@oxagen/cli 2.1.5-63 → 2.1.5-69

package/oxagen.mjs

@@ -3589,15 +3589,15 @@ var init_types = __esm({
         }
         const valueType = this._def.valueType;
         function finalizeSet(elements2) {
-          const parsedSet = /* @__PURE__ */ new Set();
+          const parsedSet2 = /* @__PURE__ */ new Set();
           for (const element of elements2) {
             if (element.status === "aborted")
               return INVALID;
             if (element.status === "dirty")
               status2.dirty();
-            parsedSet.add(element.value);
+            parsedSet2.add(element.value);
           }
-          return { status: status2.value, value: parsedSet };
+          return { status: status2.value, value: parsedSet2 };
         }
         const elements = [...ctx.data.values()].map((item, i2) => valueType._parse(new ParseInputLazyPath(ctx, item, ctx.path, i2)));
         if (ctx.common.async) {
@@ -5656,7 +5656,7 @@ function bundleSkillChars(skill) {
     chars += file.path.length + file.content.length;
   return chars;
 }
-var protocolTimestampSchema, machineGroupSchema, TACHO_BATCH_SCHEMA, TACHO_BUNDLE_SCHEMA, TACHO_COMMANDS_SCHEMA, TACHO_ENROLLMENT_CLAIMS_SCHEMA, TACHO_ENFORCEMENT_TIER_ATTR, TACHO_GATEWAY_TIER, TACHO_GATEWAY_SESSION_HEADER, TACHO_GATEWAY_GENESIS_HEADER, REFUSAL_META_KEY, MCP_STREAMABLE_HTTP_ACCEPT, TACHO_METERING_ATTR, TACHO_METERING_OBSERVED, TACHO_MODEL_SESSION_HEADER, TACHO_CREDENTIAL_BASIS_ATTR, TACHO_CREDENTIAL_GATEWAY_BROKERED, TACHO_CREDENTIAL_HARNESS_HELD, TACHO_CREDENTIAL_BASES, TACHO_RUN_TOKEN_ATTR, BUNDLE_FEATURE_GATEWAY_TOOLS, BUNDLE_FEATURE_MODEL_PRICES, BUNDLE_FEATURE_MODEL_ALLOWLIST, BUNDLE_FEATURE_INDEPENDENT_MODELS, BUNDLE_FEATURE_HOOK_FAIL_OPEN, BUNDLE_FEATURE_STEERING_MANIFEST, BUNDLE_FEATURE_STEERING_INCOMPLETE, BUNDLE_FEATURE_CONTAINMENT, BUNDLE_FEATURE_DAILY_BUDGET, BUNDLE_FEATURE_STEER_NEXT_STEP, BUNDLE_FEATURE_UNBOUND_REPO, BUNDLE_FEATURE_CEDAR, BUNDLE_FEATURE_CEDAR_TOOLBELT, BUNDLE_FEATURE_SKILLS, BUNDLE_FEATURE_CACHE_KEEP_ALIVE, BUNDLE_FEATURE_WORK_ORDERS, BUNDLE_FEATURE_WORK_ORDER_START, BUNDLE_FEATURE_GATEWAY_POLICY, GATEWAY_MIN_TIERS, SENSITIVE_SCREEN_ACTIONS, PROMPT_REDACTION_PATTERNS_MAX, PROMPT_REDACTION_PATTERN_MAX, gatewayPolicySchema, TACHO_BUNDLE_FEATURES, bundleFeaturesSchema, hostEnrollmentIdSchema, tachoPlatformSchema, tachoHarnessSchema, TACHO_HARNESS_LABELS, TACHO_HARNESS_TIERS, WRAPPED_HARNESSES, CONNECTED_HARNESSES, HARNESS_BINARY, MODEL_HARNESS_ROUTES, MODEL_ROUTED_HARNESSES, BROKERABLE_HARNESSES, BROKERABLE_HARNESS_PROVIDER, TACHO_TIER_SUMMARY, CUSTOM_AGENT_NAME_PATTERN, RESERVED_AGENT_NAMES, tachoHostStatusSchema, tachoBundleModeSchema, tachoCommandSchema, tachoCommandStatusSchema, tachoCommandAckStatusSchema, tachoDeliveryModeSchema, denyGenerationSchema, deliveredCommandSchema, deliveredCommandResponseSchema, WORK_ORDER_ID_PATTERN, WORK_ITEM_ID_PATTERN, workOrderCommandPayloadSchema, WORK_ORDER_CLAIM_PATH, WORK_ORDER_REJECT_PATH, workOrderClaimResponseSchema, workOrderRejectResponseSchema, WORK_CRITERION_CLAIM_PATH, WORK_CRITERION_ID_PATTERN, WORK_HEAD_SHA_PATTERN, WORK_CRITERION_CLAIM_TEXT_MAX, workCriterionClaimResponseSchema, WORK_ORDER_ENV, WORK_ORDER_ATTR, steeringForceSchema, steeringItemKindSchema, steeringCutReasonSchema, steeringManifestItemSchema, STEERING_MANIFEST_SCHEMA, steeringManifestSchema, steeringManifestFrameSchema, cedarIdSchema, cedarPrincipalSchema, cedarToolSchema, cedarBundleSchema, BUNDLE_SKILLS_MAX, BUNDLE_SKILL_FILES_MAX, BUNDLE_SKILLS_CHARS_MAX, BASE64_PATTERN, bundleSkillFileSchema, bundleSkillSchema, policyBundleSchema, enrollmentClaimsSchema, tachoEventWireSchema, daemonHealthSchema, TACHO_MAX_BATCH, TACHO_MAX_BODY_BYTES, TACHO_MAX_REQUEST_BYTES, TACHO_REQUEST_ENVELOPE_BYTES, tachoBodySchema, tachoBatchSchema, agentDaySpendSchema, controlEnvelopeSchema, ingestResponseSchema, bundleResponseSchema, commandAcknowledgementSchema, commandsResponseSchema, enrollmentResponseSchema, tokenEnrollmentResponseSchema;
+var protocolTimestampSchema, machineGroupSchema, TACHO_BATCH_SCHEMA, TACHO_BUNDLE_SCHEMA, TACHO_COMMANDS_SCHEMA, TACHO_ENROLLMENT_CLAIMS_SCHEMA, TACHO_ENFORCEMENT_TIER_ATTR, TACHO_GATEWAY_TIER, TACHO_GATEWAY_SESSION_HEADER, TACHO_GATEWAY_GENESIS_HEADER, REFUSAL_META_KEY, MCP_STREAMABLE_HTTP_ACCEPT, TACHO_METERING_ATTR, TACHO_METERING_OBSERVED, TACHO_MODEL_SESSION_HEADER, TACHO_CREDENTIAL_BASIS_ATTR, TACHO_CREDENTIAL_GATEWAY_BROKERED, TACHO_CREDENTIAL_HARNESS_HELD, TACHO_CREDENTIAL_BASES, TACHO_RUN_TOKEN_ATTR, BUNDLE_FEATURE_GATEWAY_TOOLS, BUNDLE_FEATURE_MODEL_PRICES, BUNDLE_FEATURE_MODEL_ALLOWLIST, BUNDLE_FEATURE_INDEPENDENT_MODELS, BUNDLE_FEATURE_HOOK_FAIL_OPEN, BUNDLE_FEATURE_STEERING_MANIFEST, BUNDLE_FEATURE_STEERING_INCOMPLETE, BUNDLE_FEATURE_CONTAINMENT, BUNDLE_FEATURE_DAILY_BUDGET, BUNDLE_FEATURE_STEER_NEXT_STEP, BUNDLE_FEATURE_UNBOUND_REPO, BUNDLE_FEATURE_CEDAR, BUNDLE_FEATURE_CEDAR_TOOLBELT, BUNDLE_FEATURE_SKILLS, BUNDLE_FEATURE_CACHE_KEEP_ALIVE, BUNDLE_FEATURE_WORK_ORDERS, BUNDLE_FEATURE_WORK_ORDER_START, BUNDLE_FEATURE_MCP_RULE_SETS, BUNDLE_FEATURE_GATEWAY_POLICY, GATEWAY_MIN_TIERS, SENSITIVE_SCREEN_ACTIONS, PROMPT_REDACTION_PATTERNS_MAX, PROMPT_REDACTION_PATTERN_MAX, gatewayPolicySchema, TACHO_BUNDLE_FEATURES, bundleFeaturesSchema, hostEnrollmentIdSchema, tachoPlatformSchema, tachoHarnessSchema, TACHO_HARNESS_LABELS, TACHO_HARNESS_TIERS, WRAPPED_HARNESSES, CONNECTED_HARNESSES, HARNESS_BINARY, MODEL_HARNESS_ROUTES, MODEL_ROUTED_HARNESSES, BROKERABLE_HARNESSES, BROKERABLE_HARNESS_PROVIDER, TACHO_TIER_SUMMARY, CUSTOM_AGENT_NAME_PATTERN, RESERVED_AGENT_NAMES, tachoHostStatusSchema, tachoBundleModeSchema, tachoCommandSchema, tachoCommandStatusSchema, tachoCommandAckStatusSchema, tachoDeliveryModeSchema, denyGenerationSchema, deliveredCommandSchema, deliveredCommandResponseSchema, WORK_ORDER_ID_PATTERN, WORK_ITEM_ID_PATTERN, workOrderCommandPayloadSchema, WORK_ORDER_CLAIM_PATH, WORK_ORDER_REJECT_PATH, workOrderClaimResponseSchema, workOrderRejectResponseSchema, WORK_CRITERION_CLAIM_PATH, WORK_CRITERION_ID_PATTERN, WORK_HEAD_SHA_PATTERN, WORK_CRITERION_CLAIM_TEXT_MAX, workCriterionClaimResponseSchema, WORK_ORDER_ENV, WORK_ORDER_ATTR, steeringForceSchema, steeringItemKindSchema, steeringCutReasonSchema, steeringManifestItemSchema, STEERING_MANIFEST_SCHEMA, steeringManifestSchema, steeringManifestFrameSchema, cedarIdSchema, cedarPrincipalSchema, cedarToolSchema, cedarBundleSchema, BUNDLE_SKILLS_MAX, BUNDLE_SKILL_FILES_MAX, BUNDLE_SKILLS_CHARS_MAX, BASE64_PATTERN, bundleSkillFileSchema, bundleSkillSchema, policyBundleSchema, enrollmentClaimsSchema, tachoEventWireSchema, daemonHealthSchema, TACHO_MAX_BATCH, TACHO_MAX_BODY_BYTES, TACHO_MAX_REQUEST_BYTES, TACHO_REQUEST_ENVELOPE_BYTES, tachoBodySchema, tachoBatchSchema, agentDaySpendSchema, controlEnvelopeSchema, ingestResponseSchema, bundleResponseSchema, commandAcknowledgementSchema, commandsResponseSchema, enrollmentResponseSchema, tokenEnrollmentResponseSchema;
 var init_wire = __esm({
   "../../packages/tacho/src/wire.ts"() {
     "use strict";
@@ -5709,6 +5709,7 @@ var init_wire = __esm({
     BUNDLE_FEATURE_CACHE_KEEP_ALIVE = "cache_keep_alive";
     BUNDLE_FEATURE_WORK_ORDERS = "work_orders";
     BUNDLE_FEATURE_WORK_ORDER_START = "work_order_start";
+    BUNDLE_FEATURE_MCP_RULE_SETS = "mcp_rule_sets";
     BUNDLE_FEATURE_GATEWAY_POLICY = "gateway_policy";
     GATEWAY_MIN_TIERS = ["harness", "gateway", "contained"];
     SENSITIVE_SCREEN_ACTIONS = ["flag", "strip", "reject"];
@@ -5755,6 +5756,7 @@ var init_wire = __esm({
       BUNDLE_FEATURE_WORK_ORDERS,
       BUNDLE_FEATURE_WORK_ORDER_START,
       BUNDLE_FEATURE_STEERING_INCOMPLETE,
+      BUNDLE_FEATURE_MCP_RULE_SETS,
       BUNDLE_FEATURE_GATEWAY_POLICY
     ];
     bundleFeaturesSchema = external_exports.array(external_exports.string().max(64)).max(32);
@@ -6072,6 +6074,25 @@ var init_wire = __esm({
         deny: external_exports.array(external_exports.string().max(512)).max(1024),
         ask: external_exports.array(external_exports.string().max(512)).max(1024)
       }).strict(),
+      /**
+       * The agent's MCP tool rules as the app holds them (#5398): one list per
+       * rule set, each rule in its set's order. The host takes the first rule
+       * that matches in each set and the most restrictive answer across the
+       * sets (deny, then ask, then allow), and a set with no matching rule says
+       * nothing. These rules are not also in `permissions`, whose fixed
+       * deny-before-allow order would undo theirs.
+       *
+       * Emitted only to a host that advertised `BUNDLE_FEATURE_MCP_RULE_SETS`.
+       * When it is absent, the same rules are sorted into `permissions`.
