@overdeck/desktop 0.45.21 → 0.45.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop",
-  "version": "0.45.21",
+  "version": "0.45.23",
   "description": "Overdeck Command Deck — AI agent monitoring desktop app",
   "publishConfig": {
     "access": "public"

package/server/{acceptance-criteria-CJIFA8Vg.js → acceptance-criteria-DOA0KgXx.js}

@@ -1,9 +1,9 @@
-import { m as readWorkspacePlanSync, o as init_io, v as init_types, y as subItemsOf } from "./io-BiM-7Zsx.js";
+import { m as readWorkspacePlanSync, o as init_io, v as init_types, y as subItemsOf } from "./io-B3_AHDfr.js";
 import "effect";
-//#region ../../lib/vbrief/acceptance-criteria.ts
+//#region ../../lib/xbrief/acceptance-criteria.ts
 init_io();
 init_types();
-function getVBriefACStatusSync(workspacePath) {
+function getXBriefACStatusSync(workspacePath) {
 	const doc = readWorkspacePlanSync(workspacePath);
 	if (!doc) return null;
 	const allCriteria = extractACFromDocument(doc);
@@ -57,6 +57,6 @@ function extractACFromDocument(doc) {
 	return criteria;
 }
 //#endregion
-export { getVBriefACStatusSync as n, extractACFromDocument as t };
+export { getXBriefACStatusSync as n, extractACFromDocument as t };
 
-//# sourceMappingURL=acceptance-criteria-CJIFA8Vg.js.map
+//# sourceMappingURL=acceptance-criteria-DOA0KgXx.js.map

package/server/{advancing-selfheal-CPOBO5ZS.js → advancing-selfheal-BBu6DSNm.js}

@@ -1,8 +1,8 @@
-import { D as killSession, j as listSessionNames, w as init_tmux } from "./tmux-y1blSxks.js";
-import { c as init_review_status, s as getReviewStatusSync, u as loadReviewStatuses } from "./review-status-CCgPVK1h.js";
-import { Gn as saveAgentStateSync, Rn as markAgentStoppedState, jn as getAgentStateSync, s as init_agents } from "./queries-B5hl7lMQ.js";
-import { c as logDeaconEventSync, o as init_persistent_logger } from "./session-history-DUehL3KN.js";
-import { o as selectMergedAdvancingSessions, t as init_reap_terminal_sessions } from "./reap-terminal-sessions-CjqRAGw7.js";
+import { D as killSession, M as listSessionNames, w as init_tmux } from "./tmux-ftABRAmc.js";
+import { c as getReviewStatusSync, d as loadReviewStatuses, l as init_review_status } from "./review-status-A7quS5KJ.js";
+import { Wn as getAgentStateSync, Zn as markAgentStoppedState, b as init_agents, ir as saveAgentStateSync } from "./queries-6d7Cdtm7.js";
+import { c as logDeaconEventSync, o as init_persistent_logger } from "./session-history-CVZDpS3c.js";
+import { a as selectMergedAdvancingSessions, t as init_reap_terminal_sessions } from "./reap-terminal-sessions-N3BTkmX_.js";
 import { Effect } from "effect";
 //#region ../../lib/cloister/advancing-selfheal.ts
 init_agents();
@@ -135,4 +135,4 @@ async function runBootAdvancingSelfHeal(deps = defaultBootAdvancingSelfHealDeps)
 //#endregion
 export { checkMergedAdvancingSessions, markAdvancingSessionStopped, reconcileInFlightJournals, runBootAdvancingSelfHeal };
 
-//# sourceMappingURL=advancing-selfheal-CPOBO5ZS.js.map
+//# sourceMappingURL=advancing-selfheal-BBu6DSNm.js.map

package/server/{agent-gc-D6PUckBB.js → agent-gc-BV1q_2EV.js}

@@ -1,6 +1,6 @@
-import { At as init_record, Pt as readIssueRecordForWorkspaceSync } from "./config-yaml-Ciyp2mYe.js";
-import { c as listAllAgentsSync, l as removeAgentSync, o as init_agents } from "./agents-DbrHWunF.js";
-import { i as resolveGitHubIssueSync, n as init_tracker_utils } from "./tracker-utils-DiceZN3a.js";
+import { Mt as readIssueRecordForWorkspaceSync, Ot as init_record } from "./config-yaml-DvyMuOle.js";
+import { c as listAllAgentsSync, l as removeAgentSync, o as init_agents } from "./agents-B4Bjbkfv.js";
+import { i as resolveGitHubIssueSync, n as init_tracker_utils } from "./tracker-utils-tnxxqROg.js";
 import { n as mapGitHubStateToCanonical, t as init_state_mapping } from "./state-mapping-BL_-3Yt8.js";
 import { readdir, readlink } from "fs/promises";
 import { execFile } from "child_process";
@@ -112,4 +112,4 @@ function pruneTerminalStoppedAgents() {
 //#endregion
 export { pidsWithCwdUnder as a, sweepAutoCloseOutCache as i, pruneTerminalStoppedAgents as n, getAutoCloseOutCanonicalState as r, pruneStoppedAgentsForIssue as t };
 
-//# sourceMappingURL=agent-gc-D6PUckBB.js.map
+//# sourceMappingURL=agent-gc-BV1q_2EV.js.map

package/server/agent-state-Bg0lhqwj.js

@@ -0,0 +1,3 @@
+import { Fn as clearAgentPausedSync, Gn as init_agent_state, Ln as clearAgentTroubledSync, Wn as getAgentStateSync, or as setAgentPausedSync } from "./queries-6d7Cdtm7.js";
+init_agent_state();
+export { clearAgentPausedSync, clearAgentTroubledSync, getAgentStateSync, setAgentPausedSync };

package/server/{agent-state-service-DHwemt96.js → agent-state-service-CnzFKSAQ.js}

