@overdeck/desktop 0.45.23 → 0.46.0

package/server/{workspace-manager-hLUv3ADC.js → workspace-manager-CwO-Hek7.js}

@@ -1,19 +1,21 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ar as SKILLS_DIR, Vr as init_paths, f as loadConfigSync, ir as FsError, mr as init_errors, t as init_config_yaml, ur as ProcessSpawnError, vr as CACHE_AGENTS_DIR, yr as CACHE_RULES_DIR } from "./config-yaml-DvyMuOle.js";
+import { Br as CACHE_RULES_DIR, Fr as init_errors, Gn as init_projects, Qr as SYNC_SOURCES, Tr as FsError, Zr as SKILLS_DIR, ci as init_paths, f as loadConfigSync, jr as ProcessSpawnError, t as init_config_yaml, zr as CACHE_AGENTS_DIR } from "./config-yaml-CmOPzmBb.js";
 import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME } from "./types-hraoaQIp.js";
-import { t as init_pan_dir } from "./pan-dir-DeVUgwA7.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-cEGcO6UT.js";
-import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-B2vxjx_b.js";
-import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-BEq0bUDg.js";
-import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-CtUgrVKW.js";
-import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-BK7HIcBj.js";
+import { t as init_pan_dir } from "./pan-dir-ubraCiUg.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-B123aZl-.js";
+import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-BAm1XgjG.js";
+import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-CDYJxqx-.js";
+import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-68CSCRnu.js";
+import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-Dam7mbIB.js";
+import { join } from "node:path";
 import { Effect } from "effect";
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
-import { basename, dirname, extname, join, relative, resolve } from "path";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
+import { basename as basename$1, dirname as dirname$1, extname as extname$1, join as join$1, relative as relative$1, resolve as resolve$1 } from "path";
 import { homedir, platform } from "os";
+import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readdirSync as readdirSync$1, readlinkSync, renameSync as renameSync$1, statSync as statSync$1, symlinkSync as symlinkSync$1 } from "node:fs";
 import { createHash } from "crypto";
 import "fs/promises";
-import { exec } from "child_process";
+import { exec, execFile } from "child_process";
 import { promisify } from "util";
 //#region ../../lib/workspace-manager/migration.ts
 /**
@@ -33,26 +35,26 @@ function copyOverdeckSettingsToWorkspaceSync(workspacePath) {
 		copied: [],
 		errors: []
 	};
-	const overdeckDir = join(workspacePath, ".overdeck");
-	const claudeDir = join(workspacePath, ".claude");
+	const overdeckDir = join$1(workspacePath, ".overdeck");
+	const claudeDir = join$1(workspacePath, ".claude");
 	mkdirSync(overdeckDir, { recursive: true });
 	if (!existsSync(claudeDir)) mkdirSync(claudeDir, { recursive: true });
 	const filesToCopy = [
 		{
-			source: join(homedir(), ".overdeck", "config.yaml"),
-			target: join(overdeckDir, "config.yaml")
+			source: join$1(homedir(), ".overdeck", "config.yaml"),
+			target: join$1(overdeckDir, "config.yaml")
 		},
 		{
-			source: join(homedir(), ".overdeck", "projects.yaml"),
-			target: join(overdeckDir, "projects.yaml")
+			source: join$1(homedir(), ".overdeck", "projects.yaml"),
+			target: join$1(overdeckDir, "projects.yaml")
 		},
 		{
-			source: join(homedir(), ".overdeck", "settings.json"),
-			target: join(overdeckDir, "settings.json")
+			source: join$1(homedir(), ".overdeck", "settings.json"),
+			target: join$1(overdeckDir, "settings.json")
 		},
 		{
-			source: join(homedir(), ".claude", "mcp.json"),
-			target: join(claudeDir, "mcp.json")
+			source: join$1(homedir(), ".claude", "mcp.json"),
+			target: join$1(claudeDir, "mcp.json")
 		}
 	];
 	for (const { source, target } of filesToCopy) {
@@ -64,8 +66,8 @@ function copyOverdeckSettingsToWorkspaceSync(workspacePath) {
 			result.errors.push(`${source}: ${err.message}`);
 		}
 	}
-	const globalSettingsPath = join(homedir(), ".claude", "settings.json");
-	const workspaceSettingsPath = join(claudeDir, "settings.json");
+	const globalSettingsPath = join$1(homedir(), ".claude", "settings.json");
+	const workspaceSettingsPath = join$1(claudeDir, "settings.json");
 	if (existsSync(globalSettingsPath)) try {
 		const globalSettings = JSON.parse(readFileSync(globalSettingsPath, "utf-8"));
 		let workspaceSettings = {};
@@ -126,7 +128,7 @@ function copyOverdeckSettingsToWorkspaceSync(workspacePath) {
 * since project-specific skills should be committed.