+       */
+      mcp_rule_sets: external_exports.array(
+        external_exports.array(
+          external_exports.object({
+            rule: external_exports.string().max(512),
+            effect: external_exports.enum(["allow", "deny", "ask"])
+          }).strict()
+        ).max(1024)
+      ).max(256).optional(),
       tools: external_exports.record(
         external_exports.string().max(256),
         external_exports.object({
@@ -8121,12 +8142,12 @@ function cacheKeepAliveFinding(bundle2) {
 }
 function parseRule(raw) {
   const rule = raw.trim();
-  const open6 = rule.indexOf("(");
-  if (open6 === -1 || !rule.endsWith(")")) return { raw, tool: rule };
+  const open7 = rule.indexOf("(");
+  if (open7 === -1 || !rule.endsWith(")")) return { raw, tool: rule };
   return {
     raw,
-    tool: rule.slice(0, open6).trim(),
-    spec: rule.slice(open6 + 1, -1)
+    tool: rule.slice(0, open7).trim(),
+    spec: rule.slice(open7 + 1, -1)
   };
 }
 function escapeRegex(value) {
@@ -8427,6 +8448,29 @@ function firstMatch(rules, call2, context, effect) {
   }
   return void 0;
 }
+function parsedSet(set) {
+  const cached3 = parsedSetCache.get(set);
+  if (cached3 !== void 0 && cached3.length === set.length && cached3.every((rule, index) => rule.raw === set[index]?.rule))
+    return cached3;
+  const parsed2 = set.map((entry2) => parseRule(entry2.rule));
+  parsedSetCache.set(set, parsed2);
+  return parsed2;
+}
+function ruleSetsMatch(sets, call2, context) {
+  if (sets === void 0) return void 0;
+  let result2;
+  for (const set of sets) {
+    const parsed2 = parsedSet(set);
+    for (const [index, rule] of parsed2.entries()) {
+      const effect = set[index].effect;
+      if (!callMatches(rule, call2, context ?? {}, effect)) continue;
+      if (result2 === void 0 || EFFECT_RANK[effect] > EFFECT_RANK[result2.effect])
+        result2 = { effect, rule: rule.raw };
+      break;
+    }
+  }
+  return result2;
+}
 function allowMatch(rules, call2, context) {
   const single = firstMatch(rules, call2, context, "allow");
   if (single !== void 0) return [single];
@@ -8559,12 +8603,8 @@ function evaluatePreToolUse(input) {
     };
   }
   const call2 = toolCallOf(toolName3, toolInput);
-  const denied = firstMatch(
-    bundle2.permissions.deny,
-    call2,
-    input.context,
-    "deny"
-  );
+  const ordered = ruleSetsMatch(bundle2.mcp_rule_sets, call2, input.context);
+  const denied = firstMatch(bundle2.permissions.deny, call2, input.context, "deny") ?? (ordered?.effect === "deny" ? ordered.rule : void 0);
   if (denied !== void 0) {
     return {
       decision: bundle2.mode === "observe" ? "allow" : "deny",
@@ -8588,7 +8628,7 @@ function evaluatePreToolUse(input) {
       stale
     };
   }
-  const ask = firstMatch(bundle2.permissions.ask, call2, input.context, "ask");
+  const ask = firstMatch(bundle2.permissions.ask, call2, input.context, "ask") ?? (ordered?.effect === "ask" ? ordered.rule : void 0);
   if (ask !== void 0) {
     return {
       decision: bundle2.mode === "observe" ? "allow" : "ask",
@@ -8603,7 +8643,7 @@ function evaluatePreToolUse(input) {
       stale
     };
   }
-  const allowed = allowMatch(bundle2.permissions.allow, call2, input.context);
+  const allowed = allowMatch(bundle2.permissions.allow, call2, input.context) ?? (ordered?.effect === "allow" ? [ordered.rule] : void 0);
   if (allowed !== void 0) {
     const rule = allowed.join(" and ");
     return {
@@ -8753,7 +8793,7 @@ function decideWithCedar(input) {
       };
   }
 }
-var SHELL_OPERATORS, SHELL_LEADING_WORDS, WINDOWS_PATH, SHELL_TOOLS2, DECLARATION_SYNONYMS, GLOB_CACHE_LIMIT, globCache, parsedRuleCache, WRITE_EFFECTS;
+var SHELL_OPERATORS, SHELL_LEADING_WORDS, WINDOWS_PATH, SHELL_TOOLS2, DECLARATION_SYNONYMS, GLOB_CACHE_LIMIT, globCache, parsedRuleCache, EFFECT_RANK, parsedSetCache, WRITE_EFFECTS;
 var init_bundle = __esm({
   "../../packages/tacho/src/host/bundle.ts"() {
     "use strict";
@@ -8795,6 +8835,8 @@ var init_bundle = __esm({
     GLOB_CACHE_LIMIT = 1024;
     globCache = /* @__PURE__ */ new Map();
     parsedRuleCache = /* @__PURE__ */ new WeakMap();
+    EFFECT_RANK = { allow: 0, ask: 1, deny: 2 };
+    parsedSetCache = /* @__PURE__ */ new WeakMap();
     WRITE_EFFECTS = /* @__PURE__ */ new Set([
       "file_write",
       "file_edit",
@@ -8853,6 +8895,13 @@ function withRecordedHarnessFiles(paths, host) {
     claudeDesktopConfig: record.claude_desktop_config !== void 0 ? record.claude_desktop_config ?? void 0 : paths.claudeDesktopConfig
   };
 }
+function recordedHarnessHomes(host) {
+  const record = host?.harness_files;
+  return {
+    ...record?.claude_settings !== void 0 ? { claudeConfigDir: dirname2(record.claude_settings) } : {},
+    ...record?.codex_hooks !== void 0 ? { codexHome: dirname2(record.codex_hooks) } : {}
+  };
+}
 function mcpEndpointOverrideRequestFrom(env) {
   const raw = env["TACHO_MCP_ENDPOINT"];
   if (typeof raw !== "string" || raw.length === 0)
@@ -10917,12 +10966,12 @@ function procStartTicks(stat7) {
   return ticks !== void 0 && /^\d+$/.test(ticks) ? ticks : void 0;
 }
 function procParent(stat7) {
-  const open6 = stat7.indexOf("(");
+  const open7 = stat7.indexOf("(");
   const close = stat7.lastIndexOf(")");
-  if (open6 < 0 || close < open6) return void 0;
+  if (open7 < 0 || close < open7) return void 0;
   const ppid = stat7.slice(close + 1).trim().split(/\s+/)[1];
   if (ppid === void 0 || !/^\d+$/.test(ppid)) return void 0;
-  return { ppid: Number(ppid), comm: stat7.slice(open6 + 1, close) };
+  return { ppid: Number(ppid), comm: stat7.slice(open7 + 1, close) };
 }
 function readProcParent(pid, read2 = readText) {
   const stat7 = read2(`/proc/${pid}/stat`);
@@ -23229,7 +23278,7 @@ function openCredentialStore(paths) {
     entriesSeen = { version: version2, entries: parsed2.data.entries };
     return parsed2.data.entries;
   }
-  function writeAll2(entries2) {
+  function writeAll3(entries2) {
     if (entries2.length === 0) {
       if (existsSync5(paths.file)) unlinkSync4(paths.file);
       return;
@@ -23273,7 +23322,7 @@ function openCredentialStore(paths) {
         prefix: kind === "chatgpt" ? "login" : credentialPrefix(secret),
         sealed: seal(keyForWrite(), secret, sealingContext(provider, owner))
       };
-      writeAll2([
+      writeAll3([
         ...readAll().filter((e) => !matches(e, provider, owner)),
         entry2
       ]);
@@ -23289,7 +23338,7 @@ function openCredentialStore(paths) {
         entry2.sealed,
         sealingContext(provider, owner)
       );
-      writeAll2(entries2.filter((e) => !matches(e, provider, owner)));
+      writeAll3(entries2.filter((e) => !matches(e, provider, owner)));
       return { kind: entry2.kind, secret };
     },
     status: () => readAll().map(custodyOf),
@@ -26623,7 +26672,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.5-63";
+  if (true) return "2.1.5-69";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -28194,13 +28243,15 @@ function* readLinesFrom(path2, from = 0, chunkBytes = SCAN_CHUNK_BYTES) {
     closeSync5(fd2);
   }
 }
-async function* readLinesFromAsync(path2, from = 0) {
+async function* readLinesFromAsync(path2, from = 0, to = Number.POSITIVE_INFINITY) {
   const handle = await open2(path2, "r");
   try {
     const splitter = new LineSplitter(from);
     let position = from;
-    for (; ; ) {
-      const chunk2 = Buffer.allocUnsafe(SCAN_CHUNK_BYTES);
+    while (position < to) {
+      const chunk2 = Buffer.allocUnsafe(
+        Math.min(SCAN_CHUNK_BYTES, to - position)
+      );
       const { bytesRead } = await handle.read(chunk2, 0, chunk2.length, position);
       if (bytesRead <= 0) break;
       position += bytesRead;
@@ -28542,6 +28593,7 @@ import {
   writeSync as writeSync4
 } from "node:fs";
 import { randomUUID } from "node:crypto";
+import { open as open3 } from "node:fs/promises";
 import { join as join18 } from "node:path";
 function activityAt(event) {
   const at2 = Date.parse(event.ts);
@@ -28576,7 +28628,66 @@ function isResumeMark(value) {
 function sizeOf(path2) {
   return statSync6(path2, { throwIfNoEntry: false })?.size ?? 0;
 }
-var BODY_READ_SLICE, BODY_DROP_SLICE_BYTES, BODY_DROP_SCANS, NEWLINE, EVENT_TAIL_WINDOW, WalRecoveryConflict, Wal;
+function statIfExists2(path2) {
+  return statSync6(path2, { throwIfNoEntry: false });
+}
+async function writeAll2(out, bytes) {
+  let written2 = 0;
+  while (written2 < bytes.length) {
+    const { bytesWritten } = await out.write(
+      bytes,
+      written2,
+      bytes.length - written2
+    );
+    written2 += bytesWritten;
+  }
+}
+async function copyRange(path2, out, from, to, signal) {
+  if (to <= from) return;
+  const source = await open3(path2, "r");
+  try {
+    const buffer = Buffer.allocUnsafe(
+      Math.min(BODY_PURGE_SLICE_BYTES, to - from)
+    );
+    for (let at2 = from; at2 < to; ) {
+      signal?.throwIfAborted();
+      const { bytesRead } = await source.read(
+        buffer,
+        0,
+        Math.min(buffer.length, to - at2),
+        at2
+      );
+      if (bytesRead <= 0) return;
+      await writeAll2(out, buffer.subarray(0, bytesRead));
+      at2 += bytesRead;
+    }
+  } finally {
+    await source.close();
+  }
+}
+function readRangeSync(path2, from, to) {
+  const buffer = Buffer.alloc(Math.max(0, to - from));
+  if (buffer.length === 0) return buffer;
+  const fd2 = openSync6(path2, "r");
+  try {
+    let filled = 0;
+    while (filled < buffer.length) {
+      const read2 = readSync3(
+        fd2,
+        buffer,
+        filled,
+        buffer.length - filled,
+        from + filled
+      );
+      if (read2 <= 0) break;
+      filled += read2;
+    }
+    return buffer.subarray(0, filled);
+  } finally {
+    closeSync6(fd2);
+  }
+}
+var BODY_READ_SLICE, BODY_DROP_SLICE_BYTES, BODY_DROP_SCANS, BODY_PURGE_SLICE_BYTES, BODY_PURGE_SCANS, BODY_PURGE_CATCH_UPS, NEWLINE, EVENT_TAIL_WINDOW, WalRecoveryConflict, Wal;
 var init_wal = __esm({
   "../../packages/tacho/src/host/wal.ts"() {
     "use strict";
@@ -28586,6 +28697,9 @@ var init_wal = __esm({
     BODY_READ_SLICE = 32;
     BODY_DROP_SLICE_BYTES = 1024 * 1024;
     BODY_DROP_SCANS = 3;
+    BODY_PURGE_SLICE_BYTES = 1024 * 1024;
+    BODY_PURGE_SCANS = 3;
+    BODY_PURGE_CATCH_UPS = 3;
     NEWLINE = 10;
     EVENT_TAIL_WINDOW = 16 * 1024;
     WalRecoveryConflict = class extends Error {
@@ -28685,6 +28799,18 @@ var init_wal = __esm({
        * WAL has ever opened. See `flush` for why this exists.
        */
       dirtyPaths = /* @__PURE__ */ new Set();
+      /**
+       * The awaited body sweeps running now, one entry per session scan
+       * (`purgeBodiesOutsideMandateAsync`). Every write to a body file other than
+       * an append marks the entries for its session, so a scan whose bytes moved
+       * under it does not rename its copy over the file.
+       */
+      bodyWatches = /* @__PURE__ */ new Set();
+      /**
+       * The temporary files those sweeps are writing. `compact` removes a
+       * temporary file a crashed rewrite left, and must not remove one of these.
+       */
+      liveTemps = /* @__PURE__ */ new Set();
       fileFor(sessionUuid2) {
         return join18(this.dir, `${sessionUuid2}.ndjson`);
       }
@@ -29407,6 +29533,7 @@ ${lines.join("\n")}
           if (next > 0) await new Promise((resolve26) => setImmediate(resolve26));
           const slice = this.blankSlice(path2, found, next, idems);
           if (slice === void 0) break;
+          if (slice.blanked > 0) this.bodyRewritten(session);
           blanked += slice.blanked;
           moved ||= slice.moved;
           next = slice.next;
@@ -29663,6 +29790,7 @@ ${lines.join("\n")}
           this.dirtyPaths.add(path2);
         }
         this.bodyIndexes.invalidate(sessionUuid2);
+        this.bodyRewritten(sessionUuid2);
         return cut;
       }
       /**
@@ -29989,27 +30117,241 @@ ${lines.join("\n")}
        * that withholds a body from a shipment. See `purgeBodiesNarrowedOut` in
        * the daemon, which calls this when a replacement bundle verifies and
        * narrows the clause.
+       *
+       * This reads every event file and every body file on the synchronous path,
+       * which ADR-231 rules out on the daemon's thread. The daemon calls
+       * `purgeBodiesOutsideMandateAsync`. It calls this only when it cannot record
+       * the purge it owes, the one case where the erase has to finish before the
+       * narrowed bundle is cached.
        */
       purgeBodiesOutsideMandate(retention) {
         let purged = 0;
-        const sessions = /* @__PURE__ */ new Set([
-          ...this.sessions(),
-          ...this.sessionsWithBodies()
-        ]);
-        for (const session of sessions) {
+        for (const session of this.sessionsToPurge())
+          purged += this.purgeSessionSync(session, retention);
+        return purged;
+      }
+      /**
+       * The same sweep, without holding the daemon's thread (#5176, ADR-231).
+       * Every read is awaited, and a turn of the event loop separates two
+       * sessions, so a hook or a proxied model call waits for one read and not
+       * for the sweep.
+       *
+       * Each session is rewritten the way `rewriteBodies` rewrites it: the lines
+       * kept go to a temporary file, and a rename puts it over the body file. A
+       * crash part way leaves the old file whole, and the caller's record of the
+       * purge it owes runs the sweep again. Hooks append to the file while the
+       * scan awaits its reads, and three rules keep those appends:
+       *
+       * - The scan measures the body file and the event file in one synchronous
+       *   stretch, and reads each only up to that size. `append` writes a body
+       *   and then its event in one synchronous stretch too, so every body the
+       *   scan reads has its event in the part of the event file the scan reads,
+       *   or is a crash orphan. A body appended later is never judged an orphan.
+       * - Bytes appended after that moment go to the new file as they are. They
+       *   were recorded under the mandate in force when they were appended, and
+       *   the daemon caches the narrowed mandate before it starts this sweep.
+       * - The rename happens in one synchronous stretch, after a last check. When
+       *   the file was replaced, cut short, or written other than by an append
+       *   while the scan read it (`dropBodiesAsync` blanks lines in place), the
+       *   copy is thrown away and the session is scanned again. After
+       *   `BODY_PURGE_SCANS` scans the session goes through the synchronous sweep.
