@quantiya/codevibe-core 2.0.81 → 2.0.82

package/dist/orchestration-shell/cli.js

@@ -951,7 +951,7 @@ function companionPreferenceFilePath() {
 async function readCompanionPreference() {
   let filePath = companionPreferenceFilePath(), raw, st;
   try {
-    st = await fs64.stat(filePath);
+    st = await fs65.stat(filePath);
   } catch (err) {
     return err?.code !== "ENOENT" && logger.debug("[companion-preference] stat error \u2014 treating as missing", {
       filePath,
@@ -964,7 +964,7 @@ async function readCompanionPreference() {
 `
     ), null;
   try {
-    raw = await fs64.readFile(filePath, "utf8");
+    raw = await fs65.readFile(filePath, "utf8");
   } catch (err) {
     return logger.debug("[companion-preference] read error \u2014 treating as missing", {
       filePath,
@@ -982,19 +982,19 @@ async function readCompanionPreference() {
 }
 async function persistCompanionPreference(pref) {
   let filePath = companionPreferenceFilePath(), dir = path85.dirname(filePath);
-  await fs64.mkdir(dir, { recursive: !0 }), await fs64.writeFile(filePath, JSON.stringify(pref, null, 2), {
+  await fs65.mkdir(dir, { recursive: !0 }), await fs65.writeFile(filePath, JSON.stringify(pref, null, 2), {
     encoding: "utf8",
     mode: 384
   });
   try {
-    await fs64.chmod(filePath, 384);
+    await fs65.chmod(filePath, 384);
   } catch {
   }
 }
-var fs64, path85, os52, import_zod16, CompanionPreferenceSchema, init_persist_preference = __esm({
+var fs65, path85, os52, import_zod16, CompanionPreferenceSchema, init_persist_preference = __esm({
   "src/companion-mode/persist-preference.ts"() {
     "use strict";
-    fs64 = __toESM(require("fs/promises")), path85 = __toESM(require("path")), os52 = __toESM(require("os")), import_zod16 = require("zod");
+    fs65 = __toESM(require("fs/promises")), path85 = __toESM(require("path")), os52 = __toESM(require("os")), import_zod16 = require("zod");
     init_logger2();
     CompanionPreferenceSchema = import_zod16.z.object({
       lastAgent: import_zod16.z.union([
@@ -1059,13 +1059,13 @@ function isContainedPath(parent, candidate) {
 }
 function resolveDeclaredCompanionLauncher(packageJsonPath) {
   try {
-    let packageRoot = fs65.realpathSync(path86.dirname(packageJsonPath)), declared = JSON.parse(
-      fs65.readFileSync(packageJsonPath, "utf8")
+    let packageRoot = fs66.realpathSync(path86.dirname(packageJsonPath)), declared = JSON.parse(
+      fs66.readFileSync(packageJsonPath, "utf8")
     ).codevibe?.companionLauncher;
     if (typeof declared != "string" || declared.trim().length === 0)
       return null;
-    let launcherPath = fs65.realpathSync(path86.resolve(packageRoot, declared));
-    return !isContainedPath(packageRoot, launcherPath) || !fs65.statSync(launcherPath).isFile() ? null : (fs65.accessSync(launcherPath, fs65.constants.X_OK), launcherPath);
+    let launcherPath = fs66.realpathSync(path86.resolve(packageRoot, declared));
+    return !isContainedPath(packageRoot, launcherPath) || !fs66.statSync(launcherPath).isFile() ? null : (fs66.accessSync(launcherPath, fs66.constants.X_OK), launcherPath);
   } catch {
     return null;
   }
@@ -1175,10 +1175,10 @@ async function runCompanionMode(args) {
     process.kill(process.pid, signal);
   }))(child.signal), 1) : child.status ?? 1;
 }
-var import_child_process10, import_module, path86, fs65, NoAgentInstalledError, COMPANION_PLUGIN, ACTIVE_COMPANION_AGENTS, ACTIVATION_AGENT, init_companion_mode = __esm({
+var import_child_process10, import_module, path86, fs66, NoAgentInstalledError, COMPANION_PLUGIN, ACTIVE_COMPANION_AGENTS, ACTIVATION_AGENT, init_companion_mode = __esm({
   "src/companion-mode/index.ts"() {
     "use strict";
-    import_child_process10 = require("child_process"), import_module = require("module"), path86 = __toESM(require("path")), fs65 = __toESM(require("fs"));
+    import_child_process10 = require("child_process"), import_module = require("module"), path86 = __toESM(require("path")), fs66 = __toESM(require("fs"));
     init_env_scrub();
     init_logger2();
     init_detect_agents();
@@ -21826,7 +21826,7 @@ async function clearRetiredPlannerCache(userId, cacheRoot = process.env.CODEVIBE
 }
 
 // src/orchestration-shell/index.ts
-var path79 = __toESM(require("path")), os48 = __toESM(require("os")), import_promises = require("node:fs/promises"), import_node_fs37 = require("node:fs"), import_node_child_process10 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
+var path79 = __toESM(require("path")), os48 = __toESM(require("os")), import_promises = require("node:fs/promises"), fs59 = __toESM(require("node:fs")), import_node_fs37 = require("node:fs"), import_node_child_process10 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
 