 */
 function ensurePanGitignoreSync(projectPath) {
-	const gitignorePath = join(projectPath, ".gitignore");
+	const gitignorePath = join$1(projectPath, ".gitignore");
 	const requiredEntries = [
 		".pan/events/",
 		".pan/review/",
@@ -182,7 +184,7 @@ var init_platform = __esmMin((() => {
 * - dnsmasq: System-wide dnsmasq configuration (Linux/macOS)
 */
 function addWsl2HostEntry(hostname) {
-	const wsl2hostsPath = join(homedir(), ".wsl2hosts");
+	const wsl2hostsPath = join$1(homedir(), ".wsl2hosts");
 	try {
 		let content = "";
 		if (existsSync(wsl2hostsPath)) content = readFileSync(wsl2hostsPath, "utf-8");
@@ -193,7 +195,7 @@ function addWsl2HostEntry(hostname) {
 	}
 }
 function removeWsl2HostEntry(hostname) {
-	const wsl2hostsPath = join(homedir(), ".wsl2hosts");
+	const wsl2hostsPath = join$1(homedir(), ".wsl2hosts");
 	try {
 		if (!existsSync(wsl2hostsPath)) return true;
 		writeFileSync(wsl2hostsPath, readFileSync(wsl2hostsPath, "utf-8").split("\n").filter((line) => line.trim() !== hostname).join("\n"));
@@ -252,7 +254,7 @@ function addDnsmasqEntry(hostname, ip = "127.0.0.1") {
 	try {
 		const configDir = getDnsmasqConfigDir();
 		mkdirSync(configDir, { recursive: true });
-		const confPath = join(configDir, OVERDECK_DNSMASQ_CONF);
+		const confPath = join$1(configDir, OVERDECK_DNSMASQ_CONF);
 		let content = "";
 		if (existsSync(confPath)) content = readFileSync(confPath, "utf-8");
 		const entry = `address=/${hostname}/${ip}`;
@@ -266,7 +268,7 @@ function addDnsmasqEntry(hostname, ip = "127.0.0.1") {
 }
 function removeDnsmasqEntry(hostname) {
 	try {
-		const confPath = join(getDnsmasqConfigDir(), OVERDECK_DNSMASQ_CONF);
+		const confPath = join$1(getDnsmasqConfigDir(), OVERDECK_DNSMASQ_CONF);
 		if (!existsSync(confPath)) return true;
 		writeFileSync(confPath, readFileSync(confPath, "utf-8").split("\n").filter((line) => !line.includes(`/${hostname}/`)).join("\n"));
 		return true;
@@ -339,7 +341,7 @@ function readManifestSync(manifestPath) {
 * Write a manifest to disk (creates parent directories if needed).
 */
 function writeManifestSync(manifestPath, manifest) {
-	mkdirSync(join(manifestPath, ".."), { recursive: true });
+	mkdirSync(join$1(manifestPath, ".."), { recursive: true });
 	writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 }
 /**
@@ -388,10 +390,10 @@ function collectSourceFilesSync(sourceDir, prefix) {
 	function walk(dir) {
 		const entries = readdirSync(dir, { withFileTypes: true });
 		for (const entry of entries) {
-			const fullPath = join(dir, entry.name);
+			const fullPath = join$1(dir, entry.name);
 			if (entry.isDirectory()) walk(fullPath);
 			else if (entry.isFile()) {
-				const rel = relative(sourceDir, fullPath);
+				const rel = relative$1(sourceDir, fullPath);
 				results.push({
 					absolutePath: fullPath,
 					relativePath: `${prefix}${rel}`
@@ -418,8 +420,8 @@ var init_manifest = __esmMin((() => {
 * (processTemplates + createSymlinks → now also copy-based).
 */
 function mergeSkillsIntoWorkspaceSync(workspacePath) {
-	const claudeDir = join(workspacePath, ".claude");
-	const manifestPath = join(claudeDir, ".overdeck-manifest.json");
+	const claudeDir = join$1(workspacePath, ".claude");
+	const manifestPath = join$1(claudeDir, ".overdeck-manifest.json");
 	const manifest = readManifestSync(manifestPath);
 	const result = {
 		added: [],
@@ -427,8 +429,8 @@ function mergeSkillsIntoWorkspaceSync(workspacePath) {
 		skipped: [],
 		overlayed: []
 	};
-	mkdirSync(join(claudeDir, "skills"), { recursive: true });
-	mkdirSync(join(claudeDir, "agents"), { recursive: true });
+	mkdirSync(join$1(claudeDir, "skills"), { recursive: true });
+	mkdirSync(join$1(claudeDir, "agents"), { recursive: true });
 	const sources = [
 		{
 			sourceDir: SKILLS_DIR,
@@ -449,11 +451,11 @@ function mergeSkillsIntoWorkspaceSync(workspacePath) {
 		const files = collectSourceFilesSync(sourceDir, "");
 		for (const file of files) {
 			const relativePath = `${prefix}${file.relativePath}`;
-			const targetPath = join(claudeDir, relativePath);
+			const targetPath = join$1(claudeDir, relativePath);
 			const sourceHash = hashFileSync(file.absolutePath);
 			switch (compareFileToManifest(targetPath, relativePath, manifest).action) {
 				case "new":
-					mkdirSync(dirname(targetPath), { recursive: true });
+					mkdirSync(dirname$1(targetPath), { recursive: true });
 					copyFileSync(file.absolutePath, targetPath);
 					setManifestEntry(manifest, relativePath, sourceHash, "overdeck");
 					result.added.push(relativePath);
@@ -493,15 +495,15 @@ function mergePanSkillsIntoWorkspaceSync(projectPath, workspacePath) {
 		skipped: [],
 		overlayed: []
 	};
-	const panSkillsDir = join(projectPath, ".pan", "skills");
+	const panSkillsDir = join$1(projectPath, ".pan", "skills");
 	if (!existsSync(panSkillsDir)) return result;
-	const claudeSkillsDir = join(workspacePath, ".claude", "skills");
-	const manifestPath = join(workspacePath, ".claude", ".overdeck-manifest.json");
+	const claudeSkillsDir = join$1(workspacePath, ".claude", "skills");
+	const manifestPath = join$1(workspacePath, ".claude", ".overdeck-manifest.json");
 	const manifest = readManifestSync(manifestPath);
 	const skillDirs = readdirSync(panSkillsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
 	for (const skillName of skillDirs) {
-		const sourceSkillDir = join(panSkillsDir, skillName);
-		const targetSkillDir = join(claudeSkillsDir, skillName);
+		const sourceSkillDir = join$1(panSkillsDir, skillName);
+		const targetSkillDir = join$1(claudeSkillsDir, skillName);
 		if (existsSync(targetSkillDir)) {
 			result.skipped.push(`skills/${skillName} (already exists in .claude/skills/)`);
 			continue;
@@ -510,8 +512,8 @@ function mergePanSkillsIntoWorkspaceSync(projectPath, workspacePath) {
 		mkdirSync(targetSkillDir, { recursive: true });
 		let anyAdded = false;
 		for (const file of files) {
-			const targetPath = join(targetSkillDir, file.relativePath);
-			mkdirSync(dirname(targetPath), { recursive: true });
+			const targetPath = join$1(targetSkillDir, file.relativePath);
+			mkdirSync(dirname$1(targetPath), { recursive: true });
 			copyFileSync(file.absolutePath, targetPath);
 			const hash = hashFileSync(targetPath);
 			setManifestEntry(manifest, `skills/${skillName}/${file.relativePath}`, hash, "pan-skills");
@@ -558,12 +560,12 @@ function validateFeatureName(name) {
 * venv's own path. Best-effort and non-fatal: unreadable/binary files skipped.
