@overdeck/desktop 0.45.24 → 0.47.0

package/server/auto-spawn-consent-CQ9Bi9q6.js

@@ -0,0 +1,1141 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { H as init_providers, W as qualifyPiModel, ci as getOverdeckHome$1, di as packageRoot, li as init_paths } from "./config-yaml-CxdwhAIA.js";
+import { i as releaseRecordLock, n as init_fs_lock, t as acquireRecordLock } from "./fs-lock-Bre3sGoz.js";
+import { $ as colorFgBgForTheme, G as tmuxExecAsync, K as validateSessionName, et as getUiThemeSync, tt as init_ui_theme, w as init_tmux } from "./tmux-CfDHob9M.js";
+import { s as getHarnessBehavior } from "./src-B948bGVR.js";
+import { t as init_behavior } from "./behavior-td6-xhQk.js";
+import { f as toCodexSandboxValue, l as init_codex } from "./codex-BzGDW_d3.js";
+import { dirname, join } from "node:path";
+import { Data } from "effect";
+import { join as join$1 } from "path";
+import { tmpdir } from "os";
+import { homedir as homedir$1 } from "node:os";
+import "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { unlink as unlink$1, writeFile as writeFile$1 } from "fs/promises";
+import { randomUUID } from "node:crypto";
+//#region ../../lib/model-validation.ts
+function normalizeModelOverrideSync(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "string") throw new Error("model must be a string.");
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return void 0;
+	if (!MODEL_ID_PATTERN.test(trimmed)) throw new Error("model must match [A-Za-z0-9._:/@-] plus square brackets, with 1-128 characters and no whitespace or shell metacharacters.");
+	return trimmed;
+}
+function requireModelOverrideSync(value) {
+	const model = normalizeModelOverrideSync(value);
+	if (!model) throw new Error("model is required");
+	return model;
+}
+function shellQuoteModelIdSync(model) {
+	return `'${requireModelOverrideSync(model).replace(/'/g, `'\\''`)}'`;
+}
+var MODEL_ID_PATTERN;
+var init_model_validation = __esmMin((() => {
+	MODEL_ID_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._:/@-]|\[|\]){0,127}$/;
+	Data.TaggedError("ModelValidationError");
+}));
+//#endregion
+//#region ../../lib/launcher-git-guard.ts
+/**
+* Per-agent `git` shim installed on the agent's PATH by its launcher.
+*
+* The shim blocks the three history-moving commands agents must never run
+* against their own worktree (`rebase`, state-moving `stash`, `reset --hard`)
+* and passes everything else through to the real git.
+*
+* Two scoping rules keep the guard honest (PAN-3189):
+*
+*   1. It only fires when the git invocation targets the agent's own worktree
+*      (`guardRoot`). A `git rebase` inside a test fixture's temp repo is not
+*      the behavior this guard exists to prevent, and blocking it made the
+*      workspace test suite untrustworthy — which pushed agents onto weaker
+*      gates, or onto stripping the guard entirely.
+*   2. The launcher drops any *other* agent's guard directory from PATH before
+*      prepending its own, so a Flywheel-spawned agent never runs behind the
+*      orchestrator's shim inherited through the environment.
+*/
+function shellQuote$1(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* Emit the launcher lines that materialize and install the per-agent git guard.
+*
+* @param agentId   Owning agent id — the guard lives in `~/.overdeck/agents/<id>/git-guard`.
+* @param guardRoot The agent's worktree. Only git commands targeting this
+*                  directory (or a descendant) are guarded.
+*/
+function buildGitGuardLines(agentId, guardRoot) {
+	const guardDir = join(getOverdeckHome$1(), "agents", agentId, "git-guard");
+	const guardPath = join(guardDir, "git");
+	const pathForDoubleQuotes = guardDir.replace(/([\\"$`])/g, "\\$1");
+	return [
+		"IFS=':' read -r -a _overdeck_path_segments <<< \"$PATH\"",
+		"_overdeck_kept_path=()",
+		"for _overdeck_path_segment in \"${_overdeck_path_segments[@]}\"; do",
+		"  [[ \"$_overdeck_path_segment\" == */git-guard ]] || _overdeck_kept_path+=(\"$_overdeck_path_segment\")",
+		"done",
+		"PATH=\"$(IFS=':'; echo \"${_overdeck_kept_path[*]}\")\"",
+		"unset _overdeck_path_segments _overdeck_kept_path _overdeck_path_segment",
+		"_OVERDECK_REAL_GIT=\"$(command -v git)\"",
+		`_OVERDECK_GUARD_ROOT="$(cd ${shellQuote$1(guardRoot)} 2>/dev/null && pwd -P)"`,
+		`[ -n "$_OVERDECK_GUARD_ROOT" ] || _OVERDECK_GUARD_ROOT=${shellQuote$1(guardRoot)}`,
+		`mkdir -p ${shellQuote$1(guardDir)}`,
+		`cat > ${shellQuote$1(guardPath)} <<EOF`,
+		"#!/bin/sh",
+		"_OVERDECK_REAL_GIT=\"$_OVERDECK_REAL_GIT\"",
+		"_OVERDECK_GUARD_ROOT=\"$_OVERDECK_GUARD_ROOT\"",
+		"if [ \"\\$OVERDECK_PAN_GIT_OP\" = \"1\" ]; then",
+		"  exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\"",
+		"fi",
+		"_overdeck_git_find_command() {",
+		"  while [ \"\\$#\" -gt 0 ]; do",
+		"    case \"\\$1\" in",
+		"      -C|-c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix|--attr-source)",
+		"        shift",
+		"        [ \"\\$#\" -gt 0 ] && shift",
+		"        ;;",
+		"      -C?*|-c?*|--git-dir=*|--work-tree=*|--namespace=*|--config-env=*|--super-prefix=*|--attr-source=*)",
+		"        shift",
+		"        ;;",
+		"      --)",
+		"        shift",
+		"        break",
+		"        ;;",
+		"      -*)",
+		"        shift",
+		"        ;;",
+		"      *)",
+		"        printf \"%s\\n\" \"\\$1\"",
+		"        return",
+		"        ;;",
+		"    esac",
