@overdeck/desktop 0.46.0 → 0.47.0

package/server/{tmux-dedup-DbN6MGzM.js → auto-spawn-consent-CQ9Bi9q6.js}

@@ -1,14 +1,18 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { H as init_providers, W as qualifyPiModel, ci as init_paths, si as getOverdeckHome, ui as packageRoot } from "./config-yaml-CmOPzmBb.js";
-import { G as tmuxExecAsync, J as colorFgBgForTheme, K as validateSessionName, X as init_ui_theme, Y as getUiThemeSync, w as init_tmux } from "./tmux-B1Wbxz5o.js";
-import { s as getHarnessBehavior } from "./src-CRmCHlma.js";
-import { t as init_behavior } from "./behavior-CfIg6pKp.js";
-import { f as toCodexSandboxValue, l as init_codex } from "./codex-Drlf5Xhf.js";
+import { H as init_providers, W as qualifyPiModel, ci as getOverdeckHome$1, di as packageRoot, li as init_paths } from "./config-yaml-CxdwhAIA.js";
+import { i as releaseRecordLock, n as init_fs_lock, t as acquireRecordLock } from "./fs-lock-Bre3sGoz.js";
+import { $ as colorFgBgForTheme, G as tmuxExecAsync, K as validateSessionName, et as getUiThemeSync, tt as init_ui_theme, w as init_tmux } from "./tmux-CfDHob9M.js";
+import { s as getHarnessBehavior } from "./src-B948bGVR.js";
+import { t as init_behavior } from "./behavior-td6-xhQk.js";
+import { f as toCodexSandboxValue, l as init_codex } from "./codex-BzGDW_d3.js";
 import { dirname, join } from "node:path";
 import { Data } from "effect";
 import { join as join$1 } from "path";
 import { tmpdir } from "os";
-import { unlink, writeFile } from "fs/promises";
+import { homedir as homedir$1 } from "node:os";
+import "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { unlink as unlink$1, writeFile as writeFile$1 } from "fs/promises";
 import { randomUUID } from "node:crypto";
 //#region ../../lib/model-validation.ts
 function normalizeModelOverrideSync(value) {
@@ -34,19 +38,54 @@ var init_model_validation = __esmMin((() => {
 }));
 //#endregion
 //#region ../../lib/launcher-git-guard.ts
+/**
+* Per-agent `git` shim installed on the agent's PATH by its launcher.
+*
+* The shim blocks the three history-moving commands agents must never run
+* against their own worktree (`rebase`, state-moving `stash`, `reset --hard`)
+* and passes everything else through to the real git.
+*
+* Two scoping rules keep the guard honest (PAN-3189):
+*
+*   1. It only fires when the git invocation targets the agent's own worktree
+*      (`guardRoot`). A `git rebase` inside a test fixture's temp repo is not
+*      the behavior this guard exists to prevent, and blocking it made the
+*      workspace test suite untrustworthy — which pushed agents onto weaker
+*      gates, or onto stripping the guard entirely.
+*   2. The launcher drops any *other* agent's guard directory from PATH before
+*      prepending its own, so a Flywheel-spawned agent never runs behind the
+*      orchestrator's shim inherited through the environment.
+*/
 function shellQuote$1(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-function buildGitGuardLines(agentId) {
-	const guardDir = join(getOverdeckHome(), "agents", agentId, "git-guard");
+/**
+* Emit the launcher lines that materialize and install the per-agent git guard.
+*
+* @param agentId   Owning agent id — the guard lives in `~/.overdeck/agents/<id>/git-guard`.
+* @param guardRoot The agent's worktree. Only git commands targeting this
+*                  directory (or a descendant) are guarded.
+*/
+function buildGitGuardLines(agentId, guardRoot) {
+	const guardDir = join(getOverdeckHome$1(), "agents", agentId, "git-guard");
 	const guardPath = join(guardDir, "git");
 	const pathForDoubleQuotes = guardDir.replace(/([\\"$`])/g, "\\$1");
 	return [
+		"IFS=':' read -r -a _overdeck_path_segments <<< \"$PATH\"",
+		"_overdeck_kept_path=()",
+		"for _overdeck_path_segment in \"${_overdeck_path_segments[@]}\"; do",
+		"  [[ \"$_overdeck_path_segment\" == */git-guard ]] || _overdeck_kept_path+=(\"$_overdeck_path_segment\")",
+		"done",
