@runweave/server-linux-x64 0.1.4 → 0.1.5

package/payload/backend/dev-resources/control.cjs

@@ -7322,12 +7322,12 @@ var require_dist = __commonJS({
 var import_promises13 = __toESM(require("node:fs/promises"), 1);
 var import_node_path29 = __toESM(require("node:path"), 1);
 var import_node_os17 = __toESM(require("node:os"), 1);
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var import_node_util6 = require("node:util");
 var import_node_url = require("node:url");
 
 // scripts/dev-session/beta-pool/projection.mjs
-var import_node_fs15 = require("node:fs");
+var import_node_fs16 = require("node:fs");
 var import_promises12 = __toESM(require("node:fs/promises"), 1);
 var import_node_os16 = __toESM(require("node:os"), 1);
 var import_node_path28 = __toESM(require("node:path"), 1);
@@ -7493,7 +7493,7 @@ function publicManifest(manifest) {
 }
 
 // scripts/dev-session/services/index.mjs
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_util4 = require("node:util");
 
 // scripts/dev-session/registry.mjs
@@ -7873,7 +7873,7 @@ async function releaseSessionPortLeases(root, ports, sessionId) {
 }
 
 // scripts/dev-session/services/runtime.mjs
-var import_node_child_process3 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var import_promises5 = require("node:fs/promises");
 var import_node_path18 = __toESM(require("node:path"), 1);
 var import_node_util2 = require("node:util");
@@ -8402,6 +8402,9 @@ __export(src_exports, {
   acquireConfigurationOwner: () => acquireConfigurationOwner,
   assertNewStableInstallation: () => assertNewStableInstallation,
   assertOwnedPath: () => assertOwnedPath,
+  assertPrivateDescriptor: () => assertPrivateDescriptor,
+  assertPrivateDirectory: () => assertPrivateDirectory,
+  assertWindowsPrivatePath: () => assertWindowsPrivatePath,
   backupMigrationSources: () => backupMigrationSources,
   canonicalPath: () => canonicalPath,
   configuration: () => configuration,
@@ -8423,11 +8426,13 @@ __export(src_exports, {
   parseEnvironmentFile: () => parseEnvironmentFile,
   prepareInitialConfiguration: () => prepareInitialConfiguration,
   prepareMigration: () => prepareMigration,
+  processStartIdentity: () => processStartIdentity,
   readInitialAuthFile: () => readInitialAuthFile,
   readInstalledRuntimeBuild: () => readInstalledRuntimeBuild,
   readLocalRuntimeStatusReport: () => readLocalRuntimeStatusReport,
   readNativeHostRuntimeStatusReport: () => readNativeHostRuntimeStatusReport,
   readNativeHostSharingEnabled: () => readNativeHostSharingEnabled,
+  readPrivateFile: () => readPrivateFile,
   readResearchMcpInstallation: () => readResearchMcpInstallation,
   redactConfiguration: () => redactConfiguration,
   registerStableConfigurationRoot: () => registerStableConfigurationRoot,
@@ -8441,6 +8446,7 @@ __export(src_exports, {
   startLocalRuntimeStatusReporter: () => startLocalRuntimeStatusReporter,
   startLocalServiceProcessReporter: () => startLocalServiceProcessReporter,
   supportsConfiguration: () => supportsConfiguration,
+  syncDirectory: () => syncDirectory,
   validateDomains: () => validateDomains,
   validateEnvelope: () => validateEnvelope,
   validateLocalRuntimeStatusReport: () => validateLocalRuntimeStatusReport,
@@ -8468,21 +8474,57 @@ var ConfigurationError = class extends Error {
 
 // packages/config-node/src/private-file.ts
 var import_node_fs3 = require("node:fs");
+
+// packages/config-node/src/windows-permissions.ts
+var import_node_child_process2 = require("node:child_process");
+function assertWindowsPrivatePath(file) {
+  if (process.platform !== "win32") return;
+  const script = `
+$ErrorActionPreference = 'Stop'
+# Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
+$acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
+  [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
+} else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+}
+`;
+  try {
+    (0, import_node_child_process2.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
+      stdio: "ignore",
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch {
+    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+  }
+}
+
+// packages/config-node/src/private-file.ts
 function assertPrivateDirectory(directory2) {
   const stat = (0, import_node_fs3.lstatSync)(directory2);
-  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 63 || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  if (!stat.isDirectory() || stat.isSymbolicLink() || process.platform !== "win32" && stat.mode & 63 || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(directory2);
 }
-function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024) {
+function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024, file) {
   const stat = (0, import_node_fs3.fstatSync)(fd);
   if (!stat.isFile() || stat.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if (stat.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && stat.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform === "win32") {
+    if (!file) throw new ConfigurationError("CONFIG_PRIVATE_PATH_REQUIRED");
+    assertWindowsPrivatePath(file);
+  }
   if (stat.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
 }
 function readPrivateFile(file, maxBytes = 1024 * 1024) {
   const fd = (0, import_node_fs3.openSync)(file, import_node_fs3.constants.O_RDONLY | import_node_fs3.constants.O_NOFOLLOW);
   try {
-    assertPrivateDescriptor(fd, maxBytes);
+    assertPrivateDescriptor(fd, maxBytes, file);
     const source = (0, import_node_fs3.readFileSync)(fd, "utf8");
     if (Buffer.byteLength(source) > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
     return source;
@@ -8563,15 +8605,40 @@ function assertOwnedPath(context, value) {
   }
 }
 