+       *
+       * The copy is synced to disk with an awaited call before that stretch, so
+       * the stretch copies and syncs only what was appended since, about
+       * `BODY_PURGE_SLICE_BYTES` at most.
+       */
+      async purgeBodiesOutsideMandateAsync(retention, options = {}) {
+        const { signal } = options;
+        let purged = 0;
+        for (const session of this.sessionsToPurge()) {
+          await new Promise((resolve26) => setImmediate(resolve26));
+          signal?.throwIfAborted();
+          await options.beforeSession?.(session);
+          signal?.throwIfAborted();
           if (!existsSync12(this.bodyFileFor(session))) continue;
-          const kindOf2 = new Map(
-            this.read(session).map(
-              (event) => [event.event_id_idem, event.kind]
-            )
-          );
-          purged += this.rewriteBodies(
-            session,
-            (stored) => this.keeps(stored, kindOf2, retention)
-          );
+          let swept = "moved";
+          for (let scan = 0; scan < BODY_PURGE_SCANS && swept === "moved"; scan++)
+            swept = await this.purgeSessionAsync(session, retention, signal);
+          purged += swept === "moved" ? this.purgeSessionSync(session, retention) : swept;
         }
         return purged;
       }
+      /**
+       * Every session that has an event file OR a body file. `sessions()` lists
+       * `.ndjson` only, so a crash between `append`'s body write and its first
+       * event write leaves a `<uuid>.bodies.jsonl` with no `.ndjson` beside it,
+       * invisible to a sweep that walked `sessions()` and to `compact`, which
+       * does. Those bytes would outlive every mechanism meant to remove them.
+       */
+      sessionsToPurge() {
+        return /* @__PURE__ */ new Set([...this.sessions(), ...this.sessionsWithBodies()]);
+      }
+      /** One session of `purgeBodiesOutsideMandate`, read and rewritten at once. */
+      purgeSessionSync(session, retention) {
+        if (!existsSync12(this.bodyFileFor(session))) return 0;
+        const kindOf2 = new Map(
+          this.read(session).map(
+            (event) => [event.event_id_idem, event.kind]
+          )
+        );
+        return this.rewriteBodies(
+          session,
+          (stored) => this.keeps(stored, kindOf2, retention)
+        );
+      }
+      /**
+       * One scan of `purgeBodiesOutsideMandateAsync` over one session. Answers
+       * how many lines went, or `moved` when the file changed under the scan
+       * other than by an append, in which case nothing was renamed.
+       */
+      async purgeSessionAsync(session, retention, signal) {
+        const path2 = this.bodyFileFor(session);
+        const start = statIfExists2(path2);
+        if (start === void 0) return 0;
+        const eventEnd = statIfExists2(this.fileFor(session))?.size ?? 0;
+        const watch2 = { session, moved: false };
+        this.bodyWatches.add(watch2);
+        const tmp = `${path2}.${randomUUID()}.tmp`;
+        let out;
+        try {
+          const kindOf2 = await this.eventKindsUpTo(session, eventEnd, signal);
+          let cut = 0;
+          let kept = 0;
+          let held = [];
+          let heldBytes = 0;
+          const writeHeld = async (to) => {
+            if (heldBytes === 0) return;
+            await writeAll2(to, Buffer.concat(held, heldBytes));
+            held = [];
+            heldBytes = 0;
+          };
+          for await (const line of readLinesFromAsync(path2, 0, start.size)) {
+            signal?.throwIfAborted();
+            if (line.text.trim().length === 0) continue;
+            if (this.keeps(parseStoredBody(line.text), kindOf2, retention)) {
+              kept += 1;
+              if (out === void 0) continue;
+              const bytes = Buffer.from(`${line.text}
+`);
+              held.push(bytes);
+              heldBytes += bytes.length;
+              if (heldBytes >= BODY_PURGE_SLICE_BYTES) await writeHeld(out);
+              continue;
+            }
+            cut += 1;
+            if (out === void 0) {
+              this.liveTemps.add(tmp);
+              out = await open3(tmp, "wx", 384);
+              await copyRange(path2, out, 0, line.offset, signal);
+            }
+          }
+          if (out === void 0) return watch2.moved ? "moved" : 0;
+          await writeHeld(out);
+          let copied = start.size;
+          for (let round = 0; round < BODY_PURGE_CATCH_UPS; round += 1) {
+            const size = statIfExists2(path2)?.size;
+            if (size === void 0 || size - copied <= BODY_PURGE_SLICE_BYTES)
+              break;
+            await copyRange(path2, out, copied, size, signal);
+            copied = size;
+          }
+          await out.sync();
+          await out.close();
+          out = void 0;
+          signal?.throwIfAborted();
+          if (watch2.moved) return "moved";
+          return this.commitPurge(session, tmp, {
+            start,
+            copied,
+            keptAny: kept > 0 || copied > start.size,
+            cut
+          });
+        } catch (error) {
+          if (error.code === "ENOENT" && !existsSync12(path2))
+            return 0;
+          throw error;
+        } finally {
+          this.bodyWatches.delete(watch2);
+          if (out !== void 0) await out.close().catch(() => void 0);
+          if (existsSync12(tmp)) unlinkSync9(tmp);
+          this.liveTemps.delete(tmp);
+        }
+      }
+      /**
+       * The kind of every event in the first `end` bytes of a session's event
+       * file, by event id, read with awaited reads. A line that does not parse is
+       * reported and skipped, as `read` does. A line cut off at `end` was torn by
+       * a crash, since `append` ends every write with a newline, and is skipped.
+       */
+      async eventKindsUpTo(session, end, signal) {
+        const kindOf2 = /* @__PURE__ */ new Map();
+        if (end === 0) return kindOf2;
+        for await (const line of readLinesFromAsync(
+          this.fileFor(session),
+          0,
+          end
+        )) {
+          signal?.throwIfAborted();
+          if (!line.terminated || line.text.trim().length === 0) continue;
+          try {
+            const event = parseEventLine(line.text);
+            kindOf2.set(event.event_id_idem, event.kind);
+          } catch (error) {
+            this.reportEventParseFailure({
+              session_uuid: session,
+              reason: error instanceof Error ? error.message : String(error)
+            });
+          }
+        }
+        return kindOf2;
+      }
+      /**
+       * The rename of `purgeSessionAsync`, in one synchronous stretch, so nothing
+       * else can write the body file between the check and the rename. Copies
+       * what was appended since `copied`, syncs it, and puts the copy over the
+       * file, or removes the file when nothing in it is left.
+       */
+      commitPurge(session, tmp, scan) {
+        const path2 = this.bodyFileFor(session);
+        const now = statIfExists2(path2);
+        if (now === void 0) return 0;
+        if (now.ino !== scan.start.ino || now.dev !== scan.start.dev || now.size < scan.copied)
+          return "moved";
+        const tail = readRangeSync(path2, scan.copied, now.size);
+        if (!scan.keptAny && tail.toString("utf8").trim().length === 0) {
+          unlinkSync9(path2);
+        } else {
+          const fd2 = openSync6(tmp, "r+");
+          try {
+            let written2 = 0;
+            const at2 = fstatSync(fd2).size;
+            while (written2 < tail.length)
+              written2 += writeSync4(
+                fd2,
+                tail,
+                written2,
+                tail.length - written2,
+                at2 + written2
+              );
+            fdatasyncSync(fd2);
+          } finally {
+            closeSync6(fd2);
+          }
+          renameSync3(tmp, path2);
+        }
+        this.bodyIndexes.invalidate(session);
+        this.bodyRewritten(session);
+        return scan.cut;
+      }
+      /**
+       * Tell every awaited sweep of this session that its body file changed
+       * other than by an append. Each write that cuts, blanks, or replaces body
+       * bytes calls this in the same synchronous stretch as the write.
+       */
+      bodyRewritten(session) {
+        for (const watch2 of this.bodyWatches)
+          if (watch2.session === session) watch2.moved = true;
+      }
       /**
        * Whether one stored body survives this mandate. Three answers, each for a
        * reason:
@@ -30027,7 +30369,9 @@ ${lines.join("\n")}
        *   the two writes and no event will ever arrive for it. Keeping it kept
        *   prompt or tool bytes that no mandate covers and that nothing would
        *   ever ship, delete or compact, because every one of those paths starts
-       *   from the event.
+       *   from the event. The awaited sweep does let appends land while it reads,
+       *   so it judges only the bodies written before it measured the files, and
+       *   their events are all in the part of the event file it reads.
        * - Otherwise the class comes from the event's kind and the one retention
        *   gate answers. A kind the table does not name has no class, so no mandate
        *   can cover it and the body goes.
@@ -30089,6 +30433,7 @@ ${lines.join("\n")}
           if (kept === 0) unlinkSync9(path2);
           else renameSync3(tmp, path2);
           this.bodyIndexes.invalidate(sessionUuid2);
+          this.bodyRewritten(sessionUuid2);
           return cut;
         } finally {
           if (existsSync12(tmp)) unlinkSync9(tmp);
@@ -30116,6 +30461,7 @@ ${lines.join("\n")}
           `^${uuid}\\.bodies\\.jsonl\\.${uuid}\\.tmp$`
         );
         for (const name of readdirSync7(this.dir)) {
+          if (this.liveTemps.has(join18(this.dir, name))) continue;
           if (abandonedRewrite.test(name)) {
             try {
               unlinkSync9(join18(this.dir, name));
@@ -30199,6 +30545,7 @@ ${lines.join("\n")}
           const path2 = this.bodyFileFor(session);
           if (existsSync12(path2)) unlinkSync9(path2);
           this.bodyIndexes.invalidate(session);
+          this.bodyRewritten(session);
           return true;
         } catch (error) {
           this.bodyFailure(session, "cleanup", error);
@@ -30551,8 +30898,12 @@ function daemonServiceSpec(daemonCommand, deps) {
     command: daemonCommand,
     env: {
       ...deps.env["TACHO_HOME"] !== void 0 ? { TACHO_HOME: deps.env["TACHO_HOME"] } : {},
-      // The harness homes the enrolling shell moved, so tachod reads the
-      // same files the hooks were written to.
+      // The harness homes this shell moved. Each collector reads its agent's
+      // harness files where that agent's host.json recorded them at enroll
+      // (`harness_files`), so these decide nothing for an agent with a
+      // record. They stay for an agent enrolled before the record existed.
+      // One service serves every agent, so they come from whichever shell
+      // installed it last (#5409).
