@noxsoft/anima 5.1.1 → 5.1.2

package/dist/{server-node-events-yZM_OBSZ.js → server-node-events-DBOg36in.js}

@@ -2,7 +2,7 @@ import "./paths-zhVksOvm.js";
 import { d as defaultRuntime } from "./subsystem-BMsbqSb4.js";
 import "./utils-B60lF9Wq.js";
 import "./pi-embedded-helpers-B6wVA0hU.js";
-import { K as requestHeartbeatNow, ar as enqueueSystemEvent, at as loadSessionEntry, ot as pruneLegacyStoreKeys, st as resolveGatewaySessionStoreTarget } from "./reply-DWdVFSBB.js";
+import { K as requestHeartbeatNow, ar as enqueueSystemEvent, at as loadSessionEntry, ot as pruneLegacyStoreKeys, st as resolveGatewaySessionStoreTarget } from "./reply-BgPvB-gR.js";
 import { u as normalizeMainKey } from "./session-key-DAZmp8ll.js";
 import "./exec-cazBMA02.js";
 import "./agent-scope-D3HZp64M.js";
@@ -55,9 +55,9 @@ import "./dispatcher-DzT6jltc.js";
 import "./pi-model-discovery-ClWISQ3j.js";
 import "./delivery-queue-DZ_ibFDu.js";
 import "./session-cost-usage-BamtB1rn.js";
-import "./deps-CMFpRoYp.js";
+import "./deps-CeyVMZf1.js";
 import { t as formatForLog } from "./ws-log-Bc4grA6W.js";
-import { t as agentCommand } from "./agent-B8ciDTm6.js";
+import { t as agentCommand } from "./agent-CaaEZsXl.js";
 import { randomUUID } from "node:crypto";
 
 //#region src/gateway/server-node-events.ts

package/dist/{session-CB9OL4Ml.js → session-3MLbl1-K.js}

@@ -1,5 +1,5 @@
 import { n as __exportAll } from "./chunk-BXK9XSlF.js";
-import { t as createSubsystemLogger } from "./subsystem-BP2l3SHn.js";
+import { t as createSubsystemLogger } from "./subsystem-DA3Cno1i.js";
 import { t as extractTopics } from "./topic-extractor-pnAue5Ts.js";
 import { randomUUID } from "node:crypto";
 

package/dist/{settings-cli-_DoMmFH9.js → settings-cli-CCtkuc1r.js}

@@ -2,7 +2,7 @@ import { t as CONFIG_PATH } from "./paths-zhVksOvm.js";
 import { V as theme, d as defaultRuntime } from "./subsystem-BMsbqSb4.js";
 import "./utils-B60lF9Wq.js";
 import "./pi-embedded-helpers-B6wVA0hU.js";
-import "./reply-DWdVFSBB.js";
+import "./reply-BgPvB-gR.js";
 import "./exec-cazBMA02.js";
 import "./agent-scope-D3HZp64M.js";
 import "./model-selection-wCaVeFbb.js";
@@ -65,10 +65,10 @@ import "./systemd-5KGZ3NHE.js";
 import "./service-QlHhVsQf.js";
 import "./widearea-dns-BDtWuGCY.js";
 import "./bonjour-discovery-QsoaZ8Pr.js";
-import "./health-2sA2ziYt.js";
+import "./health-D8fJ6U_k.js";
 import "./plugin-auto-enable-Mj7AnofW.js";
 import "./health-format-CH6JWH45.js";
-import "./prompts-C9IyM74_.js";
+import "./prompts-CneQ6SeF.js";
 import "./logging-DhXRGHWg.js";
 import "./note-De2zPKl3.js";
 import "./skill-scanner-DGoUYV22.js";
@@ -76,11 +76,11 @@ import "./archive-5e-Ytlq-.js";
 import "./skills-install-2DbC1Yo2.js";
 import "./npm-registry-spec-CFp4OEe4.js";
 import "./installs-sayrGjx1.js";
-import "./clack-prompter-DlmPIB0y.js";
-import "./onboard-channels-CWMuM-3k.js";
-import { a as CONFIGURE_WIZARD_SECTIONS, n as configureCommandWithSections, o as parseConfigureWizardSections } from "./configure-fHta2Meh.js";
+import "./clack-prompter-rXuqdPbx.js";
+import "./onboard-channels-RsbA6EaD.js";
+import { a as CONFIGURE_WIZARD_SECTIONS, n as configureCommandWithSections, o as parseConfigureWizardSections } from "./configure-B-dfdPKX.js";
 import "./systemd-linger-B-uyzDap.js";
-import { i as runConfigUnset, n as runConfigGet, r as runConfigSet } from "./configure-DLPHJ8nv.js";
+import { i as runConfigUnset, n as runConfigGet, r as runConfigSet } from "./configure-Bv6mqD0j.js";
 