-// packages/config-node/src/owner.ts
+// packages/config-node/src/platform.ts
+var import_node_child_process3 = require("node:child_process");
 var import_node_fs5 = require("node:fs");
+function processStartIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1) return null;
+  try {
+    return (0, import_node_child_process3.execFileSync)(
+      process.platform === "win32" ? "powershell.exe" : "ps",
+      process.platform === "win32" ? ["-NoProfile", "-NonInteractive", "-Command", `[Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToUniversalTime().Ticks`] : ["-p", String(pid), "-o", "lstart="],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3, windowsHide: true }
+    ).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function syncDirectory(directory2) {
+  if (process.platform === "win32") return;
+  const fd = (0, import_node_fs5.openSync)(directory2, "r");
+  try {
+    (0, import_node_fs5.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs5.closeSync)(fd);
+  }
+}
+
+// packages/config-node/src/owner.ts
+var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 var import_node_os5 = __toESM(require("node:os"), 1);
 var import_node_crypto2 = require("node:crypto");
 var import_fs_native_extensions = require("fs-native-extensions");
 function ownerDirectory(context) {
   const directory2 = context.kind === "stable" ? import_node_path7.default.join(import_node_os5.default.userInfo().homedir, ".runweave", "runtime") : import_node_path7.default.join(context.configRoot, "runtime");
-  (0, import_node_fs5.mkdirSync)(directory2, { recursive: true, mode: 448 });
+  (0, import_node_fs6.mkdirSync)(directory2, { recursive: true, mode: 448 });
   assertPrivateDirectory(import_node_path7.default.dirname(directory2));
   assertPrivateDirectory(directory2);
   return directory2;
@@ -8580,11 +8647,11 @@ function registerStableConfigurationRoot(context) {
   if (context.kind !== "stable") return;
   const directory2 = ownerDirectory(context);
   const registry = import_node_path7.default.join(directory2, "stable-root.json");
-  const registryFd = (0, import_node_fs5.openSync)(import_node_path7.default.join(directory2, "stable-root.lock"), import_node_fs5.constants.O_CREAT | import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW, 384);
+  const registryFd = (0, import_node_fs6.openSync)(import_node_path7.default.join(directory2, "stable-root.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(registryFd);
+    assertPrivateDescriptor(registryFd, void 0, import_node_path7.default.join(directory2, "stable-root.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(registryFd)) throw new ConfigurationError("CONFIG_ROOT_REGISTRATION_BUSY");
-    if ((0, import_node_fs5.existsSync)(registry)) {
+    if ((0, import_node_fs6.existsSync)(registry)) {
       let stored;
       try {
         stored = JSON.parse(readPrivateFile(registry));
@@ -8594,34 +8661,29 @@ function registerStableConfigurationRoot(context) {
       if (!stored || typeof stored !== "object" || !("root" in stored) || stored.root !== canonicalPath(context.configRoot)) throw new ConfigurationError("CONFIG_STABLE_ROOT_CONFLICT");
     } else {
       const temporary = `${registry}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
-      const file = (0, import_node_fs5.openSync)(temporary, "wx", 384);
-      try {
-        (0, import_node_fs5.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
-        (0, import_node_fs5.fsyncSync)(file);
-      } finally {
-        (0, import_node_fs5.closeSync)(file);
-      }
-      (0, import_node_fs5.renameSync)(temporary, registry);
-      const parent = (0, import_node_fs5.openSync)(directory2, "r");
+      const file = (0, import_node_fs6.openSync)(temporary, "wx", 384);
       try {
-        (0, import_node_fs5.fsyncSync)(parent);
+        (0, import_node_fs6.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
+        (0, import_node_fs6.fsyncSync)(file);
       } finally {
-        (0, import_node_fs5.closeSync)(parent);
+        (0, import_node_fs6.closeSync)(file);
       }
+      (0, import_node_fs6.renameSync)(temporary, registry);
+      syncDirectory(directory2);
     }
   } finally {
-    (0, import_node_fs5.closeSync)(registryFd);
+    (0, import_node_fs6.closeSync)(registryFd);
   }
 }
 function withUpgradeGate(context, shared, run) {
   const directory2 = ownerDirectory(context);
-  const fd = (0, import_node_fs5.openSync)(import_node_path7.default.join(directory2, "configuration-upgrade.lock"), import_node_fs5.constants.O_CREAT | import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs6.openSync)(import_node_path7.default.join(directory2, "configuration-upgrade.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path7.default.join(directory2, "configuration-upgrade.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(fd, 0, 0, { shared })) throw new ConfigurationError("CONFIG_UPGRADE_BUSY");
     return run();
   } finally {
-    (0, import_node_fs5.closeSync)(fd);
+    (0, import_node_fs6.closeSync)(fd);
   }
 }
 function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
@@ -8629,16 +8691,16 @@ function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
     const directory2 = ownerDirectory(context);
     const held = [];
     try {
-      for (const file of (0, import_node_fs5.readdirSync)(directory2).filter((name) => name.endsWith(".owner.lock"))) {
+      for (const file of (0, import_node_fs6.readdirSync)(directory2).filter((name) => name.endsWith(".owner.lock"))) {
         if (ignoredRoles.includes(file.replace(/\.owner\.lock$/, ""))) continue;
-        const fd = (0, import_node_fs5.openSync)(import_node_path7.default.join(directory2, file), import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW);
+        const fd = (0, import_node_fs6.openSync)(import_node_path7.default.join(directory2, file), import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW);
         held.push(fd);
-        assertPrivateDescriptor(fd);
+        assertPrivateDescriptor(fd, void 0, import_node_path7.default.join(directory2, file));
         if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_UPGRADE_CONSUMER_RUNNING", [file.replace(/\.owner\.lock$/, "")]);
       }
       return run();
     } finally {
-      for (const fd of held) (0, import_node_fs5.closeSync)(fd);
+      for (const fd of held) (0, import_node_fs6.closeSync)(fd);
     }
   });
 }
@@ -8647,16 +8709,16 @@ function acquireConfigurationOwner(context, role) {
 }
 function acquireOwner(context, role) {
   const directory2 = ownerDirectory(context);
-  const fd = (0, import_node_fs5.openSync)(import_node_path7.default.join(directory2, `${role}.owner.lock`), import_node_fs5.constants.O_CREAT | import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs6.openSync)(import_node_path7.default.join(directory2, `${role}.owner.lock`), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
   let closed = false;
   const release = () => {
     if (!closed) {
       closed = true;
-      (0, import_node_fs5.closeSync)(fd);
+      (0, import_node_fs6.closeSync)(fd);
     }
   };
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path7.default.join(directory2, `${role}.owner.lock`));
     if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_INSTANCE_ALREADY_RUNNING", [role]);
     registerStableConfigurationRoot(context);
     return { release };
@@ -8979,7 +9041,7 @@ function migrateConfigurationDocument(document) {
 }
 
