@quantiya/codevibe-codex-plugin 2.0.116 → 2.0.117

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -9490,7 +9490,7 @@ function resolveSpawnSweepHelper(opts = {}) {
   for (let dir of opts.nativeDirs ?? packageNativeDirs()) {
     let manifestText;
     try {
-      manifestText = fs61.readFileSync(path72.join(dir, SPAWN_SWEEP_MANIFEST), "utf8");
+      manifestText = fs62.readFileSync(path72.join(dir, SPAWN_SWEEP_MANIFEST), "utf8");
     } catch {
       continue;
     }
@@ -9498,7 +9498,7 @@ function resolveSpawnSweepHelper(opts = {}) {
     if (!manifest) return { ok: !1, reason: `the spawn-sweep manifest at ${dir} is malformed` };
     let expected = manifest.targets[target2].sha256, bin = path72.join(dir, target2, SPAWN_SWEEP_BINARY), st;
     try {
-      st = fs61.lstatSync(bin), st.isFile() && st.uid === uid && (st.mode & 18) !== 0 && (fs61.chmodSync(bin, st.mode & 493), st = fs61.lstatSync(bin));
+      st = fs62.lstatSync(bin), st.isFile() && st.uid === uid && (st.mode & 18) !== 0 && (fs62.chmodSync(bin, st.mode & 493), st = fs62.lstatSync(bin));
     } catch {
       return { ok: !1, reason: `the spawn-sweep helper is missing at ${bin}` };
     }
@@ -9507,14 +9507,14 @@ function resolveSpawnSweepHelper(opts = {}) {
     if ((st.mode & 18) !== 0) return { ok: !1, reason: `the spawn-sweep helper at ${bin} is writable by group or others` };
     if (st.uid !== uid && st.uid !== 0) return { ok: !1, reason: `the spawn-sweep helper at ${bin} is owned by another user` };
     let key = `${st.dev}:${st.ino}:${st.size}:${st.mtimeMs}:${st.ctimeMs}`, cached2 = verified.get(bin), sha2568;
-    return cached2 && cached2.key === key ? sha2568 = cached2.sha256 : (sha2568 = (0, import_node_crypto44.createHash)("sha256").update(fs61.readFileSync(bin)).digest("hex"), verified.set(bin, { key, sha256: sha2568 })), sha2568 !== expected ? { ok: !1, reason: `the spawn-sweep helper at ${bin} does not match its pinned digest` } : { ok: !0, path: bin, sha256: sha2568, target: target2 };
+    return cached2 && cached2.key === key ? sha2568 = cached2.sha256 : (sha2568 = (0, import_node_crypto44.createHash)("sha256").update(fs62.readFileSync(bin)).digest("hex"), verified.set(bin, { key, sha256: sha2568 })), sha2568 !== expected ? { ok: !1, reason: `the spawn-sweep helper at ${bin} does not match its pinned digest` } : { ok: !0, path: bin, sha256: sha2568, target: target2 };
   }
   return { ok: !1, reason: "the spawn-sweep helper is not installed with this package" };
 }
-var import_node_crypto44, fs61, path72, SPAWN_SWEEP_MANIFEST, SPAWN_SWEEP_BINARY, verified, init_spawn_sweep_binary = __esm({
+var import_node_crypto44, fs62, path72, SPAWN_SWEEP_MANIFEST, SPAWN_SWEEP_BINARY, verified, init_spawn_sweep_binary = __esm({
   "src/local-executor/spawn-sweep-binary.ts"() {
     "use strict";
-    import_node_crypto44 = require("node:crypto"), fs61 = __toESM(require("node:fs")), path72 = __toESM(require("node:path")), SPAWN_SWEEP_MANIFEST = "spawn-sweep.json", SPAWN_SWEEP_BINARY = "codevibe-spawn-sweep";
+    import_node_crypto44 = require("node:crypto"), fs62 = __toESM(require("node:fs")), path72 = __toESM(require("node:path")), SPAWN_SWEEP_MANIFEST = "spawn-sweep.json", SPAWN_SWEEP_BINARY = "codevibe-spawn-sweep";
     verified = /* @__PURE__ */ new Map();
   }
 });
@@ -9536,7 +9536,7 @@ function encodeSpawnRecord(rec) {
 }
 function defaultReadProcStat(pid) {
   try {
-    let content = import_node_fs35.default.readFileSync(`/proc/${pid}/stat`, "utf8"), closeParen = content.lastIndexOf(")");
+    let content = import_node_fs36.default.readFileSync(`/proc/${pid}/stat`, "utf8"), closeParen = content.lastIndexOf(")");
     if (closeParen < 0) return { kind: "error", reason: "malformed comm parens" };
     let rest = content.slice(closeParen + 2).trim().split(/\s+/), ppid = parseInt(rest[1], 10), starttime = rest[19];
     return Number.isNaN(ppid) || !starttime ? { kind: "error", reason: "unparsable ppid or starttime" } : { kind: "ok", ppid, starttime };
@@ -9804,10 +9804,10 @@ async function executeSpawnSweep(opts) {
     });
   });
 }
-var import_node_child_process15, import_node_crypto45, import_node_fs35, import_node_path4, activeSpawnSweeps, init_spawn_sweep = __esm({
+var import_node_child_process15, import_node_crypto45, import_node_fs36, import_node_path4, activeSpawnSweeps, init_spawn_sweep = __esm({
   "src/local-executor/spawn-sweep.ts"() {
     "use strict";
-    import_node_child_process15 = __toESM(require("node:child_process")), import_node_crypto45 = __toESM(require("node:crypto")), import_node_fs35 = __toESM(require("node:fs")), import_node_path4 = __toESM(require("node:path"));
+    import_node_child_process15 = __toESM(require("node:child_process")), import_node_crypto45 = __toESM(require("node:crypto")), import_node_fs36 = __toESM(require("node:fs")), import_node_path4 = __toESM(require("node:path"));
     init_logger2();
     init_spawn_sweep_binary();
     activeSpawnSweeps = /* @__PURE__ */ new Map();
@@ -9838,15 +9838,15 @@ function spawnFilterPath(stateRoot, taskId, spawnId) {
 }
 async function writeDurable2(file, body2, exclusive) {
   let dir = path74.dirname(file);
-  await fs63.mkdir(dir, { recursive: !0, mode: 448 });
-  let target2 = exclusive ? file : `${file}.${process.pid}.${Date.now()}.tmp`, handle = await fs63.open(target2, "wx", 384);
+  await fs64.mkdir(dir, { recursive: !0, mode: 448 });
+  let target2 = exclusive ? file : `${file}.${process.pid}.${Date.now()}.tmp`, handle = await fs64.open(target2, "wx", 384);
   try {
     await handle.writeFile(body2, "utf8"), await handle.sync();
   } finally {
     await handle.close();
   }
-  exclusive || await fs63.rename(target2, file);
-  let dirHandle = await fs63.open(dir, "r");
+  exclusive || await fs64.rename(target2, file);
+  let dirHandle = await fs64.open(dir, "r");
   try {
     await dirHandle.sync();
   } finally {
@@ -9885,9 +9885,9 @@ async function readSpawnRecord(file) {
   if (!match) return null;
   let text2;
   try {
-    let st = await fs63.lstat(file);
+    let st = await fs64.lstat(file);
     if (!st.isFile() || st.size > MAX_RECORD_BYTES2) return null;
-    text2 = await fs63.readFile(file, "utf8");
+    text2 = await fs64.readFile(file, "utf8");
   } catch {
     return null;
   }
@@ -9934,13 +9934,13 @@ function sweepRecordOf(record2) {
 async function removeExactDirectory(dir) {
   let st;
   try {
-    st = await fs63.lstat(dir);
+    st = await fs64.lstat(dir);
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
   }
   if (!st.isDirectory()) throw new Error(`spawn folder ${dir} is not a directory; left in place`);
-  await fs63.rm(dir, { recursive: !0, force: !0 });
+  await fs64.rm(dir, { recursive: !0, force: !0 });
 }
 async function removeRecordedSpawn(stateRoot, record2, opts) {
   let recordFile = spawnRecordPath(stateRoot, record2.taskId, record2.spawnId);
@@ -9956,12 +9956,12 @@ async function removeRecordedSpawn(stateRoot, record2, opts) {
         blockers: result.blockers.map((b) => b.reason)
       }), !1;
   }
-  return await removeExactDirectory(record2.folder), await fs63.rm(spawnFilterPath(stateRoot, record2.taskId, record2.spawnId), { force: !0 }), await fs63.rm(recordFile, { force: !0 }), !0;
+  return await removeExactDirectory(record2.folder), await fs64.rm(spawnFilterPath(stateRoot, record2.taskId, record2.spawnId), { force: !0 }), await fs64.rm(recordFile, { force: !0 }), !0;
 }
 async function sweepOrphanSpawnRecords(stateRoot, deps = {}) {
   let result = { removed: [], blockedTaskIds: /* @__PURE__ */ new Set(), retained: [] }, isOwnerAlive = deps.isOwnerAlive ?? isProcessIdentityAlive, dirs;
   try {
-    dirs = await fs63.readdir(stateRoot, { withFileTypes: !0 });
+    dirs = await fs64.readdir(stateRoot, { withFileTypes: !0 });
   } catch (err) {
     if (err.code === "ENOENT") return result;
     throw err;
@@ -9970,7 +9970,7 @@ async function sweepOrphanSpawnRecords(stateRoot, deps = {}) {
     if (!dir.isDirectory() || dir.isSymbolicLink()) continue;
     let stateDir = path74.join(stateRoot, dir.name), files;
     try {
-      files = await fs63.readdir(stateDir);
+      files = await fs64.readdir(stateDir);
     } catch {
       continue;
     }
@@ -9996,10 +9996,10 @@ async function sweepOrphanSpawnRecords(stateRoot, deps = {}) {
   }
   return result;
 }
-var fsSync6, fs63, path74, SPAWN_ID_RE, SPAWN_RECORD_FILE_RE, ADVISORY_STATE_DIR, MAX_RECORD_BYTES2, defaultSweep, init_spawn_records = __esm({
+var fsSync6, fs64, path74, SPAWN_ID_RE, SPAWN_RECORD_FILE_RE, ADVISORY_STATE_DIR, MAX_RECORD_BYTES2, defaultSweep, init_spawn_records = __esm({
   "src/substrate/spawn-records.ts"() {
     "use strict";
-    fsSync6 = __toESM(require("node:fs")), fs63 = __toESM(require("node:fs/promises")), path74 = __toESM(require("node:path"));
+    fsSync6 = __toESM(require("node:fs")), fs64 = __toESM(require("node:fs/promises")), path74 = __toESM(require("node:path"));
     init_logger2();
     init_process_identity();
     init_spawn_sweep();
@@ -10274,9 +10274,9 @@ function getPacketFilePath(taskId, homeDir = os46.homedir()) {
   return path96.join(getTaskDirectoryPath(taskId, homeDir), "CONTINUATION.md");
 }
 async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
-  if (await import_node_fs43.promises.mkdir(taskDir, { recursive: !0, mode: 448 }), process.platform !== "win32")
+  if (await import_node_fs44.promises.mkdir(taskDir, { recursive: !0, mode: 448 }), process.platform !== "win32")
     try {
-      await import_node_fs43.promises.chmod(taskDir, 448);
+      await import_node_fs44.promises.chmod(taskDir, 448);
     } catch (err) {
       throw new PacketIoError(
         `chmod ${taskDir} 0o700 failed: ${err.message}`,
@@ -10288,11 +10288,11 @@ async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
     `CONTINUATION.md.${pid}.${ts}.${randHex}.tmp`
   ), tmpHandle = null;
   try {
-    tmpHandle = await import_node_fs43.promises.open(
+    tmpHandle = await import_node_fs44.promises.open(
       tmpPath,
-      import_node_fs43.constants.O_WRONLY | import_node_fs43.constants.O_CREAT | import_node_fs43.constants.O_TRUNC,
+      import_node_fs44.constants.O_WRONLY | import_node_fs44.constants.O_CREAT | import_node_fs44.constants.O_TRUNC,
       384
-    ), await tmpHandle.writeFile(bytes, { encoding: "utf8" }), await tmpHandle.sync(), await tmpHandle.close(), tmpHandle = null, process.platform !== "win32" && await import_node_fs43.promises.chmod(tmpPath, 384), await import_node_fs43.promises.rename(tmpPath, finalPath);
+    ), await tmpHandle.writeFile(bytes, { encoding: "utf8" }), await tmpHandle.sync(), await tmpHandle.close(), tmpHandle = null, process.platform !== "win32" && await import_node_fs44.promises.chmod(tmpPath, 384), await import_node_fs44.promises.rename(tmpPath, finalPath);
   } catch (err) {
     if (tmpHandle)
       try {
@@ -10300,7 +10300,7 @@ async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
       } catch {
       }
     try {
-      await import_node_fs43.promises.unlink(tmpPath);
+      await import_node_fs44.promises.unlink(tmpPath);
     } catch {
     }
     throw new PacketIoError(
@@ -10310,7 +10310,7 @@ async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
   }
   if (process.platform !== "win32")
     try {
-      let dirHandle = await import_node_fs43.promises.open(taskDir, import_node_fs43.constants.O_RDONLY);
+      let dirHandle = await import_node_fs44.promises.open(taskDir, import_node_fs44.constants.O_RDONLY);
       try {
         await dirHandle.sync();
       } finally {
@@ -10365,7 +10365,7 @@ function createContinuationPacketWriter(deps) {
         });
         if (result.kind === "error") {
           try {
-            await import_node_fs43.promises.unlink(finalPath);
+            await import_node_fs44.promises.unlink(finalPath);
           } catch {
           }
           throw new PacketAuditEmitError(result.reason);
@@ -10389,10 +10389,10 @@ function createContinuationPacketWriter(deps) {
     }
   };
 }
-var import_node_fs43, path96, os46, crypto31, import_json_freeze15, import_yaml, Mutex, WORK_NOT_ENUMERATED_SENTINEL, VERIFICATION_NOT_RECORDED_SENTINEL, init_packet_writer = __esm({
+var import_node_fs44, path96, os46, crypto31, import_json_freeze15, import_yaml, Mutex, WORK_NOT_ENUMERATED_SENTINEL, VERIFICATION_NOT_RECORDED_SENTINEL, init_packet_writer = __esm({
   "src/continuation/packet-writer.ts"() {
     "use strict";
-    import_node_fs43 = require("node:fs"), path96 = __toESM(require("node:path")), os46 = __toESM(require("node:os")), crypto31 = __toESM(require("node:crypto")), import_json_freeze15 = require("json-freeze"), import_yaml = require("yaml");
+    import_node_fs44 = require("node:fs"), path96 = __toESM(require("node:path")), os46 = __toESM(require("node:os")), crypto31 = __toESM(require("node:crypto")), import_json_freeze15 = require("json-freeze"), import_yaml = require("yaml");
     init_types();
     init_dirty_state_collector();
     Mutex = class {
@@ -10591,7 +10591,7 @@ function resolveOnHostPath(cmd, hostPath = process.env.PATH ?? "") {
     if (!dir.startsWith("/")) continue;
     let candidate = path97.join(dir, cmd);
     try {
-      return fs77.accessSync(candidate, fs77.constants.X_OK), candidate;
+      return fs78.accessSync(candidate, fs78.constants.X_OK), candidate;
     } catch {
     }
   }
@@ -10599,7 +10599,7 @@ function resolveOnHostPath(cmd, hostPath = process.env.PATH ?? "") {
 }
 function xdgUserDirs(homedir47) {
   try {
-    let text2 = fs77.readFileSync(path97.join(homedir47, ".config", "user-dirs.dirs"), "utf8"), out = [];
+    let text2 = fs78.readFileSync(path97.join(homedir47, ".config", "user-dirs.dirs"), "utf8"), out = [];
     for (let m of text2.matchAll(/^XDG_(DESKTOP|DOCUMENTS|DOWNLOAD|MUSIC|PICTURES|PUBLICSHARE|TEMPLATES|VIDEOS)_DIR="([^"]*)"/gm))
       out.push(m[2].replace(/^\$HOME/, homedir47));
     return out;
@@ -10709,7 +10709,7 @@ function scanGrantRoot(root, bounds = { maxEntries: 2e5, maxMs: 1e4 }, now = Dat
   for (; stack.length > 0; ) {
     let { dir, rel } = stack.pop(), list;
     try {
-      list = fs77.readdirSync(dir, { withFileTypes: !0 });
+      list = fs78.readdirSync(dir, { withFileTypes: !0 });
     } catch {
       continue;
     }
@@ -10732,10 +10732,10 @@ function agentBinaryFolders(resolvedArgv0, realArgv0, input) {
   }
   return { folders };
 }
-var fs77, path97, inside, strictlyInside, CA_PEM, init_grant_rule = __esm({
+var fs78, path97, inside, strictlyInside, CA_PEM, init_grant_rule = __esm({
   "src/substrate/grant-rule.ts"() {
     "use strict";
-    fs77 = __toESM(require("node:fs")), path97 = __toESM(require("node:path"));
+    fs78 = __toESM(require("node:fs")), path97 = __toESM(require("node:path"));
     inside = (p, root) => p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`), strictlyInside = (p, root) => p !== root && inside(p, root);
     CA_PEM = /^(cacert.*\.pem|ca-bundle.*\.pem|ca-certificates.*\.pem|ca\.pem|cert\.pem|.*chain.*\.pem)$/;
   }
@@ -10949,7 +10949,7 @@ function defaultTierRelayPath() {
   ];
   for (let candidate of candidates)
     try {
-      if (import_node_fs44.default.statSync(candidate).isFile()) return import_node_fs44.default.realpathSync(candidate);
+      if (import_node_fs45.default.statSync(candidate).isFile()) return import_node_fs45.default.realpathSync(candidate);
     } catch {
     }
   return null;
@@ -10959,7 +10959,7 @@ function buildExecArgv2(plan, argv) {
   if (!resolved) throw new SubstrateUnavailableError("bubblewrap", `agent binary '${argv[0]}' not found on the host PATH`);
   let real = resolved;
   try {
-    real = import_node_fs44.default.realpathSync(resolved);
+    real = import_node_fs45.default.realpathSync(resolved);
   } catch {
   }
   let folders = agentBinaryFolders(resolved, real, {
@@ -10969,7 +10969,7 @@ function buildExecArgv2(plan, argv) {
     xdgRuntimeDir: process.env.XDG_RUNTIME_DIR,
     realpath: (p) => {
       try {
-        return import_node_fs44.default.realpathSync(p);
+        return import_node_fs45.default.realpathSync(p);
       } catch {
         return null;
       }
@@ -10999,10 +10999,10 @@ function buildExecArgv2(plan, argv) {
     hidden.some((root) => insideOrEqual(own2.host, root) || insideOrEqual(own2.target, root)) && segment.push(own2.mode === "ro" ? "--ro-bind" : "--bind", own2.host, own2.target);
   return [...plan.chain, ...plan.pre, ...segment, ...plan.post, ...argv];
 }
-var import_promises5, import_node_fs44, import_node_os2, import_node_path5, import_node_crypto53, import_node_net, BPF_LD, BPF_W, BPF_ABS, BPF_ALU, BPF_AND, BPF_K, BPF_JMP, BPF_JEQ, BPF_RET, SECCOMP_RET_KILL_PROCESS, SECCOMP_RET_ALLOW, SECCOMP_RET_ERRNO, EAFNOSUPPORT, ENOSYS, AUDIT_ARCH_X86_64, AUDIT_ARCH_AARCH64, AUDIT_ARCH_I386, AUDIT_ARCH_ARM, insideOrEqual, BubblewrapHandle, BubblewrapSubstrate, init_bwrap = __esm({
+var import_promises5, import_node_fs45, import_node_os2, import_node_path5, import_node_crypto53, import_node_net, BPF_LD, BPF_W, BPF_ABS, BPF_ALU, BPF_AND, BPF_K, BPF_JMP, BPF_JEQ, BPF_RET, SECCOMP_RET_KILL_PROCESS, SECCOMP_RET_ALLOW, SECCOMP_RET_ERRNO, EAFNOSUPPORT, ENOSYS, AUDIT_ARCH_X86_64, AUDIT_ARCH_AARCH64, AUDIT_ARCH_I386, AUDIT_ARCH_ARM, insideOrEqual, BubblewrapHandle, BubblewrapSubstrate, init_bwrap = __esm({
   "src/substrate/bwrap.ts"() {
     "use strict";
-    import_promises5 = __toESM(require("node:fs/promises")), import_node_fs44 = __toESM(require("node:fs")), import_node_os2 = __toESM(require("node:os")), import_node_path5 = __toESM(require("node:path")), import_node_crypto53 = __toESM(require("node:crypto")), import_node_net = __toESM(require("node:net"));
+    import_promises5 = __toESM(require("node:fs/promises")), import_node_fs45 = __toESM(require("node:fs")), import_node_os2 = __toESM(require("node:os")), import_node_path5 = __toESM(require("node:path")), import_node_crypto53 = __toESM(require("node:crypto")), import_node_net = __toESM(require("node:net"));
     init_errors();
     init_relay_channel();
     init_spawn_records();
@@ -11161,7 +11161,7 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
       }
     }, BubblewrapSubstrate = class {
       constructor(deps = {}) {
-        this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.platform = deps.platform ?? process.platform, this.homedir = deps.homedir ?? import_node_os2.default.homedir(), this.stateRoot = deps.stateRoot ?? import_node_path5.default.join(this.homedir, ".codevibe", "shadow-state-v2"), this.cacheRoot = deps.cacheRoot, this.desktopPid = deps.desktopPid ?? process.pid, this.uid = deps.uid ?? (typeof process.getuid == "function" ? process.getuid() : 1e3), this.gid = deps.gid ?? (typeof process.getgid == "function" ? process.getgid() : 1e3), this.fsShim = deps.fsShim, this.tierRelayPath = deps.tierRelayPath, this.nodePath = deps.nodePath ?? process.execPath, this.readBootId = deps.readBootId ?? (() => import_node_fs44.default.readFileSync("/proc/sys/kernel/random/boot_id", "utf8")), this.runSweep = deps.runSweep, this.readProcStat = deps.readProcStat;
+        this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.platform = deps.platform ?? process.platform, this.homedir = deps.homedir ?? import_node_os2.default.homedir(), this.stateRoot = deps.stateRoot ?? import_node_path5.default.join(this.homedir, ".codevibe", "shadow-state-v2"), this.cacheRoot = deps.cacheRoot, this.desktopPid = deps.desktopPid ?? process.pid, this.uid = deps.uid ?? (typeof process.getuid == "function" ? process.getuid() : 1e3), this.gid = deps.gid ?? (typeof process.getgid == "function" ? process.getgid() : 1e3), this.fsShim = deps.fsShim, this.tierRelayPath = deps.tierRelayPath, this.nodePath = deps.nodePath ?? process.execPath, this.readBootId = deps.readBootId ?? (() => import_node_fs45.default.readFileSync("/proc/sys/kernel/random/boot_id", "utf8")), this.runSweep = deps.runSweep, this.readProcStat = deps.readProcStat;
       }
       async launch(spec) {
         if (this.platform !== "linux")
@@ -11180,7 +11180,7 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
             host: "127.0.0.1",
             port: Number(match[2]),
             relayPath,
-            nodePath: (this.fsShim?.realpathSync ?? import_node_fs44.default.realpathSync)(this.nodePath)
+            nodePath: (this.fsShim?.realpathSync ?? import_node_fs45.default.realpathSync)(this.nodePath)
           };
         }
         let adopted = spec.spawnFolder, spawnId = adopted?.spawnId ?? import_node_crypto53.default.randomBytes(8).toString("hex"), taskSegment = spec.taskId || "advisory", taskStateDir = import_node_path5.default.join(this.stateRoot, taskSegment);
@@ -11225,7 +11225,7 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
           );
           for (let d of ["/bin", "/sbin", "/lib", "/lib32", "/lib64", "/libx32"])
             try {
-              let lstat30 = this.fsShim?.lstatSync ?? import_node_fs44.default.lstatSync, readlink4 = this.fsShim?.readlinkSync ?? import_node_fs44.default.readlinkSync;
+              let lstat30 = this.fsShim?.lstatSync ?? import_node_fs45.default.lstatSync, readlink4 = this.fsShim?.readlinkSync ?? import_node_fs45.default.readlinkSync;
               if (lstat30(d).isSymbolicLink()) {
                 let target2 = readlink4(d);
                 bwrapArgs.push("--symlink", target2, d);
@@ -11243,7 +11243,7 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
           ), isOpenEgress) {
             let resolvedResolv = null;
             try {
-              let exists = this.fsShim?.existsSync ?? import_node_fs44.default.existsSync, realpath19 = this.fsShim?.realpathSync ?? import_node_fs44.default.realpathSync;
+              let exists = this.fsShim?.existsSync ?? import_node_fs45.default.existsSync, realpath19 = this.fsShim?.realpathSync ?? import_node_fs45.default.realpathSync;
               if (!exists("/etc/resolv.conf"))
                 throw new Error("Host DNS configuration /etc/resolv.conf does not exist");
               resolvedResolv = realpath19("/etc/resolv.conf");
@@ -11300,7 +11300,7 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
               xdgUserDirs: xdgUserDirs(homedir47),
               isWsl: /microsoft/i.test((() => {
                 try {
-                  return import_node_fs44.default.readFileSync("/proc/version", "utf8");
+                  return import_node_fs45.default.readFileSync("/proc/version", "utf8");
                 } catch {
                   return "";
                 }
@@ -11309,14 +11309,14 @@ var import_promises5, import_node_fs44, import_node_os2, import_node_path5, impo
               defaultPath: ["/usr/local/bin", "/usr/bin", "/bin"],
               realpath: (p) => {
                 try {
-                  return import_node_fs44.default.realpathSync(p);
+                  return import_node_fs45.default.realpathSync(p);
                 } catch {
                   return null;
                 }
               },
               isDirectory: (p) => {
                 try {
-                  return import_node_fs44.default.statSync(p).isDirectory();
+                  return import_node_fs45.default.statSync(p).isDirectory();
                 } catch {
                   return !1;
                 }
@@ -11492,7 +11492,7 @@ function companionPreferenceFilePath() {
 async function readCompanionPreference() {
   let filePath = companionPreferenceFilePath(), raw, st;
   try {
-    st = await fs98.stat(filePath);
+    st = await fs99.stat(filePath);
   } catch (err) {
     return err?.code !== "ENOENT" && logger.debug("[companion-preference] stat error \u2014 treating as missing", {
       filePath,
@@ -11505,7 +11505,7 @@ async function readCompanionPreference() {
 `
     ), null;
   try {
-    raw = await fs98.readFile(filePath, "utf8");
+    raw = await fs99.readFile(filePath, "utf8");
   } catch (err) {
     return logger.debug("[companion-preference] read error \u2014 treating as missing", {
       filePath,
@@ -11523,19 +11523,19 @@ async function readCompanionPreference() {
 }
 async function persistCompanionPreference(pref) {
   let filePath = companionPreferenceFilePath(), dir = path119.dirname(filePath);
-  await fs98.mkdir(dir, { recursive: !0 }), await fs98.writeFile(filePath, JSON.stringify(pref, null, 2), {
+  await fs99.mkdir(dir, { recursive: !0 }), await fs99.writeFile(filePath, JSON.stringify(pref, null, 2), {
     encoding: "utf8",
     mode: 384
   });
   try {
-    await fs98.chmod(filePath, 384);
+    await fs99.chmod(filePath, 384);
   } catch {
   }
 }
-var fs98, path119, os59, import_zod17, CompanionPreferenceSchema, init_persist_preference = __esm({
+var fs99, path119, os59, import_zod17, CompanionPreferenceSchema, init_persist_preference = __esm({
   "src/companion-mode/persist-preference.ts"() {
     "use strict";
-    fs98 = __toESM(require("fs/promises")), path119 = __toESM(require("path")), os59 = __toESM(require("os")), import_zod17 = require("zod");
+    fs99 = __toESM(require("fs/promises")), path119 = __toESM(require("path")), os59 = __toESM(require("os")), import_zod17 = require("zod");
     init_logger2();
     CompanionPreferenceSchema = import_zod17.z.object({
       lastAgent: import_zod17.z.union([
@@ -11600,13 +11600,13 @@ function isContainedPath(parent, candidate) {
 }
 function resolveDeclaredCompanionLauncher(packageJsonPath) {
   try {
-    let packageRoot = fs99.realpathSync(path120.dirname(packageJsonPath)), declared = JSON.parse(
-      fs99.readFileSync(packageJsonPath, "utf8")
+    let packageRoot = fs100.realpathSync(path120.dirname(packageJsonPath)), declared = JSON.parse(
+      fs100.readFileSync(packageJsonPath, "utf8")
     ).codevibe?.companionLauncher;
     if (typeof declared != "string" || declared.trim().length === 0)
       return null;
-    let launcherPath = fs99.realpathSync(path120.resolve(packageRoot, declared));
-    return !isContainedPath(packageRoot, launcherPath) || !fs99.statSync(launcherPath).isFile() ? null : (fs99.accessSync(launcherPath, fs99.constants.X_OK), launcherPath);
+    let launcherPath = fs100.realpathSync(path120.resolve(packageRoot, declared));
+    return !isContainedPath(packageRoot, launcherPath) || !fs100.statSync(launcherPath).isFile() ? null : (fs100.accessSync(launcherPath, fs100.constants.X_OK), launcherPath);
   } catch {
     return null;
   }
@@ -11716,10 +11716,10 @@ async function runCompanionMode(args) {
     process.kill(process.pid, signal);
   }))(child.signal), 1) : child.status ?? 1;
 }
-var import_child_process12, import_module, path120, fs99, NoAgentInstalledError, COMPANION_PLUGIN, ACTIVE_COMPANION_AGENTS, ACTIVATION_AGENT, init_companion_mode = __esm({
+var import_child_process12, import_module, path120, fs100, NoAgentInstalledError, COMPANION_PLUGIN, ACTIVE_COMPANION_AGENTS, ACTIVATION_AGENT, init_companion_mode = __esm({
   "src/companion-mode/index.ts"() {
     "use strict";
-    import_child_process12 = require("child_process"), import_module = require("module"), path120 = __toESM(require("path")), fs99 = __toESM(require("fs"));
+    import_child_process12 = require("child_process"), import_module = require("module"), path120 = __toESM(require("path")), fs100 = __toESM(require("fs"));
     init_env_scrub();
     init_logger2();
     init_detect_agents();
@@ -32681,7 +32681,7 @@ async function clearRetiredPlannerCache(userId, cacheRoot = process.env.CODEVIBE
 }
 
 // src/orchestration-shell/index.ts
-var path113 = __toESM(require("path")), os55 = __toESM(require("os")), import_promises6 = require("node:fs/promises"), fs92 = __toESM(require("node:fs")), import_node_fs53 = require("node:fs"), import_node_child_process19 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
+var path113 = __toESM(require("path")), os55 = __toESM(require("os")), import_promises6 = require("node:fs/promises"), fs93 = __toESM(require("node:fs")), import_node_fs54 = require("node:fs"), import_node_child_process19 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
 
 // src/orchestration-shell/web/sanitize.ts
 function sanitizeForTerminal(input) {
@@ -41990,7 +41990,7 @@ function formatBytes(bytes) {
 }
 
 // src/orchestration-shell/quorum-loop.ts
-var import_node_fs48 = require("node:fs"), fsSync11 = __toESM(require("node:fs"));
+var import_node_fs49 = require("node:fs"), fsSync11 = __toESM(require("node:fs"));
 
 // src/diagnostics/shape-only.ts
 function outputShapeOnly(raw) {
@@ -42112,10 +42112,10 @@ function dedupKeyForBrokerCredentialLoaded(taskId, credentialIssuanceId) {
 }
 
 // src/orchestration-shell/reviewer-seat-self-test.ts
-var import_node_crypto32 = require("node:crypto"), fs43 = __toESM(require("node:fs/promises")), path49 = __toESM(require("node:path"));
+var import_node_crypto32 = require("node:crypto"), fs44 = __toESM(require("node:fs/promises")), path49 = __toESM(require("node:path"));
 
 // src/local-executor/tier-self-test.ts
-var import_node_child_process9 = require("node:child_process"), import_node_crypto31 = require("node:crypto"), fsSync3 = __toESM(require("node:fs")), fs41 = __toESM(require("node:fs/promises")), path47 = __toESM(require("node:path"));
+var import_node_child_process9 = require("node:child_process"), import_node_crypto31 = require("node:crypto"), fsSync3 = __toESM(require("node:fs")), fs42 = __toESM(require("node:fs/promises")), path47 = __toESM(require("node:path"));
 init_logger2();
 
 // src/reviewer/providers/failure-classifier.ts
@@ -42148,7 +42148,7 @@ function classifyFailureFromStdout(stdout) {
 }
 
 // src/substrate-launch/agy-auth-seed.ts
-var import_node_child_process8 = require("node:child_process"), crypto15 = __toESM(require("node:crypto")), import_node_fs19 = require("node:fs"), path46 = __toESM(require("node:path"));
+var import_node_child_process8 = require("node:child_process"), crypto15 = __toESM(require("node:crypto")), import_node_fs19 = require("node:fs"), import_node_fs20 = require("node:fs"), path46 = __toESM(require("node:path"));
 
 // src/local-executor/types.ts
 var SpawnArgsInvalid = class extends Error {
@@ -42174,6 +42174,271 @@ var SpawnArgsInvalid = class extends Error {
   MARKER_ENV_KEYS.QUORUM
 ]);
 
