@runweave/server-linux-x64 0.1.6 → 0.1.7

package/payload/backend/dev-resources/control.cjs

@@ -106,17 +106,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path34) {
-      const ctrl = callVisitor(key, node, visitor, path34);
+    function visit_(key, node, visitor, path35) {
+      const ctrl = callVisitor(key, node, visitor, path35);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path34, ctrl);
-        return visit_(key, ctrl, visitor, path34);
+        replaceNode(key, path35, ctrl);
+        return visit_(key, ctrl, visitor, path35);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path34 = Object.freeze(path34.concat(node));
+          path35 = Object.freeze(path35.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path34);
+            const ci = visit_(i, node.items[i], visitor, path35);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -127,13 +127,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path34 = Object.freeze(path34.concat(node));
-          const ck = visit_("key", node.key, visitor, path34);
+          path35 = Object.freeze(path35.concat(node));
+          const ck = visit_("key", node.key, visitor, path35);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path34);
+          const cv = visit_("value", node.value, visitor, path35);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -154,17 +154,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path34) {
-      const ctrl = await callVisitor(key, node, visitor, path34);
+    async function visitAsync_(key, node, visitor, path35) {
+      const ctrl = await callVisitor(key, node, visitor, path35);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path34, ctrl);
-        return visitAsync_(key, ctrl, visitor, path34);
+        replaceNode(key, path35, ctrl);
+        return visitAsync_(key, ctrl, visitor, path35);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path34 = Object.freeze(path34.concat(node));
+          path35 = Object.freeze(path35.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path34);
+            const ci = await visitAsync_(i, node.items[i], visitor, path35);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -175,13 +175,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path34 = Object.freeze(path34.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path34);
+          path35 = Object.freeze(path35.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path35);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path34);
+          const cv = await visitAsync_("value", node.value, visitor, path35);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -208,23 +208,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path34) {
+    function callVisitor(key, node, visitor, path35) {
       if (typeof visitor === "function")
-        return visitor(key, node, path34);
+        return visitor(key, node, path35);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path34);
+        return visitor.Map?.(key, node, path35);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path34);
+        return visitor.Seq?.(key, node, path35);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path34);
+        return visitor.Pair?.(key, node, path35);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path34);
+        return visitor.Scalar?.(key, node, path35);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path34);
+        return visitor.Alias?.(key, node, path35);
       return void 0;
     }
-    function replaceNode(key, path34, node) {
-      const parent = path34[path34.length - 1];
+    function replaceNode(key, path35, node) {
+      const parent = path35[path35.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -832,10 +832,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path34, value) {
+    function collectionFromPath(schema, path35, value) {
       let v = value;
-      for (let i = path34.length - 1; i >= 0; --i) {
-        const k = path34[i];
+      for (let i = path35.length - 1; i >= 0; --i) {
+        const k = path35[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -854,7 +854,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path34) => path34 == null || typeof path34 === "object" && !!path34[Symbol.iterator]().next().done;
+    var isEmptyPath = (path35) => path35 == null || typeof path35 === "object" && !!path35[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -884,11 +884,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path34, value) {
-        if (isEmptyPath(path34))
+      addIn(path35, value) {
+        if (isEmptyPath(path35))
           this.add(value);
         else {
-          const [key, ...rest] = path34;
+          const [key, ...rest] = path35;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -902,8 +902,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path34) {
-        const [key, ...rest] = path34;
+      deleteIn(path35) {
+        const [key, ...rest] = path35;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -917,8 +917,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path34, keepScalar) {
-        const [key, ...rest] = path34;
+      getIn(path35, keepScalar) {
+        const [key, ...rest] = path35;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -936,8 +936,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path34) {
-        const [key, ...rest] = path34;
+      hasIn(path35) {
+        const [key, ...rest] = path35;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -947,8 +947,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path34, value) {
-        const [key, ...rest] = path34;
+      setIn(path35, value) {
+        const [key, ...rest] = path35;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3452,9 +3452,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path34, value) {
+      addIn(path35, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path34, value);
+          this.contents.addIn(path35, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3529,14 +3529,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path34) {
-        if (Collection.isEmptyPath(path34)) {
+      deleteIn(path35) {
+        if (Collection.isEmptyPath(path35)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path34) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path35) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3551,10 +3551,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path34, keepScalar) {
-        if (Collection.isEmptyPath(path34))
+      getIn(path35, keepScalar) {
+        if (Collection.isEmptyPath(path35))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path34, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path35, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3565,10 +3565,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path34) {
-        if (Collection.isEmptyPath(path34))
+      hasIn(path35) {
+        if (Collection.isEmptyPath(path35))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path34) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path35) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3585,13 +3585,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path34, value) {
-        if (Collection.isEmptyPath(path34)) {
+      setIn(path35, value) {
+        if (Collection.isEmptyPath(path35)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path34), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path35), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path34, value);
+          this.contents.setIn(path35, value);
         }
       }
       /**
@@ -5543,9 +5543,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path34) => {
+    visit.itemAtPath = (cst, path35) => {
       let item = cst;
-      for (const [field, index] of path34) {
+      for (const [field, index] of path35) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5554,23 +5554,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path34) => {
-      const parent = visit.itemAtPath(cst, path34.slice(0, -1));
-      const field = path34[path34.length - 1][0];
+    visit.parentCollection = (cst, path35) => {
+      const parent = visit.itemAtPath(cst, path35.slice(0, -1));
+      const field = path35[path35.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path34, item, visitor) {
-      let ctrl = visitor(item, path34);
+    function _visit(path35, item, visitor) {
+      let ctrl = visitor(item, path35);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path34.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path35.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5581,10 +5581,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path34);
+            ctrl = ctrl(item, path35);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path34) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path35) : ctrl;
     }
     exports2.visit = visit;
   }
@@ -7320,17 +7320,17 @@ var require_dist = __commonJS({
 
 // scripts/dev-resources/snapshot.mjs
 var import_promises13 = __toESM(require("node:fs/promises"), 1);
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 var import_node_os17 = __toESM(require("node:os"), 1);
 var import_node_child_process10 = require("node:child_process");
 var import_node_util6 = require("node:util");
 var import_node_url = require("node:url");
 
 // scripts/dev-session/beta-pool/projection.mjs
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_promises12 = __toESM(require("node:fs/promises"), 1);
 var import_node_os16 = __toESM(require("node:os"), 1);
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 
 // scripts/dev-session/contracts.mjs
 var import_node_path = __toESM(require("node:path"), 1);
@@ -7875,7 +7875,7 @@ async function releaseSessionPortLeases(root, ports, sessionId) {
 // scripts/dev-session/services/runtime.mjs
 var import_node_child_process5 = require("node:child_process");
 var import_promises5 = require("node:fs/promises");
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_util2 = require("node:util");
 
 // scripts/beta/state.mjs
@@ -8400,6 +8400,7 @@ __export(src_exports, {
   ConfigurationStore: () => ConfigurationStore,
   LOCAL_RUNTIME_STATUS_SOURCES: () => LOCAL_RUNTIME_STATUS_SOURCES,
   acquireConfigurationOwner: () => acquireConfigurationOwner,
+  activateWindowsServerRelease: () => activateWindowsServerRelease,
   assertNewStableInstallation: () => assertNewStableInstallation,
   assertOwnedPath: () => assertOwnedPath,
   assertPrivateDescriptor: () => assertPrivateDescriptor,
@@ -8437,6 +8438,7 @@ __export(src_exports, {
   redactConfiguration: () => redactConfiguration,
   registerStableConfigurationRoot: () => registerStableConfigurationRoot,
   researchMcpHome: () => researchMcpHome,
+  resolveActiveServerRelease: () => resolveActiveServerRelease,
   resolveConfigurationContext: () => resolveConfigurationContext,
   resolveConfigurationValue: () => resolveConfigurationValue,
   retainSelectedStorage: () => retainSelectedStorage,
@@ -9403,9 +9405,9 @@ var ConfigurationStore = class {
     return { source, document, value, digest: (0, import_node_crypto3.createHash)("sha256").update(source).digest("hex") };
   }
   prepareUpgrade() {
-    const { source, document, value, digest } = this.readUpgradeSource();
+    const { source, document, value, digest: digest2 } = this.readUpgradeSource();
     const original = value;
-    const expectedDigest = digest;
+    const expectedDigest = digest2;
     const steps = migrateConfigurationDocument(document);
     const next = parseConfigurationYaml(document.toString({ lineWidth: 0 }), this.context);
     const failures = Object.values(next.issues).flat();
@@ -9774,13 +9776,13 @@ function prepareMigration(context, sources) {
     assertMigrationSourceOwner(context, source.file);
     if (migratedDomains.has(source.domain)) continue;
     const raw = (0, import_node_fs8.readFileSync)(source.file, "utf8");
-    const digest = (0, import_node_crypto4.createHash)("sha256").update(raw).digest("hex");
+    const digest2 = (0, import_node_crypto4.createHash)("sha256").update(raw).digest("hex");
     const previous = byDomain.get(source.domain);
-    if (previous && previous !== digest) {
+    if (previous && previous !== digest2) {
       result.conflicts.push(source.domain);
       continue;
     }
-    byDomain.set(source.domain, digest);
+    byDomain.set(source.domain, digest2);
     const draft = emptyConfiguration(context);
     if (source.format === "env") importEnvironment(draft, parseEnvironmentFile(raw));
     else {
@@ -9848,8 +9850,8 @@ function prepareMigration(context, sources) {
       continue;
     }
     for (const [key, entry] of changes) setConfigurationValue(value, key, entry);
-    value.migrations[source.domain] = { id: `${source.domain}:${digest}`, sourceDigest: digest };
-    result.sources.push({ file: source.file, digest, domain: source.domain });
+    value.migrations[source.domain] = { id: `${source.domain}:${digest2}`, sourceDigest: digest2 };
+    result.sources.push({ file: source.file, digest: digest2, domain: source.domain });
   }
   const issues = validateDomains(value, context);
   const touched = new Set(result.sources.map((source) => domainForPath(source.domain)));
@@ -9999,8 +10001,8 @@ function retainSelectedStorage(context, selected, draft) {
     "logging.backendDirectory": import_node_path12.default.join(profile, "logs", "backend")
   };
   for (const [key, value] of Object.entries(retained)) if (readConfigurationPath(draft.value, key) == null) setConfigurationValue(draft.value, key, value);
-  const digest = (0, import_node_crypto5.createHash)("sha256").update(JSON.stringify(draft.value.storage)).digest("hex");
-  draft.value.migrations.storage = { id: `selected-profile:${digest}`, sourceDigest: digest };
+  const digest2 = (0, import_node_crypto5.createHash)("sha256").update(JSON.stringify(draft.value.storage)).digest("hex");
+  draft.value.migrations.storage = { id: `selected-profile:${digest2}`, sourceDigest: digest2 };
 }
 function selectedDirectory(context, directory2) {
   if (!import_node_path12.default.isAbsolute(directory2) || !(0, import_node_fs9.existsSync)(directory2) || !(0, import_node_fs9.statSync)(directory2).isDirectory()) throw new ConfigurationError("CONFIG_SOURCE_DIRECTORY_INVALID");
@@ -10314,11 +10316,50 @@ function readInstalledRuntimeBuild(entry) {
   }
 }
 