+		"  done",
+		"  [ \"\\$#\" -gt 0 ] && printf \"%s\\n\" \"\\$1\"",
+		"}",
+		"_overdeck_git_target_dir() {",
+		"  _overdeck_dir=\"\\$(pwd -P 2>/dev/null || pwd)\"",
+		"  while [ \"\\$#\" -gt 0 ]; do",
+		"    case \"\\$1\" in",
+		"      -C)",
+		"        shift",
+		"        [ \"\\$#\" -gt 0 ] || break",
+		"        case \"\\$1\" in",
+		"          /*) _overdeck_dir=\"\\$1\" ;;",
+		"          *) _overdeck_dir=\"\\$_overdeck_dir/\\$1\" ;;",
+		"        esac",
+		"        shift",
+		"        ;;",
+		"      -C?*)",
+		"        _overdeck_c_value=\"\\${1#-C}\"",
+		"        case \"\\$_overdeck_c_value\" in",
+		"          /*) _overdeck_dir=\"\\$_overdeck_c_value\" ;;",
+		"          *) _overdeck_dir=\"\\$_overdeck_dir/\\$_overdeck_c_value\" ;;",
+		"        esac",
+		"        shift",
+		"        ;;",
+		"      -c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix|--attr-source)",
+		"        shift",
+		"        [ \"\\$#\" -gt 0 ] && shift",
+		"        ;;",
+		"      -c?*|--git-dir=*|--work-tree=*|--namespace=*|--config-env=*|--super-prefix=*|--attr-source=*)",
+		"        shift",
+		"        ;;",
+		"      --)",
+		"        break",
+		"        ;;",
+		"      -*)",
+		"        shift",
+		"        ;;",
+		"      *)",
+		"        break",
+		"        ;;",
+		"    esac",
+		"  done",
+		"  if [ -d \"\\$_overdeck_dir\" ]; then",
+		"    (cd \"\\$_overdeck_dir\" 2>/dev/null && pwd -P) || printf \"%s\\n\" \"\\$_overdeck_dir\"",
+		"  else",
+		"    printf \"%s\\n\" \"\\$_overdeck_dir\"",
+		"  fi",
+		"}",
+		"_overdeck_git_command=\"\\$(_overdeck_git_find_command \"\\$@\")\"",
+		"case \"\\$_overdeck_git_command\" in",
+		"  rebase|stash|reset) ;;",
+		"  *) exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\" ;;",
+		"esac",
+		"_overdeck_git_target=\"\\$(_overdeck_git_target_dir \"\\$@\")\"",
+		"case \"\\$_overdeck_git_target\" in",
+		"  \"\\$_OVERDECK_GUARD_ROOT\"|\"\\$_OVERDECK_GUARD_ROOT\"/*) ;;",
+		"  *) exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\" ;;",
+		"esac",
+		"case \"\\$_overdeck_git_command\" in",
+		"  rebase)",
+		"    echo \"Overdeck agents must not run git rebase directly. Use pan sync-main to sync main or pan done to submit.\" >&2",
+		"    exit 1",
+		"    ;;",
+		"  stash)",
+		"    _overdeck_stash_sub=\"\"",
+		"    _overdeck_after_stash=0",
+		"    for _overdeck_git_arg in \"\\$@\"; do",
+		"      if [ \"\\$_overdeck_after_stash\" = \"1\" ]; then",
+		"        case \"\\$_overdeck_git_arg\" in",
+		"          -*) ;;",
+		"          *)",
+		"            _overdeck_stash_sub=\"\\$_overdeck_git_arg\"",
+		"            break",
+		"            ;;",
+		"        esac",
+		"      elif [ \"\\$_overdeck_git_arg\" = \"stash\" ]; then",
+		"        _overdeck_after_stash=1",
+		"      fi",
+		"    done",
+		"    case \"\\$_overdeck_stash_sub\" in",
+		"      list|show)",
+		"        ;;",
+		"      *)",
+		"        echo \"Overdeck agents must not run git stash directly (read-only stash list/show are allowed). Use pan sync-main to sync main or pan done to submit.\" >&2",
+		"        exit 1",
+		"        ;;",
+		"    esac",
+		"    ;;",
+		"  reset)",
+		"    for _overdeck_git_arg in \"\\$@\"; do",
+		"      if [ \"\\$_overdeck_git_arg\" = \"--hard\" ]; then",
+		"        echo \"Overdeck agents must not run git reset --hard. Commit, explicitly discard, or surface the state instead.\" >&2",
+		"        exit 1",
+		"      fi",
+		"    done",
+		"    ;;",
+		"esac",
+		"exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\"",
+		"EOF",
+		`chmod 0755 ${shellQuote$1(guardPath)}`,
+		`export PATH="${pathForDoubleQuotes}:$PATH"`
+	];
+}
+var init_launcher_git_guard = __esmMin((() => {
+	init_paths();
+}));
+//#endregion
+//#region ../../lib/launcher-generator.ts
+/**
+* Quote a string for safe use as a shell literal in single quotes.
+* e.g. shellQuote("foo'bar") → "'foo'\\''bar'"
+*/
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* Build the trailing `--mcp-config <path> --dangerously-load-development-channels server:<name>`
+* fragment when both channels-bridge fields are set. Returns an empty string when
+* channelsBridgeMcpConfig is unset so existing call sites stay byte-identical.
+*
+* Note: --mcp-config is intentionally additive (no --strict-mcp-config) so the
+* project's .mcp.json continues to load alongside the bridge.
+*/
+function buildChannelsArgs(config) {
+	if (!config.channelsBridgeMcpConfig) return "";
+	const serverName = config.channelsBridgeServerName ?? "overdeck-bridge";
+	return ` --mcp-config ${shellQuote(config.channelsBridgeMcpConfig)} --dangerously-load-development-channels server:${serverName}`;
+}
+function wrapWithSupervisor(config, cmd) {
+	if (!config.useSupervisor) return cmd;
+	if (!getHarnessBehavior(config.harness ?? "claude-code").supportsPtySupervisor || config.reviewSignal) return cmd;
+	if (!config.supervisorScriptPath) throw new Error("LauncherConfig.supervisorScriptPath is required when useSupervisor=true");
+	return `node ${shellQuote(config.supervisorScriptPath)} ${cmd}`;
+}
+/**
+* Canonical launcher script generator.
+*
+* Takes a typed LauncherConfig and returns a bash script string.
+* Callers are responsible for building providerExports, cavemanExports,
+* and baseCommand strings — the generator does NOT call helper functions
+* internally (keeps coupling low, tests simple).