+// src/substrate-launch/secret-service-client.ts
+var fs40 = __toESM(require("node:fs")), net = __toESM(require("node:net")), DEADLINE_MS = 3e3, MAX_READ_BYTES = 131072, MAX_SECRET_BYTES = 65536, SECRETS = "org.freedesktop.secrets", SECRETS_PATH = "/org/freedesktop/secrets", SERVICE_IFACE = "org.freedesktop.Secret.Service";
+function sessionBusSocket(env, uid, isOwnSocket) {
+  let addr = env.DBUS_SESSION_BUS_ADDRESS;
+  if (addr) {
+    for (let entry5 of addr.split(";")) {
+      if (!entry5.startsWith("unix:")) continue;
+      let kv = /* @__PURE__ */ new Map();
+      for (let part of entry5.slice(5).split(",")) {
+        let i = part.indexOf("=");
+        if (i > 0)
+          try {
+            kv.set(part.slice(0, i), decodeURIComponent(part.slice(i + 1)));
+          } catch {
+            return null;
+          }
+      }
+      if (kv.get("path")) return kv.get("path");
+      if (kv.get("abstract")) return `\0${kv.get("abstract")}`;
+    }
+    return null;
+  }
+  let run2 = env.XDG_RUNTIME_DIR;
+  if (run2 && run2.startsWith("/")) {
+    let p = `${run2.replace(/\/+$/, "")}/bus`;
+    if (isOwnSocket(p, uid)) return p;
+  }
+  return null;
+}
+function defaultIsOwnSocket(p, uid) {
+  try {
+    let st = fs40.lstatSync(p);
+    return st.isSocket() && st.uid === uid;
+  } catch {
+    return !1;
+  }
+}
+var DBusWriter = class {
+  constructor() {
+    this.buf = Buffer.alloc(256);
+    this.len = 0;
+  }
+  ensure(n) {
+    if (this.len + n <= this.buf.length) return;
+    let b = Buffer.alloc(Math.max(this.buf.length * 2, this.len + n));
+    this.buf.copy(b, 0, 0, this.len), this.buf = b;
+  }
+  align(n) {
+    let pad2 = (n - this.len % n) % n;
+    this.ensure(pad2), this.buf.fill(0, this.len, this.len + pad2), this.len += pad2;
+  }
+  y(v) {
+    this.ensure(1), this.buf.writeUInt8(v, this.len), this.len += 1;
+  }
+  u(v) {
+    this.align(4), this.ensure(4), this.buf.writeUInt32LE(v >>> 0, this.len), this.len += 4;
+  }
+  s(v) {
+    let b = Buffer.from(v, "utf8");
+    this.u(b.length), this.ensure(b.length + 1), b.copy(this.buf, this.len), this.len += b.length, this.y(0);
+  }
+  o(v) {
+    this.s(v);
+  }
+  g(v) {
+    let b = Buffer.from(v, "ascii");
+    this.y(b.length), this.ensure(b.length + 1), b.copy(this.buf, this.len), this.len += b.length, this.y(0);
+  }
+  /** An array whose elements align to `elemAlign`; the length excludes the padding before the first element. */
+  a(elemAlign, fill) {
+    this.u(0);
+    let at = this.len - 4;
+    this.align(elemAlign);
+    let start = this.len;
+    fill(), this.buf.writeUInt32LE(this.len - start, at);
+  }
+  done() {
+    return Buffer.from(this.buf.subarray(0, this.len));
+  }
+}, BASIC = "ybnqiuxtdsogh";
+function splitSignature(sig) {
+  let out = [], i = 0, one = (inArray) => {
+    let c = sig[i];
+    if (c === void 0) throw new Error("signature");
+    if (c === "a")
+      return i++, `a${one(!0)}`;
+    if (c === "(" || c === "{") {
+      if (c === "{" && !inArray) throw new Error("signature");
+      let close = c === "(" ? ")" : "}", members = [];
+      for (i++; sig[i] !== close; ) {
+        if (i >= sig.length) throw new Error("signature");
+        members.push(one(!1));
+      }
+      if (i++, members.length === 0) throw new Error("signature");
+      if (c === "{" && (members.length !== 2 || !BASIC.includes(members[0]))) throw new Error("signature");
+      return c + members.join("") + close;
+    }
+    if (!BASIC.includes(c) && c !== "v") throw new Error("signature");
+    return i++, c;
+  };
+  for (; i < sig.length; ) out.push(one(!1));
+  return out;
+}
+var ALIGN = { y: 1, b: 4, n: 2, q: 2, i: 4, u: 4, x: 8, t: 8, d: 8, s: 4, o: 4, g: 1, v: 1, h: 4, a: 4, "(": 8, "{": 8 }, DBusReader = class {
+  constructor(b, off, le) {
+    this.b = b;
+    this.off = off;
+    this.le = le;
+  }
+  align(n) {
+    if (this.off += (n - this.off % n) % n, this.off > this.b.length) throw new Error("short");
+  }
+  need(n) {
+    if (this.off + n > this.b.length) throw new Error("short");
+  }
+  u32() {
+    this.align(4), this.need(4);
+    let v = this.le ? this.b.readUInt32LE(this.off) : this.b.readUInt32BE(this.off);
+    return this.off += 4, v;
+  }
+  str(len) {
+    this.need(len + 1);
+    let v = this.b.toString("utf8", this.off, this.off + len);
+    return this.off += len + 1, v;
+  }
+  read(t) {
+    switch (t[0]) {
+      case "y":
+        return this.need(1), this.b.readUInt8(this.off++);
+      case "b":
+        return this.u32() !== 0;
+      case "u":
+      case "h":
+        return this.u32();
+      case "i":
+        return this.u32() | 0;
+      case "s":
+      case "o":
+        return this.str(this.u32());
+      case "g": {
+        this.need(1);
+        let n = this.b.readUInt8(this.off++);
+        return this.str(n);
+      }
+      case "v": {
+        let sig = this.read("g"), types = splitSignature(sig);
+        if (types.length !== 1) throw new Error("variant");
+        return this.align(ALIGN[types[0][0]]), { sig, value: this.read(types[0]) };
+      }
+      case "a": {
+        let n = this.u32(), et = t.slice(1);
+        this.align(ALIGN[et[0]]);
+        let end = this.off + n;
+        if (this.need(n), et === "y") {
+          let v = Buffer.from(this.b.subarray(this.off, end));
+          return this.off = end, v;
+        }
+        let out = [];
+        for (; this.off < end; ) {
+          let at = this.off;
+          if (out.push(this.read(et)), this.off <= at) throw new Error("array");
+        }
+        if (this.off !== end) throw new Error("array");
+        return out;
+      }
+      case "(":
+      case "{":
+        return this.align(8), splitSignature(t.slice(1, -1)).map((x) => this.read(x));
+      default:
+        throw new Error(`type ${t}`);
+    }
+  }
+};
+function methodCall(serial, dest, path122, iface, member, signature, fill) {
+  let body2 = new DBusWriter();
+  fill?.(body2);
+  let bodyBuf = body2.done(), h = new DBusWriter();
+  return h.y(108), h.y(1), h.y(0), h.y(1), h.u(bodyBuf.length), h.u(serial), h.a(8, () => {
+    let field2 = (code, sig, write) => {
+      h.align(8), h.y(code), h.g(sig), write();
+    };
+    field2(1, "o", () => h.o(path122)), field2(2, "s", () => h.s(iface)), field2(3, "s", () => h.s(member)), field2(6, "s", () => h.s(dest)), signature && field2(8, "g", () => h.g(signature));
+  }), h.align(8), Buffer.concat([h.done(), bodyBuf]);
+}
+function parseMessage(b, wantBody = () => !0) {
+  if (b.length < 16) return null;
+  let le = b[0] === 108;
+  if (!le && b[0] !== 66) throw new Error("endianness");
+  let r = new DBusReader(b, 4, le), bodyLen = r.u32(), serial = r.u32(), fieldsLen = r.u32(), headerEnd = 16 + fieldsLen + (8 - (16 + fieldsLen) % 8) % 8, size2 = headerEnd + bodyLen;
+  if (size2 > MAX_READ_BYTES) throw new Error("size");
+  if (b.length < size2) return null;
+  let fields = new DBusReader(b.subarray(0, 16 + fieldsLen), 12, le).read("a(yv)"), msg = { type: b[1], serial, signature: "", body: [] };
+  for (let f of fields) {
+    let [code, v] = f;
+    code === 5 && (msg.replySerial = v.value), code === 3 && (msg.member = v.value), code === 4 && (msg.errorName = v.value), code === 8 && (msg.signature = v.value);
+  }
+  if (!wantBody(msg)) return { msg, size: size2 };
+  let br = new DBusReader(b.subarray(0, size2), headerEnd, le);
+  if (msg.body = splitSignature(msg.signature).map((t) => br.read(t)), br.off !== size2) throw new Error("body");
+  return { msg, size: size2 };
+}
+function readSecretServiceItem(attributes, opts = {}) {
+  let uid = opts.uid ?? (typeof process.getuid == "function" ? process.getuid() : -1), socketPath = uid < 0 ? null : sessionBusSocket(opts.env ?? process.env, uid, opts.isOwnSocket ?? defaultIsOwnSocket);
+  return socketPath ? new Promise((resolve35) => {
+    let phase = "auth", sock = (opts.connect ?? ((p) => net.createConnection({ path: p })))(socketPath), finish = (r) => {
+      phase !== "done" && (phase = "done", clearTimeout(timer), sock.destroy(), resolve35(r));
+    }, timer = setTimeout(() => finish({ kind: "error", why: "keychain-timeout" }), opts.timeoutMs ?? DEADLINE_MS), buf = Buffer.alloc(0), total = 0, serial = 0, waiting = /* @__PURE__ */ new Map(), call = (dest, path122, iface, member, sig, fill) => new Promise((res) => {
+      serial += 1, waiting.set(serial, res), sock.write(methodCall(serial, dest, path122, iface, member, sig, fill));
+    }), ok = (m, sig) => {
+      if (m.type !== 2 || m.signature !== sig) throw new Error("reply");
+      return m.body;
+    }, run2 = async () => {
+      ok(await call("org.freedesktop.DBus", "/org/freedesktop/DBus", "org.freedesktop.DBus", "Hello", ""), "s");
+      let opened = await call(SECRETS, SECRETS_PATH, SERVICE_IFACE, "OpenSession", "sv", (w) => {
+        w.s("plain"), w.g("s"), w.s("");
+      });
+      if (opened.type === 3) {
+        let absent = /^org\.freedesktop\.DBus\.Error\.(ServiceUnknown|NameHasNoOwner|Spawn\.)/.test(opened.errorName ?? "");
+        return finish(absent ? { kind: "none", why: "not-signed-in" } : { kind: "error", why: "keychain-error" });
+      }
+      let session2 = ok(opened, "vo")[1], search = ok(await call(SECRETS, SECRETS_PATH, SERVICE_IFACE, "SearchItems", "a{ss}", (w) => w.a(8, () => {
+        for (let [k, v] of Object.entries(attributes))
+          w.align(8), w.s(k), w.s(v);
+      })), "aoao"), [unlocked, locked] = search;
+      if (unlocked.length === 0) return finish({ kind: "none", why: locked.length > 0 ? "keychain-locked" : "not-signed-in" });
+      let entry5 = ok(await call(SECRETS, SECRETS_PATH, SERVICE_IFACE, "GetSecrets", "aoo", (w) => {
+        w.a(4, () => w.o(unlocked[0])), w.o(session2);
+      }), "a{o(oayays)}")[0].find((e) => e[0] === unlocked[0]);
+      if (!entry5) return finish({ kind: "error", why: "keychain-error" });
+      let value = entry5[1][2];
+      if (value.length > MAX_SECRET_BYTES) return finish({ kind: "error", why: "keychain-invalid" });
+      finish({ kind: "secret", data: Buffer.from(value) });
+    };
+    sock.on("error", () => finish({ kind: "error", why: "keychain-error" })), sock.on("close", () => finish({ kind: "error", why: "keychain-error" })), sock.on("connect", () => {
+      let uidHex = Buffer.from(String(uid), "ascii").toString("hex");
+      sock.write(Buffer.concat([Buffer.from([0]), Buffer.from(`AUTH EXTERNAL ${uidHex}\r
+`, "ascii")]));
+    }), sock.on("data", (chunk) => {
+      if (total += chunk.length, total > MAX_READ_BYTES) return finish({ kind: "error", why: "keychain-invalid" });
+      buf = Buffer.concat([buf, chunk]);
+      try {
+        if (phase === "auth") {
+          let nl = buf.indexOf(`\r
+`);
+          if (nl < 0) return;
+          let line = buf.toString("ascii", 0, nl);
+          if (buf = buf.subarray(nl + 2), !line.startsWith("OK ")) return finish({ kind: "error", why: "keychain-error" });
+          phase = "messages", sock.write(`BEGIN\r
+`), run2().catch(() => finish({ kind: "error", why: "keychain-error" }));
+        }
+        for (; ; ) {
+          if (phase !== "messages") return;
+          let p = parseMessage(buf, (m) => (m.type === 2 || m.type === 3) && m.replySerial !== void 0 && waiting.has(m.replySerial));
+          if (!p) return;
+          buf = buf.subarray(p.size);
+          let want = p.msg.replySerial !== void 0 ? waiting.get(p.msg.replySerial) : void 0;
+          want && (p.msg.type === 2 || p.msg.type === 3) && (waiting.delete(p.msg.replySerial), want(p.msg));
+        }
+      } catch (e) {
+        finish({ kind: "error", why: e.message === "size" ? "keychain-invalid" : "keychain-error" });
+      }
+    });
+  }) : Promise.resolve({ kind: "none", why: "not-signed-in" });
+}
+
 // src/substrate-launch/agy-auth-seed.ts
 var AGY_SIGN_IN_NOTICE = "No answer \u2014 Antigravity isn't signed in. Run `agy` once in a terminal to sign in.", AGY_SIGN_IN_REASON = "Antigravity isn't signed in. Run `agy` once in a terminal to sign in.", AGENT_SIGNED_OUT = "agent_signed_out", AGY_TOKEN_FILE = "antigravity-oauth-token", KEYCHAIN_SERVICE = "gemini", KEYCHAIN_ACCOUNT = "antigravity", KEYCHAIN_PREFIX = "go-keyring-base64:", SECURITY_BIN = "/usr/bin/security", KEYCHAIN_TIMEOUT_MS = 1e4, MAX_VALUE_BYTES = 65536, KEYCHAIN_SERVICE_TEST_ENV = "CODEVIBE_AGY_KEYCHAIN_SERVICE_FOR_TESTS", TEST_SERVICE_PREFIX = "codevibe-test-", TEST_SERVICE_FALLBACK = "codevibe-test-invalid-seam", AgentSignInUnavailable = class extends SpawnConfinementUnavailable {
   constructor(why) {
@@ -42182,6 +42447,19 @@ var AGY_SIGN_IN_NOTICE = "No answer \u2014 Antigravity isn't signed in. Run `agy
     this.name = "AgentSignInUnavailable";
   }
 };
+function nativeLinux(deps) {
+  if ((deps.platform ?? process.platform) !== "linux") return !1;
+  if (deps.isWsl !== void 0) return !deps.isWsl;
+  try {
+    return !/microsoft/i.test((deps.procVersion ?? (() => (0, import_node_fs20.readFileSync)("/proc/version", "utf8")))());
+  } catch {
+    return !0;
+  }
+}
+async function readSecretService(deps) {
+  let attributes = { service: keychainService(deps.env ?? process.env), username: KEYCHAIN_ACCOUNT }, r = await (deps.secretService ?? ((a) => readSecretServiceItem(a, { env: deps.env })))(attributes);
+  return r.kind !== "secret" ? { source: "none", why: r.why } : validAgySignInJson(r.data) ? { source: "secret-service", data: r.data } : { source: "none", why: "keychain-invalid" };
+}
 function validAgySignInJson(data) {
   if (data.length < 2 || data.length > MAX_VALUE_BYTES) return !1;
   let parsed;
@@ -42242,7 +42520,7 @@ function readKeychain(deps) {
 }
 async function readAgySignIn(hostAgyDir, deps = {}) {
   let file = await readTokenFile(hostAgyDir);
-  return file ? { source: "file", data: file } : (deps.platform ?? process.platform) !== "darwin" ? { source: "none", why: "not-signed-in" } : readKeychain(deps);
+  return file ? { source: "file", data: file } : (deps.platform ?? process.platform) === "darwin" ? readKeychain(deps) : nativeLinux(deps) ? readSecretService(deps) : { source: "none", why: "not-signed-in" };
 }
 async function legacyCopy(hostAgyDir, destAgyDir) {
   let dest = path46.join(destAgyDir, AGY_TOKEN_FILE);
@@ -42255,7 +42533,7 @@ async function legacyCopy(hostAgyDir, destAgyDir) {
   }
 }
 async function seedAgySignIn(hostAgyDir, destAgyDir, deps = {}) {
-  if ((deps.platform ?? process.platform) !== "darwin") return legacyCopy(hostAgyDir, destAgyDir);
+  if ((deps.platform ?? process.platform) !== "darwin" && !nativeLinux(deps)) return legacyCopy(hostAgyDir, destAgyDir);
   let signIn = await readAgySignIn(hostAgyDir, deps);
   if (signIn.source === "none") throw new AgentSignInUnavailable(signIn.why);
   let dest = path46.join(destAgyDir, AGY_TOKEN_FILE), handle = await import_node_fs19.promises.open(dest, import_node_fs19.constants.O_WRONLY | import_node_fs19.constants.O_CREAT | import_node_fs19.constants.O_EXCL | import_node_fs19.constants.O_NOFOLLOW, 384);
@@ -42327,7 +42605,7 @@ async function runOne(input, view, brief) {
   if (handle.lastMessageCapturePath)
     try {
       output = `${output}
-${await fs41.readFile(handle.lastMessageCapturePath, "utf8")}`;
+${await fs42.readFile(handle.lastMessageCapturePath, "utf8")}`;
     } catch {
     }
   return await input.removeTaskFolder?.(taskId).catch(() => {
@@ -42340,17 +42618,17 @@ function isTransientFailure(r) {
   return label === "usage_limit" || label === "auth_failed" || label === "timeout";
 }
 async function runTierSelfTest(input) {
-  let root = await fs41.realpath(await fs41.mkdtemp(path47.join(input.viewParent, "self-test-"))), view = path47.join(root, "view");
+  let root = await fs42.realpath(await fs42.mkdtemp(path47.join(input.viewParent, "self-test-"))), view = path47.join(root, "view");
   try {
-    await fs41.mkdir(view);
+    await fs42.mkdir(view);
     let firstLine = `codevibe self-test ${(0, import_node_crypto31.randomUUID)().slice(0, 8)}`;
-    await fs41.writeFile(path47.join(view, FILE), `${firstLine}
+    await fs42.writeFile(path47.join(view, FILE), `${firstLine}
 second line
 `);
-    let before = (0, import_node_crypto31.createHash)("sha256").update(await fs41.readFile(path47.join(view, FILE))).digest("hex");
+    let before = (0, import_node_crypto31.createHash)("sha256").update(await fs42.readFile(path47.join(view, FILE))).digest("hex");
     if (input.mode === "execute") {
       let wanted = `ok-${(0, import_node_crypto31.randomUUID)().slice(0, 8)}`, r2 = await runOne(input, view, `Replace the first line of ${FILE} with exactly this text: ${wanted}
-Change nothing else and do not create any other file.`), after2 = await fs41.readFile(path47.join(view, FILE), "utf8").catch(() => "");
+Change nothing else and do not create any other file.`), after2 = await fs42.readFile(path47.join(view, FILE), "utf8").catch(() => "");
       if (r2.exitCode !== 0)
         return { pass: !1, reason: `the agent exited ${r2.exitCode} on the edit task`, ...isTransientFailure(r2) ? { transient: !0 } : {} };
       if (after2.split(`
@@ -42366,12 +42644,12 @@ Change nothing else and do not create any other file.`), after2 = await fs41.rea
       }
       return { pass: !0, ...agyCommandTool ? { agyCommandTool } : {} };
     }
-    let r = await runOne(input, view, `What is the first line of ${FILE}? Reply with that line only, exactly as written.`), after = (0, import_node_crypto31.createHash)("sha256").update(await fs41.readFile(path47.join(view, FILE)).catch(() => Buffer.alloc(0))).digest("hex");
+    let r = await runOne(input, view, `What is the first line of ${FILE}? Reply with that line only, exactly as written.`), after = (0, import_node_crypto31.createHash)("sha256").update(await fs42.readFile(path47.join(view, FILE)).catch(() => Buffer.alloc(0))).digest("hex");
     return r.exitCode !== 0 ? { pass: !1, reason: `the agent exited ${r.exitCode} on the read-only question`, ...isTransientFailure(r) ? { transient: !0 } : {} } : r.output.includes(firstLine) ? after !== before ? { pass: !1, reason: "the read-only run changed the view" } : { pass: !0 } : { pass: !1, reason: "the agent exited 0 but its answer did not quote the first line" };
   } catch (err) {
     return err instanceof AgentSignInUnavailable ? { pass: !1, reason: err.reason, transient: !0, signInWhy: err.why } : { pass: !1, reason: `the self-test could not run (${err.message})`, transient: !0 };
   } finally {
-    await fs41.rm(root, { recursive: !0, force: !0 }).catch((e) => {
+    await fs42.rm(root, { recursive: !0, force: !0 }).catch((e) => {
       logger.warn("[TierSelfTest] could not remove the throwaway view", { root, err: e.message });
     });
   }
@@ -43157,7 +43435,7 @@ async function buildVerdict2(spec, gateId, outcome2, classifyVerdict, onFinalTex
 }
 
 // src/reviewer/providers/codex.ts
-var fs42 = __toESM(require("fs")), os28 = __toESM(require("os")), path48 = __toESM(require("path")), import_uuid10 = require("uuid");
+var fs43 = __toESM(require("fs")), os28 = __toESM(require("os")), path48 = __toESM(require("path")), import_uuid10 = require("uuid");
 init_env_scrub();
 var CodexReviewerProvider = class {
   constructor(opts = {}) {
@@ -43202,7 +43480,7 @@ var CodexReviewerProvider = class {
     }
     let lastMessage;
     try {
-      lastMessage = fs42.readFileSync(hostPath, "utf8");
+      lastMessage = fs43.readFileSync(hostPath, "utf8");
     } catch (ioErr) {
       bestEffortUnlink(hostPath);
       let reason = ioErr instanceof Error ? ioErr.message : String(ioErr);
@@ -43324,7 +43602,7 @@ function resolveLastMessagePaths(sandboxed, workdir) {
 }
 function bestEffortUnlink(p) {
   try {
-    fs42.unlinkSync(p);
+    fs43.unlinkSync(p);
   } catch {
   }
 }
@@ -43361,7 +43639,7 @@ function isTransient(err) {
   return d.kind === "timeout" || d.kind === "cancelled" ? !0 : d.kind === "spawn_failed" && (d.failureReason === "usage_limit" || d.failureReason === "auth_failed" || d.failureReason === "timeout");
 }
 async function runOnce(input) {
-  let root = await fs43.realpath(await fs43.mkdtemp(path49.join(await input.config.viewParent(), "self-test-"))), taskId = (0, import_node_crypto32.randomUUID)(), engaged = { seat: null }, result = await runInSeat(input, root, taskId, engaged);
+  let root = await fs44.realpath(await fs44.mkdtemp(path49.join(await input.config.viewParent(), "self-test-"))), taskId = (0, import_node_crypto32.randomUUID)(), engaged = { seat: null }, result = await runInSeat(input, root, taskId, engaged);
   if (engaged.cleanupUnresolved === !0)
     return logger.warn("[ReviewerSeatSelfTest] the unconfined fallback could not be cleaned up \u2014 its folders are kept", { root, taskId }), { pass: !1, reason: "the seat's sandbox could not be cleaned up after its self-test", transient: !0 };
   if (engaged.seat !== null)
@@ -43374,7 +43652,7 @@ async function runOnce(input) {
         taskId
       }), { pass: !1, reason: "the seat's sandbox could not be cleaned up after its self-test", transient: !0 };
     }
-  return await fs43.rm(root, { recursive: !0, force: !0 }).catch(() => {
+  return await fs44.rm(root, { recursive: !0, force: !0 }).catch(() => {
   }), await input.removeTaskFolder?.(taskId).catch(() => {
   }), result;
 }
@@ -43382,12 +43660,12 @@ async function runInSeat(input, root, taskId, engaged) {
   let seat = null;
   try {
     let view = path49.join(root, "view"), scratch = path49.join(root, "seat");
-    await fs43.mkdir(view), await fs43.mkdir(scratch, { mode: 448 });
+    await fs44.mkdir(view), await fs44.mkdir(scratch, { mode: 448 });
     let firstLine = `codevibe self-test ${(0, import_node_crypto32.randomUUID)().slice(0, 8)}`;
-    await fs43.writeFile(path49.join(view, FILE2), `${firstLine}
+    await fs44.writeFile(path49.join(view, FILE2), `${firstLine}
 second line
 `);
-    let before = (0, import_node_crypto32.createHash)("sha256").update(await fs43.readFile(path49.join(view, FILE2))).digest("hex");
+    let before = (0, import_node_crypto32.createHash)("sha256").update(await fs44.readFile(path49.join(view, FILE2))).digest("hex");
     if (seat = await input.engage({ taskId, workdir: scratch, bundleDir: view }).catch((err) => {
       throw logger.warn("[ReviewerSeatSelfTest] engage failed", { message: err.message }), err?.cleanupUnresolved === !0 && (engaged.cleanupUnresolved = !0), Object.assign(new Error("the seat could not be engaged for its self-test"), { transient: !0 });
     }), engaged.seat = seat, seat === null) return { pass: !1, reason: "the seat could not be confined for its self-test", transient: !0 };
@@ -43416,7 +43694,7 @@ second line
     }
     if (failure2 !== void 0)
       return { pass: !1, reason: `the agent failed on the read-only question (${failure2 instanceof ReviewerErrorClass ? failure2.detail.kind : "error"})`, ...isTransient(failure2) ? { transient: !0 } : {} };
-    let after = (0, import_node_crypto32.createHash)("sha256").update(await fs43.readFile(path49.join(view, FILE2)).catch(() => Buffer.alloc(0))).digest("hex");
+    let after = (0, import_node_crypto32.createHash)("sha256").update(await fs44.readFile(path49.join(view, FILE2)).catch(() => Buffer.alloc(0))).digest("hex");
     return finalText?.includes(firstLine) ? after !== before ? { pass: !1, reason: "the read-only run changed the view" } : { pass: !0 } : { pass: !1, reason: "the agent exited 0 but its answer did not quote the first line" };
   } catch (err) {
     return { pass: !1, reason: `the self-test could not run (${err.message})`, transient: !0 };
@@ -43453,14 +43731,14 @@ async function ensureReviewerSeatSelfTest(input) {
 }
 
 // src/local-executor/authority.ts
-var import_node_fs20 = require("node:fs"), fsSync4 = __toESM(require("node:fs")), os30 = __toESM(require("node:os")), path52 = __toESM(require("node:path"));
+var import_node_fs21 = require("node:fs"), fsSync4 = __toESM(require("node:fs")), os30 = __toESM(require("node:os")), path52 = __toESM(require("node:path"));
 
 // src/orchestration-shell/web/agent-web-server.ts
-var crypto16 = __toESM(require("node:crypto")), fs45 = __toESM(require("node:fs")), net2 = __toESM(require("node:net")), os29 = __toESM(require("node:os")), path51 = __toESM(require("node:path")), readline = __toESM(require("node:readline"));
+var crypto16 = __toESM(require("node:crypto")), fs46 = __toESM(require("node:fs")), net3 = __toESM(require("node:net")), os29 = __toESM(require("node:os")), path51 = __toESM(require("node:path")), readline = __toESM(require("node:readline"));
 init_logger2();
 
 // src/orchestration-shell/web/extract.ts
-var fs44 = __toESM(require("node:fs")), path50 = __toESM(require("node:path")), import_node_worker_threads = require("node:worker_threads");
+var fs45 = __toESM(require("node:fs")), path50 = __toESM(require("node:path")), import_node_worker_threads = require("node:worker_threads");
 init_logger2();
 var WebExtractTimeoutError = class extends Error {
   constructor(timeoutMs) {
@@ -43601,7 +43879,7 @@ function resolveExtractWorkerPath() {
     path50.join(__dirname, "..", "src", "orchestration-shell", "web", "web-extract-worker.ts")
   ];
   for (let c of candidates)
-    if (fs44.existsSync(c)) return path50.resolve(c);
+    if (fs45.existsSync(c)) return path50.resolve(c);
   throw new Error("[extract] Durable web-extract-worker bundle not found");
 }
 async function htmlToTextWorker(html, options) {
@@ -44206,7 +44484,7 @@ function isPromptRelevantToRetainedPage(prompt, retainedPage) {
 var http2 = __toESM(require("node:http")), https3 = __toESM(require("node:https")), dns2 = __toESM(require("node:dns")), zlib2 = __toESM(require("node:zlib")), import_node_string_decoder = require("node:string_decoder");
 
 // src/orchestration-shell/web/ip.ts
-var net = __toESM(require("node:net"));
+var net2 = __toESM(require("node:net"));
 function ipv4ToInt(ip) {
   let m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
   if (!m) return null;
@@ -44267,7 +44545,7 @@ function ipv6IsGlobalUnicast(g) {
   return !((g0 & 65024) === 64512 || (g0 & 65472) === 65152 || (g0 & 65280) === 65280 || g0 === 8193 && g1 === 3512 || g0 === 8194 || g0 === 8193 && g1 === 0 || (g0 & 57344) !== 8192);
 }
 function isGlobalUnicastIp(addr) {
-  let fam = net.isIP(addr);
+  let fam = net2.isIP(addr);
   if (fam === 4) {
     let v = ipv4ToInt(addr);
     return v !== null && ipv4IsGlobalUnicast(v);
@@ -44281,7 +44559,7 @@ function isGlobalUnicastIp(addr) {
 function classifyHost(rawHost) {
   let host = rawHost.trim().toLowerCase();
   if (host.startsWith("[") && host.endsWith("]") && (host = host.slice(1, -1)), host === "" || host === "localhost" || host.endsWith(".local")) return { kind: "reject" };
-  if (net.isIP(host) !== 0) return { kind: "ip", addr: host };
+  if (net2.isIP(host) !== 0) return { kind: "ip", addr: host };
   let dec = /^\d+$/.test(host) ? Number(host) : NaN;
   if (Number.isInteger(dec) && dec >= 0 && dec <= 4294967295)
     return { kind: "ip", addr: intToIpv4(dec >>> 0) };
@@ -44613,8 +44891,8 @@ function isPidAlive(pid) {
 }
 function sweepOrphanedFallbackDirs(tmpRoot = os29.tmpdir(), deps = {}) {
   try {
-    if (!fs45.existsSync(tmpRoot)) return;
-    let lstat30 = deps.lstat ?? fs45.lstatSync, getuid = deps.getuid ?? (typeof process.getuid == "function" ? () => process.getuid() : null), currentUid = getuid ? getuid() : null, entries = fs45.readdirSync(tmpRoot);
+    if (!fs46.existsSync(tmpRoot)) return;
+    let lstat30 = deps.lstat ?? fs46.lstatSync, getuid = deps.getuid ?? (typeof process.getuid == "function" ? () => process.getuid() : null), currentUid = getuid ? getuid() : null, entries = fs46.readdirSync(tmpRoot);
     for (let entry5 of entries) {
       if (!entry5.startsWith("cv-ipc-")) continue;
       let fullPath = path51.join(tmpRoot, entry5);
@@ -44622,25 +44900,25 @@ function sweepOrphanedFallbackDirs(tmpRoot = os29.tmpdir(), deps = {}) {
         let stat25 = lstat30(fullPath);
         if (stat25.isSymbolicLink() || !stat25.isDirectory() || currentUid !== null && stat25.uid !== currentUid) continue;
         let ownerPath = path51.join(fullPath, "owner.json");
-        if (fs45.existsSync(ownerPath))
+        if (fs46.existsSync(ownerPath))
           try {
-            let owner = JSON.parse(fs45.readFileSync(ownerPath, "utf8"));
+            let owner = JSON.parse(fs46.readFileSync(ownerPath, "utf8"));
             if (typeof owner?.pid == "number" && isPidAlive(owner.pid))
               continue;
           } catch {
           }
-        let files = fs45.readdirSync(fullPath);
+        let files = fs46.readdirSync(fullPath);
         for (let file of files) {
           if (!(file === "owner.json" || file.endsWith(".sock"))) continue;
           let filePath = path51.join(fullPath, file);
           try {
             let fileStat = lstat30(filePath);
             if (fileStat.isSymbolicLink()) continue;
-            (fileStat.isFile() || fileStat.isSocket()) && fs45.unlinkSync(filePath);
+            (fileStat.isFile() || fileStat.isSocket()) && fs46.unlinkSync(filePath);
           } catch {
           }
         }
-        fs45.readdirSync(fullPath).length === 0 && fs45.rmdirSync(fullPath);
+        fs46.readdirSync(fullPath).length === 0 && fs46.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -44658,11 +44936,11 @@ function resolveBridgePath() {
   ];
   for (let root of packageRoots) {
     let pkgJsonPath = path51.join(root, "package.json");
-    if (fs45.existsSync(pkgJsonPath))
+    if (fs46.existsSync(pkgJsonPath))
       try {
-        if (JSON.parse(fs45.readFileSync(pkgJsonPath, "utf8")).name === "@quantiya/codevibe-core") {
+        if (JSON.parse(fs46.readFileSync(pkgJsonPath, "utf8")).name === "@quantiya/codevibe-core") {
           let candidate = path51.join(root, "bin", "codevibe-web-mcp-bridge.js");
-          if (fs45.existsSync(candidate)) return candidate;
+          if (fs46.existsSync(candidate)) return candidate;
         }
       } catch {
       }
@@ -44674,15 +44952,15 @@ function resolveBridgePath() {
     path51.join(__dirname, "..", "..", "..", "bin", "codevibe-web-mcp-bridge.js")
   ];
   for (let c of candidates)
-    if (fs45.existsSync(c)) return path51.resolve(c);
+    if (fs46.existsSync(c)) return path51.resolve(c);
   throw new Error("[agent-web-server] Durable bridge binary codevibe-web-mcp-bridge.js not found");
 }
 function writeAuditEntry(sessionId, record2) {
   try {
     let auditDir = path51.join(os29.homedir(), ".codevibe", "sessions", sessionId);
-    fs45.mkdirSync(auditDir, { recursive: !0 });
+    fs46.mkdirSync(auditDir, { recursive: !0 });
     let auditPath = path51.join(auditDir, "web-audit.jsonl");
-    fs45.appendFileSync(auditPath, JSON.stringify(record2) + `
+    fs46.appendFileSync(auditPath, JSON.stringify(record2) + `
 `, "utf8");
   } catch (err) {
     logger.warn("[agent-web-server] Failed to write web audit log", {
@@ -44714,16 +44992,16 @@ async function startAgentWebTurn(options) {
   let sessionId = options.sessionId, turnId = options.turnId ?? crypto16.randomBytes(6).toString("hex"), agent = options.agent ?? "CLAUDE", token4 = crypto16.randomBytes(32).toString("hex"), bridgePath = resolveBridgePath(), searchCount = 0, fetchCount = 0, closed4 = !1, turnAbortController = new AbortController();
   options.signal && (options.signal.aborted ? turnAbortController.abort() : options.signal.addEventListener("abort", () => turnAbortController.abort(), { once: !0 }));
   let primaryIpcDir = path51.join(os29.homedir(), ".codevibe", "ipc");
-  fs45.mkdirSync(primaryIpcDir, { recursive: !0, mode: 448 });
+  fs46.mkdirSync(primaryIpcDir, { recursive: !0, mode: 448 });
   try {
-    fs45.chmodSync(primaryIpcDir, 448);
+    fs46.chmodSync(primaryIpcDir, 448);
   } catch {
   }
   let preferredSocketPath = path51.join(primaryIpcDir, `${turnId}.sock`), socketPath = preferredSocketPath, fallbackDir;
   if (Buffer.byteLength(preferredSocketPath, "utf8") > 100) {
-    fallbackDir = fs45.mkdtempSync(path51.join(os29.tmpdir(), "cv-ipc-")), fs45.chmodSync(fallbackDir, 448);
+    fallbackDir = fs46.mkdtempSync(path51.join(os29.tmpdir(), "cv-ipc-")), fs46.chmodSync(fallbackDir, 448);
     let ownerFile = path51.join(fallbackDir, "owner.json");
-    fs45.writeFileSync(
+    fs46.writeFileSync(
       ownerFile,
       JSON.stringify({ pid: process.pid, createdAt: Date.now() }),
       { mode: 384 }
@@ -44731,15 +45009,15 @@ async function startAgentWebTurn(options) {
     let safeTurnSuffix = turnId.length > 16 ? turnId.slice(0, 16) : turnId;
     socketPath = path51.join(fallbackDir, `${safeTurnSuffix}.sock`);
   }
-  if (fs45.existsSync(socketPath))
+  if (fs46.existsSync(socketPath))
     try {
-      fs45.unlinkSync(socketPath);
+      fs46.unlinkSync(socketPath);
     } catch {
     }
   let sessionDir = path51.join(os29.homedir(), ".codevibe", "sessions", sessionId);
-  fs45.mkdirSync(sessionDir, { recursive: !0 });
+  fs46.mkdirSync(sessionDir, { recursive: !0 });
   let mcpConfigPath = path51.join(sessionDir, `mcp-web-${turnId}.json`);
-  fs45.writeFileSync(mcpConfigPath, JSON.stringify({
+  fs46.writeFileSync(mcpConfigPath, JSON.stringify({
     mcpServers: {
       "codevibe-web": {
         command: "node",
@@ -44747,7 +45025,7 @@ async function startAgentWebTurn(options) {
       }
     }
   }, null, 2), { mode: 384 });
-  let activeSockets = /* @__PURE__ */ new Set(), server = net2.createServer((socket) => {
+  let activeSockets = /* @__PURE__ */ new Set(), server = net3.createServer((socket) => {
     activeSockets.add(socket), socket.on("close", () => {
       activeSockets.delete(socket);
     }), readline.createInterface({
@@ -45087,7 +45365,7 @@ async function startAgentWebTurn(options) {
     await new Promise((resolve35, reject) => {
       server.listen(socketPath, () => {
         try {
-          fs45.chmodSync(socketPath, 384), resolve35();
+          fs46.chmodSync(socketPath, 384), resolve35();
         } catch (err) {
           reject(err);
         }
@@ -45095,23 +45373,23 @@ async function startAgentWebTurn(options) {
     });
   } catch (listenErr) {
     try {
-      fs45.existsSync(socketPath) && fs45.unlinkSync(socketPath);
+      fs46.existsSync(socketPath) && fs46.unlinkSync(socketPath);
     } catch {
     }
     try {
-      fs45.existsSync(mcpConfigPath) && fs45.unlinkSync(mcpConfigPath);
+      fs46.existsSync(mcpConfigPath) && fs46.unlinkSync(mcpConfigPath);
     } catch {
     }
     if (fallbackDir)
       try {
-        if (fs45.existsSync(fallbackDir)) {
-          let files = fs45.readdirSync(fallbackDir);
+        if (fs46.existsSync(fallbackDir)) {
+          let files = fs46.readdirSync(fallbackDir);
           for (let f of files)
             try {
-              fs45.unlinkSync(path51.join(fallbackDir, f));
+              fs46.unlinkSync(path51.join(fallbackDir, f));
             } catch {
             }
-          fs45.rmdirSync(fallbackDir);
+          fs46.rmdirSync(fallbackDir);
         }
       } catch {
       }
@@ -45145,24 +45423,24 @@ async function startAgentWebTurn(options) {
         })
       ]), timer && clearTimeout(timer);
       try {
-        fs45.existsSync(socketPath) && fs45.unlinkSync(socketPath);
+        fs46.existsSync(socketPath) && fs46.unlinkSync(socketPath);
       } catch {
       }
       if (fallbackDir)
         try {
-          if (fs45.existsSync(fallbackDir)) {
-            let files = fs45.readdirSync(fallbackDir);
+          if (fs46.existsSync(fallbackDir)) {
+            let files = fs46.readdirSync(fallbackDir);
             for (let f of files)
               try {
-                fs45.unlinkSync(path51.join(fallbackDir, f));
+                fs46.unlinkSync(path51.join(fallbackDir, f));
               } catch {
               }
-            fs45.rmdirSync(fallbackDir);
+            fs46.rmdirSync(fallbackDir);
           }
         } catch {
         }
       try {
-        fs45.existsSync(mcpConfigPath) && fs45.unlinkSync(mcpConfigPath);
+        fs46.existsSync(mcpConfigPath) && fs46.unlinkSync(mcpConfigPath);
       } catch {
       }
     }
@@ -45187,10 +45465,10 @@ function authorityExpired(scope) {
   return new Date(scope.expiresAt) < /* @__PURE__ */ new Date();
 }
 async function enforceWrite(scope, p) {
-  let canonical = await import_node_fs20.promises.realpath(p).catch((e) => {
+  let canonical = await import_node_fs21.promises.realpath(p).catch((e) => {
     if (e.code === "ENOENT") {
       let parent = path52.dirname(p);
-      return import_node_fs20.promises.realpath(parent).then((realParent) => path52.join(realParent, path52.basename(p))).catch((parentErr) => {
+      return import_node_fs21.promises.realpath(parent).then((realParent) => path52.join(realParent, path52.basename(p))).catch((parentErr) => {
         throw new AuthorityError({
           category: "authority_scope_conflict",
           detail: `parent directory ${parent} for write target ${p} does not exist or is unresolvable: ${parentErr.message}`
@@ -45216,18 +45494,18 @@ async function enforceWrite(scope, p) {
 }
 async function safeWriteFile(scope, p, data, options) {
   let canonical = await enforceWrite(scope, p);
-  await import_node_fs20.promises.writeFile(canonical, data, options);
+  await import_node_fs21.promises.writeFile(canonical, data, options);
 }
 async function enforceRead(scope, p) {
   let canonical;
   try {
-    canonical = await import_node_fs20.promises.realpath(p);
+    canonical = await import_node_fs21.promises.realpath(p);
   } catch (e) {
     let err = e;
     if (err.code === "ENOENT") {
       let parent = path52.dirname(p), realParent;
       try {
-        realParent = await import_node_fs20.promises.realpath(parent);
+        realParent = await import_node_fs21.promises.realpath(parent);
       } catch (parentErr) {
         let pe = parentErr;
         throw new AuthorityError({
@@ -45264,7 +45542,7 @@ async function enforceRead(scope, p) {
 }
 async function safeReadFile(scope, p, options) {
   let canonical = await enforceRead(scope, p);
-  return import_node_fs20.promises.readFile(canonical, options);
+  return import_node_fs21.promises.readFile(canonical, options);
 }
 function mergeAuthorityScope(base2, incoming) {
   let commandAllowlist = [
@@ -45732,7 +46010,7 @@ function enforceCommand(scope, argv) {
 }
 