+// packages/config-node/src/server/active-release.ts
+var import_node_crypto8 = require("node:crypto");
+var import_node_fs13 = require("node:fs");
+var import_node_path16 = __toESM(require("node:path"), 1);
+function resolveActiveServerRelease(home) {
+  const pointer = import_node_path16.default.join(home, "active-release.json");
+  if (process.platform === "win32" && (0, import_node_fs13.existsSync)(pointer)) {
+    const value = JSON.parse(readPrivateFile(pointer, 16384));
+    if (value.schemaVersion !== 1 || !/^releases\/[a-zA-Z0-9._-]+$/.test(value.release) || !/^[a-f0-9]{64}$/.test(value.manifestDigest) || !value.transactionId)
+      throw new Error("SERVER_POINTER_INVALID");
+    const release2 = (0, import_node_fs13.realpathSync)(import_node_path16.default.join(home, value.release));
+    if (import_node_path16.default.dirname(release2) !== (0, import_node_fs13.realpathSync)(import_node_path16.default.join(home, "releases")) || digest(release2) !== value.manifestDigest)
+      throw new Error("SERVER_POINTER_INVALID");
+    return release2;
+  }
+  const legacy = import_node_path16.default.join(home, "current");
+  if (!(0, import_node_fs13.existsSync)(legacy)) return void 0;
+  const release = (0, import_node_fs13.realpathSync)(legacy);
+  if (import_node_path16.default.dirname(release) !== (0, import_node_fs13.realpathSync)(import_node_path16.default.join(home, "releases"))) throw new Error("SERVER_POINTER_INVALID");
+  return release;
+}
+function digest(release) {
+  return (0, import_node_crypto8.createHash)("sha256").update((0, import_node_fs13.readFileSync)(import_node_path16.default.join(release, "server-manifest.json"))).digest("hex");
+}
+function activateWindowsServerRelease(home, release, transactionId = (0, import_node_crypto8.randomUUID)()) {
+  release = (0, import_node_fs13.realpathSync)(release);
+  if (import_node_path16.default.dirname(release) !== (0, import_node_fs13.realpathSync)(import_node_path16.default.join(home, "releases"))) throw new Error("SERVER_POINTER_INVALID");
+  const pointer = import_node_path16.default.join(home, "active-release.json");
+  const temporary = `${pointer}.${(0, import_node_crypto8.randomUUID)()}`;
+  const fd = (0, import_node_fs13.openSync)(temporary, "wx", 384);
+  try {
+    (0, import_node_fs13.writeFileSync)(fd, JSON.stringify({ schemaVersion: 1, release: `releases/${import_node_path16.default.basename(release)}`, manifestDigest: digest(release), transactionId }) + "\n");
+    (0, import_node_fs13.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs13.closeSync)(fd);
+  }
+  (0, import_node_fs13.renameSync)(temporary, pointer);
+}
+
 // scripts/lib/backend-health-auth.mjs
 var import_node_net = require("node:net");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_promises4 = __toESM(require("node:fs/promises"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var import_node_child_process4 = require("node:child_process");
 var import_node_util = require("node:util");
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process4.execFile);
@@ -10330,8 +10371,8 @@ async function readBackendHealthAuth(profileDir) {
     if (!directory2.isDirectory() || directory2.isSymbolicLink())
       throw new Error("invalid Backend health profile directory");
     handle = await import_promises4.default.open(
-      import_node_path16.default.join(profileDir, FILE_NAME),
-      import_node_fs13.constants.O_RDONLY | import_node_fs13.constants.O_NOFOLLOW
+      import_node_path17.default.join(profileDir, FILE_NAME),
+      import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW
     );
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > 16384 || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()) {
@@ -10345,7 +10386,7 @@ async function readBackendHealthAuth(profileDir) {
     if (!(config.ownerDevSessionId === null || typeof config.ownerDevSessionId === "string") || typeof config.configRoot !== "string") throw new Error("invalid Backend health binding");
     const context = src_exports.resolveConfigurationContext({ args: ["--instance", config.ownerDevSessionId ?? "stable", "--config-dir", config.configRoot] });
     const snapshot = new src_exports.ConfigurationStore(context).read();
-    const ownedProfile = snapshot.value.storage?.browserProfileDirectory ?? import_node_path16.default.join(context.configRoot, "data", "backend");
+    const ownedProfile = snapshot.value.storage?.browserProfileDirectory ?? import_node_path17.default.join(context.configRoot, "data", "backend");
     if (src_exports.canonicalPath(profileDir) !== src_exports.canonicalPath(ownedProfile) || snapshot.issues["backend.tunnelAuth"]?.length) throw new Error("Backend health binding mismatch");
     const token = snapshot.value.backend?.tunnelAuth?.token ?? null;
     if (token !== null && typeof token !== "string") throw new Error("invalid Backend health credential");
@@ -10383,8 +10424,8 @@ async function readHealthProfileLock(profileDir) {
   let handle;
   try {
     handle = await import_promises4.default.open(
-      import_node_path16.default.join(profileDir, "backend.lock.json"),
-      import_node_fs13.constants.O_RDONLY | import_node_fs13.constants.O_NOFOLLOW
+      import_node_path17.default.join(profileDir, "backend.lock.json"),
+      import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW
     );
     const stat = await handle.stat();
     if (!stat.isFile() || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.() || stat.size > 65536) {
@@ -10503,7 +10544,7 @@ function healthListenerMatchesEndpoint(name, family, target) {
 }
 
 // scripts/dev-session/services/beta-reconciliation-paths.mjs
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 function resolveBetaReconciliationPaths(services) {
   const beta = services.beta;
   const pooledBeta = /^pool-0[1-5]$/.test(beta?.instanceId ?? "");
@@ -10522,7 +10563,7 @@ function resolveBetaReconciliationPaths(services) {
   } catch {
     return null;
   }
-  const homeDir = import_node_path17.default.resolve(beta.userDataDir, "../../../../..");
+  const homeDir = import_node_path18.default.resolve(beta.userDataDir, "../../../../..");
   const paths = resolveBetaPaths(
     beta.betaControl.cwd,
     homeDir,
@@ -10631,7 +10672,7 @@ async function inspectBackendHandshake(service) {
   }
   const health = await fetchHealthJson(
     `${service.url}/health`,
-    import_node_path18.default.dirname(service.lockPath)
+    import_node_path19.default.dirname(service.lockPath)
   );
   const expectedDevSessionId = service.ownerDevSessionId ?? null;
   if (health?.status !== "ok" || health.service !== "runweave-backend" || health.serviceInstanceId !== service.serviceInstanceId || (health.devSessionId ?? null) !== expectedDevSessionId || health.sourceRevision !== service.sourceRevision || health.resourceNamespace !== service.resourceNamespace || health.protocolVersion !== service.protocolVersion || !hasCapabilities(health.capabilities, service.capabilities)) {
@@ -10701,7 +10742,7 @@ async function reconcileBetaSessionServices(services) {
     readJson2(backend.lockPath),
     fetchHealthJson(
       `${status.backend.baseUrl}/health`,
-      import_node_path18.default.dirname(backend.lockPath)
+      import_node_path19.default.dirname(backend.lockPath)
     ),
     readJson2(appServer.lockPath),
     fetchHealthJson(`${status.appServer.baseUrl}/healthz`)
@@ -11075,18 +11116,18 @@ async function inspectSessionServices(services) {
 // scripts/dev-session/beta-pool/core.mjs
 var import_promises9 = __toESM(require("node:fs/promises"), 1);
 var import_node_os11 = __toESM(require("node:os"), 1);
-var import_node_path23 = __toESM(require("node:path"), 1);
+var import_node_path24 = __toESM(require("node:path"), 1);
 
