@overdeck/desktop 0.45.15 → 0.45.18

package/server/{claude-hooks-provision-s_wdpeVj.js → claude-hooks-provision-Du_PkMsp.js}

@@ -1,4 +1,5 @@
-import { Cr as BIN_DIR, Lr as SYNC_SOURCES, qr as init_paths } from "./config-yaml-Dcz-8uit.js";
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { Tr as BIN_DIR, Yr as init_paths, zr as SYNC_SOURCES } from "./config-yaml-CqaAyn8y.js";
 import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
@@ -23,115 +24,6 @@ import { promisify } from "node:util";
 * stale pre-rebrand `panopticon/bin` twins are pruned (PAN-2530).
 */
 /**
-* Hook scripts copied from sync-sources/hooks/ to ~/.overdeck/bin/.
-* (Comments preserved from the original setupHooksCommand list.)
-*/
-const HOOK_SCRIPT_NAMES = [
-	"pan-hook-lib.sh",
-	"pre-tool-hook",
-	"ask-user-question-hook",
-	"auto-approve-hook",
-	"heartbeat-hook",
-	"stop-hook",
-	"notification-hook",
-	"specialist-stop-hook",
-	"work-agent-stop-hook",
-	"session-start-hook",
-	"user-prompt-submit-hook",
-	"pre-compact-hook",
-	"post-compact-hook",
-	"record-cost-event.js",
-	"gh-issue-trailer-hook",
-	"gh-issue-trailer-hook.js",
-	"tldr-read-enforcer",
-	"tldr-post-edit",
-	"rtk-bash-filter",
-	"permission-event-hook",
-	"tmux-send-keys-guard"
-];
-/**
-* The settings.json registration table. Order matters only for readability;
-* see setupHooksCommand for the per-entry rationale comments (PAN-1402,
-* PAN-1024, PAN-1084, PAN-1520).
-*/
-const OVERDECK_HOOK_REGISTRATIONS = [
-	{
-		hookType: "PreToolUse",
-		scriptName: "pre-tool-hook"
-	},
-	{
-		hookType: "PreToolUse",
-		scriptName: "auto-approve-hook"
-	},
-	{
-		hookType: "PreToolUse",
-		scriptName: "gh-issue-trailer-hook",
-		matcher: "Bash"
-	},
-	{
-		hookType: "PreToolUse",
-		scriptName: "tmux-send-keys-guard",
-		matcher: "Bash"
-	},
-	{
-		hookType: "PreToolUse",
-		scriptName: "ask-user-question-hook",
-		matcher: "AskUserQuestion"
-	},
-	{
-		hookType: "PostToolUse",
-		scriptName: "heartbeat-hook"
-	},
-	{
-		hookType: "PostToolUse",
-		scriptName: "permission-event-hook"
-	},
-	{
-		hookType: "Stop",
-		scriptName: "stop-hook"
-	},
-	{
-		hookType: "Stop",
-		scriptName: "permission-event-hook"
-	},
-	{
-		hookType: "SessionStart",
-		scriptName: "session-start-hook"
-	},
-	{
-		hookType: "Notification",
-		scriptName: "notification-hook"
-	},
-	{
-		hookType: "UserPromptSubmit",
-		scriptName: "user-prompt-submit-hook"
-	},
-	{
-		hookType: "PreCompact",
-		scriptName: "pre-compact-hook"
-	},
-	{
-		hookType: "PostCompact",
-		scriptName: "post-compact-hook"
-	},
-	{
-		hookType: "PermissionRequest",
-		scriptName: "permission-event-hook"
-	},
-	{
-		hookType: "PreToolUse",
-		scriptName: "tldr-read-enforcer",
-		matcher: "Read",
-		requiresPython3: true
-	},
-	{
-		hookType: "PostToolUse",
-		scriptName: "tldr-post-edit",
-		matcher: "Edit|Write",
-		requiresPython3: true
-	}
-];
-/**
 * Per-hook-type detection of whether a Overdeck hook is already registered.
 * PAN-800: rewritten from an all-or-nothing short-circuit to a delta-install
 * check so users with older installs still get SessionStart/Notification/etc.
@@ -206,6 +98,126 @@ function applyOverdeckHookRegistrations(settings, binDir, opts) {
 		removed
 	};
 }
+var HOOK_SCRIPT_NAMES, OVERDECK_HOOK_REGISTRATIONS;
+var init_claude_hooks_registration = __esmMin((() => {
+	HOOK_SCRIPT_NAMES = [
+		"pan-hook-lib.sh",
+		"pre-tool-hook",
+		"ask-user-question-hook",
+		"auto-approve-hook",
+		"heartbeat-hook",
+		"stop-hook",
+		"notification-hook",
+		"specialist-stop-hook",
+		"work-agent-stop-hook",
+		"session-start-hook",
+		"user-prompt-submit-hook",
+		"pre-compact-hook",
+		"post-compact-hook",
+		"record-cost-event.js",
+		"gh-issue-trailer-hook",
