211,28 @@ async function findWorkspaceRoot(start = process.cwd()) {
 }
 async function resolveDocsRoot(input) {
   if (input) {
-    return import_node_path30.default.resolve(input);
+    return import_node_path31.default.resolve(input);
   }
   if (process.env.MRRLIN_DOCS_ROOT) {
-    return import_node_path30.default.resolve(process.env.MRRLIN_DOCS_ROOT);
+    return import_node_path31.default.resolve(process.env.MRRLIN_DOCS_ROOT);
   }
-  return import_node_path30.default.join(await findWorkspaceRoot(), "docs");
+  return import_node_path31.default.join(await findWorkspaceRoot(), "docs");
 }
 async function resolveIndexPath(input) {
   if (input) {
-    return import_node_path30.default.resolve(input);
+    return import_node_path31.default.resolve(input);
   }
   if (process.env.MRRLIN_WIKI_INDEX_PATH) {
-    return import_node_path30.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
+    return import_node_path31.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
   }
   const workspaceRoot = await findWorkspaceRoot();
-  return import_node_path30.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  return import_node_path31.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
 }
 async function walkMarkdownFiles(root, dir = root) {
   const entries = await import_promises8.default.readdir(dir, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = import_node_path30.default.join(dir, entry.name);
+    const absolute = import_node_path31.default.join(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...await walkMarkdownFiles(root, absolute));
       continue;
@@ -62023,7 +62251,7 @@ function parseTitle(markdown, sourcePath) {
   return title;
 }
 function documentFromFile(docsRoot, absolutePath, markdown) {
-  const relativePath = toPosixPath(import_node_path30.default.relative(docsRoot, absolutePath));
+  const relativePath = toPosixPath(import_node_path31.default.relative(docsRoot, absolutePath));
   const [section, fileName] = relativePath.split("/");
   if (!section || !fileName || !INCLUDED_DOC_FOLDERS.has(section)) {
     return null;
@@ -64924,6 +65152,81 @@ async function deliverToGit(server, toolName, payload) {
   return invokeCapability(server, toolName, args);
 }
 
+// src/mcp-tool-error.ts
+var McpToolCodedError = class extends Error {
+  code;
+  violations;
+  constructor(code, message, violations) {
+    super(message);
+    this.name = "McpToolCodedError";
+    this.code = code;
+    this.violations = violations;
+  }
+};
+
+// src/delivery/artifacts.ts
+async function deliverToArtifacts(client, projectSlug, payload, bareFetch) {
+  const { bytes: bytes3, class: artifactClass, contentType, description, filename, runId, taskId } = payload;
+  const created = await client.createArtifactFile(projectSlug, {
+    class: artifactClass,
+    contentType,
+    filename,
+    runId,
+    sizeBytes: bytes3.byteLength,
+    taskId
+  });
+  let stage = "upload";
+  try {
+    if (created.upload.kind === "presigned-post") {
+      const form = new FormData();
+      for (const [field, value] of Object.entries(created.upload.fields)) {
+        form.append(field, value);
+      }
+      form.append("file", new Blob([bytes3], { type: contentType }), filename);
+      const fetchImpl = bareFetch ?? globalThis.fetch;
+      const uploadResponse = await fetchImpl(created.upload.url, { body: form, method: "POST" });
+      if (!uploadResponse.ok) {
+        throw new Error(`Presigned upload failed: ${uploadResponse.status} ${await uploadResponse.text()}`);
+      }
+    } else {
+      await client.uploadArtifactFileContent(projectSlug, created.artifact.id, bytes3, contentType);
+    }
+    stage = "complete";
+    const completed = await client.completeArtifactFile(projectSlug, created.artifact.id);
+    if (completed.runId) {
+      stage = "append-run-artifact";
+      await client.appendExecutionArtifact(projectSlug, completed.runId, {
+        id: `EA-${completed.id}`,
+        kind: "file",
