@notis_ai/cli 0.2.15 → 0.2.17

package/dist/agent-hooks/notis-agent-hook.mjs

@@ -4564,7 +4564,7 @@ var init_skill_sync = __esm({
 });
 
 // src/cli.js
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { dirname as dirname18, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 
@@ -4587,7 +4587,7 @@ var {
 
 // src/command-specs/apps.js
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readdirSync as readdirSync6, rmSync as rmSync9 } from "node:fs";
+import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, readdirSync as readdirSync6, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename3, isAbsolute as isAbsolute2, join as join12, relative as relative3, resolve as resolve7, sep } from "node:path";
 
@@ -5849,6 +5849,9 @@ function validateConfiguredRoutes(routes) {
     if (route.default) {
       defaultCount += 1;
     }
+    if (route.resourceDeepLinks !== void 0 && typeof route.resourceDeepLinks !== "boolean") {
+      throw usageError(`Route "${route.slug}" resourceDeepLinks must be a boolean.`);
+    }
   }
   if (defaultCount !== 1) {
     throw usageError(`Expected exactly one default route, received ${defaultCount}.`);
@@ -5940,6 +5943,7 @@ function generateManifest(appConfig, projectDir) {
       icon: route.icon || null,
       parentSlug: route.parentSlug || null,
       default: route.default || false,
+      resourceDeepLinks: route.resourceDeepLinks === true,
       export_name: route.exportName || route.export_name || exportNameFromPath(route.path),
       collection: route.collection || null
     };
@@ -6031,6 +6035,14 @@ function generateManifest(appConfig, projectDir) {
     onboarding: appConfig.onboarding || null
   };
 }
+function appRowFieldsFromManifest(manifest) {
+  const app = manifest?.app && typeof manifest.app === "object" ? manifest.app : {};
+  const displayName = typeof app.title === "string" && app.title.trim() ? app.title.trim() : typeof app.name === "string" && app.name.trim() ? app.name.trim() : null;
+  return {
+    ...displayName ? { name: displayName } : {},
+    accent: app.accent ?? null
+  };
+}
 function normalizeAppToolBindings(bindings) {
   return (Array.isArray(bindings) ? bindings : []).map((binding) => {
     const name = typeof binding?.name === "string" ? binding.name.trim() : "";
@@ -7642,7 +7654,7 @@ async function updateAppVersion(supabaseUrl, supabaseKey, appId, newVersion, man
     },
     body: JSON.stringify({
       manifest: { ...manifest, version: newVersion },
-      accent: manifest?.app?.accent ?? null,
+      ...appRowFieldsFromManifest(manifest),
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     })
   });
@@ -7709,9 +7721,20 @@ async function directDeploy(projectDir, appId) {
 
 // src/runtime/app-dev-server.js
 import { createServer } from "node:http";
-import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync3, watch as fsWatch } from "node:fs";
+import { execFileSync as execFileSync2, spawn as spawn2 } from "node:child_process";
+import {
+  appendFileSync,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync7,
+  renameSync as renameSync4,
+  rmSync as rmSync5,
+  statSync as statSync3,
+  watch as fsWatch
+} from "node:fs";
+import { freemem, loadavg, totalmem } from "node:os";
 import { dirname as dirname6, join as join7, resolve as resolve5 } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/runtime/app-dev-sessions.js
@@ -8783,6 +8806,100 @@ function removeAppDevSession(sessionId, filePath) {
   return result;
 }
 
+// src/runtime/app-dev-process-identity.js
+import { execFileSync } from "node:child_process";
+import { readlinkSync, realpathSync as realpathSync2 } from "node:fs";
+var NOTIS_APP_BUILD_COMMAND_FINGERPRINT = "npm:run-build:watch:v1";
+var NOTIS_APPS_DEV_HOST_COMMAND_FINGERPRINT = "notis:apps-dev:v1";
+function normalizePath(value) {
+  if (typeof value !== "string" || !value.trim()) return null;
+  try {
+    return realpathSync2(value.trim());
+  } catch {
+    return null;
+  }
+}
+function isExpectedNotisBuildCommand(command) {
+  if (typeof command !== "string") return false;
+  return /(?:^|[/\s])npm(?:\s|$)/.test(command) && /\brun\s+build\b/.test(command) && /(?:^|\s)--watch(?:\s|$)/.test(command);
+}
+function isExpectedNotisAppsDevHostCommand(command) {
+  return typeof command === "string" && /(?:notis(?:\.js)?|@notis_ai[/\\]cli)/.test(command) && /\bapps\s+dev\b/.test(command);
+}
+function readDarwinProcessCwd(pid, execute) {
+  const output = execute("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const line = output.split("\n").find((entry) => entry.startsWith("n"));
+  return line ? line.slice(1) : null;
+}
+function inspectAppDevWatcherProcess(pid, {
+  platform = process.platform,
+  execute = execFileSync,
+  readLink = readlinkSync
+} = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0 || platform === "win32") return null;
+  try {
+    const ps = (field) => execute("ps", ["-o", `${field}=`, "-p", String(pid)], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const processGroupPid = Number.parseInt(ps("pgid"), 10);
+    const startIdentity = ps("lstart").replace(/\s+/g, " ").trim();
+    const command = ps("command");
+    const cwd = platform === "linux" ? readLink(`/proc/${pid}/cwd`) : readDarwinProcessCwd(pid, execute);
+    const projectDir = normalizePath(cwd);
+    if (!Number.isSafeInteger(processGroupPid) || processGroupPid <= 0) return null;
+    if (!startIdentity || !command || !projectDir) return null;
+    return { pid, processGroupPid, startIdentity, command, projectDir };
+  } catch {
+    return null;
+  }
+}
+function captureDesktopWatcherOwnership({
+  pid,
+  projectDir,
+  desktopOwnerId,
+  desktopOwnerScope,
+  inspect: inspect2 = inspectAppDevWatcherProcess
+} = {}) {
+  const owner = typeof desktopOwnerId === "string" ? desktopOwnerId.trim() : "";
+  const ownerScope = typeof desktopOwnerScope === "string" ? desktopOwnerScope.trim() : "";
+  const expectedProjectDir = normalizePath(projectDir);
+  if (!owner || !ownerScope || !expectedProjectDir) return null;
+  const identity = inspect2(pid);
+  if (!identity || identity.processGroupPid !== pid || identity.projectDir !== expectedProjectDir || !isExpectedNotisBuildCommand(identity.command)) {
+    return null;
+  }
+  return {
+    desktopOwnerId: owner,
+    desktopOwnerScope: ownerScope,
+    watcherProcessGroupPid: identity.processGroupPid,
+    watcherStartIdentity: identity.startIdentity,
+    watcherProjectDir: identity.projectDir,
+    watcherCommandFingerprint: NOTIS_APP_BUILD_COMMAND_FINGERPRINT
+  };
+}
+function captureDesktopHostOwnership({
+  pid = process.pid,
+  desktopOwnerId,
+  desktopOwnerScope,
+  inspect: inspect2 = inspectAppDevWatcherProcess
+} = {}) {
+  const owner = typeof desktopOwnerId === "string" ? desktopOwnerId.trim() : "";
+  const ownerScope = typeof desktopOwnerScope === "string" ? desktopOwnerScope.trim() : "";
+  if (!owner || !ownerScope) return null;
+  const identity = inspect2(pid);
+  if (!identity || !isExpectedNotisAppsDevHostCommand(identity.command)) return null;
+  return {
+    desktopOwnerId: owner,
+    desktopOwnerScope: ownerScope,
+    desktopHostStartIdentity: identity.startIdentity,
+    desktopHostCommandFingerprint: NOTIS_APPS_DEV_HOST_COMMAND_FINGERPRINT
+  };
+}
+
 // src/runtime/app-dev-server.js
 var CONTENT_TYPES = {
   ".js": "application/javascript; charset=utf-8",
@@ -8795,6 +8912,100 @@ var CLI_ROOT2 = resolve5(RUNTIME_DIR, "../..");
 var REPO_ROOT = resolve5(RUNTIME_DIR, "../../../..");
 var HARNESS_TEMPLATE_PATH = join7(CLI_ROOT2, "template", ".harness", "index.html.tmpl");
 var FALLBACK_REACT_VERSION = "19.0.0";
+var BUILD_PROCESS_STOP_GRACE_MS = 1e3;
+var DEV_DIAGNOSTIC_INTERVAL_MS = 3e4;
+var DEV_DIAGNOSTIC_MAX_BYTES = 20 * 1024 * 1024;
+function processGroupIsRunning(pid, signalProcess = process.kill) {
+  try {
+    signalProcess(-pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+function readProcessGroupRssBytes(groupPids) {
+  if (process.platform === "win32" || groupPids.size === 0) return /* @__PURE__ */ new Map();
+  try {
+    const output = execFileSync2("ps", ["-axo", "pgid=,rss="], {
+      encoding: "utf8",
+      maxBuffer: 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const rssByGroup = /* @__PURE__ */ new Map();
+    for (const line of output.split("\n")) {
+      const [rawGroupPid, rawRssKiB] = line.trim().split(/\s+/, 2);
+      const groupPid = Number.parseInt(rawGroupPid, 10);
+      if (!groupPids.has(groupPid)) continue;
+      const rssKiB = Number.parseInt(rawRssKiB, 10);
+      if (!Number.isFinite(rssKiB)) continue;
+      rssByGroup.set(groupPid, (rssByGroup.get(groupPid) || 0) + rssKiB * 1024);
+    }
+    return rssByGroup;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function terminateBuildProcessTree(child, {