 */
 function relocateVenvScripts(sourceVenv, destVenv) {
-	const sourceBin = join(sourceVenv, "bin");
-	const destBin = join(destVenv, "bin");
-	const destPy = join(destBin, "python3");
+	const sourceBin = join$1(sourceVenv, "bin");
+	const destBin = join$1(destVenv, "bin");
+	const destPy = join$1(destBin, "python3");
 	if (!existsSync(destBin) || !existsSync(destPy)) return;
 	for (const entry of readdirSync(destBin)) {
-		const script = join(destBin, entry);
+		const script = join$1(destBin, entry);
 		try {
 			if (!statSync(script).isFile()) continue;
 			const content = readFileSync(script, "utf8");
@@ -579,7 +581,7 @@ function relocateVenvScripts(sourceVenv, destVenv) {
 		"activate.csh",
 		"activate.fish"
 	]) {
-		const act = join(destBin, name);
+		const act = join$1(destBin, name);
 		if (!existsSync(act)) continue;
 		try {
 			const content = readFileSync(act, "utf8");
@@ -587,6 +589,37 @@ function relocateVenvScripts(sourceVenv, destVenv) {
 		} catch {}
 	}
 }
+/** Install the agent-only rebase guard in Git's configured hooks directory. */
+async function installPreRebaseHook(targetPath) {
+	const { stdout } = await execAsync$2("git rev-parse --git-path hooks", {
+		cwd: targetPath,
+		encoding: "utf-8"
+	});
+	const hooksDir = resolve$1(targetPath, stdout.trim());
+	const hookPath = join$1(hooksDir, "pre-rebase");
+	mkdirSync(hooksDir, { recursive: true });
+	const originalHookPath = `${hookPath}${PRE_REBASE_ORIGINAL_SUFFIX}`;
+	const existingHook = existsSync(hookPath) ? readFileSync(hookPath, "utf-8") : "";
+	if (!existingHook.includes(PRE_REBASE_HOOK_MARKER)) {
+		if (existingHook) {
+			rmSync(originalHookPath, { force: true });
+			renameSync(hookPath, originalHookPath);
+		}
+		writeFileSync(hookPath, [
+			PRE_REBASE_HOOK_PREFIX,
+			`if [ -x "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" ]; then`,
+			`  exec "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" "$@"`,
+			"fi",
+			"exit 0",
+			""
+		].join("\n"), {
+			encoding: "utf-8",
+			mode: 493
+		});
+	}
+	chmodSync(hookPath, 493);
+	return hookPath;
+}
 /**
 * Create a git worktree
 * @param repoPath Path to the source git repository
@@ -603,7 +636,8 @@ async function createWorktree(repoPath, targetPath, branchName, defaultBranch =
 		const localList = localBranches.split("\n").map((b) => b.replace(/^[*+\s]+/, "").trim()).filter(Boolean);
 		const remoteList = remoteBranches.split("\n").map((b) => b.trim()).filter(Boolean);
 		if (localList.includes(branchName) || remoteList.includes(`origin/${branchName}`)) await execAsync$2(`git worktree add "${targetPath}" "${branchName}"`, { cwd: repoPath });
-		else await execAsync$2(`git worktree add "${targetPath}" -b "${branchName}" "${defaultBranch}"`, { cwd: repoPath });
+		else await execAsync$2(`git worktree add -b "${branchName}" "${targetPath}" "${defaultBranch}"`, { cwd: repoPath });
+		await installPreRebaseHook(targetPath);
 		await execAsync$2("git restore .", { cwd: targetPath }).catch(() => {});
 		return {
 			success: true,
@@ -639,7 +673,7 @@ async function removeWorktree(repoPath, targetPath, branchName) {
 */
 function assignPort(portFile, featureFolder, range) {
 	if (!existsSync(portFile)) {
-		mkdirSync(dirname(portFile), { recursive: true });
+		mkdirSync(dirname$1(portFile), { recursive: true });
 		writeFileSync(portFile, "");
 	}
 	const content = readFileSync(portFile, "utf-8");
@@ -681,8 +715,8 @@ function mergeDirectoryWithoutOverwriteSync(source, target) {
 	if (!existsSync(source)) return;
 	mkdirSync(target, { recursive: true });
 	for (const entry of readdirSync(source, { withFileTypes: true })) {
-		const sourcePath = join(source, entry.name);
-		const targetPath = join(target, entry.name);
+		const sourcePath = join$1(source, entry.name);
+		const targetPath = join$1(target, entry.name);
 		if (entry.isDirectory()) mergeDirectoryWithoutOverwriteSync(sourcePath, targetPath);
 		else if (entry.isFile() && !existsSync(targetPath)) copyFileSync(sourcePath, targetPath);
 	}
@@ -698,19 +732,19 @@ function restorePreWorktreeMetadataSync(stagedPath, workspacePath) {
 function copyProjectTemplateDirs(sourceDir, targetDir, dirs, placeholders) {
 	const steps = [];
 	for (const dir of dirs) {
-		const sourcePath = join(sourceDir, dir);
-		const targetPath = join(targetDir, dir);
+		const sourcePath = join$1(sourceDir, dir);
+		const targetPath = join$1(targetDir, dir);
 		if (!existsSync(sourcePath)) continue;
 		function copyDir(src, dest) {
 			let count = 0;
 			mkdirSync(dest, { recursive: true });
 			const entries = readdirSync(src, { withFileTypes: true });
 			for (const entry of entries) {
-				const srcEntry = join(src, entry.name);
-				const destEntry = join(dest, entry.name);
+				const srcEntry = join$1(src, entry.name);
+				const destEntry = join$1(dest, entry.name);
 				if (entry.isDirectory()) count += copyDir(srcEntry, destEntry);
 				else if (entry.isFile()) {
-					const ext = extname(entry.name).toLowerCase();
+					const ext = extname$1(entry.name).toLowerCase();
 					if (placeholders && TEXT_EXTENSIONS.has(ext)) writeFileSync(destEntry, replacePlaceholdersSync(readFileSync(srcEntry, "utf-8"), placeholders));
 					else copyFileSync(srcEntry, destEntry);
 					count++;
@@ -748,7 +782,7 @@ function copyProjectTemplateDirs(sourceDir, targetDir, dirs, placeholders) {
 * key checked by both the bypass-mode dialog and the headless --bg gate.