@@ -1,2 +1,2 @@
-import { n as AgentStateServiceLive, r as getRuntimeSnapshot, t as AgentStateService } from "./agent-state-service-6MFQqnFy.js";
+import { n as AgentStateServiceLive, r as getRuntimeSnapshot, t as AgentStateService } from "./agent-state-service-HoK8U4jW.js";
 export { AgentStateService, AgentStateServiceLive, getRuntimeSnapshot };

package/server/{agent-state-service-6MFQqnFy.js → agent-state-service-HoK8U4jW.js}

@@ -1,6 +1,6 @@
-import { a as init_event_store, i as initEventStore } from "./event-store-BVnON3vf.js";
-import { l as INITIAL_READ_MODEL_STATE, t as init_src, u as applyEvent } from "./src-Dpq1yFIl.js";
-import { f as markAgentStateServiceInProcess, l as getRuntimeSnapshot$1, p as setAgentRuntimeMirror, r as init_session_history, t as appendSessionIdToHistory, u as init_agent_runtime_mirror } from "./session-history-DUehL3KN.js";
+import { a as init_event_store, i as initEventStore } from "./event-store-tdiY5eDZ.js";
+import { d as applyEvent, t as init_src, u as INITIAL_READ_MODEL_STATE } from "./src-U7_kTPEE.js";
+import { f as markAgentStateServiceInProcess, l as getRuntimeSnapshot$1, p as setAgentRuntimeMirror, r as init_session_history, t as appendSessionIdToHistory, u as init_agent_runtime_mirror } from "./session-history-CVZDpS3c.js";
 import { Context, Effect, Layer, SubscriptionRef } from "effect";
 //#region services/agent-state-service.ts
 /**
@@ -58,7 +58,7 @@ const AgentStateServiceLive = Layer.effect(AgentStateService, Effect.gen(functio
 	const store = yield* Effect.promise(() => initEventStore());
 	const ref = yield* SubscriptionRef.make({});
 	const seedFromSources = Effect.gen(function* () {
-		const { reconstructCacheAuto } = yield* Effect.promise(() => import("./reconstruct-cache-BqrCQt0o.js"));
+		const { reconstructCacheAuto } = yield* Effect.promise(() => import("./reconstruct-cache-uWbZfjms.js"));
 		const seeded = (yield* Effect.promise(() => reconstructCacheAuto())).agentRuntimeById;
 		if (Object.keys(seeded).length > 0) {
 			yield* SubscriptionRef.update(ref, (current) => mergeRuntimeBySequence(current, seeded));
@@ -107,4 +107,4 @@ function applyEventToRef(ref, ev) {
 //#endregion
 export { AgentStateServiceLive as n, getRuntimeSnapshot as r, AgentStateService as t };
 
-//# sourceMappingURL=agent-state-service-6MFQqnFy.js.map
+//# sourceMappingURL=agent-state-service-HoK8U4jW.js.map

package/server/{agents-DbrHWunF.js → agents-B4Bjbkfv.js}

@@ -1,7 +1,7 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ei as getOverdeckHome, ti as init_paths } from "./config-yaml-Ciyp2mYe.js";
-import { _ as integer, a as EventBus, b as and, c as Records, d as getOverdeckDatabaseSync, f as init_infra, h as text, l as Tmux, m as sqliteTable, p as init_sqlite_core, r as Db, v as init_drizzle_orm, x as eq } from "./infra-DN2wSxle.js";
-import { n as init_issues, t as IssueId } from "./issues-XYtFMxrH.js";
+import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DvyMuOle.js";
+import { _ as integer, a as EventBus, b as and, c as Records, d as getOverdeckDatabaseSync, f as init_infra, h as text, l as Tmux, m as sqliteTable, p as init_sqlite_core, r as Db, v as init_drizzle_orm, x as eq } from "./infra-CzaSOgul.js";
+import { n as init_issues, t as IssueId } from "./issues-B6ToV6x1.js";
 import { join } from "node:path";
 import { Context, Effect, Layer, Schema } from "effect";
 import { readFileSync, readdirSync, rmSync, statSync } from "node:fs";
@@ -972,4 +972,4 @@ var init_agents = __esmMin((() => {
 //#endregion
 export { countAgentsByStatusRole as a, listAllAgentsSync as c, isTerminalIssueStage as d, countAgentsByStatus as i, removeAgentSync as l, AgentsResolverLive as n, init_agents as o, backfillAgentsSync as r, listAgentIdsByPrefixSync as s, AgentsResolver as t, getIssueStageSync as u };
 
-//# sourceMappingURL=agents-DbrHWunF.js.map
+//# sourceMappingURL=agents-B4Bjbkfv.js.map

