@oxagen/cli 2.1.4-955 → 2.1.4-957

package/oxagen.mjs

@@ -25231,7 +25231,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-955";
+  if (true) return "2.1.4-957";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -29029,6 +29029,70 @@ var init_github = __esm({
   }
 });
 
+// ../../packages/tacho/src/host/harness-path.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { delimiter, join as join18 } from "node:path";
+function knownDirs(home) {
+  return [
+    join18(home, ".local", "bin"),
+    join18(home, ".bun", "bin"),
+    join18(home, ".npm-global", "bin"),
+    join18(home, ".volta", "bin"),
+    join18(home, ".cargo", "bin"),
+    join18(home, "bin"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ];
+}
+function loginShellPath(env, run3 = spawnSync5) {
+  const shell = env["SHELL"] ?? "/bin/zsh";
+  try {
+    const result2 = run3(
+      shell,
+      ["-ilc", `printf '%s%s%s' '${MARK}' "$PATH" '${MARK}'`],
+      {
+        encoding: "utf8",
+        timeout: LOGIN_SHELL_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "ignore"],
+        env: { ...env, TERM: env["TERM"] ?? "dumb" }
+      }
+    );
+    const out = typeof result2.stdout === "string" ? result2.stdout : "";
+    const start = out.indexOf(MARK);
+    const end = out.indexOf(MARK, start + MARK.length);
+    if (start < 0 || end < 0) return void 0;
+    const path2 = out.slice(start + MARK.length, end).trim();
+    return path2.length > 0 ? path2 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function harnessPath(env, home, loginPath) {
+  const seen = /* @__PURE__ */ new Set();
+  const dirs = [];
+  const add2 = (dir) => {
+    if (dir.length === 0 || seen.has(dir)) return;
+    seen.add(dir);
+    dirs.push(dir);
+  };
+  for (const dir of (loginPath ?? "").split(delimiter)) add2(dir);
+  for (const dir of (env["PATH"] ?? "").split(delimiter)) add2(dir);
+  for (const dir of knownDirs(home)) add2(dir);
+  return dirs.join(delimiter);
+}
+var MARK, LOGIN_SHELL_TIMEOUT_MS;
+var init_harness_path = __esm({
+  "../../packages/tacho/src/host/harness-path.ts"() {
+    "use strict";
+    MARK = "__OXAGEN_PATH__";
+    LOGIN_SHELL_TIMEOUT_MS = 5e3;
+  }
+});
+
 // ../../packages/tacho/src/cli/daemon-service.ts
 function daemonServiceSpec(daemonCommand, deps) {
   return {
@@ -29043,7 +29107,11 @@ function daemonServiceSpec(daemonCommand, deps) {
           return value !== void 0 ? [[key, value]] : [];
         })
       ),
-      PATH: deps.env["PATH"] ?? "/usr/local/bin:/usr/bin:/bin",
+      // The login shell's PATH, so the daemon's git calls find their
+      // credential helpers and a work order's harness is found. A desktop app
+      // installs the service from a GUI process whose PATH is the bare system
+      // path (#5936).
+      PATH: harnessPath(deps.env, deps.home, loginShellPath(deps.env)),
       HOME: deps.home
     },
     // One tachod serves every agent, so its log and working directory are
@@ -29056,6 +29124,7 @@ var HARNESS_HOME_VARS;
 var init_daemon_service = __esm({
   "../../packages/tacho/src/cli/daemon-service.ts"() {
     "use strict";
+    init_harness_path();
     HARNESS_HOME_VARS = [
       "CLAUDE_CONFIG_DIR",
       "CODEX_HOME",
@@ -29090,7 +29159,7 @@ var init_policy_mode = __esm({
 
 // ../../packages/tacho/src/host/wal-ceiling.ts
 import { statfsSync } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function freeBytesOn(dir) {
   try {
     const stats2 = statfsSync(dir);
@@ -29137,7 +29206,7 @@ function isDrop(value) {
 function readWalCeilingState(walDir) {
   let raw;
   try {
-    raw = readJsonFileIfExists(join18(walDir, STATE_FILE));
+    raw = readJsonFileIfExists(join19(walDir, STATE_FILE));
   } catch (error) {
     if (error instanceof SyntaxError) return void 0;
     throw error;
@@ -29337,7 +29406,7 @@ var init_wal_ceiling = __esm({
         const changed = this.unsaved || prior === void 0 || prior.stalled_sessions !== next.stalled_sessions || prior.drops.length !== next.drops.length || prior.drops.at(-1)?.dropped_at !== next.drops.at(-1)?.dropped_at || !sameClocks(prior.stall_clocks, next.stall_clocks) || next.stalled_sessions > 0 && (prior.stalled_bytes !== next.stalled_bytes || prior.ceiling_bytes !== next.ceiling_bytes);
         this.state = next;
         if (!changed) return;
-        const path2 = join18(this.walDir, STATE_FILE);
+        const path2 = join19(this.walDir, STATE_FILE);
         try {
           writeSensitiveFileAtomic(path2, JSON.stringify(next));
           this.unsaved = false;
@@ -29841,7 +29910,7 @@ import {
   rmdirSync as rmdirSync5,
   rmSync as rmSync2
 } from "node:fs";
-import { dirname as dirname12, join as join19 } from "node:path";
+import { dirname as dirname12, join as join20 } from "node:path";
 async function revokeOnControlPlane(host, options, deps, warnings) {
   const resolved = resolveCredentials(
     {
@@ -30452,7 +30521,7 @@ async function unenrollLocked(options, deps) {
     ];
     const purged = parts.filter(([, path2, recursive]) => remove2(path2, recursive)).map(([name]) => name);
     let failed3 = purged.length < parts.length;
-    if (!existsSync15(join19(deps.paths.dir, HARNESS_RECEIPTS)) && !remove2(join19(deps.paths.dir, HARNESS_BACKUPS), true))
+    if (!existsSync15(join20(deps.paths.dir, HARNESS_RECEIPTS)) && !remove2(join20(deps.paths.dir, HARNESS_BACKUPS), true))
       failed3 = true;
     const logShared = otherLiveAgents(deps.paths, deps.paths.dir).length > 0;
     if (!logShared) {
@@ -30510,7 +30579,7 @@ var init_unenroll = __esm({
 
 // ../../packages/tacho/src/cli/enroll.ts
 import { existsSync as existsSync16, lstatSync as lstatSync4, rmSync as rmSync3 } from "node:fs";
-import { dirname as dirname13, isAbsolute, join as join20 } from "node:path";
+import { dirname as dirname13, isAbsolute, join as join21 } from "node:path";
 function rootRefusal(command2, deps, allowRoot) {
   if (allowRoot === true || deps.getuid?.() !== 0) return void 0;
   const user = deps.env["SUDO_USER"] ?? "<user>";
@@ -30536,7 +30605,7 @@ function runtimeOf(host) {
   if (first === void 0 || !files2.every((file) => existsSync16(file)))
     return void 0;
   const binDir = dirname13(first);
-  const tacho = host.daemon_command[0] === first ? shellQuote(first) : `${host.daemon_command[0]} ${shellQuote(join20(binDir, "tacho.mjs"))}`;
+  const tacho = host.daemon_command[0] === first ? shellQuote(first) : `${host.daemon_command[0]} ${shellQuote(join21(binDir, "tacho.mjs"))}`;
   return {
     hookCommand: host.hook_command,
     credentialHelperCommand: helperCommandFor(tacho),
@@ -32792,21 +32861,21 @@ import {
   statSync as statSync7,
   unlinkSync as unlinkSync10
 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, join as join21, relative, resolve as resolve7, sep } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute2, join as join22, relative, resolve as resolve7, sep } from "node:path";
 function dataLocalDir(home, env, platform) {
   if (platform === "darwin")
-    return join21(home, "Library", "Application Support");
+    return join22(home, "Library", "Application Support");
   if (platform === "win32")
-    return env["LOCALAPPDATA"] ?? join21(home, "AppData", "Local");
+    return env["LOCALAPPDATA"] ?? join22(home, "AppData", "Local");
   const xdg = env["XDG_DATA_HOME"];
-  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join21(home, ".local", "share");
+  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join22(home, ".local", "share");
 }
 function desktopPlaces(deps) {
-  const oxagenDir = join21(deps.home, ".config", "oxagen");
+  const oxagenDir = join22(deps.home, ".config", "oxagen");
   return {
     oxagenDir,
-    desktopConfig: join21(oxagenDir, "desktop.json"),
-    copies: join21(
+    desktopConfig: join22(oxagenDir, "desktop.json"),
+    copies: join22(
       dataLocalDir(deps.home, deps.env, deps.platform),
       "oxagen",
       "bin"
@@ -33051,7 +33120,7 @@ function undoEntry(entry2, deps, tally2) {
 }
 function versionDirs(copies) {
   try {
-    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join21(copies, entry2.name)).sort();
+    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join22(copies, entry2.name)).sort();
   } catch {
     return [];
   }
@@ -33087,7 +33156,7 @@ function journaledCopies(journal, copies, tally2) {
 function removeSidecars(dir, platform, tally2) {
   const note = platform === "win32" ? `. Windows keeps a running program's file, so delete ${dir} after this command exits` : "";
   for (const name of ["oxagen", "tacho"]) {
-    const file = join21(dir, platform === "win32" ? `${name}.exe` : name);
+    const file = join22(dir, platform === "win32" ? `${name}.exe` : name);
     removeFile(file, tally2, note);
   }
 }
@@ -33175,7 +33244,7 @@ async function uninstall(options, deps) {
       tally2.left.push(`cannot remove ${dir}: ${reasonOf3(error)}`);
     }
   }
-  const configDir = join21(deps.home, ".config");
+  const configDir = join22(deps.home, ".config");
   if (record.configDirCreated && removeDirIfEmpty(configDir))
     tally2.removed.push(configDir);
   for (const path2 of tally2.removed) deps.out(`      removed ${path2}`);
@@ -33853,11 +33922,11 @@ var init_work_order_start = __esm({
 
 // ../../packages/tacho/src/host/work-orders.ts
 import { readdirSync as readdirSync10, rmSync as rmSync5 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 function orderFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join22(paths.workOrders, `${id2}.json`);
+  return join23(paths.workOrders, `${id2}.json`);
 }
 function readKept(path2) {
   try {
@@ -33907,7 +33976,7 @@ function removeWorkOrder(paths, id2) {
 function runningFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join22(paths.workOrders, `${id2}.running`);
+  return join23(paths.workOrders, `${id2}.running`);
 }
 function processIsAlive(pid) {
   try {
@@ -34000,7 +34069,7 @@ var init_work_orders = __esm({
 });
 
 // ../../packages/tacho/src/cli/work.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 function liveAgents(deps) {
   return listAgents(homeOf(deps.paths)).filter(agentIsLive);
 }
@@ -34188,7 +34257,7 @@ async function workStart(id2, deps) {
   return exitCodeOf(exit);
 }
 function gitHeadIn(cwd) {
-  const result2 = spawnSync5("git", ["-C", cwd, "rev-parse", "HEAD"], {
+  const result2 = spawnSync6("git", ["-C", cwd, "rev-parse", "HEAD"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: 1e4
@@ -38265,7 +38334,7 @@ var init_bridge = __esm({
 