 */
 function preTrustDirectorySync(dirPath) {
-	const claudeJsonPath = join(homedir(), ".claude.json");
+	const claudeJsonPath = join$1(homedir(), ".claude.json");
 	if (!existsSync(claudeJsonPath)) return;
 	const data = JSON.parse(readFileSync(claudeJsonPath, "utf8"));
 	let dirty = false;
@@ -778,11 +812,23 @@ function preTrustDirectorySync(dirPath) {
 	}
 	if (dirty) writeFileSync(claudeJsonPath, JSON.stringify(data, null, 2), "utf8");
 }
-var execAsync$2, TEXT_EXTENSIONS;
+var execAsync$2, PRE_REBASE_HOOK_MARKER, PRE_REBASE_ORIGINAL_SUFFIX, PRE_REBASE_HOOK_PREFIX, TEXT_EXTENSIONS;
 var init_worktree_ops = __esmMin((() => {
 	init_workspace_config();
 	init_types();
 	execAsync$2 = promisify(exec);
+	PRE_REBASE_HOOK_MARKER = "# OVERDECK MANAGED PRE-REBASE GUARD";
+	PRE_REBASE_ORIGINAL_SUFFIX = ".overdeck-original";
+	PRE_REBASE_HOOK_PREFIX = [
+		"#!/bin/sh",
+		PRE_REBASE_HOOK_MARKER,
+		"if [ \"$OVERDECK_PAN_GIT_OP\" != \"1\" ] && [ -n \"$OVERDECK_AGENT_ID\" ]; then",
+		"  echo \"Overdeck agents must not run git rebase directly.\" >&2",
+		"  echo \"Use pan sync-main <ISSUE-ID> to sync main or pan done <ISSUE-ID> to submit.\" >&2",
+		"  exit 1",
+		"fi",
+		""
+	].join("\n");
 	TEXT_EXTENSIONS = new Set([
 		".md",
 		".sh",
@@ -808,7 +854,7 @@ var init_worktree_ops = __esmMin((() => {
 * Returns the entries that were added or removed (empty arrays if nothing changed).
 */
 function ensurePolyrepoWorkspaceGitignoreSync(workspacePath, repos) {
-	const gitignorePath = join(workspacePath, ".gitignore");
+	const gitignorePath = join$1(workspacePath, ".gitignore");
 	let content = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
 	const removed = [];
 	const filteredLines = content.split("\n").filter((line) => {
@@ -826,8 +872,11 @@ function ensurePolyrepoWorkspaceGitignoreSync(workspacePath, repos) {
 		const entry = `${repo.name}/`;
 		if (!normalizedLines.includes(entry) && !normalizedLines.includes(repo.name)) added.push(entry);
 	}
-	const addRuntimeEntry = !normalizedLines.includes(".overdeck/") && !normalizedLines.includes(".overdeck");
-	if (added.length === 0 && !addRuntimeEntry && removed.length === 0) return {
+	const runtimeEntries = [];
+	if (!normalizedLines.includes(".overdeck/") && !normalizedLines.includes(".overdeck")) runtimeEntries.push(".overdeck/");
+	if (!normalizedLines.includes(".devcontainer/") && !normalizedLines.includes(".devcontainer")) runtimeEntries.push(".devcontainer/");
+	if (!normalizedLines.includes("dev")) runtimeEntries.push("dev");
+	if (added.length === 0 && runtimeEntries.length === 0 && removed.length === 0) return {
 		added,
 		removed
 	};
@@ -836,9 +885,10 @@ function ensurePolyrepoWorkspaceGitignoreSync(workspacePath, repos) {
 		if (!normalizedLines.some((l) => l.includes("Polyrepo") || l.includes("polyrepo"))) content += "\n# Polyrepo sub-repositories\n";
 		content += added.join("\n") + "\n";
 	}
-	if (addRuntimeEntry) {
-		content += "\n# Overdeck workspace runtime (PAN-2541: durable state lives on overdeck-state)\n.overdeck/\n";
-		added.push(".overdeck/");
+	if (runtimeEntries.length > 0) {
+		content += "\n# Overdeck workspace runtime (PAN-2541: durable state lives on overdeck-state; devcontainer harness is generated)\n";
+		content += runtimeEntries.join("\n") + "\n";
+		added.push(...runtimeEntries);
 	}
 	writeFileSync(gitignorePath, content, "utf-8");
 	return {
@@ -853,7 +903,7 @@ function ensurePolyrepoWorkspaceGitignoreSync(workspacePath, repos) {
 * surface the warning.
