@overdeck/desktop 0.50.0 → 0.50.3

package/server/{workspace-manager-CM8RCrSc.js → workspace-manager-CnAyRh3v.js}

@@ -1,20 +1,21 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ei as SYNC_SOURCES, Qr as FsError, Ti as SKILLS_DIR, ai as ProcessSpawnError, fn as init_projects, li as init_errors, mi as CACHE_RULES_DIR, p as loadConfigSync, pi as CACHE_AGENTS_DIR, t as init_config_yaml, vn as listProjectsSync, zi as init_paths } from "./config-yaml-D60AnTIu.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CJRi_5Wu.js";
-import { a as getWorkspaceForIssue, i as getWorkspaceById, n as getProjectByKey, o as init_resolver, r as getProjectByPath, s as listPinnedDocs, t as getMainWorkspace } from "./resolver-C2QKOf09.js";
-import { i as init_paths$1, m as resolveWorkspaceMemoryRoot, r as ensureParentDir } from "./paths-rETQhTF2.js";
+import { $r as FsError, Ri as init_paths, Ti as SYNC_SOURCES, fn as init_projects, mi as CACHE_AGENTS_DIR, oi as ProcessSpawnError, p as loadConfigSync, t as init_config_yaml, ui as init_errors, vn as listProjectsSync, wi as SKILLS_DIR } from "./config-yaml-Dce9VUd6.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-B05o-e2g.js";
+import { a as getWorkspaceForIssue, i as getWorkspaceById, n as getProjectByKey, o as init_resolver, r as getProjectByPath, s as listPinnedDocs, t as getMainWorkspace } from "./resolver-ChLZFIjB.js";
+import { i as init_paths$1, m as resolveWorkspaceMemoryRoot, r as ensureParentDir } from "./paths-eTg2jV4C.js";
 import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME } from "./types-pLpbsNto.js";
-import { t as init_pan_dir } from "./pan-dir-B4NfzOf3.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-D-bNq2CF.js";
-import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-skW68j9B.js";
-import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-1FJmNDTq.js";
-import { r as unmirrorPin, t as init_state_mirror } from "./state-mirror-BPXciz84.js";
-import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-BiJhwFNi.js";
-import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-CWO7dcIP.js";
+import { t as init_pan_dir } from "./pan-dir-Bs9fme2I.js";
+import { _ as isHarnessNativeTarget, a as init_worktree_ops, d as relocateVenvScripts, f as removeWorktree, g as init_native_instructions, h as validateFeatureName, i as createWorktree, l as preTrustDirectorySync, m as stagePreWorktreeMetadataSync, n as assignPort, o as installPreRebaseHook, p as restorePreWorktreeMetadataSync, r as copyProjectTemplateDirs, u as releasePort } from "./worktree-ops-Cnk1voFY.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-CoAaYx_w.js";
+import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-D01HhYX5.js";
+import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-CxfI2cg-.js";
+import { r as unmirrorPin, t as init_state_mirror } from "./state-mirror-DQKpsskH.js";
+import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-DL8lfn0Y.js";
+import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-fz7ELYZ8.js";
 import { join, resolve } from "node:path";
 import { Effect } from "effect";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
-import { basename as basename$1, dirname as dirname$1, extname as extname$1, isAbsolute as isAbsolute$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, rmdirSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
+import { basename as basename$1, dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
 import { homedir, platform } from "os";
 import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readdirSync as readdirSync$1, readlinkSync, renameSync as renameSync$1, statSync as statSync$1, symlinkSync as symlinkSync$1 } from "node:fs";