       ...Object.fromEntries(
         HARNESS_HOME_VARS.flatMap((key) => {
           const value = deps.env[key];
@@ -43081,7 +43432,11 @@ async function renewStaticToken(harness, deps) {
   const label2 = TACHO_HARNESS_LABELS[harness];
   if (deps.host.host_status !== "active" || !deps.inCustody(provider, harness))
     return "skipped";
-  const dirs = deps.stellaHome !== void 0 ? { stellaHome: deps.stellaHome } : {};
+  const dirs = {
+    ...deps.stellaHome !== void 0 ? { stellaHome: deps.stellaHome } : {},
+    ...deps.codexHome !== void 0 ? { codexHome: deps.codexHome } : {},
+    ...deps.claudeConfigDir !== void 0 ? { claudeConfigDir: deps.claudeConfigDir } : {}
+  };
   let brokered = false;
   try {
     brokered = (await readModelCredentialState({
@@ -44021,8 +44376,33 @@ var init_git_facts = __esm({
 
 // ../../packages/tacho/src/collector/work-order-autostart.ts
 import { spawn as spawn7 } from "node:child_process";
-import { closeSync as closeSync7, existsSync as existsSync21, openSync as openSync7 } from "node:fs";
+import { closeSync as closeSync7, existsSync as existsSync21, openSync as openSync7, readSync as readSync4, statSync as statSync12 } from "node:fs";
 import { dirname as dirname20, join as join36 } from "node:path";
+function lastLogLine(path2) {
+  let fd2;
+  try {
+    const size = statSync12(path2).size;
+    const length = Math.min(size, 4096);
+    const buffer = Buffer.alloc(length);
+    fd2 = openSync7(path2, "r");
+    readSync4(fd2, buffer, 0, length, size - length);
+    const line = buffer.toString("utf8").replace(TERMINAL_CODE, "").split(/\r?\n/).map((text5) => text5.trim()).filter((text5) => text5.length > 0).pop();
+    if (line === void 0) return void 0;
+    return line.length > EXIT_REPORT_QUOTE ? `${line.slice(0, EXIT_REPORT_QUOTE - 1)}\u2026` : line;
+  } catch {
+    return void 0;
+  } finally {
+    if (fd2 !== void 0) {
+      try {
+        closeSync7(fd2);
+      } catch {
+      }
+    }
+  }
+}
+function exitPhrase(exit) {
+  return exit.signal !== null ? `ended on ${exit.signal}` : `exited with code ${String(exit.code)}`;
+}
 function asError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
@@ -44037,6 +44417,10 @@ function isPlainBranchName(name) {
 function createWorkOrderAutostart(deps) {
   const { paths, log } = deps;
   const isAlive = deps.isAlive ?? processIsAlive;
+  const wait = deps.wait ?? ((ms) => new Promise((done) => {
+    setTimeout(done, ms).unref();
+  }));
+  const sessions = /* @__PURE__ */ new Set();
   const spawnHarness = deps.spawn ?? spawnDetached;
   let searchPath;
   const pathForHarness = () => {
@@ -44222,7 +44606,7 @@ function createWorkOrderAutostart(deps) {
         `work order ${id2}: could not clear its running mark: ${asError(error).message}`
       );
     }
-    const ended = exit === void 0 ? "ended while the daemon was stopped" : "never" in exit ? `never started (${exit.never})` : exit.signal !== null ? `ended on ${exit.signal}` : `exited with code ${String(exit.code)}`;
+    const ended = exit === void 0 ? "ended while the daemon was stopped" : "never" in exit ? `never started (${exit.never})` : exitPhrase(exit);
     const { worktree, root, branch, base_sha: base2 } = mark;
     if (worktree === void 0 || !existsSync21(worktree)) {
       log(`work order ${id2}: the harness ${ended}`);
@@ -44276,13 +44660,28 @@ function createWorkOrderAutostart(deps) {
       `work order ${id2}: the harness ${ended} and left nothing that is not on a remote, so its worktree is removed${mark.log !== void 0 ? `. Its output is in ${mark.log}` : ""}.`
     );
   }
-  function watch2(id2, workspace, exited) {
+  async function reportExit(id2, binary, exit, logPath) {
+    if (sessions.has(id2)) return;
+    await wait(EXIT_REPORT_GRACE_MS);
+    if (sessions.has(id2)) return;
+    const said = lastLogLine(logPath);
+    const reason3 = `${binary} ${exitPhrase(exit)} before it opened a run.${said !== void 0 ? ` Its last output: ${said}` : ""} The full output is in ${logPath} on this machine.`;
+    const failed3 = await refuseWorkOrder(deps.client, id2, reason3.slice(0, 512));
+    log(
+      failed3 === void 0 ? `work order ${id2}: ${reason3} Oxagen ended the send.` : `work order ${id2}: ${reason3} Oxagen kept the send (${failed3}).`
+    );
+  }
+  function watch2(id2, binary, workspace, exited) {
     void exited.then((exit) => {
-      const done = cleanUp({ work_order: id2, ...workspace }, exit).catch((error) => {
+      const done = Promise.all([
+        cleanUp({ work_order: id2, ...workspace }, exit),
+        reportExit(id2, binary, exit, workspace.log)
+      ]).then(() => void 0).catch((error) => {
         log(
           `work order ${id2}: cleanup after the harness failed: ${asError(error).message}`
         );
       }).finally(() => {
+        sessions.delete(id2);
         cleanups.delete(done);
       });
       cleanups.add(done);
@@ -44292,8 +44691,8 @@ function createWorkOrderAutostart(deps) {
     const id2 = order.work_order;
     const running = runningWorkOrder(paths, id2, isAlive);
     if (running !== void 0) return;
-    const wait = retry.get(id2);
-    if (wait !== void 0 && deps.now() < wait.at) return;
+    const wait2 = retry.get(id2);
+    if (wait2 !== void 0 && deps.now() < wait2.at) return;
     const outcome = await claimForStart(deps.client, deps.host(), id2);
     if (outcome.kind === "refused" && outcome.final) {
       log(
@@ -44389,7 +44788,7 @@ function createWorkOrderAutostart(deps) {
     log(
       `work order ${id2} for ${claim.work_order.item_number} started ${binary} (process ${started.pid}) in ${workspace.worktree}; output goes to ${workspace.log}`
     );
-    watch2(id2, workspace, started.exited);
+    watch2(id2, binary, workspace, started.exited);
   }
   async function runPass() {
     let orders;
@@ -44438,6 +44837,9 @@ function createWorkOrderAutostart(deps) {
         }
       }
     },
+    noteSession: (workOrder) => {
+      sessions.add(workOrder);
+    },
     idle: async () => {
       while (pass2 !== void 0 || cleanups.size > 0) {
         await Promise.allSettled([pass2, ...cleanups]);
@@ -44445,7 +44847,7 @@ function createWorkOrderAutostart(deps) {
     }
   };
 }
-var SLOW_GIT_MS, RETRY_MIN_MS, RETRY_MAX_MS, spawnDetached;
+var SLOW_GIT_MS, RETRY_MIN_MS, RETRY_MAX_MS, EXIT_REPORT_GRACE_MS, TERMINAL_CODE, EXIT_REPORT_QUOTE, spawnDetached;
 var init_work_order_autostart = __esm({
   "../../packages/tacho/src/collector/work-order-autostart.ts"() {
     "use strict";
@@ -44459,6 +44861,12 @@ var init_work_order_autostart = __esm({
     SLOW_GIT_MS = 12e4;
     RETRY_MIN_MS = 15e3;
     RETRY_MAX_MS = 5 * 6e4;
+    EXIT_REPORT_GRACE_MS = 6e4;
+    TERMINAL_CODE = new RegExp(
+      `${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`,
+      "g"
+    );
+    EXIT_REPORT_QUOTE = 240;
     spawnDetached = (command2, args, options) => new Promise((resolve26) => {
       let fd2;
       try {
@@ -44468,10 +44876,10 @@ var init_work_order_autostart = __esm({
         resolve26({ ok: false, error: asError(error) });
         return;
       }
-      let open6 = true;
+      let open7 = true;
       const close = () => {
-        if (!open6) return;
-        open6 = false;
+        if (!open7) return;
+        open7 = false;
         try {
           closeSync7(fd2);
         } catch {
@@ -44559,7 +44967,7 @@ import { createReadStream } from "node:fs";
 import {
   lstat,
   mkdir,
-  open as open3,
+  open as open4,
   readdir,
   readlink,
   rename,
@@ -44612,7 +45020,7 @@ async function contentHash(absolutePath, kind, keep) {
       const temp2 = join37(keep.dir, `.partial-${randomUUID3()}`);
       copy = {
         temp: temp2,
-        handle: await open3(temp2, "wx", keep.executable ? 448 : 384)
+        handle: await open4(temp2, "wx", keep.executable ? 448 : 384)
       };
     } catch {
       copy = null;
@@ -46380,22 +46788,41 @@ var init_interjection = __esm({
 function showsRefusedPrompt(harness) {
   return harness !== "stella";
 }
+function questionBoundary(harness) {
+  return showsRefusedPrompt(harness) ? "UserPromptSubmit" : "SessionStart";
+}
+function holdToolCall(evaluation, record) {
+  const held = record.control.interjection;
+  if (held === void 0 || evaluation.decision === "deny") return evaluation;
+  const refused2 = {
+    ...evaluation,
+    decision: "deny",
+    evaluated: "deny",
+    source: "bundle",
+    reason_code: INTERJECTION_OPEN,
+    reason: held.question
+  };
+  delete refused2.rule;
+  delete refused2.rules;
+  return refused2;
+}
 function isBound(clause, remote) {
   const bound = new Set(clause.bound_remote_digests);
   return bound.has(remote.remote_digest) || bound.has(remote.remote_digest_folded);
 }
-function interjectionQuestion(clause) {
+function interjectionQuestion(clause, harness) {
   const minutes = Math.max(1, Math.round(clause.timeout_ms / 6e4));
   const slug = clause.workspace_slug;
-  return `Oxagen is holding this session before its first model call. It started in a repository that no workspace in your organization has bound, and skills are on for workspace ${slug}. Should Oxagen link this repository to ${slug}, or create a new workspace for it with skills off? A person with access answers on this run's page in Oxagen. With no answer in ${minutes} minutes, the session goes on without skills.`;
+  const hold = showsRefusedPrompt(harness) ? `Oxagen is holding this session before its first model call. ` : `Oxagen is refusing this session's tool calls until a person answers. `;
+  return hold + `It started in a repository that no workspace in your organization has bound, and skills are on for workspace ${slug}. Should Oxagen link this repository to ${slug}, or create a new workspace for it with skills off? A person with access answers on this run's page in Oxagen. With no answer in ${minutes} minutes, the session goes on without skills.`;
 }
 function proposedSlug(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").slice(0, SLUG_MAX).replace(/-+$/, "");
   return slug.length >= SLUG_MIN && SLUG_PATTERN.test(slug) ? slug : null;
 }
-function raiseInterjection(record, clause, remote, now, fields) {
+function prepareInterjection(record, clause, remote, now) {
   const key = ulid(now);
-  const question = interjectionQuestion(clause);
+  const question = interjectionQuestion(clause, record.harness);
   const expiresAt = toProtocolTimestamp(now + clause.timeout_ms);
   const name = remote.name !== void 0 && remote.name.length <= NAME_MAX2 ? remote.name : null;
   const unknown2 = repoUnknownBodySchema.safeParse({
@@ -46432,21 +46859,28 @@ function raiseInterjection(record, clause, remote, now, fields) {
     ]
   });
   if (!unknown2.success || !interject.success) return void 0;
+  return {
+    unknown: unknown2.data,
+    interject: interject.data,
+    held: {
+      key,
+      question,
+      expiresAt,
+      workspaceSlug: clause.workspace_slug,
+      configVersion: clause.config_version
+    }
+  };
+}
+function sealInterjection(record, pending, fields) {
   const events = [
-    record.recorder.sealCollectorEvent("repo.unknown", unknown2.data, fields),
+    record.recorder.sealCollectorEvent("repo.unknown", pending.unknown, fields),
     record.recorder.sealCollectorEvent(
       "control.interject",
-      interject.data,
+      pending.interject,
       fields
     )
   ];
-  record.control.interjection = {
-    key,
-    question,
-    expiresAt,
-    workspaceSlug: clause.workspace_slug,
-    configVersion: clause.config_version
-  };
+  record.control.interjection = { ...pending.held };
   return events;
 }
 function expireInterjection(record, now, fields) {
@@ -46533,7 +46967,7 @@ function settle(record, held, answer, payload, fields) {
   record.control.interjection = void 0;
   return events;
 }
-var SLUG_PATTERN, SLUG_MIN, SLUG_MAX, NAME_MAX2, INTERJECTION_TIMED_OUT_TEXT;
+var SLUG_PATTERN, SLUG_MIN, SLUG_MAX, NAME_MAX2, INTERJECTION_OPEN, INTERJECTION_TIMED_OUT_TEXT;
 var init_interjection2 = __esm({
   "../../packages/tacho/src/collector/interjection.ts"() {
     "use strict";
@@ -46544,6 +46978,7 @@ var init_interjection2 = __esm({
     SLUG_MIN = 2;
     SLUG_MAX = 40;
     NAME_MAX2 = 120;
+    INTERJECTION_OPEN = "interjection_open";
     INTERJECTION_TIMED_OUT_TEXT = "Oxagen asked a person whether to bind this repository to a workspace, and nobody answered in time. This session goes on without skills.";
   }
 });
@@ -46809,21 +47244,23 @@ function promptBlock(view, record) {
   const block = operatorBlock(view, record);
   if (block !== void 0) return block;
   const held = record.control.interjection;
-  if (held === void 0) return void 0;
-  return { code: "interjection_open", reason: held.question, source: "bundle" };
+  if (held === void 0 || !showsRefusedPrompt(record.harness))
+    return void 0;
+  return { code: INTERJECTION_OPEN, reason: held.question, source: "bundle" };
 }
-async function askAboutRepository(record, view, deps, replay, fields) {
-  if (record.control.repoChecked === true) return [];
+async function repositoryQuestion(record, view, deps, replay, boundary) {
+  if (record.control.repoChecked === true || questionBoundary(record.harness) !== boundary)
+    return void 0;
   record.control.repoChecked = true;
   const clause = view.verified ? view.bundle.unbound_repo : void 0;
-  if (clause === void 0 || replay !== void 0 || !showsRefusedPrompt(record.harness) || record.recorder.hasModelCall || record.cwd === void 0 || deps.repositoryRemote === void 0)
-    return [];
+  if (clause === void 0 || replay !== void 0 || record.recorder.hasModelCall || record.cwd === void 0 || deps.repositoryRemote === void 0)
+    return void 0;
   const remote = await readRepository(
     recallView(record),
     deps.repositoryRemote
   );
-  if (remote === void 0 || isBound(clause, remote)) return [];
-  return raiseInterjection(record, clause, remote, deps.now(), fields) ?? [];
+  if (remote === void 0 || isBound(clause, remote)) return void 0;
+  return prepareInterjection(record, clause, remote, deps.now());
 }
 function invocationToolUseId(raw, input, record) {
   const derived = input.tool_use_id;
@@ -47274,12 +47711,19 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
   switch (input.hook_event_name) {
     case "SessionStart": {
       const block = operatorBlock(view, record);
+      const question = input.agent_id === void 0 ? await repositoryQuestion(record, view, deps, replay, "SessionStart") : void 0;
+      const questionText = question?.held.question;
       const steering = block === void 0 && replay === void 0 ? await runSteeringBundle(record, deps) ?? view.bundle : view.bundle;
       const context = steering.context.system;
       if (block === void 0 && replay === void 0)
         await placeSessionSkills(view, record, deps, env);
-      const messages = block === void 0 && replay === void 0 && input.agent_id === void 0 ? drainMessages(record, deps, events, context?.length ?? 0) : [];
-      const additional = block === void 0 ? [context ?? "", ...messages.map((m) => m.text)].filter((s2) => s2.length > 0).join(CONTEXT_JOINER) : "";
+      const messages = block === void 0 && replay === void 0 && input.agent_id === void 0 ? drainMessages(
+        record,
+        deps,
+        events,
+        (context?.length ?? 0) + (questionText?.length ?? 0)
+      ) : [];
+      const additional = block === void 0 ? [questionText ?? "", context ?? "", ...messages.map((m) => m.text)].filter((s2) => s2.length > 0).join(CONTEXT_JOINER) : "";
       const delivered = replay === void 0 ? void 0 : readDeliveredContext(replay.deliveredContext);
       const deliveryAttrs = replay === void 0 ? {
         // A blocked start hands the agent nothing, so it names no text.