 //#region src/cli/settings-cli.ts
 const GATEWAY_SETTINGS_SECTIONS = [

package/dist/{settings-cli-BVBFgDUd.js → settings-cli-Ccizggz2.js}

@@ -15,7 +15,7 @@ import "./shell-env-2QqHvBMl.js";
 import "./client-DzIcZx4J.js";
 import "./call-DHZ76BNg.js";
 import "./message-channel-DdOBO6Qm.js";
-import "./subagent-registry-BVrDlKmm.js";
+import "./subagent-registry-MZIxVf8W.js";
 import "./sessions-1XK2mH6L.js";
 import "./tokens-CmlI2hSz.js";
 import "./anthropic-direct-runner-CzQb7QkD.js";
@@ -63,11 +63,11 @@ import "./systemd-6iLWJxQQ.js";
 import "./service-4VfZwSv1.js";
 import "./widearea-dns-CtU9Fx7K.js";
 import "./bonjour-discovery-D3HFfTyG.js";
-import "./health-BNasz7nv.js";
+import "./health-BttJ1Qeh.js";
 import "./catalog-B-TAbJ2o.js";
 import "./plugin-auto-enable-OqDAK-ap.js";
 import "./health-format-BLnFZCH_.js";
-import "./auth-choice-i9Z_cli_.js";
+import "./auth-choice-DPWnLV_w.js";
 import "./prompts-D6b3zLVO.js";
 import "./logging-DcXIbpwk.js";
 import "./note-BaOKDvcy.js";
@@ -77,10 +77,10 @@ import "./skills-install-CE6djAWL.js";
 import "./npm-registry-spec-DVDcgWxm.js";
 import "./installs-BcnNDR54.js";
 import "./clack-prompter-QbDK4ABC.js";
-import "./onboard-channels-Cqeff8-v.js";
-import { a as CONFIGURE_WIZARD_SECTIONS, n as configureCommandWithSections, o as parseConfigureWizardSections } from "./configure-CJYocuSp.js";
+import "./onboard-channels-D6Gt3CsX.js";
+import { a as CONFIGURE_WIZARD_SECTIONS, n as configureCommandWithSections, o as parseConfigureWizardSections } from "./configure-G6h2Ppk0.js";
 import "./systemd-linger-CS_pA1-a.js";
-import { i as runConfigUnset, n as runConfigGet, r as runConfigSet } from "./configure-Bbx4y0lr.js";
+import { i as runConfigUnset, n as runConfigGet, r as runConfigSet } from "./configure-DxQqSUJs.js";
 
 //#region src/cli/settings-cli.ts
 const GATEWAY_SETTINGS_SECTIONS = [

package/dist/{shell-env-DaSbgZYX.js → shell-env-B4ae4lFh.js}

@@ -1,4 +1,4 @@
-import { t as createSubsystemLogger } from "./subsystem-BP2l3SHn.js";
+import { t as createSubsystemLogger } from "./subsystem-DA3Cno1i.js";
 import { t as parseBooleanValue } from "./boolean-Ce2-qkSB.js";
 import { execFileSync } from "node:child_process";
 

package/dist/{soul-B7vtVbSs.js → soul-Bt57OdSx.js}

@@ -1,5 +1,5 @@
 import { n as __exportAll } from "./chunk-BXK9XSlF.js";
-import { t as createSubsystemLogger } from "./subsystem-BP2l3SHn.js";
+import { t as createSubsystemLogger } from "./subsystem-DA3Cno1i.js";
 import { readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";

package/dist/{sqlite-D_h-b5t2.js → sqlite-ClLAW1iQ.js}

@@ -1,15 +1,15 @@
-import { t as createSubsystemLogger } from "./subsystem-BP2l3SHn.js";
-import { o as resolveSessionTranscriptsDirForAgent } from "./paths-CLxC7m0Z.js";
+import { t as createSubsystemLogger } from "./subsystem-DA3Cno1i.js";
+import { o as resolveSessionTranscriptsDirForAgent } from "./paths-Cwszsz1I.js";
 import { createRequire } from "node:module";
 import fs from "node:fs/promises";
 import path from "node:path";
-import fs$1 from "node:fs";
+import fsSync from "node:fs";
 import crypto from "node:crypto";
 