 import { stat } from "node:fs/promises";
@@ -212,11 +213,11 @@ function removeWsl2HostEntry(hostname) {
 }
 async function syncDnsToWindows() {
 	try {
-		await execAsync$3("powershell.exe -Command \"Start-ScheduledTask -TaskName 'OverdeckWsl2HostsSync'\"");
+		await execAsync$2("powershell.exe -Command \"Start-ScheduledTask -TaskName 'OverdeckWsl2HostsSync'\"");
 		return true;
 	} catch {
 		try {
-			await execAsync$3("powershell.exe -Command \"Start-ScheduledTask -TaskName 'SyncMynHosts'\"");
+			await execAsync$2("powershell.exe -Command \"Start-ScheduledTask -TaskName 'SyncMynHosts'\"");
 			return true;
 		} catch {
 			return false;
@@ -302,10 +303,10 @@ function removeDnsEntry(method, hostname) {
 		case "dnsmasq": return removeDnsmasqEntry(hostname);
 	}
 }
-var execAsync$3, HOSTS_FILE, MARKER_START, MARKER_END, OVERDECK_DNSMASQ_CONF;
+var execAsync$2, HOSTS_FILE, MARKER_START, MARKER_END, OVERDECK_DNSMASQ_CONF;
 var init_dns = __esmMin((() => {
 	init_platform();
-	execAsync$3 = promisify(exec);
+	execAsync$2 = promisify(exec);
 	HOSTS_FILE = "/etc/hosts";
 	MARKER_START = "# BEGIN overdeck managed entries";
 	MARKER_END = "# END overdeck managed entries";
@@ -538,10 +539,10 @@ var init_manifest = __esmMin((() => {
 //#endregion
 //#region ../../lib/skills-merge.ts
 /**
-* Merge Overdeck skills, agents, and rules into a workspace using file copies.
+* Merge Overdeck skills and agent definitions into a workspace using file copies.
 *
 * Flow:
-* 1. Copy from cache (skills, agent-definitions, rules) → workspace/.claude/
+* 1. Copy from cache (skills and agent-definitions) → workspace/.claude/
 * 2. Write manifest tracking what was placed
 *
 * Project template overlay is handled separately by workspace-manager.ts
@@ -561,20 +562,13 @@ function mergeSkillsIntoWorkspaceSync(workspacePath) {
 	};
 	mkdirSync(join$1(claudeDir, "skills"), { recursive: true });
 	mkdirSync(join$1(claudeDir, "agents"), { recursive: true });
-	const sources = [
-		{
-			sourceDir: SKILLS_DIR,
-			targetSubdir: "skills"
-		},
-		{
-			sourceDir: CACHE_AGENTS_DIR,
-			targetSubdir: "agents"
-		},
-		{
-			sourceDir: CACHE_RULES_DIR,
-			targetSubdir: "rules"
-		}
-	];
+	const sources = [{
+		sourceDir: SKILLS_DIR,
+		targetSubdir: "skills"
+	}, {
+		sourceDir: CACHE_AGENTS_DIR,
+		targetSubdir: "agents"
+	}];
 	const sourceSet = new Set(sources.flatMap(({ sourceDir, targetSubdir }) => collectSourceFilesSync(sourceDir, "").map((file) => `${targetSubdir}/${file.relativePath}`)));
 	for (const { sourceDir, targetSubdir } of sources) {
 		if (!existsSync(sourceDir)) continue;
@@ -582,6 +576,7 @@ function mergeSkillsIntoWorkspaceSync(workspacePath) {
 		const files = collectSourceFilesSync(sourceDir, "");
 		for (const file of files) {
 			const relativePath = `${prefix}${file.relativePath}`;
+			if (isHarnessNativeTarget(join$1(".claude", relativePath))) continue;
 			const targetPath = join$1(claudeDir, relativePath);
 			const sourceHash = hashFileSync(file.absolutePath);
 			switch (compareFileToManifest(targetPath, relativePath, manifest).action) {
@@ -605,11 +600,8 @@ function mergeSkillsIntoWorkspaceSync(workspacePath) {
 			}
 		}
 	}
-	const pruneResult = pruneStaleManifestEntriesSync(claudeDir, manifest, sourceSet, { prefixes: [
-		"skills/",
-		"agents/",
-		"rules/"
-	] });
+	for (const path of Object.keys(manifest.installed)) if (isHarnessNativeTarget(join$1(".claude", path))) sourceSet.add(path);
+	const pruneResult = pruneStaleManifestEntriesSync(claudeDir, manifest, sourceSet, { prefixes: ["skills/", "agents/"] });