 // src/orchestration-shell/web/sanitize.ts
 function sanitizeForTerminal(input) {
@@ -61160,6 +61160,9 @@ function resolveTeamExecution(_override, _env = process.env) {
   return DEFAULT_TEAM_EXECUTION;
 }
 
+// src/local-executor/spawn-sweep.ts
+init_logger2();
+
 // src/orchestration-shell/quorum-loop.ts
 init_env_scrub();
 
@@ -62549,6 +62552,7 @@ var ChildProcessCommandRunner = class {
     let spawnOptions = {
       stdio: opts.stdinTty ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
       windowsHide: !0,
+      detached: opts.detached ?? !1,
       signal: opts.signal,
       env: opts.env !== void 0 ? scrubSearchApiKeys({ ...opts.env }) : scrubSearchApiKeys({ ...process.env }),
       ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {}
@@ -63081,7 +63085,17 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
     '(allow file-read* (subpath "/Library"))',
     '(allow file-read* (subpath "/private/var/db"))',
     '(allow file-read* (subpath "/private/var/select"))',
-    '(allow file-read* (subpath "/dev"))',
+    // PD-MAC-DEV (§6.1): grant only literal reads of the device nodes agents
+    // use, plus `/dev/fd`. Replaces the broad `/dev` subpath read so a confined
+    // agent cannot open another terminal session's tty or its own controlling
+    // terminal (/dev/tty, /dev/ttys*).
+    '(allow file-read* (literal "/dev/null"))',
+    '(allow file-read* (literal "/dev/zero"))',
+    '(allow file-read* (literal "/dev/random"))',
+    '(allow file-read* (literal "/dev/urandom"))',
+    '(allow file-read* (literal "/dev/dtracehelper"))',
+    '(allow file-read* (literal "/dev/autofs_nowait"))',
+    '(allow file-read* (subpath "/dev/fd"))',
     // Ordinary POSIX tooling opens `/dev/null` rw. Grant only that literal
     // device (the `/dev` read above does not cover writes).
     '(allow file-write* (literal "/dev/null"))'
@@ -63124,11 +63138,13 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
     );
   }
   return networkPosture === "open" ? lines.push(
-    // A1d resolver-confinement row: deny all network, then re-allow ALL
-    // OUTBOUND (external inbound stays denied). Loopback bind/inbound is permitted
+    // A1d resolver-confinement row (§6.1, SP-A5, SP-A5b): deny all network,
+    // then allow IP outbound + only mDNSResponder Unix socket for name resolution
+    // (external inbound stays denied). Loopback bind/inbound is permitted
     // for local IPC (e.g. Antigravity local RPC daemon on 127.0.0.1).
     "(deny network*)",
-    "(allow network-outbound)",
+    '(allow network-outbound (remote ip "*:*"))',
+    '(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder")))',
     '(allow network-bind (local ip "localhost:*"))',
     '(allow network-inbound (local ip "localhost:*"))',
     ""
@@ -84900,14 +84916,138 @@ function uniqueDetectedAgents(detected) {
     item2 !== "CLAUDE" && item2 !== "CODEX" && item2 !== "ANTIGRAVITY" || out.includes(item2) || out.push(item2);
   return out;
 }
-function agyReadOnlyWorkdirPreamble(workdir) {
-  return [
+var AGY_ADVISORY_LISTING_MAX_ENTRIES = 500, AGY_ADVISORY_LISTING_MAX_BYTES = 16384, AGY_ADVISORY_IGNORED_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  "target",
+  "venv",
+  ".venv",
+  "__pycache__",
+  "Pods",
+  "DerivedData",
+  ".gradle",
+  ".idea",
+  ".next",
+  ".turbo",
+  ".cache",
+  ".gemini",
+  ".codevibe",
+  ".codevibe-audit",
+  ".codevibe-attachments",
+  ".agent-worktrees",
+  ".review-worktrees",
+  ".hard-gate",
+  ".dev-marketplace",
+  ".dev-marketplace-next"
+]), AGY_COMMAND_TOOL_SEATBELT_WARNING = "Your command tool cannot run in this sandbox: do not call it. CodeVibe listed the folder for you below (relative paths with '/' separator; literal backslashes escaped as \\\\, control characters escaped as \\xNN or \\uNNNN; a trailing / marks a folder). Read files with your file-reading tool, using absolute paths under the folder.";
+function sanitizeListingPath(relPath) {
+  return relPath.replace(/\\/g, "\\\\").replace(/[\x00-\x1f\x7f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`).replace(/[\u0080-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function formatAgyWorkspaceListing(workdir, maxEntries = AGY_ADVISORY_LISTING_MAX_ENTRIES, maxBytes = AGY_ADVISORY_LISTING_MAX_BYTES) {
+  try {
+    if (!fs59.existsSync(workdir))
+      return "Folder listing unavailable (directory does not exist)";
+    if (!fs59.statSync(workdir).isDirectory())
+      return "Folder listing unavailable (not a directory)";