 // packages/config-node/src/store.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_path9 = __toESM(require("node:path"), 1);
 var import_node_crypto3 = require("node:crypto");
 var import_yaml = __toESM(require_dist(), 1);
@@ -9174,10 +9236,11 @@ function parseConfigurationYaml(source, context) {
   return { document, value, digest: (0, import_node_crypto3.createHash)("sha256").update(source).digest("hex"), issues: validateDomains(value, context) };
 }
 function assertPrivateFile(file, fd) {
-  const stat = fd === void 0 ? (0, import_node_fs6.lstatSync)(file) : (0, import_node_fs6.fstatSync)(fd);
+  const stat = fd === void 0 ? (0, import_node_fs7.lstatSync)(file) : (0, import_node_fs7.fstatSync)(fd);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if ((stat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(file);
   if (stat.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
 }
 var ConfigurationStore = class {
@@ -9187,30 +9250,29 @@ var ConfigurationStore = class {
   }
   file;
   read() {
-    if (!(0, import_node_fs6.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
-    const root = (0, import_node_fs6.lstatSync)(this.context.configRoot);
-    if (!root.isDirectory() || root.isSymbolicLink() || root.mode & 63 || typeof process.getuid === "function" && root.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+    if (!(0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
+    assertPrivateDirectory(this.context.configRoot);
     assertPrivateFile(this.file);
-    const fd = (0, import_node_fs6.openSync)(this.file, import_node_fs6.constants.O_RDONLY | import_node_fs6.constants.O_NOFOLLOW);
+    const fd = (0, import_node_fs7.openSync)(this.file, import_node_fs7.constants.O_RDONLY | import_node_fs7.constants.O_NOFOLLOW);
     try {
       assertPrivateFile(this.file, fd);
-      return parseConfigurationYaml((0, import_node_fs6.readFileSync)(fd, "utf8"), this.context);
+      return parseConfigurationYaml((0, import_node_fs7.readFileSync)(fd, "utf8"), this.context);
     } finally {
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
   }
   locked(run) {
-    (0, import_node_fs6.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
-    const dirStat = (0, import_node_fs6.lstatSync)(this.context.configRoot);
+    (0, import_node_fs7.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
+    const dirStat = (0, import_node_fs7.lstatSync)(this.context.configRoot);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || typeof process.getuid === "function" && dirStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_OWNER_MISMATCH");
-    if ((dirStat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
-    const fd = (0, import_node_fs6.openSync)(import_node_path9.default.join(this.context.configRoot, "settings.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+    assertPrivateDirectory(this.context.configRoot);
+    const fd = (0, import_node_fs7.openSync)(import_node_path9.default.join(this.context.configRoot, "settings.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
     try {
       assertPrivateFile(import_node_path9.default.join(this.context.configRoot, "settings.lock"), fd);
       if (!(0, import_fs_native_extensions2.tryLock)(fd)) throw new ConfigurationError("CONFIG_WRITE_BUSY");
       return run();
     } finally {
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
   }
   publish(document, previous, backupId) {
@@ -9220,41 +9282,35 @@ var ConfigurationStore = class {
     const temporary = `${this.file}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
     if (previous !== void 0) {
       const backupRoot = import_node_path9.default.join(this.context.configRoot, "config-backups");
-      (0, import_node_fs6.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
-      const backupStat = (0, import_node_fs6.lstatSync)(backupRoot);
-      if (!backupStat.isDirectory() || backupStat.isSymbolicLink() || backupStat.mode & 63 || typeof process.getuid === "function" && backupStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_BACKUP_ROOT_INVALID");
+      (0, import_node_fs7.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
+      assertPrivateDirectory(backupRoot);
       const backup = import_node_path9.default.join(backupRoot, backupId ?? `${Date.now()}-${(0, import_node_crypto3.randomUUID)()}.yaml`);
-      const fd2 = (0, import_node_fs6.openSync)(backup, "wx", 384);
+      const fd2 = (0, import_node_fs7.openSync)(backup, "wx", 384);
       try {
-        (0, import_node_fs6.writeFileSync)(fd2, previous);
-        (0, import_node_fs6.fsyncSync)(fd2);
+        (0, import_node_fs7.writeFileSync)(fd2, previous);
+        (0, import_node_fs7.fsyncSync)(fd2);
       } finally {
-        (0, import_node_fs6.closeSync)(fd2);
+        (0, import_node_fs7.closeSync)(fd2);
       }
     }
-    const fd = (0, import_node_fs6.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs6.writeFileSync)(fd, source);
-      (0, import_node_fs6.fsyncSync)(fd);
+      (0, import_node_fs7.writeFileSync)(fd, source);
+      (0, import_node_fs7.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
     try {
-      (0, import_node_fs6.renameSync)(temporary, this.file);
-      const parent = (0, import_node_fs6.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs6.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs6.closeSync)(parent);
-      }
+      (0, import_node_fs7.renameSync)(temporary, this.file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs6.existsSync)(temporary)) (0, import_node_fs6.unlinkSync)(temporary);
+      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
     }
     return checked;
   }
   initialize(value) {
     return this.locked(() => {
-      if ((0, import_node_fs6.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+      if ((0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
       if (Object.keys(issues).length) throw new ConfigurationError("CONFIG_VALIDATION_FAILED", Object.values(issues).flat().map((item) => item.path));
@@ -9294,9 +9350,9 @@ var ConfigurationStore = class {
   }
   backups() {
     const root = import_node_path9.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs6.existsSync)(root)) return [];
+    if (!(0, import_node_fs7.existsSync)(root)) return [];
     assertPrivateDirectory(root);
-    return (0, import_node_fs6.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
+    return (0, import_node_fs7.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
       try {
         const backup = this.readBackup(id);
         return { id, revision: backup.value.revision, schemaVersion: backup.value.schemaVersion, compatible: true };
@@ -9374,23 +9430,18 @@ var ConfigurationStore = class {
   recordUpgrade(value) {
     const file = import_node_path9.default.join(this.context.configRoot, "config-upgrade.json");
     const temporary = `${file}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-    const fd = (0, import_node_fs6.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs6.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
-      (0, import_node_fs6.fsyncSync)(fd);
+      (0, import_node_fs7.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
+      (0, import_node_fs7.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
     try {
-      (0, import_node_fs6.renameSync)(temporary, file);
-      const parent = (0, import_node_fs6.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs6.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs6.closeSync)(parent);
-      }
+      (0, import_node_fs7.renameSync)(temporary, file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs6.existsSync)(temporary)) (0, import_node_fs6.unlinkSync)(temporary);
+      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
     }
   }
   upgrade(expected) {
@@ -9399,7 +9450,7 @@ var ConfigurationStore = class {
       if (preview.expectedRevision !== expected.revision || preview.expectedDigest !== expected.digest) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       if (!preview.changed) {
         const receiptFile = import_node_path9.default.join(this.context.configRoot, "config-upgrade.json");
-        if ((0, import_node_fs6.existsSync)(receiptFile)) {
+        if ((0, import_node_fs7.existsSync)(receiptFile)) {
           const receipt = JSON.parse(readPrivateFile(receiptFile));
           if (isConfigurationObject(receipt) && receipt.phase === "prepared" && receipt.plannedDigest === expected.digest)
             this.recordUpgrade({ ...receipt, phase: "committed", savedRevision: expected.revision, digest: expected.digest });
@@ -9433,9 +9484,9 @@ var ConfigurationStore = class {
   previous(keys) {
     const current = this.read();
     const root = import_node_path9.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs6.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
+    if (!(0, import_node_fs7.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
     assertPrivateDirectory(root);
-    const candidates = (0, import_node_fs6.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
+    const candidates = (0, import_node_fs7.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
     for (const candidate of candidates) {
       const file = import_node_path9.default.join(root, candidate);
       const previous = parseConfigurationYaml(readPrivateFile(file), this.context);
@@ -9447,7 +9498,7 @@ var ConfigurationStore = class {
   }
   migrate(value, expected) {
     return this.locked(() => {
-      const current = (0, import_node_fs6.existsSync)(this.file) ? this.read() : null;
+      const current = (0, import_node_fs7.existsSync)(this.file) ? this.read() : null;
       if (current ? !expected || current.value.revision !== expected.revision || current.digest !== expected.digest : expected !== null) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
@@ -9678,7 +9729,7 @@ function configurationPath(key, relativeDefault) {
 }
 