@@ -47306,6 +47750,13 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           })
         )
       );
+      if (question !== void 0)
+        events.push(
+          ...sealInterjection(record, question, {
+            hook_event_name: "SessionStart",
+            attrs: replayed
+          })
+        );
       if (block !== void 0) {
         events.push(
           record.recorder.sealCollectorEvent(
@@ -47355,14 +47806,15 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       };
       const timedOut = replay === void 0 ? expireInterjection(record, deps.now(), questionFields) : void 0;
       if (timedOut !== void 0) events.push(...timedOut);
-      const asked = await askAboutRepository(
+      const asked = await repositoryQuestion(
         record,
         view,
         deps,
         replay,
-        questionFields
+        "UserPromptSubmit"
       );
-      events.push(...asked);
+      if (asked !== void 0)
+        events.push(...sealInterjection(record, asked, questionFields));
       const block = promptBlock(view, record);
       const notice = block === void 0 && timedOut !== void 0 ? INTERJECTION_TIMED_OUT_TEXT : void 0;
       const messages = block === void 0 && replay === void 0 && input.agent_id === void 0 && deliversMessages(record.harness, input.hook_event_name) ? drainMessages(record, deps, events, notice?.length ?? 0) : [];
@@ -47440,12 +47892,17 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       const toolInput = input.tool_input;
       noteToolCall(record, toolName3, toolInput);
       noteRecallHints(record, input.tool_name, toolInput);
+      const timedOut = replay === void 0 ? expireInterjection(record, deps.now(), {
+        hook_event_name: "PreToolUse",
+        attrs: replayed
+      }) : void 0;
+      if (timedOut !== void 0) events.push(...timedOut);
       const decided = await decideToolCall(view, record, input, deps, replay, {
         toolName: toolName3,
         toolInput
       });
       const currentView = decided.view;
-      let evaluation = decided.evaluation;
+      let evaluation = replay === void 0 ? holdToolCall(decided.evaluation, record) : decided.evaluation;
       if (replay === void 0 && evaluation.decision === "deny" && evaluation.reason_code === "session_paused" && record.control.pauseEffect === void 0)
         record.control.pauseEffect = "refused";
       const refusal = evaluation.decision === "deny" ? void 0 : refusesForSteer(record.harness, record.control.messages);
@@ -47471,7 +47928,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           };
         }
       }
-      if (evaluation.decision === "deny" && evaluation.source !== "human")
+      if (evaluation.decision === "deny" && evaluation.source !== "human" && evaluation.reason_code !== INTERJECTION_OPEN)
         notePolicyDenial(record, toolName3);
       const facts = policyFacts2(evaluation, currentView);
       const attrs2 = policyAttrs(evaluation, replay);
@@ -48182,6 +48639,14 @@ function expiredAt(command2, now) {
 }
 async function applyCommands(commands, deps) {
   const now = deps.now();
+  if (newCommands(commands, deps).fresh.some(
+    (command2) => command2.session_uuid === null && command2.command === "refresh_bundle" && !expiredAt(command2, now)
+  ))
+    await deps.refreshBundle();
+  const seal2 = () => sealNewCommands(commands, deps, now);
+  return deps.exclusive !== void 0 ? deps.exclusive(seal2) : seal2();
+}
+function newCommands(commands, deps) {
   const fresh = [];
   const repeated = [];
   for (const command2 of commands) {
@@ -48189,10 +48654,10 @@ async function applyCommands(commands, deps) {
       repeated.push(command2.id);
     else fresh.push(command2);
   }
-  if (fresh.some(
-    (command2) => command2.session_uuid === null && command2.command === "refresh_bundle" && !expiredAt(command2, now)
-  ))
-    await deps.refreshBundle();
+  return { fresh, repeated };
+}
+function sealNewCommands(commands, deps, now) {
+  const { fresh, repeated } = newCommands(commands, deps);
   const result2 = sealCommands(fresh, deps, now);
   for (const ack of result2.acknowledgements) deps.handled?.remember(ack);
   for (const id2 of repeated) {
@@ -53461,6 +53926,19 @@ import {
 } from "node:http";
 import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
 import { brotliDecompress, gunzip, inflate, zstdDecompress } from "node:zlib";
+async function landedWithin(landing, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      landing.then(() => true),
+      new Promise((resolve26) => {
+        timer = setTimeout(() => resolve26(false), ms);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
 function streamsAnthropicMessages(route, body2) {
   return route.api === "anthropic.messages" && body2?.["stream"] === true;
 }
@@ -53651,6 +54129,7 @@ function createModelProxy(deps) {
   const maxRequestBytes = deps.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES;
   const upstreamIdleMs = deps.upstreamIdleMs ?? DEFAULT_UPSTREAM_IDLE_MS;
   const hookTimeoutMs = deps.beforeForwardTimeoutMs ?? DEFAULT_BEFORE_FORWARD_TIMEOUT_MS;
+  const refusalWaitMs = deps.refusalFrameWaitMs ?? DEFAULT_REFUSAL_FRAME_WAIT_MS;
   const httpAgent = new HttpAgent({ keepAlive: true, maxSockets: Infinity });
   const httpsAgent = new HttpsAgent({ keepAlive: true, maxSockets: Infinity });
   const inFlight = /* @__PURE__ */ new Map();
@@ -53776,10 +54255,10 @@ function createModelProxy(deps) {
       if (known !== void 0 && !known.sealed && !known.pendingTerminal)
         return { record: known, how };
       if (known !== void 0) {
-        const open6 = deps.registry.list().find(
+        const open7 = deps.registry.list().find(
           (record2) => record2.harnessSessionId === id2 && !record2.sealed && !record2.pendingTerminal
         );
-        if (open6 !== void 0) return { record: open6, how };
+        if (open7 !== void 0) return { record: open7, how };
         return { how: "session_closed" };
       }
       const { record } = deps.registry.ensure(id2, { harness, ambient: true });
@@ -54006,59 +54485,75 @@ function createModelProxy(deps) {
       found = { how: "unattributed" };
     }
     return {
+      ...found.record !== void 0 ? { record: found.record } : {},
       recorder: found.record?.recorder ?? deps.hostRecorder(),
       how: found.how,
       attrs: attrsFor(route, found.how)
     };
   }
+  function landingChain(record, how) {
+    if (record === void 0) return { chain: deps.hostRecorder(), attrs: {} };
+    const owner = deps.registry.byUuid(record.recorder.sessionUuid);
+    if (owner !== void 0 && !owner.sealed && owner.pendingTerminal !== true)
+      return { chain: owner.recorder, attrs: {} };
+    return {
+      chain: deps.hostRecorder(),
+      attrs: {
+        "oxagen.correlation": "session_closed",
+        "oxagen.session_correlation": how,
+        "oxagen.session_uuid": record.recorder.sessionUuid
+      }
+    };
+  }
   function sealNotForwarded(req, route, attempt, reason3, status2) {
     if (attempt.done) return;
     attempt.done = true;
     if (route.api === "other") return;
-    let recorder;
-    let mark;
+    let session;
+    const lost = (error) => {
+      deps.log(
+        `model proxy: sealing the frame of a call it did not forward (${reason3}) failed: ${error instanceof Error ? error.message : String(error)} session=${session ?? "unattributed"}`
+      );
+    };
     try {
       const attribution2 = attempt.attribution ?? attributeByHeaders(req, route);
-      const chain = attribution2.recorder;
-      recorder = chain;
-      mark = chain.markChain();
+      session = attribution2.recorder.sessionUuid;
       const at2 = deps.now();
-      deps.record([
-        chain.sealCollectorEvent(
-          "error",
-          {
-            provider: route.provider,
-            ...attempt.model !== void 0 ? { model: attempt.model.slice(0, 512) } : {},
-            ...status2 !== void 0 ? { api_status_code: status2 } : {},
-            api_error_class: reason3,
-            api_duration_ms: Math.max(0, at2 - attempt.startedAt)
-          },
-          {
-            ts: toProtocolTimestamp(at2),
-            fidelity: "proxy",
-            attrs: {
-              ...attribution2.attrs,
-              [NOT_FORWARDED_ATTR]: reason3,
-              "oxagen.provider": route.provider,
-              "oxagen.request_bytes_read": String(attempt.bytesRead),
-              ...attempt.request !== void 0 ? { "oxagen.request_digest": digestBytes(attempt.request) } : {}
-            }
-          }
-        )
-      ]);
+      const body2 = {
+        provider: route.provider,
+        ...attempt.model !== void 0 ? { model: attempt.model.slice(0, 512) } : {},
+        ...status2 !== void 0 ? { api_status_code: status2 } : {},
+        api_error_class: reason3,
+        api_duration_ms: Math.max(0, at2 - attempt.startedAt)
+      };
+      const attrs2 = {
+        ...attribution2.attrs,
+        [NOT_FORWARDED_ATTR]: reason3,
+        "oxagen.provider": route.provider,
+        "oxagen.request_bytes_read": String(attempt.bytesRead),
+        ...attempt.request !== void 0 ? { "oxagen.request_digest": digestBytes(attempt.request) } : {}
+      };
+      const land = () => {
+        const landing = landingChain(attribution2.record, attribution2.how);
+        recordOnChain(
+          landing.chain,
+          (chain) => [
+            chain.sealCollectorEvent("error", body2, {
+              ts: toProtocolTimestamp(at2),
+              fidelity: "proxy",
+              attrs: { ...attrs2, ...landing.attrs }
+            })
+          ],
+          deps.record
+        );
+      };
+      if (attribution2.record === void 0) land();
+      else
+        void onSessionQueue(deps.exclusive, attribution2.record, land).catch(
+          lost
+        );
     } catch (error) {
-      if (recorder !== void 0 && mark !== void 0) {
-        try {
-          recorder.rollbackChain(mark);
-        } catch (rollbackError) {
-          deps.log(
-            `model proxy: rolling the chain back after a failed frame failed too: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)} session=${recorder.sessionUuid}`
-          );
-        }
-      }
-      deps.log(
-        `model proxy: sealing the frame of a call it did not forward (${reason3}) failed: ${error instanceof Error ? error.message : String(error)} session=${recorder?.sessionUuid ?? "unattributed"}`
-      );
+      lost(error);
     }
   }
   function sendProviderError(res, route, status2, code, message, retryable = false) {
@@ -54347,29 +54842,6 @@ function createModelProxy(deps) {
     }
     callsObserved += 1;
     observed.set(sessionKey, (observed.get(sessionKey) ?? 0) + 1);
-    const closed2 = record.sealed || record.pendingTerminal === true;
-    const requestText = payload.body.toString("utf8");
-    const memory = new RequestPrefixMemory();
-    if (payload.priorShape !== void 0 && !closed2)
-      memory.remember("parent", {
-        text: "",
-        fullDigest: payload.priorShape.requestDigest,
-        fullBytes: 0,
-        storedBytes: 0,
-        prior: void 0,
-        shape: payload.priorShape,
-        priorPayload: void 0
-      });
-    const fold = memory.fold("parent", requestText);
-    const capped = cappedExchange(
-      fold.storedBytes > TACHO_MAX_BODY_BYTES ? void 0 : fold.text,
-      {
-        text: answer.responseText,
-        tooLarge: answer.responseTooLarge,
-        bytes: answer.responseBytes
-      }
-    );
-    const chain = closed2 ? deps.hostRecorder() : record.recorder;
     const callBody2 = llmCallBody({
       provider: "anthropic",
       model,
@@ -54385,10 +54857,33 @@ function createModelProxy(deps) {
       failed: answer.errorClass ?? (answer.status >= 400 ? `http_${answer.status}` : void 0),
       requestId: answer.requestId
     });
-    const mark = chain.markChain();
-    try {
-      deps.record(
-        [
+    const land = () => {
+      const owner = deps.registry.byUuid(record.recorder.sessionUuid);
+      const closed2 = owner === void 0 || owner.sealed || owner.pendingTerminal === true;
+      const requestText = payload.body.toString("utf8");
+      const memory = new RequestPrefixMemory();
+      if (payload.priorShape !== void 0 && !closed2)
+        memory.remember("parent", {
+          text: "",
+          fullDigest: payload.priorShape.requestDigest,
+          fullBytes: 0,
+          storedBytes: 0,
+          prior: void 0,
+          shape: payload.priorShape,
+          priorPayload: void 0
+        });
+      const fold = memory.fold("parent", requestText);
+      const capped = cappedExchange(
+        fold.storedBytes > TACHO_MAX_BODY_BYTES ? void 0 : fold.text,
+        {
+          text: answer.responseText,
+          tooLarge: answer.responseTooLarge,
+          bytes: answer.responseBytes
+        }
+      );
+      recordOnChain(
+        closed2 ? deps.hostRecorder() : owner.recorder,
+        (chain) => [
           chain.sealCollectorEvent("llm_call", callBody2, {
             ts: toProtocolTimestamp(settledAt),
             fidelity: "proxy",
@@ -54427,20 +54922,16 @@ function createModelProxy(deps) {
             }
           })
         ],
-        chain.takeBodies()
+        deps.record
       );
-    } catch (error) {
-      try {
-        chain.rollbackChain(mark);
-      } catch (rollbackError) {
+    };
+    void onSessionQueue(deps.exclusive, record, land).catch(
+      (error) => {
         deps.log(
-          `model proxy: rolling the chain back after a failed keep-alive frame failed too: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)} session=${sessionKey}`
+          `model proxy: sealing a cache keep-alive's frame failed: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
         );
       }
-      deps.log(
-        `model proxy: sealing a cache keep-alive's frame failed: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
-      );
-    }
+    );
     return usage2.cacheReadTokens ?? 0;
   }
   async function forward(req, res, route, admitted, attempt) {
@@ -54481,7 +54972,12 @@ function createModelProxy(deps) {
     const sessionKey = record?.recorder.sessionUuid ?? HOST_KEY;
     const credential = resolveCredential(req, route);
     const attrs2 = attrsFor(route, how, credential);
-    attempt.attribution = { recorder, how, attrs: attrs2 };
+    attempt.attribution = {
+      ...record !== void 0 ? { record } : {},
+      recorder,
+      how,
+      attrs: attrs2
+    };
     const metered = route.api !== "other";
     const { model: askedModel, ambiguous: modelAmbiguous } = modelOf(
       readable,
@@ -54527,44 +55023,58 @@ function createModelProxy(deps) {
     if (refusal !== void 0) {
       refused2 += 1;
       const view = deps.policy();
-      const mark = recorder.markChain();
-      try {
-        deps.record([
-          recorder.sealCollectorEvent(
-            "policy_decision",
-            {
-              policy_decision: "deny",
-              policy_source: refusal.source,
-              policy_reason_code: refusal.code,
-              policy_reason_digest: digestText(refusal.message),
-              bundle_version: view.bundle.version,
-              bundle_mode: view.bundle.mode
-            },
-            {
+      const decision = {
+        policy_decision: "deny",
+        policy_source: refusal.source,
+        policy_reason_code: refusal.code,
+        policy_reason_digest: digestText(refusal.message),
+        bundle_version: view.bundle.version,
+        bundle_mode: view.bundle.mode
+      };
+      const decisionAttrs = {
+        ...attrs2,
+        "oxagen.refused": "model_call",
+        "oxagen.provider": route.provider,
+        "oxagen.request_digest": digestBytes(body2),
+        // The model the refusal was about, when the proxy could read one. A
+        // `model_not_permitted` frame that does not name the model leaves the
+        // operator guessing which entry to add.
+        ...askedModel !== void 0 ? { "oxagen.model": askedModel.slice(0, 512) } : {},
+        ...modelAmbiguous ? { "oxagen.model_ambiguous": "true" } : {},
+        ...record !== void 0 ? {
+          "oxagen.session_spend_usd_micros": String(spendFor(sessionKey))
+        } : {},
+        ..."attrs" in refusal ? refusal.attrs : {}
+      };
+      const land = () => {
+        const landing = landingChain(record, how);
+        recordOnChain(
+          landing.chain,
+          (chain) => [
+            chain.sealCollectorEvent("policy_decision", decision, {
               fidelity: "proxy",
-              attrs: {
-                ...attrs2,
-                "oxagen.refused": "model_call",
-                "oxagen.provider": route.provider,
-                "oxagen.request_digest": digestBytes(body2),
-                // The model the refusal was about, when the proxy could read
-                // one. A `model_not_permitted` frame that does not name the
-                // model leaves the operator guessing which entry to add.
