@openscout/scout 0.2.72 → 0.2.73

package/dist/openscout-terminal-relay.mjs

@@ -2,21 +2,3246 @@
 import { createServer } from "node:http";
 import { mkdir, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { join as join2 } from "node:path";
+import { join as join6 } from "node:path";
 import { createRequire as createRequire2 } from "node:module";
 
+// packages/web/server/relay.ts
+import { basename, join } from "node:path";
+function sanitizeUploadName(name) {
+  const base = basename(name).trim();
+  if (!base || base === "." || base === ".." || base.includes("/") || base.includes("\\")) {
+    return null;
+  }
+  return base;
+}
+
+// packages/web/server/terminal-relay-session.ts
+import { createRequire } from "module";
+
+// packages/runtime/dist/system-probes/registry.js
+var DEFAULT_MIN_MAX_STALE_MS = 2 * 60000;
+var PROBE_RUN_OUTPUT = Symbol("openscout.probeRunOutput");
+var registeredProbes = [];
+
+class ProbeBackendError extends Error {
+  backend;
+  fallbackSince;
+  fallbackReason;
+  code;
+  timedOut;
+  constructor(message, metadata, cause) {
+    super(message);
+    this.name = "ProbeBackendError";
+    this.backend = metadata.backend;
+    this.fallbackSince = metadata.fallbackSince;
+    this.fallbackReason = metadata.fallbackReason;
+    const details = probeErrorDetails(cause);
+    if (details.code) {
+      this.code = details.code;
+    }
+    if (details.timedOut !== undefined) {
+      this.timedOut = details.timedOut;
+    }
+  }
+}
+function probeRunOutput(value, metadata) {
+  return {
+    [PROBE_RUN_OUTPUT]: true,
+    value,
+    ...metadata
+  };
+}
+function isProbeRunOutput(value) {
+  return typeof value === "object" && value !== null && value[PROBE_RUN_OUTPUT] === true;
+}
+function backendMetadataFromError(error) {
+  if (error instanceof ProbeBackendError) {
+    return {
+      backend: error.backend,
+      fallbackSince: error.fallbackSince,
+      fallbackReason: error.fallbackReason
+    };
+  }
+  if (typeof error === "object" && error !== null) {
+    const record = error;
+    if (record.backend === "local" || record.backend === "scoutd" || record.backend === "local-fallback") {
+      return {
+        backend: record.backend,
+        fallbackSince: typeof record.fallbackSince === "number" ? record.fallbackSince : undefined,
+        fallbackReason: typeof record.fallbackReason === "string" ? record.fallbackReason : undefined
+      };
+    }
+  }
+  return null;
+}
+function probeErrorDetails(error) {
+  if (typeof error !== "object" || error === null) {
+    return {};
+  }
+  const record = error;
+  const code = typeof record.code === "string" && record.code.trim() ? record.code.trim() : undefined;
+  const timedOut = record.timedOut === true || code === "timeout" ? true : record.timedOut === false ? false : undefined;
+  return { code, timedOut };
+}
+function assertProbeSpec(spec) {
+  if (!spec.id.trim()) {
+    throw new Error("Probe id is required");
+  }
+  if (!Number.isFinite(spec.ttlMs) || spec.ttlMs <= 0) {
+    throw new Error(`Probe ${spec.id} must declare a positive ttlMs`);
+  }
+  if (!Number.isFinite(spec.timeoutMs) || spec.timeoutMs <= 0) {
+    throw new Error(`Probe ${spec.id} must declare a positive timeoutMs`);
+  }
+  if (spec.maxStaleMs !== undefined && (!Number.isFinite(spec.maxStaleMs) || spec.maxStaleMs <= 0)) {
+    throw new Error(`Probe ${spec.id} maxStaleMs must be positive when set`);
+  }
+}
+function maxStaleMsFor(spec) {
+  return spec.maxStaleMs ?? Math.max(DEFAULT_MIN_MAX_STALE_MS, spec.ttlMs * 10);
+}
+function failureBackoffMs(consecutiveFailures) {
+  if (consecutiveFailures <= 0) {
+    return 0;
+  }
+  return Math.min(30000, 1000 * 2 ** Math.min(consecutiveFailures - 1, 5));
+}
+function probeErrorFromUnknown(error, at, timedOut = false) {
+  if (typeof error === "object" && error !== null) {
+    const record = error;
+    const code = typeof record.code === "string" && record.code.trim() ? record.code.trim() : timedOut ? "timeout" : typeof record.name === "string" && record.name.trim() ? record.name.trim() : "error";
+    const message = typeof record.message === "string" && record.message.trim() ? record.message : String(error);
+    return { code, message, at, ...timedOut ? { timedOut: true } : {} };
+  }
+  return {
+    code: timedOut ? "timeout" : "error",
+    message: String(error),
+    at,
+    ...timedOut ? { timedOut: true } : {}
+  };
+}
+function timeoutError(probeId, timeoutMs) {
+  return {
+    code: "timeout",
+    message: `Probe ${probeId} timed out after ${timeoutMs}ms`,
+    at: Date.now(),
+    timedOut: true
+  };
+}
+function staleTooLongError(probeId, ageMs, maxStaleMs) {
+  return {
+    code: "max_stale_exceeded",
+    message: `Probe ${probeId} last good snapshot is ${ageMs}ms old, exceeding maxStaleMs ${maxStaleMs}`,
+    at: Date.now()
+  };
+}
+function isFreshEnough(state, maxAgeMs) {
+  if (state.at === null || state.invalidated) {
+    return false;
+  }
+  return Date.now() - state.at <= maxAgeMs;
+}
+function logBackendTransition(input) {
+  if (input.from === input.to) {
+    return;
+  }
+  const keySuffix = input.key === undefined ? "" : ` key=${JSON.stringify(input.key)}`;
+  const reasonSuffix = input.reason ? ` (${input.reason})` : "";
+  console.warn(`[openscout] system probe ${input.id}${keySuffix} backend ${input.from} -> ${input.to}${reasonSuffix}`);
+}
+
+class ProbeInstance {
+  spec;
+  key;
+  runProbe;
+  scheduleRun;
+  state = {
+    value: null,
+    at: null,
+    error: null,
+    consecutiveFailures: 0,
+    inFlight: null,
+    invalidated: false,
+    invalidationReason: null,
+    invalidationSerial: 0,
+    nextRetryAt: 0,
+    backend: "local",
+    fallbackSince: null,
+    fallbackReason: null
+  };
+  metricState;
+  lastAccessAt = Date.now();
+  constructor(options) {
+    this.spec = options.spec;
+    this.key = options.key;
+    this.runProbe = options.run;
+    this.scheduleRun = options.scheduleRun ?? ((task) => task());
+    this.metricState = {
+      id: options.spec.id,
+      ...options.key !== undefined ? { key: options.key } : {},
+      backend: "local",
+      runCount: 0,
+      failureCount: 0,
+      timeoutCount: 0,
+      staleServedCount: 0,
+      lastRunAt: null,
+      lastDurationMs: null,
+      lastSuccessAt: null
+    };
+  }
+  read() {
+    this.touch();
+    if (this.shouldRefreshForRead(Date.now())) {
+      this.ensureRefresh(false, this.spec.ttlMs);
+    }
+    const snap = this.snapshot();
+    if (snap.status === "stale" || snap.status === "failed" && snap.at !== null) {
+      this.metricState.staleServedCount += 1;
+    }
+    return snap;
+  }
+  async fresh(options = {}) {
+    this.touch();
+    const maxAgeMs = options.maxAgeMs ?? this.spec.ttlMs;
+    for (let attempt = 0;attempt < 3; attempt += 1) {
+      if (isFreshEnough(this.state, maxAgeMs)) {
+        return this.snapshot();
+      }
+      await this.ensureRefresh(true, maxAgeMs);
+      if (!this.state.invalidated) {
+        return this.snapshot();
+      }
+    }
+    return this.snapshot();
+  }
+  snapshot() {
+    const now = Date.now();
+    const ageMs = this.state.at === null ? null : Math.max(0, now - this.state.at);
+    const maxStaleMs = maxStaleMsFor(this.spec);
+    const exceededMaxStale = ageMs !== null && ageMs > maxStaleMs;
+    const fresh = ageMs !== null && !this.state.invalidated && ageMs <= this.spec.ttlMs;
+    const status = this.state.at === null ? this.state.error ? "failed" : "empty" : exceededMaxStale ? "failed" : fresh ? "fresh" : "stale";
+    const error = exceededMaxStale ? this.state.error ?? staleTooLongError(this.spec.id, ageMs ?? 0, maxStaleMs) : this.state.error;
+    return {
+      id: this.spec.id,
+      ...this.key !== undefined ? { key: this.key } : {},
+      value: status === "failed" && exceededMaxStale ? null : this.state.value,
+      at: this.state.at,
+      ageMs,
+      stale: status === "stale" || status === "failed" && this.state.at !== null,
+      refreshing: this.state.inFlight !== null,
+      status,
+      error,
+      consecutiveFailures: this.state.consecutiveFailures,
+      backend: this.state.backend,
+      ...this.state.fallbackSince !== null ? { fallbackSince: this.state.fallbackSince } : {},
+      ...this.state.fallbackReason !== null ? { fallbackReason: this.state.fallbackReason } : {}
+    };
+  }
+  invalidate(reason) {
+    this.touch();
+    this.state.invalidated = true;
+    this.state.invalidationReason = reason ?? null;
+    this.state.invalidationSerial += 1;
+    this.state.nextRetryAt = 0;
+  }
+  metrics() {
+    return {
+      ...this.metricState,
+      consecutiveFailures: this.state.consecutiveFailures,
+      inFlight: this.state.inFlight !== null,
+      ...this.state.fallbackSince !== null ? { fallbackSince: this.state.fallbackSince } : {},
+      ...this.state.fallbackReason !== null ? { fallbackReason: this.state.fallbackReason } : {}
+    };
+  }
+  isRefreshing() {
+    return this.state.inFlight !== null;
+  }
+  touch() {
+    this.lastAccessAt = Date.now();
+  }
+  shouldRefreshForRead(now) {
+    if (this.state.inFlight !== null) {
+      return false;
+    }
+    if (this.state.nextRetryAt > now) {
+      return false;
+    }
+    if (this.state.at === null) {
+      return true;
+    }
+    if (this.state.invalidated) {
+      return true;
+    }
+    return now - this.state.at > this.spec.ttlMs;
+  }
+  ensureRefresh(force, maxAgeMs) {
+    if (this.state.inFlight) {
+      return this.state.inFlight;
+    }
+    const now = Date.now();
+    if (!force && this.state.nextRetryAt > now) {
+      return Promise.resolve();
+    }
+    const inFlight = this.scheduleRun(() => this.executeRun(maxAgeMs)).finally(() => {
+      if (this.state.inFlight === inFlight) {
+        this.state.inFlight = null;
+      }
+    });
+    this.state.inFlight = inFlight;
+    return inFlight;
+  }
+  async executeRun(maxAgeMs) {
+    const startedAt = Date.now();
+    const previousBackend = this.state.backend;
+    const invalidationSerialAtStart = this.state.invalidationSerial;
+    const controller = new AbortController;
+    let timeout = null;
+    this.metricState.runCount += 1;
+    this.metricState.lastRunAt = startedAt;
+    const ctx = {
+      probeId: this.spec.id,
+      ...this.key !== undefined ? { key: this.key } : {},
+      signal: controller.signal,
+      timeoutMs: this.spec.timeoutMs,
+      maxAgeMs,
+      startedAt
+    };
+    const timeoutProbeError = timeoutError(this.spec.id, this.spec.timeoutMs);
+    const runPromise = this.runProbe(ctx);
+    runPromise.catch(() => {
+      return;
+    });
+    try {
+      const result = await new Promise((resolve, reject) => {
+        timeout = setTimeout(() => {
+          controller.abort(timeoutProbeError);
+          reject(timeoutProbeError);
+        }, this.spec.timeoutMs);
+        runPromise.then(resolve, reject);
+      });
+      const output = isProbeRunOutput(result) ? result : probeRunOutput(result, { backend: "local" });
+      this.state.value = output.value;
+      this.state.at = output.generatedAt ?? Date.now();
+      this.state.error = null;
+      this.state.consecutiveFailures = 0;
+      if (this.state.invalidationSerial === invalidationSerialAtStart) {
+        this.state.invalidated = false;
+        this.state.invalidationReason = null;
+      }
+      this.state.nextRetryAt = 0;
+      this.state.backend = output.backend;
+      this.state.fallbackSince = output.fallbackSince ?? null;
+      this.state.fallbackReason = output.fallbackReason ?? null;
+      this.metricState.backend = output.backend;
+      this.metricState.lastSuccessAt = this.state.at;
+      logBackendTransition({
+        id: this.spec.id,
+        key: this.key,
+        from: previousBackend,
+        to: output.backend,
+        reason: output.fallbackReason
+      });
+    } catch (error) {
+      const timedOut = error === timeoutProbeError || typeof error === "object" && error !== null && (error.code === "timeout" || error.timedOut === true);
+      const at = Date.now();
+      this.state.error = error === timeoutProbeError ? timeoutProbeError : probeErrorFromUnknown(error, at, timedOut);
+      this.state.consecutiveFailures += 1;
+      this.state.nextRetryAt = at + failureBackoffMs(this.state.consecutiveFailures);
+      const backendMetadata = backendMetadataFromError(error);
+      if (backendMetadata) {
+        this.state.backend = backendMetadata.backend;
+        this.state.fallbackSince = backendMetadata.fallbackSince ?? null;
+        this.state.fallbackReason = backendMetadata.fallbackReason ?? null;
+        this.metricState.backend = backendMetadata.backend;
+        logBackendTransition({
+          id: this.spec.id,
+          key: this.key,
+          from: previousBackend,
+          to: backendMetadata.backend,
+          reason: backendMetadata.fallbackReason
+        });
+      }
+      this.metricState.failureCount += 1;
+      if (this.state.error.timedOut || this.state.error.code === "timeout") {
+        this.metricState.timeoutCount += 1;
+      }
+    } finally {
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      this.metricState.lastDurationMs = Date.now() - startedAt;
+    }
+  }
+}
+
+class FamilyLimiter {
+  maxConcurrent;
+  active = 0;
+  queue = [];
+  constructor(maxConcurrent) {
+    this.maxConcurrent = maxConcurrent;
+  }
+  queued() {
+    return this.queue.length;
+  }
+  async run(task) {
+    if (this.active >= this.maxConcurrent) {
+      await new Promise((resolve) => this.queue.push(resolve));
+    }
+    this.active += 1;
+    try {
+      return await task();
+    } finally {
+      this.active -= 1;
+      const next = this.queue.shift();
+      if (next) {
+        next();
+      }
+    }
+  }
+}
+
+class ProbeFamily {
+  spec;
+  entries = new Map;
+  limiter;
+  constructor(spec) {
+    this.spec = spec;
+    assertProbeSpec(spec);
+    if (!Number.isInteger(spec.maxKeys) || spec.maxKeys <= 0) {
+      throw new Error(`Probe family ${spec.id} must declare a positive maxKeys`);
+    }
+    if (!Number.isFinite(spec.idleKeyTtlMs) || spec.idleKeyTtlMs <= 0) {
+      throw new Error(`Probe family ${spec.id} must declare a positive idleKeyTtlMs`);
+    }
+    if (!Number.isInteger(spec.maxConcurrentKeys) || spec.maxConcurrentKeys <= 0) {
+      throw new Error(`Probe family ${spec.id} must declare a positive maxConcurrentKeys`);
+    }
+    this.limiter = new FamilyLimiter(spec.maxConcurrentKeys);
+  }
+  for(rawKey) {
+    const key = this.normalize(rawKey);
+    this.cleanupIdle(Date.now());
+    let entry = this.entries.get(key);
+    if (!entry) {
+      entry = new ProbeInstance({
+        spec: this.spec,
+        key,
+        run: (ctx) => this.spec.run(key, ctx),
+        scheduleRun: (task) => this.limiter.run(task)
+      });
+      this.entries.set(key, entry);
+    }
+    entry.lastAccessAt = Date.now();
+    this.evictLruIfNeeded();
+    return entry;
+  }
+  snapshot(key) {
+    return this.for(key).snapshot();
+  }
+  invalidate(key, reason) {
+    this.for(key).invalidate(reason);
+  }
+  metrics() {
+    this.cleanupIdle(Date.now());
+    return {
+      id: this.spec.id,
+      keyCount: this.entries.size,
+      maxKeys: this.spec.maxKeys,
+      activeRuns: this.limiter.active,
+      queuedRuns: this.limiter.queued(),
+      keys: Array.from(this.entries.values(), (entry) => entry.metrics())
+    };
+  }
+  keys() {
+    this.cleanupIdle(Date.now());
+    return Array.from(this.entries.keys());
+  }
+  normalize(rawKey) {
+    const key = this.spec.normalizeKey(rawKey).trim();
+    if (!key) {
+      throw new Error(`Probe family ${this.spec.id} normalized an empty key`);
+    }
+    return key;
+  }
+  cleanupIdle(now) {
+    for (const [key, entry] of this.entries) {
+      if (!entry.isRefreshing() && now - entry.lastAccessAt > this.spec.idleKeyTtlMs) {
+        this.entries.delete(key);
+      }
+    }
+  }
+  evictLruIfNeeded() {
+    while (this.entries.size > this.spec.maxKeys) {
+      let oldestKey = null;
+      let oldestAccess = Number.POSITIVE_INFINITY;
+      for (const [key, entry] of this.entries) {
+        if (entry.isRefreshing()) {
+          continue;
+        }
+        if (entry.lastAccessAt < oldestAccess) {
+          oldestAccess = entry.lastAccessAt;
+          oldestKey = key;
+        }
+      }
+      if (!oldestKey) {
+        return;
+      }
+      this.entries.delete(oldestKey);
+    }
+  }
+}
+function defineProbe(spec) {
+  assertProbeSpec(spec);
+  const handle = new ProbeInstance({
+    spec,
+    run: spec.run
+  });
+  registeredProbes.push({
+    kind: "probe",
+    id: spec.id,
+    handle
+  });
+  return handle;
+}
+function defineProbeFamily(spec) {
+  const family = new ProbeFamily(spec);
+  registeredProbes.push({
+    kind: "family",
+    id: spec.id,
+    family
+  });
+  return family;
+}
+// packages/runtime/dist/system-probes/exec.js
+import { spawn } from "node:child_process";
+
+// packages/runtime/dist/system-probes/scoutd-client.js
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+import { Socket } from "node:net";
+
+// packages/runtime/dist/system-probes/scout-host-catalog.js
+var SCOUT_HOST_PROBE_SCHEMA_VERSIONS = {
+  "tailscale.status": 1,
+  "git.buildInfo": 1,
+  "git.revParse": 1,
+  "git.diffShortstat": 1,
+  "git.statusPorcelain": 1,
+  "git.mergeBase": 1,
+  "git.logLastCommitUnix": 1,
+  "git.worktreeListPorcelain": 1,
+  "tmux.sessions": 1,
+  "tmux.panes": 1,
+  "zellij.sessions": 1,
+  "ps.runtime": 1,
+  "ps.discovery": 1,
+  "ps.cwd": 1,
+  "net.listeners": 1,
+  "repo.scan": 1,
+  "repo.diff": 1
+};
+var SCOUT_HOST_EXEC_VERB_SCHEMA_VERSIONS = {
+  "tmux.sendKeys": 1,
+  "tmux.sendKeysLiteral": 1,
+  "tmux.loadBuffer": 1,
+  "tmux.pasteBuffer": 1,
+  "tmux.deleteBuffer": 1,
+  "tmux.killSession": 1,
+  "tmux.newSession": 1,
+  "tmux.detachClient": 1,
+  "tailscale.cert": 1,
+  "reveal.open": 1
+};
+function expectedScoutHostProbeSchemaVersion(probeId) {
+  return Object.hasOwn(SCOUT_HOST_PROBE_SCHEMA_VERSIONS, probeId) ? SCOUT_HOST_PROBE_SCHEMA_VERSIONS[probeId] : null;
+}
+function expectedScoutHostExecVerbSchemaVersion(verb) {
+  return Object.hasOwn(SCOUT_HOST_EXEC_VERB_SCHEMA_VERSIONS, verb) ? SCOUT_HOST_EXEC_VERB_SCHEMA_VERSIONS[verb] : null;
+}
+
+// packages/runtime/dist/system-probes/scoutd-client.js
+var CAPABILITIES_SCHEMA = "openscout.probe.capabilities/v1";
+var REQUEST_SCHEMA = "openscout.probe.request/v1";
+var SNAPSHOT_SCHEMA = "openscout.probe.snapshot/v1";