 // packages/config-node/src/migration.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_path11 = __toESM(require("node:path"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_crypto4 = require("node:crypto");
@@ -9713,7 +9764,7 @@ function importEnvironment(value, environment) {
 }
 function prepareMigration(context, sources) {
   const store = new ConfigurationStore(context);
-  const initial = (0, import_node_fs7.existsSync)(store.file) ? store.read().value : emptyConfiguration(context);
+  const initial = (0, import_node_fs8.existsSync)(store.file) ? store.read().value : emptyConfiguration(context);
   const value = structuredClone(initial);
   const result = { value, sources: [], conflicts: [] };
   const byDomain = /* @__PURE__ */ new Map();
@@ -9722,7 +9773,7 @@ function prepareMigration(context, sources) {
     if (!import_node_path11.default.isAbsolute(source.file)) throw new ConfigurationError("CONFIG_SOURCE_PATH_REQUIRED");
     assertMigrationSourceOwner(context, source.file);
     if (migratedDomains.has(source.domain)) continue;
-    const raw = (0, import_node_fs7.readFileSync)(source.file, "utf8");
+    const raw = (0, import_node_fs8.readFileSync)(source.file, "utf8");
     const digest = (0, import_node_crypto4.createHash)("sha256").update(raw).digest("hex");
     const previous = byDomain.get(source.domain);
     if (previous && previous !== digest) {
@@ -9813,39 +9864,39 @@ function migrationLeaves(value, prefix) {
   return [[prefix, value]];
 }
 function backupMigrationSources(context, draft) {
-  (0, import_node_fs7.mkdirSync)(context.configRoot, { recursive: true, mode: 448 });
+  (0, import_node_fs8.mkdirSync)(context.configRoot, { recursive: true, mode: 448 });
   assertPrivateDirectory(context.configRoot);
   const directory2 = import_node_path11.default.join(context.configRoot, "config-backups");
-  (0, import_node_fs7.mkdirSync)(directory2, { recursive: true, mode: 448 });
+  (0, import_node_fs8.mkdirSync)(directory2, { recursive: true, mode: 448 });
   assertPrivateDirectory(directory2);
   for (const source of draft.sources) {
     assertMigrationSourceOwner(context, source.file);
-    const raw = (0, import_node_fs7.readFileSync)(source.file);
+    const raw = (0, import_node_fs8.readFileSync)(source.file);
     if ((0, import_node_crypto4.createHash)("sha256").update(raw).digest("hex") !== source.digest) throw new ConfigurationError("CONFIG_SOURCE_CHANGED");
     const target = import_node_path11.default.join(directory2, `migration-${source.digest}.source`);
-    if ((0, import_node_fs7.existsSync)(target)) {
+    if ((0, import_node_fs8.existsSync)(target)) {
       if ((0, import_node_crypto4.createHash)("sha256").update(readPrivateFile(target, raw.length)).digest("hex") !== source.digest) throw new ConfigurationError("CONFIG_BACKUP_INVALID");
       continue;
     }
     const temporary = `${target}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
-    const fd2 = (0, import_node_fs7.openSync)(temporary, "wx", 384);
+    const fd2 = (0, import_node_fs8.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs7.writeFileSync)(fd2, raw);
-      (0, import_node_fs7.fsyncSync)(fd2);
+      (0, import_node_fs8.writeFileSync)(fd2, raw);
+      (0, import_node_fs8.fsyncSync)(fd2);
     } finally {
-      (0, import_node_fs7.closeSync)(fd2);
+      (0, import_node_fs8.closeSync)(fd2);
     }
     try {
-      (0, import_node_fs7.renameSync)(temporary, target);
+      (0, import_node_fs8.renameSync)(temporary, target);
     } finally {
-      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
+      if ((0, import_node_fs8.existsSync)(temporary)) (0, import_node_fs8.unlinkSync)(temporary);
     }
   }
-  const fd = (0, import_node_fs7.openSync)(directory2, "r");
+  const fd = (0, import_node_fs8.openSync)(directory2, "r");
   try {
-    (0, import_node_fs7.fsyncSync)(fd);
+    (0, import_node_fs8.fsyncSync)(fd);
   } finally {
-    (0, import_node_fs7.closeSync)(fd);
+    (0, import_node_fs8.closeSync)(fd);
   }
 }
 function assertMigrationSourceOwner(context, file) {
@@ -9902,7 +9953,7 @@ var ConfigurationDomain = class {
 };
 