 */
 async function commitPolyrepoWorkspaceGitignoreAsync(workspacePath) {
-	if (!existsSync(join(workspacePath, ".git"))) return null;
+	if (!existsSync(join$1(workspacePath, ".git"))) return null;
 	try {
 		await execAsync$1("git add .gitignore", { cwd: workspacePath });
 		try {
@@ -901,9 +951,9 @@ async function createWorkspacePromise(options) {
 		return result;
 	}
 	const workspaceConfig = projectConfig.workspace || getDefaultWorkspaceConfigSync();
-	const workspacesDir = join(projectConfig.path, workspaceConfig.workspaces_dir || "workspaces");
+	const workspacesDir = join$1(projectConfig.path, workspaceConfig.workspaces_dir || "workspaces");
 	const featureFolder = `feature-${featureName}`;
-	const workspacePath = join(workspacesDir, featureFolder);
+	const workspacePath = join$1(workspacesDir, featureFolder);
 	result.workspacePath = workspacePath;
 	if (dryRun) {
 		result.steps.push("[DRY RUN] Would create workspace at: " + workspacePath);
@@ -926,9 +976,9 @@ async function createWorkspacePromise(options) {
 		result.steps.push("Created workspace directory");
 		const reposToCreate = workspaceConfig.progressive && workspaceConfig.always_include ? workspaceConfig.repos.filter((r) => workspaceConfig.always_include.includes(r.name)) : workspaceConfig.repos;
 		for (const repo of reposToCreate) {
-			const rawRepoPath = join(projectConfig.path, repo.path);
+			const rawRepoPath = join$1(projectConfig.path, repo.path);
 			const repoPath = existsSync(rawRepoPath) ? realpathSync(rawRepoPath) : rawRepoPath;
-			const targetPath = join(workspacePath, repo.name);
+			const targetPath = join$1(workspacePath, repo.name);
 			if (repo.link_type === "symlink") try {
 				symlinkSync(repoPath, targetPath);
 				result.steps.push(`Created symlink for ${repo.name} (readonly, no feature branch)`);
@@ -974,16 +1024,16 @@ async function createWorkspacePromise(options) {
 		result.steps.push(`Warning: could not create workspace .gitignore: ${gitignoreErr.message}`);
 	}
 	progress("Creating git worktree", "Worktree ready", "complete");
-	const resolvedWorkspace = resolve(workspacePath);
-	const resolvedPanDir = resolve(resolvedWorkspace, PAN_DIRNAME);
-	if (resolvedWorkspace.match(/\/workspaces\/feature-[a-z0-9-]+$/) && existsSync(join(resolvedWorkspace, ".git"))) {
-		if (resolvedPanDir === join(resolvedWorkspace, ".pan") && existsSync(resolvedPanDir)) {
+	const resolvedWorkspace = resolve$1(workspacePath);
+	const resolvedPanDir = resolve$1(resolvedWorkspace, PAN_DIRNAME);
+	if (resolvedWorkspace.match(/\/workspaces\/feature-[a-z0-9-]+$/) && existsSync(join$1(resolvedWorkspace, ".git"))) {
+		if (resolvedPanDir === join$1(resolvedWorkspace, ".pan") && existsSync(resolvedPanDir)) {
 			for (const filePath of [
-				join(resolvedPanDir, PAN_CONTINUE_FILENAME),
-				join(resolvedPanDir, PAN_SESSIONS_FILENAME),
-				join(resolvedPanDir, PAN_CONTEXT_FILENAME)
+				join$1(resolvedPanDir, PAN_CONTINUE_FILENAME),
+				join$1(resolvedPanDir, PAN_SESSIONS_FILENAME),
+				join$1(resolvedPanDir, PAN_CONTEXT_FILENAME)
 			]) if (existsSync(filePath)) unlinkSync(filePath);
-			const feedbackDir = join(resolvedPanDir, PAN_FEEDBACK_DIRNAME);
+			const feedbackDir = join$1(resolvedPanDir, PAN_FEEDBACK_DIRNAME);
 			if (existsSync(feedbackDir)) rmSync(feedbackDir, {
 				recursive: true,
 				force: true
@@ -997,15 +1047,15 @@ async function createWorkspacePromise(options) {
 	} catch (gitignoreErr) {
 		result.steps.push(`Warning: could not update .gitignore: ${gitignoreErr.message}`);
 	}
-	const devcontainerDir = join(workspacePath, ".devcontainer");
+	const devcontainerDir = join$1(workspacePath, ".devcontainer");
 	if (existsSync(devcontainerDir)) {
 		const composeFiles = readdirSync(devcontainerDir).filter((f) => f.includes("compose") && (f.endsWith(".yml") || f.endsWith(".yaml")));
-		for (const composeFile of composeFiles) sanitizeComposeFileSync(join(devcontainerDir, composeFile));
+		for (const composeFile of composeFiles) sanitizeComposeFileSync(join$1(devcontainerDir, composeFile));
 		if (composeFiles.length > 0) result.steps.push(`Sanitized ${composeFiles.length} compose file(s) for platform compatibility`);
 	}
 	progress("Installing dependencies", projectConfig.package_manager || "detecting...");
-	const pkgManager = projectConfig.package_manager || (existsSync(join(workspacePath, "bun.lock")) ? "bun" : "npm");
-	const staleModulesDirs = [join(workspacePath, "node_modules"), ...(projectConfig.workspace_packages ?? []).map((p) => join(workspacePath, p.path, "node_modules"))];
+	const pkgManager = projectConfig.package_manager || (existsSync(join$1(workspacePath, "bun.lock")) ? "bun" : "npm");
+	const staleModulesDirs = [join$1(workspacePath, "node_modules"), ...(projectConfig.workspace_packages ?? []).map((p) => join$1(workspacePath, p.path, "node_modules"))];
 	for (const dir of staleModulesDirs) if (existsSync(dir)) await execAsync$1(`rm -rf "${dir}"`);