 // ../../packages/tacho/src/contained/workspace.ts
 import { lstatSync as lstatSync6, readFileSync as readFileSync14, readdirSync as readdirSync11, realpathSync as realpathSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join23, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join24, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
 function within(root, path2) {
   const rel = relative2(root, path2);
   return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
@@ -38295,7 +38364,7 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
   }
   const visit2 = (directory) => {
     for (const entry2 of readdirSync11(directory)) {
-      const path2 = join23(directory, entry2);
+      const path2 = join24(directory, entry2);
       if (CREDENTIAL_PATHS.has(entry2) || isEnvFile(entry2))
         throw new Error(
           `Remove local credential files from the contained checkout before launch: ${named(path2)}`
@@ -38329,7 +38398,7 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
 }
 function gitDirectoryMounts(workspace) {
   const root = realpathSync3(workspace);
-  const dotGit = join23(root, ".git");
+  const dotGit = join24(root, ".git");
   let stat7;
   try {
     stat7 = lstatSync6(dotGit);
@@ -38367,7 +38436,7 @@ function gitDirectoryMounts(workspace) {
   if (gitDir !== void 0) {
     let common;
     try {
-      common = readFileSync14(join23(gitDir, "commondir"), "utf8").trim();
+      common = readFileSync14(join24(gitDir, "commondir"), "utf8").trim();
     } catch {
       common = void 0;
     }
@@ -38394,7 +38463,7 @@ var init_workspace = __esm({
 // ../../packages/tacho/src/collector/hardened-git.ts
 import { execFile as execFile2 } from "node:child_process";
 import { lstatSync as lstatSync7, readFileSync as readFileSync15, statSync as statSync8 } from "node:fs";
-import { dirname as dirname15, join as join24, resolve as resolve10 } from "node:path";
+import { dirname as dirname15, join as join25, resolve as resolve10 } from "node:path";
 function hardenedGitArgs(cwd, args, globals = []) {
   const subcommand = args[0];
   const end = args.indexOf("--");
@@ -38433,7 +38502,7 @@ function gitIdentity(repository, deps = DEFAULT_IDENTITY_DEPS) {
     };
   }
   for (let at2 = directory; ; at2 = dirname15(at2)) {
-    const marker = join24(at2, ".git");
+    const marker = join25(at2, ".git");
     const link = tryStat(deps.lstat, marker);
     if (link !== void 0) {
       owners.push(link);
@@ -38441,7 +38510,7 @@ function gitIdentity(repository, deps = DEFAULT_IDENTITY_DEPS) {
       if (target2 !== void 0) {
         owners.push(target2);
         if (target2.isDirectory()) {
-          const config = tryStat(deps.stat, join24(marker, "config"));
+          const config = tryStat(deps.stat, join25(marker, "config"));
           if (config !== void 0) owners.push(config);
         }
       }
@@ -38593,7 +38662,7 @@ var init_hardened_git = __esm({
 
 // ../../packages/tacho/src/contained/profile.ts
 import { createHash as createHash6 } from "node:crypto";
-import { isAbsolute as isAbsolute4, join as join25, relative as relative3, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join26, relative as relative3, sep as sep3 } from "node:path";
 function containerPath(workspace, path2) {
   const inside2 = relative3(workspace, path2);
   if (inside2 === "" || isAbsolute4(inside2) || inside2 === ".." || inside2.startsWith(`..${sep3}`))
@@ -38603,7 +38672,7 @@ function containerPath(workspace, path2) {
   return `/workspace/${inside2.split(sep3).join("/")}`;
 }
 function gitMountPairs(spec) {
-  if (!spec.gitMounts.includes(join25(spec.workspace, ".git")))
+  if (!spec.gitMounts.includes(join26(spec.workspace, ".git")))
     throw new Error(
       "Contained execution must mount the repository's .git read-only"
     );
@@ -38770,7 +38839,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, join as join26 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join27 } from "node:path";
 import { promisify } from "node:util";
 function reason(error) {
   return error instanceof Error ? error.message : String(error);
@@ -38809,7 +38878,7 @@ async function launchContainedAgent(options) {
   if (digest6 === void 0)
     throw new Error("The operator's contained image is not installed");
   const sessionId = `contained-${randomBytes8(16).toString("hex")}`;
-  const directory = mkdtempSync(join26(tmpdir(), "oxagen-contained-"));
+  const directory = mkdtempSync(join27(tmpdir(), "oxagen-contained-"));
   chmodSync7(directory, 448);
   let prepared;
   let containerCreated = false;
@@ -38830,7 +38899,7 @@ async function launchContainedAgent(options) {
     for (const [name2, contents] of entries2) {
       if (!/^[a-z0-9.-]+$/.test(name2))
         throw new Error("Invalid contained configuration filename");
-      writeFileSync2(join26(directory, name2), contents, {
+      writeFileSync2(join27(directory, name2), contents, {
         mode: 256,
         flag: "wx"
       });
@@ -39229,7 +39298,7 @@ var init_privilege = __esm({
 
 // ../../packages/tacho/src/contained/sandbox/launcher.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -39319,7 +39388,7 @@ async function launchSandboxAgent(options) {
       { ...asAgent, cwd: SANDBOX_AGENT_HOME, timeoutMs: 15 * 6e4 }
     );
     for (const [name, contents] of Object.entries(claudeCodeUserState())) {
-      const path2 = join27(SANDBOX_AGENT_HOME, name);
+      const path2 = join28(SANDBOX_AGENT_HOME, name);
       system.writeFile(path2, contents, 384);
       system.chown(path2, SANDBOX_AGENT_UID, SANDBOX_AGENT_GID);
     }
@@ -39525,10 +39594,10 @@ var init_system = __esm({
 });
 
 // ../../packages/tacho/src/contained/runner.ts
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function containedHookEnv(harness, workspace) {
-  const home = join28(workspace, ".oxagen-contained", "home");
-  return harness === "codex" ? { CODEX_HOME: join28(home, ".codex") } : { CLAUDE_CONFIG_DIR: join28(home, ".claude") };
+  const home = join29(workspace, ".oxagen-contained", "home");
+  return harness === "codex" ? { CODEX_HOME: join29(home, ".codex") } : { CLAUDE_CONFIG_DIR: join29(home, ".claude") };
 }
 function containedLaunchEndpoint(host) {
   const ingest = new URL(host.endpoints.ingest);
@@ -39726,7 +39795,7 @@ function createContainedRunner(options) {
             sessionUuid2 = started.recorder.sessionUuid;
             active2.set(sessionUuid2, controller);
             const bridge = await startContainedBridge({
-              socketPath: join28(directory, "bridge.sock"),
+              socketPath: join29(directory, "bridge.sock"),
               ...bridgeRoutes({
                 sessionId,
                 workspace,
@@ -39810,7 +39879,7 @@ function createContainedRunner(options) {
       const abort = () => controller.abort();
       signal?.addEventListener("abort", abort, { once: true });
       if (signal?.aborted) abort();
-      const env = { CLAUDE_CONFIG_DIR: join28(SANDBOX_AGENT_HOME, ".claude") };
+      const env = { CLAUDE_CONFIG_DIR: join29(SANDBOX_AGENT_HOME, ".claude") };
       let sessionUuid2;
       let launchedSessionId;
       let opened = false;
@@ -39944,13 +40013,13 @@ var init_runner = __esm({
 });
 
 // ../../packages/tacho/src/host/repositories.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join29, resolve as resolve11, sep as sep4 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
+import { dirname as dirname17, join as join30, resolve as resolve11, sep as sep4 } from "node:path";
 function repositoriesFile(home) {
-  return join29(home.tachoDir, "repositories.json");
+  return join30(home.tachoDir, "repositories.json");
 }
 function workTreesDir(home) {
-  return join29(home.tachoDir, "work");
+  return join30(home.tachoDir, "work");
 }
 function readIndex(home) {
   let raw;
@@ -39974,6 +40043,7 @@ function latest(checkouts) {
 function recordCheckout(home, canonical3, root, seenAt) {
   if (canonical3.length === 0 || root.length === 0) return false;
   if (isUnder(root, workTreesDir(home))) return false;
+  root = mainCheckoutOf(root);
   const key = canonical3.toLowerCase();
   const index = readIndex(home);
   const kept = index.repositories[key] ?? [];
@@ -40000,8 +40070,24 @@ function recordCheckout(home, canonical3, root, seenAt) {
   );
   return true;
 }
+function mainCheckoutOf(root) {
+  const dotGit = join30(root, ".git");
+  try {
+    if (!statSync10(dotGit).isFile()) return root;
+    const line = readFileSync17(dotGit, "utf8").trim();
+    const match = /^gitdir:\s*(.+)$/m.exec(line);
+    if (match === null) return root;
+    const gitdir = resolve11(root, match[1].trim());
+    const worktrees = dirname17(gitdir);
+    if (!worktrees.endsWith(`${sep4}.git${sep4}worktrees`)) return root;
+    const clone4 = dirname17(dirname17(worktrees));
+    return existsSync18(join30(clone4, ".git")) ? clone4 : root;
+  } catch {
+    return root;
+  }
+}
 function defaultIsCheckout(root) {
-  return existsSync18(join29(root, ".git"));
+  return existsSync18(join30(root, ".git"));
 }
 function findCheckout(home, repository, host, deps = {}) {
   const isCheckout = deps.isCheckout ?? defaultIsCheckout;
@@ -40049,7 +40135,7 @@ var init_repositories = __esm({
 