package/server/agents-FlIgQ3ql.js

@@ -0,0 +1,3 @@
+import { $ as appendActivity, $n as recordAgentFailure, $t as OHMYPI_AGENT_READY_TIMEOUT_SECONDS, An as writeChannelsBridgeMcpConfig, At as deliverAgentPermissionDecision, B as detectCrashedAgents, Bn as getAgentDir, Bt as assertWorkspaceStackHealthyForSpawn, C as replayCrashedStandingAgent, Cr as getAgentRuntimeStateSync, Dn as decideChannelsForWorkAgent, En as buildDefaultResumeContinueMessage, Fn as clearAgentPausedSync, G as resumeAgent, Gt as transitionIssueToInProgress, H as restartAgent, Hn as getAgentState, In as clearAgentTroubled, Jn as isRole, Kn as isAgentPaused, Kt as transitionIssueToInReview, Ln as clearAgentTroubledSync, Mn as SESSION_EXITED_BEFORE_KICKOFF, Mt as deliverResumeMessageWithTranscriptConfirmation, Nn as __testInternals, Nt as setAgentDeliveryMethod, On as decideSupervisorForWorkAgent, Pn as clearAgentPaused, Qn as markAgentTroubled, Rn as clearYieldForResumeSync, S as contextWindowForModel, Sr as getAgentRuntimeState, T as shouldReplayCompactAtTierRunBoundary, Tr as saveAgentRuntimeState, U as buildCompactRecoverySeed, Un as getAgentStateFilePath, V as recoverAgent, Vt as buildAgentLaunchConfig, Wn as getAgentStateSync, Wt as retrieveSpawnTimeMemoryContext, X as messageAgent, Xn as markAgentRunningState, Zn as markAgentStoppedState, _n as buildSpawnEnvForModel, _r as isQualifiedAgentId, a as listRunningAgentsSync, an as getRoleRuntimeBaseCommand, ar as setAgentPaused, at as saveSessionId, b as init_agents, bn as getProviderExportsForModel, br as waitForAgentIdle, cn as roleAgentDefinitionPath, cr as wipeAgentStateDirs, en as describeOhmypiSpawnFailure, er as recordAgentFailureSync, et as getActivity, ft as stopAgent, gn as buildCavemanExports, gr as clearReadySignal, i as listRunningAgents, in as getProviderAuthMode, ir as saveAgentStateSync, jn as GOVERNOR_SLOT_PAUSE_REASON_PREFIX, jt as deliverInitialPromptWithRetry, kn as dismissDevChannelsDialog, kt as deliverAgentMessage, ln as waitForPromptReady, lr as writeAgentStateJsonSync, lt as spawnAgent, nr as resetAgentFailureCount, nt as getLatestSessionIdSync, o as warnOnBareNumericIssueIds, or as setAgentPausedSync, pt as stopAgentSync, qn as isAgentTroubled, r as listAgentStates, rr as saveAgentState, rt as getSessionId, sn as injectPiConversationMemory, sr as setAgentYieldedSync, t as dropLegacyAgentStatesMissingRoleAsync, tn as getAgentRuntimeBaseCommand, tt as getLatestSessionId, ut as spawnRun, vn as determineModel, vr as normalizeAgentId, w as replayStandingAgent, x as compactAtTierRunBoundary, xn as getProviderTmuxFlags, xr as waitForReadySignal, yn as getProviderEnvForModel, yr as resolveAgentTargetSync, z as autoRecoverAgents } from "./queries-6d7Cdtm7.js";
+init_agents();
+export { GOVERNOR_SLOT_PAUSE_REASON_PREFIX, OHMYPI_AGENT_READY_TIMEOUT_SECONDS, SESSION_EXITED_BEFORE_KICKOFF, __testInternals, appendActivity, assertWorkspaceStackHealthyForSpawn, autoRecoverAgents, buildAgentLaunchConfig, buildCavemanExports, buildCompactRecoverySeed, buildDefaultResumeContinueMessage, buildSpawnEnvForModel, clearAgentPaused, clearAgentPausedSync, clearAgentTroubled, clearAgentTroubledSync, clearReadySignal, clearYieldForResumeSync, compactAtTierRunBoundary, contextWindowForModel, decideChannelsForWorkAgent, decideSupervisorForWorkAgent, deliverAgentMessage, deliverAgentPermissionDecision, deliverInitialPromptWithRetry, deliverResumeMessageWithTranscriptConfirmation, describeOhmypiSpawnFailure, detectCrashedAgents, determineModel, dismissDevChannelsDialog, dropLegacyAgentStatesMissingRoleAsync, getActivity, getAgentDir, getAgentRuntimeBaseCommand, getAgentRuntimeState, getAgentRuntimeStateSync, getAgentState, getAgentStateFilePath, getAgentStateSync, getLatestSessionId, getLatestSessionIdSync, getProviderAuthMode, getProviderEnvForModel, getProviderExportsForModel, getProviderTmuxFlags, getRoleRuntimeBaseCommand, getSessionId, injectPiConversationMemory, isAgentPaused, isAgentTroubled, isQualifiedAgentId, isRole, listAgentStates, listRunningAgents, listRunningAgentsSync, markAgentRunningState, markAgentStoppedState, markAgentTroubled, messageAgent, normalizeAgentId, recordAgentFailure, recordAgentFailureSync, recoverAgent, replayCrashedStandingAgent, replayStandingAgent, resetAgentFailureCount, resolveAgentTargetSync, restartAgent, resumeAgent, retrieveSpawnTimeMemoryContext, roleAgentDefinitionPath, saveAgentRuntimeState, saveAgentState, saveAgentStateSync, saveSessionId, setAgentDeliveryMethod, setAgentPaused, setAgentPausedSync, setAgentYieldedSync, shouldReplayCompactAtTierRunBoundary, spawnAgent, spawnRun, stopAgent, stopAgentSync, transitionIssueToInProgress, transitionIssueToInReview, waitForAgentIdle, waitForPromptReady, waitForReadySignal, warnOnBareNumericIssueIds, wipeAgentStateDirs, writeAgentStateJsonSync, writeChannelsBridgeMcpConfig };