 	const installCmd = pkgManager === "bun" ? "bun install" : `${pkgManager} install`;
 	try {
@@ -1021,12 +1071,19 @@ async function createWorkspacePromise(options) {
 		progress("Installing dependencies", "Failed — workspace creation aborted", "complete");
 		return result;
 	}
+	const hookTargets = workspaceConfig.type === "polyrepo" && workspaceConfig.repos ? workspaceConfig.repos.filter((repo) => repo.link_type !== "symlink").map((repo) => join$1(workspacePath, repo.name)).filter((path) => existsSync(join$1(path, ".git"))) : [workspacePath];
+	try {
+		for (const hookTarget of hookTargets) await installPreRebaseHook(hookTarget);
+	} catch (hookErr) {
+		result.errors.push(`Pre-rebase guard install failed: ${hookErr.message?.slice(0, 200)}`);
+		return result;
+	}
 	const workspacePackages = projectConfig.workspace_packages;
 	if (workspacePackages && workspacePackages.length > 0) {
 		progress("Building workspace packages", workspacePackages.map((p) => p.path).join(", "));
 		for (const pkg of workspacePackages) try {
 			await execAsync$1(pkg.build_command, {
-				cwd: join(workspacePath, pkg.path),
+				cwd: join$1(workspacePath, pkg.path),
 				encoding: "utf-8"
 			});
 			result.steps.push(`Built workspace package: ${pkg.path}`);
@@ -1040,21 +1097,21 @@ async function createWorkspacePromise(options) {
 	}
 	try {
 		await execAsync$1("python3 --version");
-		const venvPath = join(workspacePath, ".venv");
-		const tldrBin = join(venvPath, "bin", "tldr");
-		if (existsSync(join(projectConfig.path, ".venv", "bin", "tldr"))) {
-			const mainVenvPath = join(projectConfig.path, ".venv");
+		const venvPath = join$1(workspacePath, ".venv");
+		const tldrBin = join$1(venvPath, "bin", "tldr");
+		if (existsSync(join$1(projectConfig.path, ".venv", "bin", "tldr"))) {
+			const mainVenvPath = join$1(projectConfig.path, ".venv");
 			await execAsync$1(`cp -a "${mainVenvPath}" "${venvPath}"`);
 			relocateVenvScripts(mainVenvPath, venvPath);
 			result.steps.push("Copied Python venv from main branch (shebangs relocated)");
 		} else {
 			await execAsync$1(`python3 -m venv "${venvPath}"`, { cwd: workspacePath });
-			await execAsync$1(`"${join(venvPath, "bin", "pip")}" install llm-tldr`, {
+			await execAsync$1(`"${join$1(venvPath, "bin", "pip")}" install llm-tldr`, {
 				cwd: workspacePath,
 				timeout: 12e4
 			});
 			result.steps.push("Created Python venv and installed llm-tldr");
-			const patchScript = join(projectConfig.path, "scripts", "patches", "llm-tldr-tsx-support.py");
+			const patchScript = join$1(projectConfig.path, "scripts", "patches", "llm-tldr-tsx-support.py");
 			if (existsSync(patchScript)) {
 				await execAsync$1(`python3 "${patchScript}" "${venvPath}"`);
 				result.steps.push("Applied llm-tldr .tsx/.jsx patch");
@@ -1062,13 +1119,13 @@ async function createWorkspacePromise(options) {
 		}
 		if (!existsSync(tldrBin)) result.steps.push("TLDR setup incomplete: tldr binary not found after venv creation");
 		else {
-			const mainTldrDir = join(projectConfig.path, ".tldr");
-			const workspaceTldrDir = join(workspacePath, ".tldr");
+			const mainTldrDir = join$1(projectConfig.path, ".tldr");
+			const workspaceTldrDir = join$1(workspacePath, ".tldr");
 			if (existsSync(mainTldrDir)) {
 				await execAsync$1(`cp -r "${mainTldrDir}" "${workspaceTldrDir}"`);
 				result.steps.push("Copied TLDR index from main branch");
 			}
-			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DL566HbH.js");
+			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BKOYB616.js");
 			const tldrService = getTldrDaemonServiceSync(workspacePath, venvPath);
 			await tldrService.start(true);
 			result.steps.push("Started TLDR daemon");
@@ -1095,7 +1152,7 @@ async function createWorkspacePromise(options) {
 		}
 	}
 	if (workspaceConfig.ports) for (const [portName, portConfig] of Object.entries(workspaceConfig.ports)) {
-		const portFile = join(projectConfig.path, `.${portName}-ports`);
+		const portFile = join$1(projectConfig.path, `.${portName}-ports`);
 		try {
 			const port = assignPort(portFile, featureFolder, portConfig.range);
 			result.steps.push(`Assigned ${portName} port: ${port}`);
@@ -1111,7 +1168,7 @@ async function createWorkspacePromise(options) {
 	const panMergeResult = mergePanSkillsIntoWorkspaceSync(projectConfig.path, workspacePath);
 	if (panMergeResult.added.length > 0) result.steps.push(`Installed ${panMergeResult.added.length} project-local skill file(s) from .pan/skills/ (${panMergeResult.overlayed.join(", ")})`);
 	if (workspaceConfig.agent?.template_dir) {
-		const templateDir = join(projectConfig.path, workspaceConfig.agent.template_dir);
+		const templateDir = join$1(projectConfig.path, workspaceConfig.agent.template_dir);
 		const templateSteps = processTemplatesSync(templateDir, workspacePath, placeholders, workspaceConfig.agent.templates);