 // ../../packages/tacho/src/collector/detector.ts
 import { promises as fs3 } from "node:fs";
-import { basename as basename5, join as join30 } from "node:path";
+import { basename as basename5, join as join31 } from "node:path";
 async function eachLimited(items, limit, task) {
   let next = 0;
   const workers = Array.from(
@@ -40075,7 +40161,7 @@ async function scanProject(dir) {
   await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
     const match = SESSION_FILE.exec(name);
     if (match === null) return;
-    const path2 = join30(dir, name);
+    const path2 = join31(dir, name);
     try {
       const st = await fs3.stat(path2);
       out.push({ sessionId: match[1], path: path2, mtimeMs: st.mtimeMs });
@@ -40116,7 +40202,7 @@ var init_detector = __esm({
             continue;
           }
           await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
-            const dir = join30(root, name);
+            const dir = join31(root, name);
             try {
               const st = await fs3.stat(dir);
               if (st.isDirectory()) dirs.push({ dir, mtimeMs: st.mtimeMs });
@@ -40356,7 +40442,7 @@ var init_detector = __esm({
                 transcript_path: transcript.path,
                 transcript_mtime: new Date(transcript.mtimeMs).toISOString(),
                 claude_pids: processes.map((p) => p.pid),
-                project: basename5(join30(transcript.path, ".."))
+                project: basename5(join31(transcript.path, ".."))
               }
             })
           );
@@ -40728,7 +40814,7 @@ var init_git_facts = __esm({
 // ../../packages/tacho/src/collector/work-order-autostart.ts
 import { spawn as spawn5 } from "node:child_process";
 import { closeSync as closeSync7, existsSync as existsSync19, openSync as openSync7 } from "node:fs";
-import { dirname as dirname17, join as join31 } from "node:path";
+import { dirname as dirname18, join as join32 } from "node:path";
 function asError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
@@ -40741,6 +40827,14 @@ function createWorkOrderAutostart(deps) {
   const { paths, log } = deps;
   const isAlive = deps.isAlive ?? processIsAlive;
   const spawnHarness = deps.spawn ?? spawnDetached;
+  let searchPath;
+  const pathForHarness = () => {
+    if (searchPath === void 0) {
+      const login = (deps.loginPath ?? (() => loginShellPath(deps.env)))();
+      searchPath = harnessPath(deps.env, deps.env["HOME"] ?? "", login);
+    }
+    return searchPath;
+  };
   const lookup = deps.findCheckout ?? ((repository) => findCheckout(paths, repository, deps.host()));
   const retry = /* @__PURE__ */ new Map();
   const cleanups = /* @__PURE__ */ new Set();
@@ -40773,7 +40867,7 @@ function createWorkOrderAutostart(deps) {
   }
   async function abandon(id2) {
     forget(id2);
-    const worktree = join31(workTreesDir(paths), id2);
+    const worktree = join32(workTreesDir(paths), id2);
     if (!existsSync19(worktree)) return;
     const [common, branch, head2] = await Promise.all([
       git6(worktree, ["rev-parse", "--path-format=absolute", "--git-common-dir"]),
@@ -40789,7 +40883,7 @@ function createWorkOrderAutostart(deps) {
     await cleanUp(
       {
         work_order: id2,
-        root: dirname17(common.out),
+        root: dirname18(common.out),
         worktree,
         branch: branch.out,
         base_sha: head2.out
@@ -40811,7 +40905,7 @@ function createWorkOrderAutostart(deps) {
     return waitMs;
   }
   async function prepareWorktree(root, id2, itemNumber) {
-    const worktree = join31(workTreesDir(paths), id2);
+    const worktree = join32(workTreesDir(paths), id2);
     const logPath = `${worktree}.log`;
     if (existsSync19(worktree)) {
       const [branch2, head2] = await Promise.all([
@@ -40963,7 +41057,12 @@ function createWorkOrderAutostart(deps) {
       headlessArgs(harness, claim.prompt),
       {
         cwd: workspace.worktree,
-        env: { ...deps.env, ...headlessEnv(harness), [WORK_ORDER_ENV]: id2 },
+        env: {
+          ...deps.env,
+          PATH: pathForHarness(),
+          ...headlessEnv(harness),
+          [WORK_ORDER_ENV]: id2
+        },
         logPath: workspace.log
       }
     );
@@ -41060,6 +41159,7 @@ var init_work_order_autostart = __esm({
   "../../packages/tacho/src/collector/work-order-autostart.ts"() {
     "use strict";
     init_fs();
+    init_harness_path();
     init_repositories();
     init_work_order_start();
     init_work_orders();
@@ -41071,7 +41171,7 @@ var init_work_order_autostart = __esm({
     spawnDetached = (command2, args, options) => new Promise((resolve25) => {
       let fd2;
       try {
-        ensureDir(dirname17(options.logPath));
+        ensureDir(dirname18(options.logPath));
         fd2 = openSync7(options.logPath, "a", 384);
       } catch (error) {
         resolve25({ ok: false, error: asError(error) });
@@ -41175,7 +41275,7 @@ import {
   rm,
   unlink
 } from "node:fs/promises";
-import { dirname as dirname18, join as join32 } from "node:path";
+import { dirname as dirname19, join as join33 } from "node:path";
 function byPath(a, b3) {
   return a.path < b3.path ? -1 : a.path > b3.path ? 1 : 0;
 }
@@ -41218,7 +41318,7 @@ async function contentHash(absolutePath, kind, keep) {
   if (keep !== void 0) {
     try {
       await mkdir(keep.dir, { recursive: true, mode: 448 });
-      const temp2 = join32(keep.dir, `.partial-${randomUUID3()}`);
+      const temp2 = join33(keep.dir, `.partial-${randomUUID3()}`);
       copy = {
         temp: temp2,
         handle: await open3(temp2, "wx", keep.executable ? 448 : 384)
@@ -41262,7 +41362,7 @@ async function settleCopy(temp, name) {
   if (temp === void 0) return;
   if (name !== void 0)
     try {
-      await rename(temp, join32(dirname18(temp), name));
+      await rename(temp, join33(dirname19(temp), name));
       return;
     } catch {
     }
@@ -41278,7 +41378,7 @@ async function copiedBytes(dir) {
   let total2 = 0;
   for (const name of names2) {
     try {
-      total2 += (await lstat(join32(dir, name))).size;
+      total2 += (await lstat(join33(dir, name))).size;
     } catch {
     }
   }
@@ -41294,7 +41394,7 @@ async function removeCopiesOutside(root, live) {
   const keep = new Set(live());
   await Promise.all(
     names2.filter((name) => !keep.has(name)).map(
-      (name) => rm(join32(root, name), { recursive: true, force: true }).catch(
+      (name) => rm(join33(root, name), { recursive: true, force: true }).catch(
         () => void 0
       )
     )
@@ -41316,7 +41416,7 @@ async function readPreexistingPaths(exec4, root, startedAtMs, copies) {
       if (found === void 0) return;
       if (found === "absent") {
         if (!deletedIn(entry2.code)) return;
-        const parent = await directoryChangedAt(dirname18(absolute));
+        const parent = await directoryChangedAt(dirname19(absolute));
         if (parent === void 0 || parent >= startedAtMs) return;
         paths[entry2.path] = null;
         return;
@@ -41401,7 +41501,7 @@ async function contributionOf(exec4, cwd, root, repoRelative, entry2, copies) {
   let copy = null;
   if (entry2 !== null) {
     if (copies === void 0 || !COPY_NAME.test(entry2[0])) return void 0;
-    copy = join32(copies, entry2[0]);
+    copy = join33(copies, entry2[0]);
     const kept = await statOf(copy);
     if (kept === void 0 || kept === "absent" || kept.kind !== "file")
       return void 0;
@@ -41803,7 +41903,7 @@ var init_session_changes = __esm({
 });
 
 // ../../packages/tacho/src/collector/session-commits.ts
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function parseMeta(stdout) {
   const out = [];
   for (const record of stdout.split("\0")) {
@@ -41928,7 +42028,7 @@ async function readSessionCommits(exec4, cwd, input) {
     const test = input.tests[commit.sha];
     const toolUseId = callAt(times.get(commit.sha), calls);
     const written2 = input.written;
-    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join33(root, file.path)));
+    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join34(root, file.path)));
     return {
       sha: commit.sha,
       parent_shas: commit.parents.slice(0, MAX_COMMIT_PARENTS),
@@ -41976,7 +42076,7 @@ var init_session_commits = __esm({
 
 // ../../packages/tacho/src/collector/worktree-snapshot.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 function headerPath(prefix, path2) {
   const name = `${prefix}${path2}`;
   let quoted3 = false;
@@ -42060,7 +42160,7 @@ async function worktreeFingerprint(status2, root) {
       const path2 = statusPath(record);
       if (path2 === null) return "";
       try {
-        const info = await lstat2(join34(root, path2));
+        const info = await lstat2(join35(root, path2));
         return `${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
       } catch {
         return "absent";
@@ -42168,7 +42268,7 @@ async function readWorktreeSnapshot(exec4, cwd, baseline, measured) {
       }
       let present;
       try {
-        present = (await lstat2(join34(root, path2))).isFile();
+        present = (await lstat2(join35(root, path2))).isFile();
       } catch {
         present = false;
       }
@@ -42271,10 +42371,10 @@ var init_worktree_snapshot = __esm({
 });
 
 // ../../packages/tacho/src/collector/git-lane.ts
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 function copiesDirOf(root, session) {
   const uuid = session.recorder.sessionUuid;
-  return /^[0-9a-f-]{36}$/i.test(uuid) ? join35(root, uuid) : void 0;
+  return /^[0-9a-f-]{36}$/i.test(uuid) ? join36(root, uuid) : void 0;
 }
 function holdsBaseline(session) {
   return session.baselineCommit !== void 0 || Object.keys(session.baselines ?? {}).length > 0;
@@ -43308,7 +43408,7 @@ var init_policy_run = __esm({
 
 // ../../packages/tacho/src/collector/hook-handler.ts
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname19, isAbsolute as isAbsolute7 } from "node:path";
+import { dirname as dirname20, isAbsolute as isAbsolute7 } from "node:path";
 function containmentUnmet(view, record) {
   return view.verified && view.bundle.mode === "enforce" && view.bundle.containment?.required === true && view.launchedContained?.(record.harnessSessionId) !== true;
 }
@@ -44264,7 +44364,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
 }
 function writtenDir(input) {
   const path2 = writtenPath(input);
-  return path2 === void 0 ? void 0 : dirname19(path2);
+  return path2 === void 0 ? void 0 : dirname20(path2);
 }
 function writtenPath(input) {
   if (input.hook_event_name !== "PreToolUse" && input.hook_event_name !== "PostToolUse")
@@ -44490,7 +44590,7 @@ var init_steer_waiters = __esm({
 });
 
 // ../../packages/tacho/src/collector/hook-id-journal.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync20, readFileSync as readFileSync17, rmSync as rmSync7 } from "node:fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync20, readFileSync as readFileSync18, rmSync as rmSync7 } from "node:fs";
 function hookIdJournalEntry(session, key, at2, events) {
   const highest = /* @__PURE__ */ new Map();
   for (const event of events) {
@@ -44517,7 +44617,7 @@ function isEntry(value) {
 function readHookIdJournal(path2) {
   if (!existsSync20(path2)) return [];
   const entries2 = [];
-  for (const line of readFileSync17(path2, "utf8").split("\n")) {
+  for (const line of readFileSync18(path2, "utf8").split("\n")) {
     if (line.trim().length === 0) continue;
     try {
       const value = JSON.parse(line);
@@ -45642,7 +45742,7 @@ var init_hook_queues = __esm({
 
 // ../../packages/tacho/src/collector/memory-capture/memory-reader.ts
 import { createRequire as createRequire2 } from "node:module";
-import { isAbsolute as isAbsolute8, join as join36, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute8, join as join37, sep as sep6 } from "node:path";
 function claudeCodeLocation(projectsDir, memoryDir) {
   return {
     harness: "claude-code",
@@ -45654,13 +45754,13 @@ function claudeCodeLocation(projectsDir, memoryDir) {
 }
 function claudeCodeMemoryLocations(configDir, projectDirs = []) {
   const locations = [
-    claudeCodeLocation(() => join36(configDir, "projects"), "memory"),
-    claudeCodeLocation(() => join36(configDir, "agent-memory"), "")
+    claudeCodeLocation(() => join37(configDir, "projects"), "memory"),
+    claudeCodeLocation(() => join37(configDir, "agent-memory"), "")
   ];
   for (const dir of projectDirs.slice(0, MEMORY_PROJECT_DIRS_MAX))
     locations.push(
-      claudeCodeLocation(() => join36(dir, ".claude", "agent-memory"), ""),
-      claudeCodeLocation(() => join36(dir, ".claude", "agent-memory-local"), "")
+      claudeCodeLocation(() => join37(dir, ".claude", "agent-memory"), ""),
+      claudeCodeLocation(() => join37(dir, ".claude", "agent-memory-local"), "")
     );
   return locations;
 }
@@ -45845,13 +45945,13 @@ function createMemoryReader(deps) {
       const projects = await list2(top);
       let complete = projects.complete;
       for (const project2 of projects.names) {
-        const dir = location.memoryDir === "" ? join36(top, project2) : join36(top, project2, location.memoryDir);
+        const dir = location.memoryDir === "" ? join37(top, project2) : join37(top, project2, location.memoryDir);
         const files2 = await list2(dir);
         if (!files2.complete) complete = false;
         for (const name of files2.names) {
           if (!name.endsWith(location.extension)) continue;
           if (location.skip.includes(name)) continue;
-          const path2 = join36(dir, name);
+          const path2 = join37(dir, name);
           const file = await readAt2(location.harness, path2);
           if (file.kind === "absent" || file.kind === "empty") continue;
           paths.push(path2);
@@ -45937,8 +46037,8 @@ var init_memory_reader = __esm({
     MEMORY_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,31}$/;
     MEMORY_PROJECT_DIRS_MAX = 200;
     HARNESS_MEMORY_LOCATIONS = [
-      claudeCodeLocation((home) => join36(home, ".claude", "projects"), "memory"),
-      claudeCodeLocation((home) => join36(home, ".claude", "agent-memory"), "")
+      claudeCodeLocation((home) => join37(home, ".claude", "projects"), "memory"),
+      claudeCodeLocation((home) => join37(home, ".claude", "agent-memory"), "")
     ];
     FRONTMATTER = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
     FRONTMATTER_LINE = /^([ \t]*)([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*)$/;
@@ -46430,25 +46530,25 @@ var init_memory_recall = __esm({
 });
 