+  platform = process.platform,
+  signalProcess = process.kill,
+  spawnProcess = spawn2,
+  graceMs = BUILD_PROCESS_STOP_GRACE_MS
+} = {}) {
+  const pid = child?.pid;
+  if (!Number.isSafeInteger(pid) || pid <= 0) return;
+  if (platform === "win32") {
+    await new Promise((resolvePromise) => {
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        resolvePromise();
+      };
+      try {
+        const killer = spawnProcess("taskkill.exe", ["/pid", String(pid), "/t", "/f"], {
+          stdio: "ignore",
+          windowsHide: true
+        });
+        killer.once("error", () => {
+          try {
+            child.kill("SIGTERM");
+          } catch {
+          }
+          finish();
+        });
+        killer.once("exit", finish);
+        setTimeout(finish, graceMs).unref?.();
+      } catch {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        finish();
+      }
+    });
+    return;
+  }
+  try {
+    signalProcess(-pid, "SIGTERM");
+  } catch (error) {
+    if (error?.code === "ESRCH") return;
+    try {
+      child.kill("SIGTERM");
+    } catch {
+      return;
+    }
+  }
+  const deadline = Date.now() + graceMs;
+  while (processGroupIsRunning(pid, signalProcess) && Date.now() < deadline) {
+    await delay(25);
+  }
+  if (!processGroupIsRunning(pid, signalProcess)) return;
+  try {
+    signalProcess(-pid, "SIGKILL");
+  } catch (error) {
+    if (error?.code !== "ESRCH") throw error;
+  }
+}
 function extFor(pathname) {
   const idx = pathname.lastIndexOf(".");
   return idx === -1 ? "" : pathname.slice(idx);
@@ -8966,10 +9177,11 @@ function buildHarnessDescriptor({ state, manifest, appConfig, route, scenario =
       icon: route.icon || null,
       parentSlug: route.parentSlug || null,
       default: Boolean(route.default),
+      resourceDeepLinks: route.resourceDeepLinks === true,
       collection: route.collection || null
     },
     databases,
-    context: { collectionItem: null, screenshotScenario: scenario },
+    context: { collectionItem: null, resourceId: null, screenshotScenario: scenario },
     tools
   };
 }
@@ -9011,6 +9223,10 @@ async function startAppDevServer({
   watch = true,
   sessionsFilePath,
   harness = {},
+  diagnosticsFile = process.env.NOTIS_DEV_DIAGNOSTICS_FILE || null,
+  desktopOwnerId = process.env.NOTIS_APPS_DEV_DESKTOP_OWNER_ID || null,
+  desktopOwnerScope = process.env.NOTIS_APPS_DEV_DESKTOP_OWNER_SCOPE || null,
+  terminateBuildProcess = terminateBuildProcessTree,
   log = (msg) => process.stdout.write(`${msg}
 `),
   logError = (msg) => process.stderr.write(`${msg}
@@ -9020,6 +9236,9 @@ async function startAppDevServer({
     throw new Error("startAppDevServer requires at least one app.");
   }
   const appState = /* @__PURE__ */ new Map();
+  let diagnosticsTimer = null;
+  let diagnosticWriteFailed = false;
+  let serverClosing = false;
   const hostSseClients = /* @__PURE__ */ new Set();
   const createAppState = (app) => {
     let resolveBundleReady;
@@ -9044,16 +9263,65 @@ async function startAppDevServer({
       prepareTimer: null,
       reloadTimer: null,
       buildProcess: null,
+      watcherOwnership: null,
       lastMtimeMs: 0,
       watchPollTimer: null,
       bundleReady: false,
       bundleReadyPromise,
-      resolveBundleReady
+      resolveBundleReady,
+      buildProcessStopPromise: null
     };
   };
   for (const app of apps) {
     appState.set(app.slug, createAppState(app));
   }
+  function writeDevDiagnostic(event) {
+    if (!diagnosticsFile) return;
+    const memory = process.memoryUsage();
+    const watcherPids = new Set(
+      [...appState.values()].map((state) => state.buildProcess?.pid).filter((pid) => Number.isSafeInteger(pid) && pid > 0)
+    );
+    const watcherGroupRss = readProcessGroupRssBytes(watcherPids);
+    const record = {
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      event,
+      host_pid: process.pid,
+      parent_pid: process.ppid,
+      rss_bytes: memory.rss,
+      heap_used_bytes: memory.heapUsed,
+      heap_total_bytes: memory.heapTotal,
+      external_bytes: memory.external,
+      system_free_bytes: freemem(),
+      system_total_bytes: totalmem(),
+      load_average_1m: loadavg()[0],
+      watcher_groups_rss_bytes: [...watcherGroupRss.values()].reduce((total, rss) => total + rss, 0),
+      apps: [...appState.values()].map((state) => ({
+        slug: state.slug,
+        project_dir: state.projectDir,
+        watcher_pid: state.buildProcess?.pid || null,
+        watcher_exit_code: state.buildProcess?.exitCode ?? null,
+        watcher_signal: state.buildProcess?.signalCode ?? null,
+        watcher_group_rss_bytes: watcherGroupRss.get(state.buildProcess?.pid) ?? null,
+        bundle_ready: state.bundleReady
+      }))
+    };
+    try {
+      mkdirSync5(dirname6(diagnosticsFile), { recursive: true, mode: 448 });
+      if (existsSync7(diagnosticsFile) && statSync3(diagnosticsFile).size >= DEV_DIAGNOSTIC_MAX_BYTES) {
+        const previous = `${diagnosticsFile}.previous`;
+        rmSync5(previous, { force: true });
+        renameSync4(diagnosticsFile, previous);
+      }
+      appendFileSync(diagnosticsFile, `${JSON.stringify(record)}
+`, { mode: 384 });
+      diagnosticWriteFailed = false;
+    } catch (error) {
+      if (!diagnosticWriteFailed) {
+        diagnosticWriteFailed = true;
+        logError(`[notis apps dev] persistent diagnostics failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
   function broadcastReload(slug) {
     const state = appState.get(slug);
     if (!state) return;
@@ -9487,21 +9755,49 @@ data: ${JSON.stringify({ slug, at: Date.now() })}
       await prepareArtifactBuild(state.projectDir);
       watchManifestInputs(state);
       pollForBundleAndWatch(state);
-      state.buildProcess = spawn2("npm", ["run", "build", "--", "--watch"], {
+      const buildProcess = spawn2("npm", ["run", "build", "--", "--watch"], {
         cwd: state.projectDir,
+        detached: process.platform !== "win32",
         stdio: "inherit",
         env: { ...process.env, NOTIS_DEV: "1" }
       });
-      state.buildProcess.on("exit", (code) => {
+      state.buildProcess = buildProcess;
+      for (let attempt = 0; attempt < 5 && !state.watcherOwnership; attempt += 1) {
+        state.watcherOwnership = captureDesktopWatcherOwnership({
+          pid: buildProcess.pid,
+          projectDir: state.projectDir,
+          desktopOwnerId,
+          desktopOwnerScope
+        });
+        if (!state.watcherOwnership && attempt < 4) await delay(10);
+      }
+      buildProcess.on("exit", (code) => {
         if (code !== 0 && code !== null) {
           logError(`[notis apps dev] ${state.slug}: vite build --watch exited with code ${code}`);
         }
+        if (!serverClosing) {
+          if (state.buildProcess === buildProcess) state.buildProcess = null;
+          const stopPromise = terminateBuildProcess(buildProcess).catch((error) => {
+            logError(`[notis apps dev] ${state.slug}: watcher cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+          });
+          state.buildProcessStopPromise = stopPromise;
+          void stopPromise.finally(() => {
+            if (state.buildProcessStopPromise === stopPromise) {
+              state.buildProcessStopPromise = null;
+            }
+          });
+        }
       });
     } else {
       updateBundleDir(state, resolveBundleDir(state));
     }
     log(`[notis apps dev] ${state.slug}: serving bundle at http://127.0.0.1:${port}/a/${state.slug}/bundle/app.js`);
   }
+  writeDevDiagnostic("started");
+  if (diagnosticsFile) {
+    diagnosticsTimer = setInterval(() => writeDevDiagnostic("sample"), DEV_DIAGNOSTIC_INTERVAL_MS);
+    diagnosticsTimer.unref?.();
+  }
   return {
     port,
     updateApp(slug, updates = {}) {
@@ -9523,7 +9819,19 @@ data: ${JSON.stringify({ slug, at: Date.now() })}
       if (!state) return Promise.reject(new Error(`unknown app: ${slug}`));
       return state.bundleReadyPromise;
     },
+    getWatcherOwnership(slug) {
+      const state = appState.get(slug);
+      if (!state) throw new Error(`unknown app: ${slug}`);
+      return state.watcherOwnership ? { ...state.watcherOwnership } : null;
+    },
     async close() {
+      serverClosing = true;
+      if (diagnosticsTimer) {
+        clearInterval(diagnosticsTimer);
+        diagnosticsTimer = null;
+      }
+      writeDevDiagnostic("stopping");
+      const buildProcessStops = [];
       for (const state of appState.values()) {
         if (state.prepareTimer) clearTimeout(state.prepareTimer);
         if (state.reloadTimer) clearTimeout(state.reloadTimer);
@@ -9548,10 +9856,16 @@ data: ${JSON.stringify({ slug, at: Date.now() })}