+    if (maxBytes <= 0 || maxEntries <= 0)
+      return "Folder listing (listing omitted \u2014 prompt budget exhausted)";
+    let entries = [], skippedTopLevel = [], totalBytes = 0, truncated = !1, hasUnreadableDirs = !1, queue = [""];
+    for (; queue.length > 0 && !truncated; ) {
+      let relDir = queue.shift(), absDir = relDir === "" ? workdir : path79.join(workdir, relDir), dir;
+      try {
+        dir = fs59.opendirSync(absDir);
+      } catch (err) {
+        if (relDir === "")
+          return `Folder listing unavailable (directory unreadable: ${err?.code || (err instanceof Error ? err.message : String(err))})`;
+        hasUnreadableDirs = !0;
+        continue;
+      }
+      let dirEntries = [], dirScanLimit = maxEntries * 2;
+      try {
+        let entry5;
+        for (; (entry5 = dir.readSync()) !== null; )
+          if (dirEntries.push(entry5), dirEntries.length > dirScanLimit) {
+            truncated = !0;
+            break;
+          }
+      } catch (err) {
+        if (relDir === "" && dirEntries.length === 0)
+          return `Folder listing unavailable (directory unreadable: ${err?.code || (err instanceof Error ? err.message : String(err))})`;
+        hasUnreadableDirs = !0;
+      } finally {
+        try {
+          dir.closeSync();
+        } catch {
+        }
+      }
+      dirEntries.sort((a, b) => a.name.localeCompare(b.name));
+      for (let entry5 of dirEntries) {
+        let isDir = entry5.isDirectory(), isSymlinkToDir = !1;
+        if (!isDir && entry5.isSymbolicLink())
+          try {
+            fs59.statSync(path79.join(absDir, entry5.name)).isDirectory() && (isSymlinkToDir = !0, isDir = !0);
+          } catch {
+          }
+        if (entry5.name === ".git") {
+          relDir === "" && skippedTopLevel.push(isDir ? ".git/" : ".git");
+          continue;
+        }
+        if (isDir && AGY_ADVISORY_IGNORED_DIRS.has(entry5.name)) {
+          relDir === "" && skippedTopLevel.push(`${entry5.name}/`);
+          continue;
+        }
+        let rawRelPath = relDir === "" ? entry5.name : `${relDir}/${entry5.name}`, sanitizedRel = sanitizeListingPath(rawRelPath);
+        if (entry5.isDirectory()) {
+          let entryStr = `${sanitizedRel}/`, entryBytes = Buffer.byteLength(entryStr, "utf8") + 1;
+          if (entries.length >= maxEntries || totalBytes + entryBytes > maxBytes) {
+            truncated = !0;
+            break;
+          }
+          entries.push(entryStr), totalBytes += entryBytes, queue.push(rawRelPath);
+        } else if (isSymlinkToDir) {
+          let entryStr = `${sanitizedRel}/`, entryBytes = Buffer.byteLength(entryStr, "utf8") + 1;
+          if (entries.length >= maxEntries || totalBytes + entryBytes > maxBytes) {
+            truncated = !0;
+            break;
+          }
+          entries.push(entryStr), totalBytes += entryBytes;
+        } else {
+          let entryStr = sanitizedRel, entryBytes = Buffer.byteLength(entryStr, "utf8") + 1;
+          if (entries.length >= maxEntries || totalBytes + entryBytes > maxBytes) {
+            truncated = !0;
+            break;
+          }
+          entries.push(entryStr), totalBytes += entryBytes;
+        }
+      }
+    }
+    if (entries.length === 0)
+      return truncated ? "Folder listing (listing omitted \u2014 prompt budget exhausted)" : hasUnreadableDirs ? "Folder listing unavailable (directory unreadable)" : skippedTopLevel.length > 0 ? `Folder listing (0 entries listed, complete; not listed: ${skippedTopLevel.join(", ")}):
+(no other files found)` : `Folder listing (0 entries, complete):
+(no files found)`;
+    let status = truncated ? "truncated" : hasUnreadableDirs ? "partial, some subdirectories unreadable" : "complete", notListedPart = skippedTopLevel.length > 0 ? `; not listed: ${skippedTopLevel.join(", ")}` : "";
+    return `${`Folder listing (${entries.length} entries, ${status}${notListedPart}):`}
+${entries.join(`
+`)}`;
+  } catch (err) {
+    return `Folder listing unavailable (${err?.code || (err instanceof Error ? err.message : String(err))})`;
+  }
+}
+function agyReadOnlyWorkdirPreamble(workdir, listing) {
+  let parts = [
     `You are reading the directory \`${workdir}\` (added to your workspace via --add-dir).`,
     `Use absolute paths under \`${workdir}\` when you reference files.`,
     "Do NOT use a relative 'current directory' \u2014 your process cwd is NOT the workspace.",
-    "This is read-only advisory work: do not create, edit, delete, or move files.",
-    ""
-  ].join(`
+    "This is read-only advisory work: do not create, edit, delete, or move files."