 // ../../packages/tacho/src/collector/memory-capture/memory-uses.ts
-import { basename as basename6, dirname as dirname20, isAbsolute as isAbsolute9, join as join37, resolve as resolve14 } from "node:path";
+import { basename as basename6, dirname as dirname21, isAbsolute as isAbsolute9, join as join38, resolve as resolve14 } from "node:path";
 function memoryFileOf(path2, locations, home) {
   if (!isAbsolute9(path2)) return void 0;
   const file = resolve14(path2);
   const name = basename6(file);
-  const folder = dirname20(file);
+  const folder = dirname21(file);
   for (const location of locations) {
     if (!name.endsWith(location.extension)) continue;
     if (location.skip.includes(name)) continue;
-    const projectDir = location.memoryDir === "" ? folder : dirname20(folder);
+    const projectDir = location.memoryDir === "" ? folder : dirname21(folder);
     if (location.memoryDir !== "" && basename6(folder) !== location.memoryDir)
       continue;
-    if (dirname20(projectDir) !== resolve14(location.projectsDir(home))) continue;
+    if (dirname21(projectDir) !== resolve14(location.projectsDir(home))) continue;
     return { harness: location.harness, path: file };
   }
   return void 0;
 }
 function pathOf(word, cwd, home) {
-  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join37(home, word.slice(word.indexOf("/") + 1)) : word;
+  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join38(home, word.slice(word.indexOf("/") + 1)) : word;
   if (isAbsolute9(expanded)) return expanded;
   if (cwd !== void 0 && isAbsolute9(cwd)) return resolve14(cwd, expanded);
   return void 0;
@@ -46704,7 +46804,7 @@ ${use.path}`;
 });
 
 // ../../packages/tacho/src/collector/memory-capture/stella-store.ts
-import { dirname as dirname21, isAbsolute as isAbsolute10, join as join38, resolve as resolve15 } from "node:path";
+import { dirname as dirname22, isAbsolute as isAbsolute10, join as join39, resolve as resolve15 } from "node:path";
 function queryStellaStore(path2, afterSeq, limit) {
   const db = new (nodeSqlite()).DatabaseSync(path2, { readOnly: true });
   try {
@@ -46794,9 +46894,9 @@ async function stellaStoreOf(dir, exists) {
   if (!isAbsolute10(dir)) return void 0;
   let at2 = resolve15(dir);
   for (let depth = 0; depth < WORKSPACE_SEARCH_DEPTH; depth += 1) {
-    const candidate = join38(at2, STELLA_CONTEXT_DB);
+    const candidate = join39(at2, STELLA_CONTEXT_DB);
     if (await exists(candidate)) return candidate;
-    const up = dirname21(at2);
+    const up = dirname22(at2);
     if (up === at2) return void 0;
     at2 = up;
   }
@@ -46807,7 +46907,7 @@ var init_stella_store = __esm({
   "../../packages/tacho/src/collector/memory-capture/stella-store.ts"() {
     "use strict";
     init_memory_reader();
-    STELLA_CONTEXT_DB = join38(".stella", "private", "context.db");
+    STELLA_CONTEXT_DB = join39(".stella", "private", "context.db");
     STELLA_MEMORIES_VIEW = "export_memories_v1";
     STELLA_USES_VIEW = "export_memory_uses_v1";
     STELLA_USES_PER_READ = 5e3;
@@ -47469,7 +47569,7 @@ var init_cloud_link = __esm({
 
 // ../../packages/tacho/src/collector/local-servers/digest.ts
 import { createHash as createHash10 } from "node:crypto";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 function rememberBounded(map, key, value) {
   if (!map.has(key) && map.size >= MAX_REMEMBERED_DIGESTS) {
     const oldest = map.keys().next();
@@ -47506,7 +47606,7 @@ function npmNameSegment(name) {
   return name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
 }
 async function whichOnPath(command2, pathValue, search) {
-  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join39(dir, command2));
+  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join40(dir, command2));
   for (const candidate of candidates) {
     for (const extension of search.extensions) {
       if (await search.isExecutable(candidate + extension))
@@ -48802,9 +48902,9 @@ import {
   writeFile
 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname22, join as join40 } from "node:path";
+import { dirname as dirname23, join as join41 } from "node:path";
 function stagingFolder(root, name) {
-  return join40(root, `.${name}${STAGING_SUFFIX}`);
+  return join41(root, `.${name}${STAGING_SUFFIX}`);
 }
 function isStagingName(name) {
   return name.startsWith(".") && name.endsWith(STAGING_SUFFIX);
@@ -48847,17 +48947,17 @@ function envDir(env, key) {
 function skillsRoot(harness, env = process.env, home = homedir5()) {
   switch (harness) {
     case "claude-code":
-      return join40(
-        envDir(env, "CLAUDE_CONFIG_DIR") ?? join40(home, ".claude"),
+      return join41(
+        envDir(env, "CLAUDE_CONFIG_DIR") ?? join41(home, ".claude"),
         "skills"
       );
     case "codex": {
       const codexHome = envDir(env, "CODEX_HOME");
-      return codexHome === null ? join40(home, ".agents", "skills") : join40(codexHome, "skills");
+      return codexHome === null ? join41(home, ".agents", "skills") : join41(codexHome, "skills");
     }
     case "stella":
-      return join40(
-        envDir(env, "STELLA_HOME") ?? join40(home, ".stella"),
+      return join41(
+        envDir(env, "STELLA_HOME") ?? join41(home, ".stella"),
         "skills"
       );
     case "cursor":
@@ -48918,7 +49018,7 @@ async function readMarker(folder) {
   if (!entries2.includes(SESSION_MARKER)) return { state: "foreign" };
   try {
     const parsed2 = JSON.parse(
-      await readFile2(join40(folder, SESSION_MARKER), "utf8")
+      await readFile2(join41(folder, SESSION_MARKER), "utf8")
     );
     return isMarker(parsed2) ? { state: "ours", marker: parsed2 } : { state: "foreign" };
   } catch {
@@ -48935,23 +49035,23 @@ function liveSessions(marker, now) {
   return live;
 }
 async function writeMarker(folder, marker) {
-  const temp = join40(folder, MARKER_TEMP);
+  const temp = join41(folder, MARKER_TEMP);
   await writeFile(temp, `${JSON.stringify(marker, null, 2)}
 `);
-  await rename2(temp, join40(folder, SESSION_MARKER));
+  await rename2(temp, join41(folder, SESSION_MARKER));
 }
 async function writeSkill(root, skill, marker) {
-  const folder = join40(root, skill.name);
+  const folder = join41(root, skill.name);
   const staging = stagingFolder(root, skill.name);
   await rm2(folder, { recursive: true, force: true });
   await rm2(staging, { recursive: true, force: true });
   await mkdir2(staging);
   await writeMarker(staging, { digest: UNFINISHED_DIGEST, sessions: {} });
   await rename2(staging, folder);
-  await writeFile(join40(folder, "SKILL.md"), skillMarkdown(skill));
+  await writeFile(join41(folder, "SKILL.md"), skillMarkdown(skill));
   for (const file of skill.files) {
-    const target2 = join40(folder, file.path);
-    await mkdir2(dirname22(target2), { recursive: true });
+    const target2 = join41(folder, file.path);
+    await mkdir2(dirname23(target2), { recursive: true });
     await writeFile(target2, file.content);
   }
   await writeMarker(folder, marker);
@@ -48979,7 +49079,7 @@ async function placeSkills(root, sessionId, skills, now = /* @__PURE__ */ new Da
       result2.warnings.push(refusal);
       continue;
     }
-    const folder = join40(root, skill.name);
+    const folder = join41(root, skill.name);
     if (taken.has(skill.name)) {
       result2.skipped.push(skill.name);
       result2.warnings.push(
@@ -49044,7 +49144,7 @@ async function removeSkills(root, sessionId, now = /* @__PURE__ */ new Date()) {
     throw error;
   }
   for (const name of names2.sort(compareText)) {
-    const folder = join40(root, name);
+    const folder = join41(root, name);
     if (isStagingName(name)) {
       await rm2(folder, { recursive: true, force: true });
       continue;
@@ -52287,7 +52387,7 @@ var init_model_proxy_listener = __esm({
 import {
   createServer as createServer5
 } from "node:http";
-import { chmodSync as chmodSync9, existsSync as existsSync21, statSync as statSync10, unlinkSync as unlinkSync11 } from "node:fs";
+import { chmodSync as chmodSync9, existsSync as existsSync21, statSync as statSync11, unlinkSync as unlinkSync11 } from "node:fs";
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { createConnection } from "node:net";
 function isExportFormat(value) {
@@ -52652,7 +52752,7 @@ function createRequestHandler(api, log, options = {}) {
 }
 async function removeStaleSocket(socketPath) {
   if (!existsSync21(socketPath)) return;
-  if (!statSync10(socketPath).isSocket()) {
+  if (!statSync11(socketPath).isSocket()) {
     throw new Error(`collector socket path is not a socket: ${socketPath}`);
   }
   const stale = await new Promise((resolve25, reject) => {
@@ -52820,13 +52920,13 @@ var init_server = __esm({
 });
 
 // ../../packages/tacho/src/collector/refused.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync18, statSync as statSync11 } from "node:fs";
-import { join as join41 } from "node:path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync12 } from "node:fs";
+import { join as join42 } from "node:path";
 function refusalRetryable(refusal) {
   return refusal === "malformed" || refusal === "parked";
 }
 function refusedRecordPath(dir, event) {
-  return join41(dir, `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`);
+  return join42(dir, `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`);
 }
 function newRefusedRecord(event, reason3, refusal, at2, body2) {
   const retryable = refusalRetryable(refusal);
@@ -52869,8 +52969,8 @@ function readRefusedEntry(file) {
   let record;
   let mtimeMs;
   try {
-    record = JSON.parse(readFileSync18(file, "utf8"));
-    mtimeMs = statSync11(file).mtimeMs;
+    record = JSON.parse(readFileSync19(file, "utf8"));
+    mtimeMs = statSync12(file).mtimeMs;
   } catch {
     return void 0;
   }
@@ -52902,7 +53002,7 @@ function scanRefused(dir, now, limit = MAX_REFUSED_RETRIES_PER_PASS) {
   };
   const due = [];
   for (const name of names2) {
-    const entry2 = readRefusedEntry(join41(dir, name));
+    const entry2 = readRefusedEntry(join42(dir, name));
     if (entry2 === void 0) continue;
     summary.total += 1;
     if (summary.lastRefusedAt === void 0 || entry2.refusedAt > summary.lastRefusedAt)
@@ -52938,8 +53038,8 @@ var init_refused = __esm({
 });
 