-                ...askedModel !== void 0 ? { "oxagen.model": askedModel.slice(0, 512) } : {},
-                ...modelAmbiguous ? { "oxagen.model_ambiguous": "true" } : {},
-                ...record !== void 0 ? {
-                  "oxagen.session_spend_usd_micros": String(
-                    spendFor(sessionKey)
-                  )
-                } : {},
-                ..."attrs" in refusal ? refusal.attrs : {}
-              }
-            }
-          )
-        ]);
-      } catch (error) {
-        recorder.rollbackChain(mark);
-        throw error;
+              attrs: { ...decisionAttrs, ...landing.attrs }
+            })
+          ],
+          deps.record
+        );
+      };
+      if (record === void 0) land();
+      else {
+        let answered = false;
+        const written2 = onSessionQueue(deps.exclusive, record, land);
+        void written2.catch((error) => {
+          if (answered)
+            deps.log(
+              `model proxy: the frame of a refusal already answered was not written: ${error instanceof Error ? error.message : String(error)} session=${sessionKey}`
+            );
+        });
+        if (!await landedWithin(written2, refusalWaitMs)) {
+          answered = true;
+          deps.log(
+            `model proxy: answered a refused call before its frame could land, because the session's queue was busy for ${refusalWaitMs} ms session=${sessionKey}`
+          );
+        }
       }
       attempt.done = true;
       deps.log(
@@ -55245,9 +55755,9 @@ function createModelProxy(deps) {
     callsObservedFor: (sessionUuid2) => observed.get(sessionUuid2) ?? 0,
     keepAliveTick: () => keepAlive.tick(),
     stats: () => {
-      let open6 = 0;
-      for (const calls of inFlight.values()) open6 += calls.size;
-      return { callsObserved, refused: refused2, inFlight: open6 };
+      let open7 = 0;
+      for (const calls of inFlight.values()) open7 += calls.size;
+      return { callsObserved, refused: refused2, inFlight: open7 };
     },
     close: () => {
       clearInterval(keepAliveTimer);
@@ -55262,7 +55772,7 @@ function createModelProxy(deps) {
     }
   };
 }
-var DEFAULT_MAX_REQUEST_BYTES, NOT_FORWARDED_ATTR, DEFAULT_UPSTREAM_IDLE_MS, DEFAULT_BEFORE_FORWARD_TIMEOUT_MS, DEFAULT_UPSTREAM_CONNECT_MS, DEFAULT_PAUSE_HOLD_MS, DEFAULT_PAUSE_STREAM_HOLD_MS, DEFAULT_PAUSE_HOLD_PING_MS, DEFAULT_PAUSE_HOLD_CHECK_MS, MAX_HELD_CALLS_PER_SESSION, PAUSE_HOLD_CODES, ANTHROPIC_PING_EVENT, HELD_STREAM_ERROR_BYTES, FREE_SOCKET_TIMEOUT_MS, KEEP_ALIVE_TIMEOUT_MS, KEEP_ALIVE_MAX_RESPONSE_BYTES, BodyCapture, EXCHANGE_OPEN_BYTES, EXCHANGE_JOIN_BYTES, DECODERS, REQUEST_EFFORT_MAX, CREDENTIAL_MESSAGES;
+var DEFAULT_MAX_REQUEST_BYTES, NOT_FORWARDED_ATTR, DEFAULT_UPSTREAM_IDLE_MS, DEFAULT_BEFORE_FORWARD_TIMEOUT_MS, DEFAULT_UPSTREAM_CONNECT_MS, DEFAULT_REFUSAL_FRAME_WAIT_MS, DEFAULT_PAUSE_HOLD_MS, DEFAULT_PAUSE_STREAM_HOLD_MS, DEFAULT_PAUSE_HOLD_PING_MS, DEFAULT_PAUSE_HOLD_CHECK_MS, MAX_HELD_CALLS_PER_SESSION, PAUSE_HOLD_CODES, ANTHROPIC_PING_EVENT, HELD_STREAM_ERROR_BYTES, FREE_SOCKET_TIMEOUT_MS, KEEP_ALIVE_TIMEOUT_MS, KEEP_ALIVE_MAX_RESPONSE_BYTES, BodyCapture, EXCHANGE_OPEN_BYTES, EXCHANGE_JOIN_BYTES, DECODERS, REQUEST_EFFORT_MAX, CREDENTIAL_MESSAGES;
 var init_model_proxy = __esm({
   "../../packages/tacho/src/collector/model-proxy.ts"() {
     "use strict";
@@ -55293,6 +55803,7 @@ var init_model_proxy = __esm({
     DEFAULT_UPSTREAM_IDLE_MS = 10 * 6e4;
     DEFAULT_BEFORE_FORWARD_TIMEOUT_MS = 250;
     DEFAULT_UPSTREAM_CONNECT_MS = 3e4;
+    DEFAULT_REFUSAL_FRAME_WAIT_MS = 1e3;
     DEFAULT_PAUSE_HOLD_MS = 12e4;
     DEFAULT_PAUSE_STREAM_HOLD_MS = 12 * 60 * 6e4;
     DEFAULT_PAUSE_HOLD_PING_MS = 15e3;
@@ -55477,7 +55988,7 @@ var init_model_proxy_listener = __esm({
 import {
   createServer as createServer5
 } from "node:http";
-import { chmodSync as chmodSync9, existsSync as existsSync23, statSync as statSync12, unlinkSync as unlinkSync11 } from "node:fs";
+import { chmodSync as chmodSync9, existsSync as existsSync23, statSync as statSync13, unlinkSync as unlinkSync11 } from "node:fs";
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { createConnection } from "node:net";
 function isExportFormat(value) {
@@ -55853,7 +56364,7 @@ function createRequestHandler(api, log, options = {}) {
 }
 async function removeStaleSocket(socketPath) {
   if (!existsSync23(socketPath)) return;
-  if (!statSync12(socketPath).isSocket()) {
+  if (!statSync13(socketPath).isSocket()) {
     throw new Error(`collector socket path is not a socket: ${socketPath}`);
   }
   const stale = await new Promise((resolve26, reject) => {
@@ -56022,7 +56533,7 @@ var init_server = __esm({
 });
 
 // ../../packages/tacho/src/collector/refused.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync20, statSync as statSync13 } from "node:fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync20, statSync as statSync14 } from "node:fs";
 import { join as join45 } from "node:path";
 function refusalRetryable(refusal) {
   return refusal === "malformed" || refusal === "parked";
@@ -56072,7 +56583,7 @@ function readRefusedEntry(file) {
   let mtimeMs;
   try {
     record = JSON.parse(readFileSync20(file, "utf8"));
-    mtimeMs = statSync13(file).mtimeMs;
+    mtimeMs = statSync14(file).mtimeMs;
   } catch {
     return void 0;
   }
@@ -57025,7 +57536,7 @@ import {
   readdirSync as readdirSync13,
   readFileSync as readFileSync22,
   renameSync as renameSync4,
-  statSync as statSync14,
+  statSync as statSync15,
   unlinkSync as unlinkSync13
 } from "node:fs";
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:fs/promises";
@@ -57224,7 +57735,8 @@ async function startDaemon(options) {
   }
 }
 async function initializeDaemon(options, server, port, ready) {
-  const paths = options.paths;
+  const paths = withRecordedHarnessFiles(options.paths, options.host);
+  const harnessHomes = recordedHarnessHomes(options.host);
   const now = options.now ?? (() => Date.now());
   const log = options.log;
   const timers = { ...DEFAULT_TIMERS, ...options.timers };
@@ -57374,7 +57886,7 @@ async function initializeDaemon(options, server, port, ready) {
     processStarts: hookProcessStarts,
     adoptedChain: (sessionUuid2) => backfillLedger.chainHead(sessionUuid2)
   });
-  const priorStateWrittenAt = existsSync25(paths.daemonState) ? statSync14(paths.daemonState).mtimeMs : void 0;
+  const priorStateWrittenAt = existsSync25(paths.daemonState) ? statSync15(paths.daemonState).mtimeMs : void 0;
   const sealedState = parseSealedState(
     readJsonStateFile(
       paths.daemonSealedState,
@@ -57521,7 +58033,8 @@ async function initializeDaemon(options, server, port, ready) {
     },
     ...options.workOrders?.spawn !== void 0 ? { spawn: options.workOrders.spawn } : {},
     ...options.workOrders?.isAlive !== void 0 ? { isAlive: options.workOrders.isAlive } : {},
-    ...options.workOrders?.findCheckout !== void 0 ? { findCheckout: options.workOrders.findCheckout } : {}
+    ...options.workOrders?.findCheckout !== void 0 ? { findCheckout: options.workOrders.findCheckout } : {},
+    ...options.workOrders?.wait !== void 0 ? { wait: options.workOrders.wait } : {}
   });
   void workOrderAutostart.clearDeadMarks();
   function persistState(options2 = {}) {
@@ -57736,25 +58249,24 @@ async function initializeDaemon(options, server, port, ready) {
     });
   }
   async function applyCommandsRecorded(commands, deps) {
-    let marks = markCommandChains(commands);
-    let result2;
-    try {
-      result2 = await applyCommands2(commands, {
-        ...deps,
-        refreshBundle: async () => {
-          marks = [];
-          await deps.refreshBundle();
-          marks = markCommandChains(commands);
+    return applyCommands2(commands, {
+      ...deps,
+      exclusive: (seal2) => queues.host(async () => {
+        if (hostRecord.sealed) throw new Error(STOPPING);
+        const marks = markCommandChains(commands);
+        let result2;
+        try {
+          result2 = seal2();
+          record(result2.events);
+          return result2;
+        } catch (error) {
+          for (const { session, mark } of [...marks].reverse())
+            session.recorder.rollbackChain(mark);
+          result2?.restore();
+          throw error;
         }
-      });
-      record(result2.events);
-      return result2;
-    } catch (error) {
-      for (const { session, mark } of [...marks].reverse())
-        session.recorder.rollbackChain(mark);
-      result2?.restore();
-      throw error;
-    }
+      })
+    });
   }
   let modelBaseUrls = [];
   const spoolFacts = /* @__PURE__ */ new Map();
@@ -57876,6 +58388,31 @@ async function initializeDaemon(options, server, port, ready) {
     }
   }
   function retryOwedBodyPurge() {
+    if (existsSync25(bodyPurgeOwedPath)) void settleOwedBodyPurge("owed");
+  }
+  let bodyPurge;
+  let bodyPurgeAgain = false;
+  let bodyPurgeNarrowing = false;
+  function settleOwedBodyPurge(trigger) {
+    if (trigger === "narrowed") bodyPurgeNarrowing = true;
+    if (bodyPurge !== void 0) {
+      bodyPurgeAgain = true;
+      return bodyPurge;
+    }
+    const run3 = (async () => {
+      do {
+        bodyPurgeAgain = false;
+        const narrowing = bodyPurgeNarrowing;
+        bodyPurgeNarrowing = false;
+        await sweepOwedBodies(narrowing);
+      } while (bodyPurgeAgain && !stopped2);
+    })().finally(() => {
+      if (bodyPurge === run3) bodyPurge = void 0;
+    });
+    bodyPurge = run3;
+    return run3;
+  }
+  async function sweepOwedBodies(narrowing) {
     const owed = owedBodyPurge();
     if (owed === void 0) return;
     let clause = owed.retention;
@@ -57885,16 +58422,28 @@ async function initializeDaemon(options, server, port, ready) {
       clause = inForce.mandate;
     }
     try {
-      const purged = wal.purgeBodiesOutsideMandate(clause) + purgePendingEndBodies(clause);
+      const purged = await wal.purgeBodiesOutsideMandateAsync(clause, {
+        signal: stopping.signal
+      }) + purgePendingEndBodies(clause);
       purgeQueuedPrompts(clause);
-      clearBodyPurgeOwed();
+      if (!bodyPurgeAgain) clearBodyPurgeOwed();
       log(
-        `completed an owed body purge: erased ${purged} queued body(ies) the mandate does not cover`
+        narrowing ? `mandate narrowed (${owed.classes.join(", ")}): erased ${purged} queued body(ies) from the WAL` : `completed an owed body purge: erased ${purged} queued body(ies) the mandate does not cover`
       );
     } catch (error) {
-      log(
-        `an owed body purge failed again; content remains in the WAL: ${error instanceof Error ? error.message : String(error)}; check free space and permissions under ${paths.wal}. The purge is retried at each bundle confirmation`
-      );
+      const reason3 = error instanceof Error ? error.message : String(error);
+      if (stopping.signal.aborted)
+        log(
+          "stop: left an owed body purge unfinished; the next start finishes it"
+        );
+      else if (narrowing)
+        log(
+          `failed to erase bodies the narrowed mandate no longer covers (${owed.classes.join(", ")}); content remains in the WAL: ${reason3}; check free space and permissions under ${paths.wal}. The purge is retried at each bundle confirmation`
+        );
+      else
+        log(
+          `an owed body purge failed again; content remains in the WAL: ${reason3}; check free space and permissions under ${paths.wal}. The purge is retried at each bundle confirmation`
+        );
     }
   }
   function purgeQueuedPrompts(clause) {
@@ -57917,21 +58466,30 @@ async function initializeDaemon(options, server, port, ready) {
     const dropped = HOST_RETENTION_CLASSES.filter(
       (contentClass) => retentionAllows(previous, contentClass) && !retentionAllows(next, contentClass)
     );
-    if (dropped.length === 0) return true;
-    const recorded = markBodyPurgeOwed(next, dropped);
+    if (dropped.length === 0) return "none";
+    if (markBodyPurgeOwed(next, dropped)) {
+      try {
+        purgePendingEndBodies(next);
+        purgeQueuedPrompts(next);
+      } catch (error) {
+        log(
+          `failed to erase bodies the narrowed mandate no longer covers (${dropped.join(", ")}); content remains on disk: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+      return "owed";
+    }
     try {
       const purged = wal.purgeBodiesOutsideMandate(next) + purgePendingEndBodies(next);
       purgeQueuedPrompts(next);
-      clearBodyPurgeOwed();
       log(
         `mandate narrowed (${dropped.join(", ")}): erased ${purged} queued body(ies) from the WAL`
       );
-      return true;
+      return "swept";
     } catch (error) {
       log(
         `failed to erase bodies the narrowed mandate no longer covers (${dropped.join(", ")}); content remains in the WAL: ${error instanceof Error ? error.message : String(error)}`
       );
-      return recorded;
+      return "refused";
     }
   }
   async function fetchBundle() {
@@ -57963,10 +58521,11 @@ async function initializeDaemon(options, server, port, ready) {