 //#region src/memory/internal.ts
 function ensureDir(dir) {
 	try {
-		fs$1.mkdirSync(dir, { recursive: true });
+		fsSync.mkdirSync(dir, { recursive: true });
 	} catch {}
 	return dir;
 }

package/dist/{start-C0Uw_pIA.js → start-BPye9w5U.js}

@@ -2,7 +2,7 @@ import { u as resolveGatewayPort } from "./paths-zhVksOvm.js";
 import "./subsystem-BMsbqSb4.js";
 import "./utils-B60lF9Wq.js";
 import "./pi-embedded-helpers-B6wVA0hU.js";
-import "./reply-DWdVFSBB.js";
+import "./reply-BgPvB-gR.js";
 import "./exec-cazBMA02.js";
 import "./agent-scope-D3HZp64M.js";
 import "./model-selection-wCaVeFbb.js";
@@ -54,17 +54,17 @@ import "./dispatcher-DzT6jltc.js";
 import "./pi-model-discovery-ClWISQ3j.js";
 import "./delivery-queue-DZ_ibFDu.js";
 import "./session-cost-usage-BamtB1rn.js";
-import "./reply-prefix-CRGxza-M.js";
+import "./reply-prefix-37W_P4kH.js";
 import "./accounts-CL0JV_xk.js";
-import "./deps-CMFpRoYp.js";
+import "./deps-CeyVMZf1.js";
 import "./path-env-CjpH-KWH.js";
 import "./ports-B1b1r9Dz.js";
-import "./program-context-oXX-h-yI.js";
+import "./program-context-Hl6bnPfB.js";
 import "./catalog-AZNRamJ4.js";
 import "./skills-status-ybjSmiHu.js";
 import "./noxsoft-auth-Bmict45b.js";
 import "./dangerous-tools-BCnOEYau.js";
-import "./completion-cli-Blp8bILB.js";
+import "./completion-cli-BBKG6buM.js";
 import "./daemon-runtime-CIE27usH.js";
 import { d as openUrl } from "./onboard-helpers-DPqXrhma.js";
 import "./prompt-style-DU9Vjqe5.js";
@@ -75,23 +75,23 @@ import "./widearea-dns-BDtWuGCY.js";
 import "./table-CdHBo5d1.js";
 import "./shared-Hnu5dChj.js";
 import "./audit-ByHmjh-G.js";
-import "./status-DyD7gtoK.js";
-import "./health-2sA2ziYt.js";
-import { n as runGatewayCommand, r as resolveAssistantIdentity } from "./run-GZnwhuUG.js";
+import "./status-BVAoIQ0V.js";
+import "./health-D8fJ6U_k.js";
+import { n as runGatewayCommand, r as resolveAssistantIdentity } from "./run-DEHnKm2x.js";
 import "./plugin-auto-enable-Mj7AnofW.js";
 import "./health-format-CH6JWH45.js";
 import "./system-run-command-Bx8-5h2r.js";
 import "./channels-status-issues-DdjvFHx9.js";
-import "./prompts-C9IyM74_.js";
+import "./prompts-CneQ6SeF.js";
 import "./hooks-status-VvwKn90L.js";
-import "./onboarding-GIx1Wpw0.js";
+import "./onboarding-Cao0a_Z1.js";
 import "./logging-DhXRGHWg.js";
 import "./tui-DtGKiHUr.js";
 import "./note-De2zPKl3.js";
-import "./doctor-completion-jbYrRr0H.js";
+import "./doctor-completion-C8JSWfqN.js";
 import "./ws-log-Bc4grA6W.js";
 import "./gmail-setup-utils-D2uUKNlF.js";
-import "./agent-B8ciDTm6.js";
+import "./agent-CaaEZsXl.js";
 import "./agents.config-J7iEgdW_.js";
 import "./display-BwSYYxVE.js";
 import "./migrate-BLjwxe9X.js";
@@ -100,7 +100,7 @@ import "./node-service-4B-0AjmA.js";
 import "./status.update-CbIRaeaV.js";
 import "./archive-5e-Ytlq-.js";
 import "./skills-install-2DbC1Yo2.js";
-import "./update-runner-BxdLd4Q8.js";
+import "./update-runner-DPmSGXS3.js";
 