+		"gh-issue-trailer-hook.js",
+		"tldr-read-enforcer",
+		"tldr-post-edit",
+		"rtk-bash-filter",
+		"permission-event-hook",
+		"tmux-send-keys-guard"
+	];
+	OVERDECK_HOOK_REGISTRATIONS = [
+		{
+			hookType: "PreToolUse",
+			scriptName: "pre-tool-hook"
+		},
+		{
+			hookType: "PreToolUse",
+			scriptName: "auto-approve-hook"
+		},
+		{
+			hookType: "PreToolUse",
+			scriptName: "gh-issue-trailer-hook",
+			matcher: "Bash"
+		},
+		{
+			hookType: "PreToolUse",
+			scriptName: "tmux-send-keys-guard",
+			matcher: "Bash"
+		},
+		{
+			hookType: "PreToolUse",
+			scriptName: "ask-user-question-hook",
+			matcher: "AskUserQuestion"
+		},
+		{
+			hookType: "PostToolUse",
+			scriptName: "heartbeat-hook"
+		},
+		{
+			hookType: "PostToolUse",
+			scriptName: "permission-event-hook"
+		},
+		{
+			hookType: "Stop",
+			scriptName: "stop-hook"
+		},
+		{
+			hookType: "Stop",
+			scriptName: "permission-event-hook"
+		},
+		{
+			hookType: "SessionStart",
+			scriptName: "session-start-hook"
+		},
+		{
+			hookType: "Notification",
+			scriptName: "notification-hook"
+		},
+		{
+			hookType: "UserPromptSubmit",
+			scriptName: "user-prompt-submit-hook"
+		},
+		{
+			hookType: "PreCompact",
+			scriptName: "pre-compact-hook"
+		},
+		{
+			hookType: "PostCompact",
+			scriptName: "post-compact-hook"
+		},
+		{
+			hookType: "PermissionRequest",
+			scriptName: "permission-event-hook"
+		},
+		{
+			hookType: "PreToolUse",
+			scriptName: "tldr-read-enforcer",
+			matcher: "Read",
+			requiresPython3: true
+		},
+		{
+			hookType: "PostToolUse",
+			scriptName: "tldr-post-edit",
+			matcher: "Edit|Write",
+			requiresPython3: true
+		}
+	];
+}));
+//#endregion
+//#region ../../lib/claude-settings-file.ts
+/**
+* Pure file primitives for safe ~/.claude/settings.json writes — the
+* dependency-light core of src/cli/commands/setup/safe-settings.ts, moved to
+* lib so the desktop boot provisioner (PAN-2595) can share them without
+* importing CLI modules. The PAN-1137 guarantees hold here:
+*
+*   1. Every write is preceded by a timestamped backup, bounded to the most
+*      recent five.
+*   2. Writes are atomic: tmpfile in the same directory + rename (sidesteps
+*      EXDEV when /tmp is on a different filesystem than $HOME).
+*
+* Guarantee 3 (parse failures abort, never reset to `{}`) is caller policy:
+* the CLI's readSettingsOrAbortSync exits the process; the boot provisioner
+* skips provisioning instead. Both refuse to write over an unparseable file.
+*/
 /**
 * Copy the file to `<path>.pan-backup-<iso>` adjacent to the original.
 * Returns the backup path, or null if the file did not exist.
@@ -255,6 +267,7 @@ function atomicWriteJsonSync(path, value) {
 	writeFileSync(tmpPath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
 	renameSync(tmpPath, path);
 }
+var init_claude_settings_file = __esmMin((() => {}));
 //#endregion
 //#region ../../lib/claude-hooks-provision.ts
 /**
@@ -273,8 +286,6 @@ function atomicWriteJsonSync(path, value) {
 * Never throws; returns a result the caller can log. Runs async probes only
 * (no execSync — this is server-boot-reachable code).
 */
-init_paths();
-const execFileAsync = promisify(execFile);
 async function commandAvailable(cmd, args) {
 	try {
 		await execFileAsync(cmd, args, { timeout: 1e4 });
@@ -354,7 +365,14 @@ async function provisionClaudeHooks(options = {}) {
 		};
 	}
 }
+var execFileAsync;
+var init_claude_hooks_provision = __esmMin((() => {
+	init_claude_hooks_registration();
+	init_claude_settings_file();
+	init_paths();
+	execFileAsync = promisify(execFile);
+}));
 //#endregion
-export { provisionClaudeHooks };
+export { provisionClaudeHooks as n, init_claude_hooks_provision as t };
 
