@overdeck/desktop 0.45.12 → 0.45.15

package/server/{beads-query-e6oku4P5.js → beads-query-B1DlJVp9.js}

@@ -1,11 +1,7 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { i as runBdWithRetry, n as init_bd_process_lock, r as readBdProcessLockHolder, t as BdTransientFailure } from "./bd-process-lock-i3CYMS-B.js";
+import { n as init_resolver, t as createBeadsResolver } from "./resolver-dTpSSzaH.js";
 import { Data, Effect } from "effect";
-import { existsSync } from "fs";
-import { basename, dirname, join } from "path";
-import { readFile } from "node:fs/promises";
-import { execFile } from "child_process";
-import { promisify } from "util";
+import { basename, dirname } from "path";
 //#region ../../lib/beads-query.ts
 function normalizeIssueLabel(issueId) {
 	return issueId.toLowerCase();
@@ -51,106 +47,34 @@ function groupReadyBeadsByIssue(beads, issueLabels) {
 	}
 	return result;
 }
-async function readAllBeadsFromJsonl(workspacePath) {
-	try {
-		const jsonlPath = join(workspacePath, ".beads", "issues.jsonl");
-		if (!existsSync(jsonlPath)) return [];
-		const raw = await readFile(jsonlPath, "utf-8");
-		const beads = [];
-		for (const line of raw.split("\n")) {
-			if (!line.trim()) continue;
-			try {
-				const entry = JSON.parse(line);
-				beads.push(toBeadEntry(entry, beadLabels(entry)));
-			} catch {}
-		}
-		return beads;
-	} catch {
-		return [];
-	}
-}
-async function readBeadsFromJsonl(workspacePath, issueId) {
-	const issueLabel = normalizeIssueLabel(issueId);
-	return (await readAllBeadsFromJsonl(workspacePath)).filter((bead) => labelMatchesIssue(bead.labels, issueLabel));
-}
 async function queryBeadsForIssuePromise(workspacePath, issueId, retryOptions = {}) {
-	try {
-		const { stdout } = await runBdWithRetry(`query beads for ${issueId}`, () => execFileAsync("bd", [
-			"list",
-			"--json",
-			"-l",
-			issueId.toLowerCase(),
-			"--status",
-			"all",
-			"--limit",
-			"0"
-		], {
-			encoding: "utf-8",
-			cwd: workspacePath,
-			timeout: 1e4
-		}), {
-			...retryOptions,
-			workspacePath
-		});
-		const parsed = JSON.parse(stdout || "[]");
-		return { beads: Array.isArray(parsed) ? parsed : [] };
-	} catch (error) {
-		return {
-			beads: await readBeadsFromJsonl(workspacePath, issueId),
-			transientFailure: error instanceof BdTransientFailure ? error : void 0
-		};
-	}
+	const result = await createBeadsResolver(workspacePath, { retry: retryOptions }).getBeadsForIssue(issueId);
+	return result.ok ? { beads: result.value.map((entry) => toBeadEntry(entry, beadLabels(entry))) } : {
+		beads: [],
+		stale: true,
+		reason: result.reason,
+		transientFailure: result.transient ? result.error : void 0
+	};
 }
 async function queryReadyBeadsByIssueLabelsPromise(workspacePath, issueIds, retryOptions = {}) {
 	const issueLabels = Array.from(new Set(issueIds.map(normalizeIssueLabel)));
 	if (issueLabels.length === 0) return { byIssue: {} };
-	try {
-		if (await readBdProcessLockHolder({ workspacePath })) return { byIssue: groupReadyBeadsByIssue(await readAllBeadsFromJsonl(workspacePath), issueLabels) };
-		const { stdout } = await runBdWithRetry(`query ready beads for ${issueLabels.join(",")}`, () => execFileAsync("bd", [
-			"list",
-			"--json",
-			"--status",
-			"all",
-			"--limit",
-			"0"
-		], {
-			encoding: "utf-8",
-			cwd: workspacePath,
-			timeout: 1e4
-		}), {
-			...retryOptions,
-			workspacePath
-		});
-		const parsed = JSON.parse(stdout || "[]");
-		return { byIssue: groupReadyBeadsByIssue(Array.isArray(parsed) ? parsed.map((entry) => toBeadEntry(entry, beadLabels(entry))) : [], issueLabels) };
-	} catch (error) {
-		return {
-			byIssue: groupReadyBeadsByIssue(await readAllBeadsFromJsonl(workspacePath), issueLabels),
-			transientFailure: error instanceof BdTransientFailure ? error : void 0
-		};
-	}
+	const result = await createBeadsResolver(workspacePath, { retry: retryOptions }).getAllBeads();
+	if (result.ok) return { byIssue: groupReadyBeadsByIssue(result.value.map((entry) => toBeadEntry(entry, beadLabels(entry))), issueLabels) };
+	return {
+		byIssue: Object.fromEntries(issueLabels.map((label) => [label, []])),
+		stale: true,
+		reason: result.reason,
+		transientFailure: result.transient ? result.error : void 0
+	};
 }
 async function queryBeadByIdPromise(workspacePath, beadId) {
-	try {
-		const { stdout } = await execFileAsync("bd", [
-			"show",
-			beadId,
-			"--json"
-		], {
-			encoding: "utf-8",
-			cwd: workspacePath,
-			timeout: 1e4
-		});
-		const parsed = JSON.parse(stdout || "[]");
-		return (Array.isArray(parsed) ? parsed : [parsed])[0] ?? null;
-	} catch {
-		return null;
-	}
+	const result = await createBeadsResolver(workspacePath).getBeadById(beadId);
+	return result.ok ? result.value : null;
 }
-var execFileAsync, BeadsMissingError, queryBeadsForIssue, queryReadyBeadsByIssueLabels, assertIssueHasBeads, queryBeadById;
+var BeadsMissingError, queryBeadsForIssue, queryReadyBeadsByIssueLabels, assertIssueHasBeads, queryBeadById;
 var init_beads_query = __esmMin((() => {
-	init_bd_process_lock();
-	execFileAsync = promisify(execFile);
+	init_resolver();
 	BeadsMissingError = class extends Data.TaggedError("BeadsMissingError") {};
 	queryBeadsForIssue = (workspacePath, issueId, retryOptions = {}) => Effect.promise(() => queryBeadsForIssuePromise(workspacePath, issueId, retryOptions));
 	queryReadyBeadsByIssueLabels = (workspacePath, issueIds, retryOptions = {}) => Effect.promise(() => queryReadyBeadsByIssueLabelsPromise(workspacePath, issueIds, retryOptions));
@@ -159,7 +83,8 @@ var init_beads_query = __esmMin((() => {
 		if (result.beads.length === 0) return yield* Effect.fail(new BeadsMissingError({
 			issueId,
 			workspacePath,
-			transientFailure: result.transientFailure
+			transientFailure: result.transientFailure,
+			staleReason: result.reason
 		}));
 	});
 	queryBeadById = (workspacePath, beadId) => Effect.promise(() => queryBeadByIdPromise(workspacePath, beadId));
@@ -167,4 +92,4 @@ var init_beads_query = __esmMin((() => {
 //#endregion
 export { queryBeadsForIssue as a, queryBeadById as i, assertIssueHasBeads as n, queryReadyBeadsByIssueLabels as o, init_beads_query as r, resolveBeadsQueryRoot as s, BeadsMissingError as t };
 