+  ];
+  return listing !== void 0 && listing.length > 0 && parts.push(
+    AGY_COMMAND_TOOL_SEATBELT_WARNING,
+    "",
+    listing
+  ), parts.push(""), parts.join(`
 `);
 }
 function readOnlyAgentPrompt(args) {
@@ -84928,8 +85068,17 @@ function readOnlyAgentPrompt(args) {
     args.advisoryBrief || args.intent.promptForPlanning || args.intent.rawMention,
     ""
   ].join(`
-`);
-  return args.agent === "ANTIGRAVITY" && args.allowRepositoryTools ? `${agyReadOnlyWorkdirPreamble(args.workingDir)}${body}` : body;
+`), fullPrompt;
+  if (args.agent === "ANTIGRAVITY" && args.allowRepositoryTools) {
+    let basePreamble = agyReadOnlyWorkdirPreamble(args.workingDir), bodyBytes = Buffer.byteLength(body, "utf8"), basePreambleBytes = Buffer.byteLength(basePreamble, "utf8"), instructionPreambleText = `${AGY_COMMAND_TOOL_SEATBELT_WARNING}
+
+`, instructionBytes = Buffer.byteLength(instructionPreambleText, "utf8"), totalScaffoldBytes = bodyBytes + basePreambleBytes + instructionBytes + 128 + 512, availableListingBytes = Math.max(0, 122880 - totalScaffoldBytes), maxListingBytes = Math.min(AGY_ADVISORY_LISTING_MAX_BYTES, availableListingBytes), listing;
+    args.folderListing !== void 0 ? (listing = args.folderListing, Buffer.byteLength(listing, "utf8") > availableListingBytes && (listing = "Folder listing (listing omitted \u2014 prompt budget exhausted)")) : maxListingBytes >= 64 ? listing = formatAgyWorkspaceListing(args.workingDir, AGY_ADVISORY_LISTING_MAX_ENTRIES, maxListingBytes) : listing = "Folder listing (listing omitted \u2014 prompt budget exhausted)";
+    let candidatePrompt = `${agyReadOnlyWorkdirPreamble(args.workingDir, listing)}${body}`;
+    Buffer.byteLength(candidatePrompt, "utf8") <= 122880 ? fullPrompt = candidatePrompt : fullPrompt = `${basePreamble}${body}`;
+  } else
+    fullPrompt = body;
+  return fullPrompt;
 }
 function readOnlyAdvisoryAllowsRepositoryTools(_input) {
   return !0;
@@ -89300,14 +89449,14 @@ var OllamaGemmaRunner = class {
 };
 
 // src/orchestration-shell/cli.ts
-var import_uuid18 = require("uuid"), fs66 = __toESM(require("fs"));
+var import_uuid18 = require("uuid"), fs67 = __toESM(require("fs"));
 
 // src/orchestration-shell/doctor-cli.ts
-var fs60 = __toESM(require("fs")), path80 = __toESM(require("path")), crypto32 = __toESM(require("crypto")), import_child_process7 = require("child_process");
+var fs61 = __toESM(require("fs")), path80 = __toESM(require("path")), crypto32 = __toESM(require("crypto")), import_child_process7 = require("child_process");
 init_detect_agents();
 
 // src/auth/auth-service.ts
-var crypto31 = __toESM(require("crypto")), fs59 = __toESM(require("fs")), http3 = __toESM(require("http")), import_child_process6 = require("child_process");
+var crypto31 = __toESM(require("crypto")), fs60 = __toESM(require("fs")), http3 = __toESM(require("http")), import_child_process6 = require("child_process");
 init_env_scrub();
 init_logger2();
 init_auth_telemetry();
@@ -89389,7 +89538,7 @@ var AuthService = class _AuthService {
   isRunningInWSL() {
     if (process.platform !== "linux") return !1;
     try {
-      let osRelease = fs59.readFileSync("/proc/sys/kernel/osrelease", "utf8");
+      let osRelease = fs60.readFileSync("/proc/sys/kernel/osrelease", "utf8");
       return /microsoft|wsl/i.test(osRelease);
     } catch {
       return !1;
@@ -89883,9 +90032,9 @@ var colors = {
 function probeAgentClis(env = process.env) {
   return AGENT_SPECS.map(({ agent, command, name }) => {
     let binPath;
-    if (agent === "ANTIGRAVITY" && env.AGY_PATH && fs60.existsSync(env.AGY_PATH))
+    if (agent === "ANTIGRAVITY" && env.AGY_PATH && fs61.existsSync(env.AGY_PATH))
       try {
-        fs60.statSync(env.AGY_PATH).isFile() && (binPath = env.AGY_PATH);
+        fs61.statSync(env.AGY_PATH).isFile() && (binPath = env.AGY_PATH);
       } catch {
         binPath = void 0;
       }
@@ -90013,19 +90162,19 @@ async function probeBackendConnectivity(appsyncUrl) {
 function readBoundedUtf8File(filePath, maxBytes) {
   let fd;
   try {
-    let stat14 = fs60.statSync(filePath);
+    let stat14 = fs61.statSync(filePath);