 //#region src/cli/start.ts
 function resolveStartupIdentityName(cfg) {

package/dist/{start-C6a18wc7.js → start-DfC7PlAH.js}

@@ -15,7 +15,7 @@ import "./shell-env-2QqHvBMl.js";
 import "./client-DzIcZx4J.js";
 import "./call-DHZ76BNg.js";
 import "./message-channel-DdOBO6Qm.js";
-import "./subagent-registry-BVrDlKmm.js";
+import "./subagent-registry-MZIxVf8W.js";
 import "./sessions-1XK2mH6L.js";
 import "./tokens-CmlI2hSz.js";
 import "./anthropic-direct-runner-CzQb7QkD.js";
@@ -55,14 +55,14 @@ import "./progress-Dj2aBWOI.js";
 import "./logging-Bpf6Cepz.js";
 import "./auth-store-Vfd6oc1G.js";
 import "./noxsoft-auth-DpwLJIW0.js";
-import "./reply-prefix-_gr2uQ1Z.js";
+import "./reply-prefix-DBRqtDEq.js";
 import "./accounts-CYEa4ttU.js";
 import "./path-env-CafGfJPa.js";
 import "./dangerous-tools-Asx2qyrG.js";
-import "./register.subclis-CMlPDwE5.js";
-import "./command-registry-Dv064HDc.js";
+import "./register.subclis-L55mGheS.js";
+import "./command-registry-vEVxxxzI.js";
 import "./program-context-Dw8HDTRz.js";
-import "./completion-cli-C-fu_7Kd.js";
+import "./completion-cli-C84I5l8a.js";
 import "./daemon-runtime-BfgstLVI.js";
 import { d as openUrl } from "./onboard-helpers-IeOtcIME.js";
 import "./prompt-style-D6SRiiTV.js";
@@ -73,23 +73,23 @@ import "./widearea-dns-CtU9Fx7K.js";
 import "./table-Bt7rSYC6.js";
 import "./shared-7KwLAyAq.js";
 import "./audit-HJOpXfgY.js";
-import "./status-CWgHkLTE.js";
-import "./health-BNasz7nv.js";
-import { n as runGatewayCommand, r as resolveAssistantIdentity } from "./run-CXLRGLdR.js";
-import "./agent-DImD77Te.js";
+import "./status-C9B6cEM0.js";
+import "./health-BttJ1Qeh.js";
+import { n as runGatewayCommand, r as resolveAssistantIdentity } from "./run-BFPM6M2S.js";
+import "./agent-DUAarfNl.js";
 import "./catalog-B-TAbJ2o.js";
 import "./plugin-auto-enable-OqDAK-ap.js";
 import "./health-format-BLnFZCH_.js";
 import "./system-run-command-CxQM9dLk.js";
 import "./channels-status-issues-CklLFAsD.js";
-import "./auth-choice-i9Z_cli_.js";
+import "./auth-choice-DPWnLV_w.js";
 import "./prompts-D6b3zLVO.js";
 import "./hooks-status-DiqubDlK.js";
-import "./onboarding-SrNptVqc.js";
+import "./onboarding-CZBVMwFn.js";
 import "./logging-DcXIbpwk.js";
 import "./tui-Bm8FEW0b.js";
 import "./note-BaOKDvcy.js";
-import "./doctor-completion-CaC89XwQ.js";
+import "./doctor-completion-lAyxyd7X.js";
 import "./ws-log-BA9w1cJs.js";
 import "./gmail-setup-utils-CR33Gqfc.js";
 import "./agents.config-DibGEnBs.js";
@@ -100,7 +100,7 @@ import "./node-service-BDlDNv3t.js";
 import "./status.update-CPACVnCc.js";
 import "./archive-BIKRyvqD.js";
 import "./skills-install-CE6djAWL.js";
-import "./update-runner-pmlbxeZ-.js";
+import "./update-runner-iLJQF6VA.js";
 import "./ports-aNJUI3Mi.js";
 
 //#region src/cli/start.ts

package/dist/{status-CUyIggna.js → status-BU6h4wUP.js}

@@ -1,7 +1,7 @@
 import { o as createSubsystemLogger } from "./entry.js";
 import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-Dm8IL1Ks.js";
 import { i as loadConfig } from "./config-Ofh9gKvs.js";
-import { m as loadAnimaPlugins } from "./subagent-registry-BVrDlKmm.js";
+import { m as loadAnimaPlugins } from "./subagent-registry-MZIxVf8W.js";
 
 //#region src/plugins/status.ts
 const log = createSubsystemLogger("plugins");