 // src/local-executor/spawn.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 init_bounded_output();
 init_process_tree();
 init_workspace_authority();
@@ -45740,7 +46018,7 @@ init_env_scrub();
 init_logger2();
 
 // src/local-executor/descendant-reaper.ts
-var import_node_child_process11 = require("node:child_process"), import_node_fs21 = require("node:fs"), PROCESS_TREE_MARKER_ENV = "CODEVIBE_PROCESS_TREE_ID", TREE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var import_node_child_process11 = require("node:child_process"), import_node_fs22 = require("node:fs"), PROCESS_TREE_MARKER_ENV = "CODEVIBE_PROCESS_TREE_ID", TREE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function processTreeMarkerToken(treeId) {
   return `${PROCESS_TREE_MARKER_ENV}=${treeId}`;
 }
@@ -45846,15 +46124,15 @@ async function listInWorkingDirDarwin(scope) {
 async function listMarkedLinux(token4) {
   let uid = process.getuid?.() ?? -1, marked = [], entries;
   try {
-    entries = await import_node_fs21.promises.readdir("/proc");
+    entries = await import_node_fs22.promises.readdir("/proc");
   } catch {
     return marked;
   }
   for (let entry5 of entries)
     if (/^\d+$/.test(entry5))
       try {
-        if ((await import_node_fs21.promises.stat(`/proc/${entry5}`)).uid !== uid || !(await import_node_fs21.promises.readFile(`/proc/${entry5}/environ`, "utf8")).split("\0").includes(token4)) continue;
-        let procStat = await import_node_fs21.promises.readFile(`/proc/${entry5}/stat`, "utf8"), fields = procStat.slice(procStat.lastIndexOf(")") + 2).split(" ");
+        if ((await import_node_fs22.promises.stat(`/proc/${entry5}`)).uid !== uid || !(await import_node_fs22.promises.readFile(`/proc/${entry5}/environ`, "utf8")).split("\0").includes(token4)) continue;
+        let procStat = await import_node_fs22.promises.readFile(`/proc/${entry5}/stat`, "utf8"), fields = procStat.slice(procStat.lastIndexOf(")") + 2).split(" ");
         marked.push({ pid: Number(entry5), startedAt: fields[19] ?? "" });
       } catch {
       }
@@ -45936,7 +46214,7 @@ async function spawnSubprocess(scope, args) {
   if (args.argv.length === 0)
     throw new SpawnArgsInvalid("argv must not be empty", "argv");
   enforceCommand(scope, args.argv), ROLES_REQUIRING_NETWORK.has(args.role) && enforceNetwork(scope);
-  let realWorkingDir = await import_node_fs22.promises.realpath(args.workingDir);
+  let realWorkingDir = await import_node_fs23.promises.realpath(args.workingDir);
   if (realWorkingDir !== args.workingDir)
     throw new SpawnArgsInvalid(
       `workingDir must be canonicalized before passing in: got ${args.workingDir}, realpath = ${realWorkingDir}`,
@@ -46191,7 +46469,7 @@ function wireLifecycle(internal, args) {
 }
 
 // src/local-executor/implementor-argv.ts
-var import_node_fs23 = require("node:fs"), import_node_os = __toESM(require("node:os")), import_node_path3 = __toESM(require("node:path")), import_uuid11 = require("uuid");
+var import_node_fs24 = require("node:fs"), import_node_os = __toESM(require("node:os")), import_node_path3 = __toESM(require("node:path")), import_uuid11 = require("uuid");
 function buildClaudeNoToolsPlanArgv(options) {
   let model = options?.model ? assertValidModelIdentifier(options.model, "claude model") : null;
   return {
@@ -46226,7 +46504,7 @@ function buildClaudeReadOnlyAdvisoryPlanArgv(workdir, attachments, options) {
     addDirs.push(resolvedWorkdir);
     let realWorkdir = null;
     try {
-      realWorkdir = (0, import_node_fs23.realpathSync)(resolvedWorkdir);
+      realWorkdir = (0, import_node_fs24.realpathSync)(resolvedWorkdir);
     } catch {
     }
     let targetPatterns = /* @__PURE__ */ new Set(), escapedWorkdir = escapeClaudePathGlob(resolvedWorkdir);
@@ -46238,13 +46516,13 @@ function buildClaudeReadOnlyAdvisoryPlanArgv(workdir, attachments, options) {
       for (let att of attachments) {
         let resolvedAtt = import_node_path3.default.resolve(att), stat25 = null;
         try {
-          stat25 = (0, import_node_fs23.statSync)(resolvedAtt);
+          stat25 = (0, import_node_fs24.statSync)(resolvedAtt);
         } catch {
         }
         let isDir = !!stat25?.isDirectory(), escapedAtt = escapeClaudePathGlob(resolvedAtt);
         isDir ? (targetPatterns.add(formatClaudePermissionPath(`${escapedAtt}/**`)), addDirs.push(resolvedAtt)) : targetPatterns.add(formatClaudePermissionPath(escapedAtt));
         try {
-          let realAtt = (0, import_node_fs23.realpathSync)(resolvedAtt);
+          let realAtt = (0, import_node_fs24.realpathSync)(resolvedAtt);
           if (realAtt !== resolvedAtt) {
             let escapedRealAtt = escapeClaudePathGlob(realAtt);
             isDir ? targetPatterns.add(formatClaudePermissionPath(`${escapedRealAtt}/**`)) : targetPatterns.add(formatClaudePermissionPath(escapedRealAtt));
@@ -46351,8 +46629,8 @@ function extractMcpServerConfig(mcpConfigPath) {
   if (!mcpConfigPath)
     return null;
   try {
-    if ((0, import_node_fs23.existsSync)(mcpConfigPath)) {
-      let raw = JSON.parse((0, import_node_fs23.readFileSync)(mcpConfigPath, "utf8")), server = raw.mcpServers?.["codevibe-web"] || raw.mcpServers?.codevibe_web;
+    if ((0, import_node_fs24.existsSync)(mcpConfigPath)) {
+      let raw = JSON.parse((0, import_node_fs24.readFileSync)(mcpConfigPath, "utf8")), server = raw.mcpServers?.["codevibe-web"] || raw.mcpServers?.codevibe_web;
       if (server && typeof server.command == "string" && server.command === "node" && Array.isArray(server.args) && server.args.length === 5 && typeof server.args[0] == "string" && server.args[1] === "--socket" && typeof server.args[2] == "string" && server.args[3] === "--token" && typeof server.args[4] == "string")
         return { command: server.command, args: server.args };
     }
@@ -46363,13 +46641,13 @@ function extractMcpServerConfig(mcpConfigPath) {
 function setupAgyWebPlugin(workdir, server) {
   try {
     let pluginDir = import_node_path3.default.join(workdir, ".agents", "plugins", "codevibe-web");
-    (0, import_node_fs23.mkdirSync)(pluginDir, { recursive: !0, mode: 448 });
+    (0, import_node_fs24.mkdirSync)(pluginDir, { recursive: !0, mode: 448 });
     let pluginJsonPath = import_node_path3.default.join(pluginDir, "plugin.json");
-    (0, import_node_fs23.writeFileSync)(pluginJsonPath, JSON.stringify({ name: "codevibe-web" }, null, 2), {
+    (0, import_node_fs24.writeFileSync)(pluginJsonPath, JSON.stringify({ name: "codevibe-web" }, null, 2), {
       mode: 384
     });
     let mcpConfigPath = import_node_path3.default.join(pluginDir, "mcp_config.json");
-    (0, import_node_fs23.writeFileSync)(
+    (0, import_node_fs24.writeFileSync)(
       mcpConfigPath,
       JSON.stringify(
         {
@@ -46391,11 +46669,11 @@ function setupAgyWebPlugin(workdir, server) {
 function stripAgyWebPlugin(workdir) {
   try {
     let pluginDir = import_node_path3.default.join(workdir, ".agents", "plugins", "codevibe-web");
-    (0, import_node_fs23.existsSync)(pluginDir) && (0, import_node_fs23.rmSync)(pluginDir, { recursive: !0, force: !0 });
+    (0, import_node_fs24.existsSync)(pluginDir) && (0, import_node_fs24.rmSync)(pluginDir, { recursive: !0, force: !0 });
     let pluginsParent = import_node_path3.default.join(workdir, ".agents", "plugins");
-    (0, import_node_fs23.existsSync)(pluginsParent) && (0, import_node_fs23.readdirSync)(pluginsParent).length === 0 && (0, import_node_fs23.rmdirSync)(pluginsParent);
+    (0, import_node_fs24.existsSync)(pluginsParent) && (0, import_node_fs24.readdirSync)(pluginsParent).length === 0 && (0, import_node_fs24.rmdirSync)(pluginsParent);
     let agentsParent = import_node_path3.default.join(workdir, ".agents");
-    (0, import_node_fs23.existsSync)(agentsParent) && (0, import_node_fs23.readdirSync)(agentsParent).length === 0 && (0, import_node_fs23.rmdirSync)(agentsParent);
+    (0, import_node_fs24.existsSync)(agentsParent) && (0, import_node_fs24.readdirSync)(agentsParent).length === 0 && (0, import_node_fs24.rmdirSync)(agentsParent);
   } catch {
   }
 }
@@ -46518,11 +46796,11 @@ function readImplementorLastMessage(capturePath, workdir, captureHostPath) {
   } finally {
     if (captureHostPath !== void 0) {
       try {
-        (0, import_node_fs23.unlinkSync)(captureHostPath);
+        (0, import_node_fs24.unlinkSync)(captureHostPath);
       } catch {
       }
       try {
-        (0, import_node_fs23.rmdirSync)(import_node_path3.default.dirname(captureHostPath));
+        (0, import_node_fs24.rmdirSync)(import_node_path3.default.dirname(captureHostPath));
       } catch {
       }
     }
@@ -46532,12 +46810,12 @@ function readFirstCandidate(candidates) {
   for (let candidate of candidates) {
     let text2;
     try {
-      text2 = (0, import_node_fs23.readFileSync)(candidate, "utf8");
+      text2 = (0, import_node_fs24.readFileSync)(candidate, "utf8");
     } catch {
       continue;
     }
     try {
-      (0, import_node_fs23.unlinkSync)(candidate);
+      (0, import_node_fs24.unlinkSync)(candidate);
     } catch {
     }
     return text2;
@@ -46546,12 +46824,12 @@ function readFirstCandidate(candidates) {
 }
 function isInsideContainer() {
   try {
-    if ((0, import_node_fs23.existsSync)("/.dockerenv") || (0, import_node_fs23.existsSync)("/run/.containerenv"))
+    if ((0, import_node_fs24.existsSync)("/.dockerenv") || (0, import_node_fs24.existsSync)("/run/.containerenv"))
       return !0;
   } catch {
   }
   try {
-    let cgroup = (0, import_node_fs23.readFileSync)("/proc/1/cgroup", "utf8");
+    let cgroup = (0, import_node_fs24.readFileSync)("/proc/1/cgroup", "utf8");
     if (/\b(?:docker|containerd|kubepods|lxc|podman)\b/i.test(cgroup))
       return !0;
   } catch {
@@ -46914,15 +47192,15 @@ var HookBridge = class {
 };
 
 // src/local-executor/local-executor-impl.ts
-var import_node_crypto51 = require("node:crypto"), import_node_fs41 = require("node:fs"), syncFs = __toESM(require("node:fs")), os44 = __toESM(require("node:os")), path90 = __toESM(require("node:path"));
+var import_node_crypto51 = require("node:crypto"), import_node_fs42 = require("node:fs"), syncFs = __toESM(require("node:fs")), os44 = __toESM(require("node:os")), path90 = __toESM(require("node:path"));
 
 // src/substrate/docker.ts
-var import_node_fs25 = require("node:fs"), os33 = __toESM(require("node:os")), path55 = __toESM(require("node:path"));
+var import_node_fs26 = require("node:fs"), os33 = __toESM(require("node:os")), path55 = __toESM(require("node:path"));
 init_command_runner();
 init_errors();
 
 // src/substrate/forwarder.ts
-var import_node_fs24 = require("node:fs"), net3 = __toESM(require("node:net"));
+var import_node_fs25 = require("node:fs"), net4 = __toESM(require("node:net"));
 
 // src/substrate/types.ts
 var NOOP_EGRESS_HOOK = () => {
@@ -46941,7 +47219,7 @@ function splitHostPort(addr) {
 var denialCounter = 0, HostEgressForwarder = class {
   constructor(spec) {
     this.listening = !1;
-    this.taskId = spec.taskId, this.upstream = splitHostPort(spec.hostBrokerAddr), this.onEgressDenied = spec.onEgressDenied ?? NOOP_EGRESS_HOOK, this.udsPath = spec.udsPath, this.server = net3.createServer((client) => this.onConnection(client)), this.server.on("error", () => {
+    this.taskId = spec.taskId, this.upstream = splitHostPort(spec.hostBrokerAddr), this.onEgressDenied = spec.onEgressDenied ?? NOOP_EGRESS_HOOK, this.udsPath = spec.udsPath, this.server = net4.createServer((client) => this.onConnection(client)), this.server.on("error", () => {
     });
   }
   /**
@@ -46950,7 +47228,7 @@ var denialCounter = 0, HostEgressForwarder = class {
    * Resolves with the UDS path the container dials.
    */
   async start() {
-    return await import_node_fs24.promises.rm(this.udsPath, { force: !0 }).catch(() => {
+    return await import_node_fs25.promises.rm(this.udsPath, { force: !0 }).catch(() => {
     }), new Promise((resolve35, reject) => {
       let onError = (err) => {
         this.server.removeListener("error", onError), reject(err);
@@ -46970,20 +47248,20 @@ var denialCounter = 0, HostEgressForwarder = class {
    */
   async stop() {
     if (!this.listening) {
-      await import_node_fs24.promises.rm(this.udsPath, { force: !0 }).catch(() => {
+      await import_node_fs25.promises.rm(this.udsPath, { force: !0 }).catch(() => {
       });
       return;
     }
     this.listening = !1, await new Promise((resolve35) => {
       this.server.close(() => resolve35());
-    }), await import_node_fs24.promises.rm(this.udsPath, { force: !0 }).catch(() => {
+    }), await import_node_fs25.promises.rm(this.udsPath, { force: !0 }).catch(() => {
     });
   }
   // Relay one inbound (from the in-container relay) connection to the FIXED
   // broker upstream. The agent-supplied target is never read — the upstream is
   // hard-wired to `hostBrokerAddr`.
   onConnection(client) {
-    let upstream = net3.connect(
+    let upstream = net4.connect(
       { host: this.upstream.host, port: this.upstream.port },
       () => {
         client.pipe(upstream), upstream.pipe(client);
@@ -47140,7 +47418,7 @@ var DockerHandle = class {
     }), await this.runner.run(buildRmArgv(this.id)).catch(() => {
     }), await this.forwarder.stop().catch(() => {
     }), await this.workdirLease?.release().catch(() => {
-    }), await import_node_fs25.promises.rm(this.sessionDir, { recursive: !0, force: !0 }).catch(() => {
+    }), await import_node_fs26.promises.rm(this.sessionDir, { recursive: !0, force: !0 }).catch(() => {
     }));
   }
 }, DockerSubstrate = class {
@@ -47157,7 +47435,7 @@ var DockerHandle = class {
     ), workdirLease = await this.acquireWorkdirLease(spec.workdirAuthority));
     let mountedWorkdir = workdirLease?.procfsPath ?? spec.workdir, sessionDir = path55.join(this.sessionRoot, `codevibe-substrate-${id5}`), udsDir = path55.join(sessionDir, "uds");
     try {
-      await import_node_fs25.promises.mkdir(sessionDir, { recursive: !0, mode: 448 }), await import_node_fs25.promises.mkdir(udsDir, { recursive: !0, mode: 448 });
+      await import_node_fs26.promises.mkdir(sessionDir, { recursive: !0, mode: 448 }), await import_node_fs26.promises.mkdir(udsDir, { recursive: !0, mode: 448 });
     } catch (e) {
       throw await this.rollback(sessionDir, null, workdirLease), new SubstrateLaunchError(
         "docker",
@@ -47167,7 +47445,7 @@ var DockerHandle = class {
     }
     let udsPath = path55.join(udsDir, BROKER_SOCK_NAME), relayScriptPath = path55.join(sessionDir, "relay.js");
     try {
-      await import_node_fs25.promises.writeFile(relayScriptPath, IN_CONTAINER_RELAY_SOURCE, {
+      await import_node_fs26.promises.writeFile(relayScriptPath, IN_CONTAINER_RELAY_SOURCE, {
         encoding: "utf8",
         mode: 384
       });
@@ -47249,7 +47527,7 @@ var DockerHandle = class {
   async rollback(sessionDir, forwarder, workdirLease = null) {
     forwarder && await forwarder.stop().catch(() => {
     }), await workdirLease?.release().catch(() => {
-    }), await import_node_fs25.promises.rm(sessionDir, { recursive: !0, force: !0 }).catch(() => {
+    }), await import_node_fs26.promises.rm(sessionDir, { recursive: !0, force: !0 }).catch(() => {
     });
   }
   // §6 Q2 — probe the Docker CLI/daemon. `docker version` exits non-zero (or
@@ -47279,13 +47557,13 @@ function randomId() {
 }
 
 // src/local-executor/class-a-emit.ts
-var import_node_fs26 = require("node:fs"), import_ulid3 = require("ulid");
+var import_node_fs27 = require("node:fs"), import_ulid3 = require("ulid");
 var LocalStubSink = class {
   constructor(logPath) {
     this.logPath = logPath;
   }
   async emit(envelope) {
-    await import_node_fs26.promises.appendFile(this.logPath, JSON.stringify(envelope) + `
+    await import_node_fs27.promises.appendFile(this.logPath, JSON.stringify(envelope) + `
 `, { encoding: "utf8" });
   }
 }, DEFAULT_DEDUPE_CAP = 1e4;
@@ -48074,7 +48352,7 @@ var ClassBConsumer = class {
 };
 
 // src/substrate-launch/apikey-bootstrap.ts
-var import_node_fs27 = require("node:fs"), os34 = __toESM(require("node:os")), path56 = __toESM(require("node:path"));
+var import_node_fs28 = require("node:fs"), os34 = __toESM(require("node:os")), path56 = __toESM(require("node:path"));
 init_anchored_fs();
 var HELPER_SCRIPT_NAME = "broker-apikey-helper.sh", TOKEN_FILE_NAME = "broker-token", CLAUDE_SETTINGS_NAME = "settings.json", CODEX_CONFIG_NAME = "config.toml", SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent", SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config", CODEX_PROVIDER_ID = "codevibe_broker";
 function helperScriptSource(tokenFileAbsPathInSandbox) {
@@ -48146,64 +48424,64 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
    * the live {@link ApiKeyBootstrap}.
    */
   static async create(input) {
-    let hostRoot = input.hostRoot ?? os34.tmpdir(), rawHostDir = await import_node_fs27.promises.mkdtemp(path56.join(hostRoot, "codevibe-agent-"));
-    await import_node_fs27.promises.chmod(rawHostDir, 448).catch(() => {
+    let hostRoot = input.hostRoot ?? os34.tmpdir(), rawHostDir = await import_node_fs28.promises.mkdtemp(path56.join(hostRoot, "codevibe-agent-"));
+    await import_node_fs28.promises.chmod(rawHostDir, 448).catch(() => {
     });
-    let rawConfigHostDir = await import_node_fs27.promises.mkdtemp(
+    let rawConfigHostDir = await import_node_fs28.promises.mkdtemp(
       path56.join(hostRoot, "codevibe-agent-config-")
     );
-    await import_node_fs27.promises.chmod(rawConfigHostDir, 448).catch(() => {
+    await import_node_fs28.promises.chmod(rawConfigHostDir, 448).catch(() => {
     });
-    let hostDir = await import_node_fs27.promises.realpath(rawHostDir), configHostDir = await import_node_fs27.promises.realpath(rawConfigHostDir), realWorkdir;
+    let hostDir = await import_node_fs28.promises.realpath(rawHostDir), configHostDir = await import_node_fs28.promises.realpath(rawConfigHostDir), realWorkdir;
     if (input.workdir !== void 0) {
       try {
-        realWorkdir = await import_node_fs27.promises.realpath(input.workdir);
+        realWorkdir = await import_node_fs28.promises.realpath(input.workdir);
       } catch {
-        throw await import_node_fs27.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
-        }), await import_node_fs27.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
+        throw await import_node_fs28.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
+        }), await import_node_fs28.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
         }), new Error(
           `ApiKeyBootstrap.create: cannot realpath workdir "${input.workdir}" (fail-closed)`
         );
       }
       if (isInsideOrEqual(hostDir, realWorkdir))
-        throw await import_node_fs27.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
-        }), await import_node_fs27.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
+        throw await import_node_fs28.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
+        }), await import_node_fs28.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
         }), new Error(
           `ApiKeyBootstrap.create: bootstrap dir "${hostDir}" is inside the agent workdir "${realWorkdir}" \u2014 the broker token would be reachable through the workdir mount (I1 fail-closed). Use a hostRoot outside the workdir.`
         );
       if (isInsideOrEqual(configHostDir, realWorkdir))
-        throw await import_node_fs27.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
-        }), await import_node_fs27.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
+        throw await import_node_fs28.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
+        }), await import_node_fs28.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
         }), new Error(
           `ApiKeyBootstrap.create: config dir "${configHostDir}" is inside the agent workdir "${realWorkdir}" \u2014 CLI runtime state would be reachable through the workdir mount (I1 fail-closed). Use a hostRoot outside the workdir.`
         );
     }
     let sandboxDir = input.sandboxDirEqualsHostDir ? hostDir : input.sandboxDir, sandboxConfigDir = input.configDirEqualsHostDir ?? input.sandboxDirEqualsHostDir ?? !1 ? configHostDir : input.sandboxConfigDir;
     if (!sandboxDir)
-      throw await import_node_fs27.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
-      }), await import_node_fs27.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
+      throw await import_node_fs28.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
+      }), await import_node_fs28.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
       }), new Error(
         "ApiKeyBootstrap.create: provide `sandboxDir` or `sandboxDirEqualsHostDir`"
       );
     if (!sandboxConfigDir)
-      throw await import_node_fs27.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
-      }), await import_node_fs27.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
+      throw await import_node_fs28.promises.rm(hostDir, { recursive: !0, force: !0 }).catch(() => {
+      }), await import_node_fs28.promises.rm(configHostDir, { recursive: !0, force: !0 }).catch(() => {
       }), new Error(
         "ApiKeyBootstrap.create: provide `sandboxConfigDir` or `configDirEqualsHostDir`"
       );
     let tokenInSandbox = path56.posix.join(sandboxDir, TOKEN_FILE_NAME), helperInSandbox = path56.posix.join(sandboxDir, HELPER_SCRIPT_NAME), tokenFileHostPath = path56.join(hostDir, TOKEN_FILE_NAME);
-    await import_node_fs27.promises.writeFile(tokenFileHostPath, input.initialToken, {
+    await import_node_fs28.promises.writeFile(tokenFileHostPath, input.initialToken, {
       encoding: "utf8",
       mode: 384
-    }), await import_node_fs27.promises.writeFile(
+    }), await import_node_fs28.promises.writeFile(
       path56.join(hostDir, HELPER_SCRIPT_NAME),
       helperScriptSource(tokenInSandbox),
       { encoding: "utf8", mode: 448 }
-    ), input.provider === "anthropic" ? await import_node_fs27.promises.writeFile(
+    ), input.provider === "anthropic" ? await import_node_fs28.promises.writeFile(
       path56.join(configHostDir, CLAUDE_SETTINGS_NAME),
       claudeSettings(helperInSandbox, input.claudeModelSettings),
       { encoding: "utf8", mode: 384 }
-    ) : await import_node_fs27.promises.writeFile(
+    ) : await import_node_fs28.promises.writeFile(
       path56.join(configHostDir, CODEX_CONFIG_NAME),
       codexConfig(input.sandboxBrokerUrl, helperInSandbox, input.codexModelConfig),
       { encoding: "utf8", mode: 384 }
@@ -48216,7 +48494,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
         ), cleanupErrors = [];
         for (let directory of [hostDir, configHostDir])
           try {
-            await import_node_fs27.promises.rm(directory, { recursive: !0, force: !0 });
+            await import_node_fs28.promises.rm(directory, { recursive: !0, force: !0 });
           } catch (cleanupError) {
             cleanupErrors.push(cleanupError);
           }
@@ -48229,19 +48507,19 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
       }
       let rawScratchDir = null;
       try {
-        let canonicalScratchRoot = await import_node_fs27.promises.realpath(
+        let canonicalScratchRoot = await import_node_fs28.promises.realpath(
           input.claudeScratchHostRoot
         );
-        rawScratchDir = await import_node_fs27.promises.mkdtemp(path56.join(canonicalScratchRoot, "cv"));
-        let initial = await import_node_fs27.promises.lstat(rawScratchDir, { bigint: !0 });
+        rawScratchDir = await import_node_fs28.promises.mkdtemp(path56.join(canonicalScratchRoot, "cv"));
+        let initial = await import_node_fs28.promises.lstat(rawScratchDir, { bigint: !0 });
         if (!initial.isDirectory() || initial.isSymbolicLink())
           throw new Error(
             "ApiKeyBootstrap.create: generated Claude scratch root is not a real directory"
           );
         await input.beforeClaudeScratchOpen?.(rawScratchDir);
-        let scratchHandle = await import_node_fs27.promises.open(
+        let scratchHandle = await import_node_fs28.promises.open(
           rawScratchDir,
-          import_node_fs27.constants.O_RDONLY | import_node_fs27.constants.O_NOFOLLOW | (typeof import_node_fs27.constants.O_DIRECTORY == "number" ? import_node_fs27.constants.O_DIRECTORY : 0)
+          import_node_fs28.constants.O_RDONLY | import_node_fs28.constants.O_NOFOLLOW | (typeof import_node_fs28.constants.O_DIRECTORY == "number" ? import_node_fs28.constants.O_DIRECTORY : 0)
         );
         try {
           let opened = await scratchHandle.stat({ bigint: !0 });
@@ -48250,7 +48528,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
               "ApiKeyBootstrap.create: Claude scratch root changed while binding its directory handle"
             );
           await scratchHandle.chmod(448);
-          let sealed = await scratchHandle.stat({ bigint: !0 }), live = await import_node_fs27.promises.lstat(rawScratchDir, { bigint: !0 }), canonical = rawScratchDir, currentUid = process.getuid?.(), mode = sealed.mode & 0o777n;
+          let sealed = await scratchHandle.stat({ bigint: !0 }), live = await import_node_fs28.promises.lstat(rawScratchDir, { bigint: !0 }), canonical = rawScratchDir, currentUid = process.getuid?.(), mode = sealed.mode & 0o777n;
           if (!sealed.isDirectory() || !live.isDirectory() || live.isSymbolicLink() || live.dev !== sealed.dev || live.ino !== sealed.ino || live.birthtimeNs !== sealed.birthtimeNs || currentUid === void 0 || sealed.uid !== BigInt(currentUid) || mode !== 0o700n)
             throw new Error(
               "ApiKeyBootstrap.create: generated Claude scratch root failed its descriptor-bound private-directory identity check"
@@ -48286,7 +48564,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
           }
         for (let directory of [hostDir, configHostDir])
           try {
-            await import_node_fs27.promises.rm(directory, { recursive: !0, force: !0 });
+            await import_node_fs28.promises.rm(directory, { recursive: !0, force: !0 });
           } catch (cleanupError) {
             cleanupErrors.push(cleanupError);
           }
@@ -48334,7 +48612,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
    */
   async refresh(token4) {
     let tmp = `${this.tokenFileHostPath}.tmp-${process.pid}-${Date.now()}`;
-    await import_node_fs27.promises.writeFile(tmp, token4, { encoding: "utf8", mode: 384 }), await import_node_fs27.promises.rename(tmp, this.tokenFileHostPath);
+    await import_node_fs28.promises.writeFile(tmp, token4, { encoding: "utf8", mode: 384 }), await import_node_fs28.promises.rename(tmp, this.tokenFileHostPath);
   }
   /**
    * Remove the bootstrap, config, and unique Claude scratch dirs. Scratch
@@ -48361,7 +48639,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
       }
     for (let directory of [this.hostDir, this.configHostDir])
       try {
-        await import_node_fs27.promises.rm(directory, { recursive: !0, force: !0 });
+        await import_node_fs28.promises.rm(directory, { recursive: !0, force: !0 });
       } catch (error) {
         cleanupErrors.push(error);
       }
@@ -48375,7 +48653,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
 };
 
 // src/local-executor/snapshot-merge.ts
-var crypto23 = __toESM(require("node:crypto")), fs67 = __toESM(require("node:fs/promises")), path82 = __toESM(require("node:path"));
+var crypto23 = __toESM(require("node:crypto")), fs68 = __toESM(require("node:fs/promises")), path82 = __toESM(require("node:path"));
 init_logger2();
 
 // src/orchestration-shell/declared-test-runner.ts
@@ -49066,7 +49344,7 @@ init_anchored_fs();
 init_bounded_directory();
 
 // src/local-executor/workspace-shadow.ts
-var crypto22 = __toESM(require("node:crypto")), fsSync8 = __toESM(require("node:fs")), fs65 = __toESM(require("node:fs/promises")), os38 = __toESM(require("node:os")), path77 = __toESM(require("node:path")), import_uuid12 = require("uuid");
+var crypto22 = __toESM(require("node:crypto")), fsSync8 = __toESM(require("node:fs")), fs66 = __toESM(require("node:fs/promises")), os38 = __toESM(require("node:os")), path77 = __toESM(require("node:path")), import_uuid12 = require("uuid");
 init_logger2();
 init_anchored_fs();
 init_process_tree();
@@ -50044,7 +50322,7 @@ init_bounded_helper();
 init_shadow_protocol();
 
 // src/local-executor/shadow-roots.ts
-var import_node_crypto37 = require("node:crypto"), import_node_fs28 = require("node:fs"), fs51 = __toESM(require("node:fs/promises")), os35 = __toESM(require("node:os")), path60 = __toESM(require("node:path"));
+var import_node_crypto37 = require("node:crypto"), import_node_fs29 = require("node:fs"), fs52 = __toESM(require("node:fs/promises")), os35 = __toESM(require("node:os")), path60 = __toESM(require("node:path"));
 init_shadow_fs_margins();
 init_shadow_protocol();
 var SHADOW_STATE_FORMAT_FILE = "FORMAT", SHADOW_STATE_FORMAT_VERSION = 2, SHADOW_STATE_FORMAT_BODY = `${JSON.stringify({ format: "codevibe-shadow-state", version: SHADOW_STATE_FORMAT_VERSION })}
@@ -50062,7 +50340,7 @@ async function nearestExistingAncestor(candidate) {
   let current = path60.resolve(candidate);
   for (; ; ) {
     try {
-      return await fs51.stat(current), current;
+      return await fs52.stat(current), current;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -50102,19 +50380,19 @@ async function mountPointOf(p, devOf = realDevOf) {
   }
 }
 async function realDevOf(p) {
-  return (await fs51.stat(p)).dev;
+  return (await fs52.stat(p)).dev;
 }
 function projectVolumeCopyRoot(volumeRoot, uid) {
   return path60.join(volumeRoot, `.codevibe-shadows-${uid}`);
 }
 async function chooseCopyLocation(workingDir, probe = {}) {
-  let platform2 = probe.platform ?? process.platform, statfsType = probe.statfsType ?? (async (p) => Number((await fs51.statfs(p)).type)), devOf = probe.devOf ?? realDevOf, homeLocation = await defaultCopyLocation(probe);
+  let platform2 = probe.platform ?? process.platform, statfsType = probe.statfsType ?? (async (p) => Number((await fs52.statfs(p)).type)), devOf = probe.devOf ?? realDevOf, homeLocation = await defaultCopyLocation(probe);
   if (platform2 === "darwin") {
     let home = probe.home ?? shadowHomeDir();
     if (await devOf(workingDir) === await devOf(home)) return { copyRoot: homeLocation, basis: "home-volume" };
     if (await statfsType(workingDir) !== DARWIN_APFS_FS_TYPE)
       return { copyRoot: homeLocation, basis: "no-clone-volume" };
-    let mountPoint = await mountPointOf(workingDir, devOf), real = (p) => fs51.realpath(p).catch(() => path60.resolve(p)), volumesDir = await real(probe.volumesDir ?? "/Volumes");
+    let mountPoint = await mountPointOf(workingDir, devOf), real = (p) => fs52.realpath(p).catch(() => path60.resolve(p)), volumesDir = await real(probe.volumesDir ?? "/Volumes");
     return await real(path60.dirname(path60.resolve(mountPoint))) !== volumesDir ? { copyRoot: homeLocation, basis: "no-clone-volume" } : {
       copyRoot: projectVolumeCopyRoot(mountPoint, probe.uid ?? process.getuid()),
       basis: "project-volume"
@@ -50135,13 +50413,13 @@ async function v2CopyRoots(probe = {}) {
     roots.push(await defaultCopyLocation(probe));
     let volumesDir = probe.volumesDir ?? "/Volumes", uid = probe.uid ?? process.getuid(), volumes = [];
     try {
-      volumes = await fs51.readdir(volumesDir);
+      volumes = await fs52.readdir(volumesDir);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
     for (let volume of volumes) {
       let candidate = projectVolumeCopyRoot(path60.join(volumesDir, volume), uid);
-      (await fs51.lstat(candidate).catch(() => null))?.isDirectory() && roots.push(candidate);
+      (await fs52.lstat(candidate).catch(() => null))?.isDirectory() && roots.push(candidate);
     }
   } else platform2 === "linux" ? roots.push(...await linuxDiskCandidates(probe)) : roots.push(await defaultCopyLocation(probe));
   return [...new Set(roots.map((root) => path60.resolve(root)))];
@@ -50170,10 +50448,10 @@ async function shadowRootPasses(env = {}, probe = env.copyRootProbe) {
 async function readStateRootFormat(stateRootDir) {
   let handle;
   try {
-    handle = await fs51.open(
+    handle = await fs52.open(
       path60.join(stateRootDir, SHADOW_STATE_FORMAT_FILE),
       // Stage 2 R1-F8: O_NONBLOCK, so a FIFO named FORMAT is classified (not a regular file) instead of hanging.
-      import_node_fs28.constants.O_RDONLY | import_node_fs28.constants.O_NOFOLLOW | import_node_fs28.constants.O_NONBLOCK
+      import_node_fs29.constants.O_RDONLY | import_node_fs29.constants.O_NOFOLLOW | import_node_fs29.constants.O_NONBLOCK
     );
   } catch (err) {
     return err.code === "ENOENT" ? { kind: "absent" } : { kind: "unknown", detail: `FORMAT unreadable: ${err.message}` };
@@ -50201,9 +50479,9 @@ async function ensureStateRootFormat(stateRootDir) {
       new Error(`The task state folder ${stateRootDir} was created by a newer CodeVibe (${existing.detail}); this desktop will not add tasks to it. Update CodeVibe to continue.`),
       { code: "ESTATEFORMAT" }
     );
-  let formatFile = path60.join(stateRootDir, SHADOW_STATE_FORMAT_FILE), temporary = path60.join(stateRootDir, `${SHADOW_STATE_FORMAT_FILE}.${(0, import_node_crypto37.randomBytes)(8).toString("hex")}.tmp`), handle = await fs51.open(
+  let formatFile = path60.join(stateRootDir, SHADOW_STATE_FORMAT_FILE), temporary = path60.join(stateRootDir, `${SHADOW_STATE_FORMAT_FILE}.${(0, import_node_crypto37.randomBytes)(8).toString("hex")}.tmp`), handle = await fs52.open(
     temporary,
-    import_node_fs28.constants.O_WRONLY | import_node_fs28.constants.O_CREAT | import_node_fs28.constants.O_EXCL | import_node_fs28.constants.O_NOFOLLOW,
+    import_node_fs29.constants.O_WRONLY | import_node_fs29.constants.O_CREAT | import_node_fs29.constants.O_EXCL | import_node_fs29.constants.O_NOFOLLOW,
     384
   );
   try {
@@ -50213,19 +50491,19 @@ async function ensureStateRootFormat(stateRootDir) {
   }
   try {
     if (existing.kind === "empty")
-      await fs51.rename(temporary, formatFile);
+      await fs52.rename(temporary, formatFile);
     else
       try {
-        await fs51.link(temporary, formatFile);
+        await fs52.link(temporary, formatFile);
       } catch (err) {
         if (err.code !== "EEXIST") throw err;
       }
   } finally {
-    await fs51.unlink(temporary).catch(() => {
+    await fs52.unlink(temporary).catch(() => {
     });
   }
   if (process.platform !== "win32") {
-    let dir = await fs51.open(stateRootDir, import_node_fs28.constants.O_RDONLY | import_node_fs28.constants.O_NOFOLLOW);
+    let dir = await fs52.open(stateRootDir, import_node_fs29.constants.O_RDONLY | import_node_fs29.constants.O_NOFOLLOW);
     try {
       await dir.sync();
     } finally {
@@ -50242,13 +50520,13 @@ async function passIsActionable(pass) {
 init_shadow_start_record();
 