 // ../../packages/tacho/src/collector/spool.ts
-import { existsSync as existsSync22, readFileSync as readFileSync19, unlinkSync as unlinkSync12 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync20, unlinkSync as unlinkSync12 } from "node:fs";
+import { join as join43 } from "node:path";
 function sessionOwnedElsewhere(error) {
   return error.status === 403 && error.body.includes(SESSION_OWNED_ELSEWHERE);
 }
@@ -53172,12 +53272,12 @@ var init_spool = __esm({
       }
       /** Add a body to a quarantine record that was written without one. */
       stashBodyBeside(event, body2) {
-        const path2 = join42(
+        const path2 = join43(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
         try {
-          const record = JSON.parse(readFileSync19(path2, "utf8"));
+          const record = JSON.parse(readFileSync20(path2, "utf8"));
           if (record["body"] !== void 0) return;
           writeSensitiveFileAtomic(
             path2,
@@ -53821,15 +53921,15 @@ var init_session_heads = __esm({
 import {
   existsSync as existsSync23,
   readdirSync as readdirSync13,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   renameSync as renameSync4,
-  statSync as statSync12,
+  statSync as statSync13,
   unlinkSync as unlinkSync13
 } from "node:fs";
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir7, hostname as osHostname2 } from "node:os";
-import { dirname as dirname23, join as join43 } from "node:path";
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { dirname as dirname24, join as join44 } from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
 function cloudGatewayUpstreams(origin = CLOUD_GATEWAY_ORIGIN) {
   const base2 = new URL(origin).origin;
   const openai = `${base2}${CLOUD_GATEWAY_BASE_PATH}/openai/v1`;
@@ -53859,7 +53959,7 @@ function cloudGatewayCredentialStore(disk, runToken) {
 }
 function readTextOrUndefined(path2) {
   try {
-    return readFileSync20(path2, "utf8");
+    return readFileSync21(path2, "utf8");
   } catch {
     return void 0;
   }
@@ -53880,7 +53980,7 @@ function parseOtlpPayload(payload) {
   return otlpPayloadSchema.parse(payload);
 }
 function defaultExec(command2, args) {
-  const result2 = spawnSync6(command2, args, {
+  const result2 = spawnSync7(command2, args, {
     encoding: "utf8",
     maxBuffer: 4 * 1024 * 1024,
     timeout: 1e4
@@ -54060,7 +54160,7 @@ async function initializeDaemon(options, server, port, ready) {
   }) : void 0;
   const memoryHome = options.home ?? homedir7();
   const memoryLocations = () => claudeCodeMemoryLocations(
-    dirname23(paths.claudeProjects),
+    dirname24(paths.claudeProjects),
     projectDirsOf(registry2.list())
   );
   const memoryUses = options.listen ?? true ? createMemoryUses({
@@ -54171,7 +54271,7 @@ async function initializeDaemon(options, server, port, ready) {
     processStarts: hookProcessStarts,
     adoptedChain: (sessionUuid2) => backfillLedger.chainHead(sessionUuid2)
   });
-  const priorStateWrittenAt = existsSync23(paths.daemonState) ? statSync12(paths.daemonState).mtimeMs : void 0;
+  const priorStateWrittenAt = existsSync23(paths.daemonState) ? statSync13(paths.daemonState).mtimeMs : void 0;
   const sealedState = parseSealedState(
     readJsonStateFile(
       paths.daemonSealedState,
@@ -54572,7 +54672,7 @@ async function initializeDaemon(options, server, port, ready) {
       controlReachable: lastControlAt !== void 0 && now() - lastControlAt < 2 * timers.bundleRefreshMs
     };
   }
-  const bodyPurgeOwedPath = join43(paths.wal, "body-purge-owed");
+  const bodyPurgeOwedPath = join44(paths.wal, "body-purge-owed");
   function markBodyPurgeOwed(retention, dropped) {
     try {
       ensureDir(paths.wal);
@@ -54594,7 +54694,7 @@ async function initializeDaemon(options, server, port, ready) {
     if (!existsSync23(bodyPurgeOwedPath)) return void 0;
     let text5;
     try {
-      text5 = readFileSync20(bodyPurgeOwedPath, "utf8");
+      text5 = readFileSync21(bodyPurgeOwedPath, "utf8");
     } catch (error) {
       log(
         `cannot read the owed body purge at ${bodyPurgeOwedPath}: ${error instanceof Error ? error.message : String(error)}; the retry sweeps against the clause in force. Check the file's permissions`
@@ -54849,7 +54949,7 @@ async function initializeDaemon(options, server, port, ready) {
     }
     void workOrderAutostart.reconcile();
   }
-  const lastIngestFile = join43(paths.dir, "last-ingest.json");
+  const lastIngestFile = join44(paths.dir, "last-ingest.json");
   const shipper = new Shipper({
     wal,
     client,
@@ -54890,7 +54990,7 @@ async function initializeDaemon(options, server, port, ready) {
       read: () => {
         try {
           const at2 = Date.parse(
-            JSON.parse(readFileSync20(lastIngestFile, "utf8")).at ?? ""
+            JSON.parse(readFileSync21(lastIngestFile, "utf8")).at ?? ""
           );
           return Number.isFinite(at2) ? at2 : void 0;
         } catch {
@@ -55371,7 +55471,7 @@ async function initializeDaemon(options, server, port, ready) {
   async function readSpoolFile(name) {
     try {
       const file = parseSpoolFile(
-        await readFile3(join43(paths.spool, name), "utf8")
+        await readFile3(join44(paths.spool, name), "utf8")
       );
       spoolFacts.set(name, spoolFactsOf(file));
       return file;
@@ -55560,7 +55660,7 @@ async function initializeDaemon(options, server, port, ready) {
   function setAsideConflictingTerminal(uuid, pending, conflict) {
     const name = `${uuid}-terminal-conflict-${String(conflict.seq).padStart(8, "0")}.json`;
     writeSensitiveFileAtomic(
-      join43(paths.quarantine, name),
+      join44(paths.quarantine, name),
       JSON.stringify(
         {
           reason: conflict.message,
@@ -55640,8 +55740,8 @@ async function initializeDaemon(options, server, port, ready) {
   function moveToFailedSpool(path2, name, reason3) {
     log(`spool file ${name} moved to spool/failed/: ${reason3}`);
     try {
-      ensureDir(join43(paths.spool, "failed"));
-      renameSync4(path2, join43(paths.spool, "failed", name));
+      ensureDir(join44(paths.spool, "failed"));
+      renameSync4(path2, join44(paths.spool, "failed", name));
     } catch (error) {
       log(
         `spool file ${name} could not be moved to spool/failed/: ${error instanceof Error ? error.message : String(error)}`
@@ -55694,7 +55794,7 @@ async function initializeDaemon(options, server, port, ready) {
         continue;
       }
       reads += 1;
-      const path2 = join43(paths.spool, name);
+      const path2 = join44(paths.spool, name);
       let file;
       try {
         file = await readSpoolFile(name);
@@ -55979,7 +56079,7 @@ async function initializeDaemon(options, server, port, ready) {
       const state = await readModelBaseUrlState({
         home: options.home ?? homedir7(),
         port: modelProxyPortFor(host),
-        stellaHome: dirname23(options.paths.stellaToml),
+        stellaHome: dirname24(options.paths.stellaToml),
         harnesses: ["claude-code", "codex", "stella"]
       });
       const next = {};
@@ -56521,9 +56621,9 @@ async function initializeDaemon(options, server, port, ready) {
     let removed = 0;
     for (const name of readdirSync13(paths.quarantine)) {
       if (!name.endsWith(".json")) continue;
-      const file = join43(paths.quarantine, name);
+      const file = join44(paths.quarantine, name);
       try {
-        const refusedAt = readRefusedEntry(file)?.refusedAt ?? statSync12(file).mtimeMs;
+        const refusedAt = readRefusedEntry(file)?.refusedAt ?? statSync13(file).mtimeMs;
         if (at2 - refusedAt < retainMs) continue;
         unlinkSync13(file);
         removed += 1;
@@ -56851,7 +56951,7 @@ async function initializeDaemon(options, server, port, ready) {
   let memoryScan;
   if (options.listen ?? true) {
     const codexMemories = createCodexMemoryStore({
-      path: join43(dirname23(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
+      path: join44(dirname24(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
       stat: (path2) => stat2(path2),
       log
     });
@@ -57139,7 +57239,7 @@ var init_daemon = __esm({
 });
 