+		"PATH=\"$(IFS=':'; echo \"${_overdeck_kept_path[*]}\")\"",
+		"unset _overdeck_path_segments _overdeck_kept_path _overdeck_path_segment",
 		"_OVERDECK_REAL_GIT=\"$(command -v git)\"",
+		`_OVERDECK_GUARD_ROOT="$(cd ${shellQuote$1(guardRoot)} 2>/dev/null && pwd -P)"`,
+		`[ -n "$_OVERDECK_GUARD_ROOT" ] || _OVERDECK_GUARD_ROOT=${shellQuote$1(guardRoot)}`,
 		`mkdir -p ${shellQuote$1(guardDir)}`,
 		`cat > ${shellQuote$1(guardPath)} <<EOF`,
 		"#!/bin/sh",
 		"_OVERDECK_REAL_GIT=\"$_OVERDECK_REAL_GIT\"",
+		"_OVERDECK_GUARD_ROOT=\"$_OVERDECK_GUARD_ROOT\"",
 		"if [ \"\\$OVERDECK_PAN_GIT_OP\" = \"1\" ]; then",
 		"  exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\"",
 		"fi",
@@ -75,8 +114,62 @@ function buildGitGuardLines(agentId) {
 		"  done",
 		"  [ \"\\$#\" -gt 0 ] && printf \"%s\\n\" \"\\$1\"",
 		"}",
+		"_overdeck_git_target_dir() {",
+		"  _overdeck_dir=\"\\$(pwd -P 2>/dev/null || pwd)\"",
+		"  while [ \"\\$#\" -gt 0 ]; do",
+		"    case \"\\$1\" in",
+		"      -C)",
+		"        shift",
+		"        [ \"\\$#\" -gt 0 ] || break",
+		"        case \"\\$1\" in",
+		"          /*) _overdeck_dir=\"\\$1\" ;;",
+		"          *) _overdeck_dir=\"\\$_overdeck_dir/\\$1\" ;;",
+		"        esac",
+		"        shift",
+		"        ;;",
+		"      -C?*)",
+		"        _overdeck_c_value=\"\\${1#-C}\"",
+		"        case \"\\$_overdeck_c_value\" in",
+		"          /*) _overdeck_dir=\"\\$_overdeck_c_value\" ;;",
+		"          *) _overdeck_dir=\"\\$_overdeck_dir/\\$_overdeck_c_value\" ;;",
+		"        esac",
+		"        shift",
+		"        ;;",
+		"      -c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix|--attr-source)",
+		"        shift",
+		"        [ \"\\$#\" -gt 0 ] && shift",
+		"        ;;",
+		"      -c?*|--git-dir=*|--work-tree=*|--namespace=*|--config-env=*|--super-prefix=*|--attr-source=*)",
+		"        shift",
+		"        ;;",
+		"      --)",
+		"        break",
+		"        ;;",
+		"      -*)",
+		"        shift",
+		"        ;;",
+		"      *)",
+		"        break",
+		"        ;;",
+		"    esac",
+		"  done",
+		"  if [ -d \"\\$_overdeck_dir\" ]; then",
+		"    (cd \"\\$_overdeck_dir\" 2>/dev/null && pwd -P) || printf \"%s\\n\" \"\\$_overdeck_dir\"",
+		"  else",
+		"    printf \"%s\\n\" \"\\$_overdeck_dir\"",
+		"  fi",
+		"}",
 		"_overdeck_git_command=\"\\$(_overdeck_git_find_command \"\\$@\")\"",
 		"case \"\\$_overdeck_git_command\" in",
+		"  rebase|stash|reset) ;;",
+		"  *) exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\" ;;",
+		"esac",
+		"_overdeck_git_target=\"\\$(_overdeck_git_target_dir \"\\$@\")\"",
+		"case \"\\$_overdeck_git_target\" in",
+		"  \"\\$_OVERDECK_GUARD_ROOT\"|\"\\$_OVERDECK_GUARD_ROOT\"/*) ;;",
+		"  *) exec \"\\$_OVERDECK_REAL_GIT\" \"\\$@\" ;;",
+		"esac",
+		"case \"\\$_overdeck_git_command\" in",
 		"  rebase)",
 		"    echo \"Overdeck agents must not run git rebase directly. Use pan sync-main to sync main or pan done to submit.\" >&2",
 		"    exit 1",
@@ -190,7 +283,7 @@ function generateLauncherScriptSync(config) {
 			explicitlySetOverdeckKeys.add("OVERDECK_SESSION_TYPE");
 		}
 	}
-	if (config.overdeckEnv?.agentId && config.spawnMode !== "conversation") lines.push(...buildGitGuardLines(config.overdeckEnv.agentId));
+	if (config.overdeckEnv?.agentId && config.spawnMode !== "conversation") lines.push(...buildGitGuardLines(config.overdeckEnv.agentId, config.workingDir));
 	if (config.extraEnvExports) for (const expr of config.extraEnvExports) lines.push(expr);
 	if (config.codexHome) lines.push(`export CODEX_HOME=${shellQuote(config.codexHome)}`);
 	if (config.changeDir !== false) lines.push(`cd -- ${shellQuote(config.workingDir)}`);
@@ -497,6 +590,17 @@ var init_launcher_generator = __esmMin((() => {
 	];
 }));
 //#endregion
+//#region ../../lib/agents/provenance.ts
+function normalizeFlywheelRunId(runId) {
+	if (!runId) return void 0;
+	const trimmed = runId.trim();
+	return /^RUN-\d+$/.test(trimmed) ? trimmed : void 0;
+}
+function isOperatorStartedBy(startedBy) {
