@runweave/server-linux-x64 0.1.3 → 0.1.5

package/payload/app-server/index.cjs

@@ -1,4 +1,4 @@
-/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261101T045602018Z-f866322b","sourceRevision":"f866322b32d9c3896ed3c60bc387f1184a104614","sourceDirty":false,"builtAt":"2026-11-01T04:56:02.018Z","contentSha256":"a601618f713f08277371b4f143be99ed25c2380cff89952b97460e1862f1d399"};
+/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261108T004031551Z-168d13f1","sourceRevision":"168d13f138a29af9055863e4ccec018125af5644","sourceDirty":false,"builtAt":"2026-11-08T00:40:31.551Z","contentSha256":"9d35815d7ecbf345ce1ff15eaae37eb2b88f6df5289e67f3991b156aac3e2c62"};
 const __IMPORT_META_URL__ = require('url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
@@ -25745,13 +25745,13 @@ var require_view = __commonJS({
     View.prototype.resolve = function resolve2(dir, file) {
       var ext = this.ext;
       var path22 = join(dir, file);
-      var stat2 = tryStat(path22);
-      if (stat2 && stat2.isFile()) {
+      var stat3 = tryStat(path22);
+      if (stat3 && stat3.isFile()) {
         return path22;
       }
       path22 = join(dir, basename(file, ext), "index" + ext);
-      stat2 = tryStat(path22);
-      if (stat2 && stat2.isFile()) {
+      stat3 = tryStat(path22);
+      if (stat3 && stat3.isFile()) {
         return path22;
       }
     };
@@ -26021,9 +26021,9 @@ var require_etag = __commonJS({
       }
       return obj && typeof obj === "object" && "ctime" in obj && toString.call(obj.ctime) === "[object Date]" && "mtime" in obj && toString.call(obj.mtime) === "[object Date]" && "ino" in obj && typeof obj.ino === "number" && "size" in obj && typeof obj.size === "number";
     }
-    function stattag(stat2) {
-      var mtime = stat2.mtime.getTime().toString(16);
-      var size = stat2.size.toString(16);
+    function stattag(stat3) {
+      var mtime = stat3.mtime.getTime().toString(16);
+      var size = stat3.size.toString(16);
       return '"' + size + "-" + mtime + '"';
     }
   }
@@ -26636,8 +26636,8 @@ var require_send = __commonJS({
       this.sendFile(path22);
       return res;
     };
-    SendStream.prototype.send = function send3(path22, stat2) {
-      var len = stat2.size;
+    SendStream.prototype.send = function send3(path22, stat3) {
+      var len = stat3.size;
       var options = this.options;
       var opts = {};
       var res = this.res;
@@ -26649,7 +26649,7 @@ var require_send = __commonJS({
         return;
       }
       debug('pipe "%s"', path22);
-      this.setHeader(path22, stat2);
+      this.setHeader(path22, stat3);
       this.type(path22);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
@@ -26705,14 +26705,14 @@ var require_send = __commonJS({
       var i = 0;
       var self = this;
       debug('stat "%s"', path22);
-      fs.stat(path22, function onstat(err, stat2) {
+      fs.stat(path22, function onstat(err, stat3) {
         if (err && err.code === "ENOENT" && !extname(path22) && path22[path22.length - 1] !== sep) {
           return next(err);
         }
         if (err) return self.onStatError(err);
-        if (stat2.isDirectory()) return self.redirect(path22);
-        self.emit("file", path22, stat2);
-        self.send(path22, stat2);
+        if (stat3.isDirectory()) return self.redirect(path22);
+        self.emit("file", path22, stat3);
+        self.send(path22, stat3);
       });
       function next(err) {
         if (self._extensions.length <= i) {
@@ -26720,11 +26720,11 @@ var require_send = __commonJS({
         }
         var p = path22 + "." + self._extensions[i++];
         debug('stat "%s"', p);
-        fs.stat(p, function(err2, stat2) {
+        fs.stat(p, function(err2, stat3) {
           if (err2) return next(err2);
-          if (stat2.isDirectory()) return next();
-          self.emit("file", p, stat2);
-          self.send(p, stat2);
+          if (stat3.isDirectory()) return next();
+          self.emit("file", p, stat3);
+          self.send(p, stat3);
         });
       }
     };
@@ -26738,11 +26738,11 @@ var require_send = __commonJS({
         }
         var p = join(path22, self._index[i]);
         debug('stat "%s"', p);
-        fs.stat(p, function(err2, stat2) {
+        fs.stat(p, function(err2, stat3) {
           if (err2) return next(err2);
-          if (stat2.isDirectory()) return next();
-          self.emit("file", p, stat2);
-          self.send(p, stat2);
+          if (stat3.isDirectory()) return next();
+          self.emit("file", p, stat3);
+          self.send(p, stat3);
         });
       }
       next();
@@ -26777,9 +26777,9 @@ var require_send = __commonJS({
       debug("content-type %s", type2);
       res.setHeader("Content-Type", type2 + (charset ? "; charset=" + charset : ""));
     };
-    SendStream.prototype.setHeader = function setHeader(path22, stat2) {