 	result.pruned.push(...pruneResult.pruned);
 	result.keptModified.push(...pruneResult.keptModified);
 	writeManifestSync(manifestPath, manifest);
@@ -652,6 +644,7 @@ function mergePanSkillsIntoWorkspaceSync(projectPath, workspacePath) {
 		mkdirSync(targetSkillDir, { recursive: true });
 		let anyAdded = false;
 		for (const file of files) {
+			if (isHarnessNativeTarget(join$1(".claude", "skills", skillName, file.relativePath))) continue;
 			const targetPath = join$1(targetSkillDir, file.relativePath);
 			mkdirSync(dirname$1(targetPath), { recursive: true });
 			copyFileSync(file.absolutePath, targetPath);
@@ -669,340 +662,7 @@ var init_skills_merge = __esmMin((() => {
 	init_paths();
 	init_manifest();
 	init_errors();
-}));
-//#endregion
-//#region ../../lib/workspace-manager/types.ts
-var PRE_WORKTREE_METADATA_DIRS;
-var init_types = __esmMin((() => {
-	PRE_WORKTREE_METADATA_DIRS = new Set([".pan"]);
-}));
-//#endregion
-//#region ../../lib/workspace-manager/worktree-ops.ts
-/**
-* Validate feature name (alphanumeric and hyphens only)
-*/
-function validateFeatureName(name) {
-	return /^[a-zA-Z0-9-]+$/.test(name);
-}
-/**
-* Make a `cp -a`-copied Python venv self-contained by pointing its scripts at
-* the destination venv's OWN interpreter.
-*
-* Python venvs are not relocatable: every bin/* console script carries an
-* absolute `#!<source venv>/bin/python3` shebang, and the activate scripts set
-* `VIRTUAL_ENV=<source venv>`. Copying a venv to a new path leaves those
-* pointing at the old location — a repo rename (e.g. panopticon-cli → overdeck)
-* then breaks every copied script with "bad interpreter: No such file". The
-* TLDR MCP server silently fails to spawn and the read-enforcer hook silently
-* no-ops, so every agent pays full token cost on Reads with nothing erroring.
-*
-* Rewrites each bin/* shebang and the activate `VIRTUAL_ENV` to the destination
-* venv's own path. Best-effort and non-fatal: unreadable/binary files skipped.
-*/
-function relocateVenvScripts(sourceVenv, destVenv) {
-	const sourceBin = join$1(sourceVenv, "bin");
-	const destBin = join$1(destVenv, "bin");
-	const destPy = join$1(destBin, "python3");
-	if (!existsSync(destBin) || !existsSync(destPy)) return;
-	for (const entry of readdirSync(destBin)) {
-		const script = join$1(destBin, entry);
-		try {
-			if (!statSync(script).isFile()) continue;
-			const content = readFileSync(script, "utf8");
-			const firstLine = content.split("\n", 1)[0] ?? "";
-			if (firstLine.startsWith("#!") && firstLine.includes(sourceBin)) {
-				const restFrom = content.indexOf("\n");
-				writeFileSync(script, `#!${destPy}${restFrom === -1 ? "\n" : content.slice(restFrom)}`);
-			}
-		} catch {}
-	}
-	for (const name of [
-		"activate",
-		"activate.csh",
-		"activate.fish"
-	]) {
-		const act = join$1(destBin, name);
-		if (!existsSync(act)) continue;
-		try {
-			const content = readFileSync(act, "utf8");
-			if (content.includes(sourceVenv)) writeFileSync(act, content.split(sourceVenv).join(destVenv));
-		} catch {}
-	}
-}
-/**
-* Keep a generated hooks directory that lives inside the worktree out of
-* `git status`. With husky, `core.hooksPath` is `.husky/_` — a tracked-repo
-* path husky self-ignores by writing a `*` .gitignore into it on install.
-* `installPreRebaseHook` creates that directory itself in a fresh worktree,
-* long before `prepare: husky` ever runs, so without this the generated guard
-* lands as `?? .husky/_/pre-rebase` and every new workspace is born dirty —
-* which 409s the planning→work auto-handoff (PAN-3266).