-//# sourceMappingURL=claude-hooks-provision-s_wdpeVj.js.map
+//# sourceMappingURL=claude-hooks-provision-Du_PkMsp.js.map

package/server/{claude-permissions-CaWqysff.js → claude-permissions-BB6agcOZ.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-Dcz-8uit.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-CqaAyn8y.js";
 import "effect";
 //#region ../../lib/claude-permissions.ts
 /** Read PAN_YOLO from the current process env. Returns the implied mode, or undefined if unset/unparseable. */
@@ -94,4 +94,4 @@ var init_claude_permissions = __esmMin((() => {
 //#endregion
 export { init_claude_permissions as a, getClaudePermissionFlagsSync as i, buildClaudeUserSettingsSync as n, resolvePermissionModeSync as o, getClaudePermissionFlagsStringSync as r, BYPASS_PERMISSION_MODE as t };
 
-//# sourceMappingURL=claude-permissions-CaWqysff.js.map
+//# sourceMappingURL=claude-permissions-BB6agcOZ.js.map

package/server/{claude-settings-overlay-CcTf0xzG.js → claude-settings-overlay-CAq2oFSK.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { br as init_errors, ur as FsError } from "./config-yaml-Dcz-8uit.js";
+import { Sr as init_errors, fr as FsError } from "./config-yaml-CqaAyn8y.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
 import { homedir, tmpdir } from "os";
@@ -142,4 +142,4 @@ var init_claude_settings_overlay = __esmMin((() => {
 //#endregion
 export { init_claude_settings_overlay as n, injectOverdeckInfraDeny as r, detectProviderEnvConflicts as t };
 
-//# sourceMappingURL=claude-settings-overlay-CcTf0xzG.js.map
+//# sourceMappingURL=claude-settings-overlay-CAq2oFSK.js.map

package/server/{claude-settings-overlay-BbA4FbVI.js → claude-settings-overlay-DUWWLd6M.js}

@@ -1,3 +1,3 @@
-import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CcTf0xzG.js";
+import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CAq2oFSK.js";
 init_claude_settings_overlay();
 export { injectOverdeckInfraDeny };

package/server/cli-BFgrSWKV.js

@@ -0,0 +1,3 @@
+import { r as init_cli, t as createResetMarker } from "./cli-C33xPZNm.js";
+init_cli();
+export { createResetMarker };

package/server/{cli-BwCvCUBK.js → cli-C33xPZNm.js}

@@ -1,11 +1,11 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { qr as init_paths } from "./config-yaml-Dcz-8uit.js";
-import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-C9DkhIOT.js";
-import { t as init_agents } from "./agents-CsOzAmRg.js";
-import { i as init_settings } from "./settings-DCC4BAqj.js";
-import { r as init_health, t as init_providers } from "./providers-CWDXoaMA.js";
-import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-CBgBLZcL.js";
-import { r as init_rollup } from "./rollup-CnxbwaLH.js";
+import { Yr as init_paths } from "./config-yaml-CqaAyn8y.js";
+import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-Btkc8mzp.js";
+import { s as init_agents } from "./queries-C0LCGG21.js";
+import { i as init_settings } from "./settings-gJrdLZy2.js";
+import { r as init_health, t as init_providers } from "./providers-C-yWibCk.js";
+import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-Bgzn2RO7.js";
+import { r as init_rollup } from "./rollup-Bu0f2EyN.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { readFile, rename, writeFile } from "fs/promises";
@@ -194,7 +194,7 @@ async function writeResetMarkerToFtsDb(projectId, marker) {
 	});
 }
 async function emitResetMarkerCreated(marker, timestamp) {
-	const { initEventStore } = await import("./event-store-CcJAhKCl.js");
+	const { initEventStore } = await import("./event-store-D9UhQyMS.js");
 	await (await initEventStore()).appendAsync({
 		type: "memory.reset_marker_created",
 		timestamp,
@@ -221,4 +221,4 @@ var init_cli = __esmMin((() => {
 //#endregion
 export { generateDailySummary as n, init_cli as r, createResetMarker as t };
 