+	return startedBy.startsWith("operator:") || startedBy === "dashboard:agent-spawner";
+}
+var init_provenance = __esmMin((() => {}));
+//#endregion
 //#region ../../lib/tmux-dedup.ts
 /**
 * Keyed, crash-safe tmux delivery (PAN-2997).
@@ -707,7 +811,7 @@ async function sendKeysDedup(sessionName, keys, dedupKey, caller, deps = {}) {
 	const tmpFile = join$1(tmpdir(), `pan-sendkeys-${sendId}.txt`);
 	const bufferName = `pan-${sendId}`;
 	try {
-		await writeFile(tmpFile, keys, "utf-8");
+		await writeFile$1(tmpFile, keys, "utf-8");
 		await tmuxExecAsync([
 			"load-buffer",
 			"-b",
@@ -749,7 +853,7 @@ async function sendKeysDedup(sessionName, keys, dedupKey, caller, deps = {}) {
 		}
 		throw new Error(`Keyed tmux paste for ${sessionName} did not land and no dedup marker was recorded` + (caller ? ` (caller: ${caller})` : ""));
 	} finally {
-		await unlink(tmpFile).catch(() => {});
+		await unlink$1(tmpFile).catch(() => {});
 		await tmuxExecAsync([
 			"delete-buffer",
 			"-b",
@@ -887,6 +991,151 @@ var init_tmux_dedup = __esmMin((() => {
 	};
 }));
 //#endregion
-export { shellQuoteModelIdSync as _, dedupPendingOptionName as a, dedupTerminalOptionName as c, generateLauncherScriptSync as d, init_launcher_generator as f, requireModelOverrideSync as g, normalizeModelOverrideSync as h, completeKeyedSubmit as i, init_tmux_dedup as l, init_model_validation as m, KeyedSubmitTargetDeadError as n, dedupPoisonOptionName as o, MODEL_ID_PATTERN as p, assertValidDedupKey as r, dedupTargetOptionName as s, KeyedMarkerVerificationError as t, sendKeysDedup as u };
+//#region ../../lib/planning/auto-spawn-consent.ts
+function getOverdeckHome() {
+	return process.env["OVERDECK_HOME"] ?? join(homedir$1(), ".overdeck");
+}
+function autoSpawnOnFinalizeFlagPath(issueId) {
+	return join(getOverdeckHome(), "agents", `planning-${issueId.toLowerCase()}`, "auto-spawn-on-finalize.json");
+}
+function autoSpawnConsentLockPath(issueId) {
+	return join(getOverdeckHome(), "locks", "auto-spawn-consent", `${issueId.toLowerCase()}.lock`);
+}
+function parseConsentRecord(raw) {
+	const value = JSON.parse(raw);
+	if (value.version === 2 && typeof value.generation === "string" && (value.status === "granted" || value.status === "claimed" || value.status === "spent")) return value;
+	if (typeof value.autoSpawnOnFinalize === "boolean") return {
+		version: 2,
+		generation: "legacy",
+		status: value.autoSpawnOnFinalize ? "granted" : "spent",
+		updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
+	};
+	return null;
+}
+async function readConsentRecord(issueId) {
+	try {
+		return parseConsentRecord(await readFile(autoSpawnOnFinalizeFlagPath(issueId), "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function readConsentRecordForTransition(issueId) {
+	try {
+		const record = parseConsentRecord(await readFile(autoSpawnOnFinalizeFlagPath(issueId), "utf8"));
+		if (!record) throw new Error(`Invalid auto-start consent state for ${issueId.toUpperCase()}`);
+		return record;
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function writeConsentRecord(issueId, record) {
+	const path = autoSpawnOnFinalizeFlagPath(issueId);
+	const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	await mkdir(dirname(path), { recursive: true });
+	try {
+		await writeFile(temporaryPath, JSON.stringify(record), { mode: 384 });
+		await rename(temporaryPath, path);
+	} catch (error) {
+		await rm(temporaryPath, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+async function withConsentLock(issueId, writerId, operation) {
+	const lockPath = autoSpawnConsentLockPath(issueId);
+	await acquireRecordLock(lockPath, {
+		writerId,
+		recordPath: autoSpawnOnFinalizeFlagPath(issueId)
+	});
+	try {
+		return await operation();
+	} finally {
+		await releaseRecordLock(lockPath);
+	}
+}
+async function readAutoSpawnOnFinalizeFlagAsync(issueId) {
+	return (await readConsentRecord(issueId))?.status === "granted";
+}