package/dist/{status-DyD7gtoK.js → status-BVAoIQ0V.js}

@@ -1,6 +1,6 @@
 import { u as resolveGatewayPort } from "./paths-zhVksOvm.js";
 import { A as info, B as isRich, V as theme } from "./subsystem-BMsbqSb4.js";
-import { Bt as summarizeRestartSentinel, X as loadProviderUsageSummary, a as buildChannelSummary, cr as peekSystemEvents, er as lookupContextTokens, et as formatUsageReportLines, nt as listAgentsForGateway, o as buildChannelAccountSnapshot, s as formatChannelAllowFrom, u as getRemoteSkillEligibility, zt as readRestartSentinel } from "./reply-DWdVFSBB.js";
+import { Bt as summarizeRestartSentinel, X as loadProviderUsageSummary, a as buildChannelSummary, cr as peekSystemEvents, er as lookupContextTokens, et as formatUsageReportLines, nt as listAgentsForGateway, o as buildChannelAccountSnapshot, s as formatChannelAllowFrom, u as getRemoteSkillEligibility, zt as readRestartSentinel } from "./reply-BgPvB-gR.js";
 import { x as parseAgentSessionKey } from "./session-key-DAZmp8ll.js";
 import { n as runExec } from "./exec-cazBMA02.js";
 import { t as resolveAnimaPackageRoot } from "./anima-root-xWSKR6Wm.js";
@@ -26,7 +26,7 @@ import { t as readLastGatewayErrorLine } from "./diagnostics-DXeDqA_-.js";
 import { t as renderTable } from "./table-CdHBo5d1.js";
 import { a as resolveGatewayProbeAuth$1, c as probeGateway, t as runSecurityAudit } from "./audit-ByHmjh-G.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-1MPChTcB.js";
-import { a as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-2sA2ziYt.js";
+import { a as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-D8fJ6U_k.js";
 import { a as formatGitInstallLabel, f as formatUpdateChannelLabel, g as resolveEffectiveUpdateChannel, h as normalizeUpdateChannel, n as checkUpdateStatus, r as compareSemverStrings, t as collectChannelStatusIssues } from "./channels-status-issues-DdjvFHx9.js";
 import { t as resolveNodeService } from "./node-service-4B-0AjmA.js";
 import { i as resolveUpdateAvailability, n as formatUpdateOneLiner, r as getUpdateCheckResult, t as formatUpdateAvailableHint } from "./status.update-CbIRaeaV.js";

package/dist/{status-DmsznVj5.js → status-BaEcHPtc.js}

@@ -1,5 +1,5 @@
 import { t as createSubsystemLogger } from "./subsystem-BMsbqSb4.js";
-import { in as loadAnimaPlugins } from "./reply-DWdVFSBB.js";
+import { in as loadAnimaPlugins } from "./reply-BgPvB-gR.js";
 import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-D3HZp64M.js";
 import { i as loadConfig } from "./config-DqwH4y-D.js";
 

package/dist/{status-CWgHkLTE.js → status-C9B6cEM0.js}

@@ -9,7 +9,7 @@ import { _ as DEFAULT_MODEL, d as resolveConfiguredModelRef, g as DEFAULT_CONTEX
 import { t as buildWorkspaceSkillStatus } from "./skills-status-DuLjkX2E.js";
 import { M as VERSION, i as loadConfig, o as readConfigFileSnapshot } from "./config-Ofh9gKvs.js";
 import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-DHZ76BNg.js";
-import { $t as buildChannelSummary, Kt as loadProviderUsageSummary, Ln as peekSystemEvents, R as listAgentsForGateway, Xt as formatUsageReportLines, en as buildChannelAccountSnapshot, ht as summarizeRestartSentinel, mt as readRestartSentinel, sn as getRemoteSkillEligibility, tn as formatChannelAllowFrom } from "./subagent-registry-BVrDlKmm.js";
+import { $t as buildChannelSummary, Kt as loadProviderUsageSummary, Ln as peekSystemEvents, R as listAgentsForGateway, Xt as formatUsageReportLines, en as buildChannelAccountSnapshot, ht as summarizeRestartSentinel, mt as readRestartSentinel, sn as getRemoteSkillEligibility, tn as formatChannelAllowFrom } from "./subagent-registry-MZIxVf8W.js";
 import { S as resolveMainSessionKey, i as loadSessionStore, v as resolveFreshSessionTotalTokens } from "./sessions-1XK2mH6L.js";
 import { a as sha256HexPrefix } from "./anthropic-direct-runner-CzQb7QkD.js";
 import { h as readTailscaleStatusJson, m as getTailnetHostname } from "./auth-Cp__MMeO.js";
@@ -27,7 +27,7 @@ import { t as readLastGatewayErrorLine } from "./diagnostics-BhSwKIcN.js";
 import { t as renderTable } from "./table-Bt7rSYC6.js";
 import { a as resolveGatewayProbeAuth$1, c as probeGateway, t as runSecurityAudit } from "./audit-HJOpXfgY.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-CVp8W9aa.js";
-import { o as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-BNasz7nv.js";
+import { o as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-BttJ1Qeh.js";
 import { a as formatGitInstallLabel, f as formatUpdateChannelLabel, g as resolveEffectiveUpdateChannel, h as normalizeUpdateChannel, n as checkUpdateStatus, r as compareSemverStrings, t as collectChannelStatusIssues } from "./channels-status-issues-CklLFAsD.js";
 import { t as resolveNodeService } from "./node-service-BDlDNv3t.js";
 import { n as redactSecrets, t as formatGatewayAuthUsed } from "./format-wiLVr0D3.js";