-//# sourceMappingURL=cli-BwCvCUBK.js.map
+//# sourceMappingURL=cli-C33xPZNm.js.map

package/server/{cliproxy-C2xC-3vH.js → cliproxy-BQX1TL6N.js}

@@ -1,3 +1,3 @@
-import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-BsoNNDAj.js";
+import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-CGBA1GzA.js";
 init_cliproxy();
 export { isCliproxyRunning };

package/server/{cliproxy-BsoNNDAj.js → cliproxy-CGBA1GzA.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ar as OVERDECK_HOME, Cr as BIN_DIR, br as init_errors, gr as ProcessSpawnError, qr as init_paths, ur as FsError } from "./config-yaml-Dcz-8uit.js";
+import { Mr as OVERDECK_HOME, Sr as init_errors, Tr as BIN_DIR, Yr as init_paths, fr as FsError, vr as ProcessSpawnError } from "./config-yaml-CqaAyn8y.js";
 import { Data, Effect } from "effect";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -496,4 +496,4 @@ var init_cliproxy = __esmMin((() => {
 //#endregion
 export { restartCliproxy as C, readPidFile as S, stopCliproxy as T, getCliproxyPidPath as _, CliproxyError as a, isCliproxyInstalled as b, bridgeGeminiAuthToCliproxy as c, getCliproxyAuthDir as d, getCliproxyBinary as f, getCliproxyLogPath as g, getCliproxyDir as h, CLIPROXY_PORT as i, decodeJwtPayload as l, getCliproxyConfigPath as m, CLIPROXY_BASE_URL as n, bridgeCodexAuthToCliproxy as o, getCliproxyClientEnv as p, CLIPROXY_HOST as r, bridgeCodexAuthToCliproxySync as s, CLIPROXY_AUTH_TOKEN as t, detectPlatformAsset as u, init_cliproxy as v, startCliproxy as w, isCliproxyRunning as x, installCliproxy as y };
 
-//# sourceMappingURL=cliproxy-BsoNNDAj.js.map
+//# sourceMappingURL=cliproxy-CGBA1GzA.js.map

package/server/{close-issue-BleIwP3f.js → close-issue-DNv8npc1.js}

@@ -1,6 +1,6 @@
-import { $n as extractNumberSync, er as extractPrefixSync, nr as normalizeIssueIdSync, tr as init_issue_id } from "./config-yaml-Dcz-8uit.js";
-import { Mn as getAgentState, Vn as markAgentStoppedState, qn as saveAgentState, t as init_agents } from "./agents-CsOzAmRg.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-33JEP4LZ.js";
+import { ir as normalizeIssueIdSync, nr as extractPrefixSync, rr as init_issue_id, tr as extractNumberSync } from "./config-yaml-CqaAyn8y.js";
+import { Hn as markAgentStoppedState, Jn as saveAgentState, Nn as getAgentState, s as init_agents } from "./queries-C0LCGG21.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-DXBMm4mX.js";
 import { Effect } from "effect";
 import { exec } from "child_process";
 import { promisify } from "util";
@@ -227,7 +227,7 @@ function closeRallyDirect(ctx) {
 async function closeRallyDirectImpl(ctx) {
 	const step = "close-issue:transition";
 	if (!ctx.rally) return stepFailed(step, "Rally config not provided");
-	const { RallyTracker } = await import("./rally-Dc2Wnxw2.js");
+	const { RallyTracker } = await import("./rally-DF5a3ioP.js");
 	const tracker = new RallyTracker({
 		apiKey: ctx.rally.apiKey,
 		server: ctx.rally.server,
@@ -327,4 +327,4 @@ async function applyLabelLinearImpl(ctx, apiKey) {
 //#endregion
 export { closeIssue as t };
 