+var ERROR_SCHEMA = "openscout.probe.error/v1";
+var EXEC_REQUEST_SCHEMA = "openscout.exec.request/v1";
+var EXEC_RESPONSE_SCHEMA = "openscout.exec.response/v1";
+var CAPABILITY_RECHECK_MS = 1e4;
+var SOCKET_TIMEOUT_MS = 900;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function readNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fallbackMessage(error) {
+  if (error instanceof Error && error.message.trim()) {
+    return error.message;
+  }
+  return String(error);
+}
+
+class ScoutdExecResponseError extends Error {
+  code;
+  timedOut;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "ScoutdExecResponseError";
+    this.code = options.code ?? "exec_error";
+    this.timedOut = options.timedOut ?? false;
+  }
+}
+
+class ScoutdProbeResponseError extends Error {
+  code;
+  timedOut;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "ScoutdProbeResponseError";
+    this.code = options.code ?? "probe_error";
+    this.timedOut = options.timedOut ?? false;
+  }
+}
+function resolveScoutdProbesSocketPath(env = process.env) {
+  const explicit = env.OPENSCOUT_PROBES_SOCKET?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const openScoutHome = env.OPENSCOUT_HOME?.trim() || join2(homedir(), ".openscout");
+  return join2(openScoutHome, "run", "scoutd-probes.sock");
+}
+
+class ScoutdProbeClient {
+  env;
+  capabilities = null;
+  lastCapabilityCheckAt = null;
+  lastError = null;
+  daemonObserved = false;
+  fallbackByProbe = new Map;
+  fallbackByExec = new Map;
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  async requestProbe(input) {
+    const socketPath = resolveScoutdProbesSocketPath(this.env);
+    const socketTimeoutMs = probeSocketTimeoutMs(input.timeoutMs);
+    const socketExists = existsSync(socketPath);
+    if (!socketExists) {
+      this.capabilities = null;
+      this.lastError = null;
+      return this.daemonObserved ? this.fallback(input.probeId, input.key, `probe socket is missing: ${socketPath}`) : { state: "local" };
+    }
+    this.daemonObserved = true;
+    const capabilities = await this.ensureCapabilities(socketPath, socketTimeoutMs);
+    if (!capabilities) {
+      return this.fallback(input.probeId, input.key, this.lastError ?? "probe capabilities unavailable");
+    }
+    const capability = capabilities.families.get(input.probeId);
+    if (!capability) {
+      return this.fallback(input.probeId, input.key, `scoutd does not serve ${input.probeId}`);
+    }
+    const expectedSchemaVersion = expectedScoutHostProbeSchemaVersion(input.probeId);
+    if (expectedSchemaVersion === null) {
+      return this.fallback(input.probeId, input.key, `client has no compiled schema version for ${input.probeId}`);
+    }
+    if (capability.schemaVersion !== expectedSchemaVersion) {
+      return this.fallback(input.probeId, input.key, `scoutd serves ${input.probeId} schema v${capability.schemaVersion}, expected v${expectedSchemaVersion}`);
+    }
+    try {
+      const response = await requestJson(socketPath, {
+        schema: REQUEST_SCHEMA,
+        schemaVersion: expectedSchemaVersion,
+        probeId: input.probeId,
+        key: input.key ?? null,
+        maxAgeMs: input.maxAgeMs,
+        opTimeoutMs: requestOpTimeoutMs(input.timeoutMs)
+      }, { timeoutMs: socketTimeoutMs });
+      if (!isRecord(response) || response.schema !== SNAPSHOT_SCHEMA) {
+        throw new Error("scoutd returned an invalid probe snapshot envelope");
+      }
+      if (response.error) {
+        const error = isRecord(response.error) ? response.error : {};
+        const code = readString(error.code) ?? "probe_error";
+        const message = readString(error.message) ?? code;
+        const timedOut = error.timedOut === true || error.timed_out === true;
+        throw new ScoutdProbeResponseError(message, { code, timedOut });
+      }
+      this.fallbackByProbe.delete(fallbackKey(input.probeId, input.key));
+      this.lastError = null;
+      return {
+        state: "scoutd",
+        value: response.value,
+        generatedAt: readNumber(response.generatedAt) ?? Date.now(),
+        daemonVersion: readString(response.daemonVersion) ?? capabilities.daemonVersion
+      };
+    } catch (error) {
+      if (!(error instanceof ScoutdProbeResponseError)) {
+        this.capabilities = null;
+        this.lastCapabilityCheckAt = null;
+      }
+      this.lastError = fallbackMessage(error);
+      return this.fallback(input.probeId, input.key, this.lastError);
+    }
+  }
+  async requestExecVerb(input) {
+    const socketPath = resolveScoutdProbesSocketPath(this.env);
+    const socketTimeoutMs = execSocketTimeoutMs(input.args);
+    const socketExists = existsSync(socketPath);
+    if (!socketExists) {
+      this.capabilities = null;
+      this.lastError = null;
+      return this.daemonObserved ? this.execFallback(input.verb, `probe socket is missing: ${socketPath}`) : { state: "local" };
+    }
+    this.daemonObserved = true;
+    const capabilities = await this.ensureCapabilities(socketPath, socketTimeoutMs);
+    if (!capabilities) {
+      return this.execFallback(input.verb, this.lastError ?? "probe capabilities unavailable");
+    }
+    const capability = capabilities.verbs.get(input.verb);
+    if (!capability) {
+      return this.execFallback(input.verb, `scoutd does not serve ${input.verb}`);
+    }
+    const expectedSchemaVersion = expectedScoutHostExecVerbSchemaVersion(input.verb);
+    if (expectedSchemaVersion === null) {
+      return this.execFallback(input.verb, `client has no compiled schema version for ${input.verb}`);
+    }
+    if (capability.schemaVersion !== expectedSchemaVersion) {
+      return this.execFallback(input.verb, `scoutd serves ${input.verb} schema v${capability.schemaVersion}, expected v${expectedSchemaVersion}`);
+    }
+    try {
+      const response = await requestJson(socketPath, {
+        schema: EXEC_REQUEST_SCHEMA,
+        schemaVersion: expectedSchemaVersion,
+        verb: input.verb,
+        args: input.args
+      }, { timeoutMs: socketTimeoutMs });
+      if (!isRecord(response) || response.schema !== EXEC_RESPONSE_SCHEMA) {
+        throw new Error("scoutd returned an invalid exec response envelope");
+      }
+      if (!response.ok) {
+        const error = isRecord(response.error) ? response.error : {};
+        const code = readString(error.code) ?? "exec_error";
+        const message = readString(error.message) ?? code;
+        const timedOut = error.timedOut === true || error.timed_out === true;
+        throw new ScoutdExecResponseError(message, { code, timedOut });
+      }
+      this.fallbackByExec.delete(input.verb);
+      this.lastError = null;
+      return {
+        state: "scoutd",
+        value: response.value,
+        daemonVersion: readString(response.daemonVersion) ?? capabilities.daemonVersion
+      };
+    } catch (error) {
+      if (error instanceof ScoutdExecResponseError) {
+        throw error;
+      }
+      this.capabilities = null;
+      this.lastCapabilityCheckAt = null;
+      this.lastError = fallbackMessage(error);
+      return this.execFallback(input.verb, this.lastError);
+    }
+  }
+  diagnostics() {
+    const socketPath = resolveScoutdProbesSocketPath(this.env);
+    return {
+      socketPath,
+      socketExists: existsSync(socketPath),
+      daemonObserved: this.daemonObserved,
+      daemonVersion: this.capabilities?.daemonVersion ?? null,
+      supportedProbeIds: this.capabilities ? [...this.capabilities.families.keys()].sort() : [],
+      supportedExecVerbs: this.capabilities ? [...this.capabilities.verbs.keys()].sort() : [],
+      lastCapabilityCheckAt: this.lastCapabilityCheckAt,
+      lastError: this.lastError
+    };
+  }
+  resetForTests() {
+    this.capabilities = null;
+    this.lastCapabilityCheckAt = null;
+    this.lastError = null;
+    this.daemonObserved = false;
+    this.fallbackByProbe.clear();
+    this.fallbackByExec.clear();
+  }
+  async ensureCapabilities(socketPath, timeoutMs = SOCKET_TIMEOUT_MS) {
+    const now = Date.now();
+    if (this.capabilities && this.lastCapabilityCheckAt !== null && now - this.lastCapabilityCheckAt < CAPABILITY_RECHECK_MS) {
+      return this.capabilities;
+    }
+    this.lastCapabilityCheckAt = now;
+    try {
+      const response = await requestJson(socketPath, { schema: CAPABILITIES_SCHEMA }, { timeoutMs });
+      if (!isRecord(response) || response.schema !== CAPABILITIES_SCHEMA) {
+        throw new Error("scoutd returned an invalid capabilities envelope");
+      }
+      const daemonVersion = readString(response.daemonVersion) ?? "unknown";
+      const families = new Map;
+      if (Array.isArray(response.families)) {
+        for (const entry of response.families) {
+          if (!isRecord(entry))
+            continue;
+          const probeId = readString(entry.probeId);
+          const schemaVersion = readNumber(entry.schemaVersion);
+          const ttlMs = readNumber(entry.ttlMs);
+          if (probeId && schemaVersion !== null && ttlMs !== null) {
+            families.set(probeId, { probeId, schemaVersion, ttlMs });
+          }
+        }
+      }
+      const verbs = new Map;
+      if (Array.isArray(response.verbs)) {
+        for (const entry of response.verbs) {
+          if (!isRecord(entry))
+            continue;
+          const verb = readString(entry.verb);
+          const schemaVersion = readNumber(entry.schemaVersion);
+          if (verb && schemaVersion !== null) {
+            verbs.set(verb, { verb, schemaVersion });
+          }
+        }
+      }
+      this.capabilities = { daemonVersion, families, verbs };
+      this.daemonObserved = true;
+      this.lastError = null;
+      return this.capabilities;
+    } catch (error) {
+      this.capabilities = null;
+      this.lastError = fallbackMessage(error);
+      return null;
+    }
+  }
+  fallback(probeId, key, reason) {
+    const id = fallbackKey(probeId, key);
+    let state = this.fallbackByProbe.get(id);
+    if (!state || state.reason !== reason) {
+      state = { since: Date.now(), reason };
+      this.fallbackByProbe.set(id, state);
+    }
+    return {
+      state: "local",
+      fallbackSince: state.since,
+      fallbackReason: state.reason
+    };
+  }
+  execFallback(verb, reason) {
+    let state = this.fallbackByExec.get(verb);
+    if (!state || state.reason !== reason) {
+      state = { since: Date.now(), reason };
+      this.fallbackByExec.set(verb, state);
+    }
+    return {
+      state: "local",
+      fallbackSince: state.since,
+      fallbackReason: state.reason
+    };
+  }
+}
+var singletonClient = null;
+function getScoutdProbeClient() {
+  singletonClient ??= new ScoutdProbeClient;
+  return singletonClient;
+}
+async function runWithScoutdFallback(input) {
+  const client = getScoutdProbeClient();
+  const scoutd = await client.requestProbe({
+    probeId: input.probeId,
+    key: input.key,
+    maxAgeMs: input.ctx.maxAgeMs,
+    timeoutMs: input.ctx.timeoutMs
+  });
+  if (scoutd.state === "scoutd") {
+    return probeRunOutput(scoutd.value, {
+      backend: "scoutd",
+      generatedAt: scoutd.generatedAt
+    });
+  }
+  const metadata = scoutd.fallbackSince ? {
+    backend: "local-fallback",
+    fallbackSince: scoutd.fallbackSince,
+    fallbackReason: scoutd.fallbackReason ?? "scoutd unavailable"
+  } : { backend: "local" };
+  try {
+    const local = await input.local();
+    return probeRunOutput(local, metadata);
+  } catch (error) {
+    throw new ProbeBackendError(error instanceof Error ? error.message : String(error), metadata, error);
+  }
+}
+function probeSocketTimeoutMs(timeoutMs) {
+  if (timeoutMs === undefined || !Number.isFinite(timeoutMs)) {
+    return SOCKET_TIMEOUT_MS;
+  }
+  return Math.max(SOCKET_TIMEOUT_MS, Math.min(Math.max(0, timeoutMs) + 1000, 31000));
+}
+function requestOpTimeoutMs(timeoutMs) {
+  if (timeoutMs === undefined || !Number.isFinite(timeoutMs)) {
+    return;
+  }
+  return Math.max(0, Math.floor(timeoutMs));
+}
+function execSocketTimeoutMs(args) {
+  const timeoutMs = typeof args.timeoutMs === "number" && Number.isFinite(args.timeoutMs) ? Math.max(0, args.timeoutMs) : 5000;
+  return Math.max(SOCKET_TIMEOUT_MS, Math.min(timeoutMs + 1000, 31000));
+}
+async function requestJson(socketPath, payload, options = {}) {
+  const bun = globalThis.Bun;
+  if (bun?.connect) {
+    return await requestJsonWithBun(bun.connect, socketPath, payload, options);
+  }
+  return await new Promise((resolve, reject) => {
+    const socket = new Socket;
+    let response = "";
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      if (error) {
+        reject(error);
+      } else {
+        resolve(value);
+      }
+    };
+    const timeoutMs = options.timeoutMs ?? SOCKET_TIMEOUT_MS;
+    const timer = setTimeout(() => {
+      finish(new Error(`scoutd probe socket timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+    const finishFromResponse = () => {
+      if (settled)
+        return;
+      try {
+        const parsed = JSON.parse(response);
+        if (isRecord(parsed) && parsed.schema === ERROR_SCHEMA) {
+          const error = isRecord(parsed.error) ? parsed.error : {};
+          const message = readString(error.message) ?? readString(error.code) ?? "scoutd probe request failed";
+          finish(new Error(message));
+          return;
+        }
+        finish(null, parsed);
+      } catch (error) {
+        finish(new Error(`scoutd probe response was not JSON: ${fallbackMessage(error)}`));
+      }
+    };
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(`${JSON.stringify(payload)}
+`);
+    });
+    socket.on("data", (chunk) => {
+      response += chunk;
+      if (Buffer.byteLength(response, "utf8") > MAX_RESPONSE_BYTES) {
+        finish(new Error("scoutd probe response exceeded output limit"));
+      }
+    });
+    socket.on("error", (error) => finish(error));
+    socket.on("end", finishFromResponse);
+    socket.on("close", () => {
+      if (!settled) {
+        if (response.length === 0) {
+          finish(new Error("scoutd probe socket closed without a response"));
+        } else {
+          finishFromResponse();
+        }
+      }
+    });
+    socket.connect(socketPath);
+  });
+}
+async function requestJsonWithBun(connect, socketPath, payload, options = {}) {
+  return await new Promise((resolve, reject) => {
+    let response = "";
+    let settled = false;
+    let socketRef = null;
+    const decoder = new TextDecoder;
+    const finish = (error, value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socketRef?.end?.();
+      } catch {}
+      if (error) {
+        reject(error);
+      } else {
+        resolve(value);
+      }
+    };
+    const finishFromResponse = () => {
+      if (settled)
+        return;
+      try {
+        const parsed = JSON.parse(response);
+        if (isRecord(parsed) && parsed.schema === ERROR_SCHEMA) {
+          const error = isRecord(parsed.error) ? parsed.error : {};
+          const message = readString(error.message) ?? readString(error.code) ?? "scoutd probe request failed";
+          finish(new Error(message));
+          return;
+        }
+        finish(null, parsed);
+      } catch (error) {
+        finish(new Error(`scoutd probe response was not JSON: ${fallbackMessage(error)}`));
+      }
+    };
+    const timeoutMs = options.timeoutMs ?? SOCKET_TIMEOUT_MS;
+    const timer = setTimeout(() => {
+      finish(new Error(`scoutd probe socket timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+    connect({
+      unix: socketPath,
+      socket: {
+        open(socket) {
+          socketRef = socket;
+          socket.write(`${JSON.stringify(payload)}
+`);
+        },
+        data(_socket, data) {
+          response += decoder.decode(data, { stream: true });
+          if (Buffer.byteLength(response, "utf8") > MAX_RESPONSE_BYTES) {
+            finish(new Error("scoutd probe response exceeded output limit"));
+          }
+        },
+        close() {
+          if (response.length === 0) {
+            finish(new Error("scoutd probe socket closed without a response"));
+          } else {
+            response += decoder.decode();
+            finishFromResponse();
+          }
+        },
+        error(_socket, error) {
+          finish(error);
+        }
+      }
+    }).then((socket) => {
+      socketRef = socket;
+    }, (error) => {
+      finish(error instanceof Error ? error : new Error(String(error)));
+    });
+  });
+}
+function fallbackKey(probeId, key) {
+  return `${probeId}\x00${key ?? ""}`;
+}
+
+// packages/runtime/dist/system-probes/exec.js
+class ProbeCommandError extends Error {
+  code;
+  exitCode;
+  signal;
+  constructor(message, options) {
+    super(message);
+    this.name = "ProbeCommandError";
+    this.code = options.code;
+    this.exitCode = options.exitCode;
+    this.signal = options.signal;
+  }
+}
+var DEFAULT_STDOUT_CAP_BYTES = 1024 * 1024;
+var DEFAULT_STDERR_CAP_BYTES = 128 * 1024;
+var SIGKILL_DELAY_MS = 500;
+var EXEC_SYSTEM_TRANSPORT_METADATA = Symbol.for("openscout.execSystem.transport");
+var spawnProcess = spawn;
+function attachExecTransportMetadata(output, metadata) {
+  Object.defineProperty(output, EXEC_SYSTEM_TRANSPORT_METADATA, {
+    value: metadata,
+    enumerable: false,
+    configurable: true
+  });
+  return output;
+}
+function bufferByteLength(chunks) {
+  return chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+}
+function abortMessage(ctx) {
+  const reason = ctx.signal.reason;
+  if (typeof reason === "object" && reason !== null && "message" in reason) {
+    const message = reason.message;
+    if (typeof message === "string" && message.trim()) {
+      return message;
+    }
+  }
+  return `Probe ${ctx.probeId} aborted`;
+}
+async function execProbeFile(ctx, file, args, options = {}) {
+  const maxStdoutBytes = options.maxStdoutBytes ?? DEFAULT_STDOUT_CAP_BYTES;
+  const maxStderrBytes = options.maxStderrBytes ?? DEFAULT_STDERR_CAP_BYTES;
+  return await new Promise((resolve, reject) => {
+    if (ctx.signal.aborted) {
+      reject(new ProbeCommandError(abortMessage(ctx), { code: "aborted" }));
+      return;
+    }
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let settled = false;
+    let killTimer = null;
+    const child = spawnProcess(file, [...args], {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const cleanup = () => {
+      ctx.signal.removeEventListener("abort", onAbort);
+      if (killTimer) {
+        clearTimeout(killTimer);