+        payload: {
+          artifactFileId: completed.id,
+          class: completed.class,
+          contentType: completed.contentType,
+          description: description ?? null,
+          filename: completed.filename,
+          sizeBytes: completed.sizeBytes,
+          stableUrl: created.stableUrl
+        }
+      });
+    }
+    const markdown = contentType.startsWith("image/") ? `![${completed.filename}](${created.stableUrl})` : `[${completed.filename}](${created.stableUrl})`;
+    return {
+      artifactFile: completed,
+      markdown,
+      stableUrl: created.stableUrl
+    };
+  } catch (error51) {
+    const original = error51 instanceof MrrlinApiError ? error51.code : error51 instanceof McpToolCodedError ? error51.code : "ARTIFACT_FILE_UPLOAD_FAILED";
+    const message = error51 instanceof Error ? error51.message : String(error51);
+    const note = stage === "append-run-artifact" ? "file uploaded and completed successfully; only the run-history append failed \u2014 do NOT re-upload, reference the stableUrl directly" : "a pending row may remain; it is reaped automatically after 1h";
+    throw new McpToolCodedError(
+      original,
+      `artifactFileId=${created.artifact.id} stableUrl=${created.stableUrl} (failed at ${stage}; ${note}): ${message}`,
+      error51 instanceof MrrlinApiError ? error51.violations ?? void 0 : error51 instanceof McpToolCodedError ? error51.violations : void 0
+    );
+  }
+}
+
 // src/delivery/index.ts
 async function deliverThroughCapability(client, input) {
   if (resolveKindCapability(input.artifactKind) === null) {
@@ -64941,7 +65244,7 @@ async function deliverThroughCapability(client, input) {
     return { ok: false, reason: "transport_error" };
   }
   if (!resolution.ok) {
-    return { ok: false, reason: resolution.reason };
+    return { ok: false, reason: resolution.reason, message: resolution.message };
   }
   const { route, verdict } = resolution;
   if (verdict === "silent") {
@@ -64963,7 +65266,14 @@ var NoGrantForServerError = class extends Error {
 };
 async function proceedToDestination(client, route, input) {
   try {
-    const result = await callDestination(client, input.taskProjectSlug, route, input.payload, input.mcpConfigPath);
+    const result = await callDestination(
+      client,
+      input.taskProjectSlug,
+      route,
+      input.payload,
+      input.mcpConfigPath,
+      input.bareFetch
+    );
     const recorded = await recordUse(client, route, input, "ok");
     return { ok: true, use: recorded, result };
   } catch (error51) {
@@ -64972,7 +65282,15 @@ async function proceedToDestination(client, route, input) {
       return { ok: false, reason: "no_grant" };
     }
     await recordUse(client, route, input, "error");
-    return { ok: false, reason: "delivery_failed" };
+    const code = error51 instanceof McpToolCodedError || error51 instanceof MrrlinApiError ? error51.code : void 0;
+    const violations = error51 instanceof MrrlinApiError || error51 instanceof McpToolCodedError ? error51.violations : void 0;
+    return {
+      ok: false,
+      reason: "delivery_failed",
+      message: error51 instanceof Error ? error51.message : void 0,
+      code,
+      violations
+    };
   }
 }
 async function refuse(client, route, input) {
@@ -65129,7 +65447,7 @@ async function recordUse(client, route, input, outcome) {
     return null;
   }
 }
-async function callDestination(client, projectSlug, route, payload, mcpConfigPath) {
+async function callDestination(client, projectSlug, route, payload, mcpConfigPath, bareFetch) {
   const operation = isRecord6(payload) ? payload.operation : void 0;
   if (route.capability === "wiki") {
     if (operation !== "create" && operation !== "update") {
@@ -65145,6 +65463,12 @@ async function callDestination(client, projectSlug, route, payload, mcpConfigPat
     if (server === null) throw new NoGrantForServerError(`no local MCP config for server "${route.serverId}"`);