package/server/{archive-planning-BOnwJq8M.js → archive-planning-DYrYojxl.js}

@@ -1,8 +1,8 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ar as ARCHIVES_DIR, Br as PROJECT_PRDS_ACTIVE_SUBDIR, Hr as PROJECT_PRDS_PLANNED_SUBDIR, Ur as PROJECT_PRDS_SUBDIR, Vr as PROJECT_PRDS_COMPLETED_SUBDIR, ti as init_paths, zr as PROJECT_DOCS_SUBDIR } from "./config-yaml-Ciyp2mYe.js";
-import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME, u as PAN_SPEC_FILENAME } from "./types-DqeBMmJN.js";
-import { t as init_pan_dir } from "./pan-dir-Rw17YjT1.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed } from "./types-BjaZ1oqH.js";
+import { Dr as PROJECT_PRDS_COMPLETED_SUBDIR, Er as PROJECT_PRDS_ACTIVE_SUBDIR, Or as PROJECT_PRDS_PLANNED_SUBDIR, Tr as PROJECT_DOCS_SUBDIR, Vr as init_paths, gr as ARCHIVES_DIR, kr as PROJECT_PRDS_SUBDIR } from "./config-yaml-DvyMuOle.js";
+import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME, u as PAN_SPEC_FILENAME } from "./types-hraoaQIp.js";
+import { a as getDraftPath, o as getIssueDraftPath, t as init_pan_dir } from "./pan-dir-DeVUgwA7.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed } from "./types-BBNjPcqU.js";
 import { Effect } from "effect";
 import { existsSync, readdirSync } from "fs";
 import { dirname, join } from "path";
@@ -66,6 +66,30 @@ function findPrdAtStatusSync(projectPath, issueId, status) {
 	for (const c of candidates) if (existsSync(c.path)) return c;
 	return null;
 }
+function findDraftPrdSync(projectPath, issueId) {
+	const candidates = [getIssueDraftPath(projectPath, issueId), getDraftPath(projectPath, `${issueId.toLowerCase()}.md`)];
+	for (const path of candidates) if (existsSync(path)) return {
+		path,
+		format: "pan-draft",
+		status: "draft"
+	};
+	return null;
+}
+/**
+* Find a PRD across all lifecycle statuses, in priority order:
+* active → completed → planned → draft. Returns the first match or null.
+*/
+function findPrdAnywhereSync(projectPath, issueId) {
+	for (const status of [
+		"active",
+		"completed",
+		"planned"
+	]) {
+		const loc = findPrdAtStatusSync(projectPath, issueId, status);
+		if (loc) return loc;
+	}
+	return findDraftPrdSync(projectPath, issueId);
+}
 var STATUS_DIRS;
 var init_prd_locations = __esmMin((() => {
 	init_paths();
@@ -168,7 +192,7 @@ async function movePrdImpl(ctx, opts) {
 		}
 		await execAsync(`git commit -m "Move ${ctx.issueId} PRD to completed"`, { cwd: ctx.projectPath });
 		if (pushToRemote) await execAsync("git push", { cwd: ctx.projectPath });
-		return stepOk(step, [`Moved ${formatLabel} from active/ to completed/ via git mv${resolvedSidecarSource ? " (with vBRIEF sidecar)" : ""}`]);
+		return stepOk(step, [`Moved ${formatLabel} from active/ to completed/ via git mv${resolvedSidecarSource ? " (with xBRIEF sidecar)" : ""}`]);
 	} catch {
 		try {
 			await cp(source.path, dest, { recursive: true });
@@ -264,6 +288,6 @@ var init_archive_planning = __esmMin((() => {
 	execAsync = promisify(exec);
 }));
 //#endregion
-export { inferBranchFromWorkspace as a, findPrdAtStatusSync as c, findWorkspacePath as i, init_prd_locations as l, archiveWorkspaceArtifacts as n, init_archive_planning as o, findAllWorkspacePaths as r, movePrd as s, archivePlanning as t };
+export { inferBranchFromWorkspace as a, findPrdAnywhereSync as c, findWorkspacePath as i, init_prd_locations as l, archiveWorkspaceArtifacts as n, init_archive_planning as o, findAllWorkspacePaths as r, movePrd as s, archivePlanning as t };
 
-//# sourceMappingURL=archive-planning-BOnwJq8M.js.map
+//# sourceMappingURL=archive-planning-DYrYojxl.js.map

package/server/{archive-planning-MPpvQJL4.js → archive-planning-zkJb3BeM.js}

@@ -1,3 +1,3 @@
-import { i as findWorkspacePath, o as init_archive_planning } from "./archive-planning-BOnwJq8M.js";
+import { i as findWorkspacePath, o as init_archive_planning } from "./archive-planning-DYrYojxl.js";
 init_archive_planning();
 export { findWorkspacePath };

package/server/{artifact-index-jobs-BOoySTKD.js → artifact-index-jobs-C-xy7Z5v.js}

@@ -1,4 +1,4 @@
-import { ei as getOverdeckHome, ti as init_paths } from "./config-yaml-Ciyp2mYe.js";
+import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DvyMuOle.js";
 import { n as openDatabase, t as init_driver } from "./driver-CKVGi51s.js";
 import { dirname, join } from "node:path";
 import { mkdirSync } from "node:fs";
@@ -208,4 +208,4 @@ function unshareArtifactBySlugJob(slug) {
 //#endregion
 export { getArtifactBySlugJob, listArtifactsForWorkspaceOrIssueJob, unshareArtifactBySlugJob };
 
-//# sourceMappingURL=artifact-index-jobs-BOoySTKD.js.map
+//# sourceMappingURL=artifact-index-jobs-C-xy7Z5v.js.map

package/server/{backlog-auto-trigger-BUaFI44J.js → backlog-auto-trigger-GtG71X8H.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-BnInAFKs.js";
-import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-Bpz0yGmG.js";
+import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-Cx3K0hHi.js";
+import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-BGY8gjg-.js";
 //#region ../../lib/backlog/backlog-auto-trigger.ts
 /**
 * PAN-2396: --no-resume is the operator's full-quiescence escape hatch —
@@ -37,4 +37,4 @@ __esmMin((() => {
 }))();
 export { triggerDebouncedIncrementalPass };
 
-//# sourceMappingURL=backlog-auto-trigger-BUaFI44J.js.map
+//# sourceMappingURL=backlog-auto-trigger-GtG71X8H.js.map

package/server/{behavior-Dg-D8eBG.js → behavior-B_-4EKF3.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { t as init_src } from "./src-Dpq1yFIl.js";
+import { t as init_src } from "./src-U7_kTPEE.js";
 //#region ../../lib/runtimes/behavior.ts
 var init_behavior = __esmMin((() => {
 	init_src();
@@ -7,4 +7,4 @@ var init_behavior = __esmMin((() => {
 //#endregion
 export { init_behavior as t };
 