+*/
+function generateLauncherScriptSync(config) {
+	const lines = [];
+	lines.push("#!/bin/bash");
+	lines.push("unset TMUX TMUX_PANE STY");
+	if (config.setPipefail) lines.push("set -o pipefail");
+	lines.push("command -v mkcert >/dev/null 2>&1 && export NODE_EXTRA_CA_CERTS=\"$(mkcert -CAROOT)/rootCA.pem\"");
+	lines.push("export SKIP_DOCS_INDEX=1");
+	if (config.setTerminalEnv) {
+		lines.push("export TERM=xterm-256color");
+		lines.push("export COLORTERM=truecolor");
+		lines.push("export LANG=C.UTF-8");
+		lines.push("export LC_ALL=C.UTF-8");
+		lines.push(`export COLORFGBG='${colorFgBgForTheme(getUiThemeSync())}'`);
+	}
+	if (config.setRemotePath) lines.push("export PATH=\"/usr/local/bin:$PATH\"");
+	const explicitlySetOverdeckKeys = /* @__PURE__ */ new Set();
+	if (config.overdeckEnv) {
+		if (config.overdeckEnv.agentId != null) {
+			lines.push(`export OVERDECK_AGENT_ID=${shellQuote(config.overdeckEnv.agentId)}`);
+			explicitlySetOverdeckKeys.add("OVERDECK_AGENT_ID");
+		}
+		if (config.overdeckEnv.issueId != null) {
+			lines.push(`export OVERDECK_ISSUE_ID=${shellQuote(config.overdeckEnv.issueId)}`);
+			explicitlySetOverdeckKeys.add("OVERDECK_ISSUE_ID");
+		}
+		if (config.overdeckEnv.sessionType != null) {
+			lines.push(`export OVERDECK_SESSION_TYPE=${shellQuote(config.overdeckEnv.sessionType)}`);
+			explicitlySetOverdeckKeys.add("OVERDECK_SESSION_TYPE");
+		}
+	}
+	if (config.overdeckEnv?.agentId && config.spawnMode !== "conversation") lines.push(...buildGitGuardLines(config.overdeckEnv.agentId, config.workingDir));
+	if (config.extraEnvExports) for (const expr of config.extraEnvExports) lines.push(expr);
+	if (config.codexHome) lines.push(`export CODEX_HOME=${shellQuote(config.codexHome)}`);
+	if (config.changeDir !== false) lines.push(`cd -- ${shellQuote(config.workingDir)}`);
+	if (config.unsetProviderEnv) for (const key of PROVIDER_ENV_UNSETS) lines.push(`unset ${key}`);
+	if (config.providerExports) {
+		const trimmed = config.providerExports.trimEnd();
+		if (trimmed) lines.push(trimmed);
+	}
+	if (config.cavemanExports) {
+		const trimmed = config.cavemanExports.trimEnd();
+		if (trimmed) lines.push(trimmed);
+	}
+	if (config.unsetOverdeckEnv) {
+		const keysToUnset = [
+			"OVERDECK_AGENT_ID",
+			"OVERDECK_ISSUE_ID",
+			"OVERDECK_SESSION_TYPE"
+		].filter((k) => !explicitlySetOverdeckKeys.has(k));
+		if (keysToUnset.length > 0) lines.push(`unset ${keysToUnset.join(" ")}`);
+	}
+	if (config.trapHup) lines.push("trap '' HUP");
+	if (config.promptFile && config.promptFileMode !== "stdin") lines.push(`prompt=$(cat ${shellQuote(config.promptFile)})`);
+	if (config.debugLog) lines.push(`echo "[launcher] Claude starting at $(date)" >> ${shellQuote(config.debugLog)}`);
+	const commandParts = buildCommand(config);
+	if (commandParts.length > 0) lines.push(...commandParts);
+	if (config.debugLog) {
+		lines.push("CLAUDE_EXIT=$?");
+		lines.push(`echo "[launcher] Claude exited with code $CLAUDE_EXIT at $(date)" >> ${shellQuote(config.debugLog)}`);
+	}
+	if (config.role === "plan") {
+		lines.push("echo \"\"");
+		lines.push("echo \"Planning agent has exited. Session kept alive for review.\"");
+		lines.push("echo \"Click 'Done' in the dashboard when ready to hand off to implementation.\"");
+		if (config.debugLog) lines.push(`echo "[launcher] Keep-alive loop starting at $(date)" >> ${shellQuote(config.debugLog)}`);
+	}
+	if (config.spawnMode === "conversation") {
+		lines.push("echo \"\"");
+		lines.push("echo \"Conversation session ended. Close this panel or click Resume to start a new session.\"");
+	}
+	if (config.keepAlive) lines.push("while true; do sleep 60; done");
+	let script = lines.join("\n") + "\n";
+	if (config.escapeForBase64) script = script.replace(/\$/g, "\\$");
+	return script;
+}
+function buildCommand(config) {
+	const parts = [];
+	const behavior = getHarnessBehavior(config.harness ?? "claude-code");
+	if (config.spawnMode === "conversation") {
+		if (behavior.launchCommandKind === "ohmypi-rpc") return buildOhmypiCommand(config, false);
+		if (behavior.launchCommandKind === "codex-work-tui") return buildCodexCommand(config, false);
+		if (behavior.launchCommandKind === "acp-host") return buildAcpCommand(config, false);
+		if (config.baseCommand) {
+			let cmd = config.baseCommand;
+			cmd += buildChannelsArgs(config);
+			const args = [];
+			if (config.resumeSessionId) args.push(`--resume ${shellQuote(config.resumeSessionId)}`);
+			else if (config.sessionId) args.push(`--session-id ${shellQuote(config.sessionId)}`);
+			if (config.extraArgs) args.push(config.extraArgs);
+			parts.push(wrapWithSupervisor(config, `${cmd} ${args.join(" ")}`.trim()));
+		}
+		return parts;
+	}
+	if (config.role === "plan") return buildNonConversationCommand(config, false);
+	if (config.reviewSignal) return buildReviewSubRoleCommand(config);
+	return buildNonConversationCommand(config, true);
+}
+/**
+* Build the review sub-role command sequence (PAN-977).
+*
+* The reviewer runs under `timeout` as a child process; once it exits, the
+* launcher itself signals the synthesis agent deterministically — the agent
+* never has to remember to run `pan tell`, and the signal is tied to process
+* exit rather than agent good behavior or Deacon patrol timing.
+*/
+function buildReviewSubRoleCommand(config) {
+	const sig = config.reviewSignal;
+	const inner = buildNonConversationCommand(config, false);
+	if (inner.length === 0) return inner;
+	const claudeCmd = `timeout ${sig.timeoutSeconds} ${inner[0]}`;
+	const synth = shellQuote(sig.synthesisAgentId);
+	const out = sig.outputPath;
+	const role = sig.subRole;
+	const pidFile = shellQuote(sig.launcherPidPath);
+	return [
+		`echo $$ > ${pidFile}`,
+		claudeCmd,
+		"CLAUDE_EXIT=$?",
+		`if [ "$CLAUDE_EXIT" = "124" ]; then`,
+		`  pan tell ${synth} "REVIEWER_TIMEOUT ${role} reviewer exceeded ${sig.timeoutSeconds}s deadline" || true`,
+		`elif [ -s ${shellQuote(out)} ]; then`,
+		`  pan tell ${synth} "REVIEWER_READY ${role} ${out}" || true`,
+		`else`,
+		`  pan tell ${synth} "REVIEWER_FAILED ${role} reviewer exited (code $CLAUDE_EXIT) without writing report" || true`,
+		`fi`,
+		`touch ${shellQuote(sig.signalMarkerPath)}`,
+		`rm -f ${pidFile}`
+	];
+}
+/**
+* Shared command builder for planning and exec-based agent types.
+* Appends session args, extra args, and prompt references.
+*
+* PAN-982: When `baseCommand` contains `--agent` (i.e. an agent definition
+* is selecting permissions, model, and tools via `.claude/agents/pan-*.md`
+* frontmatter), permission flags are skipped — the frontmatter handles them.
+*/
+function buildNonConversationCommand(config, useExec) {
+	const behavior = getHarnessBehavior(config.harness ?? "claude-code");
+	if (behavior.launchCommandKind === "ohmypi-rpc") return buildOhmypiCommand(config, useExec);
+	if (behavior.launchCommandKind === "codex-work-tui") return buildCodexCommand(config, useExec);
+	if (behavior.launchCommandKind === "acp-host") return buildAcpCommand(config, useExec);
+	const parts = [];
+	if (!config.baseCommand) return parts;
+	let cmd = config.baseCommand;
+	if (!cmd.includes("--agent ") && config.permissionFlags && config.permissionFlags.length > 0) {
+		const cmdTokens = cmd.split(/\s+/);
+		for (const flag of config.permissionFlags) if (!cmdTokens.includes(flag)) cmd += ` ${flag}`;
+	}
+	cmd += buildChannelsArgs(config);
+	if (config.resumeSessionId) cmd += ` --resume ${shellQuote(config.resumeSessionId)}`;
+	if (config.sessionId) cmd += ` --session-id ${shellQuote(config.sessionId)}`;
+	if (config.model) cmd += ` --model ${shellQuoteModelIdSync(config.model)}`;
+	if (config.extraArgs) cmd += ` ${config.extraArgs}`;
+	for (const file of systemPromptFiles(config)) cmd += ` --append-system-prompt-file ${shellQuote(file)}`;
+	if (config.promptFile) if (config.promptFileMode === "stdin") cmd += ` < ${shellQuote(config.promptFile)}`;
+	else cmd += " \"$prompt\"";
+	if (config.promptInline) cmd += ` ${shellQuote(config.promptInline)}`;
+	const wrapped = wrapWithSupervisor(config, cmd.trim());
+	parts.push(useExec ? `exec ${wrapped}` : wrapped);
+	return parts;
+}
+/**
+* Build an oh-my-pi (omp) command line (PAN-1989).