+        killTimer = null;
+      }
+    };
+    const fail = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      if (!child.killed) {
+        child.kill("SIGTERM");
+      }
+      reject(error);
+    };
+    const onAbort = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      ctx.signal.removeEventListener("abort", onAbort);
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => {
+        child.kill("SIGKILL");
+      }, SIGKILL_DELAY_MS);
+      reject(new ProbeCommandError(abortMessage(ctx), { code: "timeout" }));
+    };
+    ctx.signal.addEventListener("abort", onAbort, { once: true });
+    if (options.input !== undefined) {
+      child.stdin?.end(options.input);
+    }
+    child.stdout?.on("data", (chunk) => {
+      if (settled) {
+        return;
+      }
+      stdoutChunks.push(chunk);
+      if (bufferByteLength(stdoutChunks) > maxStdoutBytes) {
+        fail(new ProbeCommandError(`Probe ${ctx.probeId} stdout exceeded ${maxStdoutBytes} bytes`, { code: "output_cap" }));
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (settled) {
+        return;
+      }
+      stderrChunks.push(chunk);
+      if (bufferByteLength(stderrChunks) > maxStderrBytes) {
+        fail(new ProbeCommandError(`Probe ${ctx.probeId} stderr exceeded ${maxStderrBytes} bytes`, { code: "output_cap" }));
+      }
+    });
+    child.once("error", (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      const code = typeof error.code === "string" ? String(error.code) : "spawn";
+      reject(new ProbeCommandError(error.message, { code }));
+    });
+    child.once("close", (exitCode, signal) => {
+      if (settled) {
+        cleanup();
+        return;
+      }
+      settled = true;
+      cleanup();
+      const stdout = Buffer.concat(stdoutChunks).toString("utf8");
+      const stderr = Buffer.concat(stderrChunks).toString("utf8");
+      if (exitCode === 0) {
+        resolve({ stdout, stderr, exitCode });
+        return;
+      }
+      reject(new ProbeCommandError(`${file} exited with ${exitCode ?? signal ?? "unknown status"}`, { code: "exit", exitCode, signal }));
+    });
+  });
+}
+async function execSystemFile(file, args, options) {
+  const execVerb = mapExecSystemVerb(file, args, options);
+  if (execVerb) {
+    let scoutd;
+    try {
+      scoutd = await getScoutdProbeClient().requestExecVerb({
+        verb: execVerb.verb,
+        args: execVerb.args
+      });
+    } catch (error) {
+      if (error instanceof ScoutdExecResponseError) {
+        throw new ProbeCommandError(error.message, { code: error.code });
+      }
+      throw error;
+    }
+    if (scoutd.state === "scoutd") {
+      return attachExecTransportMetadata(normalizeExecResult(scoutd.value), {
+        backend: "scoutd",
+        daemonVersion: scoutd.daemonVersion,
+        verb: execVerb.verb
+      });
+    }
+    try {
+      const local2 = await execSystemFileLocal(file, args, options);
+      return attachExecTransportMetadata(local2, scoutd.fallbackSince ? {
+        backend: "local-fallback",
+        fallbackSince: scoutd.fallbackSince,
+        fallbackReason: scoutd.fallbackReason ?? "scoutd exec unavailable",
+        verb: execVerb.verb
+      } : {
+        backend: "local",
+        verb: execVerb.verb
+      });
+    } catch (error) {
+      throw error;
+    }
+  }
+  const local = await execSystemFileLocal(file, args, options);
+  return attachExecTransportMetadata(local, { backend: "local" });
+}
+async function execSystemFileLocal(file, args, options) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => {
+    controller.abort(new ProbeCommandError(`Command ${file} timed out after ${options.timeoutMs}ms`, { code: "timeout" }));
+  }, options.timeoutMs);
+  try {
+    return await execProbeFile({
+      probeId: options.probeId ?? `imperative.${file}`,
+      signal: controller.signal,
+      timeoutMs: options.timeoutMs,
+      startedAt: Date.now()
+    }, file, args, options);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function normalizeExecResult(value) {
+  if (!value || typeof value !== "object") {
+    return { stdout: "", stderr: "", exitCode: 0 };
+  }
+  return {
+    stdout: typeof value.stdout === "string" ? value.stdout : "",
+    stderr: typeof value.stderr === "string" ? value.stderr : "",
+    exitCode: typeof value.exitCode === "number" && Number.isFinite(value.exitCode) ? value.exitCode : 0
+  };
+}
+function mapExecSystemVerb(file, args, options) {
+  const command = commandBasename(file);
+  if (command === "tmux")
+    return mapTmuxVerb(args, options);
+  if (command === "tailscale")
+    return mapTailscaleVerb(args, options);
+  if (command === "open" || file === "/usr/bin/open")
+    return mapDarwinRevealVerb(args, options);
+  if (command === "xdg-open")
+    return mapXdgRevealVerb(args, options);
+  if (command === "explorer.exe")
+    return mapWindowsRevealVerb(args, options);
+  return null;
+}
+function commandBasename(file) {
+  const normalized = file.trim();
+  const slash = normalized.lastIndexOf("/");
+  return slash >= 0 ? normalized.slice(slash + 1) : normalized;
+}
+function baseVerbArgs(options) {
+  return { timeoutMs: options.timeoutMs };
+}
+function mapTmuxVerb(rawArgs, options) {
+  const { socketPath, args } = stripTmuxSocketArgs(rawArgs);
+  const command = args[0];
+  const base = { ...baseVerbArgs(options), ...socketPath ? { socketPath } : {} };
+  if (command === "send-keys") {
+    const parsed = parseTmuxSendKeys(args.slice(1));
+    if (!parsed)
+      return null;
+    if (parsed.literal !== null) {
+      return {
+        verb: "tmux.sendKeysLiteral",
+        args: { ...base, target: parsed.target, text: parsed.literal }
+      };
+    }
+    return {
+      verb: "tmux.sendKeys",
+      args: { ...base, target: parsed.target, keys: parsed.keys }
+    };
+  }
+  if (command === "load-buffer") {
+    const bufferName = optionValue(args.slice(1), "-b");
+    if (!bufferName || args[args.length - 1] !== "-" || options.input === undefined)
+      return null;
+    return {
+      verb: "tmux.loadBuffer",
+      args: {
+        ...base,
+        bufferName,
+        content: typeof options.input === "string" ? options.input : Buffer.from(options.input).toString("utf8")
+      }
+    };
+  }
+  if (command === "paste-buffer") {
+    const flags = args[1];
+    const bufferName = optionValue(args.slice(1), "-b");
+    const target = optionValue(args.slice(1), "-t");
+    if (!flags || !bufferName || !target)
+      return null;
+    return {
+      verb: "tmux.pasteBuffer",
+      args: { ...base, flags, bufferName, target }
+    };
+  }
+  if (command === "delete-buffer") {
+    const bufferName = optionValue(args.slice(1), "-b");
+    if (!bufferName)
+      return null;
+    return { verb: "tmux.deleteBuffer", args: { ...base, bufferName } };
+  }
+  if (command === "kill-session") {
+    const target = optionValue(args.slice(1), "-t");
+    if (!target)
+      return null;
+    return { verb: "tmux.killSession", args: { ...base, target } };
+  }
+  if (command === "detach-client") {
+    const sessionName = optionValue(args.slice(1), "-s");
+    if (!sessionName)
+      return null;
+    return { verb: "tmux.detachClient", args: { ...base, sessionName } };
+  }
+  if (command === "new-session") {
+    const parsed = parseTmuxNewSession(args.slice(1));
+    if (!parsed)
+      return null;
+    return { verb: "tmux.newSession", args: { ...base, ...parsed } };
+  }
+  return null;
+}
+function stripTmuxSocketArgs(rawArgs) {
+  if (rawArgs[0] === "-S" && typeof rawArgs[1] === "string" && rawArgs[1].trim()) {
+    return { socketPath: rawArgs[1], args: [...rawArgs.slice(2)] };
+  }
+  return { socketPath: null, args: [...rawArgs] };
+}
+function parseTmuxSendKeys(args) {
+  const target = optionValue(args, "-t");
+  if (!target)
+    return null;
+  const keys = [];
+  let literal = null;
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "-t") {
+      index += 1;
+      continue;
+    }
+    if (arg === "-l") {
+      literal = args[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
+    keys.push(arg);
+  }
+  const optionLikeKey = keys.find((key) => key.startsWith("-"));
+  if (optionLikeKey) {
+    throw new ProbeCommandError(`tmux key must not start with '-': ${optionLikeKey}`, { code: "invalid_request" });
+  }
+  if (literal !== null)
+    return literal ? { target, keys: [], literal } : null;
+  return keys.length > 0 ? { target, keys, literal: null } : null;
+}
+function parseTmuxNewSession(args) {
+  const out = { detached: false, printPane: false };
+  let index = 0;
+  while (index < args.length) {
+    const arg = args[index];
+    if (arg === "-d") {
+      out.detached = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "-P") {
+      out.printPane = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "-dP" || arg === "-Pd") {
+      out.detached = true;
+      out.printPane = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "-s" || arg === "-n" || arg === "-c" || arg === "-F" || arg === "-x" || arg === "-y") {
+      const value = args[index + 1];
+      if (!value)
+        return null;
+      if (arg === "-s")
+        out.sessionName = value;
+      if (arg === "-n")
+        out.windowName = value;
+      if (arg === "-c")
+        out.cwd = value;
+      if (arg === "-F")
+        out.format = value;
+      if (arg === "-x" || arg === "-y") {
+        const parsed = positiveInteger(value);
+        if (parsed === null)
+          return null;
+        if (arg === "-x")
+          out.columns = parsed;
+        if (arg === "-y")
+          out.rows = parsed;
+      }
+      index += 2;
+      continue;
+    }
+    out.command = args.slice(index).join(" ");
+    break;
+  }
+  if (typeof out.sessionName !== "string" || typeof out.command !== "string" || !out.command.trim()) {
+    return null;
+  }
+  return out;
+}
+function positiveInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function optionValue(args, option) {
+  const index = args.indexOf(option);
+  const value = index >= 0 ? args[index + 1] : null;
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function mapTailscaleVerb(args, options) {
+  if (args[0] !== "cert")
+    return null;
+  const certFile = optionValue(args.slice(1), "--cert-file");
+  const keyFile = optionValue(args.slice(1), "--key-file");
+  const hostname = args[args.length - 1];
+  if (!certFile || !keyFile || !hostname || hostname.startsWith("-"))
+    return null;
+  return {
+    verb: "tailscale.cert",
+    args: { ...baseVerbArgs(options), certFile, keyFile, hostname }
+  };
+}
+function mapDarwinRevealVerb(args, options) {
+  if (args.length === 2 && args[0] === "-R" && args[1]) {
+    return {
+      verb: "reveal.open",
+      args: { ...baseVerbArgs(options), mode: "darwinReveal", targetPath: args[1] }
+    };
+  }
+  if (args.length === 1 && args[0]) {
+    return {
+      verb: "reveal.open",
+      args: { ...baseVerbArgs(options), mode: "darwinOpen", targetPath: args[0] }
+    };
+  }
+  return null;
+}
+function mapXdgRevealVerb(args, options) {
+  if (args.length !== 1 || !args[0])
+    return null;
+  return {
+    verb: "reveal.open",
+    args: { ...baseVerbArgs(options), mode: "xdgOpen", targetPath: args[0] }
+  };
+}
+function mapWindowsRevealVerb(args, options) {
+  if (args.length !== 1 || !args[0]?.startsWith("/select,"))
+    return null;
+  return {
+    verb: "reveal.open",
+    args: { ...baseVerbArgs(options), mode: "windowsSelect", targetPath: args[0].slice("/select,".length) }
+  };
+}
+// packages/runtime/dist/repo-service/process.js
+import { existsSync as existsSync2 } from "node:fs";
+import { Socket as Socket2 } from "node:net";
+var REPO_SERVICE_MAX_BUFFER = 2 * 1024 * 1024;
+var CAPABILITIES_SCHEMA2 = "openscout.probe.capabilities/v1";
+var REPO_SCAN_SCHEMA = "openscout.repo.scan/v1";
+var REPO_DIFF_SCHEMA = "openscout.repo.diff/v1";
+var REPO_RESPONSE_SCHEMA = "openscout.repo.response/v1";
+var REPO_SCAN_CAPABILITY_ID = "repo.scan";
+var REPO_DIFF_CAPABILITY_ID = "repo.diff";
+var CAPABILITY_RECHECK_MS2 = 1e4;
+var REPO_SERVICE_TRANSPORT_METADATA = Symbol.for("openscout.repoService.transport");
+class RepoServiceSocketClient {
+  env;
+  capabilities = null;
+  lastCapabilityCheckAt = null;
+  lastError = null;
+  daemonObserved = false;
+  fallbackByOperation = new Map;
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  async requestJob(subcommand, input, timeoutMs) {
+    const operation = operationForSubcommand(subcommand);
+    if (!operation) {
+      return { state: "spawn" };
+    }
+    const socketPath = resolveScoutdProbesSocketPath(this.env);
+    const socketExists = existsSync2(socketPath);
+    if (!socketExists) {
+      this.capabilities = null;
+      this.lastError = null;
+      return this.daemonObserved ? this.fallback(operation.capabilityId, `probe socket is missing: ${socketPath}`) : { state: "spawn" };
+    }
+    this.daemonObserved = true;
+    const socketTimeoutMs = repoSocketTimeoutMs(timeoutMs);
+    const capabilities = await this.ensureCapabilities(socketPath, socketTimeoutMs);
+    if (!capabilities) {
+      return this.fallback(operation.capabilityId, this.lastError ?? "probe capabilities unavailable");
+    }
+    const capability = capabilities.families.get(operation.capabilityId);
+    if (!capability) {
+      return this.fallback(operation.capabilityId, `scoutd does not serve ${operation.capabilityId}`);
+    }
+    const expectedSchemaVersion = expectedScoutHostProbeSchemaVersion(operation.capabilityId);
+    if (expectedSchemaVersion === null) {
+      return this.fallback(operation.capabilityId, `client has no compiled schema version for ${operation.capabilityId}`);
+    }
+    if (capability.schemaVersion !== expectedSchemaVersion) {
+      return this.fallback(operation.capabilityId, `scoutd serves ${operation.capabilityId} schema v${capability.schemaVersion}, expected v${expectedSchemaVersion}`);
+    }
+    let response;
+    try {
+      response = await requestJson2(socketPath, repoRequestPayload(operation.schema, input, expectedSchemaVersion), socketTimeoutMs);
+    } catch (error) {
+      this.capabilities = null;
+      this.lastCapabilityCheckAt = null;
+      this.lastError = fallbackMessage2(error);
+      return this.fallback(operation.capabilityId, this.lastError);
+    }
+    if (!isRecord2(response) || response.schema !== REPO_RESPONSE_SCHEMA) {
+      this.capabilities = null;
+      this.lastCapabilityCheckAt = null;
+      this.lastError = "scoutd returned an invalid repo-service envelope";
+      return this.fallback(operation.capabilityId, this.lastError);
+    }
+    if (response.error) {
+      const error = isRecord2(response.error) ? response.error : {};
+      const message = readString2(error.message) ?? readString2(error.code) ?? "scoutd repo service failed";
+      throw new Error(message);
+    }
+    this.fallbackByOperation.delete(operation.capabilityId);
+    this.lastError = null;
+    return {
+      state: "scoutd",
+      value: response.value,
+      daemonVersion: readString2(response.daemonVersion) ?? capabilities.daemonVersion
+    };
+  }
+  resetForTests() {
+    this.capabilities = null;
+    this.lastCapabilityCheckAt = null;
+    this.lastError = null;
+    this.daemonObserved = false;
+    this.fallbackByOperation.clear();
+  }
+  async ensureCapabilities(socketPath, timeoutMs) {
+    const now = Date.now();
+    if (this.capabilities && this.lastCapabilityCheckAt !== null && now - this.lastCapabilityCheckAt < CAPABILITY_RECHECK_MS2) {
+      return this.capabilities;
+    }
+    this.lastCapabilityCheckAt = now;
+    try {
+      const response = await requestJson2(socketPath, { schema: CAPABILITIES_SCHEMA2 }, timeoutMs);
+      if (!isRecord2(response) || response.schema !== CAPABILITIES_SCHEMA2) {
+        throw new Error("scoutd returned an invalid capabilities envelope");
+      }
+      const daemonVersion = readString2(response.daemonVersion) ?? "unknown";
+      const families = new Map;
+      if (Array.isArray(response.families)) {
+        for (const entry of response.families) {
+          if (!isRecord2(entry))
+            continue;
+          const probeId = readString2(entry.probeId);
+          const schemaVersion = readNumber2(entry.schemaVersion);
+          const ttlMs = readNumber2(entry.ttlMs);
+          if (probeId && schemaVersion !== null && ttlMs !== null) {
+            families.set(probeId, { probeId, schemaVersion, ttlMs });
+          }
+        }
+      }
+      this.capabilities = { daemonVersion, families };
+      this.daemonObserved = true;
+      this.lastError = null;
+      return this.capabilities;
+    } catch (error) {
+      this.capabilities = null;
+      this.lastError = fallbackMessage2(error);
+      return null;
+    }
+  }
+  fallback(operation, reason) {
+    let state = this.fallbackByOperation.get(operation);
+    if (!state || state.reason !== reason) {
+      state = { since: Date.now(), reason };
+      this.fallbackByOperation.set(operation, state);
+    }
+    return {
+      state: "spawn",
+      fallbackSince: state.since,
+      fallbackReason: state.reason
+    };
+  }
+}
+function operationForSubcommand(subcommand) {
+  switch (subcommand) {
+    case "scan":
+      return { capabilityId: REPO_SCAN_CAPABILITY_ID, schema: REPO_SCAN_SCHEMA };
+    case "diff":
+      return { capabilityId: REPO_DIFF_CAPABILITY_ID, schema: REPO_DIFF_SCHEMA };
+    default:
+      return null;
+  }
+}
+function repoRequestPayload(schema, input, schemaVersion) {
+  if (isRecord2(input)) {
+    return { ...input, schema, schemaVersion };
+  }
+  return { schema, schemaVersion, value: input };
+}
+function readString2(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function readNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fallbackMessage2(error) {
+  if (error instanceof Error && error.message.trim()) {
+    return error.message;
+  }
+  return String(error);
+}
+function repoSocketTimeoutMs(timeoutMs) {
+  return Math.max(900, Math.min(Math.max(0, timeoutMs) + 1000, 31000));
+}
+async function requestJson2(socketPath, payload, timeoutMs) {
+  const bun = globalThis.Bun;
+  if (bun?.connect) {
+    return await requestJsonWithBun2(bun.connect, socketPath, payload, timeoutMs);
+  }
+  return await new Promise((resolvePromise, reject) => {
+    const socket = new Socket2;
+    let response = "";
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      if (error) {
+        reject(error);
+      } else {