 // scripts/dev-session/beta-pool/storage/files.mjs
-var import_node_crypto8 = require("node:crypto");
-var import_node_fs14 = require("node:fs");
+var import_node_crypto9 = require("node:crypto");
+var import_node_fs15 = require("node:fs");
 var import_promises6 = __toESM(require("node:fs/promises"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 function sameFileIdentity2(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
 async function ensureDirectory(directory2, allowedRoot) {
-  const root = import_node_path19.default.resolve(allowedRoot);
+  const root = import_node_path20.default.resolve(allowedRoot);
   const target = assertPathInside(root, directory2, "Beta pool directory");
   const existingRoot = await import_promises6.default.lstat(root).catch((error) => {
     if (error?.code === "ENOENT") {
@@ -11108,10 +11149,10 @@ async function ensureDirectory(directory2, allowedRoot) {
   }
   await import_promises6.default.chmod(root, 448);
   await import_promises6.default.mkdir(target, { recursive: true, mode: 448 });
-  const relative = import_node_path19.default.relative(root, target);
+  const relative = import_node_path20.default.relative(root, target);
   let current = root;
-  for (const component of relative ? relative.split(import_node_path19.default.sep) : []) {
-    current = import_node_path19.default.join(current, component);
+  for (const component of relative ? relative.split(import_node_path20.default.sep) : []) {
+    current = import_node_path20.default.join(current, component);
     const stats = await import_promises6.default.lstat(current);
     if (!stats.isDirectory() || stats.isSymbolicLink()) {
       throw new DevSessionError("Beta pool path must not contain symlinks", 4, {
@@ -11127,7 +11168,7 @@ async function readRegularJson(filePath, allowedRoot) {
   try {
     handle = await import_promises6.default.open(
       filePath,
-      import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW
+      import_node_fs15.constants.O_RDONLY | import_node_fs15.constants.O_NOFOLLOW
     );
     const before = await handle.stat();
     if (!before.isFile()) {
@@ -11144,15 +11185,15 @@ async function readRegularJson(filePath, allowedRoot) {
   }
 }
 async function atomicWriteJson2(filePath, value, allowedRoot) {
-  const directory2 = import_node_path19.default.dirname(filePath);
+  const directory2 = import_node_path20.default.dirname(filePath);
   await ensureDirectory(directory2, allowedRoot);
-  const temporaryPath = import_node_path19.default.join(
+  const temporaryPath = import_node_path20.default.join(
     directory2,
-    `.${import_node_path19.default.basename(filePath)}.${(0, import_node_crypto8.randomUUID)()}.tmp`
+    `.${import_node_path20.default.basename(filePath)}.${(0, import_node_crypto9.randomUUID)()}.tmp`
   );
   const handle = await import_promises6.default.open(
     temporaryPath,
-    import_node_fs14.constants.O_WRONLY | import_node_fs14.constants.O_CREAT | import_node_fs14.constants.O_EXCL | import_node_fs14.constants.O_NOFOLLOW,
+    import_node_fs15.constants.O_WRONLY | import_node_fs15.constants.O_CREAT | import_node_fs15.constants.O_EXCL | import_node_fs15.constants.O_NOFOLLOW,
     384
   );
   try {
@@ -11166,9 +11207,9 @@ async function atomicWriteJson2(filePath, value, allowedRoot) {
 }
 
 // scripts/dev-session/beta-pool/recovery/claim.mjs
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var import_promises7 = __toESM(require("node:fs/promises"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 var RECOVERY_CLAIM_SCHEMA_VERSION = 1;
 var RELEASE_GUARD_TIMEOUT_MS = 1e3;
 function validateRecoveryClaim(value, slotId) {
@@ -11188,7 +11229,7 @@ async function releaseTransitionGuard(guardPath, guardStats, slotId) {
 }
 async function withTransitionGuard(slotId, paths, waitForRelease, callback) {
   await ensureDirectory(paths.recoveryClaimsDir, paths.poolRoot);
-  const guardPath = import_node_path20.default.join(paths.recoveryClaimsDir, `.${slotId}.transition`);
+  const guardPath = import_node_path21.default.join(paths.recoveryClaimsDir, `.${slotId}.transition`);
   const deadline = Date.now() + RELEASE_GUARD_TIMEOUT_MS;
   for (; ; ) {
     try {
@@ -11218,7 +11259,7 @@ async function readClaimGeneration(claimPath, slotId, paths) {
     throw new Error("claim is not a regular directory");
   }
   const { value, stats: ownerStats } = await readRegularJson(
-    import_node_path20.default.join(claimPath, "owner.json"),
+    import_node_path21.default.join(claimPath, "owner.json"),
     paths.recoveryClaimsDir
   );
   const claim = validateRecoveryClaim(value, slotId);
@@ -11242,7 +11283,7 @@ function ownerIsProvenAbsent(claim) {
 }
 async function acquireBetaSlotRecoveryClaim(slotId, paths) {
   return await withTransitionGuard(slotId, paths, false, async () => {
-    const claimPath = import_node_path20.default.join(paths.recoveryClaimsDir, `${slotId}.lock`);
+    const claimPath = import_node_path21.default.join(paths.recoveryClaimsDir, `${slotId}.lock`);
     const existing = await import_promises7.default.lstat(claimPath).catch((error) => {
       if (error?.code === "ENOENT") return null;
       throw error;
@@ -11262,9 +11303,9 @@ async function acquireBetaSlotRecoveryClaim(slotId, paths) {
       if (!rechecked || !sameClaimGeneration(current, rechecked) || !ownerIsProvenAbsent(rechecked.claim)) {
         return null;
       }
-      const stalePath = import_node_path20.default.join(
+      const stalePath = import_node_path21.default.join(
         paths.recoveryClaimsDir,
-        `.${slotId}.${(0, import_node_crypto9.randomUUID)()}.stale`
+        `.${slotId}.${(0, import_node_crypto10.randomUUID)()}.stale`
       );
       await import_promises7.default.rename(claimPath, stalePath);
       const moved = await readClaimGeneration(stalePath, slotId, paths);
@@ -11280,20 +11321,20 @@ async function acquireBetaSlotRecoveryClaim(slotId, paths) {
     const claim = {
       schemaVersion: RECOVERY_CLAIM_SCHEMA_VERSION,
       slotId,
-      claimNonce: (0, import_node_crypto9.randomUUID)(),
+      claimNonce: (0, import_node_crypto10.randomUUID)(),
       pid: process.pid,
       processSignature: readProcessSignature2(process.pid),
       acquiredAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     validateRecoveryClaim(claim, slotId);
-    const candidatePath = import_node_path20.default.join(
+    const candidatePath = import_node_path21.default.join(
       paths.recoveryClaimsDir,
       `.${slotId}.${claim.claimNonce}.tmp`
     );
     await import_promises7.default.mkdir(candidatePath, { mode: 448 });
     try {
       await atomicWriteJson2(
-        import_node_path20.default.join(candidatePath, "owner.json"),
+        import_node_path21.default.join(candidatePath, "owner.json"),
         claim,
         candidatePath
       );
@@ -11316,7 +11357,7 @@ async function acquireBetaSlotRecoveryClaim(slotId, paths) {
 async function releaseBetaSlotRecoveryClaim(recoveryClaim, paths) {
   const slotId = recoveryClaim.claim.slotId;
   return await withTransitionGuard(slotId, paths, true, async () => {
-    const claimPath = import_node_path20.default.join(paths.recoveryClaimsDir, `${slotId}.lock`);
+    const claimPath = import_node_path21.default.join(paths.recoveryClaimsDir, `${slotId}.lock`);
     const current = await readClaimGeneration(claimPath, slotId, paths);
     if (recoveryClaim.claimPath !== claimPath || !sameClaimGeneration(recoveryClaim, current) || current.claim.pid !== process.pid || current.claim.processSignature !== readProcessSignature2(process.pid)) {
       throw new DevSessionError(
@@ -11325,7 +11366,7 @@ async function releaseBetaSlotRecoveryClaim(recoveryClaim, paths) {
         { slotId }
       );
     }
-    const releasedPath = import_node_path20.default.join(
+    const releasedPath = import_node_path21.default.join(
       paths.recoveryClaimsDir,
       `.${slotId}.${current.claim.claimNonce}.released`
     );
@@ -11343,12 +11384,12 @@ async function releaseBetaSlotRecoveryClaim(recoveryClaim, paths) {
 }
 