 // src/local-executor/shadow-task-intent.ts
-var fs56 = __toESM(require("node:fs/promises")), path65 = __toESM(require("node:path"));
+var fs57 = __toESM(require("node:fs/promises")), path65 = __toESM(require("node:path"));
 
 // src/local-executor/shadow-apply-capabilities.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 
 // src/local-executor/store-dir-anchor.ts
-var import_node_fs29 = require("node:fs"), fs52 = __toESM(require("node:fs/promises")), path61 = __toESM(require("node:path"));
+var import_node_fs30 = require("node:fs"), fs53 = __toESM(require("node:fs/promises")), path61 = __toESM(require("node:path"));
 init_anchored_fs();
 init_bounded_helper();
 var O_NOFOLLOW_ANY_DARWIN = 536870912;
@@ -50261,11 +50539,11 @@ function safeName(name) {
 }
 var procFdUsable = null;
 async function linuxProcFd() {
-  return procFdUsable === null && (procFdUsable = process.platform === "linux" && await fs52.stat("/proc/self/fd").then((s) => s.isDirectory(), () => !1)), procFdUsable;
+  return procFdUsable === null && (procFdUsable = process.platform === "linux" && await fs53.stat("/proc/self/fd").then((s) => s.isDirectory(), () => !1)), procFdUsable;
 }
 async function openStoreAnchor(dir, opts) {
   if (!path61.isAbsolute(dir)) throw refuse("store path is not absolute");
-  let parent = await fs52.realpath(path61.dirname(dir)), canonical = path61.join(parent, path61.basename(dir)), lstatDir = () => fs52.lstat(canonical).catch((err) => {
+  let parent = await fs53.realpath(path61.dirname(dir)), canonical = path61.join(parent, path61.basename(dir)), lstatDir = () => fs53.lstat(canonical).catch((err) => {
     if (err.code === "ENOENT") return null;
     throw err;
   }), st = await lstatDir();
@@ -50273,13 +50551,13 @@ async function openStoreAnchor(dir, opts) {
     if (!opts.create) return null;
     let created = !1;
     try {
-      await fs52.mkdir(canonical, { mode: 448 }), created = !0;
+      await fs53.mkdir(canonical, { mode: 448 }), created = !0;
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
     }
     if (st = await lstatDir(), st === null) throw refuse("store directory vanished while it was created");
     if (created && process.platform !== "win32") {
-      let p = await fs52.open(parent, import_node_fs29.constants.O_RDONLY);
+      let p = await fs53.open(parent, import_node_fs30.constants.O_RDONLY);
       try {
         await p.sync();
       } finally {
@@ -50288,7 +50566,7 @@ async function openStoreAnchor(dir, opts) {
     }
   }
   if (st.isSymbolicLink() || !st.isDirectory()) throw refuse("store path is not a directory");
-  let identity = { dev: st.dev, ino: st.ino }, noFollow = process.platform === "darwin" ? O_NOFOLLOW_ANY_DARWIN : import_node_fs29.constants.O_NOFOLLOW, dirFlags = import_node_fs29.constants.O_RDONLY | (import_node_fs29.constants.O_DIRECTORY ?? 0) | noFollow, held = await fs52.open(canonical, dirFlags).catch((err) => {
+  let identity = { dev: st.dev, ino: st.ino }, noFollow = process.platform === "darwin" ? O_NOFOLLOW_ANY_DARWIN : import_node_fs30.constants.O_NOFOLLOW, dirFlags = import_node_fs30.constants.O_RDONLY | (import_node_fs30.constants.O_DIRECTORY ?? 0) | noFollow, held = await fs53.open(canonical, dirFlags).catch((err) => {
     throw err.code === "ELOOP" || err.code === "ENOTDIR" ? refuse("store path is not a directory") : err;
   });
   try {
@@ -50318,7 +50596,7 @@ async function openStoreAnchor(dir, opts) {
       process.platform !== "win32" && await held.sync();
     },
     async list() {
-      return fs52.readdir(pinned ? via : canonical);
+      return fs53.readdir(pinned ? via : canonical);
     },
     async close() {
       closed4 || (closed4 = !0, await held.close());
@@ -50347,7 +50625,7 @@ try { fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
 process.stdout.write(JSON.stringify({ ok: true, removed, kept }) + '\n');
 `;
 async function removeStoreEntriesAnchored(dir, prefixes, opts = {}) {
-  let st = await fs52.lstat(dir, { bigint: !0 });
+  let st = await fs53.lstat(dir, { bigint: !0 });
   if (st.isSymbolicLink() || !st.isDirectory()) throw new Error("instance content store is not a directory");
   let identity = { dev: st.dev.toString(), ino: st.ino.toString(), birthtimeNs: st.birthtimeNs.toString() };
   await opts.beforeHelper?.();
@@ -50383,7 +50661,7 @@ async function removeStoreEntriesAnchored(dir, prefixes, opts = {}) {
   let directoryRemoved = !1;
   if ((result.kept ?? 0) === 0)
     try {
-      await anchoredRemoveEmptyDirectory(dir, identity, opts.helperTimeoutMs !== void 0 ? { helperTimeoutMs: opts.helperTimeoutMs } : {}), directoryRemoved = !await fs52.lstat(dir).then(() => !0, () => !1);
+      await anchoredRemoveEmptyDirectory(dir, identity, opts.helperTimeoutMs !== void 0 ? { helperTimeoutMs: opts.helperTimeoutMs } : {}), directoryRemoved = !await fs53.lstat(dir).then(() => !0, () => !1);
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
     }
@@ -50391,12 +50669,12 @@ async function removeStoreEntriesAnchored(dir, prefixes, opts = {}) {
 }
 
 // src/local-executor/shadow-apply-capabilities.ts
-var fs55 = __toESM(require("node:fs/promises")), path64 = __toESM(require("node:path")), import_node_crypto40 = require("node:crypto");
+var fs56 = __toESM(require("node:fs/promises")), path64 = __toESM(require("node:path")), import_node_crypto40 = require("node:crypto");
 init_nolink_apply();
 init_shadow_protocol();
 
 // src/local-executor/shadow-baseline-shards.ts
-var import_node_crypto38 = require("node:crypto"), import_node_fs30 = require("node:fs"), fs53 = __toESM(require("node:fs/promises")), path62 = __toESM(require("node:path"));
+var import_node_crypto38 = require("node:crypto"), import_node_fs31 = require("node:fs"), fs54 = __toESM(require("node:fs/promises")), path62 = __toESM(require("node:path"));
 init_nolink_apply();
 init_shadow_protocol();
 var BASELINE_INLINE_MAX_BYTES = 8 * 1024 * 1024, BASELINE_SHARD_ENTRIES = 5e4, BASELINE_RECORD_VERSION = 1, BASELINE_SHARD_RE = /^baseline-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}-\d{5}\.jsonl$/i;
@@ -50413,7 +50691,7 @@ async function writeBaselineShards(stateDir, shadowDir, baseline, entriesPerShar
   for (let start = 0, index = 0; start < baseline.length || index === 0; start += entriesPerShard, index += 1) {
     let slice = baseline.slice(start, start + entriesPerShard), body2 = slice.map((entry5) => JSON.stringify(entry5)).join(`
 `) + (slice.length ? `
-` : ""), name = baselineShardName(shadowDir, index), handle = await fs53.open(path62.join(stateDir, name), import_node_fs30.constants.O_WRONLY | import_node_fs30.constants.O_CREAT | import_node_fs30.constants.O_EXCL | import_node_fs30.constants.O_NOFOLLOW, 384);
+` : ""), name = baselineShardName(shadowDir, index), handle = await fs54.open(path62.join(stateDir, name), import_node_fs31.constants.O_WRONLY | import_node_fs31.constants.O_CREAT | import_node_fs31.constants.O_EXCL | import_node_fs31.constants.O_NOFOLLOW, 384);
     try {
       await handle.writeFile(body2), await handle.sync();
     } finally {
@@ -50427,7 +50705,7 @@ async function writeBaselineShards(stateDir, shadowDir, baseline, entriesPerShar
     }), slice.length === 0) break;
   }
   if (process.platform !== "win32") {
-    let dir = await fs53.open(stateDir, import_node_fs30.constants.O_RDONLY);
+    let dir = await fs54.open(stateDir, import_node_fs31.constants.O_RDONLY);
     try {
       await dir.sync();
     } finally {
@@ -50480,16 +50758,16 @@ async function expandMarkerBaseline(stateDir, raw) {
 }
 async function listBaselineShards(stateDir, shadowDir) {
   let suffix = path62.basename(shadowDir).match(SHADOW_UUID_SUFFIX_RE)?.[0];
-  return suffix ? (await fs53.readdir(stateDir).catch(() => [])).filter((name) => BASELINE_SHARD_RE.test(name) && name.startsWith(`baseline${suffix}-`)) : [];
+  return suffix ? (await fs54.readdir(stateDir).catch(() => [])).filter((name) => BASELINE_SHARD_RE.test(name) && name.startsWith(`baseline${suffix}-`)) : [];
 }
 
 // src/local-executor/shadow-volume-probe.ts
-var import_node_child_process14 = require("node:child_process"), import_node_crypto39 = require("node:crypto"), import_node_fs31 = require("node:fs"), fs54 = __toESM(require("node:fs/promises")), path63 = __toESM(require("node:path")), PROBE_ENTRY_RE = /^\.codevibe-probe-[0-9a-f]{32}(?:\.(?:renamed|link))?$/;
+var import_node_child_process14 = require("node:child_process"), import_node_crypto39 = require("node:crypto"), import_node_fs32 = require("node:fs"), fs55 = __toESM(require("node:fs/promises")), path63 = __toESM(require("node:path")), PROBE_ENTRY_RE = /^\.codevibe-probe-[0-9a-f]{32}(?:\.(?:renamed|link))?$/;
 function newProbeEntryName() {
   return `.codevibe-probe-${(0, import_node_crypto39.randomBytes)(16).toString("hex")}`;
 }
 async function bootIdentity(platform2 = process.platform) {
-  if (platform2 === "linux") return (await fs54.readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+  if (platform2 === "linux") return (await fs55.readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
   if (platform2 === "darwin")
     return new Promise((resolve35, reject) => {
       (0, import_node_child_process14.execFile)("/usr/sbin/sysctl", ["-n", "kern.boottime"], (err, stdout) => {
@@ -50503,7 +50781,7 @@ async function probeVolumeCapabilities(projectRoot, journalProbeEntry, opts = {}
   await journalProbeEntry(name);
   let entry5 = path63.join(projectRoot, name), renamed = `${entry5}.renamed`, linked = `${entry5}.link`, steps = {}, modesTracked = !1, linkWorks = !1, inodeStable = !1;
   try {
-    let handle = await fs54.open(entry5, import_node_fs31.constants.O_WRONLY | import_node_fs31.constants.O_CREAT | import_node_fs31.constants.O_EXCL | import_node_fs31.constants.O_NOFOLLOW, 384), inoCreate;
+    let handle = await fs55.open(entry5, import_node_fs32.constants.O_WRONLY | import_node_fs32.constants.O_CREAT | import_node_fs32.constants.O_EXCL | import_node_fs32.constants.O_NOFOLLOW, 384), inoCreate;
     try {
       await handle.writeFile(`codevibe probe
 `), await handle.sync(), inoCreate = (await handle.stat({ bigint: !0 })).ino;
@@ -50511,27 +50789,27 @@ async function probeVolumeCapabilities(projectRoot, journalProbeEntry, opts = {}
       await handle.close();
     }
     steps.exclusiveCreate = "ok";
-    let inoClosed = (await fs54.lstat(entry5, { bigint: !0 })).ino;
+    let inoClosed = (await fs55.lstat(entry5, { bigint: !0 })).ino;
     try {
-      await fs54.chmod(entry5, 416);
-      let back = (await fs54.lstat(entry5)).mode & 511;
+      await fs55.chmod(entry5, 416);
+      let back = (await fs55.lstat(entry5)).mode & 511;
       modesTracked = back === 416, steps.chmod = modesTracked ? "ok" : `ignored (read back ${back.toString(8)})`;
     } catch (err) {
       steps.chmod = err.code ?? "error";
     }
     try {
-      await fs54.link(entry5, linked), linkWorks = !0, steps.link = "ok", await fs54.unlink(linked);
+      await fs55.link(entry5, linked), linkWorks = !0, steps.link = "ok", await fs55.unlink(linked);
     } catch (err) {
       steps.link = err.code ?? "error";
     }
-    await fs54.rename(entry5, renamed), steps.rename = "ok";
-    let inoRenamed = (await fs54.lstat(renamed, { bigint: !0 })).ino;
-    await fs54.writeFile(renamed, `codevibe probe rewritten
+    await fs55.rename(entry5, renamed), steps.rename = "ok";
+    let inoRenamed = (await fs55.lstat(renamed, { bigint: !0 })).ino;
+    await fs55.writeFile(renamed, `codevibe probe rewritten
 `);
-    let inoRewritten = (await fs54.lstat(renamed, { bigint: !0 })).ino, inos = [inoCreate, inoClosed, inoRenamed, inoRewritten];
+    let inoRewritten = (await fs55.lstat(renamed, { bigint: !0 })).ino, inos = [inoCreate, inoClosed, inoRenamed, inoRewritten];
     inodeStable = inos.every((ino) => ino !== 0n && ino === inoCreate), steps.inodes = inos.map(String).join(",");
     try {
-      let dir = await fs54.open(projectRoot, import_node_fs31.constants.O_RDONLY | import_node_fs31.constants.O_DIRECTORY);
+      let dir = await fs55.open(projectRoot, import_node_fs32.constants.O_RDONLY | import_node_fs32.constants.O_DIRECTORY);
       try {
         await dir.sync();
       } finally {
@@ -50544,7 +50822,7 @@ async function probeVolumeCapabilities(projectRoot, journalProbeEntry, opts = {}
   } finally {
     await removeJournaledProbeEntry(projectRoot, name);
   }
-  let rootStat = await fs54.stat(projectRoot, { bigint: !0 });
+  let rootStat = await fs55.stat(projectRoot, { bigint: !0 });
   return {
     version: 1,
     mode: linkWorks ? "link" : "nolink",
@@ -50560,7 +50838,7 @@ async function removeJournaledProbeEntry(projectRoot, name) {
     throw new Error(`not a probe entry name: ${JSON.stringify(name)}`);
   for (let candidate of [name, `${name}.renamed`, `${name}.link`]) {
     let full = path63.join(projectRoot, candidate);
-    (await fs54.lstat(full).catch(() => null))?.isFile() && await fs54.unlink(full).catch(() => {
+    (await fs55.lstat(full).catch(() => null))?.isFile() && await fs55.unlink(full).catch(() => {
     });
   }
 }
@@ -50568,7 +50846,7 @@ async function inodesTrustedNow(journaled, projectRoot, platform2) {
   if (!journaled.inodeStable) return !1;
   let [boot, stat25] = await Promise.all([
     bootIdentity(platform2).catch(() => null),
-    fs54.stat(projectRoot, { bigint: !0 }).catch(() => null)
+    fs55.stat(projectRoot, { bigint: !0 }).catch(() => null)
   ]);
   return boot === journaled.bootId && stat25 !== null && stat25.dev.toString() === journaled.dev;
 }
@@ -50601,10 +50879,10 @@ function manifestStoreFor(stateDir, shadowDir) {
   return { dir: instanceStoreDir(stateDir, shadowDir), prefix: `manifest${instanceSuffix(shadowDir)}` };
 }
 async function removeInstanceStore(storeDir, suffix) {
-  let prefixes = [`blob${suffix}-`, `manifest${suffix}-`], top = await fs55.lstat(storeDir).catch(() => null);
+  let prefixes = [`blob${suffix}-`, `manifest${suffix}-`], top = await fs56.lstat(storeDir).catch(() => null);
   if (top !== null) {
     if (top.isSymbolicLink()) {
-      await fs55.unlink(storeDir).catch((err) => {
+      await fs56.unlink(storeDir).catch((err) => {
         if (err.code !== "ENOENT") throw err;
       });
       return;
@@ -50614,14 +50892,14 @@ async function removeInstanceStore(storeDir, suffix) {
 }
 var testRetireSeam;
 async function writeDurable(file, body2) {
-  let temp = `${file}.${(0, import_node_crypto40.randomBytes)(8).toString("hex")}.tmp`, handle = await fs55.open(temp, import_node_fs32.constants.O_WRONLY | import_node_fs32.constants.O_CREAT | import_node_fs32.constants.O_EXCL | import_node_fs32.constants.O_NOFOLLOW, 384);
+  let temp = `${file}.${(0, import_node_crypto40.randomBytes)(8).toString("hex")}.tmp`, handle = await fs56.open(temp, import_node_fs33.constants.O_WRONLY | import_node_fs33.constants.O_CREAT | import_node_fs33.constants.O_EXCL | import_node_fs33.constants.O_NOFOLLOW, 384);
   try {
     await handle.writeFile(body2), await handle.sync();
   } finally {
     await handle.close();
   }
-  if (await fs55.rename(temp, file), process.platform !== "win32") {
-    let dir = await fs55.open(path64.dirname(file), import_node_fs32.constants.O_RDONLY);
+  if (await fs56.rename(temp, file), process.platform !== "win32") {
+    let dir = await fs56.open(path64.dirname(file), import_node_fs33.constants.O_RDONLY);
     try {
       await dir.sync();
     } finally {
@@ -50659,7 +50937,7 @@ async function ensureApplyCapabilities(stateDir, shadowDir, workspaceRoot, force
     linkVolume: probed.mode === "link"
   };
   return await writeDurable(names.capabilities, `${JSON.stringify(resolved)}
-`), await fs55.unlink(names.probeJournal).catch(() => {
+`), await fs56.unlink(names.probeJournal).catch(() => {
   }), resolved;
 }
 var NoLinkPendingError = class extends Error {
@@ -50766,10 +51044,10 @@ async function retireApplyArtifacts(stateDir, shadowDir, workspaceRoot) {
   let leftover = await readStateFile(names.probeJournal).catch(() => null);
   if (leftover !== null) {
     let { entry: entry5, projectRoot } = JSON.parse(leftover), root = workspaceRoot ?? projectRoot;
-    root !== void 0 && (await removeJournaledProbeEntry(root, entry5), await fs55.unlink(names.probeJournal).catch(() => {
+    root !== void 0 && (await removeJournaledProbeEntry(root, entry5), await fs56.unlink(names.probeJournal).catch(() => {
     }));
   }
-  await fs55.unlink(names.capabilities).catch((err) => {
+  await fs56.unlink(names.capabilities).catch((err) => {
     if (err.code !== "ENOENT") throw err;
   }), await removeInstanceStore(instanceStoreDir(stateDir, shadowDir), instanceSuffix(shadowDir));
   let prefixes = [
@@ -50777,13 +51055,13 @@ async function retireApplyArtifacts(stateDir, shadowDir, workspaceRoot) {
     startRecordPrefix(shadowDir) + "-",
     startRecordPrefix(shadowDir) + "."
   ];
-  for (let entry5 of await fs55.readdir(stateDir).catch(() => [])) {
+  for (let entry5 of await fs56.readdir(stateDir).catch(() => [])) {
     if (!prefixes.some((p) => entry5.startsWith(p))) continue;
-    (await fs55.lstat(path64.join(stateDir, entry5)).catch(() => null))?.isFile() && await fs55.unlink(path64.join(stateDir, entry5)).catch(() => {
+    (await fs56.lstat(path64.join(stateDir, entry5)).catch(() => null))?.isFile() && await fs56.unlink(path64.join(stateDir, entry5)).catch(() => {
     });
   }
   for (let shard of await listBaselineShards(stateDir, shadowDir))
-    await fs55.unlink(path64.join(stateDir, shard)).catch((err) => {
+    await fs56.unlink(path64.join(stateDir, shard)).catch((err) => {
       if (err.code !== "ENOENT") throw err;
     });
 }
@@ -50799,11 +51077,11 @@ async function retireInstanceRecordsForMarker(markerFile) {
 }
 var INSTANCE_ARTEFACT_RE = /^(?:apply-probe|apply-capabilities|baseline|nolink|start-record)(-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})(?:\.json|\.manifest\.json|\.intent\.json|-\d{5}\.jsonl|-[0-9a-f]{48}\.json(?:\.[0-9a-f]{16}\.tmp)?)$/i, INSTANCE_STORE_RE = /^store(-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/i, ORPHAN_ARTEFACT_MIN_AGE_MS = 3600 * 1e3;
 async function reapOrphanedInstanceArtefacts(stateDir, now = Date.now()) {
-  let names = await fs55.readdir(stateDir).catch(() => []), markers = new Set(names.filter((n) => /^shadow-state-.+\.json$/.test(n))), removed = [];
+  let names = await fs56.readdir(stateDir).catch(() => []), markers = new Set(names.filter((n) => /^shadow-state-.+\.json$/.test(n))), removed = [];
   for (let name of names) {
     let match = INSTANCE_ARTEFACT_RE.exec(name) ?? INSTANCE_STORE_RE.exec(name);
     if (!match || markers.has(`shadow-state${match[1]}.json`)) continue;
-    let full = path64.join(stateDir, name), stat25 = await fs55.lstat(full).catch(() => null);
+    let full = path64.join(stateDir, name), stat25 = await fs56.lstat(full).catch(() => null);
     if (!(!stat25 || now - stat25.mtimeMs < ORPHAN_ARTEFACT_MIN_AGE_MS)) {
       if (name.startsWith("apply-probe")) {
         if (!stat25.isFile()) continue;
@@ -50814,7 +51092,7 @@ async function reapOrphanedInstanceArtefacts(stateDir, now = Date.now()) {
         } catch {
           continue;
         }
-        await fs55.unlink(full).catch(() => {
+        await fs56.unlink(full).catch(() => {
         });
       } else if (name.startsWith("nolink") && name.endsWith(".json")) {
         if (!stat25.isFile()) continue;
@@ -50827,13 +51105,13 @@ async function reapOrphanedInstanceArtefacts(stateDir, now = Date.now()) {
           continue;
         }
         if (entry5.state !== "done") continue;
-        await fs55.unlink(full).catch(() => {
+        await fs56.unlink(full).catch(() => {
         });
       } else if (name.startsWith("store")) {
-        if (!stat25.isDirectory() || stat25.isSymbolicLink() || (await removeInstanceStore(full, match[1]), await fs55.lstat(full).then(() => !0, () => !1))) continue;
+        if (!stat25.isDirectory() || stat25.isSymbolicLink() || (await removeInstanceStore(full, match[1]), await fs56.lstat(full).then(() => !0, () => !1))) continue;
       } else {
         if (!stat25.isFile()) continue;
-        await fs55.unlink(full).catch(() => {
+        await fs56.unlink(full).catch(() => {
         });
       }
       removed.push(name);
@@ -50854,7 +51132,7 @@ async function writeTaskIntent(stateDir, shadowDir, intent) {
 async function readTaskIntent(stateDir, shadowDir) {
   let text2;
   try {
-    text2 = await fs56.readFile(intentFile(stateDir, shadowDir), "utf8");
+    text2 = await fs57.readFile(intentFile(stateDir, shadowDir), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return { kind: "none" };
     throw err;
@@ -50867,7 +51145,7 @@ async function readTaskIntent(stateDir, shadowDir) {
 }
 
 // src/local-executor/blob-store.ts
-var import_node_crypto41 = require("node:crypto"), import_node_fs33 = require("node:fs"), fs57 = __toESM(require("node:fs/promises")), path66 = __toESM(require("node:path"));
+var import_node_crypto41 = require("node:crypto"), import_node_fs34 = require("node:fs"), fs58 = __toESM(require("node:fs/promises")), path66 = __toESM(require("node:path"));
 init_binary_classifier();
 var BLOB_CHUNK_BYTES = 1024 * 1024, HEX64 = /^[0-9a-f]{64}$/, PREFIX_RE = /^blob-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function assertStore(store) {
@@ -50897,35 +51175,35 @@ async function withStoreAnchor(dir, fn) {
 }
 async function createStoreTemp(anchor2, name, testBeforeOpen) {
   await testBeforeOpen?.();
-  let handle = await fs57.open(anchor2.at(name), import_node_fs33.constants.O_WRONLY | import_node_fs33.constants.O_CREAT | import_node_fs33.constants.O_EXCL | anchor2.noFollow, 384).catch((err) => {
+  let handle = await fs58.open(anchor2.at(name), import_node_fs34.constants.O_WRONLY | import_node_fs34.constants.O_CREAT | import_node_fs34.constants.O_EXCL | anchor2.noFollow, 384).catch((err) => {
     throw err.code === "ELOOP" || err.code === "ENOTDIR" || err.code === "ENOENT" ? refuse2("store directory changed while a file was created in it") : err;
   });
   try {
-    let [own2, named] = await Promise.all([handle.stat(), fs57.lstat(anchor2.at(name))]);
+    let [own2, named] = await Promise.all([handle.stat(), fs58.lstat(anchor2.at(name))]);
     if (own2.dev !== anchor2.identity.dev || named.dev !== own2.dev || named.ino !== own2.ino)
       throw refuse2("store directory changed while a file was created in it");
     await anchor2.assertStill("while a file was created in it");
   } catch (err) {
     throw await handle.close().catch(() => {
-    }), anchor2.pinned && await fs57.unlink(anchor2.at(name)).catch(() => {
+    }), anchor2.pinned && await fs58.unlink(anchor2.at(name)).catch(() => {
     }), err;
   }
   return handle;
 }
 async function publishStoreTemp(anchor2, tmp, finalName) {
   try {
-    await anchor2.assertStill("before publishing"), await fs57.link(anchor2.at(tmp), anchor2.at(finalName));
+    await anchor2.assertStill("before publishing"), await fs58.link(anchor2.at(tmp), anchor2.at(finalName));
   } catch (err) {
     if (err.code !== "EEXIST")
-      throw await fs57.unlink(anchor2.at(tmp)).catch(() => {
+      throw await fs58.unlink(anchor2.at(tmp)).catch(() => {
       }), err;
-    return await fs57.unlink(anchor2.at(tmp)).catch(() => {
+    return await fs58.unlink(anchor2.at(tmp)).catch(() => {
     }), "exists";
   }
-  return await fs57.unlink(anchor2.at(tmp)), "published";
+  return await fs58.unlink(anchor2.at(tmp)), "published";
 }
 async function dropStoreTemp(anchor2, tmp) {
-  await fs57.unlink(anchor2.at(tmp)).catch(() => {
+  await fs58.unlink(anchor2.at(tmp)).catch(() => {
   });
 }
 async function putBlob(store, chunks, opts = {}) {
@@ -50983,7 +51261,7 @@ async function putBlobFromAnchoredCopy(store, copy) {
     let ref = { blob: read.sha256, size: read.size };
     try {
       if (!HEX64.test(ref.blob) || !Number.isSafeInteger(ref.size) || ref.size < 0) throw refuse2("invalid anchored copy result");
-      let hash3 = (0, import_node_crypto41.createHash)("sha256"), total = 0, check = await fs57.open(anchor2.at(tmp), import_node_fs33.constants.O_RDONLY | anchor2.noFollow);
+      let hash3 = (0, import_node_crypto41.createHash)("sha256"), total = 0, check = await fs58.open(anchor2.at(tmp), import_node_fs34.constants.O_RDONLY | anchor2.noFollow);
       try {
         let buf = Buffer.alloc(BLOB_CHUNK_BYTES);
         for (; ; ) {
@@ -51004,7 +51282,7 @@ async function putBlobFromAnchoredCopy(store, copy) {
 async function copyBlob(src, dst, ref) {
   if (src.dir === dst.dir && src.prefix === dst.prefix)
     return await verifyBlob(src, ref), ref;
-  let present = await fs57.lstat(blobPath(dst, ref.blob)).catch(() => null);
+  let present = await fs58.lstat(blobPath(dst, ref.blob)).catch(() => null);
   if (present?.isFile() && present.size === ref.size)
     return await verifyBlob(dst, ref), ref;
   let copied = await putBlob(dst, readBlobChunks(src, ref));
@@ -51013,7 +51291,7 @@ async function copyBlob(src, dst, ref) {
 }
 async function* readBlobChunks(store, ref) {
   if (!Number.isSafeInteger(ref.size) || ref.size < 0) throw refuse2("invalid blob size");
-  let handle = await fs57.open(blobPath(store, ref.blob), import_node_fs33.constants.O_RDONLY | import_node_fs33.constants.O_NOFOLLOW | import_node_fs33.constants.O_NONBLOCK);
+  let handle = await fs58.open(blobPath(store, ref.blob), import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_NOFOLLOW | import_node_fs34.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size !== ref.size) throw refuse2(`blob ${ref.blob} is not a regular file of ${ref.size} bytes`);
@@ -51031,7 +51309,7 @@ async function* readBlobChunks(store, ref) {
   }
 }
 async function openBlobForStreaming(store, ref) {
-  let handle = await fs57.open(blobPath(store, ref.blob), import_node_fs33.constants.O_RDONLY | import_node_fs33.constants.O_NOFOLLOW | import_node_fs33.constants.O_NONBLOCK);
+  let handle = await fs58.open(blobPath(store, ref.blob), import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_NOFOLLOW | import_node_fs34.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size !== ref.size) throw refuse2(`blob ${ref.blob} is not a regular file of ${ref.size} bytes`);
@@ -51074,7 +51352,7 @@ async function readBlobBytes(store, ref, maxBytes) {
   return Buffer.concat(parts, ref.size);
 }
 async function readBlobHead(store, ref, maxBytes) {
-  let handle = await fs57.open(blobPath(store, ref.blob), import_node_fs33.constants.O_RDONLY | import_node_fs33.constants.O_NOFOLLOW | import_node_fs33.constants.O_NONBLOCK);
+  let handle = await fs58.open(blobPath(store, ref.blob), import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_NOFOLLOW | import_node_fs34.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size !== ref.size) throw refuse2(`blob ${ref.blob} is not a regular file of ${ref.size} bytes`);
@@ -51094,14 +51372,14 @@ async function readBlobHead(store, ref, maxBytes) {
 init_binary_classifier();
 
 // src/local-executor/shadow-slice3-cleanups.ts
-var fs58 = __toESM(require("node:fs/promises")), path67 = __toESM(require("node:path"));
+var fs59 = __toESM(require("node:fs/promises")), path67 = __toESM(require("node:path"));
 init_logger2();
 init_shadow_protocol();
 async function removeEmptyCreatedStateDir(createdStateDir, taskId) {
   if (createdStateDir)
     try {
-      let st = await fs58.lstat(createdStateDir.canonicalPath, { bigint: !0 });
-      st.isDirectory() && !st.isSymbolicLink() && String(st.dev) === createdStateDir.dev && String(st.ino) === createdStateDir.ino && String(st.birthtimeNs) === createdStateDir.birthtimeNs && (await fs58.readdir(createdStateDir.canonicalPath)).length === 0 && await fs58.rmdir(createdStateDir.canonicalPath);
+      let st = await fs59.lstat(createdStateDir.canonicalPath, { bigint: !0 });
+      st.isDirectory() && !st.isSymbolicLink() && String(st.dev) === createdStateDir.dev && String(st.ino) === createdStateDir.ino && String(st.birthtimeNs) === createdStateDir.birthtimeNs && (await fs59.readdir(createdStateDir.canonicalPath)).length === 0 && await fs59.rmdir(createdStateDir.canonicalPath);
     } catch (stateDirErr) {
       logger.warn("[WorkspaceShadow] failed-create state directory kept", {
         taskId,
@@ -51118,17 +51396,17 @@ async function removeOrphanCaptureDirs(keepTaskIds, env = {}) {
 async function removeOrphanCaptureDirsInPair(keepTaskIds, stateRoot, shadowRootDir) {
   let removed = [], names;
   try {
-    names = await fs58.readdir(shadowRootDir);
+    names = await fs59.readdir(shadowRootDir);
   } catch (err) {
     if (err.code === "ENOENT") return removed;
     throw err;
   }
   for (let taskId of names) {
     if (keepTaskIds.has(taskId) || taskId.startsWith(".") || isStateRootInfrastructureDirectory(taskId)) continue;
-    let taskFolder = path67.join(shadowRootDir, taskId), capture = path67.join(taskFolder, "capture"), st = await fs58.lstat(capture).catch(() => null);
+    let taskFolder = path67.join(shadowRootDir, taskId), capture = path67.join(taskFolder, "capture"), st = await fs59.lstat(capture).catch(() => null);
     if (!st || !st.isDirectory() || st.isSymbolicLink()) continue;
-    let folder = await fs58.lstat(taskFolder).catch(() => null);
-    !folder || !folder.isDirectory() || folder.isSymbolicLink() || await fs58.lstat(path67.join(stateRoot, taskId)).then(() => "present", (err) => err.code === "ENOENT" ? "absent" : "unknown") !== "absent" || (await fs58.rm(capture, { recursive: !0, force: !0 }), removed.push(capture), await fs58.rmdir(taskFolder).catch(() => {
+    let folder = await fs59.lstat(taskFolder).catch(() => null);
+    !folder || !folder.isDirectory() || folder.isSymbolicLink() || await fs59.lstat(path67.join(stateRoot, taskId)).then(() => "present", (err) => err.code === "ENOENT" ? "absent" : "unknown") !== "absent" || (await fs59.rm(capture, { recursive: !0, force: !0 }), removed.push(capture), await fs59.rmdir(taskFolder).catch(() => {
     }));
   }
   return removed;
@@ -51140,7 +51418,7 @@ async function sweepOrphanCaptureDirs(keepTaskIds, skip, env = {}) {
 }
 
 // src/local-executor/withheld-media.ts
-var fs59 = __toESM(require("node:fs/promises")), path69 = __toESM(require("node:path"));
+var fs60 = __toESM(require("node:fs/promises")), path69 = __toESM(require("node:path"));
 
 // src/local-executor/office-extractor.ts
 var crypto18 = __toESM(require("node:crypto")), path68 = __toESM(require("node:path"));
@@ -52561,7 +52839,7 @@ async function withheldMediaChanges(store, preTaskHashes, files, readLiveBase) {
 var OTHER_BINARY = { kind: "other", format: "other_binary" };
 async function storedBlob(store, hash3) {
   if (!hash3) return null;
-  let stat25 = await fs59.stat(path69.join(store.dir, `${store.prefix}-${hash3}`)).catch(() => null);
+  let stat25 = await fs60.stat(path69.join(store.dir, `${store.prefix}-${hash3}`)).catch(() => null);
   return stat25?.isFile() ? { blob: hash3, size: stat25.size } : null;
 }
 async function unreadableOffice(store, file, baseRef) {
@@ -52657,7 +52935,7 @@ function parseChangeManifestShard(bytes, expected) {
 }
 
 // src/local-executor/change-manifest-store.ts
-var import_node_crypto43 = require("node:crypto"), import_node_fs34 = require("node:fs"), fs60 = __toESM(require("node:fs/promises")), path70 = __toESM(require("node:path"));
+var import_node_crypto43 = require("node:crypto"), import_node_fs35 = require("node:fs"), fs61 = __toESM(require("node:fs/promises")), path70 = __toESM(require("node:path"));
 var PREFIX_RE2 = /^manifest-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, HEX643 = /^[0-9a-f]{64}$/, MAX_MANIFEST_SHARD_BYTES = 64 * 1024 * 1024;
 function assertStore2(store) {
   if (!PREFIX_RE2.test(store.prefix)) throw new Error("change manifest store: invalid prefix");
@@ -52667,7 +52945,7 @@ function manifestShardName(store, sha2568) {
   return `${store.prefix}-${sha2568}`;
 }
 async function readShardFile(file, maxBytes) {
-  let handle = await fs60.open(file, import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_NOFOLLOW | import_node_fs34.constants.O_NONBLOCK);
+  let handle = await fs61.open(file, import_node_fs35.constants.O_RDONLY | import_node_fs35.constants.O_NOFOLLOW | import_node_fs35.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size > maxBytes) throw new Error(`change manifest shard is not a bounded regular file: ${file}`);
@@ -54146,7 +54424,7 @@ init_task_folder();
 init_shadow_protocol();
 