-//# sourceMappingURL=beads-query-e6oku4P5.js.map
+//# sourceMappingURL=beads-query-B1DlJVp9.js.map

package/server/beads-restore-CyygSmmn.js

@@ -0,0 +1,23 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { n as init_export, t as exportBeadsJsonl } from "./export-Dx_qJ3h8.js";
+import { Effect } from "effect";
+//#region ../../lib/beads-restore.ts
+/**
+* Repair a missing derived beads export from canonical Dolt state.
+*
+* The old implementation restored a tracked JSONL snapshot from git, which
+* could revive stale rows. Dolt is authoritative; repair is now a validated
+* re-export through the one JSONL writer.
+*/
+var restoreTrackedBeadsExport;
+var init_beads_restore = __esmMin((() => {
+	init_export();
+	restoreTrackedBeadsExport = (workspacePath) => Effect.tryPromise({
+		try: () => exportBeadsJsonl(workspacePath).then(() => void 0),
+		catch: () => void 0
+	}).pipe(Effect.catch(() => Effect.void));
+}));
+//#endregion
+export { restoreTrackedBeadsExport as n, init_beads_restore as t };
+
+//# sourceMappingURL=beads-restore-CyygSmmn.js.map

package/server/{behavior-CPf0pbOt.js → behavior-Cpj03N4v.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { t as init_src } from "./src-fgbU-jJ-.js";
-import { o as getPricingSync, s as init_cost } from "./cost-CCnqa5xK.js";
+import { t as init_src } from "./src-DHn4Rd2F.js";
+import { o as getPricingSync, s as init_cost } from "./cost-DQ2ajr_m.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region ../../lib/cost-parsers/codex-parser.ts
 /**
@@ -250,4 +250,4 @@ var init_behavior = __esmMin((() => {
 //#endregion
 export { parseCodexSessionSync as i, init_codex_parser as n, parseCodexSessionCostEventsSync as r, init_behavior as t };
 
-//# sourceMappingURL=behavior-CPf0pbOt.js.map
+//# sourceMappingURL=behavior-Cpj03N4v.js.map

package/server/{briefing-freshness-B2FdLwIv.js → briefing-freshness-Kh5V8RTh.js}

@@ -1,7 +1,7 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-ClpGgrf6.js";
-import { _ as integer, a as EventBus, b as and, c as Records, d as getOverdeckDatabaseSync, f as init_infra, h as text, l as Tmux, m as sqliteTable, p as init_sqlite_core, r as Db, v as init_drizzle_orm, x as eq } from "./infra-DE3C4PMr.js";
-import { n as init_issues, t as IssueId } from "./issues-D3kt9UWE.js";
+import { Kr as getOverdeckHome, qr as init_paths } from "./config-yaml-Dcz-8uit.js";
+import { _ as integer, a as EventBus, b as and, c as Records, d as getOverdeckDatabaseSync, f as init_infra, h as text, l as Tmux, m as sqliteTable, p as init_sqlite_core, r as Db, v as init_drizzle_orm, x as eq } from "./infra-bpq1MHKU.js";
+import { n as init_issues, t as IssueId } from "./issues-CwQMphDH.js";
 import { join } from "node:path";
 import { Context, Effect, Layer, Schema } from "effect";
 import { dirname as dirname$1, join as join$1 } from "path";
@@ -1098,4 +1098,4 @@ var init_briefing_freshness = __esmMin((() => {
 //#endregion
 export { resolveSessionContextBriefingPath as a, backfillAgentsSync as c, init_agents as d, listAgentIdsByPrefixSync as f, isTerminalIssueStage as g, getIssueStageSync as h, recordBriefingSessionStart as i, countAgentsByStatus as l, removeAgentSync as m, ensureSessionContextBriefingFile as n, AgentsResolver as o, listAllAgentsSync as p, init_briefing_freshness as r, AgentsResolverLive as s, appendFreshBriefingUpdate as t, countAgentsByStatusRole as u };
 
-//# sourceMappingURL=briefing-freshness-B2FdLwIv.js.map
+//# sourceMappingURL=briefing-freshness-Kh5V8RTh.js.map

package/server/{checkpoint-manager-eFgaMMu4.js → checkpoint-manager-CAFos8e1.js}

@@ -1,3 +1,3 @@
-import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-JryW6MpM.js";
+import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-fu9oVsR-.js";
 init_checkpoint_manager();
 export { deleteLegacyCheckpointRefs, diffCheckpointFiles, getCheckpointTimestamp, listCheckpoints, pruneCheckpointRefsForAgents, pruneStaleCheckpointRefs };

package/server/{checkpoint-manager-JryW6MpM.js → checkpoint-manager-fu9oVsR-.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { _r as VcsError, ar as CheckpointError, dr as InvalidAgentIdError, ln as init_state_plane, on as STATE_BRANCH_PATHS, vr as init_errors } from "./config-yaml-ClpGgrf6.js";
+import { br as init_errors, pr as InvalidAgentIdError, sn as STATE_BRANCH_PATHS, sr as CheckpointError, un as init_state_plane, yr as VcsError } from "./config-yaml-Dcz-8uit.js";
 import { Effect, Layer } from "effect";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -663,4 +663,4 @@ var init_checkpoint_manager = __esmMin((() => {
 //#endregion
 export { pruneStaleCheckpointRefs as _, diffAgainstMain as a, diffCheckpoints as c, diffPatchSinceCommit as d, findCommitAtTime as f, pruneCheckpointRefsForAgents as g, listCheckpoints as h, deleteLegacyCheckpointRefs as i, diffFilesAgainstHead as l, init_checkpoint_manager as m, checkpointStateExclusions as n, diffAgainstMainFiles as o, getCheckpointTimestamp as p, deleteCheckpoint as r, diffCheckpointFiles as s, captureCheckpoint as t, diffPatchFilesAgainstHead as u };
 