 // packages/config-node/src/migration-discovery.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_path12 = __toESM(require("node:path"), 1);
 var import_node_os7 = __toESM(require("node:os"), 1);
 var import_node_crypto5 = require("node:crypto");
@@ -9910,7 +9961,7 @@ function discoverMigrationSources(context, selected) {
   const sources = [];
   const add = (root, relative, domain, format = "json") => {
     const file = import_node_path12.default.join(root, relative);
-    if ((0, import_node_fs8.existsSync)(file)) sources.push({ file, domain, format });
+    if ((0, import_node_fs9.existsSync)(file)) sources.push({ file, domain, format });
   };
   add(context.configRoot, "config.json", "cli");
   add(context.configRoot, "snapshot-share/publish.env", "services.snapshotPublisher", "env");
@@ -9933,7 +9984,7 @@ function discoverMigrationSources(context, selected) {
 function retainSelectedStorage(context, selected, draft) {
   if (!selected.backendProfile || draft.value.migrations.storage) return;
   const profile = selectedDirectory(context, selected.backendProfile);
-  if (!(0, import_node_fs8.existsSync)(import_node_path12.default.join(profile, "auth-store.json"))) throw new ConfigurationError("CONFIG_SELECTED_PROFILE_UNVERIFIED");
+  if (!(0, import_node_fs9.existsSync)(import_node_path12.default.join(profile, "auth-store.json"))) throw new ConfigurationError("CONFIG_SELECTED_PROFILE_UNVERIFIED");
   const globalRoot = context.kind === "stable" ? import_node_path12.default.join(import_node_os7.default.userInfo().homedir, ".runweave") : import_node_path12.default.join(context.configRoot, "data");
   const retained = {
     "storage.browserProfileDirectory": profile,
@@ -9952,7 +10003,7 @@ function retainSelectedStorage(context, selected, draft) {
   draft.value.migrations.storage = { id: `selected-profile:${digest}`, sourceDigest: digest };
 }
 function selectedDirectory(context, directory2) {
-  if (!import_node_path12.default.isAbsolute(directory2) || !(0, import_node_fs8.existsSync)(directory2) || !(0, import_node_fs8.statSync)(directory2).isDirectory()) throw new ConfigurationError("CONFIG_SOURCE_DIRECTORY_INVALID");
+  if (!import_node_path12.default.isAbsolute(directory2) || !(0, import_node_fs9.existsSync)(directory2) || !(0, import_node_fs9.statSync)(directory2).isDirectory()) throw new ConfigurationError("CONFIG_SOURCE_DIRECTORY_INVALID");
   const result = canonicalPath(directory2);
   assertOwnedPath(context, result);
   return result;
@@ -9960,19 +10011,19 @@ function selectedDirectory(context, directory2) {
 
 // packages/config-node/src/initialization.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 var import_node_os8 = __toESM(require("node:os"), 1);
 var import_node_path13 = __toESM(require("node:path"), 1);
 function assertNewStableInstallation(context, selected = {}) {
   if (context.kind !== "stable") throw new ConfigurationError("CONFIG_STABLE_REQUIRED");
-  if ((0, import_node_fs9.existsSync)(import_node_path13.default.join(context.configRoot, "settings.yaml"))) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+  if ((0, import_node_fs10.existsSync)(import_node_path13.default.join(context.configRoot, "settings.yaml"))) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
   const legacy = discoverMigrationSources(context, selected);
   if (legacy.length) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED", legacy.map((source) => source.domain));
   for (const root of [import_node_path13.default.join(context.configRoot, "browser-profile"), import_node_path13.default.join(import_node_os8.default.userInfo().homedir, ".browser-profile")]) {
-    if (!(0, import_node_fs9.existsSync)(root)) continue;
-    const children = (0, import_node_fs9.lstatSync)(root).isDirectory() ? [root, ...(0, import_node_fs9.readdirSync)(root).map((name) => import_node_path13.default.join(root, name))] : [root];
+    if (!(0, import_node_fs10.existsSync)(root)) continue;
+    const children = (0, import_node_fs10.lstatSync)(root).isDirectory() ? [root, ...(0, import_node_fs10.readdirSync)(root).map((name) => import_node_path13.default.join(root, name))] : [root];
     for (const directory2 of children) {
-      if (["auth-store.json", "session-store.json", "terminal-session-store.json"].some((name) => (0, import_node_fs9.existsSync)(import_node_path13.default.join(directory2, name)))) {
+      if (["auth-store.json", "session-store.json", "terminal-session-store.json"].some((name) => (0, import_node_fs10.existsSync)(import_node_path13.default.join(directory2, name)))) {
         throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED", ["backend.profile"]);
       }
     }
@@ -10027,14 +10078,14 @@ function prepareInitialConfiguration(context, auth) {
 }
 