 // scripts/dev-session/beta-pool/storage/paths.mjs
-var import_node_fs15 = require("node:fs");
+var import_node_fs16 = require("node:fs");
 var import_node_os10 = __toESM(require("node:os"), 1);
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 function isDirectory(filePath) {
   try {
-    return (0, import_node_fs15.lstatSync)(filePath).isDirectory();
+    return (0, import_node_fs16.lstatSync)(filePath).isDirectory();
   } catch {
     return false;
   }
@@ -11358,11 +11399,11 @@ function buildPoolPaths(root, betaRoot, extra = {}) {
     ...extra,
     betaRoot,
     poolRoot: root,
-    leasesDir: import_node_path21.default.join(root, "leases"),
-    recoveryClaimsDir: import_node_path21.default.join(root, "recovery-claims"),
-    metadataDir: import_node_path21.default.join(root, "metadata"),
-    quarantineDir: import_node_path21.default.join(root, "quarantine"),
-    legacyInstancesQuarantineDir: import_node_path21.default.join(
+    leasesDir: import_node_path22.default.join(root, "leases"),
+    recoveryClaimsDir: import_node_path22.default.join(root, "recovery-claims"),
+    metadataDir: import_node_path22.default.join(root, "metadata"),
+    quarantineDir: import_node_path22.default.join(root, "quarantine"),
+    legacyInstancesQuarantineDir: import_node_path22.default.join(
       root,
       "quarantine",
       "legacy-instances"
@@ -11370,23 +11411,23 @@ function buildPoolPaths(root, betaRoot, extra = {}) {
   };
 }
 function resolveBetaPoolStoragePaths(homeDir = import_node_os10.default.homedir()) {
-  const controlRoot = import_node_path21.default.join(homeDir, ".runweave");
-  const canonicalPoolRoot = import_node_path21.default.join(controlRoot, "beta-pool");
-  const legacyBetaRoot = import_node_path21.default.join(
+  const controlRoot = import_node_path22.default.join(homeDir, ".runweave");
+  const canonicalPoolRoot = import_node_path22.default.join(controlRoot, "beta-pool");
+  const legacyBetaRoot = import_node_path22.default.join(
     homeDir,
     "Library",
     "Application Support",
     "Runweave Beta"
   );
-  const legacyPoolRoot = import_node_path21.default.join(legacyBetaRoot, "pool");
+  const legacyPoolRoot = import_node_path22.default.join(legacyBetaRoot, "pool");
   return {
     homeDir,
     controlRoot,
     canonicalPoolRoot,
     legacyBetaRoot,
     legacyPoolRoot,
-    migrationRoot: import_node_path21.default.join(controlRoot, "beta-pool-migrations"),
-    migrationLockPath: import_node_path21.default.join(controlRoot, ".beta-pool-migration.lock")
+    migrationRoot: import_node_path22.default.join(controlRoot, "beta-pool-migrations"),
+    migrationLockPath: import_node_path22.default.join(controlRoot, ".beta-pool-migration.lock")
   };
 }
 function resolveCanonicalBetaPoolPaths(homeDir = import_node_os10.default.homedir()) {
@@ -11417,7 +11458,7 @@ function resolveEffectiveBetaPoolPaths(homeDir = import_node_os10.default.homedi
 
 // scripts/dev-session/beta-pool/storage/support.mjs
 var import_promises8 = __toESM(require("node:fs/promises"), 1);
-var import_node_path22 = __toESM(require("node:path"), 1);
+var import_node_path23 = __toESM(require("node:path"), 1);
 var STORAGE_SCHEMA_VERSION = 1;
 var STORAGE_KIND = "beta-pool-control-plane-v1";
 async function lstat2(filePath) {
@@ -11455,7 +11496,7 @@ async function inspectLegacyActivity(paths) {
   } else {
     for (const entry of leaseEntries) {
       blockers.push(`legacy-lease:${entry}`);
-      const lease = await readJson3(import_node_path22.default.join(paths.leasesDir, entry));
+      const lease = await readJson3(import_node_path23.default.join(paths.leasesDir, entry));
       if (lease?.ownerSessionId) {
         owners.push({
           slotId: lease.slotId ?? entry.replace(/\.lock$/, ""),
@@ -11492,7 +11533,7 @@ async function inspectBetaPoolStorage({ homeDir } = {}) {
   const storage = resolveBetaPoolStoragePaths(homeDir);
   const canonicalStats = await lstat2(storage.canonicalPoolRoot);
   const canonicalDirectory = canonicalStats?.isDirectory() ?? false;
-  const canonicalMarker = canonicalDirectory ? await readJson3(import_node_path22.default.join(storage.canonicalPoolRoot, "storage.json")) : null;
+  const canonicalMarker = canonicalDirectory ? await readJson3(import_node_path23.default.join(storage.canonicalPoolRoot, "storage.json")) : null;
   if (canonicalStats?.isSymbolicLink()) {
     return storageDetails(storage, "conflict", ["canonical-root-symlink"]);
   }
@@ -11578,7 +11619,7 @@ async function findPendingMigrations(storage) {
   }
   const pending = [];
   for (const entry of entries) {
-    const journalPath = import_node_path22.default.join(storage.migrationRoot, entry, "journal.json");
+    const journalPath = import_node_path23.default.join(storage.migrationRoot, entry, "journal.json");
     const journal = await readJson3(journalPath);
     if (journal?.schemaVersion === 1 && journal.migrationId === entry && !["completed", "rolled_back"].includes(journal.state)) {
       pending.push(journal);
@@ -11650,7 +11691,7 @@ function isPidLive2(pid) {
   }
 }
 function validateBetaSlotLease(value, slotId) {
-  const valid = value?.schemaVersion === LEASE_SCHEMA_VERSION && value.slotId === slotId && typeof value.leaseNonce === "string" && value.leaseNonce.length > 0 && typeof value.ownerSessionId === "string" && typeof value.ownerSourceRoot === "string" && import_node_path23.default.isAbsolute(value.ownerSourceRoot) && typeof value.ownerRevision === "string" && typeof value.ownerManifestPath === "string" && import_node_path23.default.isAbsolute(value.ownerManifestPath) && Number.isInteger(value.allocatorPid) && value.allocatorPid > 0 && typeof value.acquiredAt === "string" && Number.isFinite(Date.parse(value.acquiredAt));
+  const valid = value?.schemaVersion === LEASE_SCHEMA_VERSION && value.slotId === slotId && typeof value.leaseNonce === "string" && value.leaseNonce.length > 0 && typeof value.ownerSessionId === "string" && typeof value.ownerSourceRoot === "string" && import_node_path24.default.isAbsolute(value.ownerSourceRoot) && typeof value.ownerRevision === "string" && typeof value.ownerManifestPath === "string" && import_node_path24.default.isAbsolute(value.ownerManifestPath) && Number.isInteger(value.allocatorPid) && value.allocatorPid > 0 && typeof value.acquiredAt === "string" && Number.isFinite(Date.parse(value.acquiredAt));
   if (!valid) {
     throw new DevSessionError("Beta slot lease is corrupt or unsupported", 5, {
       slotId,
@@ -11660,7 +11701,7 @@ function validateBetaSlotLease(value, slotId) {
   return value;
 }
 async function inspectSlot(slotId, paths) {
-  const leasePath = import_node_path23.default.join(paths.leasesDir, `${slotId}.lock`);
+  const leasePath = import_node_path24.default.join(paths.leasesDir, `${slotId}.lock`);
   try {
     const { value } = await readRegularJson(leasePath, paths.poolRoot);
     const lease = validateBetaSlotLease(value, slotId);
@@ -11740,7 +11781,7 @@ async function assertBetaSlotLease({
 }) {
   assertBetaSlotId(slotId);
   const paths = resolveBetaPoolPaths(homeDir);
-  const leasePath = import_node_path23.default.join(paths.leasesDir, `${slotId}.lock`);
+  const leasePath = import_node_path24.default.join(paths.leasesDir, `${slotId}.lock`);
   let read;
   try {
     read = await readRegularJson(leasePath, paths.poolRoot);
@@ -11778,20 +11819,20 @@ async function releaseBetaSlotLease(identity) {
 