         );
         return "refused";
       }
-      if (!purgeBodiesNarrowedOut(
+      const narrowing = purgeBodiesNarrowedOut(
         host.bundle.retention,
         response.bundle.retention
-      )) {
+      );
+      if (narrowing === "refused") {
         log(
           "refusing to cache a narrowed bundle this host can neither enforce on disk nor remember owing; the old etag stands so the next poll retries"
         );
@@ -57979,6 +58538,7 @@ async function initializeDaemon(options, server, port, ready) {
       bundleVerified = true;
       mandateConfirmedAt = now();
       log(`bundle ${response.bundle.version} (${response.bundle.etag}) cached`);
+      if (narrowing === "owed") void settleOwedBodyPurge("narrowed");
       return "cached";
     } catch (error) {
       log(
@@ -58341,7 +58901,8 @@ async function initializeDaemon(options, server, port, ready) {
       lastIngestAt ?? -Infinity,
       lastCommandPollAt ?? -Infinity
     );
-    if (pendingAcks.length === 0 && now() - lastEnvelopeAt < timers.commandsPollMs) {
+    const pollEveryMs = registry2.live().some((session) => session !== hostRecord) ? timers.commandsPollMs : timers.commandsPollMs * IDLE_COMMAND_POLL_FACTOR;
+    if (pendingAcks.length === 0 && now() - lastEnvelopeAt < pollEveryMs) {
       return;
     }
     if (now() < commandPollNextAttemptAt) return;
@@ -58742,6 +59303,8 @@ async function initializeDaemon(options, server, port, ready) {
       restoreEveryQueue(queued);
       throw error;
     }
+    const workOrder = workOrderIdOf(envelope2.env?.[WORK_ORDER_ENV]);
+    if (workOrder !== void 0) workOrderAutostart.noteSession(workOrder);
     if (pending !== void 0) {
       const state = registry2.state();
       const key = sessionMapKey(harnessSessionId, {
@@ -59244,7 +59807,8 @@ async function initializeDaemon(options, server, port, ready) {
       const state = await readModelBaseUrlState({
         home: options.home ?? homedir8(),
         port: modelProxyPortFor(host),
-        stellaHome: dirname26(options.paths.stellaToml),
+        stellaHome: dirname26(paths.stellaToml),
+        ...harnessHomes,
         harnesses: ["claude-code", "codex", "stella"]
       });
       const next = {};
@@ -59807,7 +60371,7 @@ async function initializeDaemon(options, server, port, ready) {
       if (!name.endsWith(".json")) continue;
       const file = join47(paths.quarantine, name);
       try {
-        const refusedAt = readRefusedEntry(file)?.refusedAt ?? statSync14(file).mtimeMs;
+        const refusedAt = readRefusedEntry(file)?.refusedAt ?? statSync15(file).mtimeMs;
         if (at2 - refusedAt < retainMs) continue;
         unlinkSync13(file);
         removed += 1;
@@ -60080,7 +60644,11 @@ async function initializeDaemon(options, server, port, ready) {
         else if (typeof refreshed === "object")
           log(`ChatGPT login refresh: ${refreshed.failed}`);
         if (refreshed !== "none")
-          restateCodexLastRefresh(options.home ?? homedir8(), now());
+          restateCodexLastRefresh(
+            options.home ?? homedir8(),
+            now(),
+            harnessHomes
+          );
       } catch (error) {
         log(
           `ChatGPT login refresh: ${error instanceof Error ? error.message : String(error)}`
@@ -60093,6 +60661,7 @@ async function initializeDaemon(options, server, port, ready) {
       await renewStaticToken(harness, {
         home: options.home ?? homedir8(),
         stellaHome: dirname26(paths.stellaToml),
+        ...harnessHomes,
         host,
         runTokenKeyPath: paths.runTokenKey,
         now,
@@ -60222,6 +60791,9 @@ async function initializeDaemon(options, server, port, ready) {
     drainSpool: () => queues.host(() => drainSpool()),
     queues,
     refreshBundle: () => refreshBundle({ force: true }),
+    bodyPurgeIdle: async () => {
+      while (bodyPurge !== void 0) await bodyPurge;
+    },
     workOrdersIdle: () => workOrderAutostart.idle(),
     stop: async () => {
       if (stopped2) return;
@@ -60240,7 +60812,8 @@ async function initializeDaemon(options, server, port, ready) {
       }
       const [gitSettled, memorySettled] = await Promise.all([
         settleWithin(gitLane, timers.stopLaneMs),
-        settleWithin(memoryScan, timers.stopLaneMs)
+        settleWithin(memoryScan, timers.stopLaneMs),
+        settleWithin(bodyPurge, timers.stopLaneMs)
       ]);
       if (!gitSettled)
         log(
@@ -60281,7 +60854,7 @@ async function initializeDaemon(options, server, port, ready) {
     }
   };
 }
-var DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, CHATGPT_LOGIN_CHECK_MS, MEMORY_SCAN_MS, CLOUD_GATEWAY_ORIGIN, CLOUD_GATEWAY_BASE_PATH, QUEUED_PROMPT_CLASS, TRACE_DRAIN_TIMEOUT_MS, RECORDER_EVENTS_KEPT, owedBodyPurgeSchema, objectSchema, spoolFileSchema, otlpResourceListSchema, otlpPayloadSchema, defaultExecAsync, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
+var IDLE_COMMAND_POLL_FACTOR, DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, CHATGPT_LOGIN_CHECK_MS, MEMORY_SCAN_MS, CLOUD_GATEWAY_ORIGIN, CLOUD_GATEWAY_BASE_PATH, QUEUED_PROMPT_CLASS, TRACE_DRAIN_TIMEOUT_MS, RECORDER_EVENTS_KEPT, owedBodyPurgeSchema, objectSchema, spoolFileSchema, otlpResourceListSchema, otlpPayloadSchema, defaultExecAsync, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
 var init_daemon = __esm({
   "../../packages/tacho/src/collector/daemon.ts"() {
     "use strict";
@@ -60357,6 +60930,7 @@ var init_daemon = __esm({
     init_refused();
     init_session_heads();
     init_transcript_tailer();
+    IDLE_COMMAND_POLL_FACTOR = 8;
     DEFAULT_TIMERS = {
       shipMs: 5e3,
       bundleRefreshMs: 5 * 6e4,
@@ -60650,7 +61224,7 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync7,
   openSync as openSync8,
-  readSync as readSync4,
+  readSync as readSync5,
   realpathSync as realpathSync6,
   writeFileSync as writeFileSync4
 } from "node:fs";
@@ -60696,11 +61270,11 @@ function readBounded(root, relative11, limit = ARP_MAX_BLOB_BYTES) {
     const bytes = Buffer.alloc(stat7.size);
     let offset = 0;
     while (offset < bytes.length) {
-      const count12 = readSync4(fd2, bytes, offset, bytes.length - offset, offset);
+      const count12 = readSync5(fd2, bytes, offset, bytes.length - offset, offset);
       if (!count12) arpFail(`The bundle file ${relative11} changed while it was read.`);
       offset += count12;
     }
-    if (readSync4(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
+    if (readSync5(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
       arpFail(`The bundle file ${relative11} changed while it was read.`);
     return bytes;
   } finally {
@@ -60883,13 +61457,13 @@ function verifySettledEvidence(events) {
     }
   }
   if (tools.size || children.size || approvals.size) {
-    const open6 = [
+    const open7 = [
       ...[...tools].map((id2) => `tool ${id2}`),
       ...[...approvals].map((id2) => `approval ${id2}`),
       ...[...children].map((id2) => `child work ${id2}`)
     ];
     arpFail(
-      `The source has unsettled tools, approvals, or child work at its boundary: ${open6.join(", ")}.`
+      `The source has unsettled tools, approvals, or child work at its boundary: ${open7.join(", ")}.`
     );
   }
   const present = (value) => value !== void 0 && value !== null && value !== false && !(Array.isArray(value) && value.length === 0);
@@ -61621,7 +62195,7 @@ import {
   lstatSync as lstatSync9,
   mkdirSync as mkdirSync8,
   openSync as openSync9,
-  readSync as readSync5,
+  readSync as readSync6,
   realpathSync as realpathSync7,
   rmSync as rmSync9,
   writeFileSync as writeFileSync5
@@ -61647,14 +62221,14 @@ function readRegular(label2, path2, limit) {
     const bytes = Buffer.alloc(before.size);
     let offset = 0;
     while (offset < bytes.length) {
-      const count12 = readSync5(fd2, bytes, offset, bytes.length - offset, offset);
+      const count12 = readSync6(fd2, bytes, offset, bytes.length - offset, offset);
       if (count12 === 0)
         arpFail(
           `${label2} ${path2} changed while it was read. Stop its writer and capture again.`
         );
       offset += count12;
     }
-    if (readSync5(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
+    if (readSync6(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
       arpFail(
         `${label2} ${path2} grew while it was read. Stop its writer and capture again.`
       );
@@ -62672,7 +63246,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.5-63",
+      version: "2.1.5-69",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -62768,7 +63342,7 @@ var init_atomic_write = __esm({
 // src/lib/config.ts
 import { homedir as homedir9 } from "os";
 import { join as join51 } from "path";
-import { readFileSync as readFileSync25, mkdirSync as mkdirSync9, existsSync as existsSync27, statSync as statSync15 } from "fs";
+import { readFileSync as readFileSync25, mkdirSync as mkdirSync9, existsSync as existsSync27, statSync as statSync16 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -62798,7 +63372,7 @@ function parseConfig(raw) {
 function readConfig() {
   let identity;
   try {
-    const info = statSync15(CONFIG_FILE);
+    const info = statSync16(CONFIG_FILE);
     identity = `${info.ino}:${info.size}:${info.mtimeMs}`;
   } catch {
     cached2 = void 0;
@@ -87507,7 +88081,7 @@ __export(verify_exports, {
   readBundle: () => readBundle,
   verifyBundle: () => verifyBundle3
 });
-import { existsSync as existsSync30, readFileSync as readFileSync27, statSync as statSync16 } from "node:fs";
+import { existsSync as existsSync30, readFileSync as readFileSync27, statSync as statSync17 } from "node:fs";
 import { join as join61 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
@@ -87558,7 +88132,7 @@ function readBundle(path2) {
   if (!existsSync30(path2)) {
     throw new BundleReadError(`${path2} does not exist.`);
   }
-  return statSync16(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
+  return statSync17(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
 }
 function plural3(count12, one, many) {
   return `${count12} ${count12 === 1 ? one : many}`;
@@ -91257,7 +91831,7 @@ var init_upstream_tool = __esm({
 });
 
 // ../../packages/mcp-studio/src/contract/lock.ts
-var LOCK_BYTES_MAX, serverVersionSchema, lockPackageSchema, pypiLockFileSchema, fileOnlyForPypi, registryLockPackageSchema, remoteLockSourceSchema, urlOrPackage, transportOnlyWithUrl, launchOnlyWithPackage, registryLockSourceSchema, localLockSourceSchema, mcpLockSourceSchema, DEFINITION_LABELS, fromFitsType, definitionLockSourceSchema, versionSchema, definitionHashSchema, upstreamHashSchema, mcpLockedToolSchema, definitionLockedToolSchema, mcpLockSchema, definitionLockSchema, mcpToolsLockSchema;
+var LOCK_BYTES_MAX, PACKAGE_NAME_MAX, PACKAGE_VERSION_MAX, LAUNCH_ARG_MAX, LAUNCH_ARGS_MAX, serverVersionSchema, lockPackageSchema, pypiLockFileSchema, fileOnlyForPypi, registryLockPackageSchema, remoteLockSourceSchema, urlOrPackage, transportOnlyWithUrl, launchOnlyWithPackage, registryLockSourceSchema, localLockSourceSchema, mcpLockSourceSchema, DEFINITION_LABELS, fromFitsType, definitionLockSourceSchema, versionSchema, definitionHashSchema, upstreamHashSchema, mcpLockedToolSchema, definitionLockedToolSchema, mcpLockSchema, definitionLockSchema, mcpToolsLockSchema;
 var init_lock = __esm({
   "../../packages/mcp-studio/src/contract/lock.ts"() {
     "use strict";
@@ -91270,14 +91844,18 @@ var init_lock = __esm({
     init_primitives();
     init_server2();
     LOCK_BYTES_MAX = 5 * 1024 * 1024;
+    PACKAGE_NAME_MAX = 214;
+    PACKAGE_VERSION_MAX = 64;
+    LAUNCH_ARG_MAX = 4096;
+    LAUNCH_ARGS_MAX = 1024;
     serverVersionSchema = external_exports.string().min(1).max(64).optional().describe(
       "The version the server reported in initialize, when it reported one."
     );
     lockPackageSchema = external_exports.object({
-      name: external_exports.string().min(1).max(214).describe(
+      name: external_exports.string().min(1).max(PACKAGE_NAME_MAX).describe(
         "The package or binary: @modelcontextprotocol/server-filesystem."
       ),
-      version: external_exports.string().min(1).max(64),
+      version: external_exports.string().min(1).max(PACKAGE_VERSION_MAX),
       digest: sha256Schema2.describe("SHA-256 of the package or binary.")
     }).strict();
     pypiLockFileSchema = external_exports.object({
@@ -91380,7 +91958,7 @@ var init_lock = __esm({
         command: external_exports.string().min(1).max(1024).optional().describe(
           "For a package: the command the local gateway runs, npx, uvx, docker, or dnx."
         ),
-        args: external_exports.array(external_exports.string().max(4096)).max(1024).optional().describe(
+        args: external_exports.array(external_exports.string().max(LAUNCH_ARG_MAX)).max(LAUNCH_ARGS_MAX).optional().describe(
           "For a package: the command's arguments. ${NAME} stays for the local gateway to fill from the machine, and $$ writes one $."