     if (!stat14.isFile()) return { ok: !1, error: "not a regular file" };
     if (stat14.size > maxBytes) return { ok: !1, error: `file exceeds ${maxBytes} byte limit (${stat14.size} bytes)` };
     if (stat14.size === 0) return { ok: !1, error: "empty file (0 bytes)" };
-    fd = fs60.openSync(filePath, "r");
-    let buf = Buffer.alloc(stat14.size), bytesRead = fs60.readSync(fd, buf, 0, stat14.size, 0);
+    fd = fs61.openSync(filePath, "r");
+    let buf = Buffer.alloc(stat14.size), bytesRead = fs61.readSync(fd, buf, 0, stat14.size, 0);
     return { ok: !0, content: buf.subarray(0, bytesRead).toString("utf8") };
   } catch (err) {
     return { ok: !1, error: err.message };
   } finally {
     if (fd !== void 0)
       try {
-        fs60.closeSync(fd);
+        fs61.closeSync(fd);
       } catch {
       }
   }
@@ -90151,8 +90300,8 @@ async function probeOrphanStatus(stateRoot, ownerRootOverride, shadowRootOverrid
           scanErrors.push(`Exposure retention ${record2.marker.taskId}: ${err.message}`);
         }
     let ownerRoot = ownerRootOverride ?? resolveOwnerRoot({}, stateRoot), deadProcessOwnersCount = 0;
-    if (fs60.existsSync(ownerRoot)) {
-      let entries = fs60.readdirSync(ownerRoot, { withFileTypes: !0 });
+    if (fs61.existsSync(ownerRoot)) {
+      let entries = fs61.readdirSync(ownerRoot, { withFileTypes: !0 });
       for (let entry5 of entries) {
         if (!entry5.isFile() || !/^owner-[0-9a-f-]{36}\.json$/i.test(entry5.name)) continue;
         let readResult = readBoundedUtf8File(path80.join(ownerRoot, entry5.name), 4096);
@@ -90210,7 +90359,7 @@ function shadowStateRoot() {
 function readRegistry(stateRoot) {
   let file = path80.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), raw;
   try {
-    raw = fs60.readFileSync(file, "utf8");
+    raw = fs61.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -90222,7 +90371,7 @@ function readRegistry(stateRoot) {
 function collectMarkers(stateRoot) {
   let index = /* @__PURE__ */ new Map(), taskDirs;
   try {
-    taskDirs = fs60.readdirSync(stateRoot, { withFileTypes: !0 });
+    taskDirs = fs61.readdirSync(stateRoot, { withFileTypes: !0 });
   } catch {
     return index;
   }
@@ -90230,7 +90379,7 @@ function collectMarkers(stateRoot) {
     if (!taskDir.isDirectory() || taskDir.name.startsWith(".")) continue;
     let dir = path80.join(stateRoot, taskDir.name), files;
     try {
-      files = fs60.readdirSync(dir);
+      files = fs61.readdirSync(dir);
     } catch {
       continue;
     }
@@ -90238,8 +90387,8 @@ function collectMarkers(stateRoot) {
       if (!SHADOW_STATE_FILE_RE.test(name) && !SHADOW_EXPOSURE_RETENTION_FILE_RE.test(name)) continue;
       let file = path80.join(dir, name), marker;
       try {
-        if (fs60.statSync(file).size > MAX_STATE_MARKER_BYTES) continue;
-        marker = JSON.parse(fs60.readFileSync(file, "utf8"));
+        if (fs61.statSync(file).size > MAX_STATE_MARKER_BYTES) continue;
+        marker = JSON.parse(fs61.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
@@ -90255,19 +90404,19 @@ function inodeSurvivesInParent(root) {
   if (!root.ino) return;
   let parent = path80.dirname(root.path);
   try {
-    fs60.lstatSync(parent);
+    fs61.lstatSync(parent);
   } catch (err) {
     return err.code === "ENOENT" ? !1 : void 0;
   }
   let entries;
   try {
-    entries = fs60.readdirSync(parent);
+    entries = fs61.readdirSync(parent);
   } catch {
     return;
   }
   for (let name of entries)
     try {
-      if (fs60.lstatSync(path80.join(parent, name), { bigint: !0 }).ino.toString() === root.ino) return !0;
+      if (fs61.lstatSync(path80.join(parent, name), { bigint: !0 }).ino.toString() === root.ino) return !0;
     } catch {
       continue;
     }
@@ -90278,7 +90427,7 @@ function diagnose(stateRoot, roots) {
   return roots.map((root) => {
     let markers = markerIndex.get(root.path) ?? [], present = !1;
     try {
-      present = fs60.lstatSync(root.path).isDirectory();
+      present = fs61.lstatSync(root.path).isDirectory();
     } catch {
       present = !1;
     }
@@ -90436,29 +90585,29 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