+*
+* RPC mode (work-agents):
+*   omp --mode rpc \
+*      --model <model> \
+*      --session-dir <piSessionDir> \
+*      --extension <piExtensionPath> \
+*      [--resume <resumeSessionId>] \
+*      [--append-system-prompt "$prompt"] \
+*      <> <piFifoPath> >> <agentDir>/output.log 2>&1
+*
+* TUI mode (conversations):
+*   omp --model <model> \
+*      --session-dir <piSessionDir> \
+*      [--extension <piExtensionPath>] \
+*      [--resume <resumeSessionId>] \
+*      [--append-system-prompt "$prompt"]
+*
+* Contract differences from pi (docs/ohmypi-contract.md):
+* - Binary is `omp`, not `pi`
+* - `--no-context-files` is REMOVED (flag does not exist in omp)
+* - `--resume <id>` replaces `--session <id>`
+*/
+function buildOhmypiCommand(config, useExec) {
+	const piMode = config.piMode ?? "rpc";
+	if (!config.piSessionDir) throw new Error("ohmypi launcher requires piSessionDir");
+	if (piMode === "rpc") {
+		if (!config.piExtensionPath) throw new Error("ohmypi launcher (rpc mode) requires piExtensionPath");
+		if (!config.piFifoPath) throw new Error("ohmypi launcher (rpc mode) requires piFifoPath");
+	}
+	const tokens = ["omp"];
+	if (piMode === "rpc") tokens.push("--mode", "rpc");
+	if (config.model) tokens.push("--model", shellQuoteModelIdSync(qualifyPiModel(config.model)));
+	tokens.push("--session-dir", shellQuote(config.piSessionDir));
+	if (config.piExtensionPath) tokens.push("--extension", shellQuote(config.piExtensionPath));
+	for (const file of systemPromptFiles(config)) tokens.push("--append-system-prompt", `"$(cat ${shellQuote(file)} 2>/dev/null)"`);
+	if (config.resumeSessionId) tokens.push("--resume", shellQuote(config.resumeSessionId));
+	if (config.extraArgs) tokens.push(config.extraArgs);
+	if (config.promptFile) tokens.push("--append-system-prompt", "\"$prompt\"");
+	else if (config.promptInline) tokens.push("--append-system-prompt", shellQuote(config.promptInline));
+	let cmd = tokens.join(" ").replace(/\s+/g, " ").trim();
+	if (piMode === "rpc") {
+		const agentDir = dirname(config.piFifoPath);
+		const outputLogPath = join(agentDir, "output.log");
+		const exitStatusPath = join(agentDir, "exit-status");
+		return [
+			`${cmd} <> ${shellQuote(config.piFifoPath)} >> ${shellQuote(outputLogPath)} 2>&1`,
+			"__omp_exit=$?",
+			`printf '%s %s\\n' "$__omp_exit" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > ${shellQuote(exitStatusPath)}`,
+			"exit $__omp_exit"
+		];
+	}
+	return [useExec ? `exec ${cmd}` : cmd];
+}
+/**
+* Build a Pi command line.
+*
+* RPC mode (work-agents):
+*   pi --mode rpc \
+*      --model <model> \
+*      --session-dir <piSessionDir> \
+*      --extension <piExtensionPath> \
+*      --no-context-files \
+*      [--session <resumeSessionId>] \
+*      [--append-system-prompt "$prompt"] \
+*      <> <piFifoPath>
+*
+* TUI mode (conversations):
+*   pi --model <model> \
+*      --session-dir <piSessionDir> \
+*      [--extension <piExtensionPath>] \
+*      --no-context-files \
+*      [--session <resumeSessionId>] \
+*      [--append-system-prompt "$prompt"]
+*
+* Pi has no permission system, so permissionFlags are intentionally
+* dropped (AC4). baseCommand is ignored — Pi launchers always start with
+* the literal `pi` so callers cannot accidentally smuggle in claude flags.
+*/
+function systemPromptFiles(config) {
+	return [...config.appendSystemPromptFile ? [config.appendSystemPromptFile] : [], ...config.appendSystemPromptFiles ?? []];
+}
+function buildAcpCommand(config, useExec) {
+	if (!config.acpAgentId) throw new Error("acp launcher requires acpAgentId");
+	if (!config.acpProvider) throw new Error("acp launcher requires acpProvider");
+	if (!config.acpWorkspace) throw new Error("acp launcher requires acpWorkspace");
+	if (!config.acpBinaryPath) throw new Error("acp launcher requires acpBinaryPath");
+	const tokens = [
+		"node",
+		shellQuote(join(packageRoot, "dist", "acp-host.js")),
+		"--agent",
+		shellQuote(config.acpAgentId),
+		"--provider",
+		shellQuote(config.acpProvider),
+		"--workspace",
+		shellQuote(config.acpWorkspace),
+		"--binary-path",
+		shellQuote(config.acpBinaryPath)
+	];
+	if (config.resumeSessionId) tokens.push("--resume", shellQuote(config.resumeSessionId));
+	if (config.model) tokens.push("--model", shellQuoteModelIdSync(config.model));
+	if (config.acpContextFile) tokens.push("--context-file", shellQuote(config.acpContextFile));
+	const cmd = tokens.join(" ");
+	return [useExec ? `exec ${cmd}` : cmd];
+}
+function buildCodexCommand(config, useExec) {
+	const cmd = computeCodexCommandTokens(config, useExec);
+	const flat = cmd.join(" ").replace(/\s+/g, " ");
+	const applied = /(^|\s)resume(\s|$)/.test(flat) ? "YES" : "no";
+	console.log(`[codex-launcher] agent=${config.overdeckEnv?.agentId ?? "?"} mode=${config.codexMode ?? "exec"} resumeSessionId=${config.resumeSessionId ?? "(none)"} resumeApplied=${applied} cmd=${flat.slice(0, 200)}`);
+	return cmd;
+}
+function computeCodexCommandTokens(config, useExec) {
+	const codexMode = config.codexMode ?? "exec";
+	if (codexMode === "tui") {
+		const tokens = ["codex"];
+		if (config.resumeSessionId) tokens.push("resume");
+		tokens.push("-c", "project_doc_max_bytes=0");
+		if (config.resumeSessionId) tokens.push(shellQuote(config.resumeSessionId));
+		const cmd = wrapWithSupervisor(config, tokens.join(" "));
+		return [useExec ? `exec ${cmd}` : cmd];
+	}
+	if (codexMode === "work-tui") {
+		const tokens = ["codex"];
+		if (config.resumeSessionId) tokens.push("resume");
+		if (config.model) tokens.push("-m", shellQuoteModelIdSync(config.model));
+		if (config.resumeSessionId) tokens.push(shellQuote(config.resumeSessionId));
+		const cmd = wrapWithSupervisor(config, tokens.join(" "));
+		return [useExec ? `exec ${cmd}` : cmd];
+	}
+	if (codexMode === "app-server") {
+		const tokens = ["node", shellQuote(join(packageRoot, "dist", "codex-app-server-host.js"))];
+		if (config.model) tokens.push("--model", shellQuoteModelIdSync(config.model));
+		if (config.resumeSessionId) tokens.push("--resume", shellQuote(config.resumeSessionId));
+		const cmd = tokens.join(" ");