 // src/local-executor/shadow-recovery.ts
-var crypto21 = __toESM(require("node:crypto")), fsSync7 = __toESM(require("node:fs")), fs64 = __toESM(require("node:fs/promises")), import_node_fs36 = require("node:fs"), os37 = __toESM(require("node:os")), path76 = __toESM(require("node:path"));
+var crypto21 = __toESM(require("node:crypto")), fsSync7 = __toESM(require("node:fs")), fs65 = __toESM(require("node:fs/promises")), import_node_fs37 = require("node:fs"), os37 = __toESM(require("node:os")), path76 = __toESM(require("node:path"));
 init_logger2();
 init_anchored_fs();
 init_process_identity();
@@ -54240,7 +54518,7 @@ async function scanShadowMarkers(env = {}, ownedTaskIds) {
     throw err;
   });
   if (env.signal?.aborted) return { recovered: [], exposureRetentions: [], displacedSnapshots: [], protectedDirNames: /* @__PURE__ */ new Set(), unresolved: [] };
-  let shadowRoot = shadowRootAuthority?.canonicalPath ?? path76.resolve(requestedShadowRoot), siblingRoots = new Set(await Promise.all((env.siblingShadowRoots ?? []).map((root) => fs64.realpath(root).catch(() => path76.resolve(root))))), belongsToSibling = (snapshotPath) => siblingRoots.size > 0 && typeof snapshotPath == "string" && siblingRoots.has(path76.dirname(path76.resolve(snapshotPath))), metadataBudget = createPathBudget(), entries;
+  let shadowRoot = shadowRootAuthority?.canonicalPath ?? path76.resolve(requestedShadowRoot), siblingRoots = new Set(await Promise.all((env.siblingShadowRoots ?? []).map((root) => fs65.realpath(root).catch(() => path76.resolve(root))))), belongsToSibling = (snapshotPath) => siblingRoots.size > 0 && typeof snapshotPath == "string" && siblingRoots.has(path76.dirname(path76.resolve(snapshotPath))), metadataBudget = createPathBudget(), entries;
   try {
     entries = await readDirectoryBounded(
       stateRoot,
@@ -55080,7 +55358,7 @@ async function listShadowCleanupResidueInPair(taskIds, env) {
       label: taskId
     });
     try {
-      await fs64.lstat(stateDir, { bigint: !0 }), add({ taskId, path: stateDir, kind: "state-directory" });
+      await fs65.lstat(stateDir, { bigint: !0 }), add({ taskId, path: stateDir, kind: "state-directory" });
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -55263,7 +55541,7 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
     { absolute: snapshotRoot, relative: "", identity: snapshotRootAuthority }
   ], directories = [];
   for (; pending2.length > 0; ) {
-    let current = pending2.pop(), currentStat = await fs64.lstat(current.absolute, { bigint: !0 });
+    let current = pending2.pop(), currentStat = await fs65.lstat(current.absolute, { bigint: !0 });
     if (!currentStat.isDirectory() || currentStat.isSymbolicLink() || currentStat.dev.toString() !== current.identity.dev || currentStat.ino.toString() !== current.identity.ino)
       throw new Error("snapshot durability seal found an unsafe directory");
     directories.push(current);
@@ -55280,7 +55558,7 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
       }
     ), files = [];
     for (let entry5 of entries) {
-      let relative26 = current.relative ? path76.join(current.relative, entry5.name) : entry5.name, absolute = path76.join(snapshotRoot, relative26), stat25 = await fs64.lstat(absolute, { bigint: !0 });
+      let relative26 = current.relative ? path76.join(current.relative, entry5.name) : entry5.name, absolute = path76.join(snapshotRoot, relative26), stat25 = await fs65.lstat(absolute, { bigint: !0 });
       if (stat25.isDirectory() && !stat25.isSymbolicLink()) {
         let enumerated = boundedDirectoryStat(entry5);
         if (!enumerated || enumerated.dev !== stat25.dev.toString() || enumerated.ino !== stat25.ino.toString())
@@ -55295,7 +55573,7 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
       }
     }
     await forEachBounded(files, SEAL_FILE_CONCURRENCY, async ({ absolute, relative: relative26, stat: stat25 }) => {
-      let handle = await fs64.open(absolute, import_node_fs36.constants.O_RDONLY | import_node_fs36.constants.O_NOFOLLOW);
+      let handle = await fs65.open(absolute, import_node_fs37.constants.O_RDONLY | import_node_fs37.constants.O_NOFOLLOW);
       try {
         let before = await handle.stat({ bigint: !0 });
         if (!before.isFile() || before.dev !== stat25.dev || before.ino !== stat25.ino)
@@ -55303,7 +55581,7 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
         await env.beforeSnapshotDurabilitySync?.("file", absolute), await handle.sync();
         let [after, live] = await Promise.all([
           handle.stat({ bigint: !0 }),
-          fs64.lstat(absolute, { bigint: !0 })
+          fs65.lstat(absolute, { bigint: !0 })
         ]);
         if (!after.isFile() || !live.isFile() || live.isSymbolicLink() || after.dev !== before.dev || after.ino !== before.ino || live.dev !== before.dev || live.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) throw new Error(`snapshot file changed during durability sync: ${relative26}`);
       } finally {
@@ -55320,7 +55598,7 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
       await env.beforeSnapshotDurabilitySync?.("directory", directory.absolute), process.platform !== "win32" && await handle.sync();
       let [after, live] = await Promise.all([
         handle.stat({ bigint: !0 }),
-        fs64.lstat(directory.absolute, { bigint: !0 })
+        fs65.lstat(directory.absolute, { bigint: !0 })
       ]);
       if (!after.isDirectory() || !live.isDirectory() || live.isSymbolicLink() || after.dev !== before.dev || after.ino !== before.ino || live.dev !== before.dev || live.ino !== before.ino || after.dev.toString() !== directory.identity.dev || after.ino.toString() !== directory.identity.ino) throw new Error(`snapshot directory changed during durability sync: ${directory.relative}`);
     } finally {
@@ -55344,7 +55622,7 @@ async function createCopyShadow(workingDir, shadowDir, sourceRootAuthority, copy
     (root) => !isWithinRoot(root, workingDir)
   ), excludedRootIdentities = /* @__PURE__ */ new Set();
   for (let excludedRoot of reachableExcludedRoots) {
-    let stats = await fs64.stat(excludedRoot, { bigint: !0 }).catch(() => null);
+    let stats = await fs65.stat(excludedRoot, { bigint: !0 }).catch(() => null);
     stats !== null && excludedRootIdentities.add(`${stats.dev}:${stats.ino}`);
   }
   let walkStats = { entriesSeen: 0 }, copyLanes = lanes !== void 0 && lanes.length > 0 ? lanes : [{ copyFile: copyFile3, ...batchClones ? { batchClones } : {} }], scheduler = new CopyScheduler(copyLanes), slots = [];
@@ -55730,7 +56008,7 @@ async function removeExposureRetentionMarker(stateFile, expected, shadowRoot, ph
 async function removeExposureRetentionMarkerIfPublicAbsent(stateFile, publicShadowDir, expected, shadowRoot, physicalCopyScope, expectedStateDir, expectedFileAuthority, opts) {
   if (opts?.signal?.aborted) return !1;
   try {
-    return await fs64.lstat(publicShadowDir), !1;
+    return await fs65.lstat(publicShadowDir), !1;
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -56398,7 +56676,7 @@ async function hasAnyOwnedAnchor(dir, name, opts) {
   try {
     let target2 = path76.join(dir, name);
     return await withHelperDeadline(
-      fs64.lstat(target2),
+      fs65.lstat(target2),
       resolveHelperTimeout(opts?.helperTimeoutMs),
       "anchor lstat",
       opts?.signal
@@ -56484,7 +56762,7 @@ async function readStableHandleWithLimit(handle, before, maxBytes, label, opts)
 async function readSnapshotOwnerAnchor(shadowDir, opts) {
   if (opts?.signal?.aborted)
     throw new Error("anchored operation aborted by signal");
-  let activeHandle, settled = !1, hasError = !1, timeout = resolveHelperTimeout(opts?.helperTimeoutMs), filePath = path76.join(shadowDir, SHADOW_OWNER_FILE), openPromise = (opts?.openFileHandle ?? fs64.open)(filePath, import_node_fs36.constants.O_RDONLY | import_node_fs36.constants.O_NOFOLLOW);
+  let activeHandle, settled = !1, hasError = !1, timeout = resolveHelperTimeout(opts?.helperTimeoutMs), filePath = path76.join(shadowDir, SHADOW_OWNER_FILE), openPromise = (opts?.openFileHandle ?? fs65.open)(filePath, import_node_fs37.constants.O_RDONLY | import_node_fs37.constants.O_NOFOLLOW);
   openPromise.then(
     (h) => {
       settled ? h.close().catch(() => {
@@ -56549,7 +56827,7 @@ async function scanPersistedPhysicalCopyBytes(shadowRoots, physicalCopyScope, li
     let shadowRoot = registeredRoot.path;
     if (await isOnUnmountedVolume(shadowRoot, registeredRoot.dev) || registeredRoot.vanished === !0) continue;
     let beforeRoot = await withHelperDeadline(
-      fs64.lstat(shadowRoot, { bigint: !0 }),
+      fs65.lstat(shadowRoot, { bigint: !0 }),
       timeout,
       "scanPersistedPhysicalCopyBytes root lstat",
       opts?.signal
@@ -56577,7 +56855,7 @@ async function scanPersistedPhysicalCopyBytes(shadowRoots, physicalCopyScope, li
       let shadowDir = path76.join(shadowRoot, entry5.name);
       try {
         let stat25 = await withHelperDeadline(
-          fs64.lstat(shadowDir),
+          fs65.lstat(shadowDir),
           timeout,
           "scanPersistedPhysicalCopyBytes shadowDir lstat",
           opts?.signal
@@ -56593,7 +56871,7 @@ async function scanPersistedPhysicalCopyBytes(shadowRoots, physicalCopyScope, li
       }
     }
     let afterRoot = await withHelperDeadline(
-      fs64.lstat(shadowRoot, { bigint: !0 }),
+      fs65.lstat(shadowRoot, { bigint: !0 }),
       timeout,
       "scanPersistedPhysicalCopyBytes afterRoot lstat",
       opts?.signal
@@ -56668,21 +56946,21 @@ async function hasUnreclaimedExposureRetention(stateRoot, opts) {
 async function isOnUnmountedVolume(copyRoot, registeredDev) {
   if (!/^\.codevibe-shadows-\d+$/.test(path76.basename(copyRoot))) return !1;
   let volumeRoot = path76.dirname(copyRoot);
-  if (volumeRoot === copyRoot || await fs64.lstat(copyRoot).then(() => !0, (err) => err.code !== "ENOENT")) return !1;
+  if (volumeRoot === copyRoot || await fs65.lstat(copyRoot).then(() => !0, (err) => err.code !== "ENOENT")) return !1;
   let volume;
   try {
-    volume = await fs64.lstat(volumeRoot, { bigint: !0 });
+    volume = await fs65.lstat(volumeRoot, { bigint: !0 });
   } catch (err) {
     return err.code === "ENOENT";
   }
   if (!volume.isDirectory()) return !1;
   if (registeredDev !== void 0 && /^-?\d+$/.test(registeredDev)) return volume.dev.toString() !== registeredDev;
-  let holder = await fs64.lstat(path76.dirname(volumeRoot), { bigint: !0 }).catch(() => null);
+  let holder = await fs65.lstat(path76.dirname(volumeRoot), { bigint: !0 }).catch(() => null);
   return holder !== null && holder.dev === volume.dev;
 }
 async function markerIsRecoveryAuthority(markerFile) {
   try {
-    let handle = await fs64.open(markerFile, import_node_fs36.constants.O_RDONLY | import_node_fs36.constants.O_NOFOLLOW | import_node_fs36.constants.O_NONBLOCK), text2;
+    let handle = await fs65.open(markerFile, import_node_fs37.constants.O_RDONLY | import_node_fs37.constants.O_NOFOLLOW | import_node_fs37.constants.O_NONBLOCK), text2;
     try {
       let stat25 = await handle.stat();
       if (!stat25.isFile() || stat25.size > MAX_STATE_MARKER_BYTES) return !0;
@@ -56698,7 +56976,7 @@ async function markerIsRecoveryAuthority(markerFile) {
   if (!suffix) return !1;
   let prefix = `nolink${suffix}-`, names;
   try {
-    names = await fs64.readdir(path76.dirname(markerFile));
+    names = await fs65.readdir(path76.dirname(markerFile));
   } catch (err) {
     return err.code !== "ENOENT";
   }
@@ -56718,7 +56996,7 @@ async function markerIsRecoveryAuthority(markerFile) {
   return !1;
 }
 async function readMarkerClaimBounded(stateFile) {
-  let handle = await fs64.open(stateFile, import_node_fs36.constants.O_RDONLY | import_node_fs36.constants.O_NOFOLLOW | import_node_fs36.constants.O_NONBLOCK);
+  let handle = await fs65.open(stateFile, import_node_fs37.constants.O_RDONLY | import_node_fs37.constants.O_NOFOLLOW | import_node_fs37.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size > MAX_STATE_MARKER_BYTES) throw new Error("marker claim is not a bounded regular file");
@@ -56936,7 +57214,7 @@ async function registerAndListQuotaShadowRoots(stateRoot, stateRootIdentity, cur
     let parent = path76.dirname(candidate.path);
     if (parent === candidate.path) return !0;
     try {
-      await fs64.lstat(parent);
+      await fs65.lstat(parent);
     } catch (err) {
       return err.code !== "ENOENT";
     }
@@ -57080,7 +57358,7 @@ async function registerAndListQuotaShadowRoots(stateRoot, stateRootIdentity, cur
         await canRetireReincarnatedRoot(candidate) || retained.push({ path: candidate.path, ...liveCandidate });
         continue;
       }
-      let stat25 = await fs64.lstat(candidate.path, { bigint: !0 });
+      let stat25 = await fs65.lstat(candidate.path, { bigint: !0 });
       if (!stat25.isDirectory() || stat25.isSymbolicLink() || stat25.dev.toString() !== candidate.dev || stat25.ino.toString() !== candidate.ino) {
         if (!await canRetireReincarnatedRoot(candidate))
           throw new Error("registered physical-copy root changed identity");
@@ -57377,9 +57655,9 @@ var ShadowCaptureCancelledError = class extends Error {
    */
   static async precheckCopySpace(workingDir, env = {}) {
     try {
-      let canonicalWorkingDir = await fs65.realpath(workingDir), resolvedRoots = await resolveShadowRoots(env), stateRootIsV2Default = path77.resolve(resolvedRoots.stateRootDir) === path77.resolve(defaultStateRoot()), shadowRoot = resolvedRoots.shadowRootDir;
+      let canonicalWorkingDir = await fs66.realpath(workingDir), resolvedRoots = await resolveShadowRoots(env), stateRootIsV2Default = path77.resolve(resolvedRoots.stateRootDir) === path77.resolve(defaultStateRoot()), shadowRoot = resolvedRoots.shadowRootDir;
       env.shadowRootDir === void 0 && stateRootIsV2Default && (shadowRoot = (await chooseCopyLocation(canonicalWorkingDir, env.copyRootProbe)).copyRoot);
-      let copyLocation = await fs65.realpath(shadowRoot).catch(async (err) => {
+      let copyLocation = await fs66.realpath(shadowRoot).catch(async (err) => {
         if (err.code !== "ENOENT") throw err;
         return (await ensureDurableDirectoryTree(shadowRoot, {
           anchorPath: durableDirectoryAnchor(shadowRoot),
@@ -57410,7 +57688,7 @@ var ShadowCaptureCancelledError = class extends Error {
     }
     stateRootIsV2Default && (await readStateRootFormat(requestedStateRoot)).kind === "unknown" && await ensureStateRootFormat(requestedStateRoot);
     let resolvedWorkingDir = path77.resolve(workingDir), isWorkspacePath = (candidate) => candidate === resolvedWorkingDir || candidate === canonicalWorkingDir, sharesWorkspaceIdentity = async (candidate) => {
-      let stats = await fs65.stat(candidate, { bigint: !0 }).catch(() => null);
+      let stats = await fs66.stat(candidate, { bigint: !0 }).catch(() => null);
       return stats !== null && stats.dev.toString() === workspaceRootAuthority.dev && stats.ino.toString() === workspaceRootAuthority.ino;
     };
     for (let requestedRoot of [requestedShadowRoot, requestedStateRoot]) {
@@ -57513,7 +57791,7 @@ var ShadowCaptureCancelledError = class extends Error {
           if (await withAnchoredExclusiveLock(
             lifecycleLock,
             async () => {
-              await fs65.mkdir(shadowDir, { recursive: !1, mode: 448 }), createdShadowAuthority = await captureWorkspaceRootAuthority(shadowDir), createdShadowIdentity = {
+              await fs66.mkdir(shadowDir, { recursive: !1, mode: 448 }), createdShadowAuthority = await captureWorkspaceRootAuthority(shadowDir), createdShadowIdentity = {
                 dev: createdShadowAuthority.dev,
                 ino: createdShadowAuthority.ino
               }, exposureRetention = {
@@ -57631,7 +57909,7 @@ var ShadowCaptureCancelledError = class extends Error {
                 currentOwner.snapshotRootAuthority,
                 creationSnapshotAuthority
               ) || !sameFsIdentity(currentOwner.shadowDirIdentity, createdShadowIdentity) || currentOwner.ownerProcessIdentity.pid !== ownerProcessIdentity.pid || currentOwner.ownerProcessIdentity.incarnationId !== ownerProcessIdentity.incarnationId) throw new Error("snapshot owner authority changed before exposure");
-              await sealSnapshotTreeDurably(stagingDir, creationSnapshotAuthority, env), await fs65.rename(stagingDir, finalShadowDir), shadowDir = finalShadowDir, movePhysicalCopyReservation(physicalCopyScope, stagingDir, shadowDir), await env.beforeSnapshotDurabilitySync?.("parent", shadowRoot), await fsyncDirectory2(shadowRoot), await env.afterSnapshotExposeRename?.(finalShadowDir);
+              await sealSnapshotTreeDurably(stagingDir, creationSnapshotAuthority, env), await fs66.rename(stagingDir, finalShadowDir), shadowDir = finalShadowDir, movePhysicalCopyReservation(physicalCopyScope, stagingDir, shadowDir), await env.beforeSnapshotDurabilitySync?.("parent", shadowRoot), await fsyncDirectory2(shadowRoot), await env.afterSnapshotExposeRename?.(finalShadowDir);
               let observedExposedAuthority = await captureWorkspaceRootAuthority(
                 finalShadowDir,
                 workspaceAuthorityOptions(env, finalShadowDir, "snapshot exposure")
@@ -58171,7 +58449,7 @@ var ShadowCaptureCancelledError = class extends Error {
         return { content: "", mode: read.mode, blob: ref, ...fileClass2 ? { file_class: fileClass2 } : {} };
       }
     }
-    await this.admitStoreCopy((await fs65.lstat(path77.join(this.shadowDir, rel)).catch(() => null))?.size ?? 0);
+    await this.admitStoreCopy((await fs66.lstat(path77.join(this.shadowDir, rel)).catch(() => null))?.size ?? 0);
     let stored = await putBlobFromAnchoredCopy(store, (fd) => anchoredCopyFileWithinRoot(this.shadowDir, rel, {
       maxBytes: MAX_CAPTURE_FILE_BYTES,
       outFd: fd,
@@ -58214,7 +58492,7 @@ var ShadowCaptureCancelledError = class extends Error {
    */
   async realBaseClass(rel, required) {
     let store = blobStoreFor(this.stateDir, this.shadowDir);
-    await this.admitStoreCopy((await fs65.lstat(path77.join(this.workingDir, rel)).catch(() => null))?.size ?? 0);
+    await this.admitStoreCopy((await fs66.lstat(path77.join(this.workingDir, rel)).catch(() => null))?.size ?? 0);
     let copied = await putBlobFromAnchoredCopy(store, (fd) => anchoredCopyFileWithinRoot(this.workingDir, rel, {
       maxBytes: MAX_CAPTURE_FILE_BYTES,
       outFd: fd,
@@ -58288,7 +58566,7 @@ var ShadowCaptureCancelledError = class extends Error {
    */
   async ownPostImageBlob(store, file, sourceStore) {
     if (file.blob) {
-      let present = await fs65.stat(path77.join(store.dir, `${store.prefix}-${file.blob.blob}`)).catch(() => null);
+      let present = await fs66.stat(path77.join(store.dir, `${store.prefix}-${file.blob.blob}`)).catch(() => null);
       if (present?.isFile() && present.size === file.blob.size) return file.blob;
     }
     if (isReferenceDiffFile(file)) {
@@ -58580,7 +58858,7 @@ var ShadowCaptureCancelledError = class extends Error {
         if (current.hash === null || current.mode === null)
           preImages.set(rel, null);
         else {
-          let originalBytes = (await fs65.lstat(path77.join(this.workingDir, rel))).size, space = await checkCopySpace({ copyLocation: this.stateDir, bytesToCopy: originalBytes });
+          let originalBytes = (await fs66.lstat(path77.join(this.workingDir, rel))).size, space = await checkCopySpace({ copyLocation: this.stateDir, bytesToCopy: originalBytes });
           if (!space.ok) throw new InsufficientCopySpaceError(space);
           let smallOriginal = originalBytes <= READ_SESSION_CONTENT_MAX_BYTES ? await reads.hashFile(this.workingDir, rel, {
             maxBytes: READ_SESSION_CONTENT_MAX_BYTES,
@@ -59095,7 +59373,7 @@ var ShadowCaptureCancelledError = class extends Error {
   async treeRemovalBudgetMs(signal) {
     let countEntries = async (dir) => {
       let n = 0;
-      for await (let entry5 of await fs65.opendir(dir))
+      for await (let entry5 of await fs66.opendir(dir))
         n++, entry5.isDirectory() && !entry5.isSymbolicLink() && (n += await countEntries(path77.join(dir, entry5.name)));
       return n;
     }, entries = await withHelperDeadline(
@@ -59366,7 +59644,7 @@ var ShadowCaptureCancelledError = class extends Error {
       shadowDirIdentity: this.shadowDirIdentity,
       snapshotRootAuthority: this.snapshotRootAuthority
     }, { helperTimeoutMs, signal }), stateSnapshot = await this.readStateMarkerSnapshot(!0, { helperTimeoutMs, signal });
-    if (fallback.present && (fallback.fileIdentity || stateSnapshot?.marker.promoteState !== "disposing" || await fs65.lstat(this.shadowDir).then(() => !0, (err) => err.code !== "ENOENT")))
+    if (fallback.present && (fallback.fileIdentity || stateSnapshot?.marker.promoteState !== "disposing" || await fs66.lstat(this.shadowDir).then(() => !0, (err) => err.code !== "ENOENT")))
       throw new Error(
         `WorkspaceShadow: refusing to discard ${this.taskId} while fallback cleanup authority exists`
       );
@@ -59374,7 +59652,7 @@ var ShadowCaptureCancelledError = class extends Error {
       try {
         let timeout = resolveHelperTimeout(helperTimeoutMs);
         await withHelperDeadline(
-          fs65.lstat(this.shadowDir),
+          fs66.lstat(this.shadowDir),
           timeout,
           "assertDiscardable shadowDir lstat",
           signal
@@ -59414,7 +59692,7 @@ var ShadowCaptureCancelledError = class extends Error {
       try {
         let timeout = resolveHelperTimeout(opts.helperTimeoutMs);
         await withHelperDeadline(
-          fs65.lstat(this.shadowDir),
+          fs66.lstat(this.shadowDir),
           timeout,
           "beginDisposal shadowDir lstat",
           opts.signal
@@ -60016,7 +60294,7 @@ async function reopenShadow(recovered, env = {}) {
 async function removeEmptyTaskFolders(taskId, env = {}) {
   let { shadowRootDir } = await resolveShadowRoots(env);
   for (let root of [env.stateRootDir ?? defaultStateRoot(), shadowRootDir])
-    await fs65.rmdir(path77.join(root, taskId)).catch((err) => {
+    await fs66.rmdir(path77.join(root, taskId)).catch((err) => {
       if (err.code !== "ENOENT" && err.code !== "ENOTEMPTY" && err.code !== "EEXIST") throw err;
     });
 }
@@ -60267,8 +60545,8 @@ async function reapOrphanShadowsInPair(keepTaskIdsIn, env, sweepProcessOwners, r
 var PROJECT_VOLUME_COPY_ROOT_RE = /^\.codevibe-shadows-\d+$/;
 async function removeEmptyProjectVolumeCopyRoot(shadowRoot) {
   if (!PROJECT_VOLUME_COPY_ROOT_RE.test(path77.basename(shadowRoot))) return;
-  let stat25 = await fs65.lstat(shadowRoot).catch(() => null);
-  !stat25?.isDirectory() || stat25.uid !== process.getuid?.() || await fs65.rmdir(shadowRoot).catch((err) => {
+  let stat25 = await fs66.lstat(shadowRoot).catch(() => null);
+  !stat25?.isDirectory() || stat25.uid !== process.getuid?.() || await fs66.rmdir(shadowRoot).catch((err) => {
     if (!(err.code === "ENOTEMPTY" || err.code === "EEXIST" || err.code === "ENOENT"))
       throw err;
   });
@@ -60596,7 +60874,7 @@ init_anchored_fs();
 init_shadow_protocol();
 
 // src/local-executor/sharded-list.ts
-var import_node_crypto46 = require("node:crypto"), import_node_fs37 = require("node:fs"), fs66 = __toESM(require("node:fs/promises")), path81 = __toESM(require("node:path"));
+var import_node_crypto46 = require("node:crypto"), import_node_fs38 = require("node:fs"), fs67 = __toESM(require("node:fs/promises")), path81 = __toESM(require("node:path"));
 var SHARDED_LIST_VERSION = 1, SHARDED_LIST_SHARD_ITEMS = 1e4, MAX_SHARDED_LIST_SHARD_BYTES = 64 * 1024 * 1024, PREFIX_RE3 = /^list-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, KIND_RE = /^[a-z][a-z0-9-]{0,63}$/, HEX644 = /^[0-9a-f]{64}$/;
 function sha2564(data) {
   return (0, import_node_crypto46.createHash)("sha256").update(data).digest("hex");
@@ -60618,7 +60896,7 @@ function canonicalJson2(value) {
   return Array.isArray(value) ? `[${value.map((v) => canonicalJson2(v)).join(",")}]` : `{${Object.keys(value).filter((k) => value[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson2(value[k])}`).join(",")}}`;
 }
 async function readShardFile2(file) {
-  let handle = await fs66.open(file, import_node_fs37.constants.O_RDONLY | import_node_fs37.constants.O_NOFOLLOW | import_node_fs37.constants.O_NONBLOCK);
+  let handle = await fs67.open(file, import_node_fs38.constants.O_RDONLY | import_node_fs38.constants.O_NOFOLLOW | import_node_fs38.constants.O_NONBLOCK);
   try {
     let stat25 = await handle.stat();
     if (!stat25.isFile() || stat25.size > MAX_SHARDED_LIST_SHARD_BYTES)
@@ -61202,10 +61480,10 @@ async function runSnapshotMergeGate(args) {
         deletedPaths: plan.files.filter((file) => file.change_kind === "deleted").map((file) => file.path),
         trackIndex: -1,
         runShell: runShellCommand,
-        lstat: fs67.lstat,
-        realpath: fs67.realpath,
-        stat: fs67.stat,
-        readFile: (file) => fs67.readFile(file, "utf8"),
+        lstat: fs68.lstat,
+        realpath: fs68.realpath,
+        stat: fs68.stat,
+        readFile: (file) => fs68.readFile(file, "utf8"),
         timeoutMs,
         signal: args.signal,
         shadowRootAuthority: integrationAuthority
@@ -61737,7 +62015,7 @@ function assertExactSnapshotPromotionJournal(value) {
 init_shadow_protocol();
 
 // src/local-executor/team-media-approval.ts
-var fs68 = __toESM(require("node:fs/promises")), path83 = __toESM(require("node:path"));
+var fs69 = __toESM(require("node:fs/promises")), path83 = __toESM(require("node:path"));
 init_shadow_protocol();
 var declined = /* @__PURE__ */ new WeakMap();
 function takeTeamMediaDeclined(owner, taskGroupId) {
@@ -61769,7 +62047,7 @@ function recordPath(stateRoot, taskGroupId) {
   return path83.join(teamMediaQuestionDir(stateRoot), `${taskGroupId}.json`);
 }
 async function syncDirectory(dir) {
-  let fh = await fs68.open(dir, "r");
+  let fh = await fs69.open(dir, "r");
   try {
     await fh.sync();
   } finally {
@@ -61777,27 +62055,27 @@ async function syncDirectory(dir) {
   }
 }
 async function writeOpenTeamMediaQuestion(stateRoot, q) {
-  let dir = teamMediaQuestionDir(stateRoot), created = await fs68.mkdir(dir, { recursive: !0, mode: 448 }), target2 = recordPath(stateRoot, q.taskGroupId), tmp = `${target2}.${process.pid}.tmp`, fh = await fs68.open(tmp, "w", 384);
+  let dir = teamMediaQuestionDir(stateRoot), created = await fs69.mkdir(dir, { recursive: !0, mode: 448 }), target2 = recordPath(stateRoot, q.taskGroupId), tmp = `${target2}.${process.pid}.tmp`, fh = await fs69.open(tmp, "w", 384);
   try {
     await fh.writeFile(JSON.stringify(q)), await fh.sync();
   } finally {
     await fh.close();
   }
-  await fs68.rename(tmp, target2), await syncDirectory(dir), created !== void 0 && await syncDirectory(path83.dirname(dir));
+  await fs69.rename(tmp, target2), await syncDirectory(dir), created !== void 0 && await syncDirectory(path83.dirname(dir));
 }
 async function removeOpenTeamMediaQuestion(stateRoot, taskGroupId) {
-  await fs68.rm(recordPath(stateRoot, taskGroupId), { force: !0 }), await syncDirectory(teamMediaQuestionDir(stateRoot)).catch((err) => {
+  await fs69.rm(recordPath(stateRoot, taskGroupId), { force: !0 }), await syncDirectory(teamMediaQuestionDir(stateRoot)).catch((err) => {
     if (err.code !== "ENOENT") throw err;
   });
 }
 async function listOpenTeamMediaQuestions(stateRoot) {
-  let dir = teamMediaQuestionDir(stateRoot), names = await fs68.readdir(dir).catch((err) => {
+  let dir = teamMediaQuestionDir(stateRoot), names = await fs69.readdir(dir).catch((err) => {
     if (err.code === "ENOENT") return [];
     throw err;
   }), out = [];
   for (let name of names) {
     if (!name.endsWith(".json")) continue;
-    let q = JSON.parse(await fs68.readFile(path83.join(dir, name), "utf8"));
+    let q = JSON.parse(await fs69.readFile(path83.join(dir, name), "utf8"));
     q.version === 1 && typeof q.taskGroupId == "string" && typeof q.sessionId == "string" && `${q.taskGroupId}.json` === name && out.push(q);
   }
   return out;
@@ -61858,23 +62136,23 @@ async function recoverOpenTeamMediaQuestions(args) {
 }
 
 // src/local-executor/team-summary.ts
-var crypto24 = __toESM(require("node:crypto")), fs69 = __toESM(require("node:fs")), path84 = __toESM(require("node:path"));
+var crypto24 = __toESM(require("node:crypto")), fs70 = __toESM(require("node:fs")), path84 = __toESM(require("node:path"));
 function atomicWriteJsonSync(targetPath, data, options = {}) {
   let dir = path84.dirname(targetPath);
-  fs69.existsSync(dir) || fs69.mkdirSync(dir, { recursive: !0 });
+  fs70.existsSync(dir) || fs70.mkdirSync(dir, { recursive: !0 });
   let uniqueId = crypto24.randomUUID ? crypto24.randomUUID() : `${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`, tmpPath = path84.join(dir, `.tmp.${path84.basename(targetPath)}.${uniqueId}`), serialized = typeof data == "string" ? data : JSON.stringify(data, null, 2), fd = null, renameSucceeded = !1;
   try {
-    if (fd = fs69.openSync(tmpPath, "wx", 384), fs69.writeFileSync(fd, serialized, "utf8"), fs69.fsyncSync(fd), options.interruptBeforeRename)
+    if (fd = fs70.openSync(tmpPath, "wx", 384), fs70.writeFileSync(fd, serialized, "utf8"), fs70.fsyncSync(fd), options.interruptBeforeRename)
       throw new Error("Interrupted before atomic rename");
-    fs69.closeSync(fd), fd = null, fs69.renameSync(tmpPath, targetPath), renameSucceeded = !0;
+    fs70.closeSync(fd), fd = null, fs70.renameSync(tmpPath, targetPath), renameSucceeded = !0;
     try {
       if (options.injectDirectorySyncError)
         throw options.injectDirectorySyncError;
-      let dirFd = fs69.openSync(dir, "r");
+      let dirFd = fs70.openSync(dir, "r");
       try {
-        fs69.fsyncSync(dirFd);
+        fs70.fsyncSync(dirFd);
       } finally {
-        fs69.closeSync(dirFd);
+        fs70.closeSync(dirFd);
       }
     } catch (dirErr) {
       let code = dirErr?.code;
@@ -61884,12 +62162,12 @@ function atomicWriteJsonSync(targetPath, data, options = {}) {
   } finally {
     if (fd !== null)
       try {
-        fs69.closeSync(fd);
+        fs70.closeSync(fd);
       } catch {
       }
     if (!renameSucceeded && !options.interruptBeforeRename)
       try {
-        fs69.existsSync(tmpPath) && fs69.unlinkSync(tmpPath);
+        fs70.existsSync(tmpPath) && fs70.unlinkSync(tmpPath);
       } catch {
       }
   }
@@ -61947,7 +62225,7 @@ function validateDeliveryJournalEntry(item2, filePath, index) {
 }
 function shouldUnlinkAbandonedTmpLockFile(fullPath, fileName, tmpPrefix, nowMs) {
   try {
-    let stat25 = fs69.statSync(fullPath);
+    let stat25 = fs70.statSync(fullPath);
     if (nowMs - stat25.mtimeMs < 50)
       return !1;
     let remainder = fileName.slice(tmpPrefix.length), [pidStr] = remainder.split(".");
@@ -61978,25 +62256,25 @@ var FileDurableTeamDeliveryJournal = class {
   }
   backupCorruptFile() {
     try {
-      if (fs69.existsSync(this.filePath)) {
+      if (fs70.existsSync(this.filePath)) {
         let backupPath = `${this.filePath}.corrupt-${Date.now()}`;
-        fs69.copyFileSync(this.filePath, backupPath);
+        fs70.copyFileSync(this.filePath, backupPath);
       }
     } catch {
     }
   }
   withLock(action2) {
     let lockPath = `${this.filePath}.lock`, dir = path84.dirname(this.filePath);
-    fs69.existsSync(dir) || fs69.mkdirSync(dir, { recursive: !0 });
+    fs70.existsSync(dir) || fs70.mkdirSync(dir, { recursive: !0 });
     let tmpPrefix = `${path84.basename(lockPath)}.tmp.`;
     try {
-      let files = fs69.readdirSync(dir), now = Date.now();
+      let files = fs70.readdirSync(dir), now = Date.now();
       for (let file of files)
         if (file.startsWith(tmpPrefix)) {
           let fullPath = path84.join(dir, file);
           if (shouldUnlinkAbandonedTmpLockFile(fullPath, file, tmpPrefix, now))
             try {
-              fs69.unlinkSync(fullPath);
+              fs70.unlinkSync(fullPath);
             } catch {
             }
         }
@@ -62007,11 +62285,11 @@ var FileDurableTeamDeliveryJournal = class {
     for (; !lockAcquired; ) {
       let fd = null;
       try {
-        fd = fs69.openSync(tmpLockPath, "wx", 384), fs69.writeFileSync(fd, lockPayload, "utf8"), fs69.fsyncSync(fd), fs69.closeSync(fd), fd = null, fs69.linkSync(tmpLockPath, lockPath), lockAcquired = !0;
+        fd = fs70.openSync(tmpLockPath, "wx", 384), fs70.writeFileSync(fd, lockPayload, "utf8"), fs70.fsyncSync(fd), fs70.closeSync(fd), fd = null, fs70.linkSync(tmpLockPath, lockPath), lockAcquired = !0;
       } catch (err) {
         if (err.code === "EEXIST") {
           try {
-            let stat25 = fs69.statSync(lockPath), existingLock = fs69.readFileSync(lockPath, "utf8"), trimmed = existingLock.trim(), ageMs = Date.now() - stat25.mtimeMs, shouldTakeover = !1;
+            let stat25 = fs70.statSync(lockPath), existingLock = fs70.readFileSync(lockPath, "utf8"), trimmed = existingLock.trim(), ageMs = Date.now() - stat25.mtimeMs, shouldTakeover = !1;
             if (trimmed.length === 0)
               ageMs > 50 && (shouldTakeover = !0);
             else {
@@ -62030,7 +62308,7 @@ var FileDurableTeamDeliveryJournal = class {
             }
             if (shouldTakeover) {
               try {
-                fs69.readFileSync(lockPath, "utf8") === existingLock && fs69.unlinkSync(lockPath);
+                fs70.readFileSync(lockPath, "utf8") === existingLock && fs70.unlinkSync(lockPath);
               } catch {
               }
               continue;
@@ -62048,13 +62326,13 @@ var FileDurableTeamDeliveryJournal = class {
       } finally {
         if (fd !== null) {
           try {
-            fs69.closeSync(fd);
+            fs70.closeSync(fd);
           } catch {
           }
           fd = null;
         }
         try {
-          fs69.existsSync(tmpLockPath) && fs69.unlinkSync(tmpLockPath);
+          fs70.existsSync(tmpLockPath) && fs70.unlinkSync(tmpLockPath);
         } catch {
         }
       }
@@ -62064,7 +62342,7 @@ var FileDurableTeamDeliveryJournal = class {
     } finally {
       if (lockAcquired)
         try {
-          fs69.readFileSync(lockPath, "utf8") === lockPayload && fs69.unlinkSync(lockPath);
+          fs70.readFileSync(lockPath, "utf8") === lockPayload && fs70.unlinkSync(lockPath);
         } catch {
         }
     }
@@ -62094,12 +62372,12 @@ var FileDurableTeamDeliveryJournal = class {
     atomicWriteJsonSync(this.filePath, serializedText, options), this.entries = validatedMap;
   }
   load() {
-    if (!fs69.existsSync(this.filePath)) {
+    if (!fs70.existsSync(this.filePath)) {
       this.entries.clear(), this.isCorrupted = !1, this.corruptionError = null;
       return;
     }
     try {
-      let raw = fs69.readFileSync(this.filePath, "utf8"), data;
+      let raw = fs70.readFileSync(this.filePath, "utf8"), data;
       try {
         data = JSON.parse(raw);
       } catch (parseErr) {
@@ -62144,7 +62422,7 @@ var FileDurableTeamDeliveryJournal = class {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     validateDeliveryJournalEntry(pendingEntry, this.filePath), this.withLock(() => {
-      fs69.existsSync(this.filePath) && this.load();
+      fs70.existsSync(this.filePath) && this.load();
       let existing = this.entries.get(deliveryId);
       if (existing && existing.status === "SENT")
         return;
@@ -62154,7 +62432,7 @@ var FileDurableTeamDeliveryJournal = class {
   }
   claimDeliveryAdmission(deliveryId, summaryPayload, routing) {
     return this.assertNotCorrupted(), this.withLock(() => {
-      fs69.existsSync(this.filePath) && this.load();
+      fs70.existsSync(this.filePath) && this.load();
       let existing = this.entries.get(deliveryId);
       if (existing && existing.status === "SENT")
         return { admitted: !1, alreadySent: !0, existingEntry: existing };
@@ -62180,7 +62458,7 @@ var FileDurableTeamDeliveryJournal = class {
   releaseDeliveryAdmission(deliveryId, claimToken) {
     try {
       this.withLock(() => {
-        fs69.existsSync(this.filePath) && this.load();
+        fs70.existsSync(this.filePath) && this.load();
         let existing = this.entries.get(deliveryId);
         if (existing && existing.status !== "SENT") {
           if (existing.claimToken && (!claimToken || typeof claimToken != "string" || claimToken.trim().length === 0 || existing.claimToken !== claimToken))
@@ -62199,7 +62477,7 @@ var FileDurableTeamDeliveryJournal = class {
     if (typeof claimTokenOrOptions == "string" ? (claimToken = claimTokenOrOptions, options = maybeOptions || {}) : claimTokenOrOptions && typeof claimTokenOrOptions == "object" && (options = claimTokenOrOptions), !receipt2 || typeof receipt2 != "object" || receipt2.emitted !== !0 || typeof receipt2.eventId != "string" || receipt2.eventId.trim().length === 0)
       throw new Error("Invalid ShellEventEmitResult receipt: " + JSON.stringify(receipt2));
     this.withLock(() => {
-      fs69.existsSync(this.filePath) && this.load();
+      fs70.existsSync(this.filePath) && this.load();
       let entry5 = this.entries.get(deliveryId);
       if (!entry5)
         throw new Error(`Delivery entry not found in journal: ${deliveryId}`);
@@ -62222,13 +62500,13 @@ var FileDurableTeamDeliveryJournal = class {
     });
   }
   getEntry(deliveryId) {
-    return fs69.existsSync(this.filePath) && this.load(), this.entries.get(deliveryId) || null;
+    return fs70.existsSync(this.filePath) && this.load(), this.entries.get(deliveryId) || null;
   }
   getPendingEntries() {
-    return fs69.existsSync(this.filePath) && this.load(), Array.from(this.entries.values()).filter((e) => e.status === "PENDING");
+    return fs70.existsSync(this.filePath) && this.load(), Array.from(this.entries.values()).filter((e) => e.status === "PENDING");
   }
   getAllEntries() {
-    return fs69.existsSync(this.filePath) && this.load(), Array.from(this.entries.values());
+    return fs70.existsSync(this.filePath) && this.load(), Array.from(this.entries.values());
   }
 }, UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function wireSnapshotMergeObserver(existingArgs = {}) {
@@ -62286,7 +62564,7 @@ async function emitTeamCompletionSummary(options) {
     store,
     leEmitFn
   } = options;
-  fs69.existsSync(store.filePath) && store.load();
+  fs70.existsSync(store.filePath) && store.load();
   let existing = store.getEntry(deliveryId);
   if (existing && existing.status === "SENT") {
     if (leadTaskId && existing.leadTaskId && leadTaskId !== existing.leadTaskId)
@@ -62408,11 +62686,11 @@ init_workspace_authority();
 init_anchored_fs();
 