           }
         }
         state.sseClients.clear();
-        if (state.buildProcess && state.buildProcess.exitCode === null) {
-          state.buildProcess.kill("SIGTERM");
+        if (state.buildProcessStopPromise) {
+          buildProcessStops.push(state.buildProcessStopPromise);
+        }
+        if (state.buildProcess) {
+          const buildProcess = state.buildProcess;
+          state.buildProcess = null;
+          buildProcessStops.push(terminateBuildProcess(buildProcess));
         }
       }
+      await Promise.allSettled(buildProcessStops);
       for (const res of hostSseClients) {
         try {
           res.end();
@@ -9560,6 +9874,7 @@ data: ${JSON.stringify({ slug, at: Date.now() })}
       }
       hostSseClients.clear();
       await new Promise((resolvePromise) => server.close(() => resolvePromise()));
+      writeDevDiagnostic("stopped");
     }
   };
 }
@@ -9569,12 +9884,12 @@ import { randomUUID as randomUUID4 } from "node:crypto";
 import {
   existsSync as existsSync8,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync8,
   readdirSync as readdirSync4,
-  realpathSync as realpathSync2,
-  renameSync as renameSync4,
-  rmSync as rmSync5,
+  realpathSync as realpathSync3,
+  renameSync as renameSync5,
+  rmSync as rmSync6,
   statSync as statSync4,
   writeFileSync as writeFileSync5
 } from "node:fs";
@@ -9604,13 +9919,13 @@ function readLockOwner2(lockPath) {
   }
 }
 function withLock(filePath, callback) {
-  mkdirSync5(dirname7(filePath), { recursive: true, mode: 448 });
+  mkdirSync6(dirname7(filePath), { recursive: true, mode: 448 });
   const lockPath = `${filePath}.lock`;
   const owner = `${process.pid}.${randomUUID4()}`;
   const startedAt = Date.now();
   while (true) {
     try {
-      mkdirSync5(lockPath, { mode: 448 });
+      mkdirSync6(lockPath, { mode: 448 });
       writeFileSync5(join8(lockPath, "owner"), owner, { mode: 384 });
       break;
     } catch (error) {
@@ -9627,7 +9942,7 @@ function withLock(filePath, callback) {
             process.kill(pid, 0);
           } catch (ownerError) {
             if (ownerError?.code === "ESRCH") {
-              rmSync5(lockPath, { recursive: true, force: true });
+              rmSync6(lockPath, { recursive: true, force: true });
               continue;
             }
           }
@@ -9646,7 +9961,7 @@ function withLock(filePath, callback) {
     return callback();
   } finally {
     if (readLockOwner2(lockPath) === owner) {
-      rmSync5(lockPath, { recursive: true, force: true });
+      rmSync6(lockPath, { recursive: true, force: true });
     }
   }
 }
@@ -9661,7 +9976,7 @@ function canonicalExistingDirectory(inputPath) {
   if (!stat2.isDirectory()) {
     throw usageError(`App development root is not a directory: ${absolute}`);
   }
-  return realpathSync2(absolute);
+  return realpathSync3(absolute);
 }
 function normalizeRegistry(raw) {
   const roots = Array.isArray(raw?.roots) ? raw.roots : [];
@@ -9687,14 +10002,14 @@ function readRaw(filePath) {
   }
 }
 function writeRaw(registry, filePath) {
-  mkdirSync5(dirname7(filePath), { recursive: true, mode: 448 });
+  mkdirSync6(dirname7(filePath), { recursive: true, mode: 448 });
   const normalized = {
     version: APP_DEV_ROOTS_VERSION,
     roots: normalizeRegistry(registry)
   };
   const temporary = `${filePath}.${process.pid}.${randomUUID4()}.tmp`;
   writeFileSync5(temporary, JSON.stringify(normalized, null, 2), { mode: 384 });
-  renameSync4(temporary, filePath);
+  renameSync5(temporary, filePath);
   return normalized;
 }
 function migrateLegacyProjectsUnlocked(registry, options) {
@@ -9722,12 +10037,12 @@ function migrateLegacyProjectsUnlocked(registry, options) {
     } catch {
     }
   }
-  rmSync5(path3, { force: true });
+  rmSync6(path3, { force: true });
   return { version: APP_DEV_ROOTS_VERSION, roots: [...byPath.values()] };
 }
 function realpathIfExists(path3) {
   try {
-    return realpathSync2(path3);
+    return realpathSync3(path3);
   } catch {
     return resolve6(path3);
   }
@@ -9808,7 +10123,7 @@ function discoverRegisteredAppProjects(options = {}) {
 
 // src/runtime/agent-browser.js
 import { spawn as spawn3, spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 var PREPARE_CAPTURE_SCRIPT = "(() => { const s = document.getElementById('harness-status'); if (s) s.style.display = 'none'; const r = document.getElementById('root'); if (r) { r.style.paddingTop = '0'; r.style.minHeight = '0'; } document.body.style.minHeight = '0'; document.documentElement.style.minHeight = '0'; return true; })()";
 var FONTS_STATUS_SCRIPT = "(() => (document.fonts ? document.fonts.status : 'loaded'))()";
@@ -9876,7 +10191,7 @@ async function waitForFonts(sessionName, timeoutMs = 3e3) {
     } catch {
       return;
     }
-    await delay(150);
+    await delay2(150);
   }
 }
 async function setViewport(sessionName, width, height, scale = null) {
@@ -9887,7 +10202,7 @@ async function setViewport(sessionName, width, height, scale = null) {
   const result = await runAgentBrowser(args, { timeoutMs: 5e3 });
   return result.exitCode === 0;
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
 function commandError(phase, result) {
@@ -10010,15 +10325,15 @@ async function runHarnessRoute({
   while (Date.now() < deadline) {
     const lastRead = await readHarness(sessionName, 5e3);
     if (!lastRead.ok) {
-      await delay(250);
+      await delay2(250);
       continue;
     }
     const harness2 = lastRead.harness;
     if (harness2?.mounted || Array.isArray(harness2?.errors) && harness2.errors.length > 0) {
-      await delay(250);
+      await delay2(250);
       break;
     }
-    await delay(250);
+    await delay2(250);
   }
   const finalRead = await readHarness(sessionName, 5e3);
   if (!finalRead.ok) {
@@ -10038,7 +10353,7 @@ async function runHarnessRoute({
       timeoutMs: 1e4
     });
     if (snapshot.exitCode === 0) {
-      mkdirSync6(dirname8(snapshotPath), { recursive: true });
+      mkdirSync7(dirname8(snapshotPath), { recursive: true });
       writeFileSync6(snapshotPath, snapshot.stdout);
       savedSnapshotPath = snapshotPath;
     }
@@ -10096,7 +10411,7 @@ async function captureHarnessScreenshot({
     } else {
       lastReadError = read.toolError;
     }
-    await delay(250);
+    await delay2(250);
   }
   if (lastErrors.length > 0) {
     return { ok: false, mounted, screenshotPath: null, errors: lastErrors, tool_error: null };
@@ -10134,7 +10449,7 @@ async function captureHarnessScreenshot({
         break;
       }
       framing = { ...fitted, content_height: contentHeight };
-      await delay(150);
+      await delay2(150);
       const remeasured = await evalNumber(sessionName, CONTENT_HEIGHT_SCRIPT);
       if (remeasured == null || Math.abs(remeasured - contentHeight) <= 32) {
         framing.content_height = remeasured ?? contentHeight;
@@ -10143,8 +10458,8 @@ async function captureHarnessScreenshot({
       contentHeight = remeasured;
     }
   }
-  await delay(500);
-  mkdirSync6(dirname8(screenshotPath), { recursive: true });
+  await delay2(500);
+  mkdirSync7(dirname8(screenshotPath), { recursive: true });
   const screenshotArgs = ["--session", sessionName, "screenshot"];
   if (focusSelector) {
     screenshotArgs.push(focusSelector);
@@ -10157,7 +10472,7 @@ async function captureHarnessScreenshot({
   const dimensions = pngDimensions2(screenshotPath);
   if (!focusSelector && framing && (!dimensions || dimensions.width !== width || dimensions.height !== height)) {
     await setViewport(sessionName, width, height);
-    await delay(300);
+    await delay2(300);
     const retry = await runAgentBrowser(
       ["--session", sessionName, "screenshot", screenshotPath, "--screenshot-format", "png"],
       { timeoutMs: 15e3 }
@@ -10193,7 +10508,7 @@ async function closeAgentBrowserSession(sessionName) {
 
 // src/runtime/app-dev-host-lock.js
 import { createHash, randomUUID as randomUUID5 } from "node:crypto";
-import { lstatSync as lstatSync4, mkdirSync as mkdirSync7, readFileSync as readFileSync10, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { lstatSync as lstatSync4, mkdirSync as mkdirSync8, readFileSync as readFileSync10, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join9 } from "node:path";
 var DEFAULT_LOCK_ROOT = join9(homedir4(), ".notis", "app-dev-host-locks");
@@ -10228,25 +10543,25 @@ function reclaimable(path3, now, staleAfterMs) {
 }
 function tryAcquireAppDevHostLock(options) {
   const lockRoot = options.lockRoot || DEFAULT_LOCK_ROOT;
-  mkdirSync7(lockRoot, { recursive: true, mode: 448 });
+  mkdirSync8(lockRoot, { recursive: true, mode: 448 });
   const path3 = join9(lockRoot, lockName(options.identity, options.apiBase, options.projectDir));