+		return [useExec ? `exec ${cmd}` : cmd];
+	}
+	const isResume = Boolean(config.resumeSessionId);
+	const tokens = ["codex", "exec"];
+	if (isResume) tokens.push("resume");
+	if (config.model) tokens.push("-m", shellQuoteModelIdSync(config.model));
+	tokens.push("-c", "approval_policy=never");
+	const sandbox = toCodexSandboxValue(config.codexSandboxMode);
+	if (isResume) tokens.push("-c", `sandbox_mode=${sandbox}`);
+	else tokens.push("-s", sandbox);
+	tokens.push("--skip-git-repo-check");
+	if (isResume) tokens.push(shellQuote(config.resumeSessionId));
+	if (config.promptFile) tokens.push("\"$prompt\"");
+	else if (config.promptInline) tokens.push(shellQuote(config.promptInline));
+	let cmd = tokens.join(" ").replace(/\s+/g, " ").trim();
+	return [useExec ? `exec ${cmd}` : cmd];
+}
+var PROVIDER_ENV_UNSETS;
+var init_launcher_generator = __esmMin((() => {
+	init_codex();
+	init_behavior();
+	init_providers();
+	init_model_validation();
+	init_ui_theme();
+	init_paths();
+	init_launcher_git_guard();
+	PROVIDER_ENV_UNSETS = [
+		"ANTHROPIC_API_KEY",
+		"ANTHROPIC_BASE_URL",
+		"ANTHROPIC_AUTH_TOKEN",
+		"OPENAI_API_KEY",
+		"GEMINI_API_KEY",
+		"API_TIMEOUT_MS",
+		"CLAUDE_CODE_API_KEY_HELPER_TTL_MS",
+		"CLAUDE_CODE_AUTO_COMPACT_WINDOW",
+		"CLAUDE_CODE_MAX_CONTEXT_TOKENS"
+	];
+}));
+//#endregion
+//#region ../../lib/agents/provenance.ts
+function normalizeFlywheelRunId(runId) {
+	if (!runId) return void 0;
+	const trimmed = runId.trim();
+	return /^RUN-\d+$/.test(trimmed) ? trimmed : void 0;
+}
+function isOperatorStartedBy(startedBy) {
+	return startedBy.startsWith("operator:") || startedBy === "dashboard:agent-spawner";
+}
+var init_provenance = __esmMin((() => {}));
+//#endregion
+//#region ../../lib/tmux-dedup.ts
+/**
+* Keyed, crash-safe tmux delivery (PAN-2997).
+*
+* The dashboard cannot dedupe a tmux paste from its own state — a crash
+* between the paste and the dashboard's acknowledgment bookkeeping would make
+* recovery re-paste. The dedup record therefore lives in the
+* crash-independent component: per-session tmux user options. All
+* check/paste/mark sequences that must not be interrupted are issued as ONE
+* `if-shell` command list, which the tmux SERVER executes — a dashboard exit
+* cannot interrupt it, and a tmux-server exit kills the agent session itself,
+* so a replay after either crash is correct.
+*
+* The protocol is two-phase so the complete paste-settle-submit transaction
+* survives a dashboard crash: the key becomes terminal only as part of the
+* server-owned submission itself.
+*
+*   (none) ──paste──► PENDING ──atomic claim+Enter──► TERMINAL
+*
+* - `sendKeysDedup` atomically pastes and sets the PENDING option only when
+*   neither option is set. A replay that finds PENDING (a prior attempt
+*   crashed before submitting) returns 'submit-pending' WITHOUT re-pasting.
+*   A POISON breadcrumb (a terminal marker that proved false but could not be
+*   rolled back) is repaired first and never honored as a dedup.
+* - `completeKeyedSubmit` issues ONE `if-shell`: only when PENDING is
+*   present, TERMINAL absent, and the pane alive does the tmux server send
+*   the Enter and then flip TERMINAL and clear PENDING — in that order, in a
+*   single server-executed command list. After the command the target is
+*   re-read: if the pane died, was replaced, or cannot be identified around
+*   the Enter, the terminal marker is rolled back under a poison breadcrumb
+*   and the pending claim restored. Exactly one caller can become the
+*   completer; every other concurrent or post-crash caller loses the
+*   server-side condition and sends nothing, so no stray Enter can ever land
+*   in a composer holding unrelated text.
+*/
+/** Set once the keyed message has been SUBMITTED (Enter sent). */
+function dedupTerminalOptionName(dedupKey) {
+	return `@overdeck-dedup-${dedupKey}`;
+}
+/** Set atomically with the paste; cleared when the terminal marker lands. */
+function dedupPendingOptionName(dedupKey) {
+	return `@overdeck-dedup-pending-${dedupKey}`;
+}
+/**
+* Rollback-required breadcrumb (cycle 11). Set when a post-submit check
+* proves a terminal marker FALSE but the rollback could not be verified.
+* While this marker exists the terminal marker must never be honored — the
+* next keyed call repairs the markers before anything else.
+*/
+function dedupPoisonOptionName(dedupKey) {
+	return `@overdeck-dedup-poison-${dedupKey}`;
+}
+/**
+* The pane_pid of the pane that received the keyed paste (cycle 13). Set
+* atomically with the paste (`set-option -F ... '#{pane_pid}'`) and required
+* by the submit condition: recovery may complete an old pending claim with
+* Enter alone ONLY when the current pane IS the pane that holds the pasted
+* content. A replaced pane gets a real re-paste instead.
+*/
+function dedupTargetOptionName(dedupKey) {
+	return `@overdeck-dedup-target-${dedupKey}`;
+}
+function assertValidDedupKey(dedupKey) {
+	if (!DEDUP_KEY_RE.test(dedupKey)) throw new Error(`dedupKey must match [A-Za-z0-9:_-]+, got: ${dedupKey.slice(0, 40)}`);
+}
+/** pane_pid + pane_dead in one read — the identity of the Enter's target. */
+async function readPaneTarget(sessionName) {
+	return tmuxExecAsync([
+		"display-message",
+		"-p",
+		"-t",
+		sessionName,
+		"#{pane_pid} #{pane_dead}"
+	], { encoding: "utf-8" }).then((result) => {
+		const [pid = "", dead = ""] = String(result.stdout).trim().split(/\s+/);
+		return {
+			pid,
+			dead: dead === "1"
+		};
+	}).catch(() => ({
+		pid: "",
+		dead: true
+	}));
+}
+async function readMarker(sessionName, option) {
+	return tmuxExecAsync([
+		"show-option",
+		"-qv",
+		"-t",
+		sessionName,
+		option
+	], { encoding: "utf-8" }).then((result) => String(result.stdout).trim(), () => "");
+}
+/**
+* Fail-CLOSED marker read (cycle 12): `-q` makes an unset user option a clean
+* empty read, so a rejection is always a REAL failure (missing session,
+* unreachable server). Safety-critical markers (the poison breadcrumb) must
+* be read this way — interpreting a failed read as "absent" could honor a
+* false terminal marker or bypass a rollback-required state.