+        resolvePromise(value);
+      }
+    };
+    const timer = setTimeout(() => {
+      finish(new Error(`scoutd repo-service socket timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+    const finishFromResponse = () => {
+      if (settled)
+        return;
+      try {
+        finish(null, JSON.parse(response));
+      } catch (error) {
+        finish(new Error(`scoutd repo-service response was not JSON: ${fallbackMessage2(error)}`));
+      }
+    };
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(`${JSON.stringify(payload)}
+`);
+    });
+    socket.on("data", (chunk) => {
+      response += chunk;
+      if (Buffer.byteLength(response, "utf8") > REPO_SERVICE_MAX_BUFFER) {
+        finish(new Error("scoutd repo-service response exceeded output limit"));
+      }
+    });
+    socket.on("error", (error) => finish(error));
+    socket.on("end", finishFromResponse);
+    socket.on("close", () => {
+      if (!settled) {
+        if (response.length === 0) {
+          finish(new Error("scoutd repo-service socket closed without a response"));
+        } else {
+          finishFromResponse();
+        }
+      }
+    });
+    socket.connect(socketPath);
+  });
+}
+async function requestJsonWithBun2(connect, socketPath, payload, timeoutMs) {
+  return await new Promise((resolvePromise, reject) => {
+    let response = "";
+    let settled = false;
+    let socketRef = null;
+    const decoder = new TextDecoder;
+    const finish = (error, value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socketRef?.end?.();
+      } catch {}
+      if (error) {
+        reject(error);
+      } else {
+        resolvePromise(value);
+      }
+    };
+    const finishFromResponse = () => {
+      if (settled)
+        return;
+      try {
+        finish(null, JSON.parse(response));
+      } catch (error) {
+        finish(new Error(`scoutd repo-service response was not JSON: ${fallbackMessage2(error)}`));
+      }
+    };
+    const timer = setTimeout(() => {
+      finish(new Error(`scoutd repo-service socket timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+    connect({
+      unix: socketPath,
+      socket: {
+        open(socket) {
+          socketRef = socket;
+          socket.write(`${JSON.stringify(payload)}
+`);
+        },
+        data(_socket, data) {
+          response += decoder.decode(data, { stream: true });
+          if (Buffer.byteLength(response, "utf8") > REPO_SERVICE_MAX_BUFFER) {
+            finish(new Error("scoutd repo-service response exceeded output limit"));
+          }
+        },
+        close() {
+          if (response.length === 0) {
+            finish(new Error("scoutd repo-service socket closed without a response"));
+          } else {
+            response += decoder.decode();
+            finishFromResponse();
+          }
+        },
+        error(_socket, error) {
+          finish(error);
+        }
+      }
+    }).then((socket) => {
+      socketRef = socket;
+    }, (error) => {
+      finish(error instanceof Error ? error : new Error(String(error)));
+    });
+  });
+}
+
+// packages/runtime/dist/system-probes/git-build-info.js
+import { existsSync as existsSync3, realpathSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+var staticMetadataByRepo = new Map;
+function realpathOrResolved(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+function directoryOrParent(path) {
+  const resolved = resolve(path);
+  try {
+    const stat = statSync(resolved);
+    return stat.isDirectory() ? resolved : dirname(resolved);
+  } catch {
+    return resolved;
+  }
+}
+function canonicalRepoRoot(rawPath) {
+  let current = realpathOrResolved(directoryOrParent(rawPath));
+  while (true) {
+    if (existsSync3(resolve(current, ".git"))) {
+      return realpathOrResolved(current);
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return realpathOrResolved(directoryOrParent(rawPath));
+    }
+    current = parent;
+  }
+}
+async function gitOutput(repoRoot, args, ctx) {
+  try {
+    const gitBin = process.env.OPENSCOUT_GIT_BIN?.trim() || "git";
+    const { stdout } = await execProbeFile(ctx, gitBin, ["-C", repoRoot, ...args], {
+      maxStdoutBytes: 256 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    return stdout;
+  } catch (error) {
+    if (error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit")) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function gitValue(repoRoot, args, ctx) {
+  const output = await gitOutput(repoRoot, args, ctx);
+  const value = output?.trim() ?? "";
+  return value.length > 0 ? value : null;
+}
+async function loadStaticMetadata(repoRoot, ctx) {
+  const cached = staticMetadataByRepo.get(repoRoot);
+  if (cached) {
+    return cached;
+  }
+  const metadata = {
+    commit: await gitValue(repoRoot, ["rev-parse", "--short", "HEAD"], ctx),
+    bootBranch: await gitValue(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"], ctx),
+    metadataAt: Date.now()
+  };
+  staticMetadataByRepo.set(repoRoot, metadata);
+  return metadata;
+}
+var gitBuildInfoProbe = defineProbeFamily({
+  id: "git.buildInfo",
+  ttlMs: 60000,
+  timeoutMs: 1500,
+  maxKeys: 64,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: canonicalRepoRoot,
+  run: async (repoRoot, ctx) => runWithScoutdFallback({
+    probeId: "git.buildInfo",
+    key: repoRoot,
+    ctx,
+    local: async () => {
+      const metadata = await loadStaticMetadata(repoRoot, ctx);
+      const [branch, dirtyStatus] = await Promise.all([
+        gitValue(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"], ctx),
+        gitOutput(repoRoot, ["status", "--porcelain"], ctx)
+      ]);
+      return {
+        repoRoot,
+        commit: metadata.commit,
+        bootBranch: metadata.bootBranch,
+        branch: branch ?? metadata.bootBranch,
+        dirty: dirtyStatus === null ? null : dirtyStatus.trim().length > 0,
+        metadataAt: metadata.metadataAt,
+        statusAt: Date.now()
+      };
+    }
+  })
+});
+
+// packages/runtime/dist/system-probes/git.js
+var GIT_PROBE_TTL_MS = 60000;
+var DEFAULT_GIT_TIMEOUT_MS = 5000;
+var DEFAULT_GIT_STDOUT_BYTES = 1024 * 1024;
+var DEFAULT_GIT_STDERR_BYTES = 256 * 1024;
+
+class GitCatalogValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitCatalogValidationError";
+  }
+}
+function gitBin() {
+  return process.env.OPENSCOUT_GIT_BIN?.trim() || "git";
+}
+function isUnavailable(error) {
+  return error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit");
+}
+function validateNoNul(value, label) {
+  if (value.includes("\x00")) {
+    throw new GitCatalogValidationError(`${label} contains a NUL byte`);
+  }
+}
+function validateGitRefValue(value, label = "git ref") {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new GitCatalogValidationError(`${label} is required`);
+  }
+  validateNoNul(trimmed, label);
+  if (trimmed.startsWith("-")) {
+    throw new GitCatalogValidationError(`${label} must not start with '-'`);
+  }
+  return trimmed;
+}
+function validateGitPathspecValue(value, label = "git pathspec") {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new GitCatalogValidationError(`${label} is required`);
+  }
+  validateNoNul(trimmed, label);
+  if (trimmed.startsWith("-")) {
+    throw new GitCatalogValidationError(`${label} must not start with '-'`);
+  }
+  return trimmed;
+}
+function validateGitPathspecs(paths) {
+  return (paths ?? []).map((path, index) => validateGitPathspecValue(path, `git pathspec ${index + 1}`));
+}
+function normalizeRepoRoot(repoRoot) {
+  return canonicalRepoRoot(repoRoot);
+}
+function normalizedRevParseInput(input) {
+  const repoRoot = normalizeRepoRoot(input.repoRoot);
+  if (input.kind === "verifyCommit") {
+    return {
+      repoRoot,
+      kind: input.kind,
+      ref: validateGitRefValue(input.ref, "git verify ref"),
+      quiet: input.quiet === true
+    };
+  }
+  return { repoRoot, kind: input.kind };
+}
+function normalizeRevParseKey(input) {
+  return JSON.stringify(normalizedRevParseInput(input));
+}
+function parseRevParseKey(key) {
+  return JSON.parse(key);
+}
+function normalizedDiffSelector(selector) {
+  switch (selector.kind) {
+    case "unstaged":
+    case "staged":
+      return selector;
+    case "fromRef":
+      return { kind: selector.kind, ref: validateGitRefValue(selector.ref, "git diff ref") };
+    case "twoRefs":
+      return {
+        kind: selector.kind,
+        baseRef: validateGitRefValue(selector.baseRef, "git diff base ref"),
+        compareRef: validateGitRefValue(selector.compareRef, "git diff compare ref")
+      };
+    case "range":
+      return {
+        kind: selector.kind,
+        notation: selector.notation,
+        baseRef: validateGitRefValue(selector.baseRef, "git diff base ref"),
+        compareRef: validateGitRefValue(selector.compareRef, "git diff compare ref")
+      };
+  }
+}
+function normalizedDiffInput(input) {
+  return {
+    repoRoot: normalizeRepoRoot(input.repoRoot),
+    selector: normalizedDiffSelector(input.selector),
+    paths: validateGitPathspecs(input.paths)
+  };
+}
+function normalizeDiffShortstatKey(input) {
+  return JSON.stringify(normalizedDiffInput(input));
+}
+function parseDiffKey(key) {
+  return JSON.parse(key);
+}
+function normalizedMergeBaseInput(input) {
+  return {
+    repoRoot: normalizeRepoRoot(input.repoRoot),
+    baseRef: validateGitRefValue(input.baseRef, "git merge-base base ref"),
+    compareRef: validateGitRefValue(input.compareRef, "git merge-base compare ref")
+  };
+}
+function normalizeMergeBaseKey(input) {
+  return JSON.stringify(normalizedMergeBaseInput(input));
+}
+function parseMergeBaseKey(key) {
+  return JSON.parse(key);
+}
+function validateGitStatusVersion(value) {
+  if (value === "v1" || value === "v2")
+    return value;
+  throw new GitCatalogValidationError("git status porcelain version must be v1 or v2");
+}
+function normalizedStatusPorcelainInput(input) {
+  const untrackedMode = input.untrackedMode;
+  if (untrackedMode !== undefined && untrackedMode !== "normal") {
+    throw new GitCatalogValidationError("git status untrackedMode must be normal when provided");
+  }
+  return {
+    repoRoot: normalizeRepoRoot(input.repoRoot),
+    version: validateGitStatusVersion(input.version),
+    branch: input.branch === true ? true : undefined,
+    z: input.z === true ? true : undefined,
+    untrackedMode,
+    paths: validateGitPathspecs(input.paths)
+  };
+}
+function normalizeStatusPorcelainKey(input) {
+  return JSON.stringify(normalizedStatusPorcelainInput(input));
+}
+function parseStatusPorcelainKey(key) {
+  return JSON.parse(key);
+}
+function revParseArgs(input) {
+  switch (input.kind) {
+    case "showToplevel":
+      return ["rev-parse", "--show-toplevel"];
+    case "gitDir":
+      return ["rev-parse", "--git-dir"];
+    case "gitCommonDir":
+      return ["rev-parse", "--git-common-dir"];
+    case "isInsideWorkTree":
+      return ["rev-parse", "--is-inside-work-tree"];
+    case "shortHead":
+      return ["rev-parse", "--short", "HEAD"];
+    case "abbrevRefHead":
+      return ["rev-parse", "--abbrev-ref", "HEAD"];
+    case "upstreamSymbolicFullName":
+      return ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"];
+    case "verifyCommit":
+      return [
+        "rev-parse",
+        "--verify",
+        ...input.quiet === true ? ["--quiet"] : [],
+        "--end-of-options",
+        `${validateGitRefValue(input.ref, "git verify ref")}^{commit}`
+      ];
+  }
+}
+function diffSelectorArgs(selector) {
+  const normalized = normalizedDiffSelector(selector);
+  switch (normalized.kind) {
+    case "unstaged":
+      return [];
+    case "staged":
+      return ["--cached"];
+    case "fromRef":
+      return ["--end-of-options", normalized.ref];
+    case "twoRefs":
+      return ["--end-of-options", normalized.baseRef, normalized.compareRef];
+    case "range": {
+      const operator = normalized.notation === "ellipsis" ? "..." : "..";
+      return ["--end-of-options", `${normalized.baseRef}${operator}${normalized.compareRef}`];
+    }
+  }
+}
+function pathspecArgs(paths) {
+  const normalized = validateGitPathspecs(paths);
+  return normalized.length > 0 ? ["--", ...normalized] : [];
+}
+function gitDiffCommandArgs(input) {
+  const normalized = normalizedDiffInput(input);
+  const outputArgs = (() => {
+    switch (input.output) {
+      case "rawZ":
+        return ["--raw", "-z"];
+      case "numstat":
+        return ["--numstat"];
+      case "numstatZ":
+        return ["--numstat", "-z"];
+      case "shortstat":
+        return ["--shortstat"];
+      case "patch":
+        return ["--no-color", "--no-ext-diff", "--default-prefix", "--full-index", "-U3"];
+    }
+  })();
+  return ["diff", ...outputArgs, ...diffSelectorArgs(normalized.selector), ...pathspecArgs(normalized.paths)];
+}
+function mergeBaseArgs(input) {
+  const normalized = normalizedMergeBaseInput(input);
+  return [
+    "merge-base",
+    "--end-of-options",
+    normalized.baseRef,
+    normalized.compareRef
+  ];
+}
+function statusPorcelainArgs(input) {
+  const normalized = normalizedStatusPorcelainInput(input);
+  const paths = normalized.paths ?? [];
+  const args = ["status", `--porcelain=${normalized.version}`];
+  if (normalized.branch)
+    args.push("--branch");
+  if (normalized.z)
+    args.push("-z");
+  if (normalized.untrackedMode === "normal")
+    args.push("-unormal");
+  if (paths.length > 0)
+    args.push("--", ...paths);
+  return args;
+}
+async function runGitProbeCommandLocal(ctx, repoRoot, args, maxStdoutBytes) {
+  try {
+    const result = await execProbeFile(ctx, gitBin(), ["-C", normalizeRepoRoot(repoRoot), ...args], {
+      maxStdoutBytes,
+      maxStderrBytes: DEFAULT_GIT_STDERR_BYTES
+    });
+    return result.stdout;
+  } catch (error) {
+    if (isUnavailable(error))
+      return null;
+    throw error;
+  }
+}
+function trimOutput(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed ? trimmed : null;
+}
+var gitRevParseProbe = defineProbeFamily({
+  id: "git.revParse",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: normalizeRevParseKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "git.revParse",
+    key,
+    ctx,
+    local: async () => {
+      const input = parseRevParseKey(key);
+      return trimOutput(await runGitProbeCommandLocal(ctx, input.repoRoot, revParseArgs(input), 256 * 1024));
+    }
+  })
+});
+var gitDiffShortstatProbe = defineProbeFamily({
+  id: "git.diffShortstat",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: normalizeDiffShortstatKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "git.diffShortstat",
+    key,
+    ctx,
+    local: async () => {
+      const input = parseDiffKey(key);
+      return trimOutput(await runGitProbeCommandLocal(ctx, input.repoRoot, gitDiffCommandArgs({ ...input, output: "shortstat" }), 256 * 1024));
+    }
+  })
+});
+var gitMergeBaseProbe = defineProbeFamily({
+  id: "git.mergeBase",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: normalizeMergeBaseKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "git.mergeBase",
+    key,
+    ctx,
+    local: async () => {
+      const input = parseMergeBaseKey(key);
+      return trimOutput(await runGitProbeCommandLocal(ctx, input.repoRoot, mergeBaseArgs(input), 256 * 1024));
+    }
+  })
+});
+var gitStatusPorcelainProbe = defineProbeFamily({
+  id: "git.statusPorcelain",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: normalizeStatusPorcelainKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "git.statusPorcelain",
+    key,
+    ctx,
+    local: async () => {
+      const input = parseStatusPorcelainKey(key);
+      return await runGitProbeCommandLocal(ctx, input.repoRoot, statusPorcelainArgs(input), DEFAULT_GIT_STDOUT_BYTES);
+    }
+  })
+});
+var gitLogLastCommitUnixProbe = defineProbeFamily({
+  id: "git.logLastCommitUnix",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: (repoRoot) => normalizeRepoRoot(repoRoot),
+  run: (repoRoot, ctx) => runWithScoutdFallback({
+    probeId: "git.logLastCommitUnix",
+    key: repoRoot,
+    ctx,
+    local: async () => trimOutput(await runGitProbeCommandLocal(ctx, repoRoot, ["log", "-1", "--format=%ct"], 64 * 1024))
+  })
+});
+var gitWorktreeListPorcelainProbe = defineProbeFamily({
+  id: "git.worktreeListPorcelain",
+  ttlMs: GIT_PROBE_TTL_MS,
+  timeoutMs: DEFAULT_GIT_TIMEOUT_MS,
+  maxKeys: 256,
+  idleKeyTtlMs: 10 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: (repoRoot) => normalizeRepoRoot(repoRoot),
+  run: (repoRoot, ctx) => runWithScoutdFallback({
+    probeId: "git.worktreeListPorcelain",
+    key: repoRoot,
+    ctx,
+    local: async () => await runGitProbeCommandLocal(ctx, repoRoot, ["worktree", "list", "--porcelain"], DEFAULT_GIT_STDOUT_BYTES)
+  })
+});
+
+// packages/runtime/dist/system-probes/net-listeners.js
+function isUnavailable2(error) {
+  return error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit");
+}
+function lsofBin() {
+  return process.env.OPENSCOUT_LSOF_BIN?.trim() || "lsof";
+}
+var netListenersProbe = defineProbeFamily({
+  id: "net.listeners",
+  ttlMs: 5000,
+  timeoutMs: 1500,
+  maxKeys: 128,
+  idleKeyTtlMs: 2 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: (port) => String(port).trim(),
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "net.listeners",
+    key,
+    ctx,
+    local: () => readNetListenerLocal(key, ctx)
+  })
+});
+async function readNetListenerLocal(key, ctx) {
+  const port = Number.parseInt(key, 10);
+  if (!Number.isFinite(port) || port <= 0) {
+    return { port: 0, pid: null };
+  }
+  try {
+    const { stdout } = await execProbeFile(ctx, lsofBin(), [
+      "-nP",
+      `-iTCP:${port}`,
+      "-sTCP:LISTEN",
+      "-Fp"
+    ], {
+      maxStdoutBytes: 64 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    const match = stdout.match(/^p(\d+)/m);
+    const pid = match ? Number.parseInt(match[1], 10) : null;
+    return { port, pid: Number.isFinite(pid) ? pid : null };
+  } catch (error) {
+    if (isUnavailable2(error))
+      return { port, pid: null };
+    throw error;
+  }
+}
+
+// packages/runtime/dist/system-probes/ps.js
+var PS_TTL_MS = 5000;
+var PS_TIMEOUT_MS = 1500;
+var DEFAULT_PS_DISCOVERY_MAX_ROWS = 4096;
+var PS_DISCOVERY_MAX_COMMAND_CHARS = 1024;
+function parseProcessNumber(value) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function normalizeTty(value) {
+  const normalized = value?.replace(/^\/dev\//u, "").trim();
+  if (!normalized || normalized === "??" || normalized === "?")