+    SendStream.prototype.setHeader = function setHeader(path22, stat3) {
       var res = this.res;
-      this.emit("headers", res, path22, stat2);
+      this.emit("headers", res, path22, stat3);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -26793,12 +26793,12 @@ var require_send = __commonJS({
         res.setHeader("Cache-Control", cacheControl);
       }
       if (this._lastModified && !res.getHeader("Last-Modified")) {
-        var modified = stat2.mtime.toUTCString();
+        var modified = stat3.mtime.toUTCString();
         debug("modified %s", modified);
         res.setHeader("Last-Modified", modified);
       }
       if (this._etag && !res.getHeader("ETag")) {
-        var val = etag(stat2);
+        var val = etag(stat3);
         debug("etag %s", val);
         res.setHeader("ETag", val);
       }
@@ -33560,16 +33560,16 @@ async function scanConversationSource(file, consume, signal) {
   try {
     if (await (0, import_promises.realpath)(file) !== file) return null;
     handle = await (0, import_promises.open)(file, import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_NOFOLLOW);
-    const stat2 = await handle.stat();
-    if (!stat2.isFile()) return null;
+    const stat3 = await handle.stat();
+    if (!stat3.isFile()) return null;
     const windowBytes = 64 * 1024 * 1024;
-    const truncated = stat2.size > windowBytes;
+    const truncated = stat3.size > windowBytes;
     let partial = truncated;
     const chunk = Buffer.alloc(256 * 1024);
     const ranges = truncated ? [
-      { start: 0, end: Math.min(chunk.length, stat2.size), header: true },
-      { start: stat2.size - windowBytes, end: stat2.size, header: false }
-    ] : [{ start: 0, end: stat2.size, header: false }];
+      { start: 0, end: Math.min(chunk.length, stat3.size), header: true },
+      { start: stat3.size - windowBytes, end: stat3.size, header: false }
+    ] : [{ start: 0, end: stat3.size, header: false }];
     for (const range of ranges) {
       let position = range.start;
       let lineOffset = position;
@@ -34557,21 +34557,57 @@ var ConfigurationError = class extends Error {
 
 // packages/config-node/src/private-file.ts
 var import_node_fs4 = require("node:fs");
+
+// packages/config-node/src/windows-permissions.ts
+var import_node_child_process = require("node:child_process");
+function assertWindowsPrivatePath(file) {
+  if (process.platform !== "win32") return;
+  const script = `
+$ErrorActionPreference = 'Stop'
+# Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
+$acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
+  [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
+} else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+}
+`;
+  try {
+    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
+      stdio: "ignore",
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch {
+    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+  }
+}
+
+// packages/config-node/src/private-file.ts
 function assertPrivateDirectory(directory) {
-  const stat2 = (0, import_node_fs4.lstatSync)(directory);
-  if (!stat2.isDirectory() || stat2.isSymbolicLink() || stat2.mode & 63 || typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  const stat3 = (0, import_node_fs4.lstatSync)(directory);
+  if (!stat3.isDirectory() || stat3.isSymbolicLink() || process.platform !== "win32" && stat3.mode & 63 || typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(directory);
 }
-function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024) {
-  const stat2 = (0, import_node_fs4.fstatSync)(fd);
-  if (!stat2.isFile() || stat2.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
-  if (typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if (stat2.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
-  if (stat2.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
+function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024, file) {
+  const stat3 = (0, import_node_fs4.fstatSync)(fd);
+  if (!stat3.isFile() || stat3.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
+  if (typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
+  if (process.platform !== "win32" && stat3.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform === "win32") {
+    if (!file) throw new ConfigurationError("CONFIG_PRIVATE_PATH_REQUIRED");
+    assertWindowsPrivatePath(file);
+  }
+  if (stat3.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
 }
 function readPrivateFile(file, maxBytes = 1024 * 1024) {
   const fd = (0, import_node_fs4.openSync)(file, import_node_fs4.constants.O_RDONLY | import_node_fs4.constants.O_NOFOLLOW);
   try {
-    assertPrivateDescriptor(fd, maxBytes);
+    assertPrivateDescriptor(fd, maxBytes, file);
     const source = (0, import_node_fs4.readFileSync)(fd, "utf8");
     if (Buffer.byteLength(source) > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