-//# sourceMappingURL=checkpoint-manager-JryW6MpM.js.map
+//# sourceMappingURL=checkpoint-manager-fu9oVsR-.js.map

package/server/checkpoint-worker.js

@@ -1,4 +1,4 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-qvOqvMuC.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-1BqOlS4q.js";
 import { parentPort } from "node:worker_threads";
 //#region ../../lib/memory/checkpoint-worker.ts
 function runOperation(operation, payload) {

package/server/{checkpoints-qvOqvMuC.js → checkpoints-1BqOlS4q.js}

@@ -1,4 +1,4 @@
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-DE3C4PMr.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-bpq1MHKU.js";
 import { randomUUID } from "node:crypto";
 //#region ../../lib/overdeck/transcript-checkpoint-sync.ts
 /**
@@ -195,4 +195,4 @@ function getTranscriptCheckpoint(sessionId) {
 //#endregion
 export { releaseTranscriptRange as a, listTranscriptCheckpoints as i, commitTranscriptRange as n, getTranscriptCheckpoint as r, claimTranscriptRange as t };
 
-//# sourceMappingURL=checkpoints-qvOqvMuC.js.map
+//# sourceMappingURL=checkpoints-1BqOlS4q.js.map

package/server/{checkpoints-BK17oicz.js → checkpoints-DvhGi8P_.js}

@@ -1,2 +1,2 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-qvOqvMuC.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-1BqOlS4q.js";
 export { claimTranscriptRange, commitTranscriptRange, getTranscriptCheckpoint, listTranscriptCheckpoints, releaseTranscriptRange };