 // ../../packages/tacho/src/collector/run.ts
-import { readFileSync as readFileSync21, unlinkSync as unlinkSync14 } from "node:fs";
+import { readFileSync as readFileSync22, unlinkSync as unlinkSync14 } from "node:fs";
 function stopWithin(stop, graceMs, exit, log) {
   const timer = setTimeout(() => {
     log(`tachod: stop did not finish within ${graceMs} ms, exiting
@@ -57207,14 +57307,14 @@ function ownProcStart() {
 }
 function readPidFile(path2) {
   try {
-    return readFileSync21(path2, "utf8");
+    return readFileSync22(path2, "utf8");
   } catch {
     return void 0;
   }
 }
 function releaseDaemonPid(path2, previous) {
   try {
-    if (parseDaemonPid(readFileSync21(path2, "utf8"))?.pid !== process.pid) return;
+    if (parseDaemonPid(readFileSync22(path2, "utf8"))?.pid !== process.pid) return;
     if (previous === void 0) unlinkSync14(path2);
     else writeSensitiveFileAtomic(path2, previous, 420);
   } catch {
@@ -57363,7 +57463,7 @@ import {
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname24, join as join44, resolve as resolve17 } from "node:path";
+import { dirname as dirname25, join as join45, resolve as resolve17 } from "node:path";
 function bundlePath(root, relative11, create2 = false) {
   const absolute = resolve17(root);
   if (create2) mkdirSync6(absolute, { recursive: true, mode: 448 });
@@ -57374,7 +57474,7 @@ function bundlePath(root, relative11, create2 = false) {
   let current = base2;
   const parts = relative11.split("/");
   for (let i2 = 0; i2 < parts.length; i2++) {
-    current = join44(current, parts[i2]);
+    current = join45(current, parts[i2]);
     try {
       const stat7 = lstatSync8(current);
       if (stat7.isSymbolicLink() || i2 < parts.length - 1 && !stat7.isDirectory()) {
@@ -57388,7 +57488,7 @@ function bundlePath(root, relative11, create2 = false) {
       else if (i2 < parts.length - 1) throw error;
     }
   }
-  if (realpathSync5(dirname24(current)) !== dirname24(current)) {
+  if (realpathSync5(dirname25(current)) !== dirname25(current)) {
     arpFail(`The bundle directory changed while ${relative11} was read.`);
   }
   return current;
@@ -58335,7 +58435,7 @@ import {
   rmSync as rmSync8,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { dirname as dirname25, isAbsolute as isAbsolute11, join as join45, relative as relative5, resolve as resolve18, sep as sep7 } from "node:path";
+import { dirname as dirname26, isAbsolute as isAbsolute11, join as join46, relative as relative5, resolve as resolve18, sep as sep7 } from "node:path";
 function outsideProfile(path2) {
   return HARNESS_CONFIG_PATH.test(path2) || CREDENTIAL_PATH.test(path2);
 }
@@ -58391,9 +58491,9 @@ function within2(root, path2) {
 }
 function newPath(path2) {
   const full = resolve18(path2);
-  return join45(
-    realpathSync6(dirname25(full)),
-    full.slice(dirname25(full).length + 1)
+  return join46(
+    realpathSync6(dirname26(full)),
+    full.slice(dirname26(full).length + 1)
   );
 }
 function sourcePath(root, path2) {
@@ -58405,7 +58505,7 @@ function sourcePath(root, path2) {
   }
   let current = root;
   for (const part2 of path2.split("/")) {
-    current = join45(current, part2);
+    current = join46(current, part2);
     if (lstatSync9(current).isSymbolicLink())
       arpFail(
         `${path2} is a symlink or passes through one. Symlinks require a resource adapter.`
@@ -58672,23 +58772,23 @@ function prepareCheckpoint(options) {
   });
   mkdirSync7(destination, { mode: 448 });
   try {
-    const restored = join45(destination, "workspace");
+    const restored = join46(destination, "workspace");
     mkdirSync7(restored, { mode: 448 });
     for (const item of restore) {
-      const path2 = join45(restored, item.path);
+      const path2 = join46(restored, item.path);
       if (item.kind === "directory")
         mkdirSync7(path2, { recursive: true, mode: 448 });
       else {
-        mkdirSync7(dirname25(path2), { recursive: true, mode: 448 });
+        mkdirSync7(dirname26(path2), { recursive: true, mode: 448 });
         writeFileSync5(path2, item.bytes, {
           flag: "wx",
           mode: item.executable ? 448 : 384
         });
       }
     }
-    const promptDir = join45(restored, ".arp");
+    const promptDir = join46(restored, ".arp");
     mkdirSync7(promptDir, { mode: 448 });
-    const promptFile = join45(promptDir, "handoff.json");
+    const promptFile = join46(promptDir, "handoff.json");
     const prompt = {
       checkpoint_digest: checkpointDigest,
       task: task.data.request,
@@ -58705,7 +58805,7 @@ function prepareCheckpoint(options) {
       flag: "wx",
       mode: 384
     });
-    const reportPath = join45(destination, "report.json");
+    const reportPath = join46(destination, "report.json");
     writeFileSync5(
       reportPath,
       jcs(
@@ -58890,7 +58990,7 @@ __export(main_exports, {
   recordedCliDeps: () => recordedCliDeps,
   tokenOption: () => tokenOption
 });
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 function parsePort(value) {
   const port = Number(value);
   if (!/^\d+$/.test(value) || port < 1024 || port > 65535)
@@ -58927,7 +59027,7 @@ function parseOneHarness(value) {
     throw new InvalidArgumentError("name one harness");
   return harness;
 }
-function tokenOption(opts, err2, readStdin3 = () => readFileSync22(0, "utf8")) {
+function tokenOption(opts, err2, readStdin3 = () => readFileSync23(0, "utf8")) {
   const flag2 = opts.token;
   if (opts.tokenStdin !== true) {
     if (flag2 !== void 0)
@@ -59346,7 +59446,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-955",
+      version: "2.1.4-957",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -59413,10 +59513,10 @@ var init_package = __esm({
 
 // src/lib/atomic-write.ts
 import { writeFileSync as writeFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync15, existsSync as existsSync24 } from "node:fs";
-import { dirname as dirname26, join as join46 } from "node:path";
+import { dirname as dirname27, join as join47 } from "node:path";
 function atomicWriteFileSync(path2, data, mode) {
-  const dir = dirname26(path2);
-  const tmp = join46(
+  const dir = dirname27(path2);
+  const tmp = join47(
     dir,
     `.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
   );
@@ -59441,8 +59541,8 @@ var init_atomic_write = __esm({
 
 // src/lib/config.ts
 import { homedir as homedir8 } from "os";
-import { join as join47 } from "path";
-import { readFileSync as readFileSync23, mkdirSync as mkdirSync8, existsSync as existsSync25, statSync as statSync13 } from "fs";
+import { join as join48 } from "path";
+import { readFileSync as readFileSync24, mkdirSync as mkdirSync8, existsSync as existsSync25, statSync as statSync14 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -59472,7 +59572,7 @@ function parseConfig(raw) {
 function readConfig() {
   let identity;
   try {
-    const info = statSync13(CONFIG_FILE);
+    const info = statSync14(CONFIG_FILE);
     identity = `${info.ino}:${info.size}:${info.mtimeMs}`;
   } catch {
     cached2 = void 0;
@@ -59480,7 +59580,7 @@ function readConfig() {
   }
   if (cached2?.identity === identity) return structuredClone(cached2.config);
   try {
-    const config = parseConfig(JSON.parse(readFileSync23(CONFIG_FILE, "utf8")));
+    const config = parseConfig(JSON.parse(readFileSync24(CONFIG_FILE, "utf8")));
     cached2 = { identity, config };
     return structuredClone(config);
   } catch (err2) {
@@ -59528,8 +59628,8 @@ var CONFIG_DIR, CONFIG_FILE, STRING_FIELDS, TELEMETRY_FIELDS, cached2;
 var init_config = __esm({
   "src/lib/config.ts"() {
     init_atomic_write();
-    CONFIG_DIR = join47(homedir8(), ".config", "oxagen");
-    CONFIG_FILE = join47(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join48(homedir8(), ".config", "oxagen");
+    CONFIG_FILE = join48(CONFIG_DIR, "config.json");
     STRING_FIELDS = [
       "token",
       "orgSlug",
@@ -59574,16 +59674,16 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join48 } from "node:path";
+import { join as join49 } from "node:path";
 function isDebugEnabled() {
   const v = process.env[DEBUG_ENV];
   return v === "1" || v === "true";
 }
 function logsDir() {
-  return join48(homedir9(), ".oxagen", "logs");
+  return join49(homedir9(), ".oxagen", "logs");
 }
 function debugLogFile() {
-  return join48(logsDir(), "cli.output");
+  return join49(logsDir(), "cli.output");
 }
 function sanitize(value, depth = 0) {
   if (value === null || value === void 0) return value;
@@ -62878,9 +62978,9 @@ var init_git = __esm({
 
 // ../../packages/steering-freshness/src/cache.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname27, join as join49 } from "node:path";
+import { dirname as dirname28, join as join50 } from "node:path";
 function stampPath(gitCommonDir) {
-  return join49(gitCommonDir, "oxagen", "steering-freshness.json");
+  return join50(gitCommonDir, "oxagen", "steering-freshness.json");
 }
 async function readFetchStamp(gitCommonDir, io = defaultIo) {
   try {
@@ -62901,7 +63001,7 @@ async function readFetchStamp(gitCommonDir, io = defaultIo) {
 async function writeFetchStamp(gitCommonDir, stamp, io = defaultIo) {
   const path2 = stampPath(gitCommonDir);
   try {
-    await io.mkdirp(dirname27(path2));
+    await io.mkdirp(dirname28(path2));
     await io.write(path2, `${JSON.stringify(stamp)}
 `, "utf8");
   } catch {
@@ -62932,24 +63032,24 @@ var init_cache = __esm({
 // ../../packages/steering-freshness/src/hooks.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname28, join as join50 } from "node:path";
+import { dirname as dirname29, join as join51 } from "node:path";
 function hookCommand(harness) {
   return `oxagen steering gate --harness ${harness}`;
 }
 function hookConfigPath(projectRoot, harness, env = process.env, home = homedir10()) {
   switch (harness) {
     case "claude-code":
-      return join50(projectRoot, ".claude", "settings.json");
+      return join51(projectRoot, ".claude", "settings.json");
     case "codex":
-      return join50(env["CODEX_HOME"] ?? join50(home, ".codex"), "hooks.json");
+      return join51(env["CODEX_HOME"] ?? join51(home, ".codex"), "hooks.json");
     case "cursor":
-      return join50(home, ".cursor", "hooks.json");
+      return join51(home, ".cursor", "hooks.json");
     case "stella":
-      return join50(env["STELLA_HOME"] ?? join50(home, ".stella"), "stella.toml");
+      return join51(env["STELLA_HOME"] ?? join51(home, ".stella"), "stella.toml");
   }
 }
 function stellaJsonPath(env, home) {
-  return join50(env["STELLA_HOME"] ?? join50(home, ".stella"), "settings.json");
+  return join51(env["STELLA_HOME"] ?? join51(home, ".stella"), "settings.json");
 }
 function isRecord7(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -63036,7 +63136,7 @@ async function installJsonGroupHook(path2, harness, entry2, io) {
     };
   }
   const had = hasGroupHook(loaded.config);
-  await io.mkdirp(dirname28(path2));
+  await io.mkdirp(dirname29(path2));
   await io.write(
     path2,
     `${JSON.stringify(withGroupHook(loaded.config, entry2), null, 2)}
@@ -63138,7 +63238,7 @@ async function installCursorHook(path2, io) {
   ];
   const next = { ...config, hooks };
   if (next.version === void 0) next.version = 1;
-  await io.mkdirp(dirname28(path2));
+  await io.mkdirp(dirname29(path2));
   await io.write(path2, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
@@ -63321,7 +63421,7 @@ async function installStellaHook(projectRoot, io, env, home) {
   }
   const separator = base2.length === 0 ? "" : eol;
   const next = `${base2}${separator}${renderStellaBlock(eol)}`;
-  await io.mkdirp(dirname28(path2));
+  await io.mkdirp(dirname29(path2));
   await io.write(path2, next, "utf8");
   return {
     harness: "stella",
@@ -63609,7 +63709,7 @@ var init_policy = __esm({
 // ../../packages/steering-freshness/src/settings.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 async function readLayer(scope, path2, read2) {
   let text5;
   try {
@@ -63661,14 +63761,14 @@ function parseLayer(scope, path2, text5) {
 }
 async function loadSteeringSettings({
   projectRoot,
-  userSettingsPath = join51(homedir11(), USER_SETTINGS_RELATIVE),
+  userSettingsPath = join52(homedir11(), USER_SETTINGS_RELATIVE),
   read: read2 = readFile8,
   workspacePolicy = null
 }) {
   const targets = [
     ["user", userSettingsPath],
-    ["project", join51(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
-    ["local", join51(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
+    ["project", join52(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
+    ["local", join52(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
   ];
   const layers = [];
   const warnings = [];
@@ -63731,7 +63831,7 @@ var init_settings = __esm({
     "use strict";
     init_git();
     init_policy();
-    USER_SETTINGS_RELATIVE = join51(
+    USER_SETTINGS_RELATIVE = join52(
       ".config",
       "oxagen",
       "settings.json"
@@ -63744,7 +63844,7 @@ var init_settings = __esm({
 