   Nothing was written. Re-run with ${colors.bold}--yes${colors.reset} to apply${withheld.length ? " the entries listed first" : ""}.`), 0;
   let locks = path80.join(stateRoot, SHADOW_QUOTA_LOCK_DIR), held = [];
   try {
-    held = fs60.readdirSync(locks);
+    held = fs61.readdirSync(locks);
   } catch {
     held = [];
   }
   if (held.length)
     return console.error(`${colors.red}\u2717${colors.reset} A CodeVibe session is registering a root right now. Try again once it is idle.`), 1;
-  let file = path80.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), current = fs60.readFileSync(file, "utf8");
+  let file = path80.join(stateRoot, SHADOW_ROOT_REGISTRY_FILE), current = fs61.readFileSync(file, "utf8");
   if (crypto32.createHash("sha256").update(current).digest("hex") !== crypto32.createHash("sha256").update(registry.raw).digest("hex"))
     return console.error(`${colors.red}\u2717${colors.reset} The registry changed while this ran. Nothing was written; re-run.`), 1;
   let stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-"), backupDir = path80.join(path80.dirname(stateRoot), "shadow-root-backups", stamp), backup = path80.join(backupDir, "shadow-roots.json");
   try {
-    fs60.mkdirSync(backupDir, { recursive: !0, mode: 448 }), fs60.copyFileSync(file, backup);
+    fs61.mkdirSync(backupDir, { recursive: !0, mode: 448 }), fs61.copyFileSync(file, backup);
   } catch (err) {
     return console.error(`${colors.red}\u2717${colors.reset} Could not write the backup at ${backupDir} (${err.code ?? "unknown error"}). Nothing was changed \u2014 this command will not clear an entry it cannot restore.`), 1;
   }
   let removed = new Set(clearable.map((d) => d.root.path)), kept = registry.roots.filter((r) => !removed.has(r.path)), tmp = path80.join(backupDir, `.registry.next.${process.pid}`);
   try {
-    fs60.writeFileSync(tmp, JSON.stringify({ version: 2, roots: kept }), { mode: 384 }), fs60.renameSync(tmp, file);
+    fs61.writeFileSync(tmp, JSON.stringify({ version: 2, roots: kept }), { mode: 384 }), fs61.renameSync(tmp, file);
   } catch (err) {
     return console.error(`${colors.red}\u2717${colors.reset} Could not replace the registry (${err.code ?? "unknown error"}). Nothing was changed; a copy of it is at ${backup}.`), 1;
   } finally {
     try {
-      fs60.unlinkSync(tmp);
+      fs61.unlinkSync(tmp);
     } catch {
     }
   }
@@ -90467,7 +90616,7 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
     for (let marker of d.markers) {
       let copy = path80.join(backupDir, `marker-${savedMarkers.length}-${path80.basename(marker)}`);
       try {
-        fs60.copyFileSync(marker, copy), savedMarkers.push({ copy: path80.basename(copy), original: marker });
+        fs61.copyFileSync(marker, copy), savedMarkers.push({ copy: path80.basename(copy), original: marker });
       } catch (err) {
         if (err.code !== "ENOENT") {
           unbackedMarkers.push(marker);
@@ -90475,16 +90624,16 @@ ${colors.red}\u2717${colors.reset} ${withheld.length} entr${withheld.length ===
         }
       }
       try {
-        fs60.unlinkSync(marker);
+        fs61.unlinkSync(marker);
       } catch {
       }
       try {
-        fs60.rmdirSync(path80.dirname(marker));
+        fs61.rmdirSync(path80.dirname(marker));
       } catch {
       }
     }
   try {
-    fs60.writeFileSync(path80.join(backupDir, "manifest.json"), `${JSON.stringify({
+    fs61.writeFileSync(path80.join(backupDir, "manifest.json"), `${JSON.stringify({
       clearedAtUtc: (/* @__PURE__ */ new Date()).toISOString(),
       registry: file,
       registryBackup: path80.basename(backup),
@@ -90504,7 +90653,7 @@ ${colors.green}\u2713${colors.reset} Cleared ${clearable.length} entr${clearable
 }
 
 // src/substrate-launch/engage-substrate.ts
-var import_node_fs38 = require("node:fs"), os49 = __toESM(require("node:os")), path81 = __toESM(require("node:path"));
+var import_node_fs38 = require("node:fs"), os49 = __toESM(require("node:os")), path81 = __toESM(require("node:path")), crypto33 = __toESM(require("node:crypto"));
 
 // src/credential-broker/types.ts
 var BROKER_ROUTES = [