-//# sourceMappingURL=close-issue-BleIwP3f.js.map
+//# sourceMappingURL=close-issue-DNv8npc1.js.map

package/server/{closed-issue-reaper-BwUUvjEW.js → closed-issue-reaper-DrqgBJlr.js}

@@ -1,2 +1,2 @@
-import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-mC5pujeb.js";
+import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-LoMnnjtJ.js";
 export { handleIssueStatusChangedClosed };

package/server/{closed-issue-reaper-mC5pujeb.js → closed-issue-reaper-LoMnnjtJ.js}

@@ -1,12 +1,12 @@
-import { It as resolveProjectForIssue, Pn as init_projects, Rn as listProjectsSync, kt as init_record, qr as init_paths, tr as init_issue_id, xr as AGENTS_DIR } from "./config-yaml-Dcz-8uit.js";
+import { Cr as AGENTS_DIR, Fn as init_projects, It as resolveProjectForIssue, Yr as init_paths, kt as init_record, rr as init_issue_id, zn as listProjectsSync } from "./config-yaml-CqaAyn8y.js";
 import { a as init_activity_logger, n as emitActivityEntrySync } from "./activity-logger-pcbf-e30.js";
-import { O as listSessionNames, w as killSession, x as init_tmux } from "./tmux-C_d-lSIq.js";
-import { c as init_review_status, u as loadReviewStatuses } from "./review-status-4qqLkRMu.js";
-import { K as stopAgent, Z as listRunningAgents, t as init_agents } from "./agents-CsOzAmRg.js";
-import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-s-esqZ__.js";
-import { l as init_prd_locations, o as init_archive_planning } from "./archive-planning-DkivCk1A.js";
-import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-FApNiOOs.js";
-import "./close-issue-BleIwP3f.js";
+import { S as init_tmux, T as killSession, k as listSessionNames } from "./tmux-U55cNGFG.js";
+import { c as init_review_status, u as loadReviewStatuses } from "./review-status-DANr0t-v.js";
+import { Q as stopAgent, i as listRunningAgents, s as init_agents } from "./queries-C0LCGG21.js";
+import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-CNjXS72x.js";
+import { l as init_prd_locations, o as init_archive_planning } from "./archive-planning-CzCW9Ifl.js";
+import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-Cpl4VDUM.js";
+import "./close-issue-DNv8npc1.js";
 import { join } from "node:path";
 import { Data, Effect } from "effect";
 import "fs";
@@ -414,4 +414,4 @@ async function reconcileClosedIssueAgents() {
 //#endregion
 export { reconcileClosedIssueAgents as n, handleIssueStatusChangedClosed as t };
 
-//# sourceMappingURL=closed-issue-reaper-mC5pujeb.js.map
+//# sourceMappingURL=closed-issue-reaper-LoMnnjtJ.js.map

package/server/codex-DxLivxri.js

@@ -0,0 +1,3 @@
+import { a as extractThreadIdFromRollout, c as initCodexHome, f as waitForCodexRollout, l as init_codex, o as findLatestRollout, p as writeThreadId, s as findRolloutPath } from "./codex-sgWVCGUd.js";
+init_codex();
+export { extractThreadIdFromRollout, findLatestRollout, findRolloutPath, initCodexHome, waitForCodexRollout, writeThreadId };

package/server/{behavior-Cpj03N4v.js → codex-parser-DboQnEXN.js}

@@ -1,6 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { t as init_src } from "./src-DHn4Rd2F.js";
-import { o as getPricingSync, s as init_cost } from "./cost-DQ2ajr_m.js";
+import { o as getPricingSync, s as init_cost } from "./cost-BoqD1Pxz.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region ../../lib/cost-parsers/codex-parser.ts
 /**
@@ -243,11 +242,6 @@ var init_codex_parser = __esmMin((() => {
 	init_cost();
 }));
 //#endregion
-//#region ../../lib/runtimes/behavior.ts
-var init_behavior = __esmMin((() => {
-	init_src();
-}));
-//#endregion
-export { parseCodexSessionSync as i, init_codex_parser as n, parseCodexSessionCostEventsSync as r, init_behavior as t };
+export { parseCodexSessionCostEventsSync as n, parseCodexSessionSync as r, init_codex_parser as t };
 