package/dist/{subagent-registry-BVrDlKmm.js → subagent-registry-MZIxVf8W.js}

@@ -583,8 +583,7 @@ const DEFAULT_CODEX_BACKEND = {
 		"--json",
 		"--color",
 		"never",
-		"--sandbox",
-		"danger-full-access",
+		"--dangerously-bypass-approvals-and-sandbox",
 		"--skip-git-repo-check"
 	],
 	resumeArgs: [
@@ -662,6 +661,7 @@ const LEGACY_CODEX_RESUME_ARGS = [
 	"read-only",
 	"--skip-git-repo-check"
 ];
+const CODEX_BYPASS_FLAG = "--dangerously-bypass-approvals-and-sandbox";
 function normalizeBackendKey(key) {
 	return normalizeProviderId(key);
 }
@@ -698,27 +698,34 @@ function argsEqual(left, right) {
 	if (!left || !right || left.length !== right.length) return false;
 	return left.every((entry, index) => entry === right[index]);
 }
-function resolveCliSandboxArg(args) {
+function resolveCodexExecModeArg(args) {
 	if (!args) return;
+	if (args.includes(CODEX_BYPASS_FLAG)) return CODEX_BYPASS_FLAG;
 	const index = args.indexOf("--sandbox");
 	const value = index >= 0 ? args[index + 1] : void 0;
-	return typeof value === "string" && value.trim() ? value : void 0;
-}
-function setCliArgValue(args, flag, value) {
-	const nextArgs = [...args ?? []];
-	const index = nextArgs.indexOf(flag);
-	if (index >= 0 && nextArgs[index + 1]) {
-		nextArgs[index + 1] = value;
-		return nextArgs;
+	return value === "workspace-write" || value === "read-only" ? value : void 0;
+}
+function setCodexExecModeArgs(args, mode) {
+	const nextArgs = [];
+	const source = args ?? [];
+	for (let i = 0; i < source.length; i += 1) {
+		const entry = source[i];
+		if (entry === CODEX_BYPASS_FLAG) continue;
+		if (entry === "--sandbox") {
+			i += 1;
+			continue;
+		}
+		nextArgs.push(entry);
 	}
-	nextArgs.push(flag, value);
+	if (mode === CODEX_BYPASS_FLAG) nextArgs.push(CODEX_BYPASS_FLAG);
+	else nextArgs.push("--sandbox", mode);
 	return nextArgs;
 }
-function resolveManagedCodexSandbox(cfg) {
+function resolveManagedCodexExecMode(cfg) {
 	const workspaceAccess = cfg?.agents?.defaults?.sandbox?.workspaceAccess;
 	if (workspaceAccess === "ro") return "read-only";
 	if (workspaceAccess === "rw") return "workspace-write";
-	return "danger-full-access";
+	return CODEX_BYPASS_FLAG;
 }
 function resolveCliBackendConfig(provider, cfg) {
 	const normalized = normalizeBackendKey(provider);
@@ -746,9 +753,9 @@ function resolveCliBackendConfig(provider, cfg) {
 			...merged,
 			resumeArgs: DEFAULT_CODEX_BACKEND.resumeArgs
 		};
-		if (!resolveCliSandboxArg(override?.args) || (override?.args ? argsEqual(override.args, LEGACY_CODEX_ARGS) : false)) merged = {
+		if (!resolveCodexExecModeArg(override?.args) || (override?.args ? argsEqual(override.args, LEGACY_CODEX_ARGS) : false)) merged = {
 			...merged,
-			args: setCliArgValue(merged.args, "--sandbox", resolveManagedCodexSandbox(cfg))
+			args: setCodexExecModeArgs(merged.args, resolveManagedCodexExecMode(cfg))
 		};
 		const command = merged.command?.trim();
 		if (!command) return null;
@@ -930,7 +937,7 @@ async function runCliAgent(params) {
 	const backendResolved = resolveCliBackendConfig(params.provider, params.config);
 	if (!backendResolved) throw new Error(`Unknown CLI backend: ${params.provider}`);
 	const backend = backendResolved.config;
-	const effectiveCliSandbox = resolveCliSandboxArg(backend.args);
+	const effectiveCodexExecMode = resolveCodexExecModeArg(backend.args);
 	const modelId = (params.model ?? "default").trim() || "default";
 	const normalizedModel = normalizeCliModel(modelId, backend);
 	const modelDisplay = `${params.provider}/${modelId}`;
@@ -981,10 +988,11 @@ async function runCliAgent(params) {
 		const lines = (await readFile(params.sessionFile, "utf-8")).trim().split("\n");
 		const lastLine = lines[lines.length - 1];
 		if (lastLine) {
-			const effectiveSandbox = JSON.parse(lastLine).metadata?.effectiveSandbox;
-			const currentSandbox = effectiveCliSandbox;
-			if (effectiveSandbox && effectiveSandbox !== currentSandbox) {
-				log$6.info(`Codex sandbox changed (${effectiveSandbox} -> ${currentSandbox}); forcing session restart.`);
+			const parsed = JSON.parse(lastLine);
+			const previousMode = parsed.metadata?.effectiveCodexExecMode ?? parsed.metadata?.effectiveSandbox;
+			const currentMode = effectiveCodexExecMode;
+			if (previousMode && previousMode !== currentMode) {
+				log$6.info(`Codex execution mode changed (${previousMode} -> ${currentMode}); forcing session restart.`);
 				useResume = false;
 				isNew = true;
 			}
@@ -1133,7 +1141,7 @@ async function runCliAgent(params) {
 					provider: params.provider,
 					model: modelId,
 					usage: output.usage,
-					...effectiveCliSandbox ? { metadata: { effectiveSandbox: effectiveCliSandbox } } : {}
+					...effectiveCodexExecMode ? { metadata: { effectiveCodexExecMode } } : {}
 				}
 			}
 		};
@@ -32388,7 +32396,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-D8EsFSet.js");
+	webChannelPromise ??= import("./web-DDAkSrtZ.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {

package/dist/{subsystem-BP2l3SHn.js → subsystem-DA3Cno1i.js}

@@ -1,8 +1,8 @@
-import { n as resolveConfigPath } from "./paths-B-AkG5FD.js";
+import { n as resolveConfigPath } from "./paths-D2eokayo.js";
 import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
-import fs from "node:fs";
+import fsSync from "node:fs";
 import { Logger } from "tslog";
 import JSON5 from "json5";
 import chalk, { Chalk } from "chalk";
@@ -13,9 +13,9 @@ function isNodeErrorWithCode(err, code) {
 	return typeof err === "object" && err !== null && "code" in err && err.code === code;
 }
 function resolvePreferredAnimaTmpDir(options = {}) {
-	const accessSync = options.accessSync ?? fs.accessSync;
-	const lstatSync = options.lstatSync ?? fs.lstatSync;
-	const mkdirSync = options.mkdirSync ?? fs.mkdirSync;
+	const accessSync = options.accessSync ?? fsSync.accessSync;
+	const lstatSync = options.lstatSync ?? fsSync.lstatSync;
+	const mkdirSync = options.mkdirSync ?? fsSync.mkdirSync;
 	const getuid = options.getuid ?? (() => {
 		try {
 			return typeof process.getuid === "function" ? process.getuid() : void 0;
@@ -39,14 +39,14 @@ function resolvePreferredAnimaTmpDir(options = {}) {
 	try {
 		const preferred = lstatSync(POSIX_ANIMA_TMP_DIR);
 		if (!preferred.isDirectory() || preferred.isSymbolicLink()) return fallback();
-		accessSync(POSIX_ANIMA_TMP_DIR, fs.constants.W_OK | fs.constants.X_OK);
+		accessSync(POSIX_ANIMA_TMP_DIR, fsSync.constants.W_OK | fsSync.constants.X_OK);
 		if (!isSecureDirForUser(preferred)) return fallback();
 		return POSIX_ANIMA_TMP_DIR;
 	} catch (err) {
 		if (!isNodeErrorWithCode(err, "ENOENT")) return fallback();
 	}
 	try {
-		accessSync("/tmp", fs.constants.W_OK | fs.constants.X_OK);
+		accessSync("/tmp", fsSync.constants.W_OK | fsSync.constants.X_OK);
 		mkdirSync(POSIX_ANIMA_TMP_DIR, {
 			recursive: true,
 			mode: 448
@@ -69,8 +69,8 @@ function resolvePreferredAnimaTmpDir(options = {}) {
 function readLoggingConfig() {
 	const configPath = resolveConfigPath();
 	try {
-		if (!fs.existsSync(configPath)) return;
-		const raw = fs.readFileSync(configPath, "utf-8");
+		if (!fsSync.existsSync(configPath)) return;
+		const raw = fsSync.readFileSync(configPath, "utf-8");
 		const logging = JSON5.parse(raw)?.logging;
 		if (!logging || typeof logging !== "object" || Array.isArray(logging)) return;
 		return logging;
@@ -165,7 +165,7 @@ function isFileLogLevelEnabled(level) {
 	return levelToMinLevel(level) <= levelToMinLevel(settings.level);
 }
 function buildLogger(settings) {
-	fs.mkdirSync(path.dirname(settings.file), { recursive: true });
+	fsSync.mkdirSync(path.dirname(settings.file), { recursive: true });
 	if (isRollingPath(settings.file)) pruneOldRollingLogs(path.dirname(settings.file));
 	const logger = new Logger({
 		name: "anima",
@@ -189,7 +189,7 @@ function buildLogger(settings) {
 					currentSize = 0;
 				}
 			}
-			fs.appendFileSync(currentFile, `${line}\n`, { encoding: "utf8" });