@@ -92795,8 +92944,7 @@ async function engageSubstrate(input) {
   }
 }
 var RESOLVER_AGENT_STATE_DIR_SEGMENTS = {
-  GEMINI: [".gemini"],
-  ANTIGRAVITY: [".gemini"]
+  GEMINI: [".gemini"]
 };
 async function engageWriteConfinedResolverSandbox(input) {
   let agentKind = input.agentKind;
@@ -92821,36 +92969,94 @@ async function engageWriteConfinedResolverSandbox(input) {
       teardown: async () => {
       }
     };
-  let homedir41 = os49.homedir(), stateDir = path81.join(
-    homedir41,
-    ...RESOLVER_AGENT_STATE_DIR_SEGMENTS[agentKind]
-  );
-  await import_node_fs38.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
-  });
-  let env = {}, nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
-  env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`, env.HOME = homedir41;
-  let safeSource = input.localeSource ?? {};
-  for (let key of SAFE_ENV_ALLOWLIST) {
-    let v = safeSource[key];
-    typeof v == "string" && v.length > 0 && (env[key] = v);
+  let homedir41 = input.homedir ?? os49.homedir(), stateDir, privateHomeDir = null, spawnParentDir = null, spawnParentDirCreated = !1, env = {}, handle, finalEnv;
+  if (agentKind === "ANTIGRAVITY") {
+    let spawnId = input.spawnId ?? crypto33.randomUUID().slice(0, 8), taskSegment = input.taskId || "advisory";
+    if (process.platform === "darwin")
+      input.taskId ? (spawnParentDir = path81.join(homedir41, "Library", "Caches", "CodeVibe", "shadows", taskSegment, "agy-home", spawnId), privateHomeDir = spawnParentDir) : (spawnParentDir = path81.join(homedir41, "Library", "Caches", "CodeVibe", "shadows", `advisory-${spawnId}`), privateHomeDir = path81.join(spawnParentDir, "agy-home"));
+    else {
+      let cacheBase = process.env.XDG_CACHE_HOME || path81.join(homedir41, ".cache");
+      input.taskId ? (spawnParentDir = path81.join(cacheBase, "codevibe", "shadows", taskSegment, "spawn", spawnId), privateHomeDir = path81.join(spawnParentDir, "home")) : (spawnParentDir = path81.join(cacheBase, "codevibe", "shadows", `advisory-${spawnId}`), privateHomeDir = path81.join(spawnParentDir, "home"));
+    }
+    stateDir = privateHomeDir, await import_node_fs38.promises.mkdir(path81.dirname(spawnParentDir), { recursive: !0 }), await import_node_fs38.promises.mkdir(spawnParentDir), spawnParentDirCreated = !0;
+    try {
+      let agyCliDir = path81.join(privateHomeDir, ".gemini", "antigravity-cli");
+      await import_node_fs38.promises.mkdir(agyCliDir, { recursive: !0 });
+      let hostAgyDir = path81.join(homedir41, ".gemini", "antigravity-cli"), tokenFile = path81.join(hostAgyDir, "antigravity-oauth-token"), idFile = path81.join(hostAgyDir, "installation_id");
+      try {
+        await import_node_fs38.promises.copyFile(tokenFile, path81.join(agyCliDir, "antigravity-oauth-token")), await import_node_fs38.promises.chmod(path81.join(agyCliDir, "antigravity-oauth-token"), 384);
+      } catch {
+      }
+      try {
+        await import_node_fs38.promises.copyFile(idFile, path81.join(agyCliDir, "installation_id")), await import_node_fs38.promises.chmod(path81.join(agyCliDir, "installation_id"), 384);
+      } catch {
+      }
+      env.HOME = privateHomeDir;
+      let nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
+      env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`;
+      let safeSource = input.localeSource ?? {};
+      for (let key of SAFE_ENV_ALLOWLIST) {
+        let v = safeSource[key];
+        typeof v == "string" && v.length > 0 && (env[key] = v);
+      }
+      assertNoAmbientCreds(env), finalEnv = buildSubstrateImplementorEnv(input.role, env, input.processTreeId);
+      let spec = {
+        isolationTech: "sandbox_exec",
+        workdir: input.workdir,
+        ...input.workdirAuthority ? { workdirAuthority: input.workdirAuthority } : {},
+        hostBrokerAddr: "",
+        sandboxBrokerUrl: "",
+        taskId: input.taskId,
+        sanitizedEnv: finalEnv,
+        agentConfig: { hostDir: stateDir, sandboxDir: stateDir },
+        networkPosture: "open",
+        writableWorkdir: input.writableWorkdir !== !1
+      };
+      handle = await selection.substrate.launch(spec);