   const ownerId = `${process.pid}.${randomUUID5()}`;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync7(path3, { mode: 448 });
+      mkdirSync8(path3, { mode: 448 });
       try {
         writeFileSync7(join9(path3, OWNER_FILE), JSON.stringify({ pid: process.pid, ownerId }), {
           mode: 384
         });
       } catch (error) {
-        rmSync6(path3, { recursive: true, force: true });
+        rmSync7(path3, { recursive: true, force: true });
         throw error;
       }
       return { path: path3, ownerId };
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
       if (reclaimable(path3, options.now ?? Date.now(), options.staleAfterMs ?? 6e4)) {
-        rmSync6(path3, { recursive: true, force: true });
+        rmSync7(path3, { recursive: true, force: true });
         continue;
       }
       return null;
@@ -10257,7 +10572,7 @@ function tryAcquireAppDevHostLock(options) {
 function releaseAppDevHostLock(lock) {
   try {
     if (readOwner(lock.path)?.ownerId === lock.ownerId) {
-      rmSync6(lock.path, { recursive: true, force: true });
+      rmSync7(lock.path, { recursive: true, force: true });
     }
   } catch {
   }
@@ -10268,10 +10583,10 @@ import { randomUUID as randomUUID6 } from "node:crypto";
 import {
   existsSync as existsSync9,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   readFileSync as readFileSync11,
-  renameSync as renameSync5,
-  rmSync as rmSync7,
+  renameSync as renameSync6,
+  rmSync as rmSync8,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
@@ -10304,20 +10619,20 @@ function reclaimConsumerLock(lockPath) {
   return Date.now() - stat2.mtimeMs >= CONSUMER_LOCK_STALE_AFTER_MS;
 }
 function withLock2(filePath, callback) {
-  mkdirSync8(dirname9(filePath), { recursive: true, mode: 448 });
+  mkdirSync9(dirname9(filePath), { recursive: true, mode: 448 });
   const lockPath = `${filePath}.lock`;
   const owner = `${process.pid}.${randomUUID6()}`;
   const startedAt = Date.now();
   while (true) {
     try {
-      mkdirSync8(lockPath, { mode: 448 });
+      mkdirSync9(lockPath, { mode: 448 });
       writeFileSync8(join10(lockPath, "owner"), owner, { mode: 384 });
       break;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
       try {
         if (reclaimConsumerLock(lockPath)) {
-          rmSync7(lockPath, { recursive: true, force: true });
+          rmSync8(lockPath, { recursive: true, force: true });
           continue;
         }
       } catch (lockError) {
@@ -10335,7 +10650,7 @@ function withLock2(filePath, callback) {
   } finally {
     try {
       if (readFileSync11(join10(lockPath, "owner"), "utf8").trim() === owner) {
-        rmSync7(lockPath, { recursive: true, force: true });
+        rmSync8(lockPath, { recursive: true, force: true });
       }
     } catch {
     }
@@ -10357,10 +10672,10 @@ function readAppDevConsumers(filePath = DEFAULT_APP_DEV_CONSUMERS_FILE, now = Da
   }
 }
 function writeAppDevConsumers(filePath, consumers) {
-  mkdirSync8(dirname9(filePath), { recursive: true, mode: 448 });
+  mkdirSync9(dirname9(filePath), { recursive: true, mode: 448 });
   const temporary = `${filePath}.${process.pid}.${randomUUID6()}.tmp`;
   writeFileSync8(temporary, JSON.stringify({ version: 1, consumers }, null, 2), { mode: 384 });
-  renameSync5(temporary, filePath);
+  renameSync6(temporary, filePath);
 }
 function heartbeatAppDevConsumer(lease, filePath = DEFAULT_APP_DEV_CONSUMERS_FILE) {
   return withLock2(filePath, () => {
@@ -10597,12 +10912,12 @@ import {
   timingSafeEqual
 } from "node:crypto";
 import {
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   readdirSync as readdirSync5,
   readFileSync as readFileSync12,
-  renameSync as renameSync6,
+  renameSync as renameSync7,
   rmdirSync as rmdirSync2,
-  rmSync as rmSync8,
+  rmSync as rmSync9,
   statSync as statSync5,
   writeFileSync as writeFileSync9
 } from "node:fs";
@@ -10610,7 +10925,7 @@ import { createServer as createServer3 } from "node:http";
 import { homedir as homedir6 } from "node:os";
 import { basename as basename2, dirname as dirname10, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { execFileSync, spawn as spawn4 } from "node:child_process";
+import { execFileSync as execFileSync3, spawn as spawn4 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 var DEFAULT_CLI_OAUTH_SCOPES = [
   "notis:read",
@@ -11263,7 +11578,7 @@ function legacyPendingAuthorizationFile(runtime) {
 }
 function savePendingAuthorization(runtime, pending) {
   const file = pendingAuthorizationFile(runtime);
-  mkdirSync9(dirname10(file), { recursive: true });
+  mkdirSync10(dirname10(file), { recursive: true });
   writeFileSync9(file, JSON.stringify(pending, null, 2), { mode: 384 });
 }
 function readPendingAuthorization(runtime, { includeExpired = false } = {}) {
@@ -11286,7 +11601,7 @@ function readPendingAuthorization(runtime, { includeExpired = false } = {}) {
 }
 function clearPendingAuthorization(runtime, file = pendingAuthorizationFile(runtime)) {
   try {
-    rmSync8(file);
+    rmSync9(file);
   } catch {
   }
 }
@@ -11295,7 +11610,7 @@ function clearPendingAuthorizations(runtime) {
   const legacyFile = legacyPendingAuthorizationFile(runtime);
   try {
     const pending = JSON.parse(readFileSync12(legacyFile, "utf-8"));
-    if (pending?.profile === runtime.profileName) rmSync8(legacyFile);
+    if (pending?.profile === runtime.profileName) rmSync9(legacyFile);
   } catch {
   }
 }
@@ -11399,20 +11714,20 @@ function listenerGlobalLockIsStale(lockDir, staleMs) {
 function retireStaleListenerGlobalLock(lockDir) {
   const retiredDir = `${lockDir}.stale-${process.pid}-${base64url(randomBytes(8))}`;
   try {
-    renameSync6(lockDir, retiredDir);
+    renameSync7(lockDir, retiredDir);
   } catch {
     return false;
   }
-  rmSync8(retiredDir, { recursive: true, force: true });
+  rmSync9(retiredDir, { recursive: true, force: true });
   return true;
 }
 async function acquireListenerStartLock(runtime) {
   const lockDir = listenerStartLockDir(runtime);
-  mkdirSync9(dirname10(lockDir), { recursive: true });
+  mkdirSync10(dirname10(lockDir), { recursive: true });
   const deadline = Date.now() + LISTENER_START_LOCK_STALE_MS * 2;
   for (; ; ) {
     try {
-      mkdirSync9(lockDir);
+      mkdirSync10(lockDir);
       return lockDir;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -11446,11 +11761,11 @@ async function acquireListenerGlobalLock({
   heartbeatMs = LISTENER_GLOBAL_LOCK_HEARTBEAT_MS
 } = {}) {
   const lockDir = listenerGlobalLockDir();
-  mkdirSync9(dirname10(lockDir), { recursive: true });
+  mkdirSync10(dirname10(lockDir), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync9(lockDir);
+      mkdirSync10(lockDir);
       const lock = {
         lockDir,
         ownerToken: base64url(randomBytes(24)),
@@ -11487,23 +11802,23 @@ function releaseListenerGlobalLock(lock) {
   if (owner?.owner_token !== lock.ownerToken) return;
   const releasedDir = `${lock.lockDir}.released-${process.pid}-${lock.ownerToken}`;
   try {
-    renameSync6(lock.lockDir, releasedDir);
+    renameSync7(lock.lockDir, releasedDir);
   } catch {
     return;
   }
   const movedOwner = readListenerGlobalLockOwner(releasedDir);
   if (movedOwner?.owner_token !== lock.ownerToken) {
     try {
-      renameSync6(releasedDir, lock.lockDir);
+      renameSync7(releasedDir, lock.lockDir);
     } catch {
     }
     return;
   }
-  rmSync8(releasedDir, { recursive: true, force: true });
+  rmSync9(releasedDir, { recursive: true, force: true });
 }
 function saveListenerState(runtime, state) {
   const file = listenerStateFile(runtime);
-  mkdirSync9(dirname10(file), { recursive: true });
+  mkdirSync10(dirname10(file), { recursive: true });
   writeFileSync9(file, JSON.stringify(state, null, 2), { mode: 384 });
 }
 function readListenerState(runtime) {
@@ -11524,7 +11839,7 @@ function clearListenerState(runtime, { ownerPid = null } = {}) {
     }
   }
   try {
-    rmSync8(listenerStateFile(runtime));
+    rmSync9(listenerStateFile(runtime));
   } catch {
   }
 }
@@ -11542,7 +11857,7 @@ function readLiveListener(runtime, { sameApiBase = true } = {}) {
 }
 function listenerProcessIsAlive(pid, {
   platform = process.platform,
-  run = execFileSync,
+  run = execFileSync3,
   signal = process.kill.bind(process),
   expectedIdentity = null,
   expectedScriptPath = null
@@ -11607,7 +11922,7 @@ async function startDetachedLoopbackListener(runtime, {
   const identityToken = randomBytes(24).toString("base64url");
   const payloadFile = `${listenerStateFile(runtime)}.payload.${process.pid}.${randomBytes(8).toString("hex")}`;
   try {
-    mkdirSync9(dirname10(payloadFile), { recursive: true });
+    mkdirSync10(dirname10(payloadFile), { recursive: true });
     writeFileSync9(payloadFile, JSON.stringify({
