@schoolai/shipyard 3.19.0 → 3.20.0

package/dist/{serve-AA4FCUY6.js → serve-WG7HQAYG.js}

@@ -12,7 +12,7 @@ import {
   guardedSubscribe,
   makeInitialAttemptState,
   shutdownFileWatcherGuard
-} from "./chunk-4XU7QHYE.js";
+} from "./chunk-QNEFPC4Y.js";
 import {
   TRAILER_SCHEMA_VERSION,
   appendTrailerToMessage,
@@ -39,13 +39,13 @@ import {
   startPlanBackfillForDaemon,
   sync,
   validatePeerId
-} from "./chunk-JEIJ4LIM.js";
+} from "./chunk-SECZGRK2.js";
 import {
   loadAuthToken
 } from "./chunk-TFWDJCUJ.js";
 import {
   getDaemonVersion
-} from "./chunk-KMMF5R3M.js";
+} from "./chunk-FMHVDAJK.js";
 import {
   collectPriorCrashDetail,
   getRecentWasmPanicMessages
@@ -174,7 +174,7 @@ import {
   unresolveReviewThread,
   withLabelAsync,
   writeCursorApiKeyToVault
-} from "./chunk-LVQLRQKF.js";
+} from "./chunk-OBYRPZRA.js";
 import {
   buildNodeSpawnEnv,
   nodeSpawnEnvOverlay,
@@ -235,7 +235,7 @@ import {
   createAssetResolver,
   toSdkContent,
   toSdkPermissionMode
-} from "./chunk-FASB7KFF.js";
+} from "./chunk-LYUR7G6B.js";
 import {
   AGENT_IDS,
   AGENT_SYSTEM_CLAUDE_CODE,
@@ -306,6 +306,7 @@ import {
   MERMAID_SECURITY_LEVEL,
   MessageSchema,
   OBSOLETE_PREFIXES,
+  OPEN_FILE_TOOL,
   PLAN_EPOCH,
   PLUGIN_READ_ME_TOOL,
   PRESENT_TOOL,
@@ -420,7 +421,7 @@ import {
   unsafeAssertSourceId,
   vizFileExtension,
   withPreferredRuntimeAuthMethod
-} from "./chunk-6TK5KO76.js";
+} from "./chunk-OC75AUKJ.js";
 import {
   AuthGitHubCallbackRequestSchema,
   AuthGitHubCallbackResponseSchema,
@@ -468,7 +469,7 @@ import {
   VaultKeyPutResponseSchema,
   classifyClaudeCodeCompatibility,
   classifyCodexCompatibility
-} from "./chunk-HD66ZG4O.js";
+} from "./chunk-TJ4TMMMB.js";
 import {
   external_exports as external_exports2
 } from "./chunk-EHQITHQX.js";
@@ -4857,28 +4858,133 @@ function getErrorCode(err3) {
 