         ),
         server_version: serverVersionSchema
@@ -92039,6 +92617,9 @@ function keyProblems(all, given, type) {
   }
   return problems;
 }
+function fromPackage(texts) {
+  return texts.map((text5) => ({ text: text5, field: "source.registry_type" }));
+}
 function words(slot, given, problems) {
   const { argument, label: label2, key } = slot;
   const field = key === void 0 ? "source.registry_type" : `source.arguments.${key}`;
@@ -92078,7 +92659,38 @@ function words(slot, given, problems) {
     }
     return [];
   }
-  return argument.type === "named" ? [literal2(argument.name), value] : [value];
+  const valueWord = { text: value, field };
+  return argument.type === "named" ? [...fromPackage([literal2(argument.name)]), valueWord] : [valueWord];
+}
+function lockLimitProblems(type, pkg, version2, launch) {
+  const problems = [];
+  if (pkg.identifier.length > PACKAGE_NAME_MAX) {
+    problems.push({
+      field: "source.registry_type",
+      message: `the ${type} package's identifier is ${pkg.identifier.length} characters long, and the lock holds at most ${PACKAGE_NAME_MAX}`
+    });
+  }
+  if (version2.length > PACKAGE_VERSION_MAX) {
+    problems.push({
+      field: "source.registry_type",
+      message: `the ${type} package's version is ${version2.length} characters long, and the lock holds at most ${PACKAGE_VERSION_MAX}`
+    });
+  }
+  launch.forEach(({ text: text5, field }, index) => {
+    if (text5.length > LAUNCH_ARG_MAX) {
+      problems.push({
+        field,
+        message: `args[${index}] is ${text5.length} characters long once each $ is written $$, and the lock holds at most ${LAUNCH_ARG_MAX}`
+      });
+    }
+  });
+  if (launch.length > LAUNCH_ARGS_MAX) {
+    problems.push({
+      field: "source.registry_type",
+      message: `the ${type} package's launch has ${launch.length} args, and the lock holds at most ${LAUNCH_ARGS_MAX}`
+    });
+  }
+  return problems;
 }
 function registryLaunch({
   source,
@@ -92144,18 +92756,22 @@ function registryLaunch({
   const reference = pinned !== void 0 ? ["--from", literal2(pinned.url), literal2(pkg.identifier)] : [
     `${literal2(pkg.identifier)}@${runner.pin === "digest" ? digest6 : literal2(version2)}`
   ];
-  const args = [
-    ...runner.flags,
-    ...type === "oci" ? env.flatMap((name) => ["-e", name]) : [],
+  const launch = [
+    ...fromPackage(runner.flags),
+    ...type === "oci" ? env.flatMap((name) => [
+      ...fromPackage(["-e"]),
+      { text: name, field: "source.env" }
+    ]) : [],
     ...runtime.flatMap((slot) => words(slot, given, problems)),
-    ...reference,
+    ...fromPackage(reference),
     ...packaged.flatMap((slot) => words(slot, given, problems))
   ];
+  problems.push(...lockLimitProblems(type, pkg, version2, launch));
   if (problems.length > 0) return { ok: false, problems };
   return {
     ok: true,
     command: runner.command,
-    args,
+    args: launch.map((word) => word.text),
     package: {
       name: pkg.identifier,
       version: version2,
@@ -92169,6 +92785,7 @@ var REGISTRY_RUNNERS2, ONE_VARIABLE;
 var init_registry_launch = __esm({
   "../../packages/mcp-studio/src/model/registry-launch.ts"() {
     "use strict";
+    init_lock();
     REGISTRY_RUNNERS2 = {
       npm: { command: "npx", flags: ["--yes"], pin: "version" },
       pypi: { command: "uvx", flags: [], pin: "file" },
@@ -106314,15 +106931,15 @@ var init_print = __esm({
       // ── Extensions ─────────────────────────────────────────────────────────────
       /** `extend` blocks, one for each run of extensions of the same message. */
       extensions(fields, scope, path2) {
-        let open6;
+        let open7;
         fields.forEach((field, index) => {
           const where = `the extension ${scope === "" ? "" : `${scope}.`}${field.name}`;
           if (field.extendee === "")
             this.refuse(`${where} names no message to extend`);
           if (isFieldSet(field, FieldDescriptorProtoSchema.field.oneofIndex))
             this.refuse(`${where} is in a oneof`);
-          if (field.extendee !== open6) {
-            if (open6 !== void 0) this.close();
+          if (field.extendee !== open7) {
+            if (open7 !== void 0) this.close();
             const extendee = this.typeName(
               field.extendee,
               scope,
@@ -106332,7 +106949,7 @@ var init_print = __esm({
             this.gap();
             this.line(`extend ${extendee} {`);
             this.depth += 1;
-            open6 = field.extendee;
+            open7 = field.extendee;
           }
           this.comment([...path2, index]);
           this.line(
@@ -106345,7 +106962,7 @@ var init_print = __esm({
             )
           );
         });
-        if (open6 !== void 0) this.close();
+        if (open7 !== void 0) this.close();
       }
       // ── Options ────────────────────────────────────────────────────────────────
       /**
@@ -106841,7 +107458,7 @@ function importOrder(sources, loaded) {
   const done = /* @__PURE__ */ new Set();
   const stack = [];
   const onStack = /* @__PURE__ */ new Set();
-  const open6 = (name, importer) => {
+  const open7 = (name, importer) => {
     const entry2 = load(name, importer, sources);
     loaded.set(name, entry2);
     const imports = entry2.kind === "source" ? entry2.parsed.header.imports.map((each) => each.path) : entry2.proto.dependency;
@@ -106850,7 +107467,7 @@ function importOrder(sources, loaded) {
   };
   for (const root of [...sources.keys()].sort()) {
     if (done.has(root)) continue;
-    open6(root, void 0);
+    open7(root, void 0);
     for (let top = stack.at(-1); top !== void 0; top = stack.at(-1)) {
       const next = top.imports[top.next];
       top.next += 1;
@@ -106863,7 +107480,7 @@ function importOrder(sources, loaded) {
         const at2 = stack.findIndex((frame) => frame.name === next);
         throw cycle([...stack.slice(at2).map((frame) => frame.name), next]);
       } else if (!done.has(next)) {
-        open6(next, top.name);
+        open7(next, top.name);
       }
     }
   }
@@ -107350,8 +107967,8 @@ var init_json_schema4 = __esm({
             description: `Cut: messages nest past ${DEPTH_MAX} levels here.`
           };
         }
-        const open6 = this.active.get(name) ?? 0;
-        if (open6 >= RECURSION_DEPTH) {
+        const open7 = this.active.get(name) ?? 0;
+        if (open7 >= RECURSION_DEPTH) {
           this.note(
             `Import cut the recursive message ${name} at depth ${RECURSION_DEPTH}.`
           );
@@ -107369,12 +107986,12 @@ var init_json_schema4 = __esm({
             description: `Cut: this tool's schemas passed ${count8(TOOL_NODES_SOFT_MAX)} nodes.`
           };
         }
-        this.active.set(name, open6 + 1);
+        this.active.set(name, open7 + 1);
         try {
           return this.fieldsOf(desc, direction, depth);
         } finally {
-          if (open6 === 0) this.active.delete(name);
-          else this.active.set(name, open6);
+          if (open7 === 0) this.active.delete(name);
+          else this.active.set(name, open7);
         }
       }
       fieldsOf(desc, direction, depth) {
@@ -107890,7 +108507,7 @@ function selectOutput(outputSchema, select) {
   return trimObject(outputSchema, selectTree(select));
 }
 function selectionProblem(selection) {
-  const open6 = [];
+  const open7 = [];
   let quoted3 = false;
   for (let index = 0; index < selection.length; index += 1) {
     const char = selection[index];
@@ -107900,15 +108517,15 @@ function selectionProblem(selection) {
       continue;
     }
     if (char === '"') quoted3 = true;
-    else if (char === "{" || char === "(") open6.push(char);
+    else if (char === "{" || char === "(") open7.push(char);
     else if (char === "}" || char === ")") {
       const expected = char === "}" ? "{" : "(";
-      if (open6.pop() !== expected)
+      if (open7.pop() !== expected)
         return `selection has an unmatched ${char} at character ${index + 1}.`;
     }
   }
   if (quoted3) return "selection has a string with no closing quote.";
-  const unclosed = open6.pop();
+  const unclosed = open7.pop();
   if (unclosed !== void 0) return `selection has an unclosed ${unclosed}.`;
   if (!/[_A-Za-z]/.test(selection)) return "selection names no field.";
   return void 0;
@@ -109691,8 +110308,7 @@ function locationWithoutQuery(location) {
     url = new URL(location);
   } catch {
     const cut = location.search(/[?#]/);
-    const head2 = cut === -1 ? location : location.slice(0, cut);
-    return head2.replace(/^\/\/[^/]*@/, "//");
+    return withoutUserinfo(cut === -1 ? location : location.slice(0, cut));
   }
   url.username = "";
   url.password = "";
@@ -109700,6 +110316,13 @@ function locationWithoutQuery(location) {
   url.hash = "";
   return url.href;
 }
+function withoutUserinfo(head2) {
+  const match = UNPARSED_USERINFO.exec(head2);
+  if (match === null) return head2;
+  const prefix = match[1] ?? "";
+  const rest = head2.slice(match[0].length);
+  return rest === "" || /^[\\/]/.test(rest) ? `${prefix}@${rest}` : `${prefix}${rest}`;
+}
 function recordedResponseHeaders(headers) {
   const out = /* @__PURE__ */ new Map();
   for (const [name, raw] of headers) {
@@ -109733,12 +110356,13 @@ function recordHttpResponse(response, bytes) {
     ...body2 === void 0 ? {} : { body: body2 }
   };
 }
-var REFUSED_RESPONSE_HEADERS;
+var UNPARSED_USERINFO, REFUSED_RESPONSE_HEADERS;
 var init_exchange = __esm({
   "../../packages/mcp-studio/src/execute/exchange.ts"() {
     "use strict";
     init_tests_files();
     init_body();
+    UNPARSED_USERINFO = /^([A-Za-z][A-Za-z0-9+.-]*:[\\/]*|[\\/]{2})[^/\\]*@/;
     REFUSED_RESPONSE_HEADERS = new Set(
       CREDENTIAL_RESPONSE_HEADERS
     );
@@ -110248,14 +110872,17 @@ async function notifyInitialized(session) {
   });
   return read2.ok ? { ok: true, value: void 0 } : read2;
 }
-async function callTool2(session) {
-  const { template, args } = session.call;
-  const sent = await post(session, {
+function toolsCallMessage(template, args) {
+  return {
     jsonrpc: "2.0",
     id: CALL_ID,
     method: "tools/call",
     params: { name: template.tool, arguments: args }
-  });
+  };
+}
+async function callTool2(session) {
+  const { template, args } = session.call;
+  const sent = await post(session, toolsCallMessage(template, args));
   if (!sent.ok) return { attempt: sent, exchange: void 0 };
   const response = sent.value;
   if (response.status < 200 || response.status >= 300) {
@@ -111171,7 +111798,7 @@ async function attemptCall(call2, context, deadline, settings) {
   const controller = new AbortController();
   const clock2 = new Clock(deadline, context.signal, controller);
   try {
-    const opening = open4(context.transport, {
+    const opening = open5(context.transport, {
       ...call2.request,
       deadline_ms: Math.max(1, deadline - Date.now()),
       signal: controller.signal
@@ -111191,7 +111818,7 @@ async function attemptCall(call2, context, deadline, settings) {
     clock2.dispose();
   }
 }
-async function open4(transport, request3) {
+async function open5(transport, request3) {
   return transport.grpc(request3);
 }
 async function read(response, call2, clock2, settings) {
@@ -130596,6 +131223,19 @@ var init_transport2 = __esm({
   }
 });
 
+// ../../packages/mcp-studio/src/execute/request-size.ts
+var init_request_size = __esm({
+  "../../packages/mcp-studio/src/execute/request-size.ts"() {
+    "use strict";
+    init_body();
+    init_graphql2();
+    init_http();
+    init_mcp();
+    init_shape_input();
+    init_util4();
+  }
+});
+
 // ../../packages/mcp-studio/src/execute/index.ts
 var init_execute = __esm({
   "../../packages/mcp-studio/src/execute/index.ts"() {
@@ -130612,6 +131252,7 @@ var init_execute = __esm({
     init_http();
     init_mcp();
     init_senders();
+    init_request_size();
     init_validate();
     init_body();
     init_http_call();
@@ -133315,7 +133956,7 @@ import {
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync30,
   readlinkSync as readlinkSync4,
-  statSync as statSync17
+  statSync as statSync18
 } from "node:fs";
 import { dirname as dirname36, isAbsolute as isAbsolute18, join as join64, relative as relative9, resolve as resolve25, sep as sep12 } from "node:path";
 function git5(cwd, args, input) {
@@ -133428,14 +134069,14 @@ function chooseBase(root, ref2) {
 }
 function isFile(path2) {
   try {
-    return statSync17(path2).isFile();
+    return statSync18(path2).isFile();
   } catch {
     return false;
   }
 }
 function isDir(path2) {
   try {
-    return statSync17(path2).isDirectory();
+    return statSync18(path2).isDirectory();
   } catch {
     return false;
   }
@@ -136727,16 +137368,16 @@ function assignmentValue(bytes, assignment, nameStart, nameEnd) {
   if (!assignment.names.some((k) => containsLower(name, k))) return null;
   while (isBlank2(bytes[p])) p += 1;
   if (p >= n2) return null;
-  const open6 = bytes[p];
+  const open7 = bytes[p];
   let start;
   let end;
   let quoted3;
-  if (open6 === QUOTE || open6 === APOSTROPHE || open6 === BACKTICK) {
+  if (open7 === QUOTE || open7 === APOSTROPHE || open7 === BACKTICK) {
     start = p + 1;
     end = start;
-    while (end < n2 && bytes[end] !== open6 && bytes[end] !== NEWLINE2)
+    while (end < n2 && bytes[end] !== open7 && bytes[end] !== NEWLINE2)
       end += bytes[end] === BACKSLASH ? 2 : 1;
-    if (end >= n2 || bytes[end] !== open6) return null;
+    if (end >= n2 || bytes[end] !== open7) return null;
     quoted3 = true;
   } else {
     start = p;
@@ -137912,7 +138553,7 @@ __export(logs_exports, {
   handleLogs: () => handleLogs
 });
 import { watch } from "node:fs";
-import { open as open5, stat as stat6 } from "node:fs/promises";
+import { open as open6, stat as stat6 } from "node:fs/promises";
 function formatEntry(entry2) {
   const head2 = `${entry2.ts}  ${entry2.category.padEnd(11)} ${entry2.event}`;
   if (entry2.data === void 0) return head2;
@@ -137943,7 +138584,7 @@ async function logSize(file) {
 async function readAppended(file, offset) {
   let handle;
   try {
-    handle = await open5(file, "r");
+    handle = await open6(file, "r");
   } catch {
     return { entries: [], offset: 0 };
   }