     return deliverToGit(server, route.toolName, payload);
   }
+  if (route.capability === "artifacts") {
+    if (operation !== "upload") {
+      throw new Error(`callDestination: payload.operation "${String(operation)}" is not valid for artifacts`);
+    }
+    return deliverToArtifacts(client, projectSlug, payload, bareFetch);
+  }
   throw new Error(`callDestination: no destination wired for capability "${route.capability}"`);
 }
 function isRecord6(value) {
@@ -66193,7 +66517,7 @@ var intentCheckDescriptor = createIntentCheckDescriptor();
 
 // src/evidence/assembler.ts
 var import_promises9 = require("node:fs/promises");
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 function evidenceDedupKey(sessionId, reportId) {
   return `${sessionId}:${reportId}`;
 }
@@ -66203,7 +66527,7 @@ function isRecord7(v) {
 async function readDayLines(stateDir, day, sessionId) {
   let raw;
   try {
-    raw = await (0, import_promises9.readFile)((0, import_node_path31.join)(stateDir, "logs", `bridge-${day}.jsonl`), "utf8");
+    raw = await (0, import_promises9.readFile)((0, import_node_path32.join)(stateDir, "logs", `bridge-${day}.jsonl`), "utf8");
   } catch {
     return [];
   }
@@ -66277,7 +66601,7 @@ async function assembleEvidence(stateDir, sessionId, reportId, gateCtx) {
   }
   let windowPruned = false;
   try {
-    const raw = await (0, import_promises9.readFile)((0, import_node_path31.join)(stateDir, "logs", ".pruned.jsonl"), "utf8");
+    const raw = await (0, import_promises9.readFile)((0, import_node_path32.join)(stateDir, "logs", ".pruned.jsonl"), "utf8");
     outer: for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let rec;
@@ -67316,14 +67640,6 @@ var ARTIFACT_EXTENSION_TYPES = {
   ".webp": "image/webp",
   ".gif": "image/gif"
 };
-var McpToolCodedError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "McpToolCodedError";
-    this.code = code;
-  }
-};
 function withAuth(options) {
   const baseFetch = options.fetch ?? globalThis.fetch;
   const authedFetch = async (input, init = {}) => {
@@ -67361,7 +67677,11 @@ function classifyClientError(fallbackCode, fallbackMessage, raw) {
     };
   }
   if (raw instanceof McpToolCodedError) {
-    return { code: raw.code, message: raw.message || fallbackMessage };
+    return {
+      code: raw.code,
+      message: raw.message || fallbackMessage,
+      ...raw.violations ? { violations: raw.violations } : {}
+    };
   }
   if (raw instanceof Error) {
     return { code: fallbackCode, message: raw.message || fallbackMessage };
@@ -67388,18 +67708,33 @@ function pingAsyncWorkerDispatch(projectSlug, jobId) {
   }).catch(() => {
   });
 }
-async function deliverBuiltIn(client, projectSlug, artifactKind, payload, mcpConfigPath) {
+async function deliverBuiltIn(client, projectSlug, artifactKind, payload, extra = {}) {
   const result = await deliverThroughCapability(client, {
     projectSlug,
     taskProjectSlug: projectSlug,
     artifactKind,
-    taskId: null,
-    runId: null,
+    taskId: extra.taskId ?? null,
+    runId: extra.runId ?? null,
     payload,
-    mcpConfigPath
+    mcpConfigPath: extra.mcpConfigPath,
+    bareFetch: extra.bareFetch
   });
   if (!result.ok) {
-    throw new McpToolCodedError(`CAPABILITY_${result.reason.toUpperCase()}`, `Delivery refused: ${result.reason}`);
+    throw new McpToolCodedError(
+      result.code ?? `CAPABILITY_${result.reason.toUpperCase()}`,
+      describeCapabilityRefusal({
+        reason: result.reason,
+        projectSlug,
+        artifactKind,
+        capability: resolveKindCapability(artifactKind),
+        detail: result.message
+      }),
+      // Consensus round 1 (chunk 4): a destination's own MrrlinApiError (e.g. artifact-file creation's
+      // 409) carries structured violations that classifyClientError already surfaces for every other
+      // tool -- deliverThroughCapability threads them onto DeliveryResult, converted here from the
+      // nullable client shape to McpToolCodedError's optional-array one.