 // ../../packages/steering-freshness/src/check.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute12, join as join52, resolve as resolve19 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join53, resolve as resolve19 } from "node:path";
 function publishedCommits(platform) {
   if (platform.headCommits && platform.headCommits.length > 0)
     return platform.headCommits;
@@ -64081,7 +64181,7 @@ async function absentFromDisk(root, paths) {
   const flags = await Promise.all(
     paths.map(async (path2) => {
       try {
-        await lstat3(join52(root, path2));
+        await lstat3(join53(root, path2));
         return false;
       } catch {
         return true;
@@ -64140,7 +64240,7 @@ var init_check = __esm({
 // ../../packages/steering-freshness/src/sync.ts
 import { mkdtemp, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 function refuse3(refusal, message) {
   return {
     applied: false,
@@ -64321,9 +64421,9 @@ async function syncSteering(opts) {
   };
 }
 async function commitPaths(ctx, message, paths) {
-  const dir = await mkdtemp(join53(tmpdir2(), "oxagen-steering-sync-"));
+  const dir = await mkdtemp(join54(tmpdir2(), "oxagen-steering-sync-"));
   try {
-    const list2 = join53(dir, "pathspec");
+    const list2 = join54(dir, "pathspec");
     await writeFile6(list2, `${paths.join("\0")}\0`, "utf8");
     await git3(
       ctx,
@@ -64850,10 +64950,10 @@ var init_paths2 = __esm({
 });
 
 // src/commands/workspace-link.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync9, readFileSync as readFileSync24 } from "node:fs";
-import { dirname as dirname29, join as join54 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync9, readFileSync as readFileSync25 } from "node:fs";
+import { dirname as dirname30, join as join55 } from "node:path";
 function workspaceLinkPath(cwd) {
-  return join54(cwd, WORKSPACE_LINK_PATH);
+  return join55(cwd, WORKSPACE_LINK_PATH);
 }
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -64886,7 +64986,7 @@ function readWorkspaceLink(cwd) {
   if (!existsSync26(filePath)) return null;
   let parsed2;
   try {
-    parsed2 = JSON.parse(readFileSync24(filePath, "utf8"));
+    parsed2 = JSON.parse(readFileSync25(filePath, "utf8"));
   } catch (err2) {
     const detail = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
@@ -64907,7 +65007,7 @@ function readWorkspaceLink(cwd) {
 }
 function writeWorkspaceLink(cwd, link) {
   const filePath = workspaceLinkPath(cwd);
-  mkdirSync9(dirname29(filePath), { recursive: true });
+  mkdirSync9(dirname30(filePath), { recursive: true });
   atomicWriteFileSync(filePath, JSON.stringify(link, null, 2));
 }
 var LINK_STRING_FIELDS;
@@ -64943,7 +65043,7 @@ __export(steering_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync27, realpathSync as realpathSync7 } from "node:fs";
-import { dirname as dirname30, join as join55, normalize, parse as parsePath } from "node:path";
+import { dirname as dirname31, join as join56, normalize, parse as parsePath } from "node:path";
 function findProjectRoot(start) {
   const { root } = parsePath(start);
   const rawGitRoot = gitRootOr(start);
@@ -64952,9 +65052,9 @@ function findProjectRoot(start) {
   if (gitRoot !== null) return gitRoot;
   let dir = from;
   for (; ; ) {
-    if (existsSync27(join55(dir, PROJECT_DIR_NAME))) return dir;
+    if (existsSync27(join56(dir, PROJECT_DIR_NAME))) return dir;
     if (dir === root) return from;
-    const parent = dirname30(dir);
+    const parent = dirname31(dir);
     if (parent === dir) return from;
     dir = parent;
   }
@@ -82044,7 +82144,7 @@ var init_memory_client = __esm({
 import { readFile as readFile9 } from "node:fs/promises";
 import {
   basename as basename7,
-  dirname as dirname31,
+  dirname as dirname32,
   isAbsolute as isAbsolute13,
   relative as relative6,
   resolve as resolve20,
@@ -82056,7 +82156,7 @@ function inside(rel) {
 function importFilename(path2, folder) {
   let rel = relative6(process.cwd(), path2);
   if (!inside(rel) && folder !== void 0) {
-    rel = relative6(dirname31(resolve20(folder)), resolve20(path2));
+    rel = relative6(dirname32(resolve20(folder)), resolve20(path2));
   }
   const name = inside(rel) ? rel.split(sep8).join("/") : basename7(path2);
   return name.length > 256 ? basename7(path2).slice(-256) : name;
@@ -82343,7 +82443,7 @@ __export(steering_import_exports, {
 });
 import { readdir as readdir4, realpath as realpath2, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
-import { basename as basename8, extname, join as join56, relative as relative7, sep as sep9 } from "node:path";
+import { basename as basename8, extname, join as join57, relative as relative7, sep as sep9 } from "node:path";
 function envDir2(env, key) {
   const value = env[key];
   return value === void 0 || value.trim() === "" ? null : value;
@@ -82351,34 +82451,34 @@ function envDir2(env, key) {
 function harnessHome(harness, env = process.env, home = homedir12()) {
   switch (harness) {
     case "claude-code": {
-      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join56(home, ".claude");
+      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join57(home, ".claude");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("claude-code", env, home) ?? join56(config, "skills"),
+            dir: skillsRoot("claude-code", env, home) ?? join57(config, "skills"),
             mount: ".claude/skills"
           },
-          { dir: join56(config, "commands"), mount: ".claude/commands" },
-          { dir: join56(config, "agents"), mount: ".claude/agents" }
+          { dir: join57(config, "commands"), mount: ".claude/commands" },
+          { dir: join57(config, "agents"), mount: ".claude/agents" }
         ],
         instructions: [
-          { file: join56(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
+          { file: join57(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
         ]
       };
     }
     case "codex": {
-      const codexHome = envDir2(env, "CODEX_HOME") ?? join56(home, ".codex");
+      const codexHome = envDir2(env, "CODEX_HOME") ?? join57(home, ".codex");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("codex", env, home) ?? join56(home, ".agents", "skills"),
+            dir: skillsRoot("codex", env, home) ?? join57(home, ".agents", "skills"),
             mount: ".agents/skills"
           }
         ],
         instructions: ["AGENTS.override.md", "AGENTS.md"].map((name) => ({
-          file: join56(codexHome, name),
+          file: join57(codexHome, name),
           filename: `.codex/${name}`
         }))
       };
@@ -82387,8 +82487,8 @@ function harnessHome(harness, env = process.env, home = homedir12()) {
       return {
         harness,
         folders: [
-          { dir: join56(home, ".cursor", "skills"), mount: ".cursor/skills" },
-          { dir: join56(home, ".cursor", "commands"), mount: ".cursor/commands" }
+          { dir: join57(home, ".cursor", "skills"), mount: ".cursor/skills" },
+          { dir: join57(home, ".cursor", "commands"), mount: ".cursor/commands" }
         ],
         instructions: []
       };
@@ -82434,7 +82534,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     const found = [];
     for (const entry2 of entries2.sort(byName)) {
-      const path2 = join56(dir, entry2.name);
+      const path2 = join57(dir, entry2.name);
       if (entry2.isDirectory()) {
         if (!entry2.name.startsWith(".") && entry2.name !== "node_modules")
           found.push(...await filesUnder(path2, from));
@@ -82456,7 +82556,7 @@ async function findMarkdownFiles(paths, harness) {
     const { folder } = frame;
     const named = (rel) => frame.fixedNames ? { filename: rel } : {};
     for (const entry2 of entries2) {
-      const path2 = join56(dir, entry2.name);
+      const path2 = join57(dir, entry2.name);
       const rel = frame.relOf(path2);
       if (entry2.isDirectory()) {
         if (entry2.name === "node_modules") continue;
@@ -82515,7 +82615,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     if (folderGiven) {
       const catalogue = CATALOGUE_FOLDERS.has(basename8(path2));
-      const root = catalogue ? join56(path2, "..") : path2;
+      const root = catalogue ? join57(path2, "..") : path2;
       await walk2(path2, {
         relOf: (p) => under(root, p),
         folder: path2,
@@ -84174,12 +84274,12 @@ __export(verify_exports, {
   readBundle: () => readBundle,
   verifyBundle: () => verifyBundle3
 });
-import { existsSync as existsSync28, readFileSync as readFileSync25, statSync as statSync14 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync26, statSync as statSync15 } from "node:fs";
+import { join as join58 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
-    const path2 = join57(dir, name);
-    return existsSync28(path2) ? readFileSync25(path2, "utf8") : void 0;
+    const path2 = join58(dir, name);
+    return existsSync28(path2) ? readFileSync26(path2, "utf8") : void 0;
   };
   return assemble(read2, dir);
 }
@@ -84189,7 +84289,7 @@ function isBundleEntry(name) {
 function readZip(path2) {
   let entries2;
   try {
-    entries2 = unzipSync(new Uint8Array(readFileSync25(path2)), {
+    entries2 = unzipSync(new Uint8Array(readFileSync26(path2)), {
       filter: (file) => isBundleEntry(file.name)
     });
   } catch (err2) {
@@ -84225,7 +84325,7 @@ function readBundle(path2) {
   if (!existsSync28(path2)) {
     throw new BundleReadError(`${path2} does not exist.`);
   }
-  return statSync14(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
+  return statSync15(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
 }
 function plural3(count12, one, many) {
   return `${count12} ${count12 === 1 ? one : many}`;
@@ -85301,13 +85401,13 @@ import {
   existsSync as existsSync29,
   lstatSync as lstatSync10,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync26,
+  readFileSync as readFileSync27,
   readdirSync as readdirSync14,
   realpathSync as realpathSync8,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir13, hostname as osHostname3 } from "node:os";
-import { join as join58, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
+import { join as join59, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
 function git4(cwd, args) {
   return new Promise((done) => {
     try {
@@ -85354,7 +85454,7 @@ function parseRemoteRepository(url) {
 }
 function oxagenPresent(root) {
   try {
-    return readdirSync14(join58(root, ".oxagen")).some(
+    return readdirSync14(join59(root, ".oxagen")).some(
       (name) => name !== "workspace.json"
     );
   } catch {
@@ -85363,18 +85463,18 @@ function oxagenPresent(root) {
 }
 function symlinkState(root) {
   try {
-    if (!lstatSync10(join58(root, ".stella")).isDirectory()) return "none";
+    if (!lstatSync10(join59(root, ".stella")).isDirectory()) return "none";
   } catch {
     return "none";
   }
   let oxagenReal;
   try {
-    oxagenReal = realpathSync8(join58(root, ".oxagen"));
+    oxagenReal = realpathSync8(join59(root, ".oxagen"));
   } catch {
     return "missing";
   }
   for (const link of STELLA_LINKS) {
-    const at2 = join58(root, link);
+    const at2 = join59(root, link);
     try {
       if (!lstatSync10(at2).isSymbolicLink()) return "missing";
       const target2 = realpathSync8(at2);
@@ -85388,11 +85488,11 @@ function symlinkState(root) {
   return "linked";
 }
 function machineId(configDir = getConfigDir()) {
-  const file = join58(configDir, MACHINE_ID_FILE);
+  const file = join59(configDir, MACHINE_ID_FILE);
   let secret = null;
   try {
     if (existsSync29(file)) {
-      const stored = readFileSync26(file, "utf8").trim();
+      const stored = readFileSync27(file, "utf8").trim();
       if (/^[0-9a-f]{64}$/.test(stored)) secret = stored;
     }
     if (secret === null) {
@@ -85470,15 +85570,15 @@ async function ensureWorkspaceLinkIgnored(root) {
   const topDir = resolve22(top);
   const entry2 = relative8(
     topDir,
-    join58(realpathOr2(root), ".oxagen", "workspace.json")
+    join59(realpathOr2(root), ".oxagen", "workspace.json")
   ).split(sep10).join("/");
   if (entry2.startsWith("../")) return null;
   const rule = await git4(topDir, ["check-ignore", "--no-index", "-v", entry2]);
   if (rule !== null) return null;
-  const gitignore = join58(resolve22(top), ".gitignore");
+  const gitignore = join59(resolve22(top), ".gitignore");
   let existing = "";
   try {
-    existing = readFileSync26(gitignore, "utf8");
+    existing = readFileSync27(gitignore, "utf8");
   } catch {
   }
   const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
@@ -85991,16 +86091,16 @@ import { createHash as createHash18 } from "node:crypto";
 import {
   lstatSync as lstatSync11,
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync28,
   readdirSync as readdirSync15,
   realpathSync as realpathSync9,
   rmSync as rmSync10,
   rmdirSync as rmdirSync7
 } from "node:fs";
 import {
-  dirname as dirname32,
+  dirname as dirname33,
   isAbsolute as isAbsolute14,
-  join as join59,
+  join as join60,
   parse as parsePath2,
   posix as posix4,
   sep as sep11
@@ -86113,32 +86213,32 @@ function findLinkedRoot(start) {
     } catch {
     }
     if (dir === root) return null;
-    const parent = dirname32(dir);
+    const parent = dirname33(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function fsReader(root) {
   return (path2) => {
-    const abs = join59(root, ...path2.split("/"));
+    const abs = join60(root, ...path2.split("/"));
     try {
       const st = lstatSync11(abs);
       if (!st.isFile()) return Buffer.from(`\0not-a-file:${abs}`);
-      return readFileSync27(abs);
+      return readFileSync28(abs);
     } catch {
       return null;
     }
   };
 }
 function assertInsideOxagen(root, path2) {
-  const oxagenAbs = join59(root, OXAGEN_DIR);
+  const oxagenAbs = join60(root, OXAGEN_DIR);
   let oxagenReal;
   try {
     oxagenReal = realpathSync9(oxagenAbs);
   } catch {
     return;
   }
-  const abs = join59(root, ...path2.split("/"));
+  const abs = join60(root, ...path2.split("/"));
   try {
     if (lstatSync11(abs).isSymbolicLink()) {
       throw new Error(
@@ -86148,7 +86248,7 @@ function assertInsideOxagen(root, path2) {
   } catch (err2) {
     if (err2.code !== "ENOENT") throw err2;
   }
-  let dir = dirname32(abs);
+  let dir = dirname33(abs);
   for (; ; ) {
     let real = null;
     try {
@@ -86162,14 +86262,14 @@ function assertInsideOxagen(root, path2) {
       }
       return;
     }
-    const parent = dirname32(dir);
+    const parent = dirname33(dir);
     if (parent === dir) return;
     dir = parent;
   }
 }
 function pruneEmptyDirs(root, path2) {
-  const stop = join59(root, OXAGEN_DIR);
-  let dir = dirname32(join59(root, ...path2.split("/")));
+  const stop = join60(root, OXAGEN_DIR);
+  let dir = dirname33(join60(root, ...path2.split("/")));
   while (dir.startsWith(stop + sep11)) {
     try {
       if (readdirSync15(dir).length > 0) return;
@@ -86177,19 +86277,19 @@ function pruneEmptyDirs(root, path2) {
     } catch {
       return;
     }
-    dir = dirname32(dir);
+    dir = dirname33(dir);
   }
 }
 function applyPlan(root, plan) {
   for (const w of plan.writes) assertInsideOxagen(root, w.path);
   for (const d of plan.deletes) assertInsideOxagen(root, d);
   for (const w of plan.writes) {
-    const abs = join59(root, ...w.path.split("/"));
-    mkdirSync11(dirname32(abs), { recursive: true });
+    const abs = join60(root, ...w.path.split("/"));
+    mkdirSync11(dirname33(abs), { recursive: true });
     atomicWriteFileSync(abs, w.content);
   }
   for (const d of plan.deletes) {
-    rmSync10(join59(root, ...d.split("/")), { force: true });
+    rmSync10(join60(root, ...d.split("/")), { force: true });
     pruneEmptyDirs(root, d);
   }
 }
@@ -108277,12 +108377,12 @@ function queryEntries(parameter, value) {
       }
       if (shape.items.length === 0) return [];
       if (explode) return shape.items.map((item) => pair(name, item));
-      const [raw, delimiter] = style === "form" ? [",", ","] : style === "spaceDelimited" ? [" ", "%20"] : ["|", "|"];
+      const [raw, delimiter2] = style === "form" ? [",", ","] : style === "spaceDelimited" ? [" ", "%20"] : ["|", "|"];
       return [
         entry(
           name,
           shape.items.join(raw),
-          `${enc(name)}=${shape.items.map(val).join(delimiter)}`
+          `${enc(name)}=${shape.items.map(val).join(delimiter2)}`
         )
       ];
     }
@@ -130060,11 +130160,11 @@ import { createHash as createHash20 } from "node:crypto";
 import {
   lstatSync as lstatSync12,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync29,
   readlinkSync as readlinkSync4,
-  statSync as statSync15
+  statSync as statSync16
 } from "node:fs";
-import { dirname as dirname33, isAbsolute as isAbsolute15, join as join60, relative as relative9, resolve as resolve24, sep as sep12 } from "node:path";
+import { dirname as dirname34, isAbsolute as isAbsolute15, join as join61, relative as relative9, resolve as resolve24, sep as sep12 } from "node:path";
 function git5(cwd, args, input) {
   try {
     return execFileSync2("git", args, {
@@ -130096,11 +130196,11 @@ function commitOf2(root, ref2) {
   return sha2.length > 0 ? sha2 : null;
 }
 function readWorkingFile(root, path2) {
-  const abs = join60(root, ...path2.split("/"));
+  const abs = join61(root, ...path2.split("/"));
   try {
     const stat7 = lstatSync12(abs);
     if (stat7.isSymbolicLink()) return readlinkSync4(abs, "utf8");
-    return stat7.isFile() ? readFileSync28(abs, "utf8") : null;
+    return stat7.isFile() ? readFileSync29(abs, "utf8") : null;
   } catch {
     return null;
   }
@@ -130175,14 +130275,14 @@ function chooseBase(root, ref2) {
 }
 function isFile(path2) {
   try {
-    return statSync15(path2).isFile();
+    return statSync16(path2).isFile();
   } catch {
     return false;
   }
 }
 function isDir(path2) {
   try {
-    return statSync15(path2).isDirectory();
+    return statSync16(path2).isDirectory();
   } catch {
     return false;
   }
@@ -130190,10 +130290,10 @@ function isDir(path2) {
 function findSteeringRoot(start) {
   let dir = resolve24(start);
   for (; ; ) {
-    if (isFile(join60(dir, WORKSPACE_TOML_PATH)) || isFile(join60(dir, AGENTS_MD_PATH)) && isDir(join60(dir, STEERING_DIR))) {
+    if (isFile(join61(dir, WORKSPACE_TOML_PATH)) || isFile(join61(dir, AGENTS_MD_PATH)) && isDir(join61(dir, STEERING_DIR))) {
       return dir;
     }
-    const parent = dirname33(dir);
+    const parent = dirname34(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -130270,12 +130370,12 @@ function cacheFile(cacheDir, root) {
     key: token === void 0 ? null : createHash20("sha256").update(token).digest("hex").slice(0, 16)
   };
   const key = createHash20("sha256").update(JSON.stringify([root, identity])).digest("hex").slice(0, 32);
-  return join60(cacheDir, `${key}.json`);
+  return join61(cacheDir, `${key}.json`);
 }
 function readCache(file, now) {
   let entry2;
   try {
-    entry2 = JSON.parse(readFileSync28(file, "utf8"));
+    entry2 = JSON.parse(readFileSync29(file, "utf8"));
   } catch {
     return null;
   }
@@ -130298,7 +130398,7 @@ async function publishedInputs(root, deps, refresh, out) {
   }
   if (file !== null) {
     try {
-      mkdirSync12(dirname33(file), { recursive: true });
+      mkdirSync12(dirname34(file), { recursive: true });
       atomicWriteFileSync(
         file,
         JSON.stringify({
@@ -130384,7 +130484,7 @@ function defaultDeps2() {
   return {
     fetchPublished: fetchSteeringIndex,
     cedar: cedarHooks,
-    cacheDir: join60(getConfigDir(), "cache", "steering-check"),
+    cacheDir: join61(getConfigDir(), "cache", "steering-check"),
     now: () => Date.now()
   };
 }
@@ -134267,7 +134367,7 @@ var init_src9 = __esm({
 