+*/
+async function readMarkerStrict(sessionName, option) {
+	const result = await tmuxExecAsync([
+		"show-option",
+		"-qv",
+		"-t",
+		sessionName,
+		option
+	], { encoding: "utf-8" });
+	return String(result.stdout).trim();
+}
+/**
+* Clear the poison breadcrumb and VERIFY it is gone with a strict read.
+* EVERY failure here — the clear command, the verification read, or a
+* surviving breadcrumb — is a recoverable KeyedMarkerVerificationError
+* (cycle 14): a repair that stops at this boundary has delivered nothing,
+* so the wake outbox must stay pending, never terminal 'failed'.
+*/
+async function clearPoisonVerified(sessionName, poisonOption, context, readStrict = readMarkerStrict) {
+	try {
+		await tmuxExecAsync([
+			"set-option",
+			"-u",
+			"-t",
+			sessionName,
+			poisonOption
+		], { encoding: "utf-8" });
+	} catch (error) {
+		throw new KeyedMarkerVerificationError(sessionName, `poison clear command failed (${context})`, { cause: error });
+	}
+	let remaining;
+	try {
+		remaining = await readStrict(sessionName, poisonOption);
+	} catch (error) {
+		throw new KeyedMarkerVerificationError(sessionName, `post-clear verification read failed (${context})`, { cause: error });
+	}
+	if (remaining !== "") throw new KeyedMarkerVerificationError(sessionName, `poison breadcrumb survived the clear (${context})`);
+}
+/**
+* Repair a poisoned marker set (cycle 11/12): clear the terminal marker,
+* restore a pending claim, verify both, then clear the breadcrumb — verified.
+* A poisoned terminal is PROVISIONAL: it may be a false claim (rollback was
+* interrupted) or a delivered-but-unverified one, and the tmux tier cannot
+* distinguish them — so repair always rolls back to pending and lets the
+* normal recovery re-drive. An empty Enter on the (already-submitted, live)
+* composer is the worst case; a suppressed wake is never acceptable.
+*
+* Returns normally only when the breadcrumb is verifiably gone; throws
+* otherwise (the caller must NOT submit while a stale breadcrumb survives —
+* a later replay would invalidate a legitimate terminal and re-submit).
+*/
+async function repairPoisonedMarkers(sessionName, dedupKey, sendId, readStrict) {
+	const terminalOption = dedupTerminalOptionName(dedupKey);
+	const pendingOption = dedupPendingOptionName(dedupKey);
+	const poisonOption = dedupPoisonOptionName(dedupKey);
+	await tmuxExecAsync([
+		"set-option",
+		"-u",
+		"-t",
+		sessionName,
+		terminalOption,
+		";",
+		"set-option",
+		"-t",
+		sessionName,
+		pendingOption,
+		sendId
+	], { encoding: "utf-8" });
+	let repairedTerminal;
+	let repairedPending;
+	try {
+		[repairedTerminal, repairedPending] = await Promise.all([readStrict(sessionName, terminalOption), readStrict(sessionName, pendingOption)]);
+	} catch {
+		throw new KeyedMarkerVerificationError(sessionName, `repair verification of key "${dedupKey}"`);
+	}
+	if (repairedTerminal !== "" || repairedPending === "") throw new Error(`Keyed tmux markers for ${sessionName} are poisoned and could not be repaired (key "${dedupKey}")`);
+	await clearPoisonVerified(sessionName, poisonOption, `repair of key "${dedupKey}"`, readStrict);
+}
+/**
+* Deduplicated message paste for the tmux fallback path.
+*
+* Returns 'pasted' when this call pasted (caller must complete the submit),
+* 'submit-pending' when a prior attempt's paste is still awaiting submission
+* (caller must complete the submit — crucially WITHOUT pasting again), and
+* 'deduplicated' when the key is already terminal (caller does nothing; no
+* stray Enter, because the composer may hold unrelated operator text).
+*
+* Throws when the keyed paste did not land and no marker explains why —
+* silent loss must surface as a delivery failure, not as a false dedup.
+*/
+async function sendKeysDedup(sessionName, keys, dedupKey, caller, deps = {}) {
+	validateSessionName(sessionName);
+	assertValidDedupKey(dedupKey);
+	const read = deps.readMarker ?? readMarker;
+	const readStrict = deps.readMarkerStrict ?? readMarkerStrict;
+	const terminalOption = dedupTerminalOptionName(dedupKey);
+	const pendingOption = dedupPendingOptionName(dedupKey);
+	const poisonOption = dedupPoisonOptionName(dedupKey);
+	const sendId = randomUUID();
+	let poisonMarker;
+	try {
+		poisonMarker = await readStrict(sessionName, poisonOption);
+	} catch (error) {
+		throw new KeyedMarkerVerificationError(sessionName, `initial poison read (key "${dedupKey}")`, { cause: error });
+	}
+	const repaired = poisonMarker !== "";
+	if (repaired) await repairPoisonedMarkers(sessionName, dedupKey, sendId, readStrict);
+	const targetOption = dedupTargetOptionName(dedupKey);
+	const tmpFile = join$1(tmpdir(), `pan-sendkeys-${sendId}.txt`);
+	const bufferName = `pan-${sendId}`;
+	try {
+		await writeFile$1(tmpFile, keys, "utf-8");
+		await tmuxExecAsync([
+			"load-buffer",
+			"-b",
+			bufferName,
+			tmpFile
+		], { encoding: "utf-8" });
+		if (!repaired) await tmuxExecAsync([
+			"if-shell",
+			"-t",
+			sessionName,
+			`test -z "$(tmux show-option -qv -t ${sessionName} ${pendingOption})" && test -z "$(tmux show-option -qv -t ${sessionName} ${terminalOption})"`,
+			`paste-buffer -b ${bufferName} -p -t ${sessionName} \; set-option -t ${sessionName} ${pendingOption} ${sendId} \; set-option -F -t ${sessionName} ${targetOption} '#{pane_pid}'`
+		], { encoding: "utf-8" });
+		const [pendingMarker, terminalMarker] = await Promise.all([read(sessionName, pendingOption), read(sessionName, terminalOption)]);
+		if (terminalMarker !== "") return "deduplicated";
+		if (!repaired && pendingMarker === sendId) return "pasted";
+		if (pendingMarker !== "") {
+			const recordedTarget = await read(sessionName, targetOption);
+			const currentPid = (await (deps.readPaneTarget ?? readPaneTarget)(sessionName)).pid;
+			if (recordedTarget !== "" && currentPid !== "" && recordedTarget === currentPid) return "submit-pending";
+			await tmuxExecAsync([
+				"if-shell",
+				"-t",
+				sessionName,
+				`test -n "$(tmux show-option -qv -t ${sessionName} ${pendingOption})" && test -z "$(tmux show-option -qv -t ${sessionName} ${terminalOption})" && ! test "$(tmux display-message -p -t ${sessionName} '#{pane_pid}')" = "$(tmux show-option -qv -t ${sessionName} ${targetOption})"`,
+				`paste-buffer -b ${bufferName} -p -t ${sessionName} \; set-option -t ${sessionName} ${pendingOption} ${sendId} \; set-option -F -t ${sessionName} ${targetOption} '#{pane_pid}'`
+			], { encoding: "utf-8" });
+			const [repastedPending, repastedTerminal, repastedTarget] = await Promise.all([
+				read(sessionName, pendingOption),
+				read(sessionName, terminalOption),
+				read(sessionName, targetOption)
+			]);
+			if (repastedTerminal !== "") return "deduplicated";
+			if (repastedPending === sendId) return "pasted";
+			if (repastedPending !== "") {
+				const nowPid = (await (deps.readPaneTarget ?? readPaneTarget)(sessionName)).pid;
+				if (repastedTarget !== "" && nowPid !== "" && repastedTarget === nowPid) return "submit-pending";
+			}
+		}
+		throw new Error(`Keyed tmux paste for ${sessionName} did not land and no dedup marker was recorded` + (caller ? ` (caller: ${caller})` : ""));
+	} finally {
+		await unlink$1(tmpFile).catch(() => {});
+		await tmuxExecAsync([
+			"delete-buffer",
+			"-b",
+			bufferName
+		], { encoding: "utf-8" }).catch(() => {});
+	}
+}
+/**
+* Complete the paste-settle-submit transaction for a keyed tmux delivery.