 // packages/config-node/src/research-mcp.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 var import_node_path14 = __toESM(require("node:path"), 1);
 function researchMcpHome() {
   return import_node_path14.default.join(resolveConfigurationContext().configRoot, "research-mcp");
 }
 function readResearchMcpInstallation() {
   const file = import_node_path14.default.join(researchMcpHome(), "installation.json");
-  if (!(0, import_node_fs10.existsSync)(file)) return null;
+  if (!(0, import_node_fs11.existsSync)(file)) return null;
   const value = JSON.parse(readPrivateFile(file));
   if (value.version !== 1 || value.instanceId !== resolveConfigurationContext().instanceId || typeof value.enabled !== "boolean" || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || ![value.entry, value.node, value.cwd].every((v) => typeof v === "string" && import_node_path14.default.isAbsolute(v)) || typeof value.sourceRevision !== "string" || typeof value.releaseId !== "string" || !Number.isFinite(value.installedAt) || value.tunnel !== null && (!value.tunnel || !/^[a-zA-Z0-9_-]+$/.test(value.tunnel.profile) || ![value.tunnel.executable, value.tunnel.profileDir, value.tunnel.healthFile].every((v) => typeof v === "string" && import_node_path14.default.isAbsolute(v)))) {
     throw new Error("Invalid research MCP installation identity");
@@ -10043,16 +10094,16 @@ function readResearchMcpInstallation() {
 }
 function writeResearchMcpInstallation(value) {
   const home = researchMcpHome();
-  (0, import_node_fs10.mkdirSync)(home, { recursive: true, mode: 448 });
+  (0, import_node_fs11.mkdirSync)(home, { recursive: true, mode: 448 });
   const file = import_node_path14.default.join(home, "installation.json");
   const temporary = `${file}.${process.pid}.tmp`;
-  (0, import_node_fs10.writeFileSync)(temporary, `${JSON.stringify(value, null, 2)}
+  (0, import_node_fs11.writeFileSync)(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs10.renameSync)(temporary, file);
+  (0, import_node_fs11.renameSync)(temporary, file);
 }
 
 // packages/config-node/src/runtime-status.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_path15 = __toESM(require("node:path"), 1);
 var import_node_os9 = __toESM(require("node:os"), 1);
 var import_node_crypto7 = require("node:crypto");
@@ -10137,14 +10188,14 @@ function validateLocalRuntimeStatusReport(value, source) {
 function readNativeHostRuntimeStatusReport() {
   const root = import_node_path15.default.join(import_node_os9.default.homedir(), "Library", "Application Support", "RemoteDesk");
   const file = import_node_path15.default.join(root, "runtime-status.json");
-  if (!(0, import_node_fs11.existsSync)(file)) return null;
+  if (!(0, import_node_fs12.existsSync)(file)) return null;
   assertPrivateDirectory(root);
-  return { report: validateLocalRuntimeStatusReport(JSON.parse(readPrivateFile(file, 64 * 1024)), "remote-desktop-host"), receivedAt: (0, import_node_fs11.statSync)(file).mtimeMs };
+  return { report: validateLocalRuntimeStatusReport(JSON.parse(readPrivateFile(file, 64 * 1024)), "remote-desktop-host"), receivedAt: (0, import_node_fs12.statSync)(file).mtimeMs };
 }
 function readNativeHostSharingEnabled() {
   const root = import_node_path15.default.join(import_node_os9.default.homedir(), "Library", "Application Support", "RemoteDesk");
   const file = import_node_path15.default.join(root, "local-host.json");
-  if (!(0, import_node_fs11.existsSync)(file)) return false;
+  if (!(0, import_node_fs12.existsSync)(file)) return false;
   assertPrivateDirectory(root);
   const value = JSON.parse(readPrivateFile(file, 16 * 1024));
   if (value.schemaVersion !== 1 || typeof value.running !== "boolean") throw new Error("Invalid native Host sharing intent");
@@ -10157,16 +10208,16 @@ function startLocalRuntimeStatusReporter(source, report) {
   let inFlight = null;
   let latest = null;
   const write = (snapshot, stopping = false) => {
-    (0, import_node_fs11.mkdirSync)(root, { recursive: true, mode: 448 });
+    (0, import_node_fs12.mkdirSync)(root, { recursive: true, mode: 448 });
     assertPrivateDirectory(root);
     if (snapshot.source.id !== source) throw new Error("Runtime status owner mismatch");
     if (stopping) snapshot = { ...snapshot, observedAt: Date.now(), items: snapshot.items.map((item) => ({ ...item, state: "disabled", summary: "\u670D\u52A1\u5DF2\u6B63\u5E38\u505C\u6B62", recovery: null })) };
     const temporary = `${file}.${(0, import_node_crypto7.randomUUID)()}.tmp`;
     try {
-      (0, import_node_fs11.writeFileSync)(temporary, JSON.stringify({ instanceId: configuration().context.instanceId, report: snapshot, stopped: stopping }), { mode: 384, flag: "wx" });
-      (0, import_node_fs11.renameSync)(temporary, file);
+      (0, import_node_fs12.writeFileSync)(temporary, JSON.stringify({ instanceId: configuration().context.instanceId, report: snapshot, stopped: stopping }), { mode: 384, flag: "wx" });
+      (0, import_node_fs12.renameSync)(temporary, file);
     } finally {
-      (0, import_node_fs11.rmSync)(temporary, { force: true });
+      (0, import_node_fs12.rmSync)(temporary, { force: true });
     }
   };
   const publish = () => {
@@ -10225,13 +10276,13 @@ function startLocalServiceProcessReporter(source, label, health) {
 function readLocalRuntimeStatusReport(source) {
   const root = directory();
   const file = import_node_path15.default.join(root, `${source}.json`);
-  if (!(0, import_node_fs11.existsSync)(file)) return null;
+  if (!(0, import_node_fs12.existsSync)(file)) return null;
   assertPrivateDirectory(root);
   const value = JSON.parse(readPrivateFile(file, 256 * 1024));
   if (value.instanceId !== configuration().context.instanceId) throw new Error("Local runtime status instance mismatch");
   const report = validateLocalRuntimeStatusReport(value.report, source);
   if (value.stopped === true && report.items.some((item) => item.state !== "disabled")) throw new Error("Invalid stopped owner report");
-  return { report, receivedAt: (0, import_node_fs11.statSync)(file).mtimeMs, stopped: value.stopped === true };
+  return { report, receivedAt: (0, import_node_fs12.statSync)(file).mtimeMs, stopped: value.stopped === true };
 }
 function readInstalledRuntimeBuild(entry) {
   if (!entry || !import_node_path15.default.isAbsolute(entry)) return null;
@@ -10243,34 +10294,34 @@ function readInstalledRuntimeBuild(entry) {
       const root = entry.slice(0, index);
       const relative = entry.slice(index + marker.length).split(import_node_path15.default.sep).slice(1);
       const pointer = import_node_path15.default.join(root, "current.json");
-      if ((0, import_node_fs11.existsSync)(pointer)) {
-        const selected = JSON.parse((0, import_node_fs11.readFileSync)(pointer, "utf8"));
+      if ((0, import_node_fs12.existsSync)(pointer)) {
+        const selected = JSON.parse((0, import_node_fs12.readFileSync)(pointer, "utf8"));
         if (!/^[a-zA-Z0-9._-]+$/.test(selected.releaseId) || [".", ".."].includes(selected.releaseId)) return null;
         entry = import_node_path15.default.join(root, "releases", selected.releaseId, ...relative);
       }
     }
-    fd = (0, import_node_fs11.openSync)(entry, "r");
+    fd = (0, import_node_fs12.openSync)(entry, "r");
     const buffer = Buffer.alloc(8192);
-    const length = (0, import_node_fs11.readSync)(fd, buffer, 0, buffer.length, 0);
+    const length = (0, import_node_fs12.readSync)(fd, buffer, 0, buffer.length, 0);
     const match = buffer.subarray(0, length).toString("utf8").split("\n", 1)[0]?.match(/var __RUNWEAVE_BUILD_INFO__=(\{.*\});/);
     const metadata = import_node_path15.default.join(import_node_path15.default.dirname(entry), "release.json");
-    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_fs11.existsSync)(metadata) ? metadata : import_node_path15.default.join(import_node_path15.default.dirname(entry), "build-info.json"), "utf8"));
+    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_fs12.existsSync)(metadata) ? metadata : import_node_path15.default.join(import_node_path15.default.dirname(entry), "build-info.json"), "utf8"));
     return typeof value.version === "string" && typeof value.buildId === "string" ? value : null;
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) (0, import_node_fs11.closeSync)(fd);
+    if (fd !== void 0) (0, import_node_fs12.closeSync)(fd);
   }
 }
 