+      result.violations ?? void 0
+    );
   }
   return result.result;
 }
@@ -67481,68 +67816,6 @@ async function getAgentProviderForPanel(client, opts = {}) {
 }
 function createMrrlinTools(options) {
   const client = createMrrlinClient(withAuth(options));
-  async function uploadArtifactBytes(c, args) {
-    const { bytes: bytes3, class: artifactClass, contentType, description, filename, projectSlug, runId, taskId } = args;
-    const created = await c.createArtifactFile(projectSlug, {
-      class: artifactClass,
-      contentType,
-      filename,
-      runId,
-      sizeBytes: bytes3.byteLength,
-      taskId
-    });
-    let stage = "upload";
-    try {
-      if (created.upload.kind === "presigned-post") {
-        const form = new FormData();
-        for (const [field, value] of Object.entries(created.upload.fields)) {
-          form.append(field, value);
-        }
-        form.append("file", new Blob([bytes3], { type: contentType }), filename);
-        const bareFetch = options.fetch ?? globalThis.fetch;
-        const uploadResponse = await bareFetch(created.upload.url, { body: form, method: "POST" });
-        if (!uploadResponse.ok) {
-          throw new Error(
-            `Presigned upload failed: ${uploadResponse.status} ${await uploadResponse.text()}`
-          );
-        }
-      } else {
-        await c.uploadArtifactFileContent(projectSlug, created.artifact.id, bytes3, contentType);
-      }
-      stage = "complete";
-      const completed = await c.completeArtifactFile(projectSlug, created.artifact.id);
-      if (completed.runId) {
-        stage = "append-run-artifact";
-        await c.appendExecutionArtifact(projectSlug, completed.runId, {
-          id: `EA-${completed.id}`,
-          kind: "file",
-          payload: {
-            artifactFileId: completed.id,
-            class: completed.class,
-            contentType: completed.contentType,
-            description: description ?? null,
-            filename: completed.filename,
-            sizeBytes: completed.sizeBytes,
-            stableUrl: created.stableUrl
-          }
-        });
-      }
-      const markdown = contentType.startsWith("image/") ? `![${completed.filename}](${created.stableUrl})` : `[${completed.filename}](${created.stableUrl})`;
-      return {
-        artifactFile: completed,
-        markdown,
-        stableUrl: created.stableUrl
-      };
-    } catch (error51) {
-      const original = error51 instanceof MrrlinApiError ? error51.code : error51 instanceof McpToolCodedError ? error51.code : "ARTIFACT_FILE_UPLOAD_FAILED";
-      const message = error51 instanceof Error ? error51.message : String(error51);
-      const note = stage === "append-run-artifact" ? "file uploaded and completed successfully; only the run-history append failed \u2014 do NOT re-upload, reference the stableUrl directly" : "a pending row may remain; it is reaped automatically after 1h";
-      throw new McpToolCodedError(
-        original,
-        `artifactFileId=${created.artifact.id} stableUrl=${created.stableUrl} (failed at ${stage}; ${note}): ${message}`
-      );
-    }
-  }
   return {
     [mcpToolNames.archivePlan]: makeTool(
       client,
@@ -67587,7 +67860,7 @@ function createMrrlinTools(options) {