+    return null;
+  return normalized;
+}
+function isUnavailable3(error) {
+  return error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit");
+}
+function psBin() {
+  return process.env.OPENSCOUT_PS_BIN?.trim() || "ps";
+}
+function lsofBin2() {
+  return process.env.OPENSCOUT_LSOF_BIN?.trim() || "lsof";
+}
+function psDiscoveryMaxRows() {
+  const parsed = Number.parseInt(process.env.OPENSCOUT_PS_DISCOVERY_MAX_ROWS ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PS_DISCOVERY_MAX_ROWS;
+}
+function truncateCommand(value) {
+  if (value.length <= PS_DISCOVERY_MAX_COMMAND_CHARS) {
+    return { command: value, truncated: false };
+  }
+  return {
+    command: value.slice(0, PS_DISCOVERY_MAX_COMMAND_CHARS),
+    truncated: true
+  };
+}
+function parseRows(output) {
+  return output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const parts = line.split(/\s+/u);
+    const pid = parseProcessNumber(parts[0]);
+    const ppid = parseProcessNumber(parts[1]);
+    const pgid = parseProcessNumber(parts[2]);
+    const tty = normalizeTty(parts[3]);
+    const comm = parts.slice(4).join(" ");
+    return pid && ppid && pgid && comm ? { pid, ppid, pgid, tty, comm } : null;
+  }).filter((row) => Boolean(row));
+}
+function parseCommandRows(output) {
+  return output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const parts = line.split(/\s+/u);
+    const pid = parseProcessNumber(parts[0]);
+    const ppid = parseProcessNumber(parts[1]);
+    const pgid = parseProcessNumber(parts[2]);
+    const tty = normalizeTty(parts[3]);
+    const command = truncateCommand(parts.slice(4).join(" ")).command;
+    const comm = command.split(/\s+/u)[0] ?? "";
+    return pid && ppid && pgid && comm && command ? { pid, ppid, pgid, tty, comm, command } : null;
+  }).filter((row) => Boolean(row));
+}
+function parseDiscoveryRows(output) {
+  return output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const match = line.match(/^(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/u);
+    if (!match)
+      return null;
+    const pid = parseProcessNumber(match[1]);
+    const ppid = parseProcessNumber(match[2]);
+    const etime = match[3]?.trim() ?? "";
+    const command = match[4]?.trim() ?? "";
+    return pid && ppid && etime && command ? { pid, ppid, etime, command } : null;
+  }).filter((row) => Boolean(row));
+}
+function summarizeProcessDiscoveryRows(rows, maxRows = psDiscoveryMaxRows()) {
+  const totalCount = rows.length;
+  let truncatedCommand = false;
+  const cappedRows = rows.slice(0, maxRows).map((row) => {
+    const command = truncateCommand(row.command);
+    if (command.truncated)
+      truncatedCommand = true;
+    return { ...row, command: command.command };
+  });
+  return {
+    rows: cappedRows,
+    truncated: totalCount > cappedRows.length || truncatedCommand,
+    totalCount,
+    returnedCount: cappedRows.length
+  };
+}
+async function readPsRuntimeLocal(ctx) {
+  try {
+    const [rows, commandRows] = await Promise.all([
+      execProbeFile(ctx, psBin(), ["-axo", "pid=,ppid=,pgid=,tty=,comm="], {
+        maxStdoutBytes: 4 * 1024 * 1024,
+        maxStderrBytes: 128 * 1024
+      }),
+      execProbeFile(ctx, psBin(), ["-axo", "pid=,ppid=,pgid=,tty=,command="], {
+        maxStdoutBytes: 8 * 1024 * 1024,
+        maxStderrBytes: 128 * 1024
+      })
+    ]);
+    return {
+      rows: parseRows(rows.stdout),
+      commandRows: parseCommandRows(commandRows.stdout)
+    };
+  } catch (error) {
+    if (isUnavailable3(error)) {
+      return { rows: [], commandRows: [] };
+    }
+    throw error;
+  }
+}
+var psRuntimeProbe = defineProbe({
+  id: "ps.runtime",
+  ttlMs: PS_TTL_MS,
+  timeoutMs: PS_TIMEOUT_MS,
+  run: (ctx) => runWithScoutdFallback({
+    probeId: "ps.runtime",
+    ctx,
+    local: () => readPsRuntimeLocal(ctx)
+  })
+});
+async function readPsDiscoveryLocal(ctx) {
+  try {
+    const { stdout } = await execProbeFile(ctx, psBin(), ["-axww", "-o", "pid=,ppid=,etime=,command="], {
+      maxStdoutBytes: 32 * 1024 * 1024,
+      maxStderrBytes: 128 * 1024
+    });
+    return summarizeProcessDiscoveryRows(parseDiscoveryRows(stdout));
+  } catch (error) {
+    if (isUnavailable3(error))
+      return summarizeProcessDiscoveryRows([]);
+    throw error;
+  }
+}
+var psDiscoveryProbe = defineProbe({
+  id: "ps.discovery",
+  ttlMs: 1000,
+  timeoutMs: PS_TIMEOUT_MS,
+  run: (ctx) => runWithScoutdFallback({
+    probeId: "ps.discovery",
+    ctx,
+    local: () => readPsDiscoveryLocal(ctx)
+  })
+});
+var processCwdProbe = defineProbeFamily({
+  id: "ps.cwd",
+  ttlMs: PS_TTL_MS,
+  timeoutMs: 1500,
+  maxKeys: 256,
+  idleKeyTtlMs: 2 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: (pid) => String(pid).trim(),
+  run: async (key, ctx) => runWithScoutdFallback({
+    probeId: "ps.cwd",
+    key,
+    ctx,
+    local: () => readProcessCwdLocal(key, ctx)
+  })
+});
+async function readProcessCwdLocal(key, ctx) {
+  const pid = Number.parseInt(key, 10);
+  if (!Number.isFinite(pid) || pid <= 0)
+    return null;
+  try {
+    const { stdout } = await execProbeFile(ctx, lsofBin2(), [
+      "-a",
+      "-p",
+      String(pid),
+      "-d",
+      "cwd",
+      "-Fn"
+    ], {
+      maxStdoutBytes: 64 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    for (const line of stdout.split(/\r?\n/u)) {
+      if (!line.startsWith("n"))
+        continue;
+      const value = line.slice(1).trim();
+      if (value)
+        return value;
+    }
+    return null;
+  } catch (error) {
+    if (isUnavailable3(error))
+      return null;
+    throw error;
+  }
+}
+
+// packages/runtime/dist/system-probes/tailscale-status.js
+import { readFile } from "node:fs/promises";
+var DEFAULT_TAILSCALE_STATUS_TIMEOUT_MS = 1500;
+function parseTailscaleStatusJson(raw) {
+  return JSON.parse(raw);
+}
+function parsePeers(status) {
+  const peers = Object.entries(status.Peer ?? {});
+  return peers.map(([fallbackId, peer]) => ({
+    id: peer.ID ?? fallbackId,
+    name: peer.HostName ?? peer.DNSName ?? fallbackId,
+    dnsName: peer.DNSName,
+    addresses: peer.TailscaleIPs ?? [],
+    online: peer.Online ?? false,
+    hostName: peer.HostName,
+    os: peer.OS,
+    tags: peer.Tags ?? []
+  }));
+}
+function parseSelf(status) {
+  const self = status.Self;
+  if (!self) {
+    return null;
+  }
+  return {
+    id: self.ID ?? self.DNSName ?? self.HostName ?? "self",
+    name: self.HostName ?? self.DNSName ?? "self",
+    dnsName: self.DNSName,
+    addresses: self.TailscaleIPs ?? [],
+    online: self.Online ?? true,
+    hostName: self.HostName,
+    os: self.OS,
+    tailnetName: status.CurrentTailnet?.Name,
+    magicDnsSuffix: status.CurrentTailnet?.MagicDNSSuffix
+  };
+}
+function isTailscaleBackendRunning(status) {
+  return (status.BackendState ?? "").trim().toLowerCase() === "running";
+}
+function summarizeTailscaleStatus(status) {
+  return {
+    backendState: status.BackendState ?? null,
+    running: isTailscaleBackendRunning(status),
+    health: status.Health ?? [],
+    peers: parsePeers(status),
+    self: parseSelf(status)
+  };
+}
+function statusTimeoutMs(env) {
+  const parsed = Number.parseInt(env.OPENSCOUT_TAILSCALE_STATUS_TIMEOUT_MS ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TAILSCALE_STATUS_TIMEOUT_MS;
+}
+async function readStatusJsonFromFile(filePath) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    return parseTailscaleStatusJson(raw);
+  } catch {
+    return null;
+  }
+}
+function isDomainUnavailableError(error) {
+  if (!(error instanceof ProbeCommandError)) {
+    return false;
+  }
+  return error.code === "ENOENT" || error.code === "spawn" || error.code === "exit";
+}
+async function readTailscaleStatusSummaryLocal(ctx) {
+  const fixturePath = process.env.OPENSCOUT_TAILSCALE_STATUS_JSON;
+  if (fixturePath) {
+    const status = await readStatusJsonFromFile(fixturePath);
+    return status ? summarizeTailscaleStatus(status) : null;
+  }
+  const tailscaleBin = process.env.OPENSCOUT_TAILSCALE_BIN ?? "tailscale";
+  try {
+    const { stdout } = await execProbeFile(ctx, tailscaleBin, ["status", "--json"], {
+      maxStdoutBytes: 4 * 1024 * 1024,
+      maxStderrBytes: 256 * 1024
+    });
+    return summarizeTailscaleStatus(parseTailscaleStatusJson(stdout));
+  } catch (error) {
+    if (isDomainUnavailableError(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+var tailscaleStatusProbe = defineProbe({
+  id: "tailscale.status",
+  ttlMs: 30000,
+  timeoutMs: statusTimeoutMs(process.env),
+  run: (ctx) => runWithScoutdFallback({
+    probeId: "tailscale.status",
+    ctx,
+    local: () => readTailscaleStatusSummaryLocal(ctx)
+  })
+});
+
+// packages/runtime/dist/system-probes/tmux.js
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+var TMUX_TTL_MS = 5000;
+var TMUX_TIMEOUT_MS = 1500;
+var ZELLIJ_TIMEOUT_MS = 1500;
+function parsePositiveInteger(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
+}
+function cleanOptionalString(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function splitDelimitedLine(line, delimiter, fieldCount) {
+  const parts = line.split(delimiter);
+  if (parts.length <= fieldCount)
+    return parts;
+  return [...parts.slice(0, fieldCount - 1), parts.slice(fieldCount - 1).join(delimiter)];
+}
+function parseProcessNumber2(value) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function isUnavailable4(error) {
+  return error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit");
+}
+function tmuxBin() {
+  return process.env.OPENSCOUT_TMUX_BIN?.trim() || "tmux";
+}
+function zellijBin() {
+  return process.env.OPENSCOUT_ZELLIJ_BIN?.trim() || "zellij";
+}
+function tmuxSocketFromEnv(env) {
+  const explicit = env.OPENSCOUT_TMUX_SOCKET?.trim();
+  if (explicit)
+    return explicit;
+  const tmux = env.TMUX?.trim();
+  if (!tmux)
+    return null;
+  const [socketPath] = tmux.split(",");
+  return socketPath?.trim() || null;
+}
+function tmuxSocketKey(input) {
+  if (typeof input === "string")
+    return input.trim() || "default";
+  const socketPath = input?.socketPath?.trim() || tmuxSocketFromEnv(input?.env ?? process.env);
+  return socketPath || "default";
+}
+function tmuxSocketArgs(key) {
+  return key === "default" ? [] : ["-S", key];
+}
+function zellijSocketDirFromEnv(env) {
+  return env.ZELLIJ_SOCKET_DIR?.trim() || env.OPENSCOUT_ZELLIJ_SOCKET_DIR?.trim() || join3(env.HOME?.trim() || homedir2(), ".openscout", "zellij-sockets");
+}
+function zellijSocketKey(input) {
+  if (typeof input === "string")
+    return input.trim() || zellijSocketDirFromEnv(process.env);
+  return input?.socketDir?.trim() || zellijSocketDirFromEnv(input?.env ?? process.env);
+}
+function parseTmuxSessionList(output) {
+  return output.split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const [name, windows, attached, createdAt, currentCommand, currentPath] = line.includes("|") ? splitDelimitedLine(line, "|", 6) : splitDelimitedLine(line, "\t", 6);
+    if (!name)
+      return null;
+    return {
+      name,
+      windows: parsePositiveInteger(windows, 1),
+      attached: parsePositiveInteger(attached, 0),
+      createdAt: createdAt ? Number.parseInt(createdAt, 10) || null : null,
+      currentCommand: cleanOptionalString(currentCommand),
+      currentPath: cleanOptionalString(currentPath)
+    };
+  }).filter((session) => Boolean(session));
+}
+function stripAnsi(value) {
+  return value.replace(/\x1B\[[0-?]*[ -/]*[@-~]/gu, "");
+}
+function parseZellijSessionList(output) {
+  return stripAnsi(output).split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const [name] = line.split(/\s+/u);
+    if (!name)
+      return null;
+    return {
+      name,
+      state: /\bEXITED\b/iu.test(line) ? "exited" : "live",
+      raw: line
+    };
+  }).filter((session) => Boolean(session));
+}
+async function readTmuxSessionsLocal(key, ctx) {
+  try {
+    const { stdout } = await execProbeFile(ctx, tmuxBin(), [
+      ...tmuxSocketArgs(key),
+      "list-sessions",
+      "-F",
+      "#{session_name}|#{session_windows}|#{session_attached}|#{session_created}|#{pane_current_command}|#{pane_current_path}"
+    ], {
+      maxStdoutBytes: 512 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    return parseTmuxSessionList(stdout);
+  } catch (error) {
+    if (isUnavailable4(error))
+      return [];
+    throw error;
+  }
+}
+var tmuxSessionsProbe = defineProbeFamily({
+  id: "tmux.sessions",
+  ttlMs: TMUX_TTL_MS,
+  timeoutMs: TMUX_TIMEOUT_MS,
+  maxKeys: 16,
+  idleKeyTtlMs: 5 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: tmuxSocketKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "tmux.sessions",
+    key,
+    ctx,
+    local: () => readTmuxSessionsLocal(key, ctx)
+  })
+});
+async function readZellijSessionsLocal(socketDir, ctx) {
+  try {
+    const { stdout } = await execProbeFile(ctx, zellijBin(), ["list-sessions"], {
+      env: { ...process.env, ZELLIJ_SOCKET_DIR: socketDir },
+      maxStdoutBytes: 512 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    return parseZellijSessionList(stdout);
+  } catch (error) {
+    if (isUnavailable4(error))
+      return [];
+    throw error;
+  }
+}
+var zellijSessionsProbe = defineProbeFamily({
+  id: "zellij.sessions",
+  ttlMs: TMUX_TTL_MS,
+  timeoutMs: ZELLIJ_TIMEOUT_MS,
+  maxKeys: 16,
+  idleKeyTtlMs: 5 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: zellijSocketKey,
+  run: (socketDir, ctx) => runWithScoutdFallback({
+    probeId: "zellij.sessions",
+    key: socketDir,
+    ctx,
+    local: () => readZellijSessionsLocal(socketDir, ctx)
+  })
+});
+function normalizeTmuxPaneKey(input) {
+  const socketPath = tmuxSocketKey(input.socketPath ?? null);
+  if (input.kind === "detail") {
+    return JSON.stringify({ kind: "detail", socketPath, target: input.target.trim() });
+  }
+  return JSON.stringify({
+    kind: "capture",
+    socketPath,
+    target: input.target.trim(),
+    start: input.start,
+    end: input.end,
+    joinWrapped: input.joinWrapped !== false,
+    maxBytes: input.maxBytes ?? null
+  });
+}
+function parseTmuxPaneKey(key) {
+  const parsed = JSON.parse(key);
+  return parsed;
+}
+var tmuxPanesProbe = defineProbeFamily({
+  id: "tmux.panes",
+  ttlMs: TMUX_TTL_MS,
+  timeoutMs: 1500,
+  maxKeys: 128,
+  idleKeyTtlMs: 2 * 60000,
+  maxConcurrentKeys: 4,
+  normalizeKey: normalizeTmuxPaneKey,
+  run: (key, ctx) => runWithScoutdFallback({
+    probeId: "tmux.panes",
+    key,
+    ctx,
+    local: () => readTmuxPaneLocal(key, ctx)
+  })
+});
+async function readTmuxPaneLocal(key, ctx) {
+  const parsed = parseTmuxPaneKey(key);
+  try {
+    if (parsed.kind === "detail") {
+      const { stdout: stdout2 } = await execProbeFile(ctx, tmuxBin(), [
+        ...tmuxSocketArgs(parsed.socketPath),
+        "display-message",
+        "-p",
+        "-t",
+        parsed.target,
+        "#{pane_pid}\t#{pane_tty}\t#{pane_current_path}"
+      ], {
+        maxStdoutBytes: 64 * 1024,
+        maxStderrBytes: 64 * 1024
+      });
+      const [pidRaw, ttyRaw, pathRaw] = stdout2.trim().split("\t");
+      const panePid = parseProcessNumber2(pidRaw);
+      const paneTty = ttyRaw?.replace(/^\/dev\//u, "").trim();
+      const paneCurrentPath = pathRaw?.trim() || null;
+      return panePid && paneTty ? { panePid, paneTty, paneCurrentPath } : null;
+    }
+    const { stdout } = await execProbeFile(ctx, tmuxBin(), [
+      ...tmuxSocketArgs(parsed.socketPath),
+      "capture-pane",
+      "-p",
+      ...parsed.joinWrapped === false ? [] : ["-J"],
+      "-t",
+      parsed.target,
+      "-S",
+      parsed.start,
+      "-E",
+      parsed.end
+    ], {
+      maxStdoutBytes: parsed.maxBytes ?? 1024 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    return { body: stdout };
+  } catch (error) {
+    if (isUnavailable4(error))
+      return null;
+    throw error;
+  }
+}
+async function readTmuxSessionExists(sessionName, options = {}) {
+  const name = sessionName.trim();
+  if (!name)
+    return false;
+  const snapshot = await tmuxSessionsProbe.for({ env: options.env, socketPath: options.socketPath }).fresh({ maxAgeMs: options.maxAgeMs ?? TMUX_TTL_MS });
+  return Boolean(snapshot.value?.some((session) => session.name === name));
+}
+function invalidateTmuxSessions(options = {}) {
+  tmuxSessionsProbe.invalidate({ env: options.env, socketPath: options.socketPath }, options.reason);
+}
+async function readZellijSessionExists(sessionName, options = {}) {
+  const name = sessionName.trim();
+  if (!name)
+    return false;
+  const snapshot = await zellijSessionsProbe.for({ env: options.env, socketDir: options.socketDir }).fresh({ maxAgeMs: options.maxAgeMs ?? TMUX_TTL_MS });
+  return Boolean(snapshot.value?.some((session) => session.name === name));
+}
+// packages/runtime/dist/system-probes/sessions.js
+import { createReadStream } from "node:fs";
+import { readdir, stat } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
+import { createInterface } from "node:readline";
+function positiveInteger2(value, fallback, max) {
+  return Number.isFinite(value) && value > 0 ? Math.min(max, Math.floor(value)) : fallback;