-//# sourceMappingURL=behavior-Dg-D8eBG.js.map
+//# sourceMappingURL=behavior-B_-4EKF3.js.map

package/server/{briefing-freshness-OouGbJ7d.js → briefing-freshness-DWdW7vUm.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ei as getOverdeckHome, ti as init_paths } from "./config-yaml-Ciyp2mYe.js";
+import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DvyMuOle.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { mkdir, readFile, rename, stat, writeFile } from "fs/promises";
@@ -128,4 +128,4 @@ var init_briefing_freshness = __esmMin((() => {
 //#endregion
 export { resolveSessionContextBriefingPath as a, recordBriefingSessionStart as i, ensureSessionContextBriefingFile as n, init_briefing_freshness as r, appendFreshBriefingUpdate as t };
 
-//# sourceMappingURL=briefing-freshness-OouGbJ7d.js.map
+//# sourceMappingURL=briefing-freshness-DWdW7vUm.js.map

package/server/{build-info-27NlbKhV.js → build-info-BT096lEl.js}

@@ -2,12 +2,12 @@ import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
 //#region ../../lib/deploy/build-info.ts
 function getBuildInfo() {
 	return {
-		buildCommit: "728294f95c4da89583ad5ec2d68679b7a8e02851",
-		builtAt: "2026-07-17T09:39:54.319Z"
+		buildCommit: "3824685a47cd1a723b2a2ef7e57d46abf82957ae",
+		builtAt: "2026-07-20T03:34:02.499Z"
 	};
 }
 var init_build_info = __esmMin((() => {}));
 //#endregion
 export { init_build_info as n, getBuildInfo as t };
 
-//# sourceMappingURL=build-info-27NlbKhV.js.map
+//# sourceMappingURL=build-info-BT096lEl.js.map

package/server/{build-info-Cv6CI7Gu.js → build-info-DgTqZkL5.js}

@@ -1,3 +1,3 @@
-import { n as init_build_info, t as getBuildInfo } from "./build-info-27NlbKhV.js";
+import { n as init_build_info, t as getBuildInfo } from "./build-info-BT096lEl.js";
 init_build_info();
 export { getBuildInfo };

package/server/{checkpoint-manager-C7mFCY_E.js → checkpoint-manager-B7Bt29J0.js}

@@ -1,3 +1,3 @@
-import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-D64fCC4p.js";
+import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-DDqcGyu8.js";
 init_checkpoint_manager();
 export { deleteLegacyCheckpointRefs, diffCheckpointFiles, getCheckpointTimestamp, listCheckpoints, pruneCheckpointRefsForAgents, pruneStaleCheckpointRefs };

package/server/{checkpoint-manager-D64fCC4p.js → checkpoint-manager-DDqcGyu8.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Dr as VcsError, Or as init_errors, cn as STATE_BRANCH_PATHS, dn as init_state_plane, hr as CheckpointError, xr as InvalidAgentIdError } from "./config-yaml-Ciyp2mYe.js";
+import { Kt as STATE_BRANCH_PATHS, Yt as init_state_plane, mr as init_errors, pr as VcsError, sr as InvalidAgentIdError, tr as CheckpointError } from "./config-yaml-DvyMuOle.js";
 import { Effect, Layer } from "effect";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -663,4 +663,4 @@ var init_checkpoint_manager = __esmMin((() => {
 //#endregion
 export { pruneStaleCheckpointRefs as _, diffAgainstMain as a, diffCheckpoints as c, diffPatchSinceCommit as d, findCommitAtTime as f, pruneCheckpointRefsForAgents as g, listCheckpoints as h, deleteLegacyCheckpointRefs as i, diffFilesAgainstHead as l, init_checkpoint_manager as m, checkpointStateExclusions as n, diffAgainstMainFiles as o, getCheckpointTimestamp as p, deleteCheckpoint as r, diffCheckpointFiles as s, captureCheckpoint as t, diffPatchFilesAgainstHead as u };
 
-//# sourceMappingURL=checkpoint-manager-D64fCC4p.js.map
+//# sourceMappingURL=checkpoint-manager-DDqcGyu8.js.map

package/server/checkpoint-worker.js

@@ -1,4 +1,4 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-Vh-J15ge.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-C-AXLfYT.js";
 import { parentPort } from "node:worker_threads";
 //#region ../../lib/memory/checkpoint-worker.ts
 function runOperation(operation, payload) {

package/server/{checkpoints-Vh-J15ge.js → checkpoints-C-AXLfYT.js}

@@ -1,4 +1,4 @@
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-DN2wSxle.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CzaSOgul.js";
 import { randomUUID } from "node:crypto";
 //#region ../../lib/overdeck/transcript-checkpoint-sync.ts
 /**
@@ -195,4 +195,4 @@ function getTranscriptCheckpoint(sessionId) {
 //#endregion
 export { releaseTranscriptRange as a, listTranscriptCheckpoints as i, commitTranscriptRange as n, getTranscriptCheckpoint as r, claimTranscriptRange as t };
 
-//# sourceMappingURL=checkpoints-Vh-J15ge.js.map
+//# sourceMappingURL=checkpoints-C-AXLfYT.js.map

package/server/{checkpoints-DwZqT2qQ.js → checkpoints-CpgCjAlN.js}

@@ -1,2 +1,2 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-Vh-J15ge.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-C-AXLfYT.js";
 export { claimTranscriptRange, commitTranscriptRange, getTranscriptCheckpoint, listTranscriptCheckpoints, releaseTranscriptRange };

package/server/{claude-hooks-provision-CS5W_dhI.js → claude-hooks-provision-C8wdRnN1.js}