         projectSlug,
         "code_change",
         { operation: "branch", ...input },
-        options.mcpConfigPath
+        { mcpConfigPath: options.mcpConfigPath }
       )
     ),
     [mcpToolNames.createGithubPullRequest]: makeTool(
@@ -67600,7 +67873,7 @@ function createMrrlinTools(options) {
         projectSlug,
         "code_change",
         { operation: "pull_request", ...input },
-        options.mcpConfigPath
+        { mcpConfigPath: options.mcpConfigPath }
       )
     ),
     [mcpToolNames.createPlan]: makeTool(
@@ -67677,7 +67950,7 @@ function createMrrlinTools(options) {
         projectSlug,
         "document",
         { operation: "create", page: input },
-        options.mcpConfigPath
+        { mcpConfigPath: options.mcpConfigPath }
       )
     ),
     [mcpToolNames.deleteTaskDependency]: makeTool(
@@ -67872,7 +68145,7 @@ function createMrrlinTools(options) {
         projectSlug,
         "document",
         { operation: "update", pageId, patch },
-        options.mcpConfigPath
+        { mcpConfigPath: options.mcpConfigPath }
       )
     ),
     [mcpToolNames.markSpecReady]: makeTool(
@@ -68141,7 +68414,7 @@ function createMrrlinTools(options) {
       "ARTIFACT_FILE_UPLOAD_FAILED",
       "Unable to upload artifact file.",
       async (c, { projectSlug, path: filePath, class: artifactClass, taskId, runId, description }) => {
-        const extension2 = import_node_path32.default.extname(filePath).toLowerCase();
+        const extension2 = import_node_path33.default.extname(filePath).toLowerCase();
         const contentType = ARTIFACT_EXTENSION_TYPES[extension2];
         if (!contentType) {
           throw new McpToolCodedError(
@@ -68169,17 +68442,14 @@ function createMrrlinTools(options) {
             "Artifact exceeds 5MB; split or summarize instead."
           );
         }
-        const filename = import_node_path32.default.basename(filePath);
-        return uploadArtifactBytes(c, {
-          bytes: bytes3,
-          class: artifactClass,
-          contentType,
-          description,
-          filename,
+        const filename = import_node_path33.default.basename(filePath);
+        return deliverBuiltIn(
+          c,
           projectSlug,
-          runId,
-          taskId
-        });
+          "file_set",
+          { operation: "upload", bytes: bytes3, class: artifactClass, contentType, description, filename, runId, taskId },
+          { mcpConfigPath: options.mcpConfigPath, bareFetch: options.fetch ?? globalThis.fetch, taskId, runId }
+        );
       }
     ),
     [mcpToolNames.deliverFile]: makeTool(
@@ -68194,7 +68464,7 @@ function createMrrlinTools(options) {
             `Invalid filename '${filename}'; provide a bare filename with no path separators or '..'.`
           );
         }
-        const extension2 = import_node_path32.default.extname(filename).toLowerCase();
+        const extension2 = import_node_path33.default.extname(filename).toLowerCase();
         const contentType = ARTIFACT_EXTENSION_TYPES[extension2];
         if (!contentType) {
           throw new McpToolCodedError(
@@ -68215,16 +68485,13 @@ function createMrrlinTools(options) {
             "Artifact exceeds 5MB; split or summarize instead."