+}
+function normalizeScanKey(input) {
+  return {
+    home: resolve2(input.home?.trim() || homedir3()),
+    workspaceRoot: input.workspaceRoot?.trim() ? resolve2(input.workspaceRoot) : null,
+    maxAgeDays: positiveInteger2(input.maxAgeDays, 14, 3650),
+    limit: positiveInteger2(input.limit, 250, 1e4)
+  };
+}
+function normalizeSessionFileScanKey(input) {
+  return JSON.stringify(normalizeScanKey(input));
+}
+function normalizeSessionSearchKey(input) {
+  const scan = normalizeScanKey(input);
+  return JSON.stringify({
+    ...scan,
+    query: input.query,
+    candidateLimit: positiveInteger2(input.candidateLimit, Math.max(scan.limit * 10, 1000), 20000)
+  });
+}
+function parseKey(key) {
+  return JSON.parse(key);
+}
+function extractProjectName(filePath) {
+  const claudeMatch = filePath.match(/\.claude\/projects\/[^/]*-dev-([^/]+)/);
+  if (claudeMatch?.[1])
+    return claudeMatch[1];
+  return basename2(dirname2(filePath)) || "unknown";
+}
+function detectAgent(filePath, fallback = "unknown") {
+  if (filePath.includes(".claude"))
+    return "claude-code";
+  if (filePath.includes(".codex") || filePath.includes("codex"))
+    return "codex";
+  if (filePath.includes(".aider") || filePath.includes("aider"))
+    return "aider";
+  return fallback;
+}
+async function directoryExists(path) {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function scanJsonlFiles(input) {
+  const out = [];
+  async function visit(directory, depth) {
+    if (input.signal.aborted || out.length >= input.cap || depth < 0)
+      return;
+    let entries;
+    try {
+      entries = await readdir(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (input.signal.aborted || out.length >= input.cap)
+        return;
+      const filePath = join4(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (input.skipSubagents && entry.name === "subagents")
+          continue;
+        await visit(filePath, depth - 1);
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
+        continue;
+      try {
+        const info = await stat(filePath);
+        if (!info.isFile() || info.mtimeMs < input.cutoffMs)
+          continue;
+        out.push({
+          path: filePath,
+          project: extractProjectName(filePath),
+          agent: detectAgent(filePath, input.agent),
+          modifiedAt: info.mtimeMs,
+          sizeBytes: info.size,
+          lineCount: 0
+        });
+      } catch {}
+    }
+  }
+  await visit(input.root, input.maxDepth);
+  return out;
+}
+async function scanSessionFilesLocal(input, ctx) {
+  const normalized = normalizeScanKey(input);
+  const cutoffMs = Date.now() - normalized.maxAgeDays * 24 * 60 * 60000;
+  const roots = [
+    { root: join4(normalized.home, ".claude", "projects"), agent: "claude-code", maxDepth: 8, skipSubagents: true },
+    { root: join4(normalized.home, ".codex"), agent: "codex", maxDepth: 8, skipSubagents: true },
+    { root: join4(normalized.home, ".openai-codex"), agent: "codex", maxDepth: 8, skipSubagents: true }
+  ];
+  const results = [];
+  const cap = Math.max(normalized.limit * 4, normalized.limit + 100);
+  for (const root of roots) {
+    if (!await directoryExists(root.root))
+      continue;
+    results.push(...await scanJsonlFiles({
+      ...root,
+      cutoffMs,
+      signal: ctx.signal,
+      cap
+    }));
+  }
+  if (normalized.workspaceRoot && await directoryExists(normalized.workspaceRoot)) {
+    const existing = new Set(results.map((result) => result.path));
+    const workspaceResults = await scanJsonlFiles({
+      root: normalized.workspaceRoot,
+      agent: "unknown",
+      cutoffMs,
+      maxDepth: 4,
+      skipSubagents: false,
+      signal: ctx.signal,
+      cap
+    });
+    for (const result of workspaceResults) {
+      if (existing.has(result.path))
+        continue;
+      existing.add(result.path);
+      results.push(result);
+    }
+  }
+  results.sort((a, b) => b.modifiedAt - a.modifiedAt);
+  return results.slice(0, normalized.limit);
+}
+async function searchFile(path, query, signal) {
+  const needle = query.toLowerCase();
+  let count = 0;
+  const preview = [];
+  const stream = createReadStream(path, { encoding: "utf8" });
+  signal.addEventListener("abort", () => stream.destroy(signal.reason), { once: true });
+  const reader = createInterface({ input: stream, crlfDelay: Number.POSITIVE_INFINITY });
+  try {
+    for await (const line of reader) {
+      if (signal.aborted)
+        break;
+      if (!String(line).toLowerCase().includes(needle))
+        continue;
+      count += 1;
+      if (preview.length < 3) {
+        preview.push(String(line));
+      }
+    }
+  } catch {
+    return { count: 0, preview: [] };
+  }
+  return { count, preview };
+}
+async function searchSessionFilesLocal(input, ctx) {
+  const query = input.query.trim();
+  if (!query)
+    return [];
+  const candidateLimit = positiveInteger2(input.candidateLimit, Math.max(input.limit * 10, 1000), 20000);
+  const sessions = await scanSessionFilesLocal({ ...input, limit: candidateLimit }, ctx);
+  const matches = [];
+  for (const session of sessions) {
+    if (ctx.signal.aborted)
+      break;
+    const result = await searchFile(session.path, query, ctx.signal);
+    if (result.count <= 0)
+      continue;
+    matches.push({
+      path: session.path,
+      project: session.project,
+      agent: session.agent,
+      matchCount: result.count,
+      preview: result.preview
+    });
+  }
+  matches.sort((a, b) => b.matchCount - a.matchCount);
+  return matches.slice(0, positiveInteger2(input.limit, 50, 1e4));
+}
+var sessionsScanProbe = defineProbeFamily({
+  id: "sessions.scan",
+  ttlMs: 1e4,
+  timeoutMs: 1e4,
+  maxKeys: 64,
+  idleKeyTtlMs: 5 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: normalizeSessionFileScanKey,
+  run: (key, ctx) => scanSessionFilesLocal(parseKey(key), ctx)
+});
+var sessionsSearchProbe = defineProbeFamily({
+  id: "sessions.search",
+  ttlMs: 1e4,
+  timeoutMs: 1e4,
+  maxKeys: 128,
+  idleKeyTtlMs: 5 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: normalizeSessionSearchKey,
+  run: (key, ctx) => searchSessionFilesLocal(parseKey(key), ctx)
+});
+// packages/runtime/dist/system-probes/cert-status.js
+import { existsSync as existsSync4, realpathSync as realpathSync2 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+function canonicalCertPath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return resolve3(path);
+  }
+}
+function isUnavailable5(error) {
+  return error instanceof ProbeCommandError && (error.code === "ENOENT" || error.code === "spawn" || error.code === "exit");
+}
+var certStatusProbe = defineProbeFamily({
+  id: "cert.status",
+  ttlMs: 5 * 60000,
+  timeoutMs: 5000,
+  maxKeys: 64,
+  idleKeyTtlMs: 30 * 60000,
+  maxConcurrentKeys: 2,
+  normalizeKey: canonicalCertPath,
+  run: async (certPath, ctx) => {
+    if (!existsSync4(certPath)) {
+      return {
+        certPath,
+        exists: false,
+        validAtLeast24h: false,
+        issuer: null,
+        subject: null,
+        publiclyTrusted: false
+      };
+    }
+    let validAtLeast24h = false;
+    try {
+      await execProbeFile(ctx, "openssl", ["x509", "-in", certPath, "-noout", "-checkend", "86400"], {
+        maxStdoutBytes: 64 * 1024,
+        maxStderrBytes: 64 * 1024
+      });
+      validAtLeast24h = true;
+    } catch (error) {
+      if (!isUnavailable5(error)) {
+        throw error;
+      }
+    }
+    let issuer = null;
+    let subject = null;
+    try {
+      const { stdout } = await execProbeFile(ctx, "openssl", ["x509", "-in", certPath, "-noout", "-issuer", "-subject"], {
+        maxStdoutBytes: 128 * 1024,
+        maxStderrBytes: 64 * 1024
+      });
+      issuer = stdout.match(/^issuer=(.*)$/m)?.[1]?.trim() || null;
+      subject = stdout.match(/^subject=(.*)$/m)?.[1]?.trim() || null;
+    } catch (error) {
+      if (!isUnavailable5(error)) {
+        throw error;
+      }
+    }
+    return {
+      certPath,
+      exists: true,
+      validAtLeast24h,
+      issuer,
+      subject,
+      publiclyTrusted: Boolean(validAtLeast24h && issuer && subject && issuer !== subject)
+    };
+  }
+});
+// packages/web/server/terminal-relay-session.ts
+import { randomBytes, timingSafeEqual } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, rmSync } from "fs";
+import { dirname as pathDirname, resolve as pathResolve, sep as pathSep } from "path";
+
+// packages/web/server/terminal-relay-flow.ts
+var TERMINAL_ACK_CAPABILITY = "terminal:ack";
+var DEFAULT_HIGH_WATER_BYTES = 512 * 1024;
+var DEFAULT_LOW_WATER_BYTES = 256 * 1024;
+var DEFAULT_MAX_QUEUED_BYTES = 2 * 1024 * 1024;
+function byteLength(data) {
+  return Buffer.byteLength(data, "utf8");
+}
+function socketOpen(ws) {
+  return Boolean(ws && ws.readyState === 1);
+}
+function createTerminalFlowControlState(options = {}) {
+  const highWaterBytes = Math.max(1, options.highWaterBytes ?? DEFAULT_HIGH_WATER_BYTES);
+  const lowWaterBytes = Math.max(0, Math.min(options.lowWaterBytes ?? DEFAULT_LOW_WATER_BYTES, highWaterBytes));
+  const maxQueuedBytes = Math.max(0, options.maxQueuedBytes ?? DEFAULT_MAX_QUEUED_BYTES);
+  return {
+    nextSeq: 1,
+    inFlightBytes: 0,
+    queuedBytes: 0,
+    droppedBytes: 0,
+    paused: false,
+    highWaterBytes,
+    lowWaterBytes,
+    maxQueuedBytes,
+    pendingAcks: new Map,
+    queue: []
+  };
+}
+function resetTerminalFlowControl(state, hooks = {}) {
+  state.inFlightBytes = 0;
+  state.queuedBytes = 0;
+  state.pendingAcks.clear();
+  state.queue = [];
+  resumeFlow(state, hooks, true);
+}
+function pauseFlow(state, hooks) {
+  if (state.paused)
+    return;
+  state.paused = true;
+  hooks.pause?.();
+}
+function resumeFlow(state, hooks, force = false) {
+  if (!state.paused)
+    return;
+  if (!force && state.inFlightBytes + state.queuedBytes > state.lowWaterBytes)
+    return;
+  state.paused = false;
+  hooks.resume?.();
+}
+function sendChunk(state, ws, chunk, hooks) {
+  if (!socketOpen(ws))
+    return false;
+  ws.send(JSON.stringify({ type: "terminal:data", data: chunk.data, seq: chunk.seq }));
+  state.pendingAcks.set(chunk.seq, chunk);
+  state.inFlightBytes += chunk.bytes;
+  if (state.inFlightBytes >= state.highWaterBytes) {
+    pauseFlow(state, hooks);
+  }
+  return true;
+}
+function dropOverflow(state, hooks) {
+  if (state.maxQueuedBytes <= 0)
+    return;
+  let droppedBytes = 0;
+  let droppedChunks = 0;
+  while (state.queuedBytes > state.maxQueuedBytes && state.queue.length > 0) {
+    const dropped = state.queue.shift();
+    if (!dropped)
+      break;
+    state.queuedBytes -= dropped.bytes;
+    state.droppedBytes += dropped.bytes;
+    droppedBytes += dropped.bytes;
+    droppedChunks += 1;
+  }
+  if (droppedChunks > 0) {
+    hooks.onDrop?.({ bytes: droppedBytes, chunks: droppedChunks });
+  }
+}
+function queueChunk(state, chunk, hooks) {
+  state.queue.push(chunk);
+  state.queuedBytes += chunk.bytes;
+  pauseFlow(state, hooks);
+  dropOverflow(state, hooks);
+}
+function enqueueTerminalData(state, ws, data, hooks = {}) {
+  if (!data || !socketOpen(ws))
+    return null;
+  const chunk = {
+    seq: state.nextSeq++,
+    data,
+    bytes: byteLength(data)
+  };
+  if (state.inFlightBytes >= state.highWaterBytes || state.queue.length > 0) {
+    queueChunk(state, chunk, hooks);
+    return chunk.seq;
+  }
+  sendChunk(state, ws, chunk, hooks);
+  return chunk.seq;
+}
+
+// packages/web/server/terminal-relay-zellij.ts
+import { mkdtempSync, writeFileSync, mkdirSync } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+function kdlString(value) {
+  return JSON.stringify(value);
+}
+function createZellijLayoutFile({ cwd, commandBin, commandArgs }) {
+  const dir = mkdtempSync(join5(tmpdir(), "hudson-zellij-"));
+  const layoutPath = join5(dir, "layout.kdl");
+  const argsBlock = commandArgs.length > 0 ? `
+            args ${commandArgs.map(kdlString).join(" ")}` : "";
+  const layout = `layout {
+    pane command=${kdlString(commandBin)} {
+        cwd ${kdlString(cwd)}${argsBlock}
+    }
+}
+`;
+  writeFileSync(layoutPath, layout, "utf8");
+  return layoutPath;
+}
+function prepareZellijSocketDir(socketDir) {
+  if (!socketDir)
+    return {};
+  mkdirSync(socketDir, { recursive: true });
+  return { ZELLIJ_SOCKET_DIR: socketDir };
+}
+function buildZellijAttachArgs({
+  sessionName,
+  controlMode = "owner",
+  layoutPath,
+  cwd
+}) {
+  if (controlMode === "observe") {
+    return ["watch", sessionName];
+  }
+  const args = ["attach", "--create", sessionName];
+  const optionArgs = [];
+  if (layoutPath)
+    optionArgs.push("--default-layout", layoutPath);
+  if (cwd)
+    optionArgs.push("--default-cwd", cwd);
+  if (optionArgs.length > 0)
+    args.push("options", ...optionArgs);
+  return args;
+}
+
 // packages/web/server/terminal-relay-session.ts
-import { createRequire } from "module";
-import { execFileSync, execSync } from "child_process";
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { join, dirname as pathDirname } from "path";
 var require2 = createRequire(import.meta.url);
-var pty = require2("@lydell/node-pty");
+var pty = (() => {
+  try {
+    return require2("@lydell/node-pty");
+  } catch {
+    return require2("node-pty");
+  }
+})();
 var DEFAULT_ORPHAN_TTL_MS = 30 * 60 * 1000;
 var MAX_BUFFER_SIZE = 512 * 1024;
-var sessions = new Map;
+var SAFE_TRUNCATION_WINDOW = 4096;
+var sessions2 = new Map;
 function generateId() {
-  return Math.random().toString(36).slice(2, 10);
+  return randomBytes(8).toString("hex");
+}
+function generateReconnectToken() {
+  return randomBytes(16).toString("hex");
+}
+function verifyReconnectToken(session, token) {
+  if (typeof token !== "string" || token.length === 0)
+    return false;
+  const expected = Buffer.from(session.reconnectToken, "utf8");
+  const supplied = Buffer.from(token, "utf8");
+  if (expected.length !== supplied.length)
+    return false;
+  return timingSafeEqual(expected, supplied);
+}
+var MULTIPLEXER_NAME_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$/;
+function isValidMultiplexerName(name) {
+  return MULTIPLEXER_NAME_RE.test(name);
 }
 function send(ws, data) {
   if (ws.readyState === 1) {
@@ -34,12 +3259,47 @@ function markSessionPtyClosed(session, err, op) {
   console.warn(`[relay] Session ${session.id}: PTY ${op} failed after fd closed (${err instanceof Error ? err.message : String(err)})`);
   scheduleReap(session, 1e4);
 }
+function pauseSessionOutput(session) {
+  try {
+    session.pty.pause?.();
+  } catch {}
+}
+function resumeSessionOutput(session) {
+  try {
+    session.pty.resume?.();
+  } catch {}
+}
+function resetSessionFlowControl(session) {
+  resetTerminalFlowControl(session.flowControl, {
+    resume: () => resumeSessionOutput(session)
+  });
+}
+function sendTerminalOutput(session, data) {
+  if (!session.flowControlEnabled) {
+    if (session.ws && session.ws.readyState === 1) {
+      send(session.ws, { type: "terminal:data", data });
+    }
+    return;
+  }
+  enqueueTerminalData(session.flowControl, session.ws, data, {
+    pause: () => pauseSessionOutput(session),
+    resume: () => resumeSessionOutput(session),
+    onDrop: ({ bytes, chunks }) => {
+      console.warn(`[relay] Session ${session.id}: dropped ${bytes} bytes across ${chunks} queued output chunks after flow-control overflow`);
+    }
+  });
+}
+function clientSupportsAck(capabilities) {
+  return Array.isArray(capabilities) && capabilities.includes(TERMINAL_ACK_CAPABILITY);
+}
 function sessionOwnsSocket(session, ws) {
   return session.ws === ws;
 }
 function writeSession(session, data) {
   if (session.exited)
     return false;
+  if (session.controlMode === "observe")
+    return false;
   try {
     session.pty.write(data);
     return true;
@@ -54,6 +3314,8 @@ function writeSession(session, data) {
 function resizeSession(session, cols, rows) {
   if (session.exited)
     return false;
+  if (session.controlMode === "observe" && session.backend !== "zellij")
+    return false;
   try {
     session.pty.resize(cols, rows);
     if (session.backend === "tmux" && session.tmuxSession) {
@@ -70,13 +3332,57 @@ function resizeSession(session, cols, rows) {
     throw err;
   }
 }
+function isLowSurrogate(code) {
+  return code >= 56320 && code <= 57343;
+}
+function truncateOutputBuffer(buffer, maxSize = MAX_BUFFER_SIZE) {
+  if (buffer.length <= maxSize)
+    return buffer;
+  let start = buffer.length - maxSize;
+  if (isLowSurrogate(buffer.charCodeAt(start)))
+    start += 1;
+  const scanEnd = Math.min(buffer.length, start + SAFE_TRUNCATION_WINDOW);
+  for (let i = start;i < scanEnd; i++) {
+    const code = buffer.charCodeAt(i);
+    if (code === 10)
+      return buffer.slice(i + 1);
+    if (code === 27)
+      return buffer.slice(i);
+  }
+  return buffer.slice(start);
+}
+function chunkReplayData(data, maxBytes) {
+  if (!data)
+    return [];
+  const limit = Math.max(1, maxBytes);
+  if (Buffer.byteLength(data, "utf8") <= limit)
+    return [data];
+  const chunks = [];
+  let start = 0;
+  while (start < data.length) {
+    let end = Math.min(start + limit, data.length);