+async function writeAutoSpawnOnFinalizeFlag(issueId, enabled) {
+	await withConsentLock(issueId, "planning-consent:new-cycle", async () => {
+		await writeConsentRecord(issueId, {
+			version: 2,
+			generation: randomUUID(),
+			status: enabled ? "granted" : "spent",
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	});
+}
+async function claimAutoSpawnConsentForWorkStart(issueId) {
+	return withConsentLock(issueId, "planning-consent:claim", async () => {
+		const current = await readConsentRecordForTransition(issueId);
+		if (!current) return null;
+		if (current.status !== "granted") throw new Error(`Auto-start consent for ${issueId.toUpperCase()} is unavailable because the current generation is ${current.status}`);
+		const claimId = randomUUID();
+		await writeConsentRecord(issueId, {
+			...current,
+			status: "claimed",
+			claimId,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return {
+			issueId: issueId.toUpperCase(),
+			generation: current.generation,
+			claimId
+		};
+	});
+}
+async function transitionClaim(claim, status, writerId) {
+	await withConsentLock(claim.issueId, writerId, async () => {
+		const current = await readConsentRecordForTransition(claim.issueId);
+		if (!current || current.generation !== claim.generation || current.status !== "claimed" || current.claimId !== claim.claimId) return;
+		await writeConsentRecord(claim.issueId, {
+			...current,
+			status,
+			claimId: void 0,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	});
+}
+async function completeAutoSpawnConsentClaim(claim) {
+	await transitionClaim(claim, "spent", "planning-consent:complete");
+}
+async function releaseAutoSpawnConsentClaim(claim) {
+	await transitionClaim(claim, "granted", "planning-consent:release");
+}
+async function withAutoSpawnConsentClaim(issueId, operation, options = {}) {
+	const claim = await claimAutoSpawnConsentForWorkStart(issueId);
+	if (!claim) throw new Error(`Auto-start consent for ${issueId.toUpperCase()} is required but no current generation exists`);
+	let accepted = false;
+	const accept = async () => {
+		if (accepted) return;
+		accepted = true;
+		try {
+			await completeAutoSpawnConsentClaim(claim);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			(options.logWarning ?? console.warn)(`[planning] Work start for ${issueId.toUpperCase()} succeeded; consent remains durably claimed because completion persistence failed: ${message}`);
+		}
+	};
+	try {
+		const result = await operation(accept);
+		if (!accepted) if ((options.isAccepted ?? (() => true))(result)) await accept();
+		else await releaseAutoSpawnConsentClaim(claim);
+		return result;
+	} catch (error) {
+		if (!accepted) try {
+			await releaseAutoSpawnConsentClaim(claim);
+		} catch (releaseError) {
+			const message = releaseError instanceof Error ? releaseError.message : String(releaseError);
+			(options.logWarning ?? console.warn)(`[planning] Work start for ${issueId.toUpperCase()} failed; consent remains fail-closed because claim release failed: ${message}`);
+		}
+		throw error;
+	}
+}
+var init_auto_spawn_consent = __esmMin((() => {
+	init_fs_lock();
+}));
+//#endregion
+export { init_launcher_generator as C, requireModelOverrideSync as D, normalizeModelOverrideSync as E, shellQuoteModelIdSync as O, generateLauncherScriptSync as S, init_model_validation as T, init_tmux_dedup as _, readAutoSpawnOnFinalizeFlagAsync as a, isOperatorStartedBy as b, writeAutoSpawnOnFinalizeFlag as c, assertValidDedupKey as d, completeKeyedSubmit as f, dedupTerminalOptionName as g, dedupTargetOptionName as h, init_auto_spawn_consent as i, KeyedMarkerVerificationError as l, dedupPoisonOptionName as m, claimAutoSpawnConsentForWorkStart as n, releaseAutoSpawnConsentClaim as o, dedupPendingOptionName as p, completeAutoSpawnConsentClaim as r, withAutoSpawnConsentClaim as s, autoSpawnOnFinalizeFlagPath as t, KeyedSubmitTargetDeadError as u, sendKeysDedup as v, MODEL_ID_PATTERN as w, normalizeFlywheelRunId as x, init_provenance as y };
 