 // scripts/dev-session/beta-pool/process-inspection.mjs
 var import_node_os12 = __toESM(require("node:os"), 1);
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
 async function inspectBetaSlotProcessSafety(slotId, homeDir = import_node_os12.default.homedir()) {
   const targets = resolveBetaUpdateTargets(homeDir, slotId);
   const [desktop, backend, appServer, references] = await Promise.all([
     inspectRecordedProcessState(
-      import_node_path24.default.join(targets.userData, "beta-desktop-status.json"),
+      import_node_path25.default.join(targets.userData, "beta-desktop-status.json"),
       ["app", "pid"]
     ),
     inspectRecordedProcessState(
-      import_node_path24.default.join(targets.userData, "browser-profile", "backend.lock.json"),
+      import_node_path25.default.join(targets.userData, "browser-profile", "backend.lock.json"),
       ["pid"]
     ),
     inspectRecordedProcessState(
-      import_node_path24.default.join(targets.appServerHome, "app-server.lock.json"),
+      import_node_path25.default.join(targets.appServerHome, "app-server.lock.json"),
       ["pid"]
     ),
     inspectProcessReferences([
@@ -11825,7 +11866,7 @@ async function betaSlotProcessesAreAbsent(slotId, homeDir = import_node_os12.def
 // scripts/dev-session/beta-pool/retention.mjs
 var import_promises10 = __toESM(require("node:fs/promises"), 1);
 var import_node_os13 = __toESM(require("node:os"), 1);
-var import_node_path25 = __toESM(require("node:path"), 1);
+var import_node_path26 = __toESM(require("node:path"), 1);
 async function lstatOptional(targetPath) {
   try {
     return await import_promises10.default.lstat(targetPath);
@@ -11843,8 +11884,8 @@ function retentionStateError(message, details) {
   });
 }
 async function validateBetaRuntimeReleaseAllowlist(runtimeHome, previousReleaseId) {
-  const pointerPath = import_node_path25.default.join(runtimeHome, "current.json");
-  const releasesDir = import_node_path25.default.join(runtimeHome, "releases");
+  const pointerPath = import_node_path26.default.join(runtimeHome, "current.json");
+  const releasesDir = import_node_path26.default.join(runtimeHome, "releases");
   const pointerExists = await lstatOptional(pointerPath);
   const releasesExist = await lstatOptional(releasesDir);
   if (!pointerExists && !releasesExist) {
@@ -11886,7 +11927,7 @@ async function validateBetaRuntimeReleaseAllowlist(runtimeHome, previousReleaseI
     allowlist.add(previousReleaseId);
   }
   for (const releaseId of allowlist) {
-    const releasePath = import_node_path25.default.join(releasesDir, releaseId);
+    const releasePath = import_node_path26.default.join(releasesDir, releaseId);
     const stats = await lstatOptional(releasePath);
     if (!stats || !stats.isDirectory() || stats.isSymbolicLink()) {
       throw retentionStateError(
@@ -11924,7 +11965,7 @@ async function readBetaSlotWarmState(targets, slotId) {
   }
 }
 async function readEffectiveWarmState(targets, slotId) {
-  const pendingPath = import_node_path25.default.join(
+  const pendingPath = import_node_path26.default.join(
     targets.instanceRoot,
     "diagnostics",
     "pending.json"
@@ -11973,7 +12014,7 @@ async function validateAppBackupReferences({
   applicationsDir
 }) {
   const referencedBackup = state?.previous?.app?.backupPath ?? null;
-  const backupPrefix = import_node_path25.default.basename(
+  const backupPrefix = import_node_path26.default.basename(
     resolveBetaAppBackupPrefix(slotId, applicationsDir)
   );
   const isRollbackEntry = (entry) => entry === backupPrefix || entry.startsWith(`${backupPrefix}-`) && /^\d+$/.test(entry.slice(backupPrefix.length + 1));
@@ -11987,8 +12028,8 @@ async function validateAppBackupReferences({
     }
     applicationEntries = [];
   }
-  const backupPaths = applicationEntries.filter(isRollbackEntry).map((entry) => import_node_path25.default.join(applicationsDir, entry));
-  const legacyBackupPaths = applicationEntries.filter((entry) => entry.startsWith(legacyBackupPrefix)).map((entry) => import_node_path25.default.join(applicationsDir, entry));
+  const backupPaths = applicationEntries.filter(isRollbackEntry).map((entry) => import_node_path26.default.join(applicationsDir, entry));
+  const legacyBackupPaths = applicationEntries.filter((entry) => entry.startsWith(legacyBackupPrefix)).map((entry) => import_node_path26.default.join(applicationsDir, entry));
   const allBackupPaths = [...backupPaths, ...legacyBackupPaths];
   if (allBackupPaths.length > 0 && !referencedBackup) {
     throw retentionStateError("Beta app previous pointer is missing", {
@@ -11998,8 +12039,8 @@ async function validateAppBackupReferences({
   }
   let referenceKind = null;
   if (referencedBackup && state?.previous?.app?.exists === true) {
-    const resolvedBackup = import_node_path25.default.resolve(referencedBackup);
-    if (import_node_path25.default.basename(referencedBackup).startsWith(legacyBackupPrefix)) {
+    const resolvedBackup = import_node_path26.default.resolve(referencedBackup);
+    if (import_node_path26.default.basename(referencedBackup).startsWith(legacyBackupPrefix)) {
       if (!legacyBackupPaths.includes(resolvedBackup)) {
         throw retentionStateError(
           "Beta legacy app previous pointer is invalid",
@@ -12009,8 +12050,8 @@ async function validateAppBackupReferences({
           }
         );
       }
-      const suffix = import_node_path25.default.basename(resolvedBackup).slice(legacyBackupPrefix.length);
-      const migratedBackup = import_node_path25.default.join(
+      const suffix = import_node_path26.default.basename(resolvedBackup).slice(legacyBackupPrefix.length);
+      const migratedBackup = import_node_path26.default.join(
         applicationsDir,
         `${backupPrefix}${suffix}`
       );
@@ -12021,7 +12062,7 @@ async function validateAppBackupReferences({
         });
       }
       referenceKind = "legacy";
-    } else if (!backupPaths.includes(resolvedBackup) || !import_node_path25.default.basename(referencedBackup).startsWith(backupPrefix)) {
+    } else if (!backupPaths.includes(resolvedBackup) || !import_node_path26.default.basename(referencedBackup).startsWith(backupPrefix)) {
       throw retentionStateError("Beta app previous pointer is invalid", {
         slotId,
         referencedBackup
@@ -12051,7 +12092,7 @@ async function validateBetaSlotRetentionState({
   const [desktopAllowlist, appServerAllowlist] = await Promise.all([
     validateBetaRuntimeReleaseAllowlist(targets.runtimeHome, desktopPrevious),
     validateBetaRuntimeReleaseAllowlist(
-      import_node_path25.default.join(targets.appServerHome, "runtime"),
+      import_node_path26.default.join(targets.appServerHome, "runtime"),
       appServerPrevious
     )
   ]);
@@ -12070,7 +12111,7 @@ async function validateBetaSlotRetentionState({
   };
 }
 async function assertNoBetaSlotSymlinkComponents(rootPath, targetPath) {
-  const root = import_node_path25.default.resolve(rootPath);
+  const root = import_node_path26.default.resolve(rootPath);
   const target = assertPathInside(root, targetPath, "Beta controlled path");
   const rootStats = await import_promises10.default.lstat(root).catch((error) => {
     if (error?.code === "ENOENT") {
@@ -12084,11 +12125,11 @@ async function assertNoBetaSlotSymlinkComponents(rootPath, targetPath) {
     });
   }
   let current = root;
-  for (const component of import_node_path25.default.relative(root, target).split(import_node_path25.default.sep)) {
+  for (const component of import_node_path26.default.relative(root, target).split(import_node_path26.default.sep)) {
     if (!component) {
       continue;
     }
-    current = import_node_path25.default.join(current, component);
+    current = import_node_path26.default.join(current, component);
     const stats = await import_promises10.default.lstat(current).catch((error) => {
       if (error?.code === "ENOENT") {
         return null;
@@ -12114,8 +12155,8 @@ async function inspectBetaSlotRetentionSafety({
     const targets = await resolveBetaSlotRetentionTargets(homeDir, slotId);
     await assertNoBetaSlotSymlinkComponents(homeDir, targets.runtimeHome);
     await assertNoBetaSlotSymlinkComponents(
-      import_node_path25.default.join(homeDir, ".runweave"),
-      import_node_path25.default.join(targets.appServerHome, "runtime")
+      import_node_path26.default.join(homeDir, ".runweave"),
+      import_node_path26.default.join(targets.appServerHome, "runtime")
     );
     const effective = await readEffectiveWarmState(targets, slotId);
     await validateBetaSlotRetentionState({
@@ -12152,16 +12193,16 @@ async function resolveBetaSlotRetentionTargets(homeDir, slotId) {
 }
 
 // scripts/dev-session/beta-pool/storage/index.mjs
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var import_node_child_process9 = require("node:child_process");
 var import_promises11 = __toESM(require("node:fs/promises"), 1);
 var import_node_os15 = __toESM(require("node:os"), 1);
-var import_node_path27 = __toESM(require("node:path"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 var import_node_util5 = require("node:util");
 