+    for (;; ) {
+      if (end > start + 1 && isLowSurrogate(data.charCodeAt(end))) {
+        end -= 1;
+        continue;
+      }
+      const bytes = Buffer.byteLength(data.slice(start, end), "utf8");
+      if (bytes <= limit || end <= start + 1)
+        break;
+      end = start + Math.max(1, Math.floor((end - start) * limit / bytes));
+    }
+    chunks.push(data.slice(start, end));
+    start = end;
+  }
+  return chunks;
+}
 function resolveCwd(raw) {
   const home = process.env.HOME || "/tmp";
   const expanded = (raw || home).replace(/^~/, home);
-  if (existsSync(expanded))
+  if (existsSync5(expanded))
     return expanded;
   try {
-    mkdirSync(expanded, { recursive: true });
+    mkdirSync2(expanded, { recursive: true });
     console.log(`[relay] Created missing cwd: ${expanded}`);
     return expanded;
   } catch {
@@ -84,26 +3390,40 @@ function resolveCwd(raw) {
     return home;
   }
 }
-function findBin(name, envOverride) {
+async function findBin(name, envOverride) {
   if (envOverride && process.env[envOverride])
-    return process.env[envOverride];
+    return process.env[envOverride] ?? null;
   try {
-    return execSync(`which ${name}`, { encoding: "utf8" }).trim() || null;
+    const result = await execSystemFile("which", [name], {
+      timeoutMs: 1500,
+      maxStdoutBytes: 64 * 1024,
+      maxStderrBytes: 64 * 1024
+    });
+    return result.stdout.trim() || null;
   } catch {
     return null;
   }
 }
-function findClaudeBin() {
+async function findClaudeBin() {
   return findBin("claude", "CLAUDE_BIN");
 }
-function findPiBin() {
+async function findPiBin() {
   return findBin("pi", "PI_BIN");
 }
-function findShellBin() {
+async function findShellBin() {
   const configured = process.env.SHELL;
-  if (configured && existsSync(configured))
+  if (configured && existsSync5(configured))
     return configured;
-  return findBin("zsh") ?? findBin("bash") ?? findBin("sh") ?? (existsSync("/bin/sh") ? "/bin/sh" : null);
+  return await findBin("zsh") ?? await findBin("bash") ?? await findBin("sh") ?? (existsSync5("/bin/sh") ? "/bin/sh" : null);
+}
+async function findZellijBin() {
+  return findBin("zellij", "ZELLIJ_BIN");
+}
+async function zellijSessionExists(_zellijBin, name, env) {
+  return await readZellijSessionExists(name, { env, maxAgeMs: 5000 });
+}
+async function tmuxSessionExists(name) {
+  return await readTmuxSessionExists(name, { maxAgeMs: 5000 });
 }
 function normalizePiProviderForCli(provider) {
   if (!provider)
@@ -112,17 +3432,12 @@ function normalizePiProviderForCli(provider) {
     return "github-copilot";
   return provider;
 }
-function tmuxSessionExists(name) {
-  try {
-    execSync(`tmux has-session -t ${name} 2>/dev/null`, { encoding: "utf8" });
-    return true;
-  } catch {
-    return false;
-  }
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-function resizeTmuxWindow(name, cols, rows) {
+async function resizeTmuxWindow(name, cols, rows) {
   try {
-    execFileSync("tmux", [
+    await execSystemFile("tmux", [
       "resize-window",
       "-t",
       name,
@@ -130,21 +3445,32 @@ function resizeTmuxWindow(name, cols, rows) {
       String(cols),
       "-y",
       String(rows)
-    ], { stdio: "ignore" });
+    ], { timeoutMs: 2000 });
     return true;
   } catch {
     return false;
   }
 }
+function resolveBootstrapPath(cwd, relPath) {
+  const base = pathResolve(cwd);
+  const absPath = pathResolve(base, relPath);
+  if (absPath === base || !absPath.startsWith(base + pathSep))
+    return null;
+  return absPath;
+}
 function bootstrapFiles(cwd, files, sessionId) {
   for (const [relPath, content] of Object.entries(files)) {
-    const absPath = join(cwd, relPath);
-    if (!existsSync(absPath)) {
+    const absPath = resolveBootstrapPath(cwd, relPath);
+    if (!absPath) {
+      console.warn(`[relay] Session ${sessionId}: refused to bootstrap ${relPath} — path escapes the session cwd`);
+      continue;
+    }
+    if (!existsSync5(absPath)) {
       try {
         const dir = pathDirname(absPath);
-        if (!existsSync(dir))
-          mkdirSync(dir, { recursive: true });
-        writeFileSync(absPath, content, "utf-8");
+        if (!existsSync5(dir))
+          mkdirSync2(dir, { recursive: true });
+        writeFileSync2(absPath, content, "utf-8");
         console.log(`[relay] Session ${sessionId}: bootstrapped ${relPath}`);
       } catch (err) {
         console.warn(`[relay] Session ${sessionId}: failed to bootstrap ${relPath}:`, err);
@@ -152,15 +3478,36 @@ function bootstrapFiles(cwd, files, sessionId) {
     }
   }
 }
-function spawnTmuxSession(tmuxName, cols, rows, cwd, commandBin, commandArgs, env) {
-  const exists = tmuxSessionExists(tmuxName);
+async function spawnTmuxSession(tmuxName, cols, rows, cwd, commandBin, commandArgs, env, controlMode) {
+  const exists = await tmuxSessionExists(tmuxName);
   if (!exists) {
-    const shellCmd = [commandBin, ...commandArgs].map((a) => a.includes(" ") ? `'${a}'` : a).join(" ");
-    execSync(`tmux new-session -d -s ${tmuxName} -x ${cols} -y ${rows} -c '${cwd}' '${shellCmd}'`, { env });
+    if (controlMode === "observe") {
+      throw new Error(`tmux session '${tmuxName}' does not exist`);
+    }
+    const shellCmd = [commandBin, ...commandArgs].map(shellQuote).join(" ");
+    await execSystemFile("tmux", [
+      "new-session",
+      "-d",
+      "-s",
+      tmuxName,
+      "-x",
+      String(cols),
+      "-y",
+      String(rows),
+      "-c",
+      cwd,
+      shellCmd
+    ], { env, timeoutMs: 5000 });
+    invalidateTmuxSessions({ env, reason: "terminal-relay.new-session" });
     console.log(`[relay] Created tmux session: ${tmuxName}`);
+    if (muxTtlMs() > 0)
+      trackCreatedMuxSession("tmux", tmuxName);
   } else {
-    resizeTmuxWindow(tmuxName, cols, rows);
-    console.log(`[relay] Attaching to existing tmux session: ${tmuxName}`);
+    if (controlMode !== "observe") {
+      await resizeTmuxWindow(tmuxName, cols, rows);
+    }
+    console.log(`[relay] Attaching to existing tmux session: ${tmuxName}${controlMode === "observe" ? " (observe)" : ""}`);
+    markMuxSessionInUse("tmux", tmuxName);
   }
   return pty.spawn("tmux", ["attach", "-t", tmuxName], {
     name: "xterm-256color",
@@ -170,16 +3517,44 @@ function spawnTmuxSession(tmuxName, cols, rows, cwd, commandBin, commandArgs, en
     env
   });
 }
-function createSession(ws, msg) {
+function spawnZellijSession(zellijBin2, zellijName, cols, rows, cwd, commandBin, commandArgs, env, controlMode) {
+  const layoutPath = controlMode === "observe" ? undefined : createZellijLayoutFile({ cwd, commandBin, commandArgs });
+  const args = buildZellijAttachArgs({
+    sessionName: zellijName,
+    controlMode,
+    layoutPath,
+    cwd
+  });
+  return {
+    ptyProcess: pty.spawn(zellijBin2, args, {
+      name: "xterm-256color",
+      cols,
+      rows,
+      cwd,
+      env
+    }),
+    layoutPath
+  };
+}
+async function createSession(ws, msg) {
   const id = generateId();
   const cols = Math.max(msg.cols || 80, 20);
   const rows = Math.max(msg.rows || 24, 4);
   const backend = msg.backend || "pty";
+  const controlMode = msg.controlMode || "owner";
   const tmuxName = msg.tmuxSession || `hudson-${id}`;
+  const zellijName = msg.zellijSession || `hudson-${id}`;
   const agent = msg.agent || "claude";
+  const multiplexerName = backend === "tmux" ? tmuxName : backend === "zellij" ? zellijName : null;
+  if (multiplexerName && !isValidMultiplexerName(multiplexerName)) {
+    const reason = `Invalid ${backend} session name. Use letters, digits, dashes, and underscores (max 64 chars).`;
+    console.error(`[relay] Session ${id} failed: ${reason}`);
+    send(ws, { type: "session:error", error: reason });
+    return null;
+  }
   let agentBin;
   if (agent === "shell") {
-    agentBin = findShellBin();
+    agentBin = await findShellBin();
     if (!agentBin) {
       const reason = "No login shell found. Set SHELL or install zsh, bash, or sh.";
       console.error(`[relay] Session ${id} failed: ${reason}`);
@@ -187,7 +3562,7 @@ function createSession(ws, msg) {
       return null;
     }
   } else if (agent === "pi") {
-    agentBin = findPiBin();
+    agentBin = await findPiBin();
     if (!agentBin) {
       const reason = "pi CLI not found. Install it with: npm install -g @mariozechner/pi-coding-agent";
       console.error(`[relay] Session ${id} failed: ${reason}`);
@@ -195,7 +3570,7 @@ function createSession(ws, msg) {
       return null;
     }
   } else {
-    agentBin = findClaudeBin();
+    agentBin = await findClaudeBin();
     if (!agentBin) {
       const reason = "Claude CLI not found. Install it with: npm install -g @anthropic-ai/claude-code";
       console.error(`[relay] Session ${id} failed: ${reason}`);
@@ -203,18 +3578,25 @@ function createSession(ws, msg) {
       return null;
     }
   }
-  if (!existsSync(agentBin)) {
+  if (!existsSync5(agentBin)) {
     const reason = `${agent} binary not found at ${agentBin}`;
     console.error(`[relay] Session ${id} failed: ${reason}`);
     send(ws, { type: "session:error", error: reason });
     return null;
   }
-  if (backend === "tmux" && !findBin("tmux")) {
+  if (backend === "tmux" && !await findBin("tmux")) {
     const reason = "tmux not found. Install it with: brew install tmux";
     console.error(`[relay] Session ${id} failed: ${reason}`);
     send(ws, { type: "session:error", error: reason });
     return null;
   }
+  const zellijBin2 = backend === "zellij" ? await findZellijBin() : null;
+  if (backend === "zellij" && !zellijBin2) {
+    const reason = "zellij not found. Install it with: brew install zellij";
+    console.error(`[relay] Session ${id} failed: ${reason}`);
+    send(ws, { type: "session:error", error: reason });
+    return null;
+  }
   const cwd = resolveCwd(msg.cwd);
   if (msg.workspaceFiles) {
     bootstrapFiles(cwd, msg.workspaceFiles, id);
@@ -237,13 +3619,29 @@ function createSession(ws, msg) {
     if (msg.systemPrompt)
       agentArgs.push("--system-prompt", msg.systemPrompt);
   }
-  const env = { ...process.env, TERM: "xterm-256color", FORCE_COLOR: "1" };
+  const env = {
+    ...process.env,
+    ...prepareZellijSocketDir(backend === "zellij" ? msg.zellijSocketDir : undefined),
+    TERM: "xterm-256color",
+    FORCE_COLOR: "1"
+  };
   delete env.CLAUDECODE;
   let ptyProcess;
+  let zellijLayoutPath;
   try {
     if (backend === "tmux") {
       console.log(`[relay] Session ${id}: tmux backend (session: ${tmuxName}) in ${cwd} [agent: ${agent}]`);
-      ptyProcess = spawnTmuxSession(tmuxName, cols, rows, cwd, agentBin, agentArgs, env);
+      ptyProcess = await spawnTmuxSession(tmuxName, cols, rows, cwd, agentBin, agentArgs, env, controlMode);
+    } else if (backend === "zellij") {
+      console.log(`[relay] Session ${id}: zellij backend (session: ${zellijName}, mode: ${controlMode}) in ${cwd} [agent: ${agent}]`);
+      const trackZellij = muxTtlMs() > 0 && controlMode !== "observe" && !await zellijSessionExists(zellijBin2, zellijName, env);
+      const spawned = spawnZellijSession(zellijBin2, zellijName, cols, rows, cwd, agentBin, agentArgs, env, controlMode);
+      ptyProcess = spawned.ptyProcess;
+      zellijLayoutPath = spawned.layoutPath;
+      if (trackZellij)
+        trackCreatedMuxSession("zellij", zellijName);
+      else
+        markMuxSessionInUse("zellij", zellijName);
     } else {
       console.log(`[relay] Session ${id}: pty backend, spawning ${agentBin} in ${cwd} [agent: ${agent}]`);
       ptyProcess = pty.spawn(agentBin, agentArgs, {
@@ -265,25 +3663,29 @@ function createSession(ws, msg) {
     id,
     pty: ptyProcess,
     ws,
+    reconnectToken: generateReconnectToken(),
     outputBuffer: "",
     cols,
     rows,
     reapTimer: null,
     orphanTTL,
     backend,
+    controlMode,
     ...backend === "tmux" ? { tmuxSession: tmuxName } : {},
+    ...backend === "zellij" ? {
+      zellijSession: zellijName,
+      ...msg.zellijSocketDir ? { zellijSocketDir: msg.zellijSocketDir } : {},
+      ...zellijLayoutPath ? { zellijLayoutPath } : {}
+    } : {},
+    flowControl: createTerminalFlowControlState(),
+    flowControlEnabled: clientSupportsAck(msg.clientCapabilities),
     exited: false,
     exitCode: null
   };
   const startTime = Date.now();
   ptyProcess.onData((data) => {
-    session.outputBuffer += data;
-    if (session.outputBuffer.length > MAX_BUFFER_SIZE) {
-      session.outputBuffer = session.outputBuffer.slice(-MAX_BUFFER_SIZE);
-    }
-    if (session.ws && session.ws.readyState === 1) {
-      send(session.ws, { type: "terminal:data", data });
-    }
+    session.outputBuffer = truncateOutputBuffer(session.outputBuffer + data, MAX_BUFFER_SIZE);
+    sendTerminalOutput(session, data);
   });
   ptyProcess.onExit(({ exitCode }) => {
     session.exited = true;
@@ -304,15 +3706,17 @@ function createSession(ws, msg) {
     }
     scheduleReap(session, 1e4);
   });
-  sessions.set(id, session);
+  sessions2.set(id, session);
   console.log(`[relay] Session ${id} created (${cols}x${rows})`);
   return session;
 }
-function attachSession(session, ws, cols, rows) {
+function attachSession(session, ws, cols, rows, clientCapabilities) {
   if (session.reapTimer) {
     clearTimeout(session.reapTimer);
     session.reapTimer = null;
   }
+  resetSessionFlowControl(session);
+  session.flowControlEnabled = clientSupportsAck(clientCapabilities);
   session.ws = ws;
   if (cols && rows) {
     const c = Math.max(cols, 20);
@@ -324,11 +3728,15 @@ function attachSession(session, ws, cols, rows) {
   if (session.exited) {
     send(ws, { type: "session:exit", exitCode: session.exitCode });
   } else if (session.outputBuffer.length > 0) {
-    send(ws, { type: "terminal:data", data: session.outputBuffer });
+    const replayChunks = session.flowControlEnabled ? chunkReplayData(session.outputBuffer, session.flowControl.highWaterBytes) : [session.outputBuffer];
+    for (const chunk of replayChunks) {
+      sendTerminalOutput(session, chunk);
+    }
   }
   console.log(`[relay] Session ${session.id} reconnected`);
 }
 function detachSession(session) {
+  resetSessionFlowControl(session);
   session.ws = null;
   if (session.exited) {
     scheduleReap(session, 5000);
@@ -347,33 +3755,226 @@ function scheduleReap(session, delay) {
   }, delay);
 }
 function destroy(sessionId) {
-  const session = sessions.get(sessionId);
+  const session = sessions2.get(sessionId);
   if (!session)
     return;
   if (session.reapTimer)
     clearTimeout(session.reapTimer);
+  resetSessionFlowControl(session);
   try {
     session.pty.kill();
   } catch {}
-  sessions.delete(sessionId);
+  if (session.zellijLayoutPath) {
+    try {
+      rmSync(pathDirname(session.zellijLayoutPath), { recursive: true, force: true });
+    } catch {}
+  }
+  sessions2.delete(sessionId);
   if (session.backend === "tmux") {
     console.log(`[relay] Session ${sessionId} bridge destroyed (tmux session '${session.tmuxSession}' still alive)`);
+    if (session.tmuxSession)
+      markMuxSessionDetached("tmux", session.tmuxSession);
+  } else if (session.backend === "zellij") {
+    console.log(`[relay] Session ${sessionId} bridge destroyed (zellij session '${session.zellijSession}' still alive)`);
+    if (session.zellijSession)
+      markMuxSessionDetached("zellij", session.zellijSession);
   } else {
     console.log(`[relay] Session ${sessionId} destroyed`);
   }
 }
+var trackedMuxSessions = new Map;
+function muxTtlMs() {
+  const raw = Number(process.env.HUDSON_RELAY_MUX_TTL_MS || 0);
+  return Number.isFinite(raw) && raw > 0 ? raw : 0;
+}
+function muxKey(backend, name) {
+  return `${backend}:${name}`;
+}
+function trackCreatedMuxSession(backend, name) {
+  trackedMuxSessions.set(muxKey(backend, name), { backend, name, detachedAt: null });
+}
+function markMuxSessionInUse(backend, name) {
+  const record = trackedMuxSessions.get(muxKey(backend, name));
+  if (record)
+    record.detachedAt = null;
+}
+function markMuxSessionDetached(backend, name, now = Date.now()) {
+  const record = trackedMuxSessions.get(muxKey(backend, name));
+  if (record)
+    record.detachedAt = now;
+}
 
 // packages/web/server/terminal-relay-node.ts
 process.title = "scout-relay";
 var require3 = createRequire2(import.meta.url);
 var { WebSocketServer } = require3("ws");
-var hostname = process.env.OPENSCOUT_WEB_TERMINAL_RELAY_HOST?.trim() || process.env.OPENSCOUT_WEB_HOST?.trim() || process.env.SCOUT_WEB_HOST?.trim() || "127.0.0.1";
+var hostname = process.env.OPENSCOUT_WEB_TERMINAL_RELAY_HOST?.trim() || "127.0.0.1";
 var port = Number.parseInt(process.env.OPENSCOUT_WEB_TERMINAL_RELAY_PORT?.trim() || "3201", 10);
 var UPLOAD_DIR = "/tmp/scout-uploads";
+var OUTPUT_BATCH_INTERVAL_MS = 8;
+var OUTPUT_BATCH_DRAIN_CONTINUE_MS = 1;
+var OUTPUT_BATCH_CHUNK_CHARS = 16 * 1024;
+var OUTPUT_BATCH_MAX_WRITES = 2;
+var OUTPUT_IN_FLIGHT_HIGH_WATER_CHARS = 512 * 1024;
+var OUTPUT_IN_FLIGHT_LOW_WATER_CHARS = 256 * 1024;
+var OUTPUT_PENDING_MAX_CHARS = 2 * 1024 * 1024;
+var OUTPUT_BACKLOG_WARNING = `\x18\x1B[0m\r