-//# sourceMappingURL=tmux-dedup-DbN6MGzM.js.map
+//# sourceMappingURL=auto-spawn-consent-CQ9Bi9q6.js.map

package/server/{backlog-auto-trigger-Dh-i9PQf.js → backlog-auto-trigger-n1lzPgN4.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-C5ULAXwO.js";
-import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-B2WeCtGi.js";
+import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-BgD0JUmM.js";
+import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-CigMyKh2.js";
 //#region ../../lib/backlog/backlog-auto-trigger.ts
 /**
 * PAN-2396: --no-resume is the operator's full-quiescence escape hatch —
@@ -37,4 +37,4 @@ __esmMin((() => {
 }))();
 export { triggerDebouncedIncrementalPass };
 
-//# sourceMappingURL=backlog-auto-trigger-Dh-i9PQf.js.map
+//# sourceMappingURL=backlog-auto-trigger-n1lzPgN4.js.map

package/server/{behavior-CfIg6pKp.js → behavior-td6-xhQk.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { t as init_src } from "./src-CRmCHlma.js";
+import { t as init_src } from "./src-B948bGVR.js";
 //#region ../../lib/runtimes/behavior.ts
 var init_behavior = __esmMin((() => {
 	init_src();
@@ -7,4 +7,4 @@ var init_behavior = __esmMin((() => {
 //#endregion
 export { init_behavior as t };
 
-//# sourceMappingURL=behavior-CfIg6pKp.js.map
+//# sourceMappingURL=behavior-td6-xhQk.js.map

package/server/boot-reconciled-stop-events-C7gGe3oB.js

@@ -0,0 +1,44 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+//#region services/boot-reconciled-stop-events.ts
+async function appendStopOnce(store, stop, errorMessage) {
+	const pendingByKey = appendByStore.get(store) ?? /* @__PURE__ */ new Map();
+	appendByStore.set(store, pendingByKey);
+	const key = `${stop.id}:${stop.previousStatus}`;
+	const existing = pendingByKey.get(key);
+	if (existing && await existing) return;
+	const pending = (async () => {
+		try {
+			const sequence = await store.appendAsync({
+				type: "agent.status_changed",
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				payload: {
+					agentId: stop.id,
+					status: "stopped",
+					previousStatus: stop.previousStatus,
+					hasLiveTmuxSession: false
+				}
+			});
+			if (sequence <= 0) throw new Error(`Event append returned invalid sequence ${sequence}`);
+			return true;
+		} catch (err) {
+			console.error(errorMessage, err);
+			return false;
+		}
+	})();
+	pendingByKey.set(key, pending);
+	if (!await pending && pendingByKey.get(key) === pending) pendingByKey.delete(key);
+}
+async function emitBootReconciledStopEvents(store, stopped, presentAgents, errorMessage) {
+	for (const stop of stopped) {
+		if (!presentAgents[stop.id]) continue;
+		await appendStopOnce(store, stop, errorMessage);
+	}
+}
+var appendByStore;
+var init_boot_reconciled_stop_events = __esmMin((() => {
+	appendByStore = /* @__PURE__ */ new WeakMap();
+}));
+//#endregion
+export { init_boot_reconciled_stop_events as n, emitBootReconciledStopEvents as t };
+
+//# sourceMappingURL=boot-reconciled-stop-events-C7gGe3oB.js.map

package/server/{bridge-pool-patrol-CUFmjVDN.js → bridge-pool-patrol-CYH2OLb5.js}

@@ -133,4 +133,4 @@ async function patrolDockerBridgePool(deps = {}) {
 //#endregion
 export { patrolDockerBridgePool };
 