package/server/claude-hooks-provision-s_wdpeVj.js

@@ -0,0 +1,360 @@
+import { Cr as BIN_DIR, Lr as SYNC_SOURCES, qr as init_paths } from "./config-yaml-Dcz-8uit.js";
+import { join } from "node:path";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
+import { homedir } from "node:os";
+import { chmodSync as chmodSync$1, copyFileSync as copyFileSync$1, existsSync as existsSync$1, mkdirSync as mkdirSync$1 } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/claude-hooks-registration.ts
+/**
+* Overdeck's Claude Code hook registration — single source of truth for
+* WHICH hook scripts exist and WHERE they register in ~/.claude/settings.json.
+*
+* Consumed by two installers that must never drift:
+*   - `pan admin hooks install` (src/cli/commands/setup/hooks.ts) — the
+*     interactive CLI path.
+*   - the desktop boot provisioner (src/lib/claude-hooks-provision.ts) — the
+*     non-interactive path for machines that never run the pan CLI (PAN-2595).
+*
+* Registration is delta-only: existing entries (including hand-customized
+* matchers) are left alone; only missing Overdeck hooks are appended, and
+* stale pre-rebrand `panopticon/bin` twins are pruned (PAN-2530).
+*/
+/**
+* Hook scripts copied from sync-sources/hooks/ to ~/.overdeck/bin/.
+* (Comments preserved from the original setupHooksCommand list.)
+*/
+const HOOK_SCRIPT_NAMES = [
+	"pan-hook-lib.sh",
+	"pre-tool-hook",
+	"ask-user-question-hook",
+	"auto-approve-hook",
+	"heartbeat-hook",
+	"stop-hook",
+	"notification-hook",
+	"specialist-stop-hook",
+	"work-agent-stop-hook",
+	"session-start-hook",
+	"user-prompt-submit-hook",
+	"pre-compact-hook",
+	"post-compact-hook",
+	"record-cost-event.js",
+	"gh-issue-trailer-hook",
+	"gh-issue-trailer-hook.js",
+	"tldr-read-enforcer",
+	"tldr-post-edit",
+	"rtk-bash-filter",
+	"permission-event-hook",
+	"tmux-send-keys-guard"
+];
+/**
+* The settings.json registration table. Order matters only for readability;
+* see setupHooksCommand for the per-entry rationale comments (PAN-1402,
+* PAN-1024, PAN-1084, PAN-1520).
+*/
+const OVERDECK_HOOK_REGISTRATIONS = [
+	{
+		hookType: "PreToolUse",
+		scriptName: "pre-tool-hook"
+	},
+	{
+		hookType: "PreToolUse",
+		scriptName: "auto-approve-hook"
+	},
+	{
+		hookType: "PreToolUse",
+		scriptName: "gh-issue-trailer-hook",
+		matcher: "Bash"
+	},
+	{
+		hookType: "PreToolUse",
+		scriptName: "tmux-send-keys-guard",
+		matcher: "Bash"
+	},
+	{
+		hookType: "PreToolUse",
+		scriptName: "ask-user-question-hook",
+		matcher: "AskUserQuestion"
+	},
+	{
+		hookType: "PostToolUse",
+		scriptName: "heartbeat-hook"
+	},
+	{
+		hookType: "PostToolUse",
+		scriptName: "permission-event-hook"
+	},
+	{
+		hookType: "Stop",
+		scriptName: "stop-hook"
+	},
+	{
+		hookType: "Stop",
+		scriptName: "permission-event-hook"
+	},
+	{
+		hookType: "SessionStart",
+		scriptName: "session-start-hook"
+	},
+	{
+		hookType: "Notification",
+		scriptName: "notification-hook"
+	},
+	{
+		hookType: "UserPromptSubmit",
+		scriptName: "user-prompt-submit-hook"
+	},
+	{
+		hookType: "PreCompact",
+		scriptName: "pre-compact-hook"
+	},
+	{
+		hookType: "PostCompact",
+		scriptName: "post-compact-hook"
+	},
+	{
+		hookType: "PermissionRequest",
+		scriptName: "permission-event-hook"
+	},
+	{
+		hookType: "PreToolUse",
+		scriptName: "tldr-read-enforcer",
+		matcher: "Read",
+		requiresPython3: true
+	},
+	{
+		hookType: "PostToolUse",
+		scriptName: "tldr-post-edit",
+		matcher: "Edit|Write",
+		requiresPython3: true
+	}
+];
+/**
+* Per-hook-type detection of whether a Overdeck hook is already registered.
+* PAN-800: rewritten from an all-or-nothing short-circuit to a delta-install
+* check so users with older installs still get SessionStart/Notification/etc.
+* added without having to wipe their settings.
+*/
+function isHookConfigured(settings, hookType, binDir, scriptName) {