 // scripts/dev-session/beta-pool/metadata.mjs
 var import_node_os14 = __toESM(require("node:os"), 1);
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 async function recordBetaSlotRelease({
   slotId,
   revision,
@@ -12171,7 +12212,7 @@ async function recordBetaSlotRelease({
   homeDir = import_node_os14.default.homedir()
 }) {
   const paths = resolveBetaPoolPaths(homeDir);
-  const metadataPath = import_node_path26.default.join(
+  const metadataPath = import_node_path27.default.join(
     paths.metadataDir,
     `${assertBetaSlotId(slotId)}.json`
   );
@@ -12200,7 +12241,7 @@ async function readBetaSlotMetadata(slotId, { homeDir = import_node_os14.default
   const paths = resolveBetaPoolPaths(homeDir);
   try {
     const { value } = await readRegularJson(
-      import_node_path26.default.join(paths.metadataDir, `${assertBetaSlotId(slotId)}.json`),
+      import_node_path27.default.join(paths.metadataDir, `${assertBetaSlotId(slotId)}.json`),
       paths.poolRoot
     );
     if (!value || typeof value !== "object" || ![1, 2].includes(value.schemaVersion) || value.slotId !== slotId) {
@@ -12227,7 +12268,7 @@ async function recordBetaSlotRecoveryAttempt({
   const current = await readBetaSlotMetadata(slotId, { homeDir });
   const paths = resolveBetaPoolPaths(homeDir);
   await atomicWriteJson2(
-    import_node_path26.default.join(paths.metadataDir, `${assertBetaSlotId(slotId)}.json`),
+    import_node_path27.default.join(paths.metadataDir, `${assertBetaSlotId(slotId)}.json`),
     {
       ...current ?? {},
       schemaVersion: 2,
@@ -12250,7 +12291,7 @@ var MIN_PLANNED_WRITE_BYTES = 512 * 1024 * 1024;
 var BACKEND_CONNECTION_SETTINGS_FILES = ["agent-provider-catalogs.json"];
 var LAUNCH_SERVICES_REGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
 async function unregisterApplicationPath(appPath, applicationsDir) {
-  if (process.platform !== "darwin" || import_node_path27.default.resolve(applicationsDir) !== "/Applications") {
+  if (process.platform !== "darwin" || import_node_path28.default.resolve(applicationsDir) !== "/Applications") {
     return false;
   }
   return await execFileAsync5(LAUNCH_SERVICES_REGISTER, ["-u", appPath]).then(() => true).catch(() => false);
@@ -12278,19 +12319,19 @@ async function calculatePathBytes(targetPath, rejectSymlink = true) {
   }
   let bytes = 0;
   for (const entry of await import_promises11.default.readdir(targetPath)) {
-    bytes += await calculatePathBytes(import_node_path27.default.join(targetPath, entry), false);
+    bytes += await calculatePathBytes(import_node_path28.default.join(targetPath, entry), false);
   }
   return bytes;
 }
 async function pruneRuntime(runtimeHome, previousReleaseId, validated = null) {
-  const releasesDir = import_node_path27.default.join(runtimeHome, "releases");
+  const releasesDir = import_node_path28.default.join(runtimeHome, "releases");
   const allowlist = validated ?? await validateBetaRuntimeReleaseAllowlist(runtimeHome, previousReleaseId);
   let cleanedBytes = 0;
   for (const entry of await import_promises11.default.readdir(releasesDir).catch(() => [])) {
     if (allowlist.has(entry)) {
       continue;
     }
-    const target = import_node_path27.default.join(releasesDir, entry);
+    const target = import_node_path28.default.join(releasesDir, entry);
     cleanedBytes += await calculatePathBytes(target);
     await import_promises11.default.rm(target, { recursive: true, force: true });
   }
@@ -12301,13 +12342,13 @@ async function collectSharedRuntimeReleaseReferences(homeDir, slotId, runtimeHom
   for (const otherSlotId of BETA_SLOT_IDS) {
     if (otherSlotId === slotId) continue;
     const otherTargets = await resolveBetaSlotRetentionTargets(homeDir, otherSlotId);
-    if (import_node_path27.default.resolve(resolveRuntimeHome(otherTargets)) !== import_node_path27.default.resolve(runtimeHome)) continue;
+    if (import_node_path28.default.resolve(resolveRuntimeHome(otherTargets)) !== import_node_path28.default.resolve(runtimeHome)) continue;
     const otherState = await readBetaSlotWarmState(otherTargets, otherSlotId);
     if (otherState?.[releaseField]) retained.add(otherState[releaseField]);
     if (otherState?.devSessionId === otherState?.previous?.devSessionId && otherState?.previous?.[releaseField]) {
       retained.add(otherState.previous[releaseField]);
     }
-    const pendingPath = import_node_path27.default.join(otherTargets.instanceRoot, "diagnostics", "pending.json");
+    const pendingPath = import_node_path28.default.join(otherTargets.instanceRoot, "diagnostics", "pending.json");
     const pendingStats = await import_promises11.default.lstat(pendingPath).catch((error) => {
       if (error?.code === "ENOENT") return null;
       throw error;
@@ -12330,7 +12371,7 @@ async function collectSharedRuntimeReleaseReferences(homeDir, slotId, runtimeHom
 async function pruneLogs(logDir) {
   const entries = [];
   for (const entry of await import_promises11.default.readdir(logDir).catch(() => [])) {
-    const filePath = import_node_path27.default.join(logDir, entry);
+    const filePath = import_node_path28.default.join(logDir, entry);
     const stats = await import_promises11.default.lstat(filePath);
     if (stats.isFile() && !stats.isSymbolicLink()) {
       entries.push({ filePath, mtimeMs: stats.mtimeMs, size: stats.size });
@@ -12353,7 +12394,7 @@ async function pruneArtifacts(artifactsRoot, allowlist) {
     const artifactMatch = /^runweave-runtime-(.+?)(?:\.zip)?$/.exec(entry);
     const releaseId = artifactMatch?.[1] ?? entry;
     if (allowlist.has(releaseId)) continue;
-    const target = import_node_path27.default.join(artifactsRoot, entry);
+    const target = import_node_path28.default.join(artifactsRoot, entry);
     cleanedBytes += await calculatePathBytes(target);
     await import_promises11.default.rm(target, { recursive: true, force: true });
   }
@@ -12367,10 +12408,10 @@ async function applyBetaSlotRetention({
   const targets = await resolveBetaSlotRetentionTargets(homeDir, slotId);
   await assertNoBetaSlotSymlinkComponents(homeDir, targets.runtimeHome);
   await assertNoBetaSlotSymlinkComponents(
-    import_node_path27.default.join(homeDir, ".runweave"),
-    import_node_path27.default.join(targets.appServerHome, "runtime")
+    import_node_path28.default.join(homeDir, ".runweave"),
+    import_node_path28.default.join(targets.appServerHome, "runtime")
   );
-  const pendingPath = import_node_path27.default.join(
+  const pendingPath = import_node_path28.default.join(
     targets.instanceRoot,
     "diagnostics",
     "pending.json"
@@ -12428,9 +12469,9 @@ async function applyBetaSlotRetention({
   let appBackupMigrated = false;
   let launchServicesUnregistered = 0;
   if (referenceKind === "legacy") {
-    const resolvedLegacyBackup = import_node_path27.default.resolve(referencedBackup);
-    const suffix = import_node_path27.default.basename(resolvedLegacyBackup).slice(legacyBackupPrefix.length);
-    const migratedBackup = import_node_path27.default.join(
+    const resolvedLegacyBackup = import_node_path28.default.resolve(referencedBackup);
+    const suffix = import_node_path28.default.basename(resolvedLegacyBackup).slice(legacyBackupPrefix.length);
+    const migratedBackup = import_node_path28.default.join(
       applicationsDir,
       `${backupPrefix}${suffix}`
     );
@@ -12454,15 +12495,15 @@ async function applyBetaSlotRetention({
     referencedBackup = migratedBackup;
     backupPaths.push(migratedBackup);
     legacyBackupPaths = legacyBackupPaths.filter(
-      (entry) => import_node_path27.default.resolve(entry) !== resolvedLegacyBackup
+      (entry) => import_node_path28.default.resolve(entry) !== resolvedLegacyBackup
     );
     appBackupMigrated = true;
   }
   const allBackupPaths = [...backupPaths, ...legacyBackupPaths];
-  const appServerRuntimeHome = import_node_path27.default.join(targets.appServerHome, "runtime");
+  const appServerRuntimeHome = import_node_path28.default.join(targets.appServerHome, "runtime");
   const [sharedDesktopAllowlist, sharedAppServerAllowlist] = await Promise.all([
     collectSharedRuntimeReleaseReferences(homeDir, slotId, targets.runtimeHome, desktopAllowlist, "runtimeReleaseId", (other) => other.runtimeHome),
-    collectSharedRuntimeReleaseReferences(homeDir, slotId, appServerRuntimeHome, appServerAllowlist, "appServerReleaseId", (other) => import_node_path27.default.join(other.appServerHome, "runtime"))
+    collectSharedRuntimeReleaseReferences(homeDir, slotId, appServerRuntimeHome, appServerAllowlist, "appServerReleaseId", (other) => import_node_path28.default.join(other.appServerHome, "runtime"))
   ]);
   const [desktopRuntime, appServerRuntime, logs] = await Promise.all([
     pruneRuntime(targets.runtimeHome, desktopPrevious, sharedDesktopAllowlist),
@@ -12471,16 +12512,16 @@ async function applyBetaSlotRetention({
       appServerPrevious,
       sharedAppServerAllowlist
     ),
-    pruneLogs(import_node_path27.default.join(targets.instanceRoot, "diagnostics", "logs"))
+    pruneLogs(import_node_path28.default.join(targets.instanceRoot, "diagnostics", "logs"))
   ]);
-  const artifactsRoot = import_node_path27.default.join(targets.instanceRoot, "runtime-artifacts");
+  const artifactsRoot = import_node_path28.default.join(targets.instanceRoot, "runtime-artifacts");
   const artifacts = await pruneArtifacts(artifactsRoot, desktopAllowlist);
   let appBackupCleanedBytes = 0;
   for (const backupPath of allBackupPaths) {
-    if (referencedBackup && import_node_path27.default.resolve(backupPath) === import_node_path27.default.resolve(referencedBackup)) {
+    if (referencedBackup && import_node_path28.default.resolve(backupPath) === import_node_path28.default.resolve(referencedBackup)) {
       continue;
     }
-    if (import_node_path27.default.basename(backupPath).startsWith(legacyBackupPrefix) && await unregisterApplicationPath(backupPath, applicationsDir)) {
+    if (import_node_path28.default.basename(backupPath).startsWith(legacyBackupPrefix) && await unregisterApplicationPath(backupPath, applicationsDir)) {
       launchServicesUnregistered += 1;
     }
     appBackupCleanedBytes += await calculatePathBytes(backupPath);
@@ -12514,7 +12555,7 @@ async function assertSafeMutableRoot(targetPath, allowedRoot) {
 async function readBackendConnectionSettings(userData, instanceRoot) {
   const files = [];
   for (const fileName of BACKEND_CONNECTION_SETTINGS_FILES) {
-    const filePath = import_node_path27.default.join(userData, "browser-profile", fileName);
+    const filePath = import_node_path28.default.join(userData, "browser-profile", fileName);
     await assertNoBetaSlotSymlinkComponents(instanceRoot, filePath);
     const stats = await import_promises11.default.lstat(filePath).catch((error) => {
       if (error?.code === "ENOENT") {
@@ -12540,10 +12581,10 @@ async function restoreBackendConnectionSettings(userData, files) {
   if (files.length === 0) {
     return;
   }
-  const profileDir = import_node_path27.default.join(userData, "browser-profile");
+  const profileDir = import_node_path28.default.join(userData, "browser-profile");
   await import_promises11.default.mkdir(profileDir, { recursive: true, mode: 448 });
   for (const file of files) {
-    await import_promises11.default.writeFile(import_node_path27.default.join(profileDir, file.fileName), file.contents, {
+    await import_promises11.default.writeFile(import_node_path28.default.join(profileDir, file.fileName), file.contents, {
       mode: 384
     });
   }
@@ -12557,7 +12598,7 @@ async function resetBetaSlotMutableState({
   const targets = resolveBetaUpdateTargets(homeDir, assertBetaSlotId(slotId));
   await assertNoBetaSlotSymlinkComponents(homeDir, targets.instanceRoot);
   await assertNoBetaSlotSymlinkComponents(
-    import_node_path27.default.join(homeDir, ".runweave"),
+    import_node_path28.default.join(homeDir, ".runweave"),
     targets.appServerHome
   );
   const userData = await assertSafeMutableRoot(
@@ -12566,9 +12607,9 @@ async function resetBetaSlotMutableState({
   );
   const backendConnectionSettings = preserveBackendConnectionSettings ? await readBackendConnectionSettings(userData, targets.instanceRoot) : [];
   await import_promises11.default.mkdir(targets.instanceRoot, { recursive: true, mode: 448 });
-  const resetPath = import_node_path27.default.join(
+  const resetPath = import_node_path28.default.join(
     targets.instanceRoot,
-    `.user-data.reset-${(0, import_node_crypto10.randomUUID)()}`
+    `.user-data.reset-${(0, import_node_crypto11.randomUUID)()}`
   );
   if (await import_promises11.default.lstat(userData).catch(() => null)) {
     await import_promises11.default.rename(userData, resetPath);
@@ -12579,7 +12620,7 @@ async function resetBetaSlotMutableState({
   await import_promises11.default.rm(resetPath, { recursive: true, force: true });
   for (const entry of await import_promises11.default.readdir(targets.instanceRoot)) {
     if (entry.startsWith(".user-data.reset-")) {
-      await import_promises11.default.rm(import_node_path27.default.join(targets.instanceRoot, entry), {
+      await import_promises11.default.rm(import_node_path28.default.join(targets.instanceRoot, entry), {
         recursive: true,
         force: true
       });
@@ -12587,33 +12628,33 @@ async function resetBetaSlotMutableState({
   }
   const appServerHome = await assertSafeMutableRoot(
     targets.appServerHome,
-    import_node_path27.default.join(homeDir, ".runweave", "app-server-beta")
+    import_node_path28.default.join(homeDir, ".runweave", "app-server-beta")
   );
   await import_promises11.default.mkdir(appServerHome, { recursive: true, mode: 448 });
   for (const entry of await import_promises11.default.readdir(appServerHome)) {
     if (entry === "runtime") {
-      const runtimeStats = await import_promises11.default.lstat(import_node_path27.default.join(appServerHome, entry));
+      const runtimeStats = await import_promises11.default.lstat(import_node_path28.default.join(appServerHome, entry));
       if (!runtimeStats.isDirectory() || runtimeStats.isSymbolicLink()) {
         throw new DevSessionError(
           "Beta App Server runtime must be a regular directory",
           5,
-          { path: import_node_path27.default.join(appServerHome, entry) }
+          { path: import_node_path28.default.join(appServerHome, entry) }
         );
       }
       continue;
     }
-    await import_promises11.default.rm(import_node_path27.default.join(appServerHome, entry), {
+    await import_promises11.default.rm(import_node_path28.default.join(appServerHome, entry), {
       recursive: true,
       force: true
     });
   }
   for (const temporaryPath of [
-    import_node_path27.default.join(targets.instanceRoot, "build"),
-    import_node_path27.default.join(targets.instanceRoot, "runtime-artifacts"),
-    import_node_path27.default.join(targets.instanceRoot, "control"),
-    import_node_path27.default.join(targets.instanceRoot, "pending.json"),
-    import_node_path27.default.join(targets.instanceRoot, "diagnostics", "pending.json"),
-    import_node_path27.default.join(targets.instanceRoot, "update.lock")
+    import_node_path28.default.join(targets.instanceRoot, "build"),
+    import_node_path28.default.join(targets.instanceRoot, "runtime-artifacts"),
+    import_node_path28.default.join(targets.instanceRoot, "control"),
+    import_node_path28.default.join(targets.instanceRoot, "pending.json"),
+    import_node_path28.default.join(targets.instanceRoot, "diagnostics", "pending.json"),
+    import_node_path28.default.join(targets.instanceRoot, "update.lock")
   ]) {
     await import_promises11.default.rm(temporaryPath, { recursive: true, force: true });
   }
@@ -12630,7 +12671,7 @@ async function resetBetaSlotMutableState({
 async function readLease(slotId, paths) {
   try {
     const { value, stats } = await readRegularJson(
-      import_node_path28.default.join(paths.leasesDir, `${slotId}.lock`),
+      import_node_path29.default.join(paths.leasesDir, `${slotId}.lock`),
       paths.poolRoot
     );
     return {
@@ -12648,7 +12689,7 @@ async function readLease(slotId, paths) {
         failureReason: null
       };
     }
-    const stats = await import_promises12.default.lstat(import_node_path28.default.join(paths.leasesDir, `${slotId}.lock`)).catch(() => null);
+    const stats = await import_promises12.default.lstat(import_node_path29.default.join(paths.leasesDir, `${slotId}.lock`)).catch(() => null);
     return {
       state: "corrupt",
       value: null,
@@ -12669,7 +12710,7 @@ async function readManifestObservation(lease) {
   try {
     handle = await import_promises12.default.open(
       lease.ownerManifestPath,
-      import_node_fs16.constants.O_RDONLY | import_node_fs16.constants.O_NOFOLLOW
+      import_node_fs17.constants.O_RDONLY | import_node_fs17.constants.O_NOFOLLOW
     );
     const opened = await handle.stat();
     if (!opened.isFile()) {
@@ -13109,9 +13150,9 @@ async function inspectBetaPool({
 }
 