-//# sourceMappingURL=bridge-pool-patrol-CUFmjVDN.js.map
+//# sourceMappingURL=bridge-pool-patrol-CYH2OLb5.js.map

package/server/{briefing-freshness-DHmCSLar.js → briefing-freshness-DRqZ8lAz.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ci as init_paths, si as getOverdeckHome } from "./config-yaml-CmOPzmBb.js";
+import { ci as getOverdeckHome, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { mkdir, readFile, rename, stat, writeFile } from "fs/promises";
@@ -128,4 +128,4 @@ var init_briefing_freshness = __esmMin((() => {
 //#endregion
 export { resolveSessionContextBriefingPath as a, recordBriefingSessionStart as i, ensureSessionContextBriefingFile as n, init_briefing_freshness as r, appendFreshBriefingUpdate as t };
 
-//# sourceMappingURL=briefing-freshness-DHmCSLar.js.map
+//# sourceMappingURL=briefing-freshness-DRqZ8lAz.js.map

package/server/{build-info-CuFfxZxp.js → build-info-7yiEpl6u.js}

@@ -2,8 +2,8 @@ import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
 //#region ../../lib/deploy/build-info.ts
 function getBuildInfo() {
 	return {
-		buildCommit: "5d0b41f1bfcdabdec46ca1212b17f0d4b6edb14a",
-		builtAt: "2026-07-27T02:12:59.776Z",
+		buildCommit: "3eff6973c550a453f51d6c294df9154365f76528",
+		builtAt: "2026-07-27T19:06:18.015Z",
 		buildDirty: false,
 		buildBranch: null
 	};
@@ -12,4 +12,4 @@ var init_build_info = __esmMin((() => {}));
 //#endregion
 export { init_build_info as n, getBuildInfo as t };
 
-//# sourceMappingURL=build-info-CuFfxZxp.js.map
+//# sourceMappingURL=build-info-7yiEpl6u.js.map

package/server/{build-info-BP160gU7.js → build-info-CpG__c63.js}

@@ -1,3 +1,3 @@
-import { n as init_build_info, t as getBuildInfo } from "./build-info-CuFfxZxp.js";
+import { n as init_build_info, t as getBuildInfo } from "./build-info-7yiEpl6u.js";
 init_build_info();
 export { getBuildInfo };

package/server/{checkpoint-manager-Dxh0FYsv.js → checkpoint-manager-CkKmB0wZ.js}

@@ -1,3 +1,3 @@
-import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-DEWD82qK.js";
+import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-DBcyNR8w.js";
 init_checkpoint_manager();
 export { deleteLegacyCheckpointRefs, diffCheckpointFiles, getCheckpointTimestamp, listCheckpoints, pruneCheckpointRefsForAgents, pruneStaleCheckpointRefs };

package/server/{checkpoint-manager-DEWD82qK.js → checkpoint-manager-DBcyNR8w.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Fr as init_errors, Or as InvalidAgentIdError, Pr as VcsError, Sr as CheckpointError, fn as STATE_BRANCH_PATHS, hn as init_state_plane } from "./config-yaml-CmOPzmBb.js";
+import { Fr as init_errors, Or as InvalidAgentIdError, Pr as VcsError, Sr as CheckpointError, fn as STATE_BRANCH_PATHS, hn as init_state_plane } from "./config-yaml-CxdwhAIA.js";
 import { Effect, Layer } from "effect";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -663,4 +663,4 @@ var init_checkpoint_manager = __esmMin((() => {
 //#endregion
 export { pruneStaleCheckpointRefs as _, diffAgainstMain as a, diffCheckpoints as c, diffPatchSinceCommit as d, findCommitAtTime as f, pruneCheckpointRefsForAgents as g, listCheckpoints as h, deleteLegacyCheckpointRefs as i, diffFilesAgainstHead as l, init_checkpoint_manager as m, checkpointStateExclusions as n, diffAgainstMainFiles as o, getCheckpointTimestamp as p, deleteCheckpoint as r, diffCheckpointFiles as s, captureCheckpoint as t, diffPatchFilesAgainstHead as u };
 