+	return (settings?.hooks?.[hookType] || []).some((hookConfig) => hookConfig.hooks?.some((hook) => (hook.command?.includes(join$1(binDir, scriptName)) ?? false) || (hook.command?.includes(`overdeck/bin/${scriptName}`) ?? false)));
+}
+/**
+* PAN-2530: Remove stale pre-rebrand hook entries that point at the old
+* `~/.panopticon/bin/<scriptName>` path.
+*
+* Before the PAN-1952 rebrand, hooks were installed under `panopticon/bin/`.
+* `isHookConfigured()` only recognizes the current `overdeck/bin/` path, so a
+* re-sync after the rename added the new hook *alongside* the legacy one,
+* leaving both registered and both firing (e.g. ask-user-question-hook fired
+* twice, one copy still branded "Panopticon"). Prune any legacy entry for this
+* script so exactly one hook survives after install.
+*
+* Mutates `settings` in place. Returns true if anything was removed.
+*/
+function pruneLegacyPanopticonHook(settings, hookType, scriptName) {
+	const list = settings?.hooks?.[hookType];
+	if (!list) return false;
+	const isLegacy = (command) => command?.includes(`panopticon/bin/${scriptName}`) ?? false;
+	let removed = false;
+	const next = [];
+	for (const hookConfig of list) {
+		const originalHooks = hookConfig.hooks ?? [];
+		const keptHooks = originalHooks.filter((hook) => {
+			if (isLegacy(hook.command)) {
+				removed = true;
+				return false;
+			}
+			return true;
+		});
+		if (keptHooks.length > 0 || originalHooks.length === 0) next.push(keptHooks.length === originalHooks.length ? hookConfig : {
+			...hookConfig,
+			hooks: keptHooks
+		});
+	}
+	if (removed) settings.hooks[hookType] = next;
+	return removed;
+}
+function addOverdeckHookIfMissing(settings, hookType, binDir, scriptName, matcher = ".*") {
+	if (!settings.hooks) settings.hooks = {};
+	pruneLegacyPanopticonHook(settings, hookType, scriptName);
+	if (isHookConfigured(settings, hookType, binDir, scriptName)) return false;
+	(settings.hooks[hookType] ??= []).push({
+		matcher,
+		hooks: [{
+			type: "command",
+			command: join$1(binDir, scriptName)
+		}]
+	});
+	return true;
+}
+/**
+* Apply the full Overdeck registration table to `settings` (mutated in place,
+* delta-only). Returns what changed so callers can decide whether to write.
+*/
+function applyOverdeckHookRegistrations(settings, binDir, opts) {
+	const added = [];
+	const removed = [];
+	for (const reg of OVERDECK_HOOK_REGISTRATIONS) {
+		if (reg.requiresPython3 && !opts.python3Available) continue;
+		if (pruneLegacyPanopticonHook(settings, reg.hookType, reg.scriptName)) removed.push(`${reg.hookType}:${reg.scriptName}`);
+		if (addOverdeckHookIfMissing(settings, reg.hookType, binDir, reg.scriptName, reg.matcher ?? ".*")) added.push(`${reg.hookType}:${reg.scriptName}`);
+	}
+	return {
+		added,
+		removed
+	};
+}
+/**
+* Copy the file to `<path>.pan-backup-<iso>` adjacent to the original.
+* Returns the backup path, or null if the file did not exist.
+*
+* Backups go alongside the file (not in tmpdir) so users can find them
+* easily and so we don't pay EXDEV on the copy.
+*/
+function backupSettingsSync(path) {
+	if (!existsSync(path)) return null;
+	const backupPath = `${path}.pan-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+	copyFileSync(path, backupPath);
+	return backupPath;
+}
+/**
+* Keep the most recent `SETTINGS_BACKUP_KEEP` backups for the given
+* settings file, delete the rest. Backups are sorted lexically — the
+* ISO-8601 timestamp in the suffix makes that equivalent to chronological.
+*
+* Silent on per-file delete failure; the next prune cycle will retry.
+*/
+function pruneBackupsSync(settingsPath, keep = 5) {
+	const dir = dirname$1(settingsPath);
+	const prefix = `${basename$1(settingsPath)}.pan-backup-`;
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	const backups = entries.filter((e) => e.startsWith(prefix)).sort().reverse();
+	for (const stale of backups.slice(keep)) try {
+		unlinkSync(join$1(dir, stale));
+	} catch {}
+}
+/**