     return source;
@@ -34646,15 +34682,27 @@ function assertOwnedPath(context, value) {
   }
 }
 
-// packages/config-node/src/owner.ts
+// packages/config-node/src/platform.ts
 var import_node_fs6 = require("node:fs");
+function syncDirectory(directory) {
+  if (process.platform === "win32") return;
+  const fd = (0, import_node_fs6.openSync)(directory, "r");
+  try {
+    (0, import_node_fs6.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs6.closeSync)(fd);
+  }
+}
+
+// packages/config-node/src/owner.ts
+var import_node_fs7 = require("node:fs");
 var import_node_path4 = __toESM(require("node:path"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_crypto3 = require("node:crypto");
 var import_fs_native_extensions = require("fs-native-extensions");
 function ownerDirectory(context) {
   const directory = context.kind === "stable" ? import_node_path4.default.join(import_node_os2.default.userInfo().homedir, ".runweave", "runtime") : import_node_path4.default.join(context.configRoot, "runtime");
-  (0, import_node_fs6.mkdirSync)(directory, { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)(directory, { recursive: true, mode: 448 });
   assertPrivateDirectory(import_node_path4.default.dirname(directory));
   assertPrivateDirectory(directory);
   return directory;
@@ -34663,11 +34711,11 @@ function registerStableConfigurationRoot(context) {
   if (context.kind !== "stable") return;
   const directory = ownerDirectory(context);
   const registry = import_node_path4.default.join(directory, "stable-root.json");
-  const registryFd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, "stable-root.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const registryFd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, "stable-root.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(registryFd);
+    assertPrivateDescriptor(registryFd, void 0, import_node_path4.default.join(directory, "stable-root.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(registryFd)) throw new ConfigurationError("CONFIG_ROOT_REGISTRATION_BUSY");
-    if ((0, import_node_fs6.existsSync)(registry)) {
+    if ((0, import_node_fs7.existsSync)(registry)) {
       let stored;
       try {
         stored = JSON.parse(readPrivateFile(registry));
@@ -34677,34 +34725,29 @@ function registerStableConfigurationRoot(context) {
       if (!stored || typeof stored !== "object" || !("root" in stored) || stored.root !== canonicalPath(context.configRoot)) throw new ConfigurationError("CONFIG_STABLE_ROOT_CONFLICT");
     } else {
       const temporary = `${registry}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-      const file = (0, import_node_fs6.openSync)(temporary, "wx", 384);
+      const file = (0, import_node_fs7.openSync)(temporary, "wx", 384);
       try {
-        (0, import_node_fs6.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
-        (0, import_node_fs6.fsyncSync)(file);
+        (0, import_node_fs7.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
+        (0, import_node_fs7.fsyncSync)(file);
       } finally {
-        (0, import_node_fs6.closeSync)(file);
-      }
-      (0, import_node_fs6.renameSync)(temporary, registry);
-      const parent = (0, import_node_fs6.openSync)(directory, "r");
-      try {
-        (0, import_node_fs6.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs6.closeSync)(parent);
+        (0, import_node_fs7.closeSync)(file);
       }
+      (0, import_node_fs7.renameSync)(temporary, registry);
+      syncDirectory(directory);
     }
   } finally {
-    (0, import_node_fs6.closeSync)(registryFd);
+    (0, import_node_fs7.closeSync)(registryFd);
   }
 }
 function withUpgradeGate(context, shared, run) {
   const directory = ownerDirectory(context);
-  const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, "configuration-upgrade.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, "configuration-upgrade.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, "configuration-upgrade.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(fd, 0, 0, { shared })) throw new ConfigurationError("CONFIG_UPGRADE_BUSY");
     return run();
   } finally {
-    (0, import_node_fs6.closeSync)(fd);
+    (0, import_node_fs7.closeSync)(fd);
   }
 }
 function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
@@ -34712,16 +34755,16 @@ function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
     const directory = ownerDirectory(context);
     const held = [];
     try {
-      for (const file of (0, import_node_fs6.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
+      for (const file of (0, import_node_fs7.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
         if (ignoredRoles.includes(file.replace(/\.owner\.lock$/, ""))) continue;
-        const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, file), import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW);