 // scripts/dev-resources/identity.mjs
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function ownershipVersion(generation, identity) {
-  return (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify([generation, identity])).digest("hex");
+  return (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([generation, identity])).digest("hex");
 }
 function sessionIdentity(manifest) {
   return [
@@ -13234,7 +13275,7 @@ function manifestOwner(manifest) {
   return {
     id: manifest.devSessionId,
     task: manifest.profile,
-    worktree: import_node_path29.default.basename(manifest.source.root),
+    worktree: import_node_path30.default.basename(manifest.source.root),
     startedAt: manifest.createdAt ?? null,
     lastActivityAt: null
   };
@@ -13256,7 +13297,7 @@ async function inspectSessions(generation, backendPid) {
   for (const entry of entries.slice(0, 2048)) {
     if (entry.name.startsWith(".")) continue;
     try {
-      const manifestPath = import_node_path29.default.join(root, entry.name, "manifest.json");
+      const manifestPath = import_node_path30.default.join(root, entry.name, "manifest.json");
       const stat = await import_promises13.default.lstat(manifestPath);
       if (!entry.isDirectory() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
         throw new Error("\u4E0D\u5B89\u5168\u7684 manifest");
@@ -13339,7 +13380,7 @@ async function desktopSnapshot(generation, backendPid) {
         resource.owner = {
           id: slot.lease.owner.sessionId,
           task: null,
-          worktree: import_node_path29.default.basename(slot.lease.owner.sourceRoot),
+          worktree: import_node_path30.default.basename(slot.lease.owner.sourceRoot),
           startedAt: slot.lease.acquiredAt,
           lastActivityAt: null
         };
@@ -13440,12 +13481,12 @@ var import_node_os21 = __toESM(require("node:os"), 1);
 