           );
         }
-        return uploadArtifactBytes(c, {
-          bytes: bytes3,
-          class: artifactClass,
-          contentType,
-          description,
-          filename,
+        return deliverBuiltIn(
+          c,
           projectSlug,
-          runId,
-          taskId
-        });
+          "file_set",
+          { operation: "upload", bytes: bytes3, class: artifactClass, contentType, description, filename, runId, taskId },
+          { mcpConfigPath: options.mcpConfigPath, bareFetch: options.fetch ?? globalThis.fetch, taskId, runId }
+        );
       }
     ),
     [mcpToolNames.listArtifactFiles]: makeTool(
@@ -68269,7 +68536,7 @@ function createMrrlinTools(options) {
       "Unable to register local checkout.",
       async (_c, { projectSlug, path: checkoutPath, repo }) => {
         const registry3 = new CheckoutRegistry(resolveStateDir());
-        const result = registerCheckout(registry3, { projectSlug, path: checkoutPath, repo }, import_node_os15.default.hostname());
+        const result = registerCheckout(registry3, { projectSlug, path: checkoutPath, repo }, import_node_os16.default.hostname());
         if (!result.ok) {
           const codeMap = {
             not_absolute: "LOCAL_CHECKOUT_PATH_NOT_ABSOLUTE",
@@ -68506,9 +68773,9 @@ function runSetCredential(args) {
 }
 
 // src/install-service.ts
-var import_node_os16 = __toESM(require("node:os"), 1);
-var import_node_fs22 = require("node:fs");
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_os17 = __toESM(require("node:os"), 1);
+var import_node_fs23 = require("node:fs");
+var import_node_path34 = __toESM(require("node:path"), 1);
 function readExistingTelemetryDefaultProject(deps, ecoPath) {
   try {
     const existing = deps.readFile?.(ecoPath);
@@ -68568,7 +68835,7 @@ function deriveServiceApiTarget(deps, ecoPath) {
 var SYSTEM_PATH_DIRS = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
 function defaultHomeOwnerUid(home) {
   try {
-    return (0, import_node_fs22.statSync)(home).uid;
+    return (0, import_node_fs23.statSync)(home).uid;
   } catch {
     return null;
   }
@@ -68609,11 +68876,11 @@ function installService(deps) {
     deps.log(resolved.reason);
     return { ok: false };
   }
-  const home = deps.env.HOME ?? import_node_os16.default.homedir();
+  const home = deps.env.HOME ?? import_node_os17.default.homedir();
   const user = resolveBridgeUser({
     env: deps.env,
     home,
-    userInfo: deps.userInfo ?? (() => import_node_os16.default.userInfo()),
+    userInfo: deps.userInfo ?? (() => import_node_os17.default.userInfo()),
     homeOwnerUid: deps.homeOwnerUid ?? defaultHomeOwnerUid,
     log: deps.log
   });
@@ -68629,9 +68896,9 @@ function installService(deps) {
   const claudeBin = deps.which("claude");
   const resolvedBins = [...bins, claudeBin].filter((b) => b !== null);
   const pathEnv = Array.from(
-    /* @__PURE__ */ new Set([...resolvedBins.map((b) => import_node_path33.default.dirname(b)), ...SYSTEM_PATH_DIRS])
+    /* @__PURE__ */ new Set([...resolvedBins.map((b) => import_node_path34.default.dirname(b)), ...SYSTEM_PATH_DIRS])
   ).join(":");
-  const ecoPath = import_node_path33.default.join(home, ".mrrlin", "ecosystem.config.cjs");
+  const ecoPath = import_node_path34.default.join(home, ".mrrlin", "ecosystem.config.cjs");
   const apiTarget = deriveServiceApiTarget(deps, ecoPath);
   const telemetryDefaultProject = "MRRLIN_TELEMETRY_DEFAULT_PROJECT" in deps.env ? deps.env.MRRLIN_TELEMETRY_DEFAULT_PROJECT?.trim() || void 0 : readExistingTelemetryDefaultProject(deps, ecoPath);
   const text = renderEcosystemConfig({
@@ -68695,13 +68962,13 @@ function uninstallService(deps) {
 
 // src/uninstall-codex.ts
 var import_promises11 = __toESM(require("node:fs/promises"), 1);
-var import_node_os17 = __toESM(require("node:os"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_os18 = __toESM(require("node:os"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var toml3 = __toESM(require_toml(), 1);
 function resolveCodexHome3(options) {
   if (options.codexHome) return options.codexHome;