+        const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, file), import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW);
         held.push(fd);
-        assertPrivateDescriptor(fd);
+        assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, file));
         if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_UPGRADE_CONSUMER_RUNNING", [file.replace(/\.owner\.lock$/, "")]);
       }
       return run();
     } finally {
-      for (const fd of held) (0, import_node_fs6.closeSync)(fd);
+      for (const fd of held) (0, import_node_fs7.closeSync)(fd);
     }
   });
 }
@@ -34730,16 +34773,16 @@ function acquireConfigurationOwner(context, role) {
 }
 function acquireOwner(context, role) {
   const directory = ownerDirectory(context);
-  const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, `${role}.owner.lock`), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, `${role}.owner.lock`), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   let closed = false;
   const release = () => {
     if (!closed) {
       closed = true;
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
   };
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, `${role}.owner.lock`));
     if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_INSTANCE_ALREADY_RUNNING", [role]);
     registerStableConfigurationRoot(context);
     return { release };
@@ -35062,7 +35105,7 @@ function migrateConfigurationDocument(document2) {
 }
 
 // packages/config-node/src/store.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_path6 = __toESM(require("node:path"), 1);
 var import_node_crypto4 = require("node:crypto");
 var import_yaml = __toESM(require_dist(), 1);
@@ -35086,6 +35129,8 @@ function isConfigurationContainer(key, array = false) {
   });
 }
 function domainForPath(key) {
+  const declared = Object.keys(CONFIGURATION_DOMAIN_VERSIONS).find((domain) => key === domain || key.startsWith(`${domain}.`));
+  if (declared) return declared;
   const parts = key.split(".");
   return ["backend", "services", "desktop", "agents"].includes(parts[0]) ? parts.slice(0, 2).join(".") : parts[0];
 }
@@ -35254,11 +35299,12 @@ function parseConfigurationYaml(source, context) {
   return { document: document2, value, digest: (0, import_node_crypto4.createHash)("sha256").update(source).digest("hex"), issues: validateDomains(value, context) };
 }
 function assertPrivateFile(file, fd) {
-  const stat2 = fd === void 0 ? (0, import_node_fs7.lstatSync)(file) : (0, import_node_fs7.fstatSync)(fd);
-  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
-  if (typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if ((stat2.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
-  if (stat2.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
+  const stat3 = fd === void 0 ? (0, import_node_fs8.lstatSync)(file) : (0, import_node_fs8.fstatSync)(fd);
+  if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
+  if (typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
+  if (process.platform !== "win32" && (stat3.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(file);
+  if (stat3.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
 }
 var ConfigurationStore = class {
   constructor(context) {
@@ -35267,30 +35313,29 @@ var ConfigurationStore = class {
   }
   file;
   read() {
-    if (!(0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
-    const root = (0, import_node_fs7.lstatSync)(this.context.configRoot);
-    if (!root.isDirectory() || root.isSymbolicLink() || root.mode & 63 || typeof process.getuid === "function" && root.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+    if (!(0, import_node_fs8.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
+    assertPrivateDirectory(this.context.configRoot);
     assertPrivateFile(this.file);
-    const fd = (0, import_node_fs7.openSync)(this.file, import_node_fs7.constants.O_RDONLY | import_node_fs7.constants.O_NOFOLLOW);
+    const fd = (0, import_node_fs8.openSync)(this.file, import_node_fs8.constants.O_RDONLY | import_node_fs8.constants.O_NOFOLLOW);
     try {
       assertPrivateFile(this.file, fd);
-      return parseConfigurationYaml((0, import_node_fs7.readFileSync)(fd, "utf8"), this.context);
+      return parseConfigurationYaml((0, import_node_fs8.readFileSync)(fd, "utf8"), this.context);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
   }
   locked(run) {
-    (0, import_node_fs7.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
-    const dirStat = (0, import_node_fs7.lstatSync)(this.context.configRoot);
+    (0, import_node_fs8.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
+    const dirStat = (0, import_node_fs8.lstatSync)(this.context.configRoot);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || typeof process.getuid === "function" && dirStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_OWNER_MISMATCH");