+[OpenScout skipped terminal output because the relay backlog exceeded 2 MB.]\r
+`;
+function disableGeneratedSessionFlowControl(msg) {
+  return { ...msg, clientCapabilities: [] };
+}
+
+class FlowControlledRelaySocket {
+  ws;
+  session = null;
+  pendingOutput = "";
+  pendingFlush = null;
+  nextSeq = 1;
+  unacked = [];
+  unackedChars = 0;
+  ptyPaused = false;
+  droppedBacklog = false;
+  constructor(ws) {
+    this.ws = ws;
+  }
+  get readyState() {
+    return this.ws.readyState;
+  }
+  bindSession(session) {
+    this.session = session;
+  }
+  send(data) {
+    if (Buffer.isBuffer(data)) {
+      this.sendRaw(data);
+      return;
+    }
+    const message = parseServerMessage(data);
+    if (message?.type === "terminal:data" && typeof message.data === "string") {
+      this.enqueueOutput(message.data);
+      return;
+    }
+    if (message?.type === "session:exit") {
+      this.flushOutput({ ignoreBackpressure: true });
+    }
+    this.sendRaw(data);
+  }
+  handleAck(seq) {
+    if (typeof seq !== "number" || !Number.isFinite(seq)) {
+      return;
+    }
+    while (this.unacked.length > 0 && this.unacked[0].seq <= seq) {
+      const acked = this.unacked.shift();
+      this.unackedChars = Math.max(0, this.unackedChars - acked.chars);
+    }
+    if (this.ptyPaused && this.unackedChars < OUTPUT_IN_FLIGHT_LOW_WATER_CHARS) {
+      this.resumePty();
+    }
+    if (this.pendingOutput.length > 0) {
+      this.scheduleFlush(OUTPUT_BATCH_DRAIN_CONTINUE_MS);
+    }
+  }
+  dispose() {
+    if (this.pendingFlush) {
+      clearTimeout(this.pendingFlush);
+      this.pendingFlush = null;
+    }
+    this.pendingOutput = "";
+    this.unacked = [];
+    this.unackedChars = 0;
+    this.resumePty();
+    this.session = null;
+  }
+  enqueueOutput(data) {
+    if (!data) {
+      return;
+    }
+    this.pendingOutput += data;
+    if (this.pendingOutput.length > OUTPUT_PENDING_MAX_CHARS) {
+      this.pendingOutput = OUTPUT_BACKLOG_WARNING + this.pendingOutput.slice(-OUTPUT_PENDING_MAX_CHARS);
+      if (!this.droppedBacklog) {
+        console.warn("[relay] terminal output backlog exceeded 2 MB; keeping only the newest output");
+        this.droppedBacklog = true;
+      }
+    }
+    this.scheduleFlush(OUTPUT_BATCH_INTERVAL_MS);
+  }
+  scheduleFlush(delayMs) {
+    if (this.pendingFlush || this.pendingOutput.length === 0) {
+      return;
+    }
+    this.pendingFlush = setTimeout(() => {
+      this.pendingFlush = null;
+      this.flushOutput();
+    }, delayMs);
+  }
+  flushOutput(options = {}) {
+    if (this.pendingOutput.length === 0 || this.readyState !== 1) {
+      return;
+    }
+    let writes = 0;
+    while (this.pendingOutput.length > 0 && writes < OUTPUT_BATCH_MAX_WRITES) {
+      if (!options.ignoreBackpressure && this.unackedChars >= OUTPUT_IN_FLIGHT_HIGH_WATER_CHARS) {
+        this.pausePty();
+        return;
+      }
+      const chunk = this.pendingOutput.slice(0, OUTPUT_BATCH_CHUNK_CHARS);
+      this.pendingOutput = this.pendingOutput.slice(chunk.length);
+      const seq = this.nextSeq++;
+      this.unacked.push({ seq, chars: chunk.length });
+      this.unackedChars += chunk.length;
+      this.sendRaw(JSON.stringify({ type: "terminal:data", data: chunk, seq, chars: chunk.length }));
+      writes++;
+    }
+    if (!options.ignoreBackpressure && this.unackedChars >= OUTPUT_IN_FLIGHT_HIGH_WATER_CHARS) {
+      this.pausePty();
+      return;
+    }
+    if (this.pendingOutput.length > 0) {
+      this.scheduleFlush(OUTPUT_BATCH_DRAIN_CONTINUE_MS);
+    } else {
+      this.droppedBacklog = false;
+    }
+  }
+  pausePty() {
+    if (this.ptyPaused || !this.session || this.session.exited) {
+      return;
+    }
+    try {
+      this.session.pty.pause();
+      this.ptyPaused = true;
+    } catch (error) {
+      console.warn("[relay] Failed to pause PTY for terminal flow control:", error);
+    }
+  }
+  resumePty() {
+    if (!this.ptyPaused || !this.session || this.session.exited) {
+      this.ptyPaused = false;
+      return;
+    }
+    try {
+      this.session.pty.resume();
+    } catch (error) {
+      console.warn("[relay] Failed to resume PTY for terminal flow control:", error);
+    } finally {
+      this.ptyPaused = false;
+    }
+  }
+  sendRaw(data) {
+    if (this.ws.readyState === 1) {
+      this.ws.send(data);
+    }
+  }
+}
+function sessionMatchesSurface(session, backend, sessionName) {
+  if (!backend || !sessionName || session.backend !== backend)
+    return false;
+  return session.terminalSession === sessionName || session.tmuxSession === sessionName || session.zellijSession === sessionName;
+}
 var pendingCommand = null;
 function queueTerminalCommand(input) {
   if (!input.cwd) {
-    for (const [, session] of sessions) {
+    for (const [, session] of sessions2) {
       if (writeSession(session, input.command + `
 `)) {
         return;
@@ -387,15 +3988,17 @@ function drainPendingCommand() {
   pendingCommand = null;
   return command;
 }
-function parseMessage(raw) {
+function parseServerMessage(raw) {
   try {
     const message = JSON.parse(raw);
-    if (typeof message.type === "string") {
-      return message;
-    }
+    return typeof message?.type === "string" ? message : null;
   } catch {}
   return null;
 }
+function parseMessage(raw) {
+  const message = parseServerMessage(raw);
+  return message ? message : null;
+}
 function setCors(res) {
   res.setHeader("Access-Control-Allow-Origin", "*");
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
@@ -419,9 +4022,6 @@ function writeJson(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function relayUploadPath(name) {
-  return join2(UPLOAD_DIR, `${randomUUID()}-${name}`);
-}
 var server = createServer(async (req, res) => {
   setCors(res);
   if (req.method === "OPTIONS") {
@@ -432,7 +4032,7 @@ var server = createServer(async (req, res) => {
   const url = new URL(req.url || "/", `http://${hostname}:${port}`);
   if (req.method === "GET" && url.pathname === "/health") {
     let attachedSessions = 0;
-    for (const session of sessions.values()) {
+    for (const session of sessions2.values()) {
       if (session.ws) {
         attachedSessions += 1;
       }
@@ -441,7 +4041,7 @@ var server = createServer(async (req, res) => {
       ok: true,
       surface: "openscout-terminal-relay",
       pid: process.pid,
-      sessions: sessions.size,
+      sessions: sessions2.size,
       attachedSessions
     });
     return;
@@ -452,9 +4052,14 @@ var server = createServer(async (req, res) => {
       writeJson(res, 400, { error: "Missing name or data" });
       return;
     }
-    await mkdir(UPLOAD_DIR, { recursive: true });
-    const filepath = relayUploadPath(body.name);
-    await writeFile(filepath, Buffer.from(body.data, "base64"));
+    const safeName = sanitizeUploadName(body.name);
+    if (!safeName) {
+      writeJson(res, 400, { error: "Invalid name" });
+      return;
+    }
+    await mkdir(UPLOAD_DIR, { recursive: true, mode: 448 });
+    const filepath = join6(UPLOAD_DIR, `${randomUUID()}-${safeName}`);
+    await writeFile(filepath, Buffer.from(body.data, "base64"), { mode: 384 });
     writeJson(res, 200, { path: filepath });
     return;
   }
@@ -473,121 +4078,176 @@ var server = createServer(async (req, res) => {
     writeJson(res, 200, { ok: true });
     return;
   }
+  if (req.method === "POST" && url.pathname === "/api/terminal/session/destroy") {
+    const body = await readJson(req);
+    const sessionId = body?.sessionId?.trim();
+    if (!sessionId) {
+      writeJson(res, 400, { error: "missing sessionId" });
+      return;
+    }
+    const existed = sessions2.has(sessionId);
+    if (existed) {
+      destroy(sessionId);
+    }
+    writeJson(res, 200, { ok: true, destroyed: existed });
+    return;
+  }
+  if (req.method === "POST" && url.pathname === "/api/terminal/session/destroy-surface") {
+    const body = await readJson(req);
+    const backend = body?.backend?.trim();
+    const sessionName = body?.sessionName?.trim();
+    if (!backend || !sessionName) {
+      writeJson(res, 400, { error: "missing backend or sessionName" });
+      return;
+    }
+    let destroyed = 0;
+    for (const [id, session] of [...sessions2]) {
+      if (!sessionMatchesSurface(session, backend, sessionName))
+        continue;
+      destroy(id);
+      destroyed += 1;
+    }
+    writeJson(res, 200, { ok: true, destroyed });
+    return;
+  }
   writeJson(res, 404, { error: "Not found" });
 });
-var wss = new WebSocketServer({ server });
+var wss = new WebSocketServer({
+  server,
+  verifyClient: (info) => {
+    const origin = info.origin ?? info.req.headers.origin;
+    return !origin;
+  }
+});
 wss.on("connection", (ws) => {
   let sessionId = null;
+  const relaySocket = new FlowControlledRelaySocket(ws);
   ws.on("message", (raw) => {
-    const msg = parseMessage(raw.toString());
-    if (!msg) {
-      return;
-    }
-    switch (msg.type) {
-      case "session:init": {
-        const pending = drainPendingCommand();
-        if (sessionId) {
-          const previous = sessions.get(sessionId);
-          if (previous && sessionOwnsSocket(previous, ws)) {
-            detachSession(previous);
-          }
-        }
-        const session = createSession(ws, pending?.cwd ? { ...msg, cwd: pending.cwd, agent: "shell" } : msg);
-        if (!session) {
-          break;
-        }
-        sessionId = session.id;
-        send(ws, { type: "session:ready", sessionId: session.id });
-        if (pending) {
-          setTimeout(() => writeSession(session, pending.command + `
-`), 400);
-        }
-        break;
+    (async () => {
+      const msg = parseMessage(raw.toString());
+      if (!msg) {
+        return;
       }
-      case "session:reconnect": {
-        const pending = drainPendingCommand();
-        if (pending?.cwd) {
+      switch (msg.type) {
+        case "session:init": {
+          const pending = drainPendingCommand();
           if (sessionId) {
-            const previous = sessions.get(sessionId);
-            if (previous && sessionOwnsSocket(previous, ws)) {
+            const previous = sessions2.get(sessionId);
+            if (previous && sessionOwnsSocket(previous, relaySocket)) {
               detachSession(previous);
             }
           }
-          const session = createSession(ws, {
-            type: "session:init",
-            cols: msg.cols ?? 80,
-            rows: msg.rows ?? 24,
-            cwd: pending.cwd,
-            agent: "shell"
-          });
+          const session = await createSession(relaySocket, disableGeneratedSessionFlowControl(pending?.cwd ? { ...msg, cwd: pending.cwd, agent: "shell" } : msg));
           if (!session) {
             break;
           }
+          relaySocket.bindSession(session);
           sessionId = session.id;
-          send(ws, { type: "session:ready", sessionId: session.id });
-          setTimeout(() => writeSession(session, pending.command + `
+          send(ws, { type: "session:ready", sessionId: session.id, reconnectToken: session.reconnectToken });
+          if (pending) {
+            setTimeout(() => writeSession(session, pending.command + `
 `), 400);
+          }
           break;
         }
-        const existing = sessions.get(msg.sessionId);
-        if (existing && !existing.exited) {
-          if (sessionId && sessionId !== msg.sessionId) {
-            const previous = sessions.get(sessionId);
-            if (previous && sessionOwnsSocket(previous, ws)) {
-              detachSession(previous);
+        case "session:reconnect": {
+          const pending = drainPendingCommand();
+          if (pending?.cwd) {
+            if (sessionId) {
+              const previous = sessions2.get(sessionId);
+              if (previous && sessionOwnsSocket(previous, relaySocket)) {
+                detachSession(previous);
+              }
             }
+            const session = await createSession(relaySocket, {
+              type: "session:init",
+              cols: msg.cols ?? 80,
+              rows: msg.rows ?? 24,
+              cwd: pending.cwd,
+              agent: "shell",
+              clientCapabilities: []
+            });
+            if (!session) {
+              break;
+            }
+            relaySocket.bindSession(session);
+            sessionId = session.id;
+            send(ws, { type: "session:ready", sessionId: session.id, reconnectToken: session.reconnectToken });
+            setTimeout(() => writeSession(session, pending.command + `
+`), 400);
+            break;
           }
-          if (existing.ws && existing.ws !== ws) {
-            send(existing.ws, { type: "session:detached" });
-          }
-          sessionId = existing.id;
-          attachSession(existing, ws, msg.cols, msg.rows);
-          send(ws, {
-            type: "session:ready",
-            sessionId: existing.id,
-            reconnected: true
-          });
-          if (pending) {
-            setTimeout(() => writeSession(existing, pending.command + `
+          const existing = sessions2.get(msg.sessionId);
+          const requestedControlMode = msg.controlMode || "owner";
+          const canReconnect = existing && !existing.exited && existing.controlMode === requestedControlMode && verifyReconnectToken(existing, msg.reconnectToken);
+          if (canReconnect) {
+            if (sessionId && sessionId !== msg.sessionId) {
+              const previous = sessions2.get(sessionId);
+              if (previous && sessionOwnsSocket(previous, relaySocket)) {
+                detachSession(previous);
+              }
+            }
+            if (existing.ws && existing.ws !== relaySocket) {
+              send(existing.ws, { type: "session:detached" });
+            }
+            sessionId = existing.id;
+            relaySocket.bindSession(existing);
+            attachSession(existing, relaySocket, msg.cols, msg.rows, []);
+            send(ws, {
+              type: "session:ready",
+              sessionId: existing.id,
+              reconnectToken: existing.reconnectToken,
+              reconnected: true
+            });
+            if (pending) {
+              setTimeout(() => writeSession(existing, pending.command + `
 `), 400);
+            }
+          } else {
+            send(ws, { type: "session:expired", sessionId: msg.sessionId });
           }
-        } else {
-          send(ws, { type: "session:expired", sessionId: msg.sessionId });
-        }
-        break;
-      }
-      case "terminal:input": {
-        if (!sessionId) {
-          return;
+          break;
         }
-        const session = sessions.get(sessionId);
-        if (session && sessionOwnsSocket(session, ws)) {
-          writeSession(session, msg.data);
+        case "terminal:ack": {
+          relaySocket.handleAck(msg.seq);
+          break;
         }
-        break;
-      }
-      case "terminal:resize": {
-        if (!sessionId) {
-          return;
+        case "terminal:input": {
+          if (!sessionId) {
+            return;
+          }
+          const session = sessions2.get(sessionId);
+          if (session && sessionOwnsSocket(session, relaySocket)) {
+            writeSession(session, msg.data);
+          }
+          break;
         }
-        const session = sessions.get(sessionId);
-        if (session && sessionOwnsSocket(session, ws)) {
-          const cols = Math.max(msg.cols || 80, 20);
-          const rows = Math.max(msg.rows || 24, 4);
-          resizeSession(session, cols, rows);
+        case "terminal:resize": {
+          if (!sessionId) {
+            return;
+          }
+          const session = sessions2.get(sessionId);
+          if (session && sessionOwnsSocket(session, relaySocket)) {
+            const cols = Math.max(msg.cols || 80, 20);
+            const rows = Math.max(msg.rows || 24, 4);
+            resizeSession(session, cols, rows);
+          }
+          break;
         }
-        break;
       }
-    }
+    })().catch((error) => {
+      console.error("[relay] message handler failed:", error);
+    });
   });
   ws.on("close", () => {
     if (!sessionId) {
       return;
     }
-    const session = sessions.get(sessionId);
-    if (session && sessionOwnsSocket(session, ws)) {
+    const session = sessions2.get(sessionId);
+    if (session && sessionOwnsSocket(session, relaySocket)) {
       detachSession(session);
     }
+    relaySocket.dispose();
     sessionId = null;
   });
   ws.on("error", (err) => {
@@ -595,10 +4255,11 @@ wss.on("connection", (ws) => {
     if (!sessionId) {
       return;
     }
-    const session = sessions.get(sessionId);
-    if (session && sessionOwnsSocket(session, ws)) {
+    const session = sessions2.get(sessionId);
+    if (session && sessionOwnsSocket(session, relaySocket)) {
       detachSession(session);
     }
+    relaySocket.dispose();
     sessionId = null;
   });
 });
@@ -608,7 +4269,7 @@ server.listen(port, hostname, () => {
 var shutdown = () => {
   console.log(`
 [relay] Shutting down...`);
-  for (const [id] of sessions) {
+  for (const [id] of sessions2) {
     destroy(id);
   }
   wss.close();