@@ -1,3 +1,3 @@
-import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-BVLGfHrv.js";
+import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-but-_qGY.js";
 init_claude_hooks_provision();
 export { provisionClaudeHooks };

package/server/{claude-hooks-provision-BVLGfHrv.js → claude-hooks-provision-but-_qGY.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Gr as SYNC_SOURCES, jr as BIN_DIR, ti as init_paths } from "./config-yaml-Ciyp2mYe.js";
+import { Vr as init_paths, _r as BIN_DIR, jr as SYNC_SOURCES } from "./config-yaml-DvyMuOle.js";
 import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
@@ -375,4 +375,4 @@ var init_claude_hooks_provision = __esmMin((() => {
 //#endregion
 export { provisionClaudeHooks as n, init_claude_hooks_provision as t };
 
-//# sourceMappingURL=claude-hooks-provision-BVLGfHrv.js.map
+//# sourceMappingURL=claude-hooks-provision-but-_qGY.js.map

package/server/{claude-permissions-C2OrLYKL.js → claude-permissions-H_5wHQZQ.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-Ciyp2mYe.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-DvyMuOle.js";
 import "effect";
 //#region ../../lib/claude-permissions.ts
 /** Read PAN_YOLO from the current process env. Returns the implied mode, or undefined if unset/unparseable. */
@@ -94,4 +94,4 @@ var init_claude_permissions = __esmMin((() => {
 //#endregion
 export { init_claude_permissions as a, getClaudePermissionFlagsSync as i, buildClaudeUserSettingsSync as n, resolvePermissionModeSync as o, getClaudePermissionFlagsStringSync as r, BYPASS_PERMISSION_MODE as t };
 
-//# sourceMappingURL=claude-permissions-C2OrLYKL.js.map
+//# sourceMappingURL=claude-permissions-H_5wHQZQ.js.map

package/server/{claude-settings-overlay-DWXjafJh.js → claude-settings-overlay-BTENVmYf.js}

@@ -1,3 +1,3 @@
-import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-DX-fMFpC.js";
+import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CbSz0Dvb.js";
 init_claude_settings_overlay();
 export { injectOverdeckInfraDeny };

package/server/{claude-settings-overlay-DX-fMFpC.js → claude-settings-overlay-CbSz0Dvb.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Or as init_errors, vr as FsError } from "./config-yaml-Ciyp2mYe.js";
+import { ir as FsError, mr as init_errors } from "./config-yaml-DvyMuOle.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
 import { homedir, tmpdir } from "os";
@@ -142,4 +142,4 @@ var init_claude_settings_overlay = __esmMin((() => {
 //#endregion
 export { init_claude_settings_overlay as n, injectOverdeckInfraDeny as r, detectProviderEnvConflicts as t };
 
-//# sourceMappingURL=claude-settings-overlay-DX-fMFpC.js.map
+//# sourceMappingURL=claude-settings-overlay-CbSz0Dvb.js.map

package/server/cli-BsVIHwzC.js

@@ -0,0 +1,3 @@
+import { r as init_cli, t as createResetMarker } from "./cli-vBeXbPrq.js";
+init_cli();
+export { createResetMarker };

package/server/{cli-mvpEOb3w.js → cli-vBeXbPrq.js}

@@ -1,11 +1,11 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ti as init_paths } from "./config-yaml-Ciyp2mYe.js";
-import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-FP8v3lTz.js";
-import { s as init_agents } from "./queries-B5hl7lMQ.js";
-import { i as init_settings } from "./settings-DP2OYLXL.js";
-import { r as init_health, t as init_providers } from "./providers-d3pwXGVE.js";
-import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-6ponMie2.js";
-import { r as init_rollup } from "./rollup-CLj_AK9f.js";
+import { Vr as init_paths } from "./config-yaml-DvyMuOle.js";
+import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-_zEts6wc.js";
+import { b as init_agents } from "./queries-6d7Cdtm7.js";
+import { i as init_settings } from "./settings-BZ5m1UCl.js";
+import { r as init_health, t as init_providers } from "./providers-DV7ec8l7.js";
+import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-CKgg0VKg.js";
+import { r as init_rollup } from "./rollup-WA0VD-Rr.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { readFile, rename, writeFile } from "fs/promises";
@@ -194,7 +194,7 @@ async function writeResetMarkerToFtsDb(projectId, marker) {
 	});
 }
 async function emitResetMarkerCreated(marker, timestamp) {
-	const { initEventStore } = await import("./event-store-DABarGNz.js");
+	const { initEventStore } = await import("./event-store-Cr5PQwFC.js");
 	await (await initEventStore()).appendAsync({
 		type: "memory.reset_marker_created",
 		timestamp,
@@ -221,4 +221,4 @@ var init_cli = __esmMin((() => {
 //#endregion
 export { generateDailySummary as n, init_cli as r, createResetMarker as t };
 
-//# sourceMappingURL=cli-mvpEOb3w.js.map
+//# sourceMappingURL=cli-vBeXbPrq.js.map

package/server/{cliproxy-Dvsr4ZkW.js → cliproxy-Bgb2XCqi.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Or as init_errors, Rr as OVERDECK_HOME, jr as BIN_DIR, ti as init_paths, vr as FsError, wr as ProcessSpawnError } from "./config-yaml-Ciyp2mYe.js";
+import { Vr as init_paths, _r as BIN_DIR, ir as FsError, mr as init_errors, ur as ProcessSpawnError, wr as OVERDECK_HOME } from "./config-yaml-DvyMuOle.js";
 import { Data, Effect } from "effect";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -496,4 +496,4 @@ var init_cliproxy = __esmMin((() => {
 //#endregion
 export { restartCliproxy as C, readPidFile as S, stopCliproxy as T, getCliproxyPidPath as _, CliproxyError as a, isCliproxyInstalled as b, bridgeGeminiAuthToCliproxy as c, getCliproxyAuthDir as d, getCliproxyBinary as f, getCliproxyLogPath as g, getCliproxyDir as h, CLIPROXY_PORT as i, decodeJwtPayload as l, getCliproxyConfigPath as m, CLIPROXY_BASE_URL as n, bridgeCodexAuthToCliproxy as o, getCliproxyClientEnv as p, CLIPROXY_HOST as r, bridgeCodexAuthToCliproxySync as s, CLIPROXY_AUTH_TOKEN as t, detectPlatformAsset as u, init_cliproxy as v, startCliproxy as w, isCliproxyRunning as x, installCliproxy as y };
 