+* Atomic JSON write: serialize, write to a tmpfile in the same directory,
+* rename onto the target. Crash or out-of-disk between the open and the
+* rename leaves the original file intact.
+*
+* tmpfile lives in the same directory (not tmpdir) so the rename is a
+* single-filesystem op — POSIX guarantees that's atomic.
+*/
+function atomicWriteJsonSync(path, value) {
+	const dir = dirname$1(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+	writeFileSync(tmpPath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
+	renameSync(tmpPath, path);
+}
+//#endregion
+//#region ../../lib/claude-hooks-provision.ts
+/**
+* Non-interactive Claude Code hook provisioning for machines that never run
+* the pan CLI — the desktop app (PAN-2595).
+*
+* Mirrors what `pan admin hooks install` does, minus everything interactive:
+* copy the hook scripts from sync-sources/hooks/ into ~/.overdeck/bin/, then
+* delta-register them in ~/.claude/settings.json via the shared table
+* (src/lib/claude-hooks-registration.ts). Safe-settings guarantees hold
+* (PAN-1137): an unparseable settings.json is never overwritten — we skip
+* with a reason instead of process.exit — and every write is backed up and
+* atomic. Idempotent: a machine with everything registered results in no
+* write at all.
+*
+* Never throws; returns a result the caller can log. Runs async probes only
+* (no execSync — this is server-boot-reachable code).
+*/
+init_paths();
+const execFileAsync = promisify(execFile);
+async function commandAvailable(cmd, args) {
+	try {
+		await execFileAsync(cmd, args, { timeout: 1e4 });
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function provisionClaudeHooks(options = {}) {
+	const settingsPath = options.settingsPath ?? join(homedir(), ".claude", "settings.json");
+	const binDir = options.binDir ?? BIN_DIR;
+	const none = {
+		changed: false,
+		binariesSynced: 0,
+		registered: [],
+		pruned: []
+	};
+	try {
+		if (!existsSync$1(SYNC_SOURCES.hooks)) return {
+			ok: false,
+			reason: `hook sources not shipped in this install (${SYNC_SOURCES.hooks})`,
+			...none
+		};
+		if (!await commandAvailable("jq", ["--version"])) return {
+			ok: false,
+			reason: "jq is not installed — hooks require it (see the setup checklist)",
+			...none
+		};
+		mkdirSync$1(binDir, { recursive: true });
+		let binariesSynced = 0;
+		for (const scriptName of HOOK_SCRIPT_NAMES) {
+			const sourcePath = join(SYNC_SOURCES.hooks, scriptName);
+			if (!existsSync$1(sourcePath)) return {
+				ok: false,
+				reason: `hook script missing from install: ${sourcePath}`,
+				...none
+			};
+			copyFileSync$1(sourcePath, join(binDir, scriptName));
+			chmodSync$1(join(binDir, scriptName), 493);
+			binariesSynced++;
+		}
+		let settings = {};
+		if (existsSync$1(settingsPath)) try {
+			settings = JSON.parse(await readFile(settingsPath, "utf-8"));
+		} catch (err) {
+			return {
+				ok: false,
+				reason: `${settingsPath} is not valid JSON (${err instanceof Error ? err.message : String(err)}) — refusing to write; fix or restore a .pan-backup first`,
+				...none,
+				binariesSynced
+			};
+		}
+		const python3Available = await commandAvailable("python3", ["--version"]);
+		const { added, removed } = applyOverdeckHookRegistrations(settings, binDir, { python3Available });
+		if (added.length === 0 && removed.length === 0) return {
+			ok: true,
+			changed: false,
+			binariesSynced,
+			registered: [],
+			pruned: []
+		};
+		backupSettingsSync(settingsPath);
+		atomicWriteJsonSync(settingsPath, settings);
+		pruneBackupsSync(settingsPath);
+		return {
+			ok: true,
+			changed: true,
+			binariesSynced,
+			registered: added,
+			pruned: removed
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			reason: err instanceof Error ? err.message : String(err),
+			...none
+		};
+	}
+}
+//#endregion
+export { provisionClaudeHooks };
+
+//# sourceMappingURL=claude-hooks-provision-s_wdpeVj.js.map