 // scripts/lib/backend-health-auth.mjs
 var import_node_net = require("node:net");
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_promises4 = __toESM(require("node:fs/promises"), 1);
 var import_node_path16 = __toESM(require("node:path"), 1);
-var import_node_child_process2 = require("node:child_process");
+var import_node_child_process4 = require("node:child_process");
 var import_node_util = require("node:util");
-var execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process4.execFile);
 var FILE_NAME = "backend-health-binding.json";
 async function readBackendHealthAuth(profileDir) {
   let handle;
@@ -10280,7 +10331,7 @@ async function readBackendHealthAuth(profileDir) {
       throw new Error("invalid Backend health profile directory");
     handle = await import_promises4.default.open(
       import_node_path16.default.join(profileDir, FILE_NAME),
-      import_node_fs12.constants.O_RDONLY | import_node_fs12.constants.O_NOFOLLOW
+      import_node_fs13.constants.O_RDONLY | import_node_fs13.constants.O_NOFOLLOW
     );
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > 16384 || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()) {
@@ -10333,7 +10384,7 @@ async function readHealthProfileLock(profileDir) {
   try {
     handle = await import_promises4.default.open(
       import_node_path16.default.join(profileDir, "backend.lock.json"),
-      import_node_fs12.constants.O_RDONLY | import_node_fs12.constants.O_NOFOLLOW
+      import_node_fs13.constants.O_RDONLY | import_node_fs13.constants.O_NOFOLLOW
     );
     const stat = await handle.stat();
     if (!stat.isFile() || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.() || stat.size > 65536) {
@@ -10494,7 +10545,7 @@ function isCanonicalLoopbackEndpoint(endpoint) {
 }
 
 // scripts/dev-session/services/runtime.mjs
-var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process3.execFile);
+var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process5.execFile);
 function isProcessLive2(pid) {
   try {
     process.kill(pid, 0);
@@ -10505,7 +10556,7 @@ function isProcessLive2(pid) {
 }
 function readProcessSignature2(pid) {
   try {
-    return (0, import_node_child_process3.execFileSync)(
+    return (0, import_node_child_process5.execFileSync)(
       "ps",
       ["-p", String(pid), "-o", "lstart=", "-o", "command="],
       {
@@ -10759,14 +10810,14 @@ async function reconcileBetaSessionServices(services) {
 }
 
 // scripts/dev-session/services/process-stop.mjs
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process6 = require("node:child_process");
 var GRACE_MS = 5e3;
 var FORCE_WAIT_MS = 2e3;
 var POLL_MS = 100;
 function readProcessGroupSnapshot() {
   let output;
   try {
-    output = (0, import_node_child_process4.execFileSync)("ps", ["-axo", "pid=,pgid=,stat="], {
+    output = (0, import_node_child_process6.execFileSync)("ps", ["-axo", "pid=,pgid=,stat="], {
       encoding: "utf8",
       timeout: 2e3
     });
@@ -10851,12 +10902,12 @@ async function stopOwnedProcess(processInfo) {
 }
 
 // scripts/dev-session/services/beta.mjs
-var import_node_child_process5 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_util3 = require("node:util");
-var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process5.execFile);
+var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process7.execFile);
 
 // scripts/dev-session/services/index.mjs
-var execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
+var execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process8.execFile);
 async function assertSessionServicesStoppable(services) {
   const inspection = await inspectSessionServices(services);
   const staleOwnedServices = [
@@ -11028,7 +11079,7 @@ var import_node_path23 = __toESM(require("node:path"), 1);
 