-//# sourceMappingURL=cliproxy-Dvsr4ZkW.js.map
+//# sourceMappingURL=cliproxy-Bgb2XCqi.js.map

package/server/{cliproxy-7g1nObvB.js → cliproxy-DW0V86F8.js}

@@ -1,3 +1,3 @@
-import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-Dvsr4ZkW.js";
+import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-Bgb2XCqi.js";
 init_cliproxy();
 export { isCliproxyRunning };

package/server/{close-issue-8F6uawYj.js → close-issue-Dn_4c4G8.js}

@@ -1,6 +1,6 @@
-import { cr as extractPrefixSync, lr as init_issue_id, sr as extractNumberSync, ur as normalizeIssueIdSync } from "./config-yaml-Ciyp2mYe.js";
-import { Rn as markAgentStoppedState, Wn as saveAgentState, kn as getAgentState, s as init_agents } from "./queries-B5hl7lMQ.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-BjaZ1oqH.js";
+import { Jn as extractPrefixSync, Xn as normalizeIssueIdSync, Yn as init_issue_id, qn as extractNumberSync } from "./config-yaml-DvyMuOle.js";
+import { Hn as getAgentState, Zn as markAgentStoppedState, b as init_agents, rr as saveAgentState } from "./queries-6d7Cdtm7.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-BBNjPcqU.js";
 import { Effect } from "effect";
 import { exec } from "child_process";
 import { promisify } from "util";
@@ -227,7 +227,7 @@ function closeRallyDirect(ctx) {
 async function closeRallyDirectImpl(ctx) {
 	const step = "close-issue:transition";
 	if (!ctx.rally) return stepFailed(step, "Rally config not provided");
-	const { RallyTracker } = await import("./rally-DGimSRBQ.js");
+	const { RallyTracker } = await import("./rally-njs_mJrt.js");
 	const tracker = new RallyTracker({
 		apiKey: ctx.rally.apiKey,
 		server: ctx.rally.server,
@@ -327,4 +327,4 @@ async function applyLabelLinearImpl(ctx, apiKey) {
 //#endregion
 export { closeIssue as t };
 
-//# sourceMappingURL=close-issue-8F6uawYj.js.map
+//# sourceMappingURL=close-issue-Dn_4c4G8.js.map

package/server/{closed-issue-reaper-BhV-r-tC.js → closed-issue-reaper-CWpY2uBw.js}

@@ -1,2 +1,2 @@
-import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-BaYQYF6w.js";
+import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-hANY_ehE.js";
 export { handleIssueStatusChangedClosed };

package/server/{closed-issue-reaper-BaYQYF6w.js → closed-issue-reaper-hANY_ehE.js}

@@ -1,12 +1,12 @@
-import { At as init_record, Lt as resolveProjectForIssue, Un as listProjectsSync, kr as AGENTS_DIR, lr as init_issue_id, ti as init_paths, zn as init_projects } from "./config-yaml-Ciyp2mYe.js";
+import { Ft as resolveProjectForIssue, Ot as init_record, Tn as init_projects, Vr as init_paths, Yn as init_issue_id, hr as AGENTS_DIR, kn as listProjectsSync } from "./config-yaml-DvyMuOle.js";
 import { a as init_activity_logger, n as emitActivityEntrySync } from "./activity-logger-DDlOIAML.js";
-import { D as killSession, j as listSessionNames, w as init_tmux } from "./tmux-y1blSxks.js";
-import { c as init_review_status, u as loadReviewStatuses } from "./review-status-CCgPVK1h.js";
-import { $ as stopAgent, i as listRunningAgents, s as init_agents } from "./queries-B5hl7lMQ.js";
-import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-ClwPQaba.js";
-import { l as init_prd_locations, o as init_archive_planning } from "./archive-planning-BOnwJq8M.js";
-import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-Dfw3QDyZ.js";
-import "./close-issue-8F6uawYj.js";
+import { D as killSession, M as listSessionNames, w as init_tmux } from "./tmux-ftABRAmc.js";
+import { d as loadReviewStatuses, l as init_review_status } from "./review-status-A7quS5KJ.js";
+import { b as init_agents, ft as stopAgent, i as listRunningAgents } from "./queries-6d7Cdtm7.js";
+import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-BK7HIcBj.js";
+import { l as init_prd_locations, o as init_archive_planning } from "./archive-planning-DYrYojxl.js";
+import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-zhdvQicO.js";
+import "./close-issue-Dn_4c4G8.js";
 import { join } from "node:path";
 import { Data, Effect } from "effect";
 import "fs";
@@ -414,4 +414,4 @@ async function reconcileClosedIssueAgents() {
 //#endregion
 export { reconcileClosedIssueAgents as n, handleIssueStatusChangedClosed as t };
 