       profile: runtime.profileName,
       api_base: runtime.apiBase,
@@ -11634,7 +11949,7 @@ async function startDetachedLoopbackListener(runtime, {
     });
   } catch {
     try {
-      rmSync8(payloadFile);
+      rmSync9(payloadFile);
     } catch {
     }
     return null;
@@ -11663,7 +11978,7 @@ async function startDetachedLoopbackListener(runtime, {
     } catch {
     }
     try {
-      rmSync8(payloadFile);
+      rmSync9(payloadFile);
     } catch {
     }
     return null;
@@ -12355,11 +12670,11 @@ function lockIsStale() {
   }
 }
 async function acquireRefreshLock(runtime, waitMs = 6e4) {
-  mkdirSync9(join11(homedir6(), ".notis"), { recursive: true });
+  mkdirSync10(join11(homedir6(), ".notis"), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync9(OAUTH_LOCK_DIR);
+      mkdirSync10(OAUTH_LOCK_DIR);
       return true;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -13085,6 +13400,67 @@ function projectIsWithinRoot(projectDir, rootDir) {
   const nested = relative3(rootDir, projectDir);
   return nested === "" || nested !== ".." && !nested.startsWith(`..${sep}`) && !isAbsolute2(nested);
 }
+function parseNotisAppVersion(value) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(
+    String(value || "").trim()
+  );
+  if (!match) return null;
+  const prerelease = match[4] ? match[4].split(".") : [];
+  if (prerelease.some((identifier) => /^\d+$/.test(identifier) && identifier.length > 1 && identifier.startsWith("0"))) {
+    return null;
+  }
+  return {
+    major: match[1],
+    minor: match[2],
+    patch: match[3],
+    prerelease
+  };
+}
+function compareNumericSemverIdentifiers(left, right) {
+  if (left.length !== right.length) return left.length > right.length ? 1 : -1;
+  return left === right ? 0 : left > right ? 1 : -1;
+}
+function compareNotisPrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftIdentifier = left[index];
+    const rightIdentifier = right[index];
+    if (leftIdentifier === void 0 || rightIdentifier === void 0) {
+      return leftIdentifier === rightIdentifier ? 0 : leftIdentifier === void 0 ? -1 : 1;
+    }
+    if (leftIdentifier === rightIdentifier) continue;
+    const leftNumeric = /^\d+$/.test(leftIdentifier);
+    const rightNumeric = /^\d+$/.test(rightIdentifier);
+    if (leftNumeric && rightNumeric) {
+      return compareNumericSemverIdentifiers(leftIdentifier, rightIdentifier);
+    }
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+    return leftIdentifier > rightIdentifier ? 1 : -1;
+  }
+  return 0;
+}
+function compareNotisAppVersions(leftValue, rightValue) {
+  const left = parseNotisAppVersion(leftValue);
+  const right = parseNotisAppVersion(rightValue);
+  if (!left || !right) return null;
+  for (const key of ["major", "minor", "patch"]) {
+    const comparison = compareNumericSemverIdentifiers(left[key], right[key]);
+    if (comparison !== 0) return comparison;
+  }
+  return compareNotisPrerelease(left.prerelease, right.prerelease);
+}
+function readLocalNotisAppVersion(projectDir) {
+  try {
+    const packageJson = JSON.parse(readFileSync13(join12(projectDir, "package.json"), "utf8"));
+    const version = String(packageJson.notisAppVersion || "").trim();
+    return parseNotisAppVersion(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
 function discoverAppDevLaunchProjects(rootDir, {
   skipRootRegistration = false,
   registerRoot = registerAppDevRoot,
@@ -13320,7 +13696,7 @@ function pruneStaleScreenshotFiles(outputDir, keepCount) {
     if (!entry.isFile()) continue;
     const match = /^screenshot-(\d+)\.png$/i.exec(entry.name);
     if (match && Number.parseInt(match[1], 10) > keepCount) {
-      rmSync9(join12(outputDir, entry.name), { force: true });
+      rmSync10(join12(outputDir, entry.name), { force: true });
     }
   }
 }
@@ -13331,12 +13707,6 @@ function screenshotIndexByRouteSlug(manifest) {
   const routes = Array.isArray(manifest?.routes) ? manifest.routes : [];
   return new Map(routes.map((route, index) => [route.slug, index + 1]));
 }
-function appRowFieldsFromManifest(manifest) {
-  const app = manifest?.app && typeof manifest.app === "object" ? manifest.app : {};
-  return {
-    accent: app.accent ?? null
-  };
-}
 function screenshotExitCode(failedCount) {
   return failedCount === 0 ? EXIT_CODES.ok : EXIT_CODES.unexpected;
 }
@@ -13472,7 +13842,7 @@ function renderVerifyReport({ summary, results, noBrowser }) {
   }
   return lines.join("\n");
 }
-function buildManifestForDev(appConfig) {
+function buildManifestForDev(appConfig, projectDir) {
   const routes = Array.isArray(appConfig.routes) ? appConfig.routes : [];
   return {
     version: 1,
@@ -13480,7 +13850,8 @@ function buildManifestForDev(appConfig) {
     app: {
       name: appConfig.name,
       description: appConfig.description || null,
-      icon: appConfig.icon || null
+      icon: appConfig.icon || null,
+      release_version: readLocalNotisAppVersion(projectDir)
     },
     routes: routes.map((route) => ({
       path: route.path,
@@ -13489,6 +13860,7 @@ function buildManifestForDev(appConfig) {
       icon: route.icon || null,
       parentSlug: route.parentSlug || null,
       default: route.default || false,
+      resourceDeepLinks: route.resourceDeepLinks === true,
       export_name: route.exportName || route.export_name,
       collection: route.collection || null
     })),
@@ -13606,7 +13978,7 @@ async function ensureDevInstall({
   if (!devSlug) {
     throw usageError(`notis.config.ts devSlug or name in ${projectDir} must slugify to a non-empty value.`);
   }
-  const manifest = buildManifestForDev(appConfig);
+  const manifest = buildManifestForDev(appConfig, projectDir);
   const skills = resolveConfiguredAppSkills(appConfig, projectDir);
   const profileKey = linkedStateProfileKey(ctx.runtime);
   let linkedState = readLinkedState(projectDir, profileKey);
@@ -13675,6 +14047,9 @@ async function ensureDevInstall({
       "version"
     ].includes(key))
   ) : linkedState;
+  const localReleaseVersion = manifest.app.release_version || null;
+  const installedReleaseVersion = linkedApp?.manifest?.app?.release_version || "0.0.0";
+  const mountEligible = !linkedApp || compareNotisAppVersions(localReleaseVersion, installedReleaseVersion) === 1;
   const ensureArguments = buildEnsureDevInstallArguments({
     appConfig,
     manifest,
@@ -13735,6 +14110,9 @@ async function ensureDevInstall({
     linkedAppId: runtimeLinkedState?.app_id || null,
     targetAppId: runtimeLinkedState?.app_id || null,
     targetAppSlug: linkedApp?.slug || null,
+    localReleaseVersion,
+    installedReleaseVersion: linkedApp ? installedReleaseVersion : null,
+    mountEligible,
     databaseMaterialization: ensureResult.payload.database_materialization || { created: [], unresolved: [] },
     liveData: ensureResult.payload.live_data || null
   };
@@ -13755,6 +14133,13 @@ function databaseMaterializationWarnings(apps) {
 function liveDataWarnings(apps) {
   return apps.filter((app) => app.liveData?.warning).map((app) => `${app.name}: ${app.liveData.warning}`);
 }
+function versionPrecedenceWarnings(apps) {
+  return apps.filter((app) => app.targetAppId && app.mountEligible === false).map((app) => {
+    const localVersion = app.localReleaseVersion || "missing or invalid";
+    const pullCommand = `npx --package @notis_ai/cli@latest -- notis apps pull ${app.targetAppId} ${JSON.stringify(app.projectDir)} --force`;
+    return `${app.name}: local version ${localVersion} is not strictly newer than installed version ${app.installedReleaseVersion}; Workspace keeps serving the online bundle. Preserve any local edits, pull latest with \`${pullCommand}\`, then bump package.json notisAppVersion before development.`;
+  });
+}
 async function getAccessibleApp(runtime, appId, runTool = runToolCommand) {
   const result = await runTool({
     runtime,
@@ -14078,7 +14463,8 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
     updateApp: () => {
     },
     waitForBundle: async () => {
-    }
+    },
+    getWatcherOwnership: () => null
   } : await startAppDevServer({
     apps: canonicalCandidates.map((app) => ({
       slug: app.devSlug,
@@ -14093,7 +14479,60 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
     port,
     sessionsFilePath
   });
-  let heartbeatTimer = setInterval(() => {
+  const desktopHostOwnership = captureDesktopHostOwnership({
+    desktopOwnerId: process.env.NOTIS_APPS_DEV_DESKTOP_OWNER_ID,
+    desktopOwnerScope: process.env.NOTIS_APPS_DEV_DESKTOP_OWNER_SCOPE
+  });
+  let heartbeatTimer = null;
+  let consumerTimer = null;
+  let shuttingDown = false;
+  const shutdown = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    process.stdout.write(`
+[notis apps dev] stopping (${signal})...