-    if ((dirStat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
-    const fd = (0, import_node_fs7.openSync)(import_node_path6.default.join(this.context.configRoot, "settings.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
+    assertPrivateDirectory(this.context.configRoot);
+    const fd = (0, import_node_fs8.openSync)(import_node_path6.default.join(this.context.configRoot, "settings.lock"), import_node_fs8.constants.O_CREAT | import_node_fs8.constants.O_RDWR | import_node_fs8.constants.O_NOFOLLOW, 384);
     try {
       assertPrivateFile(import_node_path6.default.join(this.context.configRoot, "settings.lock"), fd);
       if (!(0, import_fs_native_extensions2.tryLock)(fd)) throw new ConfigurationError("CONFIG_WRITE_BUSY");
       return run();
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
   }
   publish(document2, previous, backupId) {
@@ -35300,41 +35345,35 @@ var ConfigurationStore = class {
     const temporary = `${this.file}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
     if (previous !== void 0) {
       const backupRoot = import_node_path6.default.join(this.context.configRoot, "config-backups");
-      (0, import_node_fs7.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
-      const backupStat = (0, import_node_fs7.lstatSync)(backupRoot);
-      if (!backupStat.isDirectory() || backupStat.isSymbolicLink() || backupStat.mode & 63 || typeof process.getuid === "function" && backupStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_BACKUP_ROOT_INVALID");
+      (0, import_node_fs8.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
+      assertPrivateDirectory(backupRoot);
       const backup = import_node_path6.default.join(backupRoot, backupId ?? `${Date.now()}-${(0, import_node_crypto4.randomUUID)()}.yaml`);
-      const fd2 = (0, import_node_fs7.openSync)(backup, "wx", 384);
+      const fd2 = (0, import_node_fs8.openSync)(backup, "wx", 384);
       try {
-        (0, import_node_fs7.writeFileSync)(fd2, previous);
-        (0, import_node_fs7.fsyncSync)(fd2);
+        (0, import_node_fs8.writeFileSync)(fd2, previous);
+        (0, import_node_fs8.fsyncSync)(fd2);
       } finally {
-        (0, import_node_fs7.closeSync)(fd2);
+        (0, import_node_fs8.closeSync)(fd2);
       }
     }
-    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs8.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs7.writeFileSync)(fd, source);
-      (0, import_node_fs7.fsyncSync)(fd);
+      (0, import_node_fs8.writeFileSync)(fd, source);
+      (0, import_node_fs8.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
     try {
-      (0, import_node_fs7.renameSync)(temporary, this.file);
-      const parent = (0, import_node_fs7.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs7.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs7.closeSync)(parent);
-      }
+      (0, import_node_fs8.renameSync)(temporary, this.file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
+      if ((0, import_node_fs8.existsSync)(temporary)) (0, import_node_fs8.unlinkSync)(temporary);
     }
     return checked;
   }
   initialize(value) {
     return this.locked(() => {
-      if ((0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+      if ((0, import_node_fs8.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
       if (Object.keys(issues).length) throw new ConfigurationError("CONFIG_VALIDATION_FAILED", Object.values(issues).flat().map((item) => item.path));
@@ -35374,9 +35413,9 @@ var ConfigurationStore = class {
   }
   backups() {
     const root = import_node_path6.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs7.existsSync)(root)) return [];
+    if (!(0, import_node_fs8.existsSync)(root)) return [];
     assertPrivateDirectory(root);
-    return (0, import_node_fs7.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
+    return (0, import_node_fs8.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
       try {
         const backup = this.readBackup(id);
         return { id, revision: backup.value.revision, schemaVersion: backup.value.schemaVersion, compatible: true };
@@ -35454,23 +35493,18 @@ var ConfigurationStore = class {
   recordUpgrade(value) {
     const file = import_node_path6.default.join(this.context.configRoot, "config-upgrade.json");
     const temporary = `${file}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
-    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs8.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs7.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
-      (0, import_node_fs7.fsyncSync)(fd);
+      (0, import_node_fs8.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
+      (0, import_node_fs8.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
     try {
-      (0, import_node_fs7.renameSync)(temporary, file);