+    } catch (launchErr) {
+      let rollbackErrors = [];
+      if (spawnParentDirCreated && spawnParentDir !== null)
+        try {
+          await import_node_fs38.promises.rm(spawnParentDir, { recursive: !0, force: !0 });
+        } catch (rmErr) {
+          rollbackErrors.push(rmErr);
+        }
+      if (rollbackErrors.length > 0) {
+        let combinedError = new Error(
+          `engageSubstrate initialization or launch failed and rollback failed: ${launchErr instanceof Error ? launchErr.message : String(launchErr)} (rollback: ${rollbackErrors.map((e) => e instanceof Error ? e.message : String(e)).join("; ")})`
+        );
+        throw combinedError.cause = launchErr, combinedError;
+      }
+      throw launchErr;
+    }
+  } else {
+    stateDir = path81.join(
+      homedir41,
+      ...RESOLVER_AGENT_STATE_DIR_SEGMENTS[agentKind]
+    ), await import_node_fs38.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
+    }), env.HOME = homedir41;
+    let nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
+    env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`;
+    let safeSource = input.localeSource ?? {};
+    for (let key of SAFE_ENV_ALLOWLIST) {
+      let v = safeSource[key];
+      typeof v == "string" && v.length > 0 && (env[key] = v);
+    }
+    assertNoAmbientCreds(env), finalEnv = buildSubstrateImplementorEnv(input.role, env, input.processTreeId);
+    let spec = {
+      isolationTech: "sandbox_exec",
+      workdir: input.workdir,
+      ...input.workdirAuthority ? { workdirAuthority: input.workdirAuthority } : {},
+      hostBrokerAddr: "",
+      sandboxBrokerUrl: "",
+      taskId: input.taskId,
+      sanitizedEnv: finalEnv,
+      agentConfig: { hostDir: stateDir, sandboxDir: stateDir },
+      networkPosture: "open",
+      writableWorkdir: input.writableWorkdir !== !1
+    };
+    handle = await selection.substrate.launch(spec);
   }
-  assertNoAmbientCreds(env);
-  let finalEnv = buildSubstrateImplementorEnv(input.role, env, input.processTreeId), spec = {
-    isolationTech: "sandbox_exec",
-    workdir: input.workdir,
-    ...input.workdirAuthority ? { workdirAuthority: input.workdirAuthority } : {},
-    // No broker on this row — the addr/url fields are informational for A5
-    // (the profile, not these strings, governs egress) and deliberately empty.
-    hostBrokerAddr: "",
-    sandboxBrokerUrl: "",
-    taskId: input.taskId,
-    sanitizedEnv: finalEnv,
-    // The agent's own auth/state home — writable, read-granted (A5: sandbox fs
-    // == host fs, so sandboxDir == hostDir).
-    agentConfig: { hostDir: stateDir, sandboxDir: stateDir },
-    networkPosture: "open",
-    writableWorkdir: input.writableWorkdir !== !1
-  }, handle = await selection.substrate.launch(spec);
   return logger.info(
     `[A1d] Resolver-confinement row engaged (tier=sandbox_exec, egress=open) \u2014 writes fenced to the disposable workspace; ${agentKind} runs on its own file-based auth (no broker)`,
     { taskId: input.taskId, agent: agentKind }
@@ -92868,8 +93074,18 @@ async function engageWriteConfinedResolverSandbox(input) {
     refreshBrokerToken: async () => {
     },
     teardown: async () => {
-      await handle.teardown().catch(() => {
-      });
+      try {
+        await handle.teardown();
+      } catch (err) {
+        throw logger.warn(
+          "[engageSubstrate] resolver sandbox handle teardown failed, retaining state for recovery",
+          {
+            err,
+            spawnParentDir
+          }
+        ), err;
+      }
+      spawnParentDirCreated && spawnParentDir !== null && await import_node_fs38.promises.rm(spawnParentDir, { recursive: !0, force: !0 });
     }
   };
 }
@@ -94760,7 +94976,7 @@ Note: --export will overwrite any existing file at <path>.
     offset: parsed.offset
   });
   if (result.kind === "ok" && parsed.exportPath) {
-    let writeFile4 = deps?.writeFileFn ?? ((p, c) => fs66.writeFileSync(p, c, "utf8"));
+    let writeFile4 = deps?.writeFileFn ?? ((p, c) => fs67.writeFileSync(p, c, "utf8"));
     try {
       let formatted = formatAuditExport(
         result.model,