   if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return import_node_path34.default.join(options.homeDir ?? import_node_os17.default.homedir(), ".codex");
+  return import_node_path35.default.join(options.homeDir ?? import_node_os18.default.homedir(), ".codex");
 }
 async function pathExists4(target) {
   try {
@@ -68714,7 +68981,7 @@ async function pathExists4(target) {
 var MRRLIN_BLOCK_RE = /(^|\n)\[mcp_servers\.(?:mrrlin(?:-browser)?|external-agents)(?:\]|\.[^\]\n]*\])[\s\S]*?(?=\n\[|$)/g;
 async function uninstallCodex(options = {}) {
   const codexHome = resolveCodexHome3(options);
-  const configPath = import_node_path34.default.join(codexHome, "config.toml");
+  const configPath = import_node_path35.default.join(codexHome, "config.toml");
   const removePrompts = async () => uninstallPrompts(codexHome, options.promptNames ?? []);
   if (!await pathExists4(configPath)) {
     return { action: "missing", configPath, prompts: await removePrompts() };
@@ -68742,10 +69009,10 @@ async function uninstallCodex(options = {}) {
 }
 async function uninstallPrompts(codexHome, names) {
   if (names.length === 0) return [];
-  const promptsDir = import_node_path34.default.join(codexHome, "prompts");
+  const promptsDir = import_node_path35.default.join(codexHome, "prompts");
   const out = [];
   for (const name of names) {
-    const promptPath = import_node_path34.default.join(promptsDir, `${name}.md`);
+    const promptPath = import_node_path35.default.join(promptsDir, `${name}.md`);
     try {
       await import_promises11.default.unlink(promptPath);
       out.push({ name, action: "removed", promptPath });
@@ -68763,7 +69030,7 @@ async function uninstallPrompts(codexHome, names) {
 
 // src/extract/command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path35 = require("node:path");
+var import_node_path36 = require("node:path");
 function parseArgs(args) {
   const map2 = /* @__PURE__ */ new Map();
   for (let i = 0; i < args.length; i++) {
@@ -68800,7 +69067,7 @@ Missing required flag(s): ${missing.join(
   const days = await findSessionDays(deps.stateDir, sessionId);
   const matchingLines = [];
   for (const day of days) {
-    const logPath = (0, import_node_path35.join)(deps.stateDir, "logs", `bridge-${day}.jsonl`);
+    const logPath = (0, import_node_path36.join)(deps.stateDir, "logs", `bridge-${day}.jsonl`);
     let raw;
     try {
       raw = await (0, import_promises12.readFile)(logPath, "utf8");
@@ -68900,16 +69167,16 @@ function bootHookStatus() {
   if (process.platform !== "darwin") return { status: "unknown" };
   const uid = process.getuid?.();
   if (uid === void 0 || uid === 0) return { status: "unknown" };
-  const home = process.env.HOME ?? (0, import_node_os18.homedir)();
-  const agents = import_node_path37.default.join(home, "Library", "LaunchAgents");
+  const home = process.env.HOME ?? (0, import_node_os19.homedir)();
+  const agents = import_node_path38.default.join(home, "Library", "LaunchAgents");
   const candidates = [
-    { label: "com.mrrlin.director-bridge", plist: import_node_path37.default.join(agents, "com.mrrlin.director-bridge.plist") },
-    { label: "com.PM2", plist: import_node_path37.default.join(agents, `pm2.${(0, import_node_os18.userInfo)().username}.plist`) }
+    { label: "com.mrrlin.director-bridge", plist: import_node_path38.default.join(agents, "com.mrrlin.director-bridge.plist") },
+    { label: "com.PM2", plist: import_node_path38.default.join(agents, `pm2.${(0, import_node_os19.userInfo)().username}.plist`) }
   ];
   for (const candidate of candidates) {
     const printed = (0, import_node_child_process18.spawnSync)("launchctl", ["print", `gui/${uid}/${candidate.label}`], { encoding: "utf8" });
     if (printed.status !== 0) continue;
-    if (!(0, import_node_fs23.existsSync)(candidate.plist)) continue;
+    if (!(0, import_node_fs24.existsSync)(candidate.plist)) continue;
     const out = printed.stdout ?? "";
     const runs = /^\s*runs\s*=\s*(\d+)/m.exec(out);
     const exitCode = /^\s*last exit code\s*=\s*(-?\d+)/m.exec(out);
@@ -69194,8 +69461,8 @@ async function main() {
         }
       }
       try {