-      const parent = (0, import_node_fs7.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs7.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs7.closeSync)(parent);
-      }
+      (0, import_node_fs8.renameSync)(temporary, file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
+      if ((0, import_node_fs8.existsSync)(temporary)) (0, import_node_fs8.unlinkSync)(temporary);
     }
   }
   upgrade(expected) {
@@ -35479,7 +35513,7 @@ var ConfigurationStore = class {
       if (preview.expectedRevision !== expected.revision || preview.expectedDigest !== expected.digest) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       if (!preview.changed) {
         const receiptFile = import_node_path6.default.join(this.context.configRoot, "config-upgrade.json");
-        if ((0, import_node_fs7.existsSync)(receiptFile)) {
+        if ((0, import_node_fs8.existsSync)(receiptFile)) {
           const receipt = JSON.parse(readPrivateFile(receiptFile));
           if (isConfigurationObject(receipt) && receipt.phase === "prepared" && receipt.plannedDigest === expected.digest)
             this.recordUpgrade({ ...receipt, phase: "committed", savedRevision: expected.revision, digest: expected.digest });
@@ -35513,9 +35547,9 @@ var ConfigurationStore = class {
   previous(keys) {
     const current = this.read();
     const root = import_node_path6.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs7.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
+    if (!(0, import_node_fs8.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
     assertPrivateDirectory(root);
-    const candidates = (0, import_node_fs7.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
+    const candidates = (0, import_node_fs8.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
     for (const candidate of candidates) {
       const file = import_node_path6.default.join(root, candidate);
       const previous = parseConfigurationYaml(readPrivateFile(file), this.context);
@@ -35527,7 +35561,7 @@ var ConfigurationStore = class {
   }
   migrate(value, expected) {
     return this.locked(() => {
-      const current = (0, import_node_fs7.existsSync)(this.file) ? this.read() : null;
+      const current = (0, import_node_fs8.existsSync)(this.file) ? this.read() : null;
       if (current ? !expected || current.value.revision !== expected.revision || current.digest !== expected.digest : expected !== null) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
@@ -35741,7 +35775,7 @@ function configurationPath(key, relativeDefault) {
 }
 
 // packages/config-node/src/runtime-status.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 
 // packages/shared/src/monitoring/runtime-version.ts
@@ -35794,23 +35828,23 @@ function readInstalledRuntimeBuild(entry) {
       const root = entry.slice(0, index);
       const relative = entry.slice(index + marker.length).split(import_node_path8.default.sep).slice(1);
       const pointer = import_node_path8.default.join(root, "current.json");
-      if ((0, import_node_fs8.existsSync)(pointer)) {
-        const selected = JSON.parse((0, import_node_fs8.readFileSync)(pointer, "utf8"));
+      if ((0, import_node_fs9.existsSync)(pointer)) {
+        const selected = JSON.parse((0, import_node_fs9.readFileSync)(pointer, "utf8"));
         if (!/^[a-zA-Z0-9._-]+$/.test(selected.releaseId) || [".", ".."].includes(selected.releaseId)) return null;
         entry = import_node_path8.default.join(root, "releases", selected.releaseId, ...relative);
       }
     }
-    fd = (0, import_node_fs8.openSync)(entry, "r");
+    fd = (0, import_node_fs9.openSync)(entry, "r");
     const buffer = Buffer.alloc(8192);
-    const length = (0, import_node_fs8.readSync)(fd, buffer, 0, buffer.length, 0);
+    const length = (0, import_node_fs9.readSync)(fd, buffer, 0, buffer.length, 0);
     const match = buffer.subarray(0, length).toString("utf8").split("\n", 1)[0]?.match(/var __RUNWEAVE_BUILD_INFO__=(\{.*\});/);
     const metadata = import_node_path8.default.join(import_node_path8.default.dirname(entry), "release.json");
-    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_fs8.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
+    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_fs9.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
     return typeof value.version === "string" && typeof value.buildId === "string" ? value : null;
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) (0, import_node_fs8.closeSync)(fd);
+    if (fd !== void 0) (0, import_node_fs9.closeSync)(fd);
   }
 }
 
@@ -35910,8 +35944,8 @@ var PiSessionReader = class {
     try {
       if (await (0, import_promises4.realpath)(file) !== file) return null;
       handle = await (0, import_promises4.open)(file, "r");
-      const stat2 = await handle.stat();
-      if (!stat2.isFile() || stat2.size > 64 * 1024 * 1024) return null;