-//# sourceMappingURL=checkpoint-manager-DEWD82qK.js.map
+//# sourceMappingURL=checkpoint-manager-DBcyNR8w.js.map

package/server/checkpoint-worker.js

@@ -1,4 +1,4 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-CZvbtLnr.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-D95apurL.js";
 import { parentPort } from "node:worker_threads";
 //#region ../../lib/memory/checkpoint-worker.ts
 function runOperation(operation, payload) {

package/server/{checkpoints-CZvbtLnr.js → checkpoints-D95apurL.js}

@@ -1,4 +1,4 @@
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BjuxvjdS.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BDQDRopn.js";
 import { randomUUID } from "node:crypto";
 //#region ../../lib/overdeck/transcript-checkpoint-sync.ts
 /**
@@ -195,4 +195,4 @@ function getTranscriptCheckpoint(sessionId) {
 //#endregion
 export { releaseTranscriptRange as a, listTranscriptCheckpoints as i, commitTranscriptRange as n, getTranscriptCheckpoint as r, claimTranscriptRange as t };
 
-//# sourceMappingURL=checkpoints-CZvbtLnr.js.map
+//# sourceMappingURL=checkpoints-D95apurL.js.map

package/server/{checkpoints-DMTgXuLG.js → checkpoints-Wm963lm8.js}

@@ -1,2 +1,2 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-CZvbtLnr.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-D95apurL.js";
 export { claimTranscriptRange, commitTranscriptRange, getTranscriptCheckpoint, listTranscriptCheckpoints, releaseTranscriptRange };

package/server/{claude-hooks-provision-CN-xo-do.js → claude-hooks-provision-4RPxNkE8.js}

@@ -1,3 +1,3 @@
-import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-fvy4RD2b.js";
+import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-Bjitl9aI.js";
 init_claude_hooks_provision();
 export { provisionClaudeHooks };

package/server/{claude-hooks-provision-fvy4RD2b.js → claude-hooks-provision-Bjitl9aI.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Qr as SYNC_SOURCES, Rr as BIN_DIR, ci as init_paths } from "./config-yaml-CmOPzmBb.js";
+import { Qr as SYNC_SOURCES, Rr as BIN_DIR, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
@@ -386,4 +386,4 @@ var init_claude_hooks_provision = __esmMin((() => {
 //#endregion
 export { provisionClaudeHooks as n, init_claude_hooks_provision as t };
 
-//# sourceMappingURL=claude-hooks-provision-fvy4RD2b.js.map
+//# sourceMappingURL=claude-hooks-provision-Bjitl9aI.js.map

package/server/{claude-permissions-CN0cSCPp.js → claude-permissions-CpbpvUQ2.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-CmOPzmBb.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-CxdwhAIA.js";
 import "effect";
 //#region ../../lib/claude-permissions.ts
 /** Read PAN_YOLO from the current process env. Returns the implied mode, or undefined if unset/unparseable. */
@@ -94,4 +94,4 @@ var init_claude_permissions = __esmMin((() => {
 //#endregion
 export { init_claude_permissions as a, getClaudePermissionFlagsSync as i, buildClaudeUserSettingsSync as n, resolvePermissionModeSync as o, getClaudePermissionFlagsStringSync as r, BYPASS_PERMISSION_MODE as t };
 
-//# sourceMappingURL=claude-permissions-CN0cSCPp.js.map
+//# sourceMappingURL=claude-permissions-CpbpvUQ2.js.map

package/server/{claude-settings-overlay-Dabi9slj.js → claude-settings-overlay-BzkHYDwR.js}

@@ -1,3 +1,3 @@
-import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CJn35FHQ.js";
+import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-_H9Yrzab.js";
 init_claude_settings_overlay();
 export { injectOverdeckInfraDeny };

package/server/{claude-settings-overlay-CJn35FHQ.js → claude-settings-overlay-_H9Yrzab.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Fr as init_errors, Tr as FsError } from "./config-yaml-CmOPzmBb.js";
+import { Fr as init_errors, Tr as FsError } from "./config-yaml-CxdwhAIA.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
 import { homedir, tmpdir } from "os";
@@ -142,4 +142,4 @@ var init_claude_settings_overlay = __esmMin((() => {
 //#endregion
 export { init_claude_settings_overlay as n, injectOverdeckInfraDeny as r, detectProviderEnvConflicts as t };
 