-        const codexHome = process.env.CODEX_HOME ?? import_node_path37.default.join(process.env.HOME ?? (0, import_node_os18.homedir)(), ".codex");
-        (0, import_node_fs23.rmSync)(import_node_path37.default.join(codexHome, "prompts", "report-issue.md"), { force: true });
+        const codexHome = process.env.CODEX_HOME ?? import_node_path38.default.join(process.env.HOME ?? (0, import_node_os19.homedir)(), ".codex");
+        (0, import_node_fs24.rmSync)(import_node_path38.default.join(codexHome, "prompts", "report-issue.md"), { force: true });
       } catch {
       }
       const claudeResult = await installClaude({ binPath, force, serveEnv });
@@ -69256,15 +69523,15 @@ async function main() {
         env: process.env,
         cwd: process.cwd(),
         writeFile: (p, c) => {
-          (0, import_node_fs23.mkdirSync)(import_node_path37.default.dirname(p), { recursive: true, mode: 448 });
-          (0, import_node_fs23.writeFileSync)(p, c, { mode: 384 });
+          (0, import_node_fs24.mkdirSync)(import_node_path38.default.dirname(p), { recursive: true, mode: 448 });
+          (0, import_node_fs24.writeFileSync)(p, c, { mode: 384 });
         },
         // Swallows every error on purpose — the only caller uses this to recover settings from the
         // config it is about to overwrite, and a missing or unreadable file means "no previous
         // value", never a failed install. See readExistingTelemetryDefaultProject.
         readFile: (p) => {
           try {
-            return (0, import_node_fs23.readFileSync)(p, "utf8");
+            return (0, import_node_fs24.readFileSync)(p, "utf8");
           } catch {
             return null;
           }
@@ -69285,35 +69552,35 @@ async function main() {
         runPm2: (a) => ({ code: pm2Runner(a).code }),
         removeFile: (p) => {
           try {
-            (0, import_node_fs23.rmSync)(p, { force: true });
+            (0, import_node_fs24.rmSync)(p, { force: true });
           } catch {
           }
         },
         purgeSecret: purge,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path37.default.join(process.env.HOME ?? (0, import_node_os18.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path38.default.join(process.env.HOME ?? (0, import_node_os19.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
         log: (m) => process.stderr.write(`[mrrlin-mcp uninstall-service] ${m}
 `)
       });
       return;
     }
     case "uninstall": {
-      const home = process.env.HOME ?? (0, import_node_os18.homedir)();
+      const home = process.env.HOME ?? (0, import_node_os19.homedir)();
       const log = (m) => process.stderr.write(`[mrrlin-mcp uninstall] ${m}
 `);
       uninstallService({
         runPm2: (a) => ({ code: pm2Runner(a).code }),
         removeFile: (p) => {
           try {
-            (0, import_node_fs23.rmSync)(p, { force: true });
+            (0, import_node_fs24.rmSync)(p, { force: true });
           } catch {
           }
         },
         purgeSecret: true,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path37.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path38.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
         log
       });
       let codexOk = true;
@@ -69333,7 +69600,7 @@ async function main() {
         log(`codex config NOT modified: ${error51 instanceof Error ? error51.message : String(error51)}`);
       }
       try {
-        (0, import_node_fs23.rmSync)(import_node_path37.default.join(home, ".mrrlin"), { recursive: true, force: true });
+        (0, import_node_fs24.rmSync)(import_node_path38.default.join(home, ".mrrlin"), { recursive: true, force: true });
       } catch {
       }
       log("removed ~/.mrrlin");
@@ -69374,7 +69641,7 @@ ${HELP_TEXT}`);
   }
 }
 function resolveSelfBinPath() {
-  return import_node_path36.default.resolve(process.argv[1] ?? process.execPath);
+  return import_node_path37.default.resolve(process.argv[1] ?? process.execPath);
 }
 main().catch((error51) => {
   process.stderr.write(`mrrlin-mcp fatal error: ${error51 instanceof Error ? error51.message : String(error51)}