+      const stat3 = await handle.stat();
+      if (!stat3.isFile() || stat3.size > 64 * 1024 * 1024) return null;
       const content = await handle.readFile("utf8");
       const lines = content.split("\n");
       lines.pop();
@@ -36041,7 +36075,7 @@ ${entry.summary}`
           preview,
           status: status === "running" ? "active" : status === "idle" ? "idle" : "notLoaded",
           createdAt: String(header.timestamp ?? ""),
-          updatedAt: new Date(stat2.mtimeMs).toISOString(),
+          updatedAt: new Date(stat3.mtimeMs).toISOString(),
           turns
         },
         latest
@@ -36408,15 +36442,15 @@ var ThreadPreviewReader = class {
     }
     const handle = await (0, import_promises6.open)(file, "r");
     try {
-      const stat2 = await handle.stat();
-      if (!stat2.isFile()) {
+      const stat3 = await handle.stat();
+      if (!stat3.isFile()) {
         entry.ready = false;
         entry.availability = "source_missing";
         return;
       }
-      if (entry.file !== file || entry.inode !== stat2.ino || stat2.size < entry.offset) {
+      if (entry.file !== file || entry.inode !== stat3.ino || stat3.size < entry.offset) {
         entry.file = file;
-        entry.inode = stat2.ino;
+        entry.inode = stat3.ino;
         entry.offset = 0;
         entry.pending = Buffer.alloc(0);
         entry.skippingLine = false;
@@ -36428,11 +36462,11 @@ var ThreadPreviewReader = class {
         entry.leaf = null;
         entry.piCursor = null;
       }
-      const buffer = Buffer.alloc(Math.min(READ_BYTES, stat2.size - entry.offset));
+      const buffer = Buffer.alloc(Math.min(READ_BYTES, stat3.size - entry.offset));
       const { bytesRead } = await handle.read(buffer, 0, buffer.length, entry.offset);
       entry.offset += bytesRead;
       this.consume(entry, buffer.subarray(0, bytesRead));
-      if (entry.offset < stat2.size) {
+      if (entry.offset < stat3.size) {
         this.queued.add(entry);
         return;
       }
@@ -36938,8 +36972,8 @@ var CodexQuotaService = class {
 };
 
 // app-server/src/codex/client.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs9 = require("node:fs");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs10 = require("node:fs");
 var import_node_os4 = __toESM(require("node:os"), 1);
 var import_node_path15 = __toESM(require("node:path"), 1);
 
@@ -37200,7 +37234,7 @@ var CodexAppServerClient = class {
     this.stdoutBuffer = "";
     this.stderrBuffer = "";
     const launchPlan = resolveCodexLaunchPlan(process.env);
-    this.child = (0, import_node_child_process.spawn)(launchPlan.command, launchPlan.args, {
+    this.child = (0, import_node_child_process2.spawn)(launchPlan.command, launchPlan.args, {
       env: buildCodexProcessEnv(process.env, launchPlan),
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -37329,7 +37363,7 @@ function resolveCodexBinaryCandidates(env) {
 }
 function resolveNvmCodexCandidates(nodeVersionsDir) {
   try {
-    return (0, import_node_fs9.readdirSync)(nodeVersionsDir).map((entry) => import_node_path15.default.join(nodeVersionsDir, entry, "bin", "codex")).sort((left, right) => readMtimeMs(right) - readMtimeMs(left));
+    return (0, import_node_fs10.readdirSync)(nodeVersionsDir).map((entry) => import_node_path15.default.join(nodeVersionsDir, entry, "bin", "codex")).sort((left, right) => readMtimeMs(right) - readMtimeMs(left));
   } catch {
     return [];
   }
@@ -37353,6 +37387,7 @@ var import_promises9 = require("node:fs/promises");
 var import_node_os5 = __toESM(require("node:os"), 1);
 var import_node_path16 = __toESM(require("node:path"), 1);
 var ROLLOUT_TAIL_BYTES = 1024 * 1024;
+var ROLLOUT_LOOKBACK_BYTES = 64 * ROLLOUT_TAIL_BYTES;
 var TERMINAL_LIFECYCLE_TYPES = /* @__PURE__ */ new Set([
   "task_started",
   "task_complete",
@@ -37378,13 +37413,11 @@ var CodexRolloutLifecycleReader = class {
     }
     try {
       const previous = this.snapshots.get(threadId);
-      const tail = await readFileTail(filePath, previous?.signature);
-      if (tail.content === null) return previous.lifecycle;
-      const lifecycle = parseLatestLifecycle(tail.content);
+      const snapshot = await readFileLifecycle(filePath, previous);
       this.snapshots.delete(threadId);
-      this.snapshots.set(threadId, { signature: tail.signature, lifecycle });
+      this.snapshots.set(threadId, snapshot);
       if (this.snapshots.size > 128) this.snapshots.delete(this.snapshots.keys().next().value);
-      return lifecycle;
+      return snapshot.lifecycle;
     } catch {
       this.threadPaths.delete(threadId);
       this.snapshots.delete(threadId);
@@ -37417,21 +37450,32 @@ var CodexRolloutLifecycleReader = class {
     return this.threadPaths.get(threadId) ?? [...this.threadPaths].find(([id]) => id.endsWith(`-${threadId}`))?.[1] ?? null;