-//# sourceMappingURL=behavior-Cpj03N4v.js.map
+//# sourceMappingURL=codex-parser-DboQnEXN.js.map

package/server/{codex-DW60_5j2.js → codex-sgWVCGUd.js}

@@ -1,12 +1,13 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { br as init_errors } from "./config-yaml-Dcz-8uit.js";
-import { A as listSessionsSync, L as sessionExists, o as createSession, w as killSession, x as init_tmux } from "./tmux-C_d-lSIq.js";
-import { r as CODEX_BEHAVIOR } from "./src-DHn4Rd2F.js";
-import { i as parseCodexSessionSync, n as init_codex_parser, t as init_behavior } from "./behavior-Cpj03N4v.js";
+import { Sr as init_errors } from "./config-yaml-CqaAyn8y.js";
+import { R as sessionExists, S as init_tmux, T as killSession, j as listSessionsSync, o as createSession } from "./tmux-U55cNGFG.js";
+import { r as CODEX_BEHAVIOR } from "./src-By3D85Ry.js";
+import { r as parseCodexSessionSync, t as init_codex_parser } from "./codex-parser-DboQnEXN.js";
+import { t as init_behavior } from "./behavior-CWqNMqE5.js";
 import { basename, join } from "node:path";
 import { Effect } from "effect";
 import { homedir } from "node:os";
-import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 //#region ../../lib/runtimes/codex.ts
@@ -134,16 +135,7 @@ function initCodexHome(codexHomeDir, opts = {}) {
 		lines.push("");
 		writeFileSync(configPath, lines.join("\n"), { mode: 384 });
 	}
-	const homeAuthPath = join(codexHomeDir, "auth.json");
-	if (!existsSync(homeAuthPath)) {
-		const globalAuthPath = join(homedir(), ".codex", "auth.json");
-		if (existsSync(globalAuthPath)) {
-			copyFileSync(globalAuthPath, homeAuthPath);
-			try {
-				chmodSync(homeAuthPath, 384);
-			} catch {}
-		}
-	}
+	seedCodexAuthSymlink(join(codexHomeDir, "auth.json"), join(homedir(), ".codex", "auth.json"));
 	const agentsMdPath = join(codexHomeDir, "AGENTS.md");
 	if (!existsSync(agentsMdPath)) {
 		const globalCodexContext = join(homedir(), ".overdeck", "context", "codex-global.md");
@@ -152,6 +144,40 @@ function initCodexHome(codexHomeDir, opts = {}) {
 	}
 }
 /**
+* Point a per-agent CODEX_HOME/auth.json at the global ~/.codex/auth.json via a
+* symlink so every agent shares one OAuth refresh-token family (PAN-2285).
+*
+* Idempotent and migration-safe:
+*   - global auth.json missing        → do nothing (onboarding prompts, as before)
+*   - home auth.json already the right → nothing
+*     symlink to global
+*   - home auth.json a regular-file    → remove the stale disposable copy and
+*     copy or a wrong symlink            replace it with the symlink (this is the
+*                                        in-place migration for already-deployed
+*                                        homes; removing a per-agent copy loses
+*                                        nothing — the global file is the source
+*                                        of truth)
+*
+* Exported for unit testing over temp dirs. Privacy: a symlink's permissions
+* follow its target (the global file is 0600), so no chmod is needed here.
+*/
+function seedCodexAuthSymlink(homeAuthPath, globalAuthPath) {
+	if (!existsSync(globalAuthPath)) return;
+	let currentLink = null;
+	try {
+		if (lstatSync(homeAuthPath).isSymbolicLink()) currentLink = readlinkSync(homeAuthPath);
+	} catch {
+		currentLink = null;
+	}
+	if (currentLink === globalAuthPath) return;
+	try {
+		if (existsSync(homeAuthPath) || currentLink !== null) unlinkSync(homeAuthPath);
+	} catch {}
+	try {
+		symlinkSync(globalAuthPath, homeAuthPath);
+	} catch {}
+}
+/**
 * Translate Overdeck's abstract sandbox mode token into a value the codex
 * CLI actually accepts. Overdeck config uses 'workspace' as its mode name
 * (see config-yaml.ts permission modes); codex only accepts read-only,
@@ -496,6 +522,6 @@ var init_codex = __esmMin((() => {
 	};
 }));
 //#endregion
-export { extractThreadIdFromRollout as a, initCodexHome as c, waitForCodexRollout as d, writeThreadId as f, createCodexRuntimeSync as i, init_codex as l, CodexSpawnTimeout as n, findLatestRollout as o, codexHome as r, findRolloutPath as s, CodexRuntimeSync as t, toCodexSandboxValue as u };
+export { extractThreadIdFromRollout as a, initCodexHome as c, toCodexSandboxValue as d, waitForCodexRollout as f, createCodexRuntimeSync as i, init_codex as l, CodexSpawnTimeout as n, findLatestRollout as o, writeThreadId as p, codexHome as r, findRolloutPath as s, CodexRuntimeSync as t, seedCodexAuthSymlink as u };
 