 		result.steps.push(...templateSteps);
 		const dirsToSync = workspaceConfig.agent.copy_dirs || workspaceConfig.agent.symlinks;
@@ -1122,7 +1179,7 @@ async function createWorkspacePromise(options) {
 	}
 	if (workspaceConfig.env?.template) {
 		const envContent = replacePlaceholdersSync(workspaceConfig.env.template, placeholders);
-		writeFileSync(join(workspacePath, ".env"), envContent);
+		writeFileSync(join$1(workspacePath, ".env"), envContent);
 		result.steps.push("Created .env file");
 	}
 	if (workspaceConfig.docker?.compose_template) try {
@@ -1145,7 +1202,7 @@ async function createWorkspacePromise(options) {
 		const humeResult = await Effect.runPromise(createHumeConfig(workspaceConfig.hume, placeholders));
 		result.steps.push(...humeResult.steps);
 		if (humeResult.configId) {
-			writeFileSync(join(workspacePath, ".hume-config"), `HUME_CONFIG_ID=${humeResult.configId}\nVITE_HUME_CONFIG_ID=${humeResult.configId}\n`);
+			writeFileSync(join$1(workspacePath, ".hume-config"), `HUME_CONFIG_ID=${humeResult.configId}\nVITE_HUME_CONFIG_ID=${humeResult.configId}\n`);
 			result.steps.push("Wrote .hume-config with Hume EVI config ID");
 		}
 		if (!humeResult.success) result.errors.push("Hume EVI config setup had failures (see steps for details)");
@@ -1154,9 +1211,9 @@ async function createWorkspacePromise(options) {
 	if (startDocker) {
 		progress("Starting Docker containers", "Building and starting services");
 		if (workspaceConfig.docker?.traefik) {
-			const traefikPath = join(homedir(), ".overdeck", "traefik", "docker-compose.yml");
+			const traefikPath = join$1(homedir(), ".overdeck", "traefik", "docker-compose.yml");
 			if (existsSync(traefikPath)) try {
-				await execAsync$1(`docker compose -f "${traefikPath}" up -d`, { cwd: join(homedir(), ".overdeck", "traefik") });
+				await execAsync$1(`docker compose -f "${traefikPath}" up -d`, { cwd: join$1(homedir(), ".overdeck", "traefik") });
 				result.steps.push("Started Traefik");
 			} catch (error) {
 				const msg = error?.message || String(error);
@@ -1165,18 +1222,18 @@ async function createWorkspacePromise(options) {
 			}
 		}
 		const composeLocations = [
-			join(workspacePath, "docker-compose.yml"),
-			join(workspacePath, "docker-compose.yaml"),
-			join(workspacePath, ".devcontainer", "docker-compose.yml"),
-			join(workspacePath, ".devcontainer", "docker-compose.devcontainer.yml")
+			join$1(workspacePath, "docker-compose.yml"),
+			join$1(workspacePath, "docker-compose.yaml"),
+			join$1(workspacePath, ".devcontainer", "docker-compose.yml"),
+			join$1(workspacePath, ".devcontainer", "docker-compose.devcontainer.yml")
 		];
 		for (const composePath of composeLocations) if (existsSync(composePath)) {
 			try {
 				await execAsync$1(`docker compose -f "${composePath}" up -d --build`, {
-					cwd: dirname(composePath),
+					cwd: dirname$1(composePath),
 					timeout: 3e5
 				});
-				result.steps.push(`Started containers from ${basename(composePath)}`);
+				result.steps.push(`Started containers from ${basename$1(composePath)}`);
 			} catch (error) {
 				result.errors.push(`Failed to start containers: ${error}`);
 			}
@@ -1189,7 +1246,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push("Pre-trusted workspace in Claude Code");
 	} catch {}
 	try {
-		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-DuUdndHe.js");
+		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-BqFg__wH.js");
 		const cavemanConfig = loadConfigSync().config.caveman;
 		const variant = determineCavemanVariant(cavemanConfig);
 		await Effect.runPromise(injectCavemanSettings(workspacePath, variant));
@@ -1205,7 +1262,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push(`Overdeck settings copy skipped: ${settingsErr instanceof Error ? settingsErr.message : String(settingsErr)}`);
 	}
 	try {
-		const { injectMemoryHookSettings } = await import("./workspace-DuUdndHe.js");
+		const { injectMemoryHookSettings } = await import("./workspace-BqFg__wH.js");
 		await injectMemoryHookSettings(workspacePath);
 		result.steps.push("Injected memory hooks into .claude/settings.json");
 	} catch (memoryHookErr) {
@@ -1229,9 +1286,42 @@ var init_create = __esmMin((() => {
 	execAsync$1 = promisify(exec);
 }));
 //#endregion
-//#region ../../lib/workspace-manager/repos.ts
+//#region ../../lib/git-hooks.ts
+function installGitHooksInDir(gitDir) {
+	const hooksTarget = join(gitDir, "hooks");
+	let installed = 0;
+	if (!existsSync$1(hooksTarget)) mkdirSync$1(hooksTarget, { recursive: true });
+	if (!existsSync$1(BUNDLED_HOOKS_DIR)) return 0;
+	try {
+		const hooks = readdirSync$1(BUNDLED_HOOKS_DIR).filter((file) => {
+			const path = join(BUNDLED_HOOKS_DIR, file);
+			return existsSync$1(path) && statSync$1(path).isFile();
+		});
+		for (const hook of hooks) {
+			const source = join(BUNDLED_HOOKS_DIR, hook);
+			const target = join(hooksTarget, hook);