+*
+* After the settle window, the SUBMISSION is one server-owned command: a
+* single `if-shell` whose condition requires the pending claim present, the
+* terminal marker absent, AND the pane alive, and whose command list sends
+* the Enter FIRST and then sets the POISON breadcrumb and the TERMINAL
+* marker and clears pending — the terminal is PROVISIONAL from the moment it
+* exists, so a dashboard crash can never strand an honorable-but-unverified
+* terminal (cycle 12). The tmux server executes the whole sequence:
+*
+* - A pane that died during the settle window fails the liveness condition —
+*   NO marker changes and NO Enter is sent, so the wake is never recorded as
+*   delivered when it never landed. The preserved pending claim lets
+*   recovery retry after the agent resumes.
+* - The pre-branch liveness condition is NOT proof of acceptance (cycle 10):
+*   the pane can die in the shell-to-branch handoff, and tmux reports
+*   send-keys into a remain-on-exit corpse as success. So after the command
+*   the target is re-read — if the pane died, was replaced, or cannot be
+*   identified around the Enter, the terminal marker is ROLLED BACK and the
+*   pending claim restored, and KeyedSubmitTargetDeadError is thrown. The
+*   breadcrumb is lifted only after verification, and clearing it is itself
+*   verified (cycle 12): a stale breadcrumb would let a later replay
+*   invalidate a legitimate terminal and re-submit.
+* - The Enter precedes the terminal transition inside the transaction, so a
+*   failed Enter (which aborts the command list) can never leave the key
+*   terminal.
+* - Exactly one caller becomes the completer; concurrent or post-crash
+*   callers lose the server-side condition and send no stray Enter into a
+*   composer that may hold unrelated operator text.
+*
+* Safe to call for both 'pasted' and 'submit-pending' phases; a call whose
+* key is already terminal is a no-op. Throws KeyedSubmitTargetDeadError when
+* the pane is dead (pending claim preserved), and a generic error when both
+* markers vanished without a submission.
+*/
+async function completeKeyedSubmit(sessionName, dedupKey, deps = {}) {
+	validateSessionName(sessionName);
+	assertValidDedupKey(dedupKey);
+	const read = deps.readMarker ?? readMarker;
+	const readStrict = deps.readMarkerStrict ?? readMarkerStrict;
+	const readTarget = deps.readPaneTarget ?? readPaneTarget;
+	const terminalOption = dedupTerminalOptionName(dedupKey);
+	const pendingOption = dedupPendingOptionName(dedupKey);
+	const poisonOption = dedupPoisonOptionName(dedupKey);
+	const targetOption = dedupTargetOptionName(dedupKey);
+	await new Promise((resolve) => setTimeout(resolve, PASTE_SETTLE_MS));
+	const preTarget = await readTarget(sessionName);
+	const pendingBefore = await read(sessionName, pendingOption);
+	await tmuxExecAsync([
+		"if-shell",
+		"-t",
+		sessionName,
+		`test -z "$(tmux show-option -qv -t ${sessionName} ${terminalOption})" && test -n "$(tmux show-option -qv -t ${sessionName} ${pendingOption})" && test "$(tmux display-message -p -t ${sessionName} '#{pane_dead}')" = "0" && test "$(tmux display-message -p -t ${sessionName} '#{pane_pid}')" = "$(tmux show-option -qv -t ${sessionName} ${targetOption})"`,
+		`send-keys -t ${sessionName} C-m \; set-option -t ${sessionName} ${poisonOption} 1 \; set-option -t ${sessionName} ${terminalOption} 1 \; set-option -u -t ${sessionName} ${pendingOption}`
+	], { encoding: "utf-8" });
+	const [terminalAfter, pendingAfter, postTarget, recordedTarget] = await Promise.all([
+		read(sessionName, terminalOption),
+		read(sessionName, pendingOption),
+		readTarget(sessionName),
+		read(sessionName, targetOption)
+	]);
+	const targetLost = preTarget.dead || preTarget.pid === "" || postTarget.dead || postTarget.pid !== preTarget.pid;
+	if (terminalAfter !== "") {
+		if (!targetLost) {
+			await clearPoisonVerified(sessionName, poisonOption, `verified delivery of key "${dedupKey}"`, readStrict);
+			return;
+		}
+		await tmuxExecAsync(pendingBefore === "" ? [
+			"set-option",
+			"-u",
+			"-t",
+			sessionName,
+			terminalOption,
+			";",
+			"set-option",
+			"-u",
+			"-t",
+			sessionName,
+			pendingOption
+		] : [
+			"set-option",
+			"-u",
+			"-t",
+			sessionName,
+			terminalOption,
+			";",
+			"set-option",
+			"-t",
+			sessionName,
+			pendingOption,
+			pendingBefore
+		], { encoding: "utf-8" }).catch(() => {});
+		let rolledTerminal;
+		let restoredPending;
+		try {
+			[rolledTerminal, restoredPending] = await Promise.all([readStrict(sessionName, terminalOption), readStrict(sessionName, pendingOption)]);
+		} catch {
+			throw new KeyedMarkerVerificationError(sessionName, `rollback verification of key "${dedupKey}"`);
+		}
+		if (rolledTerminal === "" && restoredPending !== "") await clearPoisonVerified(sessionName, poisonOption, `verified rollback of key "${dedupKey}"`, readStrict).catch(() => {});
+		throw new KeyedSubmitTargetDeadError(sessionName, dedupKey);
+	}
+	if (pendingAfter !== "") {
+		const replaced = recordedTarget === "" || postTarget.pid === "" || recordedTarget !== postTarget.pid;
+		if (targetLost || replaced) throw new KeyedSubmitTargetDeadError(sessionName, dedupKey);
+		throw new Error(`Keyed tmux submit for ${sessionName} was rejected with the pending claim intact on a live pane`);
+	}
+	throw new Error(`Keyed tmux submit for ${sessionName} found neither a pending claim nor a terminal marker — the paste vanished without submission`);
+}
+var DEDUP_KEY_RE, PASTE_SETTLE_MS, KeyedSubmitTargetDeadError, KeyedMarkerVerificationError;
+var init_tmux_dedup = __esmMin((() => {
+	init_tmux();
+	DEDUP_KEY_RE = /^[A-Za-z0-9:_-]+$/;
+	PASTE_SETTLE_MS = 300;
+	KeyedSubmitTargetDeadError = class extends Error {
+		constructor(sessionName, dedupKey) {
+			super(`Keyed tmux submit for ${sessionName} found a dead pane — the Enter was NOT accepted by a live harness, the pending claim for key "${dedupKey}" is preserved, and the key is not terminal`);
+			this.name = "KeyedSubmitTargetDeadError";
+		}
+	};
+	KeyedMarkerVerificationError = class extends Error {
+		constructor(sessionName, context, options) {
+			const causeText = options?.cause instanceof Error ? `: ${options.cause.message}` : "";
+			super(`Keyed tmux markers for ${sessionName} could not be verified (${context})${causeText}`, options);
+			this.name = "KeyedMarkerVerificationError";
+		}
+	};
+}));