+`);
+    if (heartbeatTimer) {
+      clearInterval(heartbeatTimer);
+      heartbeatTimer = null;
+    }
+    if (consumerTimer) {
+      clearInterval(consumerTimer);
+      consumerTimer = null;
+    }
+    if (manualConsumerTimer) {
+      clearInterval(manualConsumerTimer);
+      manualConsumerTimer = null;
+    }
+    if (manualConsumerInstanceId) {
+      try {
+        removeAppDevConsumer(manualConsumerInstanceId);
+      } catch {
+      }
+    }
+    try {
+      await devServer.close();
+    } catch {
+    }
+    try {
+      removeAppDevSession(sessionId, sessionsFilePath);
+    } catch {
+    }
+    if (sourceHostLock) {
+      releaseAppDevHostLock(sourceHostLock);
+      sourceHostLock = null;
+    }
+    process.exit(EXIT_CODES.ok);
+  };
+  const handleSigint = () => {
+    void shutdown("SIGINT");
+  };
+  const handleSigterm = () => {
+    void shutdown("SIGTERM");
+  };
+  process.on("SIGINT", handleSigint);
+  process.on("SIGTERM", handleSigterm);
+  heartbeatTimer = setInterval(() => {
     try {
       heartbeatAppDevSession(sessionId, (/* @__PURE__ */ new Date()).toISOString(), sessionsFilePath);
     } catch (error) {
@@ -14146,6 +14585,8 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
         sessionId,
         hostPid: process.pid,
         sourceHost: !sharedBundleBaseUrls,
+        ...desktopHostOwnership || {},
+        ...devServer.getWatcherOwnership(app.devSlug) || {},
         bundleReady: devServer.isBundleReady(app.devSlug),
         ...!sharedBundleBaseUrls ? {
           discoveredProjects: discoveredAppDirs,
@@ -14194,6 +14635,8 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
     }
   }
   if (apps.length === 0) {
+    process.off("SIGINT", handleSigint);
+    process.off("SIGTERM", handleSigterm);
     clearInterval(heartbeatTimer);
     heartbeatTimer = null;
     try {
@@ -14221,9 +14664,9 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
     ...canonicalSelection.warnings,
     ...registrationWarnings,
     ...databaseMaterializationWarnings(apps),
-    ...liveDataWarnings(apps)
+    ...liveDataWarnings(apps),
+    ...versionPrecedenceWarnings(apps)
   ];
-  let consumerTimer = null;
   ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(" "),
     data: {
@@ -14244,7 +14687,10 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
         created: app.created,
         linked_app_id: app.linkedAppId,
         database_materialization: app.databaseMaterialization,
-        live_data: app.liveData
+        live_data: app.liveData,
+        local_release_version: app.localReleaseVersion,
+        installed_release_version: app.installedReleaseVersion,
+        mount_eligible: app.mountEligible
       }))
     },
     warnings,
@@ -14254,58 +14700,13 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
       `Watching ${readAppDevRoots().roots.length} persistent development root(s).`,
       ...useInstalledDatabases ? [`Databases: ${apps.filter((app) => app.liveData?.enabled).length}/${apps.length} app(s) reading the installed app's live rows`] : [],
       "",
-      ...apps.map((app) => `  ${app.name.padEnd(24)} ${app.bundleBaseUrl} -> ${app.appHref}`),
+      ...apps.map((app) => app.mountEligible ? `  ${app.name.padEnd(24)} ${app.bundleBaseUrl} -> ${app.appHref}` : `  ${app.name.padEnd(24)} online v${app.installedReleaseVersion} (local ${app.localReleaseVersion || "version missing"})`),
       "",
-      sharedBundleBaseUrls ? `Mounted ${apps.length} shared source app${apps.length === 1 ? "" : "s"} for this authenticated environment.` : `Serving one shared loopback host for ${apps.length} app${apps.length === 1 ? "" : "s"}.`,
+      sharedBundleBaseUrls ? `Attached to the shared source host: ${apps.filter((app) => app.mountEligible).length}/${apps.length} app${apps.length === 1 ? "" : "s"} eligible to substitute.` : `Serving one shared loopback host for ${apps.length} app${apps.length === 1 ? "" : "s"}; ${apps.filter((app) => app.mountEligible).length} eligible to substitute.`,
       "",
       "Press Ctrl-C to stop."
     ].join("\n")
   });
-  let shuttingDown = false;
-  const shutdown = async (signal) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    process.stdout.write(`
-[notis apps dev] stopping (${signal})...
-`);
-    if (heartbeatTimer) {
-      clearInterval(heartbeatTimer);
-      heartbeatTimer = null;
-    }
-    if (consumerTimer) {
-      clearInterval(consumerTimer);
-      consumerTimer = null;
-    }
-    if (manualConsumerTimer) {
-      clearInterval(manualConsumerTimer);
-      manualConsumerTimer = null;
-    }
-    if (manualConsumerInstanceId) {
-      try {
-        removeAppDevConsumer(manualConsumerInstanceId);
-      } catch {
-      }
-    }
-    try {
-      removeAppDevSession(sessionId, sessionsFilePath);
-    } catch {
-    }
-    try {
-      await devServer.close();
-    } catch {
-    }
-    if (sourceHostLock) {
-      releaseAppDevHostLock(sourceHostLock);
-      sourceHostLock = null;
-    }
-    process.exit(EXIT_CODES.ok);
-  };
-  process.on("SIGINT", () => {
-    void shutdown("SIGINT");
-  });
-  process.on("SIGTERM", () => {
-    void shutdown("SIGTERM");
-  });
   if (consumerMode === "machine" || consumerMode === "environment") {
     consumerTimer = setInterval(() => {
       if (!hasAppDevConsumer(readAppDevConsumers(), {
@@ -14666,7 +15067,7 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
 `)
     });
     browserTouched = true;
-    mkdirSync10(outputDir, { recursive: true });
+    mkdirSync11(outputDir, { recursive: true });
     const results = [];
     for (const capture of captures) {
       const { route, scenario, focus, theme, fileName } = capture;
@@ -14764,7 +15165,7 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
       }
     }
     if (rawOutputDir) {
-      rmSync9(rawOutputDir, { recursive: true, force: true });
+      rmSync10(rawOutputDir, { recursive: true, force: true });
     }
   }
 }
@@ -14803,13 +15204,19 @@ async function appsPullHandler(ctx) {
   const appId = ctx.args.appId;
   const result = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: GET_APP_TOOL,
-    arguments_: { app_id: appId }
+    // Pull is source retrieval plus local link state. LIST_APPS is deliberately
+    // non-materializing; GET_APP hydrates missing declared databases and would
+    // turn a read-only pull into a remote mutation before build/verification.