 // src/local-executor/merge-train.ts
-var crypto26 = __toESM(require("node:crypto")), fs71 = __toESM(require("node:fs/promises")), os40 = __toESM(require("node:os")), path86 = __toESM(require("node:path"));
+var crypto26 = __toESM(require("node:crypto")), fs72 = __toESM(require("node:fs/promises")), os40 = __toESM(require("node:os")), path86 = __toESM(require("node:path"));
 init_logger2();
 
 // src/local-executor/worktree-merge.ts
-var import_node_child_process16 = require("node:child_process"), crypto25 = __toESM(require("node:crypto")), fs70 = __toESM(require("node:fs/promises")), os39 = __toESM(require("node:os")), path85 = __toESM(require("node:path")), import_node_util = require("node:util");
+var import_node_child_process16 = require("node:child_process"), crypto25 = __toESM(require("node:crypto")), fs71 = __toESM(require("node:fs/promises")), os39 = __toESM(require("node:os")), path85 = __toESM(require("node:path")), import_node_util = require("node:util");
 
 // src/local-executor/git-lock-retry.ts
 var realSleep = (ms) => new Promise((resolve35) => setTimeout(resolve35, ms));
@@ -62853,7 +63131,7 @@ async function captureUntrackedTree(repoDir, taskGroupId, repoId) {
       // #65 — race an in-flight revise's ref write
     }), tree;
   } finally {
-    await fs70.rm(tmpIndex, { force: !0 }).catch(() => {
+    await fs71.rm(tmpIndex, { force: !0 }).catch(() => {
     });
   }
 }
@@ -62954,7 +63232,7 @@ async function snapshotWorktreeTreeSeeded(repoDir, seedRef) {
     let { stdout } = await gitWithIndex(repoDir, tmpIndex, ["write-tree"]);
     return stdout.trim();
   } finally {
-    await fs70.rm(tmpIndex, { force: !0 }).catch(() => {
+    await fs71.rm(tmpIndex, { force: !0 }).catch(() => {
     });
   }
 }
@@ -62995,7 +63273,7 @@ async function normalizingRawDigest(repoDir, paths) {
   for (let p of normalizing) {
     hash3.update(`${p.length}:${p}\0`);
     try {
-      let bytes = await fs70.readFile(path85.join(repoDir, p));
+      let bytes = await fs71.readFile(path85.join(repoDir, p));
       hash3.update(`${bytes.length}:`), hash3.update(bytes);
     } catch {
       hash3.update("
ABSENT
");
@@ -63057,7 +63335,7 @@ async function reconstructPostResetAnchor(repoDir, targetRef, entryWorktreeTree,
     });
     return;
   } finally {
-    await fs70.rm(tmpIndex, { force: !0 }).catch(() => {
+    await fs71.rm(tmpIndex, { force: !0 }).catch(() => {
     });
   }
 }
@@ -63089,7 +63367,7 @@ async function reconstructDirtyUncommittedPostPromoteTree(repoDir, integrationTr
     });
     return;
   } finally {
-    await fs70.rm(tmpIndex, { force: !0 }).catch(() => {
+    await fs71.rm(tmpIndex, { force: !0 }).catch(() => {
     });
   }
 }
@@ -63956,23 +64234,23 @@ async function catBlobRaw(repoDir, oid) {
 }
 async function hashObjectW(repoDir, bytes) {
   let tmp = path85.join(os39.tmpdir(), `cp14-w3-blob-${crypto25.randomBytes(8).toString("hex")}`);
-  await fs70.writeFile(tmp, bytes);
+  await fs71.writeFile(tmp, bytes);
   try {
     return (await git(repoDir, ["hash-object", "-w", "--no-filters", "--", tmp], { hermetic: !0 })).stdout.trim();
   } finally {
-    await fs70.rm(tmp, { force: !0 });
+    await fs71.rm(tmp, { force: !0 });
   }
 }
 async function diff3MergeBlobs(repoDir, oursOid, baseOid, theirsOid) {
-  let dir = await fs70.mkdtemp(path85.join(os39.tmpdir(), "cp14-w3-mf-"));
+  let dir = await fs71.mkdtemp(path85.join(os39.tmpdir(), "cp14-w3-mf-"));
   try {
     let oursF = path85.join(dir, "ours"), baseF = path85.join(dir, "base"), theirsF = path85.join(dir, "theirs");
-    return await fs70.writeFile(oursF, await catBlobRaw(repoDir, oursOid)), await fs70.writeFile(baseF, baseOid ? await catBlobRaw(repoDir, baseOid) : Buffer.alloc(0)), await fs70.writeFile(theirsF, await catBlobRaw(repoDir, theirsOid)), (await git(repoDir, ["merge-file", "-p", "--diff3", oursF, baseF, theirsF], {
+    return await fs71.writeFile(oursF, await catBlobRaw(repoDir, oursOid)), await fs71.writeFile(baseF, baseOid ? await catBlobRaw(repoDir, baseOid) : Buffer.alloc(0)), await fs71.writeFile(theirsF, await catBlobRaw(repoDir, theirsOid)), (await git(repoDir, ["merge-file", "-p", "--diff3", oursF, baseF, theirsF], {
       allowFail: !0,
       hermetic: !0
     })).stdout;
   } finally {
-    await fs70.rm(dir, { recursive: !0, force: !0 });
+    await fs71.rm(dir, { recursive: !0, force: !0 });
   }
 }
 async function extractThreeWayConflict(repoDir, oursCommit, theirsCommit, p) {
@@ -64019,7 +64297,7 @@ async function assembleResolvedTree(repoDir, conflictedTree, resolved) {
     }
     return await runIdx(["write-tree"]);
   } finally {
-    await fs70.rm(idx, { force: !0 });
+    await fs71.rm(idx, { force: !0 });
   }
 }
 async function commitTreeOffBranch(repoDir, tree, parents, message2, opts = {}) {
@@ -66306,7 +66584,7 @@ async function runTier1OnIntegrationWorktree(repoDir, integrationTip, tracks, co
       repoDir,
       attributePathCount: treeDanger.length
     }), { status: "attribute_halt", attributePaths: treeDanger };
-  let wtDir = await fs71.mkdtemp(path86.join(os40.tmpdir(), "cv-tier1-")), worktreeAdded = !1;
+  let wtDir = await fs72.mkdtemp(path86.join(os40.tmpdir(), "cv-tier1-")), worktreeAdded = !1;
   try {
     let add = await pinnedGit(
       repoDir,
@@ -66345,10 +66623,10 @@ async function runTier1OnIntegrationWorktree(repoDir, integrationTip, tracks, co
         trackIndex: -1,
         // a union run — not a single track.
         runShell: runShellCommand,
-        lstat: fs71.lstat,
-        realpath: fs71.realpath,
-        stat: fs71.stat,
-        readFile: (p) => fs71.readFile(p, "utf8"),
+        lstat: fs72.lstat,
+        realpath: fs72.realpath,
+        stat: fs72.stat,
+        readFile: (p) => fs72.readFile(p, "utf8"),
         timeoutMs
       });
       if (declared.outcome === "fail")
@@ -66360,7 +66638,7 @@ async function runTier1OnIntegrationWorktree(repoDir, integrationTip, tracks, co
     }
     return { status: "pass" };
   } finally {
-    worktreeAdded && await pinnedGit(repoDir, ["worktree", "remove", "--force", wtDir], { allowFail: !0 }), await fs71.rm(wtDir, { recursive: !0, force: !0 }).catch(() => {
+    worktreeAdded && await pinnedGit(repoDir, ["worktree", "remove", "--force", wtDir], { allowFail: !0 }), await fs72.rm(wtDir, { recursive: !0, force: !0 }).catch(() => {
     }), worktreeAdded && await pinnedGit(repoDir, ["worktree", "prune"], { allowFail: !0 });
   }
 }
@@ -66612,7 +66890,7 @@ async function detectGraftsHalt(repoDir, integrationTip) {
   if (graftsPath.length === 0) return null;
   let resolved = path86.isAbsolute(graftsPath) ? graftsPath : path86.join(repoDir, graftsPath), content;
   try {
-    content = await fs71.readFile(resolved, "utf8");
+    content = await fs72.readFile(resolved, "utf8");
   } catch (err) {
     return err?.code === "ENOENT" ? null : { status: "grafts_halt", graftsPath: resolved, integrationTip };
   }
@@ -66632,7 +66910,7 @@ async function detectShallowHalt(repoDir, integrationTip) {
     return isShallow.code === 0 && isShallow.stdout.trim() === "false" ? null : { status: "shallow_halt", shallowPath: resolved, integrationTip };
   let present;
   try {
-    await fs71.access(resolved), present = !0;
+    await fs72.access(resolved), present = !0;
   } catch (err) {
     if (err?.code === "ENOENT") return null;
     present = !0;
@@ -67152,7 +67430,7 @@ async function reconstructResolutionSetEntry(repoDir, commit, setHash, repoId, m
 }
 
 // src/local-executor/conflict-resolution-durable-store.ts
-var import_node_crypto50 = require("node:crypto"), import_node_fs38 = require("node:fs"), fs72 = __toESM(require("node:fs/promises")), os41 = __toESM(require("node:os")), path87 = __toESM(require("node:path")), DIR_MODE5 = 448, FILE_MODE7 = 384, RECORDS_FILE = "records.json", AGENTIC_RECORDS_FILE = "agentic-records.json", PENDING_FILE = "pending-attempts.json", INDEX_FILE = "resolution-sets.json";
+var import_node_crypto50 = require("node:crypto"), import_node_fs39 = require("node:fs"), fs73 = __toESM(require("node:fs/promises")), os41 = __toESM(require("node:os")), path87 = __toESM(require("node:path")), DIR_MODE5 = 448, FILE_MODE7 = 384, RECORDS_FILE = "records.json", AGENTIC_RECORDS_FILE = "agentic-records.json", PENDING_FILE = "pending-attempts.json", INDEX_FILE = "resolution-sets.json";
 function defaultRoot() {
   return path87.join(os41.homedir(), ".codevibe", "conflict-resolutions");
 }
@@ -67174,7 +67452,7 @@ var SafeGroupDir = class {
     for (let i = -1; i < segments.length; i++) {
       i >= 0 && (cur = path87.join(cur, segments[i]));
       try {
-        if ((await fs72.lstat(cur)).isSymbolicLink())
+        if ((await fs73.lstat(cur)).isSymbolicLink())
           throw new Error("ConflictResolutionDurableStore: refusing a symlinked path component");
       } catch (err) {
         if (err.code === "ENOENT") return;
@@ -67186,7 +67464,7 @@ var SafeGroupDir = class {
     let p = path87.join(this.dir(), file);
     await this.assertNoSymlinkComponents(p);
     try {
-      let raw = await fs72.readFile(p, "utf8");
+      let raw = await fs73.readFile(p, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (err.code === "ENOENT") return null;
@@ -67195,19 +67473,19 @@ var SafeGroupDir = class {
   }
   async writeJsonAtomic(file, value) {
     let dir = this.dir(), p = path87.join(dir, file);
-    await this.assertNoSymlinkComponents(p), await fs72.mkdir(dir, { recursive: !0, mode: DIR_MODE5 });
+    await this.assertNoSymlinkComponents(p), await fs73.mkdir(dir, { recursive: !0, mode: DIR_MODE5 });
     let data = JSON.stringify(value), tmp = `${p}.tmp.${process.pid}.${(0, import_node_crypto50.randomBytes)(6).toString("hex")}`, fh;
     try {
-      fh = await fs72.open(tmp, import_node_fs38.constants.O_WRONLY | import_node_fs38.constants.O_CREAT | import_node_fs38.constants.O_EXCL, FILE_MODE7), await fh.writeFile(data, "utf8"), await fh.sync();
+      fh = await fs73.open(tmp, import_node_fs39.constants.O_WRONLY | import_node_fs39.constants.O_CREAT | import_node_fs39.constants.O_EXCL, FILE_MODE7), await fh.writeFile(data, "utf8"), await fh.sync();
     } finally {
       await fh?.close().catch(() => {
       });
     }
-    await fs72.chmod(tmp, FILE_MODE7).catch(() => {
-    }), await fs72.rename(tmp, p);
+    await fs73.chmod(tmp, FILE_MODE7).catch(() => {
+    }), await fs73.rename(tmp, p);
     let dirFh;
     try {
-      dirFh = await fs72.open(dir, import_node_fs38.constants.O_RDONLY), await dirFh.sync();
+      dirFh = await fs73.open(dir, import_node_fs39.constants.O_RDONLY), await dirFh.sync();
     } catch {
     } finally {
       await dirFh?.close().catch(() => {
@@ -67347,7 +67625,7 @@ function listShadowCleanupResidueWithRetry(taskIds, env = {}) {
 init_process_identity();
 
 // src/local-executor/merge-journal-store.ts
-var crypto27 = __toESM(require("node:crypto")), fs73 = __toESM(require("node:fs/promises")), import_node_fs39 = require("node:fs"), os42 = __toESM(require("node:os")), path88 = __toESM(require("node:path"));
+var crypto27 = __toESM(require("node:crypto")), fs74 = __toESM(require("node:fs/promises")), import_node_fs40 = require("node:fs"), os42 = __toESM(require("node:os")), path88 = __toESM(require("node:path"));
 init_logger2();
 var DIR_MODE6 = 448, FILE_MODE8 = 384, MERGE_JOURNAL_VERSION = 1, MERGE_JOURNAL_FILE = "merge.json";
 function defaultRoot2() {
@@ -67381,7 +67659,7 @@ var MergeJournalStore = class {
     return seg;
   }
   async mkdirSecure(dir) {
-    await fs73.mkdir(dir, { recursive: !0, mode: DIR_MODE6 });
+    await fs74.mkdir(dir, { recursive: !0, mode: DIR_MODE6 });
   }
   /**
    * Refuse to operate under a path whose any in-`rootDir` component is a symlink
@@ -67397,7 +67675,7 @@ var MergeJournalStore = class {
       i >= 0 && (cur = path88.join(cur, segments[i]));
       let st;
       try {
-        st = await fs73.lstat(cur);
+        st = await fs74.lstat(cur);
       } catch (err) {
         if (err.code === "ENOENT") return;
         throw err;
@@ -67412,20 +67690,20 @@ var MergeJournalStore = class {
     await this.assertNoSymlinkComponents(finalPath), await this.mkdirSecure(dir);
     let tmp = `${finalPath}.tmp.${process.pid}.${crypto27.randomBytes(6).toString("hex")}`, fh;
     try {
-      fh = await fs73.open(
+      fh = await fs74.open(
         tmp,
-        import_node_fs39.constants.O_WRONLY | import_node_fs39.constants.O_CREAT | import_node_fs39.constants.O_EXCL,
+        import_node_fs40.constants.O_WRONLY | import_node_fs40.constants.O_CREAT | import_node_fs40.constants.O_EXCL,
         FILE_MODE8
       ), await fh.writeFile(data, "utf8"), await fh.sync();
     } finally {
       await fh?.close().catch(() => {
       });
     }
-    await fs73.chmod(tmp, FILE_MODE8).catch(() => {
-    }), await fs73.rename(tmp, finalPath);
+    await fs74.chmod(tmp, FILE_MODE8).catch(() => {
+    }), await fs74.rename(tmp, finalPath);
     let dirFh;
     try {
-      dirFh = await fs73.open(dir, import_node_fs39.constants.O_RDONLY), await dirFh.sync();
+      dirFh = await fs74.open(dir, import_node_fs40.constants.O_RDONLY), await dirFh.sync();
     } catch {
     } finally {
       await dirFh?.close().catch(() => {
@@ -67435,7 +67713,7 @@ var MergeJournalStore = class {
   async readJson(p) {
     await this.assertNoSymlinkComponents(p);
     try {
-      let raw = await fs73.readFile(p, "utf8");
+      let raw = await fs74.readFile(p, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (err.code === "ENOENT") return null;
@@ -67707,7 +67985,7 @@ var MergeJournalStore = class {
   }
   /** Delete the journal record for `(group, repo)` (terminal cleanup / GC). */
   async deleteRecord(taskGroupId, repoId) {
-    await fs73.rm(this.repoDir(taskGroupId, repoId), { recursive: !0, force: !0 }).catch(() => {
+    await fs74.rm(this.repoDir(taskGroupId, repoId), { recursive: !0, force: !0 }).catch(() => {
     });
   }
 };
@@ -67728,7 +68006,7 @@ function tracksEqual(a, b) {
 }
 
 // src/local-executor/promote-wal-store.ts
-var crypto28 = __toESM(require("node:crypto")), fs74 = __toESM(require("node:fs/promises")), import_node_fs40 = require("node:fs"), os43 = __toESM(require("node:os")), path89 = __toESM(require("node:path"));
+var crypto28 = __toESM(require("node:crypto")), fs75 = __toESM(require("node:fs/promises")), import_node_fs41 = require("node:fs"), os43 = __toESM(require("node:os")), path89 = __toESM(require("node:path"));
 init_logger2();
 var DIR_MODE7 = 448, FILE_MODE9 = 384, PROMOTE_WAL_VERSION = 1, PROMOTE_WAL_FILE = "promote.json";
 function defaultRoot3() {
@@ -67763,7 +68041,7 @@ var PromoteWalStore = class {
     return seg;
   }
   async mkdirSecure(dir) {
-    await fs74.mkdir(dir, { recursive: !0, mode: DIR_MODE7 });
+    await fs75.mkdir(dir, { recursive: !0, mode: DIR_MODE7 });
   }
   /**
    * Refuse to operate under a path whose any in-`rootDir` component is a symlink
@@ -67779,7 +68057,7 @@ var PromoteWalStore = class {
       i >= 0 && (cur = path89.join(cur, segments[i]));
       let st;
       try {
-        st = await fs74.lstat(cur);
+        st = await fs75.lstat(cur);
       } catch (err) {
         if (err.code === "ENOENT") return;
         throw err;
@@ -67794,20 +68072,20 @@ var PromoteWalStore = class {
     await this.assertNoSymlinkComponents(finalPath), await this.mkdirSecure(dir);
     let tmp = `${finalPath}.tmp.${process.pid}.${crypto28.randomBytes(6).toString("hex")}`, fh;
     try {
-      fh = await fs74.open(
+      fh = await fs75.open(
         tmp,
-        import_node_fs40.constants.O_WRONLY | import_node_fs40.constants.O_CREAT | import_node_fs40.constants.O_EXCL,
+        import_node_fs41.constants.O_WRONLY | import_node_fs41.constants.O_CREAT | import_node_fs41.constants.O_EXCL,
         FILE_MODE9
       ), await fh.writeFile(data, "utf8"), await fh.sync();
     } finally {
       await fh?.close().catch(() => {
       });
     }
-    await fs74.chmod(tmp, FILE_MODE9).catch(() => {
-    }), await fs74.rename(tmp, finalPath);
+    await fs75.chmod(tmp, FILE_MODE9).catch(() => {
+    }), await fs75.rename(tmp, finalPath);
     let dirFh;
     try {
-      dirFh = await fs74.open(dir, import_node_fs40.constants.O_RDONLY), await dirFh.sync();
+      dirFh = await fs75.open(dir, import_node_fs41.constants.O_RDONLY), await dirFh.sync();
     } catch {
     } finally {
       await dirFh?.close().catch(() => {
@@ -67817,7 +68095,7 @@ var PromoteWalStore = class {
   async readJson(p) {
     await this.assertNoSymlinkComponents(p);
     try {
-      let raw = await fs74.readFile(p, "utf8");
+      let raw = await fs75.readFile(p, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (err.code === "ENOENT") return null;
@@ -67979,7 +68257,7 @@ var PromoteWalStore = class {
   }
   /** Delete the WAL record for `(group, repo)` (terminal cleanup / GC). */
   async deleteRecord(taskGroupId, repoId) {
-    await fs74.rm(this.repoDir(taskGroupId, repoId), { recursive: !0, force: !0 }).catch(() => {
+    await fs75.rm(this.repoDir(taskGroupId, repoId), { recursive: !0, force: !0 }).catch(() => {
     });
   }
   /**
@@ -67990,7 +68268,7 @@ var PromoteWalStore = class {
   async listStartedNotCommitted() {
     let out = [], groups;
     try {
-      groups = (await fs74.readdir(this.rootDir, { withFileTypes: !0 })).filter((e) => e.isDirectory()).map((e) => e.name);
+      groups = (await fs75.readdir(this.rootDir, { withFileTypes: !0 })).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch (err) {
       if (err.code === "ENOENT") return out;
       throw err;
@@ -67998,7 +68276,7 @@ var PromoteWalStore = class {
     for (let gid of groups) {
       let repos;
       try {
-        repos = (await fs74.readdir(path89.join(this.rootDir, gid), { withFileTypes: !0 })).filter((e) => e.isDirectory()).map((e) => e.name);
+        repos = (await fs75.readdir(path89.join(this.rootDir, gid), { withFileTypes: !0 })).filter((e) => e.isDirectory()).map((e) => e.name);
       } catch {
         continue;
       }
@@ -68480,7 +68758,7 @@ var LocalExecutorImpl = class {
           combinedOnExit
         );
       } catch (spawnErr) {
-        throw capture !== void 0 && await import_node_fs41.promises.rm(path90.dirname(capture.hostPath), { recursive: !0, force: !0 }).catch(() => {
+        throw capture !== void 0 && await import_node_fs42.promises.rm(path90.dirname(capture.hostPath), { recursive: !0, force: !0 }).catch(() => {
         }), spawnErr;
       }
       return capture !== void 0 && (handle.lastMessageCapturePath = capture.hostPath), advisoryAdmission && this.bindAdvisorySpawn(advisoryAdmission, handle), handle;
@@ -68659,7 +68937,7 @@ var LocalExecutorImpl = class {
       ), { args, substrateEngaged: !1 };
     }
     let isWebActive = args.webTurnActive === !0, readOnlyView = args.implementorMode === "plan" || isPlanModeImplementorArgv(agentKind, args.argv), captureDir = readOnlyView && agentKind === "CODEX" && args.argv.includes("--output-last-message") ? await this.createCaptureDir(effectiveTaskId) : null, removeCaptureDir = async () => {
-      captureDir !== null && await import_node_fs41.promises.rm(captureDir, { recursive: !0, force: !0 }).catch(() => {
+      captureDir !== null && await import_node_fs42.promises.rm(captureDir, { recursive: !0, force: !0 }).catch(() => {
       });
     }, result;
     try {
@@ -68774,7 +69052,7 @@ var LocalExecutorImpl = class {
         viewParent: await config.viewParent(),
         argvFor: (view) => buildImplementorArgv(agentKind, mode, view).argv,
         spawn: (spawnArgs) => this.spawnImplementor(spawnArgs),
-        ...this.taskFolder ? { removeTaskFolder: (taskId) => import_node_fs41.promises.rm(this.taskFolder(taskId), { recursive: !0, force: !0 }) } : {}
+        ...this.taskFolder ? { removeTaskFolder: (taskId) => import_node_fs42.promises.rm(this.taskFolder(taskId), { recursive: !0, force: !0 }) } : {}
       }), result = {
         key,
         agentKind,
@@ -68803,11 +69081,11 @@ var LocalExecutorImpl = class {
    */
   async createCaptureDir(taskId) {
     if (this.taskFolder === void 0)
-      return import_node_fs41.promises.realpath(await import_node_fs41.promises.mkdtemp(path90.join(os44.tmpdir(), "codevibe-capture-")));
+      return import_node_fs42.promises.realpath(await import_node_fs42.promises.mkdtemp(path90.join(os44.tmpdir(), "codevibe-capture-")));
     let parent = path90.join(this.taskFolder(taskId), "capture");
-    await import_node_fs41.promises.mkdir(parent, { recursive: !0, mode: 448 });
+    await import_node_fs42.promises.mkdir(parent, { recursive: !0, mode: 448 });
     let dir = path90.join(parent, (0, import_node_crypto51.randomUUID)());
-    return await import_node_fs41.promises.mkdir(dir, { mode: 448 }), import_node_fs41.promises.realpath(dir);
+    return await import_node_fs42.promises.mkdir(dir, { mode: 448 }), import_node_fs42.promises.realpath(dir);
   }
   /**
    * CP-7 PART F — surface the PROMINENT reduced-trust badge (§6 Q2). The moat
@@ -70564,7 +70842,7 @@ var LocalExecutorImpl = class {
 init_env_scrub();
 
 // src/local-executor/cp7-audit-writer.ts
-var import_node_fs42 = require("node:fs"), import_node_crypto52 = require("node:crypto"), import_uuid13 = require("uuid");
+var import_node_fs43 = require("node:fs"), import_node_crypto52 = require("node:crypto"), import_uuid13 = require("uuid");
 init_logger2();
 var CANONICAL_FIELD_ORDER = [
   "entry_id",
@@ -70721,19 +70999,19 @@ var Cp7AuditWriter = class {
         prev_hash: this.lastHash,
         event_dedup_key: eventDedupKey
       }, line = canonicalEntryBytes(entry5) + `
-`, fd = (0, import_node_fs42.openSync)(
+`, fd = (0, import_node_fs43.openSync)(
         this.auditPath,
-        import_node_fs42.constants.O_CREAT | import_node_fs42.constants.O_APPEND | import_node_fs42.constants.O_WRONLY | import_node_fs42.constants.O_NOFOLLOW,
+        import_node_fs43.constants.O_CREAT | import_node_fs43.constants.O_APPEND | import_node_fs43.constants.O_WRONLY | import_node_fs43.constants.O_NOFOLLOW,
         384
       );
       try {
-        let st = (0, import_node_fs42.fstatSync)(fd);
+        let st = (0, import_node_fs43.fstatSync)(fd);
         if (!st.isFile())
           throw new Error(
             `Cp7AuditWriter: audit target "${this.auditPath}" is not a regular file (mode=0o${(st.mode & 61440).toString(8)}) \u2014 refusing to write`
           );
       } catch (statErr) {
-        throw (0, import_node_fs42.closeSync)(fd), statErr;
+        throw (0, import_node_fs43.closeSync)(fd), statErr;
       }
     } catch (err) {
       let reason = err instanceof Error ? err.message : String(err);
@@ -70747,18 +71025,18 @@ var Cp7AuditWriter = class {
     try {
       let off = 0;
       for (; off < buf.length; ) {
-        let n = (0, import_node_fs42.writeSync)(fd, buf, off, buf.length - off);
+        let n = (0, import_node_fs43.writeSync)(fd, buf, off, buf.length - off);
         if (n === 0)
           throw new Error(
             `Cp7AuditWriter: writeSync made no progress (0 bytes) at offset ${off}/${buf.length} \u2014 refusing to spin on a stalled write`
           );
         off += n;
       }
-      (0, import_node_fs42.fsyncSync)(fd), (0, import_node_fs42.closeSync)(fd);
+      (0, import_node_fs43.fsyncSync)(fd), (0, import_node_fs43.closeSync)(fd);
     } catch (err) {
       let reason = err instanceof Error ? err.message : String(err);
       try {
-        (0, import_node_fs42.closeSync)(fd);
+        (0, import_node_fs43.closeSync)(fd);
       } catch {
       }
       return this.poisoned = reason, logger.warn(
@@ -70779,7 +71057,7 @@ var Cp7AuditWriter = class {
   readLastHashFromFile() {
     let content;
     try {
-      content = (0, import_node_fs42.readFileSync)(this.auditPath, "utf8");
+      content = (0, import_node_fs43.readFileSync)(this.auditPath, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return null;
       throw e;
@@ -74528,7 +74806,7 @@ function withImplementorCredentialPreflight(engage, store) {
 init_bwrap();
 
 // src/substrate/sandbox-exec.ts
-var import_node_fs45 = require("node:fs"), fsSync10 = __toESM(require("node:fs")), os48 = __toESM(require("node:os")), path100 = __toESM(require("node:path"));
+var import_node_fs46 = require("node:fs"), fsSync10 = __toESM(require("node:fs")), os48 = __toESM(require("node:os")), path100 = __toESM(require("node:path"));
 init_command_runner();
 var import_node_path6 = require("node:path");
 init_errors();
@@ -74536,7 +74814,7 @@ init_workspace_authority();
 init_grant_rule();
 
 // src/substrate/seatbelt-grants.ts
-var fs79 = __toESM(require("node:fs")), path99 = __toESM(require("node:path"));
+var fs80 = __toESM(require("node:fs")), path99 = __toESM(require("node:path"));
 init_grant_rule();
 var esc = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 function seatbeltRegexEscape(literal) {
@@ -74591,7 +74869,7 @@ function hideBlockLines(opts) {
   for (let p of [...parents].sort()) lines.push(`(allow file-read-metadata (literal "${esc(p)}"))`);
   return lines;
 }
-function hasCaseVariantSibling(p, readdir21 = (d) => fs79.readdirSync(d)) {
+function hasCaseVariantSibling(p, readdir21 = (d) => fs80.readdirSync(d)) {
   let cur = path99.resolve(p);
   for (; cur !== path99.dirname(cur); ) {
     let parent = path99.dirname(cur), name = path99.basename(cur), siblings;
@@ -74605,7 +74883,7 @@ function hasCaseVariantSibling(p, readdir21 = (d) => fs79.readdirSync(d)) {
   }
   return !1;
 }
-function ownFolderCaseRefusal(p, readdir21 = (d) => fs79.readdirSync(d)) {
+function ownFolderCaseRefusal(p, readdir21 = (d) => fs80.readdirSync(d)) {
   let cur = path99.resolve(p);
   for (; cur !== path99.dirname(cur); ) {
     let parent = path99.dirname(cur), name = path99.basename(cur), siblings;
@@ -74935,7 +75213,7 @@ async function resolveOnParentPath(cmd) {
     if (!dir) continue;
     let candidate = path100.join(dir, cmd);
     try {
-      return await import_node_fs45.promises.access(candidate, import_node_fs45.constants.X_OK), candidate;
+      return await import_node_fs46.promises.access(candidate, import_node_fs46.constants.X_OK), candidate;
     } catch {
     }
   }
@@ -74965,7 +75243,7 @@ var SandboxExecHandle = class {
         "sandbox_exec",
         `agent binary '${argv[0]}' not found on the host PATH \u2014 cannot exec in the sandbox`
       );
-    let realArgv0 = await import_node_fs45.promises.realpath(resolvedArgv0).catch(() => resolvedArgv0), deniedRoots = [
+    let realArgv0 = await import_node_fs46.promises.realpath(resolvedArgv0).catch(() => resolvedArgv0), deniedRoots = [
       path100.join(os48.homedir(), ".codevibe"),
       path100.join(this.workdir, ".git"),
       ...this.auditDir !== null ? [this.auditDir] : []
@@ -75014,7 +75292,7 @@ ${[
     ].join(`
 `)}
 ` : "";
-    await import_node_fs45.promises.appendFile(
+    await import_node_fs46.promises.appendFile(
       this.profilePath,
       `
 ; exec-time agent-binary read allowance (argv0 resolution, 2026-07-03)
@@ -75046,7 +75324,7 @@ ${tail}`
         }
         this.proc = null;
       }
-      await import_node_fs45.promises.rm(this.profilePath, { force: !0 }).catch(() => {
+      await import_node_fs46.promises.rm(this.profilePath, { force: !0 }).catch(() => {
       });
     }
   }
@@ -75069,14 +75347,14 @@ ${tail}`
       ), canonicalWorkdir = spec.workdirAuthority.canonicalPath;
     else
       try {
-        canonicalWorkdir = await import_node_fs45.promises.realpath(spec.workdir);
+        canonicalWorkdir = await import_node_fs46.promises.realpath(spec.workdir);
       } catch {
       }
     let extraReadDirs = [];
     if (spec.agentBootstrap) {
       let bootstrapDir = spec.agentBootstrap.hostDir;
       try {
-        bootstrapDir = await import_node_fs45.promises.realpath(bootstrapDir);
+        bootstrapDir = await import_node_fs46.promises.realpath(bootstrapDir);
       } catch {
       }
       let refusal = ownFolderCaseRefusal(bootstrapDir);
@@ -75087,12 +75365,12 @@ ${tail}`
     if (spec.agentConfig) {
       let configDir = spec.agentConfig.hostDir;
       try {
-        configDir = await import_node_fs45.promises.realpath(configDir);
+        configDir = await import_node_fs46.promises.realpath(configDir);
       } catch {
       }
       extraWriteDirs.push(configDir);
     }
-    if (spec.captureDir && extraWriteDirs.push(await import_node_fs45.promises.realpath(spec.captureDir)), spec.agentScratch) {
+    if (spec.captureDir && extraWriteDirs.push(await import_node_fs46.promises.realpath(spec.captureDir)), spec.agentScratch) {
       try {
         await assertWorkspaceRootAuthority(
           spec.agentScratch.hostDir,
@@ -75112,14 +75390,14 @@ ${tail}`
     if (spec.auditDir) {
       resolvedAuditDir = spec.auditDir;
       try {
-        resolvedAuditDir = await import_node_fs45.promises.realpath(spec.auditDir);
+        resolvedAuditDir = await import_node_fs46.promises.realpath(spec.auditDir);
       } catch {
       }
     }
     let canonicalReview = spec.reviewGrants ? {
-      bundleDir: await import_node_fs45.promises.realpath(spec.reviewGrants.bundleDir),
+      bundleDir: await import_node_fs46.promises.realpath(spec.reviewGrants.bundleDir),
       ...spec.reviewGrants.maskedOriginal ? { maskedOriginal: {
-        dir: await import_node_fs45.promises.realpath(spec.reviewGrants.maskedOriginal.dir),
+        dir: await import_node_fs46.promises.realpath(spec.reviewGrants.maskedOriginal.dir),
         changedWithheld: spec.reviewGrants.maskedOriginal.changedWithheld
       } } : {}
     } : null, workspace = spec.workspaceRoots ? await this.seatbeltWorkspace(spec, canonicalWorkdir, extraWriteDirs, canonicalReview) : null, profile = buildSeatbeltProfile(
@@ -75138,7 +75416,7 @@ ${tail}`
       workspace?.profile ?? null
     ), profilePath = path100.join(this.profileRoot, `codevibe-seatbelt-${id5}.sb`);
     try {
-      await import_node_fs45.promises.writeFile(profilePath, profile, { encoding: "utf8", mode: 384 });
+      await import_node_fs46.promises.writeFile(profilePath, profile, { encoding: "utf8", mode: 384 });
     } catch (e) {
       throw new SubstrateLaunchError(
         "sandbox_exec",
@@ -75155,7 +75433,7 @@ ${tail}`
           "sandbox-exec substrate handoff"
         );
       } catch (err) {
-        throw await import_node_fs45.promises.rm(profilePath, { force: !0 }).catch(() => {
+        throw await import_node_fs46.promises.rm(profilePath, { force: !0 }).catch(() => {
         }), err;
       }
     if (spec.agentScratch)
@@ -75166,7 +75444,7 @@ ${tail}`
           "sandbox-exec Claude scratch profile handoff"
         );
       } catch (err) {
-        throw await import_node_fs45.promises.rm(profilePath, { force: !0 }).catch(() => {
+        throw await import_node_fs46.promises.rm(profilePath, { force: !0 }).catch(() => {
         }), err;
       }
     return new SandboxExecHandle(
@@ -75195,7 +75473,7 @@ ${tail}`
   }
   /** P63 §6.1 — the seat's own folders, the toolchain and interpreter grants (through the rule), and the PATH. */
   async seatbeltWorkspace(spec, canonicalWorkdir, extraWriteDirs, review) {
-    let real = async (p) => import_node_fs45.promises.realpath(p).catch(() => p), homedir47 = os48.homedir(), project = await real(spec.workspaceRoots.project), copyRoots = await Promise.all(spec.workspaceRoots.copyRoots.map(real)), ownFolders = [
+    let real = async (p) => import_node_fs46.promises.realpath(p).catch(() => p), homedir47 = os48.homedir(), project = await real(spec.workspaceRoots.project), copyRoots = await Promise.all(spec.workspaceRoots.copyRoots.map(real)), ownFolders = [
       { dir: canonicalWorkdir, mode: spec.writableWorkdir === !1 ? "read" : "read-write" },
       ...review ? [{ dir: review.bundleDir, mode: "read" }] : [],
       ...review?.maskedOriginal ? [{ dir: review.maskedOriginal.dir, mode: "read" }] : [],
@@ -75253,11 +75531,11 @@ function randomId2() {
 