-*
-* Directories under `.git/` need nothing: git never reports them.
-*/
-function ensureGeneratedHooksDirIsIgnored(targetPath, hooksDir) {
-	const relativeDir = relative$1(targetPath, hooksDir).replace(/\\/g, "/");
-	if (!relativeDir || relativeDir.startsWith("..") || relativeDir === ".git" || relativeDir.startsWith(".git/")) return;
-	const ignorePath = join$1(hooksDir, ".gitignore");
-	if (existsSync(ignorePath)) return;
-	try {
-		writeFileSync(ignorePath, "*\n", "utf-8");
-	} catch {}
-}
-/** Install the agent-only rebase guard in Git's configured hooks directory. */
-async function installPreRebaseHook(targetPath) {
-	const { stdout } = await execAsync$2("git rev-parse --git-path hooks", {
-		cwd: targetPath,
-		encoding: "utf-8"
-	});
-	const hooksDir = resolve$1(targetPath, stdout.trim());
-	const hookPath = join$1(hooksDir, "pre-rebase");
-	mkdirSync(hooksDir, { recursive: true });
-	ensureGeneratedHooksDirIsIgnored(targetPath, hooksDir);
-	const originalHookPath = `${hookPath}${PRE_REBASE_ORIGINAL_SUFFIX}`;
-	const existingHook = existsSync(hookPath) ? readFileSync(hookPath, "utf-8") : "";
-	if (!existingHook.includes(PRE_REBASE_HOOK_MARKER)) {
-		if (existingHook) {
-			rmSync(originalHookPath, { force: true });
-			renameSync(hookPath, originalHookPath);
-		}
-		writeFileSync(hookPath, [
-			PRE_REBASE_HOOK_PREFIX,
-			`if [ -x "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" ]; then`,
-			`  exec "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" "$@"`,
-			"fi",
-			"exit 0",
-			""
-		].join("\n"), {
-			encoding: "utf-8",
-			mode: 493
-		});
-	}
-	chmodSync(hookPath, 493);
-	return hookPath;
-}
-/**
-* Create a git worktree
-* @param repoPath Path to the source git repository
-* @param targetPath Where to create the worktree
-* @param branchName Name of the feature branch to create/checkout
-* @param defaultBranch Base branch to create new branches from (default: 'main')
-*/
-async function createWorktree(repoPath, targetPath, branchName, defaultBranch = "main") {
-	try {
-		await execAsync$2("git fetch origin", { cwd: repoPath });
-		await execAsync$2("git worktree prune", { cwd: repoPath });
-		const { stdout: localBranches } = await execAsync$2("git branch --list", { cwd: repoPath });
-		const { stdout: remoteBranches } = await execAsync$2("git branch -r --list", { cwd: repoPath });
-		const localList = localBranches.split("\n").map((b) => b.replace(/^[*+\s]+/, "").trim()).filter(Boolean);
-		const remoteList = remoteBranches.split("\n").map((b) => b.trim()).filter(Boolean);
-		if (localList.includes(branchName) || remoteList.includes(`origin/${branchName}`)) await execAsync$2(`git worktree add "${targetPath}" "${branchName}"`, { cwd: repoPath });
-		else await execAsync$2(`git worktree add -b "${branchName}" "${targetPath}" "${defaultBranch}"`, { cwd: repoPath });
-		await installPreRebaseHook(targetPath);
-		await execAsync$2("git restore .", { cwd: targetPath }).catch(() => {});
-		return {
-			success: true,
-			message: `Created worktree at ${targetPath}`
-		};
-	} catch (error) {
-		return {
-			success: false,
-			message: `Failed to create worktree: ${error}`
-		};
-	}
-}
-/**
-* Remove a git worktree
-*/
-async function removeWorktree(repoPath, targetPath, branchName) {
-	try {
-		await execAsync$2(`git worktree remove "${targetPath}" --force`, { cwd: repoPath }).catch(() => {});
-		await execAsync$2(`git branch -D "${branchName}"`, { cwd: repoPath }).catch(() => {});
-		return {
-			success: true,
-			message: `Removed worktree at ${targetPath}`
-		};
-	} catch (error) {
-		return {
-			success: false,
-			message: `Failed to remove worktree: ${error}`
-		};
-	}
-}
-/**
-* Assign a port from a range