+			fsSync.appendFileSync(currentFile, `${line}\n`, { encoding: "utf8" });
 			currentSize += lineBytes;
 		} catch {}
 	});
@@ -231,7 +231,7 @@ function toPinoLikeLogger(logger, level) {
 }
 function getFileSize(filePath) {
 	try {
-		return fs.statSync(filePath).size;
+		return fsSync.statSync(filePath).size;
 	} catch {
 		return 0;
 	}
@@ -244,21 +244,21 @@ function rotateLogFile(filePath) {
 		let segment = 1;
 		while (segment <= MAX_LOG_SEGMENTS) {
 			const segmentPath = path.join(dir, `${base}.${segment}${ext}`);
-			if (!fs.existsSync(segmentPath)) {
-				fs.renameSync(filePath, segmentPath);
+			if (!fsSync.existsSync(segmentPath)) {
+				fsSync.renameSync(filePath, segmentPath);
 				pruneExcessSegments(dir, base, ext);
 				return filePath;
 			}
 			segment++;
 		}
 		const oldestPath = path.join(dir, `${base}.${MAX_LOG_SEGMENTS}${ext}`);
-		fs.rmSync(oldestPath, { force: true });
+		fsSync.rmSync(oldestPath, { force: true });
 		for (let i = MAX_LOG_SEGMENTS - 1; i >= 1; i--) {
 			const from = path.join(dir, `${base}.${i}${ext}`);
 			const to = path.join(dir, `${base}.${i + 1}${ext}`);
-			if (fs.existsSync(from)) fs.renameSync(from, to);
+			if (fsSync.existsSync(from)) fsSync.renameSync(from, to);
 		}
-		fs.renameSync(filePath, path.join(dir, `${base}.1${ext}`));
+		fsSync.renameSync(filePath, path.join(dir, `${base}.1${ext}`));
 		return filePath;
 	} catch {
 		return null;
@@ -268,7 +268,7 @@ function pruneExcessSegments(dir, base, ext) {
 	try {
 		for (let i = MAX_LOG_SEGMENTS + 1; i <= MAX_LOG_SEGMENTS + 10; i++) {
 			const segmentPath = path.join(dir, `${base}.${i}${ext}`);
-			if (fs.existsSync(segmentPath)) fs.rmSync(segmentPath, { force: true });
+			if (fsSync.existsSync(segmentPath)) fsSync.rmSync(segmentPath, { force: true });
 			else break;
 		}
 	} catch {}
@@ -286,14 +286,14 @@ function isRollingPath(file) {
 }
 function pruneOldRollingLogs(dir) {
 	try {
-		const entries = fs.readdirSync(dir, { withFileTypes: true });
+		const entries = fsSync.readdirSync(dir, { withFileTypes: true });
 		const cutoff = Date.now() - MAX_LOG_AGE_MS;
 		for (const entry of entries) {
 			if (!entry.isFile()) continue;
 			if (!entry.name.startsWith(`${LOG_PREFIX}-`) || !entry.name.endsWith(LOG_SUFFIX)) continue;
 			const fullPath = path.join(dir, entry.name);
 			try {
-				if (fs.statSync(fullPath).mtimeMs < cutoff) fs.rmSync(fullPath, { force: true });
+				if (fsSync.statSync(fullPath).mtimeMs < cutoff) fsSync.rmSync(fullPath, { force: true });
 			} catch {}
 		}
 	} catch {}

package/dist/{tool-images-CUx-9B7B.js → tool-images-DK97edts.js}

@@ -1,5 +1,5 @@
-import { t as createSubsystemLogger } from "./subsystem-BP2l3SHn.js";
-import { E as getImageMetadata, k as resizeToJpeg } from "./chunk-5llVa3wc.js";
+import { t as createSubsystemLogger } from "./subsystem-DA3Cno1i.js";
+import { E as getImageMetadata, k as resizeToJpeg } from "./chunk-CyT-_QsQ.js";
 
 //#region src/agents/tool-images.ts
 const MAX_IMAGE_DIMENSION_PX = 2e3;