+			if (existsSync$1(target)) {
+				try {
+					if (readlinkSync(target) === source) continue;
+				} catch {}
+				renameSync$1(target, `${target}.backup`);
+			}
+			symlinkSync$1(source, target);
+			installed++;
+		}
+	} catch {}
+	return installed;
+}
+var BUNDLED_HOOKS_DIR;
+var init_git_hooks = __esmMin((() => {
+	init_paths();
+	BUNDLED_HOOKS_DIR = SYNC_SOURCES.gitHooks;
+}));
 var init_repos = __esmMin((() => {
+	init_git_hooks();
+	init_projects();
 	init_worktree_ops();
+	promisify(execFile);
 }));
 //#endregion
 //#region ../../lib/workspace-manager/remove.ts
@@ -1243,9 +1333,9 @@ async function removeWorkspacePromise(options) {
 		steps: []
 	};
 	const workspaceConfig = projectConfig.workspace || getDefaultWorkspaceConfigSync();
-	const workspacesDir = join(projectConfig.path, workspaceConfig.workspaces_dir || "workspaces");
+	const workspacesDir = join$1(projectConfig.path, workspaceConfig.workspaces_dir || "workspaces");
 	const featureFolder = `feature-${featureName}`;
-	const workspacePath = join(workspacesDir, featureFolder);
+	const workspacePath = join$1(workspacesDir, featureFolder);
 	if (!existsSync(workspacePath)) {
 		result.success = false;
 		result.errors.push(`Workspace not found at ${workspacePath}`);
@@ -1255,9 +1345,9 @@ async function removeWorkspacePromise(options) {
 		result.steps.push("[DRY RUN] Would remove workspace at: " + workspacePath);
 		return result;
 	}
-	const venvPath = join(workspacePath, ".venv");
+	const venvPath = join$1(workspacePath, ".venv");
 	if (existsSync(venvPath)) try {
-		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DL566HbH.js");
+		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BKOYB616.js");
 		await getTldrDaemonServiceSync(workspacePath, venvPath).stop();
 		result.steps.push("Stopped TLDR daemon");
 	} catch (error) {
@@ -1266,7 +1356,7 @@ async function removeWorkspacePromise(options) {
 	const dockerResult = await stopWorkspaceDockerPromise(workspacePath, featureName);
 	result.steps.push(...dockerResult.steps);
 	if (workspaceConfig.type === "polyrepo" && workspaceConfig.repos) for (const repo of workspaceConfig.repos) {
-		const targetPath = join(workspacePath, repo.name);
+		const targetPath = join$1(workspacePath, repo.name);
 		if (existsSync(targetPath) && lstatSync(targetPath).isSymbolicLink()) try {
 			unlinkSync(targetPath);
 			result.steps.push(`Removed symlink for ${repo.name}`);
@@ -1274,7 +1364,7 @@ async function removeWorkspacePromise(options) {
 			result.errors.push(`${repo.name}: ${unlinkErr.message}`);
 		}
 		else if (existsSync(targetPath)) {
-			const worktreeResult = await removeWorktree(join(projectConfig.path, repo.path), targetPath, `${repo.branch_prefix || "feature/"}${featureName}`);
+			const worktreeResult = await removeWorktree(join$1(projectConfig.path, repo.path), targetPath, `${repo.branch_prefix || "feature/"}${featureName}`);
 			if (worktreeResult.success) result.steps.push(`Removed worktree for ${repo.name}`);
 			else result.errors.push(worktreeResult.message);
 		}
@@ -1304,7 +1394,7 @@ async function removeWorkspacePromise(options) {
 		result.steps.push(...humeResult.steps);
 	}
 	if (workspaceConfig.ports) {
-		for (const [portName] of Object.entries(workspaceConfig.ports)) if (releasePort(join(projectConfig.path, `.${portName}-ports`), featureFolder)) result.steps.push(`Released ${portName} port`);
+		for (const [portName] of Object.entries(workspaceConfig.ports)) if (releasePort(join$1(projectConfig.path, `.${portName}-ports`), featureFolder)) result.steps.push(`Released ${portName} port`);
 	}
 	const orphanedContainers = await getContainersReferencingWorkspacePathPromise(workspacePath);
 	if (orphanedContainers.length > 0) result.errors.push(`Cannot remove workspace directory: ${orphanedContainers.length} Docker container(s) still reference compose paths in ${DEVCONTAINER_DIRNAME}/. Run workspace Docker cleanup first or stop the containers manually.`);
@@ -1377,6 +1467,6 @@ var init_workspace_manager = __esmMin((() => {
 	});
 }));
 //#endregion
-export { removeWorkspace as a, relocateVenvScripts as c, copyOverdeckSettingsToWorkspaceSync as d, ensurePanGitignoreSync as f, preTrustDirectory as i, detectPlatform as l, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, init_workspace_manager as r, preTrustDirectorySync as s, createWorkspace as t, init_platform as u };
+export { removeWorkspace as a, installGitHooksInDir as c, relocateVenvScripts as d, detectPlatform as f, ensurePanGitignoreSync as h, preTrustDirectory as i, installPreRebaseHook as l, copyOverdeckSettingsToWorkspaceSync as m, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, init_platform as p, init_workspace_manager as r, init_git_hooks as s, createWorkspace as t, preTrustDirectorySync as u };
 
-//# sourceMappingURL=workspace-manager-hLUv3ADC.js.map
+//# sourceMappingURL=workspace-manager-CwO-Hek7.js.map