-*/
-function assignPort(portFile, featureFolder, range) {
-	if (!existsSync(portFile)) {
-		mkdirSync(dirname$1(portFile), { recursive: true });
-		writeFileSync(portFile, "");
-	}
-	const content = readFileSync(portFile, "utf-8");
-	const lines = content.split("\n").filter(Boolean);
-	for (const line of lines) {
-		const [folder, port] = line.split(":");
-		if (folder === featureFolder) return parseInt(port, 10);
-	}
-	const usedPorts = new Set(lines.map((l) => parseInt(l.split(":")[1], 10)));
-	for (let port = range[0]; port <= range[1]; port++) if (!usedPorts.has(port)) {
-		writeFileSync(portFile, content + (content.endsWith("\n") ? "" : "\n") + `${featureFolder}:${port}\n`);
-		return port;
-	}
-	throw new Error(`No available ports in range ${range[0]}-${range[1]}`);
-}
-/**
-* Release a port assignment
-*/
-function releasePort(portFile, featureFolder) {
-	try {
-		if (!existsSync(portFile)) return true;
-		writeFileSync(portFile, readFileSync(portFile, "utf-8").split("\n").filter((line) => !line.startsWith(`${featureFolder}:`)).join("\n"));
-		return true;
-	} catch {
-		return false;
-	}
-}
-function isPreWorktreeMetadataOnlyDir(path) {
-	return readdirSync(path, { withFileTypes: true }).every((entry) => PRE_WORKTREE_METADATA_DIRS.has(entry.name) && entry.isDirectory());
-}
-function stagePreWorktreeMetadataSync(workspacePath) {
-	if (!existsSync(workspacePath)) return null;
-	if (!isPreWorktreeMetadataOnlyDir(workspacePath)) return null;
-	const stagedPath = `${workspacePath}.pre-worktree-${process.pid}-${Date.now()}`;
-	renameSync(workspacePath, stagedPath);
-	return stagedPath;
-}
-function mergeDirectoryWithoutOverwriteSync(source, target) {
-	if (!existsSync(source)) return;
-	mkdirSync(target, { recursive: true });
-	for (const entry of readdirSync(source, { withFileTypes: true })) {
-		const sourcePath = join$1(source, entry.name);
-		const targetPath = join$1(target, entry.name);
-		if (entry.isDirectory()) mergeDirectoryWithoutOverwriteSync(sourcePath, targetPath);
-		else if (entry.isFile() && !existsSync(targetPath)) copyFileSync(sourcePath, targetPath);
-	}
-}
-function restorePreWorktreeMetadataSync(stagedPath, workspacePath) {
-	if (!stagedPath || !existsSync(stagedPath)) return;
-	mergeDirectoryWithoutOverwriteSync(stagedPath, workspacePath);
-	rmSync(stagedPath, {
-		recursive: true,
-		force: true
-	});
-}
-function copyProjectTemplateDirs(sourceDir, targetDir, dirs, placeholders) {
-	const steps = [];
-	for (const dir of dirs) {
-		const sourcePath = join$1(sourceDir, dir);
-		const targetPath = join$1(targetDir, dir);
-		if (!existsSync(sourcePath)) continue;
-		function copyDir(src, dest) {
-			let count = 0;
-			mkdirSync(dest, { recursive: true });
-			const entries = readdirSync(src, { withFileTypes: true });
-			for (const entry of entries) {
-				const srcEntry = join$1(src, entry.name);
-				const destEntry = join$1(dest, entry.name);
-				if (entry.isDirectory()) count += copyDir(srcEntry, destEntry);
-				else if (entry.isFile()) {
-					const ext = extname$1(entry.name).toLowerCase();
-					if (placeholders && TEXT_EXTENSIONS.has(ext)) writeFileSync(destEntry, replacePlaceholdersSync(readFileSync(srcEntry, "utf-8"), placeholders));
-					else copyFileSync(srcEntry, destEntry);
-					count++;
-				}
-			}
-			return count;
-		}
-		const count = copyDir(sourcePath, targetPath);
-		steps.push(`Copied ${count} files from project template: ${dir}`);
-	}
-	return steps;
-}
-/**
-* Pre-register a directory as trusted in Claude Code's ~/.claude.json so that
-* neither the per-project "Quick safety check" trust prompt nor the global
-* "WARNING: Claude Code running in Bypass Permissions mode" warning blocks
-* spawn.