 // scripts/dev-session/beta-pool/storage/files.mjs
 var import_node_crypto8 = require("node:crypto");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_promises6 = __toESM(require("node:fs/promises"), 1);
 var import_node_path19 = __toESM(require("node:path"), 1);
 function sameFileIdentity2(left, right) {
@@ -11076,7 +11127,7 @@ async function readRegularJson(filePath, allowedRoot) {
   try {
     handle = await import_promises6.default.open(
       filePath,
-      import_node_fs13.constants.O_RDONLY | import_node_fs13.constants.O_NOFOLLOW
+      import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW
     );
     const before = await handle.stat();
     if (!before.isFile()) {
@@ -11101,7 +11152,7 @@ async function atomicWriteJson2(filePath, value, allowedRoot) {
   );
   const handle = await import_promises6.default.open(
     temporaryPath,
-    import_node_fs13.constants.O_WRONLY | import_node_fs13.constants.O_CREAT | import_node_fs13.constants.O_EXCL | import_node_fs13.constants.O_NOFOLLOW,
+    import_node_fs14.constants.O_WRONLY | import_node_fs14.constants.O_CREAT | import_node_fs14.constants.O_EXCL | import_node_fs14.constants.O_NOFOLLOW,
     384
   );
   try {
@@ -11292,12 +11343,12 @@ async function releaseBetaSlotRecoveryClaim(recoveryClaim, paths) {
 }
 
 // scripts/dev-session/beta-pool/storage/paths.mjs
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var import_node_os10 = __toESM(require("node:os"), 1);
 var import_node_path21 = __toESM(require("node:path"), 1);
 function isDirectory(filePath) {
   try {
-    return (0, import_node_fs14.lstatSync)(filePath).isDirectory();
+    return (0, import_node_fs15.lstatSync)(filePath).isDirectory();
   } catch {
     return false;
   }
@@ -12102,7 +12153,7 @@ async function resolveBetaSlotRetentionTargets(homeDir, slotId) {
 
 // scripts/dev-session/beta-pool/storage/index.mjs
 var import_node_crypto10 = require("node:crypto");
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_promises11 = __toESM(require("node:fs/promises"), 1);
 var import_node_os15 = __toESM(require("node:os"), 1);
 var import_node_path27 = __toESM(require("node:path"), 1);
@@ -12192,7 +12243,7 @@ async function recordBetaSlotRecoveryAttempt({
 }
 
 // scripts/dev-session/beta-pool/storage/index.mjs
-var execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
+var execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process9.execFile);
 var MAX_UPDATE_LOGS = 5;
 var MAX_UPDATE_LOG_BYTES = 64 * 1024 * 1024;
 var MIN_PLANNED_WRITE_BYTES = 512 * 1024 * 1024;
@@ -12618,7 +12669,7 @@ async function readManifestObservation(lease) {
   try {
     handle = await import_promises12.default.open(
       lease.ownerManifestPath,
-      import_node_fs15.constants.O_RDONLY | import_node_fs15.constants.O_NOFOLLOW
+      import_node_fs16.constants.O_RDONLY | import_node_fs16.constants.O_NOFOLLOW
     );
     const opened = await handle.stat();
     if (!opened.isFile()) {
@@ -13094,7 +13145,7 @@ function assertExpectedVersion(actual, expected) {
 }
 
 // scripts/dev-resources/snapshot.mjs
-var exec = (0, import_node_util6.promisify)(import_node_child_process8.execFile);
+var exec = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
 var pythonEntry = (0, import_node_url.fileURLToPath)(
   new URL("../ios-simulators/monitor.py", __IMPORT_META_URL__)
 );
@@ -13384,7 +13435,7 @@ async function inspectResources({ generation, backendPid }) {
 }
 
 // scripts/dev-resources/operations.mjs
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var import_node_os21 = __toESM(require("node:os"), 1);
 
 // scripts/dev-session/services/beta-start-recovery.mjs
@@ -13660,12 +13711,12 @@ async function finalizeBetaSlotRelease(options) {
 
 // scripts/dev-session/beta-pool/recovery/index.mjs
 var import_node_crypto13 = require("node:crypto");
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var import_promises14 = __toESM(require("node:fs/promises"), 1);
 var import_node_os19 = __toESM(require("node:os"), 1);
 var import_node_path31 = __toESM(require("node:path"), 1);
 var import_node_util7 = require("node:util");
-var execFileAsync6 = (0, import_node_util7.promisify)(import_node_child_process9.execFile);
+var execFileAsync6 = (0, import_node_util7.promisify)(import_node_child_process11.execFile);
 function sleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
@@ -14136,7 +14187,7 @@ async function recoverBetaPoolSlot({
 }
 
 // scripts/beta/operations.mjs
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_promises15 = __toESM(require("node:fs/promises"), 1);
 var import_node_path32 = __toESM(require("node:path"), 1);
 async function withBetaLock(paths, operation) {
@@ -14268,7 +14319,7 @@ async function quitBeta(paths) {
 }
 async function runAppServerCli(paths, command, sourceRevision = null) {
   const cliEntry = paths.controlCliPath;
-  if (!(0, import_node_fs16.existsSync)(cliEntry)) {
+  if (!(0, import_node_fs17.existsSync)(cliEntry)) {
     return { ok: false, code: 1, stderr: `missing CLI build: ${cliEntry}` };
   }
   return await runCapture(
@@ -14743,7 +14794,7 @@ async function releaseSimulator(request, context) {
   if (resource.release.action !== request.action)
     conflict("\u6E05\u7406\u6761\u4EF6\u5DF2\u53D8\u5316\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u65B0\u786E\u8BA4");
   return await new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process10.spawn)("python3", ["-B", pythonEntry, "release"], {
+    const child = (0, import_node_child_process12.spawn)("python3", ["-B", pythonEntry, "release"], {
       stdio: ["pipe", "pipe", "ignore"]
     });
     let stdout = "";