 // src/commands/codegraph-upload/files.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join61, relative as relative10, sep as sep13 } from "node:path";
+import { join as join62, relative as relative10, sep as sep13 } from "node:path";
 function hasGlobChars(pattern) {
   return /[*?[\]{}]/.test(pattern);
 }
@@ -134279,7 +134379,7 @@ async function walk(root, dir, out) {
   const entries2 = await readdir5(dir, { withFileTypes: true });
   for (const entry2 of entries2) {
     if (entry2.isSymbolicLink()) continue;
-    const full = join61(dir, entry2.name);
+    const full = join62(dir, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name)) await walk(root, full, out);
     } else if (entry2.isFile()) {
@@ -134291,7 +134391,7 @@ async function expandPattern(root, pattern) {
   const wanted = normalize2(pattern.trim());
   if (!hasGlobChars(wanted)) {
     try {
-      const info = await stat5(join61(root, wanted));
+      const info = await stat5(join62(root, wanted));
       return info.isFile() ? [wanted] : [];
     } catch {
       return [];
@@ -134442,7 +134542,7 @@ var init_token = __esm({
 });
 
 // src/commands/codegraph-upload/run.ts
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 function addDropped(into, more) {
   into.sensitiveValues += more.sensitiveValues;
   into.secretData += more.secretData;
@@ -134460,7 +134560,7 @@ async function uploadOne(deps, config, token, group, path2, totals2) {
   const label2 = `${group.kind}/${group.source} ${path2}`;
   let bytes;
   try {
-    bytes = await deps.readFile(join62(deps.cwd, path2));
+    bytes = await deps.readFile(join63(deps.cwd, path2));
   } catch (error) {
     totals2.failed += 1;
     deps.log(`error: ${label2}: cannot read the file: ${error.message}`);
@@ -136296,7 +136396,7 @@ __export(secret_exports, {
   handleSecretReveal: () => handleSecretReveal,
   handleSecretSet: () => handleSecretSet
 });
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync8 } from "fs";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync8 } from "fs";
 async function readStdin2() {
   const chunks = [];
   for await (const chunk2 of process.stdin) chunks.push(chunk2);
@@ -136409,7 +136509,7 @@ async function handleSecretReveal(key, opts, writer = stdoutWriter) {
 async function handleSecretImport(opts, writer = stdoutWriter) {
   const out = createOutput({}, writer);
   try {
-    const text5 = opts.file ? readFileSync29(opts.file, "utf8") : await readStdin2();
+    const text5 = opts.file ? readFileSync30(opts.file, "utf8") : await readStdin2();
     const environmentId = opts.env ? await resolveEnvironmentId2(opts.env) : null;
     const { rows, committed } = await apiPostOrThrow("secret/import-env", { text: text5, environmentId, commit: !!opts.yes });
     const newCount = rows.filter((r) => r.isNewKey).length;