-*
-* Two acceptances are written:
-*
-* 1. **Per-project** `projects[dir].hasTrustDialogAccepted = true` — suppresses
-*    the "Is this a project you created or one you trust?" prompt for this cwd.
-*
-* 2. **Global** `bypassPermissionsModeAccepted = true` — suppresses the
-*    "Bypass Permissions mode" disclaimer that Claude shows on first launch
-*    under `--dangerously-skip-permissions`. The default selection on that
-*    prompt is "No, exit", so an undismissed dialog tears the session down
-*    the moment any code (dev-channels dismisser, readiness poll) sends Enter.
-*    Spawning under Overdeck implies the user already opted into bypass
-*    via `claude.permissionMode` / `--yolo`, so this is a pre-acknowledgement
-*    of a choice already made, not a silent escalation.
-*
-* The field name (`bypassPermissionsModeAccepted`) comes straight from the
-* Claude Code binary — strings(claude.exe) confirms it as the persistence
-* key checked by both the bypass-mode dialog and the headless --bg gate.
-*/
-function preTrustDirectorySync(dirPath) {
-	const claudeJsonPath = join$1(homedir(), ".claude.json");
-	if (!existsSync(claudeJsonPath)) return;
-	const data = JSON.parse(readFileSync(claudeJsonPath, "utf8"));
-	let dirty = false;
-	if (data.bypassPermissionsModeAccepted !== true) {
-		data.bypassPermissionsModeAccepted = true;
-		dirty = true;
-	}
-	if (!data.projects) data.projects = {};
-	if (data.projects[dirPath]) {
-		if (!data.projects[dirPath].hasTrustDialogAccepted) {
-			data.projects[dirPath].hasTrustDialogAccepted = true;
-			dirty = true;
-		}
-	} else {
-		data.projects[dirPath] = {
-			allowedTools: [],
-			mcpContextUris: [],
-			mcpServers: {},
-			enabledMcpjsonServers: [],
-			disabledMcpjsonServers: [],
-			hasTrustDialogAccepted: true,
-			projectOnboardingSeenCount: 0,
-			hasClaudeMdExternalIncludesApproved: false,
-			hasClaudeMdExternalIncludesWarningShown: false
-		};
-		dirty = true;
-	}
-	if (dirty) writeFileSync(claudeJsonPath, JSON.stringify(data, null, 2), "utf8");
-}
-var execAsync$2, PRE_REBASE_HOOK_MARKER, PRE_REBASE_ORIGINAL_SUFFIX, PRE_REBASE_HOOK_PREFIX, TEXT_EXTENSIONS;
-var init_worktree_ops = __esmMin((() => {
-	init_workspace_config();
-	init_types();
-	execAsync$2 = promisify(exec);
-	PRE_REBASE_HOOK_MARKER = "# OVERDECK MANAGED PRE-REBASE GUARD";
-	PRE_REBASE_ORIGINAL_SUFFIX = ".overdeck-original";
-	PRE_REBASE_HOOK_PREFIX = [
-		"#!/bin/sh",
-		PRE_REBASE_HOOK_MARKER,
-		"if [ \"$OVERDECK_PAN_GIT_OP\" != \"1\" ] && [ -n \"$OVERDECK_AGENT_ID\" ]; then",
-		"  echo \"Overdeck agents must not run git rebase directly.\" >&2",
-		"  echo \"Use pan sync-main <ISSUE-ID> to sync main or pan done <ISSUE-ID> to submit.\" >&2",
-		"  exit 1",
-		"fi",
-		""
-	].join("\n");
-	TEXT_EXTENSIONS = new Set([
-		".md",
-		".sh",
-		".yml",
-		".yaml",
-		".json",
-		".ts",
-		".js",
-		".env",
-		".txt",
-		".toml",
-		".template"
-	]);
+	init_native_instructions();
 }));
 //#endregion
 //#region ../../lib/memory/identity-record.ts
@@ -1519,7 +1179,7 @@ async function createWorkspacePromise(options) {
 					await execAsync$1(`cp -r "${mainTldrDir}" "${workspaceTldrDir}"`);
 					result.steps.push("Copied TLDR index from main branch");
 				}
-				const { getTldrDaemonServiceSync } = await import("./tldr-daemon-CRSAkhBx.js");