package/server/{claude-permissions-B6bWGh9d.js → claude-permissions-CaWqysff.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-ClpGgrf6.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-Dcz-8uit.js";
 import "effect";
 //#region ../../lib/claude-permissions.ts
 /** Read PAN_YOLO from the current process env. Returns the implied mode, or undefined if unset/unparseable. */
@@ -94,4 +94,4 @@ var init_claude_permissions = __esmMin((() => {
 //#endregion
 export { init_claude_permissions as a, getClaudePermissionFlagsSync as i, buildClaudeUserSettingsSync as n, resolvePermissionModeSync as o, getClaudePermissionFlagsStringSync as r, BYPASS_PERMISSION_MODE as t };
 
-//# sourceMappingURL=claude-permissions-B6bWGh9d.js.map
+//# sourceMappingURL=claude-permissions-CaWqysff.js.map

package/server/{claude-settings-overlay-BPdhTPjo.js → claude-settings-overlay-BbA4FbVI.js}

@@ -1,3 +1,3 @@
-import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CRyyKKXQ.js";
+import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CcTf0xzG.js";
 init_claude_settings_overlay();
 export { injectOverdeckInfraDeny };

package/server/{claude-settings-overlay-CRyyKKXQ.js → claude-settings-overlay-CcTf0xzG.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { cr as FsError, vr as init_errors } from "./config-yaml-ClpGgrf6.js";
+import { br as init_errors, ur as FsError } from "./config-yaml-Dcz-8uit.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
 import { homedir, tmpdir } from "os";
@@ -142,4 +142,4 @@ var init_claude_settings_overlay = __esmMin((() => {
 //#endregion
 export { init_claude_settings_overlay as n, injectOverdeckInfraDeny as r, detectProviderEnvConflicts as t };
 
-//# sourceMappingURL=claude-settings-overlay-CRyyKKXQ.js.map
+//# sourceMappingURL=claude-settings-overlay-CcTf0xzG.js.map