+//#endregion
+//#region ../../lib/planning/auto-spawn-consent.ts
+function getOverdeckHome() {
+	return process.env["OVERDECK_HOME"] ?? join(homedir$1(), ".overdeck");
+}
+function autoSpawnOnFinalizeFlagPath(issueId) {
+	return join(getOverdeckHome(), "agents", `planning-${issueId.toLowerCase()}`, "auto-spawn-on-finalize.json");
+}
+function autoSpawnConsentLockPath(issueId) {
+	return join(getOverdeckHome(), "locks", "auto-spawn-consent", `${issueId.toLowerCase()}.lock`);
+}
+function parseConsentRecord(raw) {
+	const value = JSON.parse(raw);
+	if (value.version === 2 && typeof value.generation === "string" && (value.status === "granted" || value.status === "claimed" || value.status === "spent")) return value;
+	if (typeof value.autoSpawnOnFinalize === "boolean") return {
+		version: 2,
+		generation: "legacy",
+		status: value.autoSpawnOnFinalize ? "granted" : "spent",
+		updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
+	};
+	return null;
+}
+async function readConsentRecord(issueId) {
+	try {
+		return parseConsentRecord(await readFile(autoSpawnOnFinalizeFlagPath(issueId), "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function readConsentRecordForTransition(issueId) {
+	try {
+		const record = parseConsentRecord(await readFile(autoSpawnOnFinalizeFlagPath(issueId), "utf8"));
+		if (!record) throw new Error(`Invalid auto-start consent state for ${issueId.toUpperCase()}`);
+		return record;
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function writeConsentRecord(issueId, record) {
+	const path = autoSpawnOnFinalizeFlagPath(issueId);
+	const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	await mkdir(dirname(path), { recursive: true });
+	try {
+		await writeFile(temporaryPath, JSON.stringify(record), { mode: 384 });
+		await rename(temporaryPath, path);
+	} catch (error) {
+		await rm(temporaryPath, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+async function withConsentLock(issueId, writerId, operation) {
+	const lockPath = autoSpawnConsentLockPath(issueId);
+	await acquireRecordLock(lockPath, {
+		writerId,
+		recordPath: autoSpawnOnFinalizeFlagPath(issueId)
+	});
+	try {
+		return await operation();
+	} finally {
+		await releaseRecordLock(lockPath);
+	}
+}
+async function readAutoSpawnOnFinalizeFlagAsync(issueId) {
+	return (await readConsentRecord(issueId))?.status === "granted";
+}
+async function writeAutoSpawnOnFinalizeFlag(issueId, enabled) {
+	await withConsentLock(issueId, "planning-consent:new-cycle", async () => {
+		await writeConsentRecord(issueId, {
+			version: 2,
+			generation: randomUUID(),
+			status: enabled ? "granted" : "spent",
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	});
+}
+async function claimAutoSpawnConsentForWorkStart(issueId) {
+	return withConsentLock(issueId, "planning-consent:claim", async () => {
+		const current = await readConsentRecordForTransition(issueId);
+		if (!current) return null;
+		if (current.status !== "granted") throw new Error(`Auto-start consent for ${issueId.toUpperCase()} is unavailable because the current generation is ${current.status}`);
+		const claimId = randomUUID();
+		await writeConsentRecord(issueId, {
+			...current,
+			status: "claimed",
+			claimId,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return {
+			issueId: issueId.toUpperCase(),
+			generation: current.generation,
+			claimId
+		};
+	});
+}
+async function transitionClaim(claim, status, writerId) {
+	await withConsentLock(claim.issueId, writerId, async () => {
+		const current = await readConsentRecordForTransition(claim.issueId);
+		if (!current || current.generation !== claim.generation || current.status !== "claimed" || current.claimId !== claim.claimId) return;
+		await writeConsentRecord(claim.issueId, {
+			...current,
+			status,
+			claimId: void 0,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	});
+}
+async function completeAutoSpawnConsentClaim(claim) {
+	await transitionClaim(claim, "spent", "planning-consent:complete");
+}
+async function releaseAutoSpawnConsentClaim(claim) {
+	await transitionClaim(claim, "granted", "planning-consent:release");
+}
+async function withAutoSpawnConsentClaim(issueId, operation, options = {}) {
+	const claim = await claimAutoSpawnConsentForWorkStart(issueId);
+	if (!claim) throw new Error(`Auto-start consent for ${issueId.toUpperCase()} is required but no current generation exists`);
+	let accepted = false;
+	const accept = async () => {
+		if (accepted) return;
+		accepted = true;
+		try {
+			await completeAutoSpawnConsentClaim(claim);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			(options.logWarning ?? console.warn)(`[planning] Work start for ${issueId.toUpperCase()} succeeded; consent remains durably claimed because completion persistence failed: ${message}`);
+		}
+	};
+	try {
+		const result = await operation(accept);
+		if (!accepted) if ((options.isAccepted ?? (() => true))(result)) await accept();
+		else await releaseAutoSpawnConsentClaim(claim);
+		return result;
+	} catch (error) {
+		if (!accepted) try {
+			await releaseAutoSpawnConsentClaim(claim);
+		} catch (releaseError) {
+			const message = releaseError instanceof Error ? releaseError.message : String(releaseError);
+			(options.logWarning ?? console.warn)(`[planning] Work start for ${issueId.toUpperCase()} failed; consent remains fail-closed because claim release failed: ${message}`);
+		}
+		throw error;
+	}
+}
+var init_auto_spawn_consent = __esmMin((() => {
+	init_fs_lock();
+}));
+//#endregion
+export { init_launcher_generator as C, requireModelOverrideSync as D, normalizeModelOverrideSync as E, shellQuoteModelIdSync as O, generateLauncherScriptSync as S, init_model_validation as T, init_tmux_dedup as _, readAutoSpawnOnFinalizeFlagAsync as a, isOperatorStartedBy as b, writeAutoSpawnOnFinalizeFlag as c, assertValidDedupKey as d, completeKeyedSubmit as f, dedupTerminalOptionName as g, dedupTargetOptionName as h, init_auto_spawn_consent as i, KeyedMarkerVerificationError as l, dedupPoisonOptionName as m, claimAutoSpawnConsentForWorkStart as n, releaseAutoSpawnConsentClaim as o, dedupPendingOptionName as p, completeAutoSpawnConsentClaim as r, withAutoSpawnConsentClaim as s, autoSpawnOnFinalizeFlagPath as t, KeyedSubmitTargetDeadError as u, sendKeysDedup as v, MODEL_ID_PATTERN as w, normalizeFlywheelRunId as x, init_provenance as y };
+
+//# sourceMappingURL=auto-spawn-consent-CQ9Bi9q6.js.map