 // scripts/dev-session/services/beta-start-recovery.mjs
 var import_node_os20 = __toESM(require("node:os"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 
 // scripts/dev-session/beta-pool/lifecycle.mjs
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var import_node_os18 = __toESM(require("node:os"), 1);
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var RELEASE_FAILURE_CHECKPOINTS = /* @__PURE__ */ new Set([
   "after_reset",
   "after_metadata",
@@ -13492,7 +13533,7 @@ function createBetaPoolRecoveryReceipt({
   releasedLease = false,
   quarantinedLeasePath = null,
   failureReason = null,
-  attemptId = (0, import_node_crypto12.randomUUID)(),
+  attemptId = (0, import_node_crypto13.randomUUID)(),
   attemptedAt = (/* @__PURE__ */ new Date()).toISOString(),
   completedAt = null,
   phase = null
@@ -13532,7 +13573,7 @@ async function writeOwnerManifest(lease, manifest, receipt, state, failure) {
       poolRecovery: receipt,
       failure
     },
-    import_node_path30.default.dirname(lease.ownerManifestPath)
+    import_node_path31.default.dirname(lease.ownerManifestPath)
   );
 }
 async function finalizeBetaSlotReleaseClaimed({
@@ -13710,11 +13751,11 @@ async function finalizeBetaSlotRelease(options) {
 }
 
 // scripts/dev-session/beta-pool/recovery/index.mjs
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var import_node_child_process11 = require("node:child_process");
 var import_promises14 = __toESM(require("node:fs/promises"), 1);
 var import_node_os19 = __toESM(require("node:os"), 1);
-var import_node_path31 = __toESM(require("node:path"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
 var import_node_util7 = require("node:util");
 var execFileAsync6 = (0, import_node_util7.promisify)(import_node_child_process11.execFile);
 function sleep(milliseconds) {
@@ -13722,7 +13763,7 @@ function sleep(milliseconds) {
 }
 async function readLease2(slotId, paths, homeDir) {
   const raw = await readRegularJson(
-    import_node_path31.default.join(paths.leasesDir, `${slotId}.lock`),
+    import_node_path32.default.join(paths.leasesDir, `${slotId}.lock`),
     paths.poolRoot
   );
   const ownerSessionId = raw.value?.ownerSessionId;
@@ -13745,7 +13786,7 @@ async function readOwnerManifest(lease) {
     return validateManifest(
       (await readRegularJson(
         lease.ownerManifestPath,
-        import_node_path31.default.dirname(lease.ownerManifestPath)
+        import_node_path32.default.dirname(lease.ownerManifestPath)
       )).value
     );
   } catch (error) {
@@ -13775,7 +13816,7 @@ async function stopRecordedDedicatedServices(manifest, lease, homeDir, stopBetaC
     }
   }
   const sourceRoot = manifest.source?.root;
-  if (typeof sourceRoot !== "string" || !import_node_path31.default.isAbsolute(sourceRoot)) {
+  if (typeof sourceRoot !== "string" || !import_node_path32.default.isAbsolute(sourceRoot)) {
     throw new DevSessionError(
       "Beta recovery manifest source root is invalid",
       5,
@@ -13784,7 +13825,7 @@ async function stopRecordedDedicatedServices(manifest, lease, homeDir, stopBetaC
       }
     );
   }
-  const controlScript = import_node_path31.default.join(
+  const controlScript = import_node_path32.default.join(
     sourceRoot,
     "scripts",
     "beta",
@@ -13826,13 +13867,13 @@ async function stopRecordedDedicatedServices(manifest, lease, homeDir, stopBetaC
   return stoppedServices;
 }
 function ownerSessionLockEnv(lease) {
-  const sessionDir = import_node_path31.default.dirname(lease.ownerManifestPath);
-  if (import_node_path31.default.basename(lease.ownerManifestPath) !== "manifest.json" || import_node_path31.default.basename(sessionDir) !== lease.ownerSessionId) {
+  const sessionDir = import_node_path32.default.dirname(lease.ownerManifestPath);
+  if (import_node_path32.default.basename(lease.ownerManifestPath) !== "manifest.json" || import_node_path32.default.basename(sessionDir) !== lease.ownerSessionId) {
     return null;
   }
   return {
     ...process.env,
-    RUNWEAVE_DEV_SESSION_HOME: import_node_path31.default.dirname(sessionDir)
+    RUNWEAVE_DEV_SESSION_HOME: import_node_path32.default.dirname(sessionDir)
   };
 }
 async function persistNonMutatingReceipt(receipt, homeDir) {
@@ -13851,7 +13892,7 @@ async function quarantineCorruptLease({
   applicationsDir,
   paths
 }) {
-  const leasePath = import_node_path31.default.join(paths.leasesDir, `${slot.slotId}.lock`);
+  const leasePath = import_node_path32.default.join(paths.leasesDir, `${slot.slotId}.lock`);
   const initialStats = await import_promises14.default.lstat(leasePath).catch(() => null);
   let leaseQuarantined = false;
   let quarantinedLeasePath = null;
@@ -13900,10 +13941,10 @@ async function quarantineCorruptLease({
         { slotId: slot.slotId }
       );
     }
-    const operationId = (0, import_node_crypto13.randomUUID)();
-    const operationDir = import_node_path31.default.join(paths.quarantineDir, operationId);
+    const operationId = (0, import_node_crypto14.randomUUID)();
+    const operationDir = import_node_path32.default.join(paths.quarantineDir, operationId);
     await import_promises14.default.mkdir(operationDir, { recursive: true, mode: 448 });
-    quarantinedLeasePath = import_node_path31.default.join(operationDir, "lease.json");
+    quarantinedLeasePath = import_node_path32.default.join(operationDir, "lease.json");
     const pending = {
       ...base,
       phase: "release_pending",
@@ -13916,7 +13957,7 @@ async function quarantineCorruptLease({
       homeDir
     });
     await atomicWriteJson2(
-      import_node_path31.default.join(operationDir, "operation.json"),
+      import_node_path32.default.join(operationDir, "operation.json"),
       { receipt: pending, cleanupSummary: { ...reset, retention } },
       paths.quarantineDir
     );
@@ -13930,7 +13971,7 @@ async function quarantineCorruptLease({
       quarantinedLeasePath
     };
     await atomicWriteJson2(
-      import_node_path31.default.join(operationDir, "operation.json"),
+      import_node_path32.default.join(operationDir, "operation.json"),
       { receipt: completed, cleanupSummary: { ...reset, retention } },
       paths.quarantineDir
     );
@@ -14187,15 +14228,15 @@ async function recoverBetaPoolSlot({
 }
 
 // scripts/beta/operations.mjs
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_promises15 = __toESM(require("node:fs/promises"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 async function withBetaLock(paths, operation) {
-  const lockPaths = [import_node_path32.default.join(paths.instanceRoot, "update.lock")];
+  const lockPaths = [import_node_path33.default.join(paths.instanceRoot, "update.lock")];
   const handles = [];
   try {
     for (const lockPath of lockPaths) {
-      await import_promises15.default.mkdir(import_node_path32.default.dirname(lockPath), { recursive: true });
+      await import_promises15.default.mkdir(import_node_path33.default.dirname(lockPath), { recursive: true });
       let handle;
       for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
@@ -14238,7 +14279,7 @@ function buildUpdateEnv(paths, gitHead, appBackupPath = paths.appBackupPath, sha
     BROWSER_PROFILE_DIR: paths.profileDir,
     RUNWEAVE_CLI_BUNDLE_OUTFILE: paths.controlCliPath,
     RUNWEAVE_APP_BACKUP_PATH: appBackupPath,
-    RUNWEAVE_APP_SERVER_CLOUD_SYNC_DIR: sharedAppServer ? import_node_path32.default.join(sharedAppServer.homeDir, "cloud-sync") : paths.appServerCloudSyncDir,
+    RUNWEAVE_APP_SERVER_CLOUD_SYNC_DIR: sharedAppServer ? import_node_path33.default.join(sharedAppServer.homeDir, "cloud-sync") : paths.appServerCloudSyncDir,
     RUNWEAVE_APP_SERVER_HOME: sharedAppServer?.homeDir ?? paths.appServerHome,
     RUNWEAVE_WHISTLE_PORTS: paths.slotId ? [0, 1, 2].map((index) => 18100 + Number(paths.slotId.slice(-2)) * 10 + index).join(",") : process.env.RUNWEAVE_WHISTLE_PORTS || "18081,18082,18083",
     RUNWEAVE_DESKTOP_STATE_DIR: paths.userData,
@@ -14319,7 +14360,7 @@ async function quitBeta(paths) {
 }
 async function runAppServerCli(paths, command, sourceRevision = null) {
   const cliEntry = paths.controlCliPath;
-  if (!(0, import_node_fs17.existsSync)(cliEntry)) {
+  if (!(0, import_node_fs18.existsSync)(cliEntry)) {
     return { ok: false, code: 1, stderr: `missing CLI build: ${cliEntry}` };
   }
   return await runCapture(
@@ -14377,7 +14418,7 @@ async function cleanupIncompleteBetaStart(manifest, { homeDir = import_node_os20
       );
     }
     const backendLock = await readJson(
-      import_node_path33.default.join(paths.profileDir, "backend.lock.json")
+      import_node_path34.default.join(paths.profileDir, "backend.lock.json")
     );
     if (backendLock && isPidLive(backendLock.pid) && backendLock.devSessionId !== manifest.devSessionId) {
       throw new DevSessionError(