+				const { getTldrDaemonServiceSync } = await import("./tldr-daemon-CW1MhBkM.js");
 				const tldrService = getTldrDaemonServiceSync(workspacePath, venvPath);
 				await tldrService.start(true);
 				result.steps.push("Started TLDR daemon");
@@ -1563,9 +1223,13 @@ async function createWorkspacePromise(options) {
 		if (panMergeResult.added.length > 0) result.steps.push(`Installed ${panMergeResult.added.length} project-local skill file(s) from .pan/skills/ (${panMergeResult.overlayed.join(", ")})`);
 		if (workspaceConfig.agent?.template_dir) {
 			const templateDir = join$1(projectConfig.path, workspaceConfig.agent.template_dir);
-			const templateSteps = processTemplatesSync(templateDir, workspacePath, placeholders, workspaceConfig.agent.templates);
+			const configuredTemplates = workspaceConfig.agent.templates;
+			const templateSteps = processTemplatesSync(templateDir, workspacePath, placeholders, (configuredTemplates === void 0 ? readdirSync(templateDir).filter((source) => source.endsWith(".template")).map((source) => ({
+				source,
+				target: source.slice(0, -9)
+			})) : configuredTemplates).filter(({ target }) => !isHarnessNativeTarget(target)));
 			result.steps.push(...templateSteps);
-			const dirsToSync = workspaceConfig.agent.copy_dirs || workspaceConfig.agent.symlinks;
+			const dirsToSync = (workspaceConfig.agent.copy_dirs || workspaceConfig.agent.symlinks)?.filter((dir) => !isHarnessNativeTarget(dir));
 			if (dirsToSync) {
 				const copySteps = copyProjectTemplateDirs(templateDir, workspacePath, dirsToSync, placeholders);
 				result.steps.push(...copySteps);
@@ -1640,7 +1304,7 @@ async function createWorkspacePromise(options) {
 			result.steps.push("Pre-trusted workspace in Claude Code");
 		} catch {}
 		try {
-			const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-Dbqv9ehn.js");
+			const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-BO8fIfW9.js");
 			const cavemanConfig = loadConfigSync().config.caveman;
 			const variant = determineCavemanVariant(cavemanConfig);
 			await Effect.runPromise(injectCavemanSettings(workspacePath, variant));
@@ -1656,7 +1320,7 @@ async function createWorkspacePromise(options) {
 			result.steps.push(`Overdeck settings copy skipped: ${settingsErr instanceof Error ? settingsErr.message : String(settingsErr)}`);
 		}
 		try {
-			const { injectMemoryHookSettings } = await import("./workspace-Dbqv9ehn.js");
+			const { injectMemoryHookSettings } = await import("./workspace-BO8fIfW9.js");
 			await injectMemoryHookSettings(workspacePath);
 			result.steps.push("Injected memory hooks into .claude/settings.json");
 		} catch (memoryHookErr) {
@@ -1674,6 +1338,7 @@ async function createWorkspacePromise(options) {
 }
 var execAsync$1;
 var init_create = __esmMin((() => {
+	init_native_instructions();
 	init_workspace_config();
 	init_dns();
 	init_tunnel();
@@ -1751,7 +1416,7 @@ async function removeWorkspacePromise(options) {
 	}
 	const venvPath = join$1(workspacePath, ".venv");
 	if (existsSync(venvPath)) try {
-		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-CRSAkhBx.js");
+		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-CW1MhBkM.js");
 		await getTldrDaemonServiceSync(workspacePath, venvPath).stop();