+    toolName: LIST_APPS_TOOL
   });
   if (ctx.runtime.credentialKind === "oauth" && !await ensureFreshOAuthCredential(ctx.runtime)) {
     throw usageError("Pulling app source requires a current OAuth grant. Run `notis login` and retry.");
   }
-  const app = result.payload?.app || {};
+  const apps = Array.isArray(result.payload?.apps) ? result.payload.apps : [];
+  const app = apps.find((candidate) => (candidate?.app_id || candidate?.id) === appId);
+  if (!app) {
+    throw usageError(`App ${appId} is not accessible to the active profile.`);
+  }
   const defaultDir = slugify(app.slug) || slugify(app.name) || slugify(appId);
   const targetDir = ctx.args.dir ? resolveProjectDir(ctx.args.dir) : defaultAppProjectDir(defaultDir);
   const version = ctx.options.sourceVersion || "latest";
@@ -14830,7 +15237,7 @@ async function appsPullHandler(ctx) {
       project_dir: pulled.projectDir,
       version: pulled.version
     },
-    humanSummary: `Pulled ${versionLabel} to ${pulled.projectDir}. Run \`cd ${pulled.projectDir} && npm install && notis apps dev\` to start editing.`
+    humanSummary: `Pulled ${versionLabel} to ${pulled.projectDir}. Increment package.json notisAppVersion above the pulled release, then run \`cd ${pulled.projectDir} && npm install && notis apps dev\` to substitute the online bundle.`
   });
 }
 function updateLinkedDeployState(projectDir, linkedState, appId, version, profileKey = null) {
@@ -15212,7 +15619,7 @@ var appsCommandSpecs = [
   {
     command_path: ["apps", "dev"],
     summary: "Register a development root and connect its apps to the shared local development host.",
-    when_to_use: "Run this once for any folder that should be watched permanently. The folder itself, direct child apps, and apps/* are discovered automatically by every signed-in Notis Desktop instance.",
+    when_to_use: "Run this once for any folder that should be watched permanently. The folder itself, direct child apps, and apps/* are discovered automatically by every signed-in Notis Desktop instance. A linked app substitutes its online bundle only when local notisAppVersion is strictly greater than the installed release.",
     args_schema: {
       arguments: [
         { token: "[dir]", key: "dir", description: "Project directory or monorepo root (default: current dir)." }
@@ -15374,7 +15781,7 @@ var appsCommandSpecs = [
   {
     command_path: ["apps", "pull"],
     summary: "Download a Notis app source snapshot into a local project folder.",
-    when_to_use: "Edit an installed app locally. Pulls the persisted source, links the directory to the app/version, then continue with npm install, notis apps dev, notis apps build, and notis apps deploy.",
+    when_to_use: "Edit an installed app locally. Preserve any local edits, pull and link the latest persisted source, then increment package.json notisAppVersion above that release before notis apps dev; continue with build and deploy.",
     args_schema: {
       arguments: [
         { token: "<app-id>", description: "Remote app ID to pull." },
@@ -15482,7 +15889,7 @@ var appsCommandSpecs = [
 ];
 
 // src/command-specs/tools.js
-import { accessSync, constants as fsConstants2, createReadStream as createReadStream2, existsSync as existsSync11, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { accessSync, constants as fsConstants2, createReadStream as createReadStream2, existsSync as existsSync11, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
 import { basename as basename4 } from "node:path";
 async function resolveJsonInput(value, label) {
@@ -15499,7 +15906,7 @@ async function resolveJsonInput(value, label) {
     if (!existsSync11(filePath)) {
       throw usageError(`File not found: ${filePath}`);
     }
-    return parseJson(readFileSync13(filePath, "utf-8"), label);
+    return parseJson(readFileSync14(filePath, "utf-8"), label);
   }
   return parseJson(value, label);
 }
@@ -16373,7 +16780,7 @@ var metaCommandSpecs = [
 ];
 
 // src/command-specs/onboarding.js
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { dirname as dirname15, join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 
@@ -16385,10 +16792,10 @@ import { basename as basename5 } from "node:path";
 import {
   chmodSync,
   existsSync as existsSync12,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync14,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync15,
   readdirSync as readdirSync7,
-  renameSync as renameSync7,
+  renameSync as renameSync8,
   writeFileSync as writeFileSync10
 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
@@ -16405,13 +16812,13 @@ var MANAGED_HOOK_MARKER = "--notis-managed-agent-hook";
 var LEGACY_MANAGED_HOOK_MARKER = "NOTIS_MANAGED_AGENT_HOOK=1";
 var AGENT_IDS = Object.freeze(["codex", "claude-code"]);
 function atomicWrite(filePath, contents, mode = 384) {
-  mkdirSync11(dirname13(filePath), { recursive: true, mode: 448 });
+  mkdirSync12(dirname13(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.notis-${process.pid}-${Date.now()}.tmp`;
   writeFileSync10(temporaryPath, contents, { mode });
-  renameSync7(temporaryPath, filePath);
+  renameSync8(temporaryPath, filePath);
 }
 function readText(filePath) {
-  return existsSync12(filePath) ? readFileSync14(filePath, "utf-8") : "";
+  return existsSync12(filePath) ? readFileSync15(filePath, "utf-8") : "";
 }
 function activeCodexInstructionsPath(home) {
   const overridePath = join13(home, ".codex", "AGENTS.override.md");
@@ -16454,7 +16861,7 @@ function upsertInstructionBlock(filePath, block) {
 }
 function readJsonObject(filePath) {
   if (!existsSync12(filePath)) return {};
-  const raw = readFileSync14(filePath, "utf-8");
+  const raw = readFileSync15(filePath, "utf-8");
   try {
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -16506,7 +16913,7 @@ function installManagedHookRuntime({
   nodePath = process.execPath,
   platform = process.platform
 } = {}) {
-  const bundle = readFileSync14(bundlePath);
+  const bundle = readFileSync15(bundlePath);
   const digest = createHash4("sha256").update(bundle).digest("hex");
   const runtimePath = join13(
     home,
@@ -16516,7 +16923,7 @@ function installManagedHookRuntime({
     digest,
     "notis-agent-hook.mjs"
   );
-  const existingDigest = existsSync12(runtimePath) ? createHash4("sha256").update(readFileSync14(runtimePath)).digest("hex") : null;
+  const existingDigest = existsSync12(runtimePath) ? createHash4("sha256").update(readFileSync15(runtimePath)).digest("hex") : null;
   if (existingDigest !== digest) atomicWrite(runtimePath, bundle, 320);
   chmodSync(runtimePath, 320);
   const launcherPath = join13(
@@ -16635,7 +17042,7 @@ function installAgentSetup({
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(String(profileName || ""))) {
     throw new Error("A valid authenticated Notis profile is required for agent setup");
   }
-  const instructions = readFileSync14(INSTRUCTIONS_PATH, "utf-8").trim();
+  const instructions = readFileSync15(INSTRUCTIONS_PATH, "utf-8").trim();
   const results = [];
   const shouldRepairManagedHooks = memoryHooks === true || memoryHooks === null && agents.some((agentId) => fileHasManagedNotisHook(agentPaths(agentId, home).hooks));
   const hookRuntime = shouldRepairManagedHooks ? installManagedHookRuntime({ home, platform }) : null;
@@ -16680,9 +17087,9 @@ function installAgentSetup({
 import { createHash as createHash5 } from "node:crypto";
 import {
   existsSync as existsSync13,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync15,
-  renameSync as renameSync8,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync16,
+  renameSync as renameSync9,
   writeFileSync as writeFileSync11
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
@@ -16700,7 +17107,7 @@ function readState(sessionId, home) {
   const filePath = statePath(sessionId, home);
   if (!filePath || !existsSync13(filePath)) return { seen: [], pending: null };
   try {
-    const parsed = JSON.parse(readFileSync15(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(filePath, "utf-8"));
     return parsed && typeof parsed === "object" ? {
       seen: Array.isArray(parsed.seen) ? parsed.seen.filter((item) => typeof item === "string") : [],
       pending: parsed.pending && typeof parsed.pending === "object" ? parsed.pending : null,
@@ -16730,11 +17137,11 @@ function stateForInput(sessionId, input, home) {
 function writeState(sessionId, state, home) {
   const filePath = statePath(sessionId, home);
   if (!filePath) return;
-  mkdirSync12(dirname14(filePath), { recursive: true, mode: 448 });
+  mkdirSync13(dirname14(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync11(temporaryPath, `${JSON.stringify(state)}
 `, { mode: 384 });
-  renameSync8(temporaryPath, filePath);
+  renameSync9(temporaryPath, filePath);
 }
 function rememberPendingTurn(input, home = homedir8()) {
   const sessionId = input?.session_id;
@@ -17276,7 +17683,7 @@ async function fetchBrief(apiBase, timeoutMs) {
   } catch {
   }
   try {
-    return { markdown: readFileSync16(BUNDLED_BRIEF_PATH, "utf-8"), source: "bundled" };
+    return { markdown: readFileSync17(BUNDLED_BRIEF_PATH, "utf-8"), source: "bundled" };
   } catch {
     return { markdown: null, source: null };
   }
@@ -17444,7 +17851,7 @@ var onboardingCommandSpecs = [
 