 // src/substrate-launch/fallback-ladder.ts
 init_command_runner();
-var import_node_crypto55 = require("node:crypto"), import_node_fs46 = require("node:fs"), os49 = __toESM(require("node:os")), path102 = __toESM(require("node:path"));
+var import_node_crypto55 = require("node:crypto"), import_node_fs47 = require("node:fs"), os49 = __toESM(require("node:os")), path102 = __toESM(require("node:path"));
 init_spawn_sweep_binary();
 
 // src/substrate/pasta-isolation-check.ts
-var import_node_child_process18 = require("node:child_process"), import_node_crypto54 = require("node:crypto"), fs81 = __toESM(require("node:fs")), import_node_net2 = __toESM(require("node:net")), path101 = __toESM(require("node:path"));
+var import_node_child_process18 = require("node:child_process"), import_node_crypto54 = require("node:crypto"), fs82 = __toESM(require("node:fs")), import_node_net2 = __toESM(require("node:net")), path101 = __toESM(require("node:path"));
 init_logger2();
 init_pasta();
 function evaluateIsolation(e) {
@@ -75360,7 +75638,7 @@ async function runIsolationCheck(opts = {}) {
       listeners.push(await listenOn("all-v6", "::"));
     } catch {
     }
-    let ports = listeners.map((l) => ({ port: l.port, listener: l.name })), nodePath = fs81.realpathSync(opts.nodePath ?? process.execPath), argv = [
+    let ports = listeners.map((l) => ({ port: l.port, listener: l.name })), nodePath = fs82.realpathSync(opts.nodePath ?? process.execPath), argv = [
       ...buildSetprivPrefix(opts.desktopPid ?? process.pid),
       ...(opts.mutatePastaArgv ?? ((x) => x))(
         buildPastaArgv({ brokerPort: "none", ...opts.pastaPath ? { pastaBin: opts.pastaPath } : {} })
@@ -75393,17 +75671,17 @@ async function runIsolationCheck(opts = {}) {
 }
 function readIsolationCache(dir, key) {
   try {
-    let entry5 = JSON.parse(fs81.readFileSync(path101.join(dir, `pasta-isolation-${key}.json`), "utf8"));
+    let entry5 = JSON.parse(fs82.readFileSync(path101.join(dir, `pasta-isolation-${key}.json`), "utf8"));
     return entry5.key === key && typeof entry5.pass == "boolean" ? entry5 : null;
   } catch {
     return null;
   }
 }
 function writeIsolationCache(dir, entry5) {
-  fs81.mkdirSync(dir, { recursive: !0, mode: 448 });
+  fs82.mkdirSync(dir, { recursive: !0, mode: 448 });
   let file = path101.join(dir, `pasta-isolation-${entry5.key}.json`), tmp = `${file}.${process.pid}.tmp`;
-  fs81.writeFileSync(tmp, `${JSON.stringify(entry5)}
-`, { mode: 384, flag: "wx" }), fs81.renameSync(tmp, file), logger.info("[PastaIsolation] result cached", { pass: entry5.pass });
+  fs82.writeFileSync(tmp, `${JSON.stringify(entry5)}
+`, { mode: 384, flag: "wx" }), fs82.renameSync(tmp, file), logger.info("[PastaIsolation] result cached", { pass: entry5.pass });
 }
 
 // src/substrate-launch/fallback-ladder.ts
@@ -75429,7 +75707,7 @@ async function cachedIsolationCheck(runner, cacheDir = path102.join(os49.homedir
   if (!which.ok || !which.stdout.trim()) return { ok: !1, reason: "pasta is not on PATH" };
   let pastaSha;
   try {
-    pastaSha = (0, import_node_crypto55.createHash)("sha256").update(await import_node_fs46.promises.readFile(await import_node_fs46.promises.realpath(which.stdout.trim()))).digest("hex");
+    pastaSha = (0, import_node_crypto55.createHash)("sha256").update(await import_node_fs47.promises.readFile(await import_node_fs47.promises.realpath(which.stdout.trim()))).digest("hex");
   } catch (err) {
     return { ok: !1, reason: `pasta could not be read (${err.message})` };
   }
@@ -75558,13 +75836,13 @@ async function confinementPreflight(input, deps = {}) {
 async function linuxTierSelfTestKeyParts(open29, runner = new ChildProcessCommandRunner()) {
   let resolve35 = async (name) => {
     let p = (await exitsZero(runner, ["/bin/sh", "-c", `command -v ${name}`])).stdout.trim();
-    return p ? import_node_fs46.promises.realpath(p).catch(() => p) : "";
-  }, sha = async (file) => file ? (0, import_node_crypto55.createHash)("sha256").update(await import_node_fs46.promises.readFile(file)).digest("hex") : "", { generateSeccompBpfFilter: generateSeccompBpfFilter2 } = await Promise.resolve().then(() => (init_bwrap(), bwrap_exports));
+    return p ? import_node_fs47.promises.realpath(p).catch(() => p) : "";
+  }, sha = async (file) => file ? (0, import_node_crypto55.createHash)("sha256").update(await import_node_fs47.promises.readFile(file)).digest("hex") : "", { generateSeccompBpfFilter: generateSeccompBpfFilter2 } = await Promise.resolve().then(() => (init_bwrap(), bwrap_exports));
   return {
     filterSha256: (0, import_node_crypto55.createHash)("sha256").update(generateSeccompBpfFilter2()).digest("hex"),
     bwrapVersion: (await exitsZero(runner, ["bwrap", "--version"])).stdout.trim(),
     setprivPath: await resolve35("setpriv"),
-    bashPath: await import_node_fs46.promises.realpath("/bin/bash").catch(() => "/bin/bash"),
+    bashPath: await import_node_fs47.promises.realpath("/bin/bash").catch(() => "/bin/bash"),
     ...open29 ? { pastaSha256: await sha(await resolve35("pasta")) } : {}
   };
 }
@@ -75627,7 +75905,7 @@ var ConfinedModelCaller = class {
 };
 
 // src/local-executor/agentic-disposable-repo.ts
-var import_node_crypto56 = require("node:crypto"), fs83 = __toESM(require("node:fs/promises")), path103 = __toESM(require("node:path"));
+var import_node_crypto56 = require("node:crypto"), fs84 = __toESM(require("node:fs/promises")), path103 = __toESM(require("node:path"));
 init_anchored_fs();
 init_workspace_authority();
 var DisposableRepoError = class extends Error {
@@ -75664,10 +75942,10 @@ var DisposableRepoError = class extends Error {
 ];
 async function materializeDisposableRepo(opts) {
   let repoDir = path103.join(opts.parentDir, `cp14-wb2-resolve-${(0, import_node_crypto56.randomBytes)(8).toString("hex")}`);
-  await fs83.mkdir(repoDir, { recursive: !1, mode: 448 });
+  await fs84.mkdir(repoDir, { recursive: !1, mode: 448 });
   let repoAuthority = await captureWorkspaceRootAuthority(repoDir), cleanup = async () => {
     try {
-      await fs83.lstat(repoDir);
+      await fs84.lstat(repoDir);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
@@ -75728,7 +76006,7 @@ async function stageDirForRead(dir, expectedAuthority, seams = {}) {
   if (!sameWorkspaceRootAuthority(before, expectedAuthority))
     throw new Error("disposable repository changed before staging");
   let staged = path103.join(parent, `.cp14-staged-${(0, import_node_crypto56.randomBytes)(12).toString("hex")}`);
-  await fs83.rename(dir, staged);
+  await fs84.rename(dir, staged);
   try {
     await seams.afterRename?.(staged);
     let [moved, parentAfter] = await Promise.all([
@@ -75875,11 +76153,11 @@ init_anchored_fs();
 init_shadow_protocol();
 
 // src/orchestration-shell/review-bundle.ts
-var import_node_crypto58 = require("node:crypto"), import_node_fs47 = require("node:fs"), fs85 = __toESM(require("node:fs/promises")), path105 = __toESM(require("node:path"));
+var import_node_crypto58 = require("node:crypto"), import_node_fs48 = require("node:fs"), fs86 = __toESM(require("node:fs/promises")), path105 = __toESM(require("node:path"));
 init_shadow_protocol();
 
 // src/orchestration-shell/review-receipts.ts
-var import_node_crypto57 = require("node:crypto"), fs84 = __toESM(require("node:fs/promises")), path104 = __toESM(require("node:path")), MAX_RECEIPTS_PER_SEAT = 12, RECEIPT_PRIORITY_CHANGE_BYTES = 16 * 1024, MAX_RECEIPT_LINE_BYTES = 512, CHUNK2 = 1024 * 1024, NL = 10, LARGE_VIEW_FILE_BYTES = 64 * 1024 * 1024;
+var import_node_crypto57 = require("node:crypto"), fs85 = __toESM(require("node:fs/promises")), path104 = __toESM(require("node:path")), MAX_RECEIPTS_PER_SEAT = 12, RECEIPT_PRIORITY_CHANGE_BYTES = 16 * 1024, MAX_RECEIPT_LINE_BYTES = 512, CHUNK2 = 1024 * 1024, NL = 10, LARGE_VIEW_FILE_BYTES = 64 * 1024 * 1024;
 function receiptEntryFields(entries, filePath) {
   let entry5 = entries?.find((e) => e.path === filePath);
   return entry5 ? { entryKind: entry5.kind, ...entry5.office ? { office: entry5.office } : {} } : {};
@@ -75888,7 +76166,7 @@ function normaliseReceiptValue(v) {
   return v.replace(/\s+/g, " ").trim();
 }
 async function lineCount(file) {
-  let fh = await fs84.open(file, "r");
+  let fh = await fs85.open(file, "r");
   try {
     let buf = Buffer.allocUnsafe(CHUNK2), total = 0, newlines = 0;
     for (; ; ) {
@@ -75956,7 +76234,7 @@ async function readShortLine(fh, r) {
   return length > 0 && await fh.read(buf, 0, length, r.start), buf.toString("utf8");
 }
 async function withFile(file, fn) {
-  let fh = await fs84.open(file, "r");
+  let fh = await fs85.open(file, "r");
   try {
     return await fn(fh, (await fh.stat()).size);
   } finally {
@@ -75968,7 +76246,7 @@ async function changedRegion(beforeFile, afterFile) {
   afterFile && beforeFile && await withFile(afterFile, (fa, aSize) => withFile(beforeFile, async (fb, bSize) => {
     prefix = await commonPrefixLines(fa, aSize, fb, bSize), suffix = Math.min(await commonSuffixLines(fa, aSize, fb, bSize), Math.min(aCount, bCount) - prefix);
   }));
-  let after = aCount - suffix > prefix ? [prefix + 1, aCount - suffix] : null, before = bCount - suffix > prefix ? [prefix + 1, bCount - suffix] : null, sizeOf = async (f) => f ? (await fs84.stat(f)).size : 0, share = (r, count4) => r && count4 > 0 ? (r[1] - r[0] + 1) / count4 : 0, changedBytes = Math.max(
+  let after = aCount - suffix > prefix ? [prefix + 1, aCount - suffix] : null, before = bCount - suffix > prefix ? [prefix + 1, bCount - suffix] : null, sizeOf = async (f) => f ? (await fs85.stat(f)).size : 0, share = (r, count4) => r && count4 > 0 ? (r[1] - r[0] + 1) / count4 : 0, changedBytes = Math.max(
     await sizeOf(afterFile) * share(after, aCount),
     await sizeOf(beforeFile) * share(before, bCount)
   );
@@ -75991,7 +76269,7 @@ async function pickNonBlank(file, range, rng) {
   });
 }
 async function copyByteRange(fh, start, end, dest) {
-  let out = await fs84.open(dest, "wx");
+  let out = await fs85.open(dest, "wx");
   try {
     let buf = Buffer.allocUnsafe(CHUNK2);
     for (let pos = start; pos < end; ) {
@@ -76004,7 +76282,7 @@ async function copyByteRange(fh, start, end, dest) {
   }
 }
 async function writeLargeViewParts(file, range, destDir, partBytes = LARGE_VIEW_FILE_BYTES) {
-  await fs84.mkdir(destDir, { recursive: !0 }), await withFile(file, async (fh, size2) => {
+  await fs85.mkdir(destDir, { recursive: !0 }), await withFile(file, async (fh, size2) => {
     let [lo, hi] = range, emit = (start, end, first, last) => copyByteRange(fh, start, end, path104.join(destDir, `lines-${first}-${last}.txt`)), buf = Buffer.allocUnsafe(CHUNK2), line = 1, lineStart = 0, partStart = lo === 1 ? 0 : -1, partFirst = lo;
     for (let pos = 0; pos < size2; ) {
       let { bytesRead } = await fh.read(buf, 0, Math.min(CHUNK2, size2 - pos), pos);
@@ -76023,7 +76301,7 @@ async function writeLargeViewParts(file, range, destDir, partBytes = LARGE_VIEW_
   });
 }
 async function largeViewLocation(bundleDir, file, line) {
-  let dir = path104.join(bundleDir, "large", file), names = await fs84.readdir(dir).catch(() => []);
+  let dir = path104.join(bundleDir, "large", file), names = await fs85.readdir(dir).catch(() => []);
   for (let name of names) {
     let m = /^lines-(\d+)-(\d+)\.txt$/.exec(name);
     if (m && Number(m[1]) <= line && line <= Number(m[2]))
@@ -76036,7 +76314,7 @@ async function drawReceiptRequests(input) {
   for (let f of input.files) {
     let kind = f.entryKind ?? "text";
     if (kind === "view" || kind === "withheld" || kind === "office" && !f.office?.textChanged) continue;
-    let names = kind === "office" ? { after: `text/${f.path}.after.txt`, before: `text/${f.path}.before.txt` } : { after: `after/${f.path}`, before: `before/${f.path}` }, exists = async (rel) => await fs84.stat(path104.join(input.bundleDir, rel)).catch(() => null) !== null, afterFile = (kind === "office" ? await exists(names.after) : f.hasAfter) ? path104.join(input.bundleDir, names.after) : null, beforeFile = (kind === "office" ? await exists(names.before) : f.hasBefore) ? path104.join(input.bundleDir, names.before) : null, region = await changedRegion(beforeFile, afterFile);
+    let names = kind === "office" ? { after: `text/${f.path}.after.txt`, before: `text/${f.path}.before.txt` } : { after: `after/${f.path}`, before: `before/${f.path}` }, exists = async (rel) => await fs85.stat(path104.join(input.bundleDir, rel)).catch(() => null) !== null, afterFile = (kind === "office" ? await exists(names.after) : f.hasAfter) ? path104.join(input.bundleDir, names.after) : null, beforeFile = (kind === "office" ? await exists(names.before) : f.hasBefore) ? path104.join(input.bundleDir, names.before) : null, region = await changedRegion(beforeFile, afterFile);
     region.after === null && region.before === null || candidates.push({ file: f, changedBytes: region.changedBytes, afterRange: region.after, beforeRange: region.before, names });
   }
   let lineMaker = (c) => ({
@@ -76179,12 +76457,12 @@ function blobFile(source2) {
 }
 async function sha256File(file) {
   let hash3 = (0, import_node_crypto58.createHash)("sha256"), size2 = 0;
-  for await (let chunk of (0, import_node_fs47.createReadStream)(file, { highWaterMark: 1024 * 1024 }))
+  for await (let chunk of (0, import_node_fs48.createReadStream)(file, { highWaterMark: 1024 * 1024 }))
     hash3.update(chunk), size2 += chunk.length;
   return { sha256: hash3.digest("hex"), size: size2 };
 }
 async function place(source2, dest) {
-  await fs85.mkdir(path105.dirname(dest), { recursive: !0 }), await fs85.copyFile(blobFile(source2), dest, import_node_fs47.constants.COPYFILE_EXCL | import_node_fs47.constants.COPYFILE_FICLONE);
+  await fs86.mkdir(path105.dirname(dest), { recursive: !0 }), await fs86.copyFile(blobFile(source2), dest, import_node_fs48.constants.COPYFILE_EXCL | import_node_fs48.constants.COPYFILE_FICLONE);
   let placed = await sha256File(dest);
   if (placed.sha256 !== source2.ref.blob || placed.size !== source2.ref.size)
     throw new Error(`review bundle: placed bytes do not match their blob: ${dest}`);
@@ -76211,7 +76489,7 @@ function contextSection(context) {
 }
 async function buildReviewBundle(input) {
   for (let f of input.files) assertSafeRelativePath(f.path);
-  await fs85.mkdir(input.bundleDir);
+  await fs86.mkdir(input.bundleDir);
   let lines = [], entries = [], officeParts = [];
   for (let f of [...input.files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) {
     let binary = await presentBinary(input.bundleDir, f);
@@ -76223,13 +76501,13 @@ async function buildReviewBundle(input) {
     let diffed = !1, small = (s) => !s || s.ref.size <= LARGE_TEXT_BYTES, baseUnknown = f.change_kind === "modified" && f.before === null;
     if (f.change_kind !== "deleted" && !baseUnknown && small(f.after) && small(f.before)) {
       let after = f.after ? (await readBlobBytes(f.after.store, f.after.ref, LARGE_TEXT_BYTES)).toString("utf8") : "", before = f.before ? (await readBlobBytes(f.before.store, f.before.ref, LARGE_TEXT_BYTES)).toString("utf8") : "", diffFile = path105.join(input.bundleDir, "diff", `${f.path}.diff`);
-      await fs85.mkdir(path105.dirname(diffFile), { recursive: !0 }), await fs85.writeFile(diffFile, excerptDiff(f.path, before, after, Number.MAX_SAFE_INTEGER), { flag: "wx" }), diffed = !0;
+      await fs86.mkdir(path105.dirname(diffFile), { recursive: !0 }), await fs86.writeFile(diffFile, excerptDiff(f.path, before, after, Number.MAX_SAFE_INTEGER), { flag: "wx" }), diffed = !0;
     }
     let largeNote = "";
     if ((f.after?.ref.size ?? 0) > LARGE_VIEW_FILE_BYTES || (f.before?.ref.size ?? 0) > LARGE_VIEW_FILE_BYTES) {
       let afterFile = f.after ? path105.join(input.bundleDir, "after", f.path) : null, beforeFile = f.before ? path105.join(input.bundleDir, "before", f.path) : null, region = await changedRegion(beforeFile, afterFile);
       for (let [side, file, range] of [["after", afterFile, region.after], ["before", beforeFile, region.before]])
-        file === null || range === null || (await fs85.stat(file)).size <= LARGE_VIEW_FILE_BYTES || (await writeLargeViewParts(file, range, path105.join(input.bundleDir, "large", side, f.path)), largeNote += `; changed lines of ${side}/${f.path} in large/${side}/${f.path}/`);
+        file === null || range === null || (await fs86.stat(file)).size <= LARGE_VIEW_FILE_BYTES || (await writeLargeViewParts(file, range, path105.join(input.bundleDir, "large", side, f.path)), largeNote += `; changed lines of ${side}/${f.path} in large/${side}/${f.path}/`);
     }
     lines.push(indexLine(f, diffed).replace(/ \|$/, `${largeNote} |`));
   }
@@ -76250,7 +76528,7 @@ async function buildReviewBundle(input) {
     ...contextSection(input.context)
   ].join(`
 `);
-  await fs85.writeFile(path105.join(input.bundleDir, "INDEX.md"), index, { flag: "wx" });
+  await fs86.writeFile(path105.join(input.bundleDir, "INDEX.md"), index, { flag: "wx" });
   let record2 = { version: 1, files: await hashTree(input.bundleDir), entries };
   return await makeReadOnly(input.bundleDir), record2;
 }
@@ -76258,7 +76536,7 @@ function partText(name) {
   return name.replace(/[\r\n|`]/g, " ");
 }
 async function writeNew(file, text2) {
-  await fs85.mkdir(path105.dirname(file), { recursive: !0 }), await fs85.writeFile(file, text2, { flag: "wx" });
+  await fs86.mkdir(path105.dirname(file), { recursive: !0 }), await fs86.writeFile(file, text2, { flag: "wx" });
 }
 async function presentBinary(bundleDir, f) {
   let afterCls = f.change_kind === "deleted" ? null : f.afterClass, beforeCls = f.change_kind === "created" ? null : f.beforeClass;
@@ -76311,7 +76589,7 @@ async function presentBinary(bundleDir, f) {
 }
 async function walkBundle(dir, onFile, onDir) {
   let walk2 = async (current) => {
-    for await (let entry5 of await fs85.opendir(current)) {
+    for await (let entry5 of await fs86.opendir(current)) {
       let full = path105.join(current, entry5.name);
       if (entry5.isSymbolicLink()) throw new Error(`review bundle contains a link: ${full}`);
       entry5.isDirectory() ? await walk2(full) : entry5.isFile() && await onFile(full, path105.relative(dir, full).split(path105.sep).join("/"));
@@ -76328,18 +76606,18 @@ async function hashTree(dir) {
   }), out.sort(byName);
 }
 async function makeReadOnly(dir) {
-  await walkBundle(dir, (full) => fs85.chmod(full, 292), (folder) => fs85.chmod(folder, 365));
+  await walkBundle(dir, (full) => fs86.chmod(full, 292), (folder) => fs86.chmod(folder, 365));
 }
 async function removeReviewRound(roundDir) {
-  let top = await fs85.lstat(roundDir).catch(() => null);
+  let top = await fs86.lstat(roundDir).catch(() => null);
   if (!top) return;
   if (!top.isDirectory() || top.isSymbolicLink()) throw new Error(`review round is not a directory: ${roundDir}`);
   let walk2 = async (dir) => {
-    await fs85.chmod(dir, 448);
-    for (let e of await fs85.readdir(dir, { withFileTypes: !0 }))
+    await fs86.chmod(dir, 448);
+    for (let e of await fs86.readdir(dir, { withFileTypes: !0 }))
       e.isDirectory() && await walk2(path105.join(dir, e.name));
   };
-  await walk2(roundDir), await fs85.rm(roundDir, { recursive: !0, force: !0 });
+  await walk2(roundDir), await fs86.rm(roundDir, { recursive: !0, force: !0 });
 }
 async function verifyReviewBundle(bundleDir, record2) {
   let want = [...record2.files].sort(byName), find = (name) => {
@@ -82255,10 +82533,10 @@ ${section}`);
     return runDeclaredTestSurfaces({
       ...a,
       runShell: this.deps.runShell ?? runShellCommand,
-      lstat: import_node_fs48.promises.lstat,
-      realpath: import_node_fs48.promises.realpath,
-      stat: import_node_fs48.promises.stat,
-      readFile: (p) => import_node_fs48.promises.readFile(p, "utf8")
+      lstat: import_node_fs49.promises.lstat,
+      realpath: import_node_fs49.promises.realpath,
+      stat: import_node_fs49.promises.stat,
+      readFile: (p) => import_node_fs49.promises.readFile(p, "utf8")
       // #609 — nearest-package.json framework detection.
     });
   }
@@ -82515,7 +82793,7 @@ ${section}`);
         })
       }, seatWorkdir = this.deps.workingDir, reviewGrants, round = null, receiptRequests = [];
       try {
-        round = await this.ensureReviewRound(args.gateId), round && (seatWorkdir = round.seatDir(args.seatId), await import_node_fs48.promises.mkdir(seatWorkdir, { recursive: !0, mode: 448 }), reviewGrants = {
+        round = await this.ensureReviewRound(args.gateId), round && (seatWorkdir = round.seatDir(args.seatId), await import_node_fs49.promises.mkdir(seatWorkdir, { recursive: !0, mode: 448 }), reviewGrants = {
           bundleDir: round.bundleDir,
           ...process.platform === "darwin" ? maskedOriginalGrant(round.record, this.deps.workingDir) : {}
         }, receiptRequests = await drawReceiptRequests({ bundleDir: round.bundleDir, files: round.receiptFiles }));
@@ -82854,10 +83132,10 @@ ${section}`);
     let next = (this.reviewStateRemovalByTask.get(taskId) ?? Promise.resolve()).then(async () => {
       try {
         let folder = folderFor(taskId);
-        await removeReviewRound(path106.join(folder, "review")), await import_node_fs48.promises.rm(path106.join(folder, "capture"), { recursive: !0, force: !0 });
-        for (let sub of ["agy-home", "spawn"]) await import_node_fs48.promises.rmdir(path106.join(folder, sub)).catch(() => {
+        await removeReviewRound(path106.join(folder, "review")), await import_node_fs49.promises.rm(path106.join(folder, "capture"), { recursive: !0, force: !0 });
+        for (let sub of ["agy-home", "spawn"]) await import_node_fs49.promises.rmdir(path106.join(folder, sub)).catch(() => {
         });
-        await import_node_fs48.promises.rmdir(folder).catch(() => {
+        await import_node_fs49.promises.rmdir(folder).catch(() => {
         });
       } catch (err) {
         logger.warn("[QuorumLoop] task review-state removal failed (left for the next start sweep)", {
@@ -82887,10 +83165,10 @@ ${section}`);
       if (!reviewed) throw new Error("review round: the task has no captured change");
       await this.reviewStateRemovalByTask.get(taskId);
       let folders = reviewRoundFolders(this.deps.reviewTaskFolder(taskId), gateId);
-      await import_node_fs48.promises.mkdir(path106.dirname(folders.round), { recursive: !0, mode: 448 });
-      for (let entry5 of await import_node_fs48.promises.readdir(path106.dirname(folders.round)))
+      await import_node_fs49.promises.mkdir(path106.dirname(folders.round), { recursive: !0, mode: 448 });
+      for (let entry5 of await import_node_fs49.promises.readdir(path106.dirname(folders.round)))
         entry5 !== gateId && await removeReviewRound(path106.join(path106.dirname(folders.round), entry5));
-      await removeReviewRound(folders.round), await import_node_fs48.promises.mkdir(folders.round, { mode: 448 });
+      await removeReviewRound(folders.round), await import_node_fs49.promises.mkdir(folders.round, { mode: 448 });
       let brief = this.singleTaskContextByTask.get(taskId)?.brief ?? this.activeBriefByTask.get(taskId)?.brief ?? "", sources = await shadow.reviewBundleSources(reviewed), placedBytes = (size2) => size2 > LARGE_VIEW_FILE_BYTES ? 2 * size2 : size2, bundleBytes = sources.reduce((sum, f) => sum + placedBytes(f.after?.ref.size ?? 0) + placedBytes(f.before?.ref.size ?? 0), 0);
       await assertCopySpace(folders.round, bundleBytes, "prepare the review files");
       let context = shadow.reviewIndexContext(), record2 = await buildReviewBundle({ bundleDir: folders.bundle, taskBrief: brief, files: sources, context });
@@ -83105,7 +83383,7 @@ ${section}`);
         }), null) : { handle: result.substrateHandle, tier: result.tier, teardown: () => result.teardown() };
       },
       evaluate: (testSpec, gateId, opts) => this.deps.reviewerRegistry.evaluate(testSpec, gateId, opts),
-      ...this.deps.reviewTaskFolder ? { removeTaskFolder: (taskId) => import_node_fs48.promises.rm(this.deps.reviewTaskFolder(taskId), { recursive: !0, force: !0 }) } : {}
+      ...this.deps.reviewTaskFolder ? { removeTaskFolder: (taskId) => import_node_fs49.promises.rm(this.deps.reviewTaskFolder(taskId), { recursive: !0, force: !0 }) } : {}
     });
     return verdict.pass ? null : verdict.reason ?? "no reason";
   }
@@ -83410,7 +83688,7 @@ ${section}`);
         oursCommit,
         theirsCommit,
         baseSha
-      }), parentDir = await import_node_fs48.promises.mkdtemp(path106.join(os50.tmpdir(), "codevibe-wb2-resolve-"));
+      }), parentDir = await import_node_fs49.promises.mkdtemp(path106.join(os50.tmpdir(), "codevibe-wb2-resolve-"));
       return resolveAgenticSlot({
         realRepoDir: this.deps.workingDir,
         // canonical loop workdir == repo root
@@ -89751,7 +90029,7 @@ function destructiveConfirmationQuestion(text2) {
 }
 
 // src/orchestration-shell/advisory-attachment-journal.ts
-var import_node_crypto59 = require("node:crypto"), os51 = __toESM(require("node:os")), path107 = __toESM(require("node:path")), import_node_fs49 = require("node:fs");
+var import_node_crypto59 = require("node:crypto"), os51 = __toESM(require("node:os")), path107 = __toESM(require("node:path")), import_node_fs50 = require("node:fs");
 init_anchored_fs();
 init_bounded_directory();
 init_durable_directory();
@@ -89960,7 +90238,7 @@ var AdvisoryAttachmentJournal = class {
       ), this.rootAuthority;
     if (!create)
       try {
-        let stat25 = await import_node_fs49.promises.lstat(this.rootPath);
+        let stat25 = await import_node_fs50.promises.lstat(this.rootPath);
         if (!stat25.isDirectory() || stat25.isSymbolicLink())
           throw new Error("advisory attachment journal root is not a private directory");
       } catch (reason) {
@@ -90752,7 +91030,7 @@ function classifyDurableWorkspaceOutcome(event, displayedSessionId, decryptedMet
 }
 
 // src/orchestration-shell/workspace-terminal-coordinator.ts
-var crypto35 = __toESM(require("node:crypto")), import_node_fs50 = require("node:fs"), os52 = __toESM(require("node:os")), path108 = __toESM(require("node:path"));
+var crypto35 = __toESM(require("node:crypto")), import_node_fs51 = require("node:fs"), os52 = __toESM(require("node:os")), path108 = __toESM(require("node:path"));
 init_logger2();
 
 // src/orchestration-shell/emit-shell-event.ts
@@ -91454,10 +91732,10 @@ var WorkspaceTerminalCoordinator = class {
   }
   async readJson(filePath, missing = null) {
     try {
-      let stat25 = await import_node_fs50.promises.lstat(filePath);
+      let stat25 = await import_node_fs51.promises.lstat(filePath);
       if (!stat25.isFile() || stat25.isSymbolicLink() || stat25.size > MAX_RECORD_BYTES3)
         throw new Error("WorkspaceTerminalCoordinator: unsafe or oversized record");
-      return JSON.parse(await import_node_fs50.promises.readFile(filePath, "utf8"));
+      return JSON.parse(await import_node_fs51.promises.readFile(filePath, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT") return missing;
       throw error;
@@ -91466,7 +91744,7 @@ var WorkspaceTerminalCoordinator = class {
   async listRecords(directory) {
     let entries;
     try {
-      entries = await import_node_fs50.promises.readdir(directory, { withFileTypes: !0 });
+      entries = await import_node_fs51.promises.readdir(directory, { withFileTypes: !0 });
     } catch (error) {
       if (error.code === "ENOENT") return [];
       throw error;
@@ -91476,7 +91754,7 @@ var WorkspaceTerminalCoordinator = class {
   async listGenerationDirectories(root) {
     let entries;
     try {
-      entries = await import_node_fs50.promises.readdir(root, { withFileTypes: !0 });
+      entries = await import_node_fs51.promises.readdir(root, { withFileTypes: !0 });
     } catch (error) {
       if (error.code === "ENOENT") return [];
       throw error;
@@ -91493,13 +91771,13 @@ var WorkspaceTerminalCoordinator = class {
   async cleanTemporaryFiles(directory) {
     let entries;
     try {
-      entries = await import_node_fs50.promises.readdir(directory, { withFileTypes: !0 });
+      entries = await import_node_fs51.promises.readdir(directory, { withFileTypes: !0 });
     } catch (error) {
       if (error.code === "ENOENT") return;
       throw error;
     }
     for (let entry5 of entries)
-      entry5.isFile() && !entry5.isSymbolicLink() && entry5.name.includes(TEMP_INFIX) && await import_node_fs50.promises.unlink(path108.join(directory, entry5.name));
+      entry5.isFile() && !entry5.isSymbolicLink() && entry5.name.includes(TEMP_INFIX) && await import_node_fs51.promises.unlink(path108.join(directory, entry5.name));
     await fsyncDir(directory);
   }
   async cleanTemporaryFilesAcrossGenerations(root) {
@@ -91512,7 +91790,7 @@ var WorkspaceTerminalCoordinator = class {
       for (let record2 of await this.listRecordsAcrossGenerations(root)) {
         let identity = `${record2.generation}/${path108.basename(record2.file, ".json")}`;
         if (identity === excluded) continue;
-        let stat25 = await import_node_fs50.promises.stat(record2.file);
+        let stat25 = await import_node_fs51.promises.stat(record2.file);
         if (stat25.size > MAX_RECORD_BYTES3)
           throw new Error("WorkspaceTerminalCoordinator: exact record exceeds size limit");
         aggregateBytes += stat25.size, reserved.add(identity);
@@ -91696,7 +91974,7 @@ var WorkspaceTerminalCoordinator = class {
       let intent = validateGroupIntent(raw);
       if (intent.state !== "PENDING" || intent.operation !== operation || intent.groupGeneration !== groupGeneration || intent.operationHash !== authority.operationHash || intent.predecessor.anchorId !== authority.anchorId)
         throw new Error("WorkspaceTerminalCoordinator: refused mismatched group reservation cancellation");
-      await import_node_fs50.promises.unlink(this.intentPath(nonce)), await fsyncDir(this.intentDir());
+      await import_node_fs51.promises.unlink(this.intentPath(nonce)), await fsyncDir(this.intentDir());
     });
   }
   groupTerminal(outcome2, details) {
@@ -91841,12 +92119,12 @@ var WorkspaceTerminalCoordinator = class {
       let outbox = validateOutboxForIntent(outboxValue, intent);
       if (draftValue && canonicalJson4(validateOutboxForIntent(draftValue, intent)) !== canonicalJson4(outbox))
         throw new Error("WorkspaceTerminalCoordinator: draft/outbox identity changed");
-      draftValue && (await import_node_fs50.promises.unlink(draftPath), await fsyncDir(this.draftDir(generation)));
+      draftValue && (await import_node_fs51.promises.unlink(draftPath), await fsyncDir(this.draftDir(generation)));
       return;
     }
     if (!draftValue)
       throw new Error("WorkspaceTerminalCoordinator: committed group outcome has no exact draft");
-    validateOutboxForIntent(draftValue, intent), await import_node_fs50.promises.mkdir(this.outboxDir(generation), { recursive: !0, mode: 448 }), await import_node_fs50.promises.rename(draftPath, outboxPath), await Promise.all([
+    validateOutboxForIntent(draftValue, intent), await import_node_fs51.promises.mkdir(this.outboxDir(generation), { recursive: !0, mode: 448 }), await import_node_fs51.promises.rename(draftPath, outboxPath), await Promise.all([
       fsyncDir(this.draftDir(generation)),
       fsyncDir(this.outboxDir(generation))
     ]);
@@ -91863,7 +92141,7 @@ var WorkspaceTerminalCoordinator = class {
   async syncSettlementDirectory(directory) {
     let handle;
     try {
-      handle = await import_node_fs50.promises.open(directory, import_node_fs50.constants.O_RDONLY | import_node_fs50.constants.O_DIRECTORY | import_node_fs50.constants.O_NOFOLLOW);
+      handle = await import_node_fs51.promises.open(directory, import_node_fs51.constants.O_RDONLY | import_node_fs51.constants.O_DIRECTORY | import_node_fs51.constants.O_NOFOLLOW);
     } catch (error) {
       if (error.code === "ENOENT") return;
       throw error;
@@ -91877,7 +92155,7 @@ var WorkspaceTerminalCoordinator = class {
   async persistSettlementMarker(file, record2) {
     await atomicWriteFileSync2(file, this.serialize(record2), { requireDirectorySync: !0 });
     for (let directory of [this.quarantineRoot(), path108.join(this.rootDir, "quarantine"), this.rootDir]) {
-      let handle = await import_node_fs50.promises.open(directory, import_node_fs50.constants.O_RDONLY | import_node_fs50.constants.O_DIRECTORY | import_node_fs50.constants.O_NOFOLLOW);
+      let handle = await import_node_fs51.promises.open(directory, import_node_fs51.constants.O_RDONLY | import_node_fs51.constants.O_DIRECTORY | import_node_fs51.constants.O_NOFOLLOW);
       try {
         await handle.sync();
       } finally {
@@ -91887,11 +92165,11 @@ var WorkspaceTerminalCoordinator = class {
   }
   async acknowledge(nonce, generation = this.generation(), settlement = !1) {
     let sync = (directory) => settlement ? this.syncSettlementDirectory(directory) : fsyncDir(directory);
-    await import_node_fs50.promises.unlink(this.outboxPath(nonce, generation)).catch((error) => {
+    await import_node_fs51.promises.unlink(this.outboxPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
-    }), await sync(this.outboxDir(generation)), await import_node_fs50.promises.unlink(this.draftPath(nonce, generation)).catch((error) => {
+    }), await sync(this.outboxDir(generation)), await import_node_fs51.promises.unlink(this.draftPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
-    }), await sync(this.draftDir(generation)), await import_node_fs50.promises.unlink(this.intentPath(nonce, generation)).catch((error) => {
+    }), await sync(this.draftDir(generation)), await import_node_fs51.promises.unlink(this.intentPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
     }), await sync(this.intentDir(generation));
   }
@@ -91908,7 +92186,7 @@ var WorkspaceTerminalCoordinator = class {
           pending2.add(`${record2.generation}/${sha2567(path108.basename(record2.file, ".json"))}`);
       let disposable = files.filter((record2) => !pending2.has(`${record2.generation}/${path108.basename(record2.file, ".json")}`)), oldest = (await Promise.all(disposable.map(async (record2) => ({
         ...record2,
-        mtimeMs: (await import_node_fs50.promises.stat(record2.file)).mtimeMs
+        mtimeMs: (await import_node_fs51.promises.stat(record2.file)).mtimeMs
       })))).sort((left, right) => left.mtimeMs - right.mtimeMs || left.file.localeCompare(right.file))[0];
       if (!oldest) throw new Error("WorkspaceTerminalCoordinator: pending settlement capacity is full");
       for (let directory2 of [this.intentDir(oldest.generation), this.outboxDir(oldest.generation), this.draftDir(oldest.generation)]) {
@@ -91917,7 +92195,7 @@ var WorkspaceTerminalCoordinator = class {
           if (sha2567(path108.basename(file, ".json")) === path108.basename(oldest.file, ".json"))
             throw new Error("WorkspaceTerminalCoordinator: settlement cleanup is still pending");
       }
-      await import_node_fs50.promises.unlink(oldest.file), await this.syncSettlementDirectory(path108.dirname(oldest.file));
+      await import_node_fs51.promises.unlink(oldest.file), await this.syncSettlementDirectory(path108.dirname(oldest.file));
     }
     let diagnostic = {
       version: QUARANTINE_VERSION,
@@ -92016,7 +92294,7 @@ var WorkspaceTerminalCoordinator = class {
         intent.state === "TERMINAL" && (await this.flushTerminalIntent(intent), attempted.add(intent.nonce));
       }
       let outboxFiles = await this.listRecordsAcrossGenerations(this.outboxRoot()), bytes = 0;
-      for (let record2 of outboxFiles) bytes += (await import_node_fs50.promises.stat(record2.file)).size;
+      for (let record2 of outboxFiles) bytes += (await import_node_fs51.promises.stat(record2.file)).size;
       if (outboxFiles.length > MAX_OUTBOX_RECORDS || bytes > MAX_OUTBOX_BYTES)
         throw new Error("WorkspaceTerminalCoordinator: outbox capacity exceeded");
       for (let record2 of outboxFiles) {
@@ -92037,7 +92315,7 @@ var WorkspaceTerminalCoordinator = class {
 };
 