   }
 };
-async function readFileTail(filePath, previousSignature) {
+async function readFileLifecycle(filePath, previous) {
   const handle = await (0, import_promises9.open)(filePath, "r");
   try {
     const { size, dev, ino, mtimeMs, ctimeMs } = await handle.stat();
     const signature = `${filePath}:${dev}:${ino}:${size}:${mtimeMs}:${ctimeMs}`;
-    if (signature === previousSignature) return { signature, content: null };
-    const start = Math.max(0, size - ROLLOUT_TAIL_BYTES);
-    const buffer = Buffer.alloc(size - start);
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, start);
-    const value = buffer.subarray(0, bytesRead).toString("utf8");
-    if (start === 0) {
-      return { signature, content: value };
-    }
-    const firstNewline = value.indexOf("\n");
-    return { signature, content: firstNewline === -1 ? "" : value.slice(firstNewline + 1) };
+    if (signature === previous?.signature) return previous;
+    const floor = Math.max(0, size - ROLLOUT_LOOKBACK_BYTES);
+    let end = size;
+    let suffix = Buffer.alloc(0);
+    let lifecycle = null;
+    while (end > floor && !lifecycle) {
+      const start = Math.max(floor, end - ROLLOUT_TAIL_BYTES);
+      const buffer = Buffer.alloc(end - start);
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, start);
+      if (bytesRead !== buffer.length) return { signature, lifecycle: null };
+      const value = Buffer.concat([buffer, suffix]);
+      const boundary = start > 0 ? value.indexOf(10) : -1;
+      const complete = start === 0 ? value : boundary < 0 ? Buffer.alloc(0) : value.subarray(boundary + 1);
+      lifecycle = parseLatestLifecycle(complete.toString("utf8"));
+      suffix = boundary >= 0 && boundary < ROLLOUT_TAIL_BYTES ? Buffer.from(value.subarray(0, boundary + 1)) : Buffer.alloc(0);
+      end = start;
+    }
+    const current = await (0, import_promises9.stat)(filePath);
+    if (current.dev !== dev || current.ino !== ino || current.size !== size || current.mtimeMs !== mtimeMs || current.ctimeMs !== ctimeMs)
+      return { signature, lifecycle: null };
+    return { signature, lifecycle };
   } finally {
     await handle.close();
   }
@@ -37629,6 +37673,7 @@ var AgentThreadStatusReconciler = class {
   collectCandidates() {
     const cutoff = Date.now() - ACTIVE_WINDOW_MS;
     return this.options.eventCenter.getStateStore().listThreads({ limit: 1e4 }).filter((thread) => RECONCILED_AGENTS.has(thread.agent)).filter((thread) => !thread.threadId.startsWith("unknown-thread:")).filter((thread) => {
+      if (thread.status === "running") return true;
       const lastActivityAtMs = Date.parse(thread.lastActivityAt);
       return !Number.isFinite(lastActivityAtMs) || lastActivityAtMs >= cutoff;
     }).sort(
@@ -37664,8 +37709,19 @@ var AgentThreadStatusReconciler = class {
       const lifecycle2 = await this.options.codexRolloutLifecycleReader.readLatestLifecycle(
         thread.threadId
       );
+      if (lifecycle2?.status === "running" && (thread.status === "running" || !isOlderThanThreadProjection(lifecycle2.timestamp, thread))) {
+        return {
+          status: "running",
+          lifecycleType: `rollout:${lifecycle2.type}`,
+          lifecycleCursor: lifecycle2.cursor,
+          detailStatus: null,
+          preview: null,
+          turnId: lifecycle2.turnId
+        };
+      }
       const sameObservedFailure = lifecycle2?.error && thread.status === "idle" && thread.lastLifecycleType === `rollout:${lifecycle2.type}` && thread.lastLifecycleCursor === lifecycle2.cursor;
-      if (lifecycle2?.status === "idle" && (!isOlderThanThreadProjection(lifecycle2.timestamp, thread) || sameObservedFailure) && // A terminal error is a fact even if a Hook already marked the thread
+      const followsObservedStart = lifecycle2 && thread.lastLifecycleType === "rollout:task_started" && newerRolloutCursor(lifecycle2.cursor, thread.lastLifecycleCursor);
+      if (lifecycle2?.status === "idle" && (!isOlderThanThreadProjection(lifecycle2.timestamp, thread) || sameObservedFailure || followsObservedStart) && // A terminal error is a fact even if a Hook already marked the thread
       // idle, or thread/read still reports active. Never adopt an old turn.
       (lifecycle2.error || thread.status === "running" && status !== "active")) {
         return {
@@ -37784,6 +37840,11 @@ var AgentThreadStatusReconciler = class {
     });
   }
 };
+function newerRolloutCursor(current, previous) {
+  const currentOrdinal = current.match(/^rollout:(\d+)$/)?.[1];
+  const previousOrdinal = previous?.match(/^rollout:(\d+)$/)?.[1];
+  return Boolean(currentOrdinal && previousOrdinal && BigInt(currentOrdinal) > BigInt(previousOrdinal));
+}
 function isOlderThanThreadProjection(observedAt, thread) {
   const observedAtMs = Date.parse(observedAt);
   const projectedAtMs = Date.parse(thread.updatedAt);