 // src/command-specs/diagnostics.js
 import { createHash as createHash7, randomUUID as randomUUID10 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync18 } from "node:fs";
 var ENTITLEMENT_FIELDS = [
   "created_at",
   "included_credit_seat_count",
@@ -17850,7 +18257,7 @@ ORDER BY i.created_at ASC;`;
 function traceFileDiagnostics(path3) {
   if (!path3) return null;
   if (!existsSync14(path3)) throw usageError(`Trace file not found: ${path3}`);
-  const trace = JSON.parse(readFileSync17(path3, "utf-8"));
+  const trace = JSON.parse(readFileSync18(path3, "utf-8"));
   const text = JSON.stringify(trace).toLowerCase();
   const modelCounts = {};
   const generationIds = /* @__PURE__ */ new Set();
@@ -18044,13 +18451,13 @@ var diagnosticCommandSpecs = [
 import { createHash as createHash8, randomUUID as randomUUID11 } from "node:crypto";
 import {
   mkdtempSync as mkdtempSync4,
-  readFileSync as readFileSync18,
-  rmSync as rmSync10,
+  readFileSync as readFileSync19,
+  rmSync as rmSync11,
   writeFileSync as writeFileSync12
 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename6, join as join16 } from "node:path";
-import { setTimeout as delay2 } from "node:timers/promises";
+import { setTimeout as delay3 } from "node:timers/promises";
 function discoveryNames(payload) {
   return [...new Set(
     (payload.results || []).flatMap((result) => [
@@ -18089,7 +18496,7 @@ async function fetchDiscoveryWithRetry(ctx, useCase, knownFields) {
         message: `Tool discovery transiently failed; retrying (${attempt}/${maxAttempts - 1})`,
         requestId: error?.details?.request_id || null
       });
-      await delay2(250 * 2 ** (attempt - 1));
+      await delay3(250 * 2 ** (attempt - 1));
     }
   }
   throw usageError("Dropbox tool discovery exhausted its retries.");
@@ -18145,7 +18552,7 @@ unicode=\xE9t\xE9 Z\xFCrich \u6771\u4EAC
     );
   }
   const localHash = await hashFileSha256(fixturePath);
-  const localBytes = readFileSync18(fixturePath);
+  const localBytes = readFileSync19(fixturePath);
   const destination = remotePath(
     ctx.options.remoteFolder,
     `notis-file-upload-${marker}-${basename6(fixturePath)}`
@@ -18358,7 +18765,7 @@ unicode=\xE9t\xE9 Z\xFCrich \u6771\u4EAC
         result.cleanup.deleted = false;
       }
     }
-    rmSync10(tempDir, { recursive: true, force: true });
+    rmSync11(tempDir, { recursive: true, force: true });
   }
 }
 var smokeCommandSpecs = [
@@ -18666,7 +19073,7 @@ var profileCommandSpecs = [
 
 // src/runtime/git.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { lstatSync as lstatSync6, readFileSync as readFileSync19 } from "node:fs";
+import { lstatSync as lstatSync6, readFileSync as readFileSync20 } from "node:fs";
 import { basename as basename7, relative as relative4, resolve as resolve8, sep as sep2 } from "node:path";
 var GIT_TIMEOUT_MS = 12e4;
 var MAX_SECRET_SCAN_BYTES = 1e6;
@@ -18735,7 +19142,7 @@ function sensitiveAutoCommitFiles(repository) {
     try {
       const stat2 = lstatSync6(absolute);
       if (!stat2.isFile() || stat2.size > MAX_SECRET_SCAN_BYTES) continue;
-      const content = readFileSync19(absolute, "utf8");
+      const content = readFileSync20(absolute, "utf8");
       if (SENSITIVE_CONTENT.some((pattern) => pattern.test(content))) sensitive.push(path3);
     } catch {
     }
@@ -19121,10 +19528,10 @@ import {
   cpSync as cpSync2,
   existsSync as existsSync15,
   lstatSync as lstatSync7,
-  mkdirSync as mkdirSync13,
-  readlinkSync,
-  renameSync as renameSync9,
-  rmSync as rmSync11,
+  mkdirSync as mkdirSync14,
+  readlinkSync as readlinkSync2,
+  renameSync as renameSync10,
+  rmSync as rmSync12,
   symlinkSync
 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
@@ -19168,35 +19575,35 @@ function getBaseSkillPaths({ home = homedir9(), userId = null } = {}) {
 function sameLinkTarget(linkPath, expectedTarget) {
   try {
     if (!lstatSync7(linkPath).isSymbolicLink()) return false;
-    return resolve9(dirname16(linkPath), readlinkSync(linkPath)) === resolve9(expectedTarget);
+    return resolve9(dirname16(linkPath), readlinkSync2(linkPath)) === resolve9(expectedTarget);
   } catch {
     return false;
   }
 }
 function backupConflict(linkPath, backupRoot, targetLabel, skillName, now) {
   const backupPath = join17(backupRoot, String(now), targetLabel, skillName);
-  mkdirSync13(dirname16(backupPath), { recursive: true, mode: 448 });
-  renameSync9(linkPath, backupPath);
+  mkdirSync14(dirname16(backupPath), { recursive: true, mode: 448 });
+  renameSync10(linkPath, backupPath);
   return backupPath;
 }
 function replaceDirectory(source, destination) {
-  mkdirSync13(dirname16(destination), { recursive: true, mode: 448 });
+  mkdirSync14(dirname16(destination), { recursive: true, mode: 448 });
   const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`;
   const previous = `${destination}.previous-${process.pid}-${Date.now()}`;
-  rmSync11(temporary, { recursive: true, force: true });
+  rmSync12(temporary, { recursive: true, force: true });
   cpSync2(source, temporary, { recursive: true });
   let movedPrevious = false;
   try {
     if (existsSync15(destination)) {
-      renameSync9(destination, previous);
+      renameSync10(destination, previous);
       movedPrevious = true;
     }
-    renameSync9(temporary, destination);
-    if (movedPrevious) rmSync11(previous, { recursive: true, force: true });
+    renameSync10(temporary, destination);
+    if (movedPrevious) rmSync12(previous, { recursive: true, force: true });
   } catch (error) {
-    rmSync11(temporary, { recursive: true, force: true });
+    rmSync12(temporary, { recursive: true, force: true });
     if (movedPrevious && !existsSync15(destination) && existsSync15(previous)) {
-      renameSync9(previous, destination);
+      renameSync10(previous, destination);
     }
     throw error;
   }
@@ -19224,7 +19631,7 @@ function reconcileBaseSkills({
     result.installed += 1;
   }
   for (const targetRoot of paths.targetRoots) {
-    mkdirSync13(targetRoot, { recursive: true, mode: 448 });
+    mkdirSync14(targetRoot, { recursive: true, mode: 448 });
     const targetLabel = relative5(home, targetRoot).replaceAll("/", "_") || "home";
     for (const name of BASE_SKILL_NAMES) {
       const skillTarget = join17(paths.baseRoot, name);
@@ -19294,7 +19701,7 @@ function processIsAlive2(pid) {
     return error?.code === "EPERM";
   }
 }
-function delay3(milliseconds) {
+function delay4(milliseconds) {
   return new Promise((resolve10) => setTimeout(resolve10, milliseconds));
 }
 async function quarantineStaleLock(lockDirectory, snapshot) {
@@ -19315,6 +19722,20 @@ async function writeLockOwnerAtomically(lockDirectory, owner) {
   await writeFile(temporaryOwnerPath, JSON.stringify(owner), { mode: 384 });
   await rename(temporaryOwnerPath, ownerPath);
 }
+async function releaseOwnedLock(lockDirectory, ownerId) {
+  const owner = await lockSnapshot(lockDirectory);
+  if (owner?.id !== ownerId) return;
+  const quarantineRoot = join18(dirname17(lockDirectory), ".stale-operation-locks");
+  const releasedDirectory = join18(quarantineRoot, `released.${ownerId}`);
+  await mkdir(quarantineRoot, { recursive: true, mode: 448 });
+  try {
+    await rename(lockDirectory, releasedDirectory);
+  } catch (error) {
+    if (error?.code === "ENOENT") return;
+    throw error;
+  }
+  await rm(releasedDirectory, { recursive: true, force: true });
+}
 async function withSkillSyncLock(callback, {
   home = homedir10(),
   timeoutMs = DEFAULT_LOCK_TIMEOUT_MS,
@@ -19345,7 +19766,7 @@ async function withSkillSyncLock(callback, {
     }
     const observed = await lockSnapshot(lockDirectory);
     if (observed && now() - observed.at > staleMs && !processIsAlive2(observed.pid)) {
-      await delay3(Math.max(pollMs, 10));
+      await delay4(Math.max(pollMs, 10));
       const current = await lockSnapshot(lockDirectory);
       if (sameLockSnapshot(observed, current) && !processIsAlive2(current?.pid)) {
         if (await quarantineStaleLock(lockDirectory, current)) continue;
@@ -19354,7 +19775,7 @@ async function withSkillSyncLock(callback, {
     if (now() >= deadline) {
       throw new Error("Timed out waiting for another Notis skill sync to finish.");
     }
-    await delay3(pollMs);
+    await delay4(pollMs);
   }
   const heartbeatMs = Math.max(10, Math.min(3e4, Math.floor(staleMs / 3)));
   let heartbeatStopped = false;
@@ -19384,10 +19805,7 @@ async function withSkillSyncLock(callback, {
     heartbeatStopped = true;
     clearInterval(heartbeat);
     await heartbeatInFlight;
-    const owner = await lockSnapshot(lockDirectory);
-    if (owner?.id === ownerId) {
-      await rm(lockDirectory, { recursive: true, force: true });
-    }
+    await releaseOwnedLock(lockDirectory, ownerId);
   }
 }
 async function reconcileAllSkills({
@@ -19573,7 +19991,7 @@ async function reportCliCommand({
 function readCliVersion() {
   try {
     const manifestPath = join19(dirname18(fileURLToPath10(import.meta.url)), "..", "package.json");
-    const version = JSON.parse(readFileSync20(manifestPath, "utf-8")).version;
+    const version = JSON.parse(readFileSync21(manifestPath, "utf-8")).version;
     if (typeof version === "string" && version.trim()) {
       return version.trim();
     }