-//# sourceMappingURL=codex-DW60_5j2.js.map
+//# sourceMappingURL=codex-sgWVCGUd.js.map

package/server/{config-BRNQJXhA.js → config-6MCHOZ2N.js}

@@ -1,3 +1,3 @@
-import { _ as saveConfigSync, a as getConversationsConfigSync, c as getDefaultConfig, d as getDevrootPathSync, f as init_config, g as saveConfig, h as normalizeRemoteConfig, i as getConversationsConfig, l as getDefaultConfigSync, m as loadConfigSync, n as findDevrootForProject, o as getDashboardApiUrl, p as loadConfig, r as findDevrootForProjectSync, s as getDashboardApiUrlSync, t as checkDevrootDeprecation, u as getDevrootPath } from "./config-ZNnMpIlh.js";
+import { _ as saveConfigSync, a as getConversationsConfigSync, c as getDefaultConfig, d as getDevrootPathSync, f as init_config, g as saveConfig, h as normalizeRemoteConfig, i as getConversationsConfig, l as getDefaultConfigSync, m as loadConfigSync, n as findDevrootForProject, o as getDashboardApiUrl, p as loadConfig, r as findDevrootForProjectSync, s as getDashboardApiUrlSync, t as checkDevrootDeprecation, u as getDevrootPath } from "./config-DfaUXr6r.js";
 init_config();
 export { checkDevrootDeprecation, findDevrootForProject, findDevrootForProjectSync, getConversationsConfig, getConversationsConfigSync, getDashboardApiUrl, getDashboardApiUrlSync, getDefaultConfig, getDefaultConfigSync, getDevrootPath, getDevrootPathSync, loadConfig, loadConfigSync, normalizeRemoteConfig, saveConfig, saveConfigSync };

package/server/{config-ZNnMpIlh.js → config-DfaUXr6r.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Dr as CONFIG_FILE, br as init_errors, f as loadConfigSync$1, qr as init_paths, t as init_config_yaml, ur as FsError } from "./config-yaml-Dcz-8uit.js";
+import { Sr as init_errors, Yr as init_paths, f as loadConfigSync$1, fr as FsError, kr as CONFIG_FILE, t as init_config_yaml } from "./config-yaml-CqaAyn8y.js";
 import { t as require_toml } from "./toml-CeLDATih.js";
 import { Effect } from "effect";
 import { existsSync, promises, readFileSync, writeFileSync } from "fs";
@@ -253,4 +253,4 @@ var init_config = __esmMin((() => {
 //#endregion
 export { saveConfigSync as _, getConversationsConfigSync as a, getDefaultConfig as c, getDevrootPathSync as d, init_config as f, saveConfig as g, normalizeRemoteConfig as h, getConversationsConfig as i, getDefaultConfigSync as l, loadConfigSync as m, findDevrootForProject as n, getDashboardApiUrl as o, loadConfig as p, findDevrootForProjectSync as r, getDashboardApiUrlSync as s, checkDevrootDeprecation as t, getDevrootPath as u };
 
-//# sourceMappingURL=config-ZNnMpIlh.js.map
+//# sourceMappingURL=config-DfaUXr6r.js.map