 // src/orchestration-shell/decision-effect.ts
-var crypto36 = __toESM(require("node:crypto")), fs89 = __toESM(require("node:fs/promises")), import_node_fs51 = require("node:fs"), os53 = __toESM(require("node:os")), path109 = __toESM(require("node:path"));
+var crypto36 = __toESM(require("node:crypto")), fs90 = __toESM(require("node:fs/promises")), import_node_fs52 = require("node:fs"), os53 = __toESM(require("node:os")), path109 = __toESM(require("node:path"));
 var RECEIPT_VERSION = 1, DIRECTORY_MODE2 = 448, FILE_MODE11 = 384, MAX_RECEIPT_BYTES2 = 64 * 1024, MAX_SESSION_RECEIPTS2 = 64, KNOWN_DECISIONS2 = /* @__PURE__ */ new Set([
   "APPROVE",
   "CANCEL",
@@ -92101,7 +92379,7 @@ var DecisionEffectReceiptStore = class {
     for (let index = -1; index < components.length; index += 1) {
       index >= 0 && (current = path109.join(current, components[index]));
       try {
-        if ((await fs89.lstat(current)).isSymbolicLink()) throw new Error("DecisionEffectReceiptStore: symlinked path");
+        if ((await fs90.lstat(current)).isSymbolicLink()) throw new Error("DecisionEffectReceiptStore: symlinked path");
       } catch (error) {
         if (error.code === "ENOENT") return;
         throw error;
@@ -92111,16 +92389,16 @@ var DecisionEffectReceiptStore = class {
   async atomicWrite(finalPath, receipt2) {
     await this.assertNoSymlinkComponents(finalPath);
     let directory = path109.dirname(finalPath);
-    await fs89.mkdir(directory, { recursive: !0, mode: DIRECTORY_MODE2 }), process.platform !== "win32" && await fs89.chmod(directory, DIRECTORY_MODE2);
+    await fs90.mkdir(directory, { recursive: !0, mode: DIRECTORY_MODE2 }), process.platform !== "win32" && await fs90.chmod(directory, DIRECTORY_MODE2);
     let temporary = `${finalPath}.tmp.${process.pid}.${crypto36.randomBytes(6).toString("hex")}`, handle;
     try {
-      handle = await fs89.open(
+      handle = await fs90.open(
         temporary,
-        import_node_fs51.constants.O_WRONLY | import_node_fs51.constants.O_CREAT | import_node_fs51.constants.O_EXCL,
+        import_node_fs52.constants.O_WRONLY | import_node_fs52.constants.O_CREAT | import_node_fs52.constants.O_EXCL,
         FILE_MODE11
       ), await handle.writeFile(`${JSON.stringify(validateReceipt2(receipt2))}
-`, "utf8"), await handle.sync(), await handle.close(), handle = void 0, await fs89.rename(temporary, finalPath);
-      let directoryHandle = await fs89.open(directory, import_node_fs51.constants.O_RDONLY);
+`, "utf8"), await handle.sync(), await handle.close(), handle = void 0, await fs90.rename(temporary, finalPath);
+      let directoryHandle = await fs90.open(directory, import_node_fs52.constants.O_RDONLY);
       try {
         await directoryHandle.sync();
       } finally {
@@ -92128,7 +92406,7 @@ var DecisionEffectReceiptStore = class {
       }
     } catch (error) {
       throw await handle?.close().catch(() => {
-      }), await fs89.unlink(temporary).catch(() => {
+      }), await fs90.unlink(temporary).catch(() => {
       }), error;
     }
   }
@@ -92136,9 +92414,9 @@ var DecisionEffectReceiptStore = class {
     let target2 = this.receiptPath(sessionId, decisionClaimId);
     await this.assertNoSymlinkComponents(target2);
     try {
-      if ((await fs89.stat(target2)).size > MAX_RECEIPT_BYTES2)
+      if ((await fs90.stat(target2)).size > MAX_RECEIPT_BYTES2)
         throw new Error("DecisionEffectReceiptStore: receipt exceeds size limit");
-      return validateReceipt2(JSON.parse(await fs89.readFile(target2, "utf8")));
+      return validateReceipt2(JSON.parse(await fs90.readFile(target2, "utf8")));
     } catch (error) {
       if (error.code === "ENOENT") return null;
       throw error;
@@ -92180,7 +92458,7 @@ var DecisionEffectReceiptStore = class {
     await this.assertNoSymlinkComponents(directory);
     let entries;
     try {
-      entries = await fs89.readdir(directory, { withFileTypes: !0 });
+      entries = await fs90.readdir(directory, { withFileTypes: !0 });
     } catch (error) {
       if (error.code === "ENOENT") return [];
       throw error;
@@ -92191,9 +92469,9 @@ var DecisionEffectReceiptStore = class {
     let receipts = [];
     for (let entry5 of files.sort((a, b) => a.name.localeCompare(b.name))) {
       let target2 = path109.join(directory, entry5.name);
-      if ((await fs89.stat(target2)).size > MAX_RECEIPT_BYTES2)
+      if ((await fs90.stat(target2)).size > MAX_RECEIPT_BYTES2)
         throw new Error("DecisionEffectReceiptStore: receipt exceeds size limit");
-      let receipt2 = validateReceipt2(JSON.parse(await fs89.readFile(target2, "utf8")));
+      let receipt2 = validateReceipt2(JSON.parse(await fs90.readFile(target2, "utf8")));
       if (receipt2.sessionId !== sessionId)
         throw new Error("DecisionEffectReceiptStore: receipt session mismatch");
       receipts.push(receipt2);
@@ -94169,7 +94447,7 @@ ${notFoundMsg}`), fallbackSection && sections.push(fallbackSection);
 }
 
 // src/continuation/packet-reader.ts
-var import_node_fs52 = require("node:fs"), path111 = __toESM(require("node:path")), os54 = __toESM(require("node:os")), import_yaml2 = require("yaml");
+var import_node_fs53 = require("node:fs"), path111 = __toESM(require("node:path")), os54 = __toESM(require("node:os")), import_yaml2 = require("yaml");
 init_types();
 init_packet_writer();
 init_packet_writer();
@@ -94245,7 +94523,7 @@ function createContinuationPacketReader(deps) {
     async read(taskId, expectedHash) {
       let filePath = getPacketFilePath(taskId, homeDir), stat25;
       try {
-        stat25 = await import_node_fs52.promises.lstat(filePath);
+        stat25 = await import_node_fs53.promises.lstat(filePath);
       } catch (err) {
         throw err.code === "ENOENT" ? new PacketNotFound(filePath) : err;
       }
@@ -94253,7 +94531,7 @@ function createContinuationPacketReader(deps) {
         throw new PacketPermissionsLoose(filePath, stat25.mode);
       let body2;
       try {
-        body2 = await import_node_fs52.promises.readFile(filePath, "utf8");
+        body2 = await import_node_fs53.promises.readFile(filePath, "utf8");
       } catch (err) {
         throw err.code === "ENOENT" ? new PacketNotFound(filePath) : err;
       }
@@ -94279,7 +94557,7 @@ function createContinuationPacketReader(deps) {
     async list() {
       let tasksDir = path111.join(homeDir, ".codevibe", "tasks"), entries;
       try {
-        entries = await import_node_fs52.promises.readdir(tasksDir, { withFileTypes: !0 });
+        entries = await import_node_fs53.promises.readdir(tasksDir, { withFileTypes: !0 });
       } catch (err) {
         if (err.code === "ENOENT")
           return [];
@@ -94290,10 +94568,10 @@ function createContinuationPacketReader(deps) {
         if (!dirent.isDirectory()) continue;
         let taskId = dirent.name, packetPath = getPacketFilePath(taskId, homeDir), packetExists = !1, lastModified = null, packetHash;
         try {
-          let stat25 = await import_node_fs52.promises.lstat(packetPath);
+          let stat25 = await import_node_fs53.promises.lstat(packetPath);
           packetExists = !0, lastModified = stat25.mtime;
           try {
-            let body2 = await import_node_fs52.promises.readFile(packetPath, "utf8"), { yaml } = splitFrontmatter(body2);
+            let body2 = await import_node_fs53.promises.readFile(packetPath, "utf8"), { yaml } = splitFrontmatter(body2);
             if (yaml !== null) {
               let parsed = (0, import_yaml2.parse)(yaml), validated = validatePacketSchema(parsed);
               packetHash = computePacketHash(validated);
@@ -96032,7 +96310,7 @@ function validateAgentAvailability(workItems, detected, priorityOrder, inFlightA
 var import_node_crypto60 = require("node:crypto");
 
 // src/orchestration-shell/root-discovery.ts
-var fs91 = __toESM(require("fs/promises")), path112 = __toESM(require("path")), DEFAULT_DISCOVERY_MAX_DEPTH = 2, DEFAULT_DISCOVERY_MAX_ROOTS = 25, PRUNED_DIRECTORY_NAMES = /* @__PURE__ */ new Set([
+var fs92 = __toESM(require("fs/promises")), path112 = __toESM(require("path")), DEFAULT_DISCOVERY_MAX_DEPTH = 2, DEFAULT_DISCOVERY_MAX_ROOTS = 25, PRUNED_DIRECTORY_NAMES = /* @__PURE__ */ new Set([
   ".git",
   ".codevibe",
   ".dart_tool",
@@ -96105,14 +96383,14 @@ async function discoverRepositoryRoots(deps = {}) {
 async function canonicalizeDirectory(dir) {
   let resolved = path112.resolve(dir);
   try {
-    return await fs91.realpath(resolved);
+    return await fs92.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function readDirSafe(dir) {
   try {
-    return await fs91.readdir(dir, { withFileTypes: !0 });
+    return await fs92.readdir(dir, { withFileTypes: !0 });
   } catch {
     return null;
   }
@@ -98997,9 +99275,9 @@ function sanitizeListingPath(relPath) {
 }
 function formatAgyWorkspaceListing(workdir, maxEntries = AGY_ADVISORY_LISTING_MAX_ENTRIES, maxBytes = AGY_ADVISORY_LISTING_MAX_BYTES) {
   try {
-    if (!fs92.existsSync(workdir))
+    if (!fs93.existsSync(workdir))
       return "Folder listing unavailable (directory does not exist)";
-    if (!fs92.statSync(workdir).isDirectory())
+    if (!fs93.statSync(workdir).isDirectory())
       return "Folder listing unavailable (not a directory)";
     if (maxBytes <= 0 || maxEntries <= 0)
       return "Folder listing (listing omitted \u2014 prompt budget exhausted)";
@@ -99007,7 +99285,7 @@ function formatAgyWorkspaceListing(workdir, maxEntries = AGY_ADVISORY_LISTING_MA
     for (; queue.length > 0 && !truncated; ) {
       let relDir = queue.shift(), absDir = relDir === "" ? workdir : path113.join(workdir, relDir), dir;
       try {
-        dir = fs92.opendirSync(absDir);
+        dir = fs93.opendirSync(absDir);
       } catch (err) {
         if (relDir === "")
           return `Folder listing unavailable (directory unreadable: ${err?.code || (err instanceof Error ? err.message : String(err))})`;
@@ -99037,7 +99315,7 @@ function formatAgyWorkspaceListing(workdir, maxEntries = AGY_ADVISORY_LISTING_MA
         let isDir = entry5.isDirectory(), isSymlinkToDir = !1;
         if (!isDir && entry5.isSymbolicLink())
           try {
-            fs92.statSync(path113.join(absDir, entry5.name)).isDirectory() && (isSymlinkToDir = !0, isDir = !0);
+            fs93.statSync(path113.join(absDir, entry5.name)).isDirectory() && (isSymlinkToDir = !0, isDir = !0);
           } catch {
           }
         if (entry5.name === ".git") {
@@ -101825,7 +102103,7 @@ async function handleShellUserInput(deps) {
                   json ? "json" : "text",
                   { taskId, sessionId: effectiveSessionId }
                 );
-                (0, import_node_fs53.writeFileSync)(exportPath, formatted, "utf8"), output.output = `Audit log exported to ${exportPath} (${result.model.entries.length} entries)`;
+                (0, import_node_fs54.writeFileSync)(exportPath, formatted, "utf8"), output.output = `Audit log exported to ${exportPath} (${result.model.entries.length} entries)`;
               } catch (err) {
                 output.output = `Failed to export audit log to ${exportPath}: ${err.message ?? String(err)}`;
               }
@@ -103714,14 +103992,14 @@ var OllamaGemmaRunner = class {
 };
 
 // src/orchestration-shell/cli.ts
-var import_uuid18 = require("uuid"), fs100 = __toESM(require("fs")), os60 = __toESM(require("os")), path121 = __toESM(require("path"));
+var import_uuid18 = require("uuid"), fs101 = __toESM(require("fs")), os60 = __toESM(require("os")), path121 = __toESM(require("path"));
 
 // src/orchestration-shell/doctor-cli.ts
-var fs94 = __toESM(require("fs")), path114 = __toESM(require("path")), crypto38 = __toESM(require("crypto")), import_child_process9 = require("child_process");
+var fs95 = __toESM(require("fs")), path114 = __toESM(require("path")), crypto38 = __toESM(require("crypto")), import_child_process9 = require("child_process");
 init_detect_agents();
 
 // src/auth/auth-service.ts
-var crypto37 = __toESM(require("crypto")), fs93 = __toESM(require("fs")), http3 = __toESM(require("http")), import_child_process8 = require("child_process");
+var crypto37 = __toESM(require("crypto")), fs94 = __toESM(require("fs")), http3 = __toESM(require("http")), import_child_process8 = require("child_process");
 init_env_scrub();
 init_logger2();
 init_auth_telemetry();
@@ -103803,7 +104081,7 @@ var AuthService = class _AuthService {
   isRunningInWSL() {
     if (process.platform !== "linux") return !1;
     try {
-      let osRelease = fs93.readFileSync("/proc/sys/kernel/osrelease", "utf8");
+      let osRelease = fs94.readFileSync("/proc/sys/kernel/osrelease", "utf8");
       return /microsoft|wsl/i.test(osRelease);
     } catch {
       return !1;
@@ -104300,9 +104578,9 @@ var colors = {
 function probeAgentClis(env = process.env) {
   return AGENT_SPECS.map(({ agent, command, name }) => {
     let binPath;
-    if (agent === "ANTIGRAVITY" && env.AGY_PATH && fs94.existsSync(env.AGY_PATH))
+    if (agent === "ANTIGRAVITY" && env.AGY_PATH && fs95.existsSync(env.AGY_PATH))
       try {
-        fs94.statSync(env.AGY_PATH).isFile() && (binPath = env.AGY_PATH);
+        fs95.statSync(env.AGY_PATH).isFile() && (binPath = env.AGY_PATH);
       } catch {
         binPath = void 0;
       }
@@ -104430,19 +104708,19 @@ async function probeBackendConnectivity(appsyncUrl) {
 function readBoundedUtf8File(filePath, maxBytes) {
   let fd;
   try {
-    let stat25 = fs94.statSync(filePath);
+    let stat25 = fs95.statSync(filePath);
     if (!stat25.isFile()) return { ok: !1, error: "not a regular file" };
     if (stat25.size > maxBytes) return { ok: !1, error: `file exceeds ${maxBytes} byte limit (${stat25.size} bytes)` };
     if (stat25.size === 0) return { ok: !1, error: "empty file (0 bytes)" };
-    fd = fs94.openSync(filePath, "r");
-    let buf = Buffer.alloc(stat25.size), bytesRead = fs94.readSync(fd, buf, 0, stat25.size, 0);
+    fd = fs95.openSync(filePath, "r");
+    let buf = Buffer.alloc(stat25.size), bytesRead = fs95.readSync(fd, buf, 0, stat25.size, 0);
     return { ok: !0, content: buf.subarray(0, bytesRead).toString("utf8") };
   } catch (err) {
     return { ok: !1, error: err.message };
   } finally {
     if (fd !== void 0)
       try {
-        fs94.closeSync(fd);
+        fs95.closeSync(fd);
       } catch {
       }
   }
@@ -104591,8 +104869,8 @@ async function probeOrphanStatusInPair(stateRoot, ownerRootOverride, shadowRootO
           scanErrors.push(`Exposure retention ${record2.marker.taskId}: ${err.message}`);
         }
     let ownerRoot = ownerRootOverride ?? resolveOwnerRoot({}, stateRoot), deadProcessOwnersCount = 0;
-    if (fs94.existsSync(ownerRoot)) {
-      let entries = fs94.readdirSync(ownerRoot, { withFileTypes: !0 });
+    if (fs95.existsSync(ownerRoot)) {
+      let entries = fs95.readdirSync(ownerRoot, { withFileTypes: !0 });
       for (let entry5 of entries) {
         if (!entry5.isFile() || !/^owner-[0-9a-f-]{36}\.json$/i.test(entry5.name)) continue;
         let readResult = readBoundedUtf8File(path114.join(ownerRoot, entry5.name), 4096);
@@ -104650,7 +104928,7 @@ function shadowStateRoot() {
 function readRegistry(stateRoot) {
   let file = path114.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), raw;
   try {
-    raw = fs94.readFileSync(file, "utf8");
+    raw = fs95.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -104662,7 +104940,7 @@ function readRegistry(stateRoot) {
 function collectMarkers(stateRoot) {
   let index = /* @__PURE__ */ new Map(), taskDirs;
   try {
-    taskDirs = fs94.readdirSync(stateRoot, { withFileTypes: !0 });
+    taskDirs = fs95.readdirSync(stateRoot, { withFileTypes: !0 });
   } catch {
     return index;
   }
@@ -104670,7 +104948,7 @@ function collectMarkers(stateRoot) {
     if (!taskDir.isDirectory() || taskDir.name.startsWith(".")) continue;
     let dir = path114.join(stateRoot, taskDir.name), files;
     try {
-      files = fs94.readdirSync(dir);
+      files = fs95.readdirSync(dir);
     } catch {
       continue;
     }
@@ -104678,8 +104956,8 @@ function collectMarkers(stateRoot) {
       if (!SHADOW_STATE_FILE_RE.test(name) && !SHADOW_EXPOSURE_RETENTION_FILE_RE.test(name)) continue;
       let file = path114.join(dir, name), marker;
       try {
-        if (fs94.statSync(file).size > MAX_STATE_MARKER_BYTES) continue;
-        marker = JSON.parse(fs94.readFileSync(file, "utf8"));
+        if (fs95.statSync(file).size > MAX_STATE_MARKER_BYTES) continue;
+        marker = JSON.parse(fs95.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
@@ -104695,19 +104973,19 @@ function inodeSurvivesInParent(root) {
   if (!root.ino) return;
   let parent = path114.dirname(root.path);
   try {
-    fs94.lstatSync(parent);
+    fs95.lstatSync(parent);
   } catch (err) {
     return err.code === "ENOENT" ? !1 : void 0;
   }
   let entries;
   try {
-    entries = fs94.readdirSync(parent);
+    entries = fs95.readdirSync(parent);
   } catch {
     return;
   }
   for (let name of entries)
     try {
-      if (fs94.lstatSync(path114.join(parent, name), { bigint: !0 }).ino.toString() === root.ino) return !0;
+      if (fs95.lstatSync(path114.join(parent, name), { bigint: !0 }).ino.toString() === root.ino) return !0;
     } catch {
       continue;
     }
@@ -104718,7 +104996,7 @@ function diagnose(stateRoot, roots) {
   return roots.map((root) => {
     let markers = markerIndex.get(root.path) ?? [], present = !1;
     try {
-      present = fs94.lstatSync(root.path).isDirectory();
+      present = fs95.lstatSync(root.path).isDirectory();
     } catch {
       present = !1;
     }
@@ -104876,29 +105154,29 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
   Nothing was written. Re-run with ${colors.bold}--yes${colors.reset} to apply${withheld.length ? " the entries listed first" : ""}.`), 0;
   let locks = path114.join(stateRoot, SHADOW_QUOTA_LOCK_DIR), held = [];
   try {
-    held = fs94.readdirSync(locks);
+    held = fs95.readdirSync(locks);
   } catch {
     held = [];
   }
   if (held.length)
     return console.error(`${colors.red}\u2717${colors.reset} A CodeVibe session is registering a root right now. Try again once it is idle.`), 1;
-  let file = path114.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), current = fs94.readFileSync(file, "utf8");
+  let file = path114.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), current = fs95.readFileSync(file, "utf8");
   if (crypto38.createHash("sha256").update(current).digest("hex") !== crypto38.createHash("sha256").update(registry.raw).digest("hex"))
     return console.error(`${colors.red}\u2717${colors.reset} The registry changed while this ran. Nothing was written; re-run.`), 1;
   let stamp2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-"), backupDir = path114.join(path114.dirname(stateRoot), "shadow-root-backups", stamp2), backup = path114.join(backupDir, "shadow-roots.json");
   try {
-    fs94.mkdirSync(backupDir, { recursive: !0, mode: 448 }), fs94.copyFileSync(file, backup);
+    fs95.mkdirSync(backupDir, { recursive: !0, mode: 448 }), fs95.copyFileSync(file, backup);
   } catch (err) {
     return console.error(`${colors.red}\u2717${colors.reset} Could not write the backup at ${backupDir} (${err.code ?? "unknown error"}). Nothing was changed \u2014 this command will not clear an entry it cannot restore.`), 1;
   }
   let removed = new Set(clearable.map((d) => d.root.path)), kept = registry.roots.filter((r) => !removed.has(r.path)), tmp = path114.join(backupDir, `.registry.next.${process.pid}`);
   try {
-    fs94.writeFileSync(tmp, JSON.stringify({ version: 2, roots: kept }), { mode: 384 }), fs94.renameSync(tmp, file);
+    fs95.writeFileSync(tmp, JSON.stringify({ version: 2, roots: kept }), { mode: 384 }), fs95.renameSync(tmp, file);
   } catch (err) {
     return console.error(`${colors.red}\u2717${colors.reset} Could not replace the registry (${err.code ?? "unknown error"}). Nothing was changed; a copy of it is at ${backup}.`), 1;
   } finally {
     try {
-      fs94.unlinkSync(tmp);
+      fs95.unlinkSync(tmp);
     } catch {
     }
   }
@@ -104907,7 +105185,7 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
     for (let marker of d.markers) {
       let copy = path114.join(backupDir, `marker-${savedMarkers.length}-${path114.basename(marker)}`);
       try {
-        fs94.copyFileSync(marker, copy), savedMarkers.push({ copy: path114.basename(copy), original: marker });
+        fs95.copyFileSync(marker, copy), savedMarkers.push({ copy: path114.basename(copy), original: marker });
       } catch (err) {
         if (err.code !== "ENOENT") {
           unbackedMarkers.push(marker);
@@ -104915,16 +105193,16 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
         }
       }
       try {
-        fs94.unlinkSync(marker);
+        fs95.unlinkSync(marker);
       } catch {
       }
       try {
-        fs94.rmdirSync(path114.dirname(marker));
+        fs95.rmdirSync(path114.dirname(marker));
       } catch {
       }
     }
   try {
-    fs94.writeFileSync(path114.join(backupDir, "manifest.json"), `${JSON.stringify({
+    fs95.writeFileSync(path114.join(backupDir, "manifest.json"), `${JSON.stringify({
       clearedAtUtc: (/* @__PURE__ */ new Date()).toISOString(),
       registry: file,
       registryBackup: path114.basename(backup),
@@ -104944,7 +105222,7 @@ ${colors.green}\u2713${colors.reset} Cleared ${clearable.length} entr${clearable
 }
 
 // src/substrate-launch/engage-substrate.ts
-var import_node_fs54 = require("node:fs"), os56 = __toESM(require("node:os")), path115 = __toESM(require("node:path")), crypto39 = __toESM(require("node:crypto"));
+var import_node_fs55 = require("node:fs"), os56 = __toESM(require("node:os")), path115 = __toESM(require("node:path")), crypto39 = __toESM(require("node:crypto"));
 
 // src/credential-broker/types.ts
 var BROKER_ROUTES = [
@@ -106947,17 +107225,17 @@ function deriveAuditPath(workdir) {
 async function assertAuditOutsideWorkdir(auditPath, workdir) {
   let realWorkdir;
   try {
-    realWorkdir = await import_node_fs54.promises.realpath(workdir);
+    realWorkdir = await import_node_fs55.promises.realpath(workdir);
   } catch {
     throw new Error(
       `CP-7 W3: cannot realpath workdir "${workdir}" \u2014 refusing to launch (audit containment fail-closed)`
     );
   }
   let auditDir = path115.dirname(auditPath);
-  await import_node_fs54.promises.mkdir(auditDir, { recursive: !0 });
+  await import_node_fs55.promises.mkdir(auditDir, { recursive: !0 });
   let realAuditDir;
   try {
-    realAuditDir = await import_node_fs54.promises.realpath(auditDir);
+    realAuditDir = await import_node_fs55.promises.realpath(auditDir);
   } catch {
     throw new Error(
       `CP-7 W3: cannot realpath audit dir "${auditDir}" \u2014 refusing to launch (fail-closed)`
@@ -106965,14 +107243,14 @@ async function assertAuditOutsideWorkdir(auditPath, workdir) {
   }
   let resolvedAuditPath = path115.join(realAuditDir, path115.basename(auditPath)), leafStat;
   try {
-    leafStat = await import_node_fs54.promises.lstat(resolvedAuditPath);
+    leafStat = await import_node_fs55.promises.lstat(resolvedAuditPath);
   } catch {
     leafStat = void 0;
   }
   let resolvedLeafTarget = resolvedAuditPath;
   if (leafStat?.isSymbolicLink())
     try {
-      resolvedLeafTarget = await import_node_fs54.promises.realpath(resolvedAuditPath);
+      resolvedLeafTarget = await import_node_fs55.promises.realpath(resolvedAuditPath);
     } catch {
       throw new Error(
         `CP-7 W3: audit leaf "${resolvedAuditPath}" is a symlink that does not resolve (dangling) \u2014 refusing to launch (fail-closed). The audit file must be a regular file in the sibling .codevibe/audit/ tree.`
@@ -107250,7 +107528,7 @@ async function engageSubstrate(input) {
 async function bubblewrapWorkspaceRoots(input) {
   if (!input.projectRoot)
     throw new Error("bubblewrap tier: the spawn names no project folder \u2014 refusing to launch without the \xA76.1 grant rule");
-  return { project: await import_node_fs54.promises.realpath(input.projectRoot), copyRoots: await v2CopyRoots() };
+  return { project: await import_node_fs55.promises.realpath(input.projectRoot), copyRoots: await v2CopyRoots() };
 }
 var RESOLVER_AGENT_STATE_DIR_SEGMENTS = {
   GEMINI: [".gemini"]
@@ -107303,22 +107581,22 @@ async function engageWriteConfinedResolverSandbox(input) {
       copyRoot
     });
     try {
-      await import_node_fs54.promises.mkdir(path115.dirname(spawnParentDir), { recursive: !0 }), await import_node_fs54.promises.mkdir(spawnParentDir);
+      await import_node_fs55.promises.mkdir(path115.dirname(spawnParentDir), { recursive: !0 }), await import_node_fs55.promises.mkdir(spawnParentDir);
     } catch (mkdirErr) {
-      throw await import_node_fs54.promises.rm(spawnRecordFile, { force: !0 }), mkdirErr;
+      throw await import_node_fs55.promises.rm(spawnRecordFile, { force: !0 }), mkdirErr;
     }
     spawnParentDirCreated = !0;
     try {
       let agyCliDir = path115.join(privateHomeDir, ".gemini", "antigravity-cli");
-      await import_node_fs54.promises.mkdir(agyCliDir, { recursive: !0 });
+      await import_node_fs55.promises.mkdir(agyCliDir, { recursive: !0 });
       let hostAgyDir = path115.join(homedir47, ".gemini", "antigravity-cli"), idFile = path115.join(hostAgyDir, "installation_id"), seeded = await seedAgySignIn(hostAgyDir, agyCliDir, input.agySignIn);
       logger.info("[engageSubstrate] agy sign-in seeded for the spawn", seeded);
       try {
-        await import_node_fs54.promises.copyFile(idFile, path115.join(agyCliDir, "installation_id")), await import_node_fs54.promises.chmod(path115.join(agyCliDir, "installation_id"), 384);
+        await import_node_fs55.promises.copyFile(idFile, path115.join(agyCliDir, "installation_id")), await import_node_fs55.promises.chmod(path115.join(agyCliDir, "installation_id"), 384);
       } catch {
       }
       let agyEnvForModel = input.homedir !== void 0 ? {} : process.env, safeAgySettings = readSafeAgyModelSettings(homedir47, agyEnvForModel);
-      (safeAgySettings.model || safeAgySettings.effort) && await import_node_fs54.promises.writeFile(
+      (safeAgySettings.model || safeAgySettings.effort) && await import_node_fs55.promises.writeFile(
         path115.join(agyCliDir, "settings.json"),
         JSON.stringify(safeAgySettings, null, 2) + `
 `,
@@ -107357,7 +107635,7 @@ async function engageWriteConfinedResolverSandbox(input) {
       let rollbackErrors = [];
       if (spawnParentDirCreated && spawnParentDir !== null)
         try {
-          await import_node_fs54.promises.rm(spawnParentDir, { recursive: !0, force: !0 }), spawnRecordFile !== null && await import_node_fs54.promises.rm(spawnRecordFile, { force: !0 });
+          await import_node_fs55.promises.rm(spawnParentDir, { recursive: !0, force: !0 }), spawnRecordFile !== null && await import_node_fs55.promises.rm(spawnRecordFile, { force: !0 });
         } catch (rmErr) {
           rollbackErrors.push(rmErr);
         }
@@ -107373,7 +107651,7 @@ async function engageWriteConfinedResolverSandbox(input) {
     stateDir = path115.join(
       homedir47,
       ...RESOLVER_AGENT_STATE_DIR_SEGMENTS[agentKind]
-    ), await import_node_fs54.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
+    ), await import_node_fs55.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
     }), env.HOME = homedir47;
     let nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
     env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`;
@@ -107427,7 +107705,7 @@ async function engageWriteConfinedResolverSandbox(input) {
           }
         ), err;
       }
-      spawnParentDirCreated && spawnParentDir !== null && (await import_node_fs54.promises.rm(spawnParentDir, { recursive: !0, force: !0 }), spawnRecordFile !== null && await import_node_fs54.promises.rm(spawnRecordFile, { force: !0 }));
+      spawnParentDirCreated && spawnParentDir !== null && (await import_node_fs55.promises.rm(spawnParentDir, { recursive: !0, force: !0 }), spawnRecordFile !== null && await import_node_fs55.promises.rm(spawnRecordFile, { force: !0 }));
     }
   };
 }
@@ -109118,7 +109396,7 @@ Note: --export will overwrite any existing file at <path>.
     offset: parsed.offset
   });
   if (result.kind === "ok" && parsed.exportPath) {
-    let writeFile9 = deps?.writeFileFn ?? ((p, c) => fs100.writeFileSync(p, c, "utf8"));
+    let writeFile9 = deps?.writeFileFn ?? ((p, c) => fs101.writeFileSync(p, c, "utf8"));
     try {
       let formatted = formatAuditExport(
         result.model,
@@ -109267,7 +109545,7 @@ ${err.message}
 `), 1;
   }
   try {
-    setSessionCopyRoot((await chooseCopyLocation(await fs100.promises.realpath(process.cwd()))).copyRoot);
+    setSessionCopyRoot((await chooseCopyLocation(await fs101.promises.realpath(process.cwd()))).copyRoot);
   } catch (err) {
     let reason = err?.message ?? String(err);
     markSessionCopyRootUnresolved(reason), logger.warn("[cli] copy location not resolved at start (each task resolves it again)", { error: reason });
@@ -109614,7 +109892,7 @@ function buildAndArmQuorumLoop(args) {
       cacheDir: path121.join(os60.homedir(), ".codevibe", "substrate-checks"),
       viewParent: async () => {
         let dir = await defaultCopyLocation();
-        return await fs100.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
+        return await fs101.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
       },
       linuxKeyParts: (open29) => linuxTierSelfTestKeyParts(open29)
     },
@@ -109710,7 +109988,7 @@ async function buildQuorumLoopExecutor(args) {
       cacheDir: path121.join(os60.homedir(), ".codevibe", "substrate-checks"),
       viewParent: async () => {
         let dir = await defaultCopyLocation();
-        return await fs100.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
+        return await fs101.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
       },
       linuxKeyParts: (open29) => linuxTierSelfTestKeyParts(open29)
     },
@@ -110193,7 +110471,7 @@ async function buildTeamLocalExecutor(args) {
       cacheDir: path121.join(os60.homedir(), ".codevibe", "substrate-checks"),
       viewParent: async () => {
         let dir = await defaultCopyLocation();
-        return await fs100.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
+        return await fs101.promises.mkdir(dir, { recursive: !0, mode: 448 }), dir;
       },
       linuxKeyParts: (open29) => linuxTierSelfTestKeyParts(open29)
     },