-//# sourceMappingURL=closed-issue-reaper-BaYQYF6w.js.map
+//# sourceMappingURL=closed-issue-reaper-hANY_ehE.js.map

package/server/codex-Dg7Is5yb.js

@@ -0,0 +1,3 @@
+import { a as extractThreadIdFromRollout, c as initCodexHome, l as init_codex, m as writeThreadId, o as findLatestRollout, p as waitForCodexRollout, s as findRolloutPath } from "./codex-TmSi-yTv.js";
+init_codex();
+export { extractThreadIdFromRollout, findLatestRollout, findRolloutPath, initCodexHome, waitForCodexRollout, writeThreadId };

package/server/{codex-D_UBEOwL.js → codex-TmSi-yTv.js}

@@ -1,8 +1,9 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Or as init_errors, h as jsYaml, m as init_js_yaml } from "./config-yaml-Ciyp2mYe.js";
-import { r as CODEX_BEHAVIOR } from "./src-Dpq1yFIl.js";
-import { r as parseCodexSessionSync, t as init_codex_parser } from "./codex-parser-BTzlOZiV.js";
-import { t as init_behavior } from "./behavior-Dg-D8eBG.js";
+import { h as jsYaml, m as init_js_yaml, mr as init_errors } from "./config-yaml-DvyMuOle.js";
+import { i as CODEX_BEHAVIOR } from "./src-U7_kTPEE.js";
+import { r as parseCodexSessionSync, t as init_codex_parser } from "./codex-parser-C4gSH-IR.js";
+import { t as init_behavior } from "./behavior-B_-4EKF3.js";
+import { n as init_harness_binary, r as prepareHarnessLaunch } from "./harness-binary-CVio2m-u.js";
 import { basename, dirname, join } from "node:path";
 import "effect";
 import { homedir } from "node:os";
@@ -231,6 +232,7 @@ function walkForThread(dir, threadId) {
 *     config.toml   — Codex settings (approval_policy, sandbox_mode, project
 *                     trust, notify hooks)
 *     AGENTS.md     — Populated by context-layering bead; placeholder for now
+*     rules/        — Symlink to the user's global Codex execpolicy rules
 *     sessions/     — Codex writes rollout JSONL here
 */
 function initCodexHome(codexHomeDir, opts = {}) {
@@ -279,7 +281,9 @@ function initCodexHome(codexHomeDir, opts = {}) {
 		lines.push("");
 		writeFileSync(configPath, lines.join("\n"), { mode: 384 });
 	}
-	seedCodexAuthSymlink(join(codexHomeDir, "auth.json"), join(homedir(), ".codex", "auth.json"));
+	const globalCodexHome = join(homedir(), ".codex");
+	seedCodexAuthSymlink(join(codexHomeDir, "auth.json"), join(globalCodexHome, "auth.json"));
+	seedCodexRulesSymlink(join(codexHomeDir, "rules"), join(globalCodexHome, "rules"));
 	const agentsMdPath = join(codexHomeDir, "AGENTS.md");
 	if (!existsSync(agentsMdPath)) {
 		const globalCodexContext = join(homedir(), ".overdeck", "context", "codex-global.md");
@@ -322,6 +326,22 @@ function seedCodexAuthSymlink(homeAuthPath, globalAuthPath) {
 	} catch {}
 }
 /**
+* Share user-approved Codex execpolicy rules with an isolated managed home.
+* Existing per-agent rule state is preserved rather than replaced: rules can
+* authorize out-of-sandbox execution, so Overdeck must never silently discard
+* or redirect a rule directory it did not create.
+*/
+function seedCodexRulesSymlink(homeRulesPath, globalRulesPath) {
+	if (!existsSync(globalRulesPath)) return;
+	try {
+		if (lstatSync(homeRulesPath).isSymbolicLink() && readlinkSync(homeRulesPath) === globalRulesPath) return;
+		return;
+	} catch {}
+	try {
+		symlinkSync(globalRulesPath, homeRulesPath, "dir");
+	} catch {}
+}
+/**
 * Translate Overdeck's abstract sandbox mode token into a value the codex
 * CLI actually accepts. Overdeck config uses 'workspace' as its mode name
 * (see config-yaml.ts permission modes); codex only accepts read-only,
@@ -506,6 +526,7 @@ var init_codex = __esmMin((() => {
 	init_behavior();
 	init_tmux_cli();
 	init_errors();
+	init_harness_binary();
 	init_codex_parser();
 	execAsync = promisify(exec);
 	rolloutPathCache = /* @__PURE__ */ new Map();
@@ -621,11 +642,12 @@ var init_codex = __esmMin((() => {
 			if (await tmuxSessionExists(agentId)) await tmuxKillSession(agentId);
 		}
 		async spawnAgent(config) {
+			const harnessLaunch = await prepareHarnessLaunch("codex");
 			const agentId = config.agentId;
 			const codexHomeDir = config.codexHome ?? join(homedir(), ".overdeck", "agents", agentId, "codex-home");
 			initCodexHome(codexHomeDir);
 			const sandbox = toCodexSandboxValue(config.codexSandboxMode);
-			const tokens = ["codex", "exec"];
+			const tokens = [shellQuote(harnessLaunch.binaryPath), "exec"];
 			if (config.model) tokens.push("-m", shellQuote(config.model));
 			tokens.push("-c", "approval_policy=never");
 			tokens.push("-s", shellQuote(sandbox));
@@ -662,6 +684,6 @@ var init_codex = __esmMin((() => {
 	};
 }));
 //#endregion
-export { extractThreadIdFromRollout as a, initCodexHome as c, toCodexSandboxValue as d, waitForCodexRollout as f, createCodexRuntimeSync as i, init_codex as l, CodexSpawnTimeout as n, findLatestRollout as o, writeThreadId as p, codexHome as r, findRolloutPath as s, CodexRuntimeSync as t, seedCodexAuthSymlink as u };
+export { extractThreadIdFromRollout as a, initCodexHome as c, seedCodexRulesSymlink as d, toCodexSandboxValue as f, createCodexRuntimeSync as i, init_codex as l, writeThreadId as m, CodexSpawnTimeout as n, findLatestRollout as o, waitForCodexRollout as p, codexHome as r, findRolloutPath as s, CodexRuntimeSync as t, seedCodexAuthSymlink as u };
 
-//# sourceMappingURL=codex-D_UBEOwL.js.map
+//# sourceMappingURL=codex-TmSi-yTv.js.map