-//# sourceMappingURL=claude-settings-overlay-CJn35FHQ.js.map
+//# sourceMappingURL=claude-settings-overlay-_H9Yrzab.js.map

package/server/cli-CjOCSnfj.js

@@ -0,0 +1,3 @@
+import { r as init_cli, t as createResetMarker } from "./cli-Cte9ZFGn.js";
+init_cli();
+export { createResetMarker };

package/server/{cli-oCWYA1pE.js → cli-Cte9ZFGn.js}

@@ -1,11 +1,11 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ci as init_paths } from "./config-yaml-CmOPzmBb.js";
-import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-cXmOwSbh.js";
-import { b as init_agents } from "./queries-DHJm7bTd.js";
-import { i as init_settings } from "./settings-Bse1Pdcj.js";
-import { r as init_health, t as init_providers } from "./providers-evXhiQeg.js";
-import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-BeOomFa-.js";
-import { r as init_rollup } from "./rollup-DTNvelz9.js";
+import { li as init_paths } from "./config-yaml-CxdwhAIA.js";
+import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-sJBSb7Ul.js";
+import { b as init_agents } from "./queries-C-MUZaIy.js";
+import { i as init_settings } from "./settings-VN0qOh4U.js";
+import { r as init_health, t as init_providers } from "./providers-BJQSnAAp.js";
+import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-IVc4_M3f.js";
+import { r as init_rollup } from "./rollup-BQaol5TX.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { readFile, rename, writeFile } from "fs/promises";
@@ -194,7 +194,7 @@ async function writeResetMarkerToFtsDb(projectId, marker) {
 	});
 }
 async function emitResetMarkerCreated(marker, timestamp) {
-	const { initEventStore } = await import("./event-store-ELqkVOn0.js");
+	const { initEventStore } = await import("./event-store-5UKzh9Jf.js");
 	await (await initEventStore()).appendAsync({
 		type: "memory.reset_marker_created",
 		timestamp,
@@ -221,4 +221,4 @@ var init_cli = __esmMin((() => {
 //#endregion
 export { generateDailySummary as n, init_cli as r, createResetMarker as t };
 
-//# sourceMappingURL=cli-oCWYA1pE.js.map
+//# sourceMappingURL=cli-Cte9ZFGn.js.map

package/server/{cliproxy-C8mB3KuB.js → cliproxy-C5fMJ7rY.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Fr as init_errors, Gr as OVERDECK_HOME, Rr as BIN_DIR, Tr as FsError, ci as init_paths, jr as ProcessSpawnError } from "./config-yaml-CmOPzmBb.js";
+import { Fr as init_errors, Gr as OVERDECK_HOME, Rr as BIN_DIR, Tr as FsError, jr as ProcessSpawnError, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { Data, Effect } from "effect";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -496,4 +496,4 @@ var init_cliproxy = __esmMin((() => {
 //#endregion
 export { restartCliproxy as C, readPidFile as S, stopCliproxy as T, getCliproxyPidPath as _, CliproxyError as a, isCliproxyInstalled as b, bridgeGeminiAuthToCliproxy as c, getCliproxyAuthDir as d, getCliproxyBinary as f, getCliproxyLogPath as g, getCliproxyDir as h, CLIPROXY_PORT as i, decodeJwtPayload as l, getCliproxyConfigPath as m, CLIPROXY_BASE_URL as n, bridgeCodexAuthToCliproxy as o, getCliproxyClientEnv as p, CLIPROXY_HOST as r, bridgeCodexAuthToCliproxySync as s, CLIPROXY_AUTH_TOKEN as t, detectPlatformAsset as u, init_cliproxy as v, startCliproxy as w, isCliproxyRunning as x, installCliproxy as y };
 
-//# sourceMappingURL=cliproxy-C8mB3KuB.js.map
+//# sourceMappingURL=cliproxy-C5fMJ7rY.js.map

package/server/{cliproxy-PGwTX_o8.js → cliproxy-DaAbWMjC.js}

@@ -1,3 +1,3 @@
-import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-C8mB3KuB.js";
+import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-C5fMJ7rY.js";
 init_cliproxy();
 export { isCliproxyRunning };