 		result.steps.push("Stopped TLDR daemon");
 	} catch (error) {
@@ -1871,6 +1536,6 @@ var init_workspace_manager = __esmMin((() => {
 	});
 }));
 //#endregion
-export { ensurePanGitignoreSync as A, installPreRebaseHook as C, detectPlatform as D, validateFeatureName as E, init_platform as O, init_worktree_ops as S, relocateVenvScripts as T, updateWorkspaceLayout as _, removeWorkspace as a, readWorkspaceIdentity as b, installGitHooksInDir as c, init_writer as d, relocateWorkspace as f, unarchiveWorkspace as g, touchWorkspaceAccessed as h, preTrustDirectory as i, copyOverdeckSettingsToWorkspaceSync as k, archiveWorkspace as l, setWorkspaceRunCommand as m, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, setWorkspaceFavorite as p, init_workspace_manager as r, init_git_hooks as s, createWorkspace as t, createWorkspace$1 as u, upsertProjectFromConfig as v, preTrustDirectorySync as w, writeWorkspaceIdentity as x, init_identity_record as y };
+export { init_platform as C, detectPlatform as S, ensurePanGitignoreSync as T, updateWorkspaceLayout as _, removeWorkspace as a, readWorkspaceIdentity as b, installGitHooksInDir as c, init_writer as d, relocateWorkspace as f, unarchiveWorkspace as g, touchWorkspaceAccessed as h, preTrustDirectory as i, archiveWorkspace as l, setWorkspaceRunCommand as m, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, setWorkspaceFavorite as p, init_workspace_manager as r, init_git_hooks as s, createWorkspace as t, createWorkspace$1 as u, upsertProjectFromConfig as v, copyOverdeckSettingsToWorkspaceSync as w, writeWorkspaceIdentity as x, init_identity_record as y };
 
-//# sourceMappingURL=workspace-manager-CM8RCrSc.js.map
+//# sourceMappingURL=workspace-manager-CnAyRh3v.js.map

package/server/workspace-manager-D0jJ7StJ.js

@@ -0,0 +1,4 @@
+import { a as removeWorkspace, i as preTrustDirectory, o as stopWorkspaceDocker, r as init_workspace_manager, t as createWorkspace, w as copyOverdeckSettingsToWorkspaceSync } from "./workspace-manager-CnAyRh3v.js";
+import { l as preTrustDirectorySync } from "./worktree-ops-Cnk1voFY.js";
+init_workspace_manager();
+export { copyOverdeckSettingsToWorkspaceSync, createWorkspace, preTrustDirectory, preTrustDirectorySync, removeWorkspace, stopWorkspaceDocker };

package/server/{workspace-metadata-Cu6yfxBS.js → workspace-metadata-Copcoih9.js}

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { er as require_dist, li as init_errors } from "./config-yaml-D60AnTIu.js";
+import { er as require_dist, ui as init_errors } from "./config-yaml-Dce9VUd6.js";
 import "effect";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -70,4 +70,4 @@ function deleteWorkspaceMetadataSync(issueId) {
 //#endregion
 export { loadWorkspaceMetadataSync as a, listWorkspaceMetadataSync as i, deleteWorkspaceMetadataSync as n, saveWorkspaceMetadataSync as o, findRemoteWorkspaceMetadataSync as r, WORKSPACES_DIR as t };
 
-//# sourceMappingURL=workspace-metadata-Cu6yfxBS.js.map
+//# sourceMappingURL=workspace-metadata-Copcoih9.js.map

package/server/{workspace-metadata-BEOwJSdK.js → workspace-metadata-ILlbk8AX.js}

@@ -1,2 +1,2 @@
-import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-Cu6yfxBS.js";
+import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-Copcoih9.js";
 export { deleteWorkspaceMetadataSync };