 // src/services/bootstrap/heartbeat.ts
 import { randomUUID as randomUUID4 } from "crypto";
+
+// src/services/bootstrap/pid-identity.ts
+import { execFileSync } from "child_process";
+function decideProcessIdentity(recorded, live) {
+  if (recorded === null) return "unrecorded";
+  if (live === null) return "unverifiable";
+  return recorded === live ? "ours" : "not-ours";
+}
+function readProcessStartTime(pid, exec = defaultExec) {
+  try {
+    const out = exec("ps", ["-p", String(pid), "-o", "lstart="]).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function defaultExec(command, args) {
+  return execFileSync(command, args, { encoding: "utf8" });
+}
+
+// src/services/bootstrap/pid-liveness.ts
+function probePid(pid, kill = process.kill.bind(process)) {
+  try {
+    kill(pid, 0);
+    return { outcome: "signaled" };
+  } catch (err3) {
+    const code = errorCode(err3);
+    if (code === "ESRCH") return { outcome: "no-process" };
+    if (code === "EPERM") return { outcome: "foreign-owner" };
+    return { outcome: "probe-error", code };
+  }
+}
+function errorCode(err3) {
+  if (err3 instanceof Error && "code" in err3) {
+    const { code } = err3;
+    return typeof code === "string" ? code : void 0;
+  }
+  return void 0;
+}
+function classifyPidLiveness(probe) {
+  switch (probe.outcome) {
+    case "signaled":
+      return "alive-same-user";
+    case "no-process":
+      return "stale";
+    case "foreign-owner":
+      return "foreign";
+    case "probe-error":
+      return "indeterminate";
+    default:
+      return assertNever(probe);
+  }
+}
+function decidePidAcquisition(reading, ctx) {
+  switch (reading.kind) {
+    case "absent":
+      return { action: "reclaim", reason: "no-file" };
+    case "corrupt":
+      return { action: "reclaim", reason: "corrupt" };
+    case "present":
+      return decideForLiveness(reading.liveness, reading.identity, ctx);
+    default:
+      return assertNever(reading);
+  }
+}
+function decideForLiveness(liveness, identity, ctx) {
+  switch (liveness) {
+    case "stale":
+      return { action: "reclaim", reason: "stale" };
+    case "foreign":
+      return { action: "reclaim", reason: "foreign" };
+    case "alive-same-user":
+      return decideForSameUser(identity, ctx);
+    case "indeterminate":
+      return { action: "refuse", reason: "indeterminate" };
+    default:
+      return assertNever(liveness);
+  }
+}
+function decideForSameUser(identity, ctx) {
+  switch (identity) {
+    case "ours":
+      return { action: "refuse", reason: "live-same-user" };
+    case "not-ours":
+      return { action: "reclaim", reason: "recycled-pid" };
+    case "unverifiable":
+      return { action: "refuse", reason: "identity-unverifiable" };
+    case "unrecorded":
+      return ctx.selfTokenAvailable ? { action: "reclaim", reason: "unrecorded-stale" } : { action: "refuse", reason: "live-same-user" };
+    default:
+      return assertNever(identity);
+  }
+}
+
+// src/services/bootstrap/heartbeat.ts
 var DEFAULT_INTERVAL_MS2 = 15e3;
 var DEFAULT_STALE_THRESHOLD_MS = 5 * 6e4;
 function isHeartbeatPayload(value) {
   if (typeof value !== "object" || value === null) return false;
   if (!("pid" in value) || !("timestamp" in value)) return false;
   const { pid, timestamp } = value;
-  return typeof pid === "number" && typeof timestamp === "number";
+  if (typeof pid !== "number" || typeof timestamp !== "number") return false;
+  if ("startTime" in value) {
+    const { startTime } = value;
+    if (typeof startTime !== "string") return false;
+  }
+  return true;
 }
 function getErrorCode2(err3) {
   if (!(err3 instanceof Error) || !("code" in err3)) return void 0;
   const { code } = err3;
   return typeof code === "string" ? code : void 0;
 }
-function isProcessRunning(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err3) {
-    if (getErrorCode2(err3) === "ESRCH") {
+function isPriorDaemonRunning(payload, readStartTime) {
+  const liveness = classifyPidLiveness(probePid(payload.pid));
+  switch (liveness) {
+    case "stale":
       return false;
+    case "foreign":
+    case "indeterminate":
+      return true;
+    case "alive-same-user": {
+      const identity = decideProcessIdentity(payload.startTime ?? null, readStartTime(payload.pid));
+      return identity !== "not-ours";
     }
-    return true;
+    default:
+      return assertNever(liveness);
   }
 }
 async function writeHeartbeatAtomic(fs3, pidFilePath, payload) {
@@ -4888,11 +4994,14 @@ async function writeHeartbeatAtomic(fs3, pidFilePath, payload) {
 }
 function startHeartbeat(deps) {
   const intervalMs = deps.intervalMs ?? DEFAULT_INTERVAL_MS2;
+  const readStartTime = deps.readProcessStartTime ?? readProcessStartTime;
+  const ownStartTime = readStartTime(process.pid);
   const writeOnce = async () => {
     try {
       await writeHeartbeatAtomic(deps.fs, deps.pidFilePath, {
         pid: process.pid,
-        timestamp: deps.now()
+        timestamp: deps.now(),
+        ...ownStartTime !== null ? { startTime: ownStartTime } : {}
       });
     } catch (err3) {
       deps.log({ event: "daemon_heartbeat_write_failed", err: String(err3) });
@@ -4923,6 +5032,7 @@ function startHeartbeat(deps) {
 }
 async function detectPriorAbnormalExit(deps) {
   const staleThresholdMs = deps.staleThresholdMs ?? DEFAULT_STALE_THRESHOLD_MS;
+  const readStartTime = deps.readProcessStartTime ?? readProcessStartTime;
   let raw;
   try {
     raw = await deps.fs.readFile(deps.pidFilePath, "utf-8");
@@ -4950,7 +5060,7 @@ async function detectPriorAbnormalExit(deps) {
   if (ageMs > staleThresholdMs) {
     return { prior: "unknown" };
   }
-  if (isProcessRunning(parsed.pid)) {
+  if (isPriorDaemonRunning(parsed, readStartTime)) {
     return { prior: "clean" };
   }
   return {
@@ -5200,7 +5310,7 @@ function forwardAbnormalExitMetric(report, restartDetail, metrics) {
 }
 
 // src/services/bootstrap/lifecycle.ts
-import { unlinkSync } from "fs";
+import { readFileSync, unlinkSync } from "fs";
 import { readFile as readFile3, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
 import { join as join9 } from "path";
 
@@ -5252,67 +5362,14 @@ function getLoroCrdtVersion() {
   return cachedVersion;
 }
 
-// src/services/bootstrap/pid-liveness.ts
-function probePid(pid, kill = process.kill.bind(process)) {
-  try {
-    kill(pid, 0);
-    return { outcome: "signaled" };
-  } catch (err3) {
-    const code = errorCode(err3);
-    if (code === "ESRCH") return { outcome: "no-process" };
-    if (code === "EPERM") return { outcome: "foreign-owner" };
-    return { outcome: "probe-error", code };
-  }
-}
-function errorCode(err3) {
-  if (err3 instanceof Error && "code" in err3) {
-    const { code } = err3;
-    return typeof code === "string" ? code : void 0;
-  }
-  return void 0;
-}
-function classifyPidLiveness(probe) {
-  switch (probe.outcome) {
-    case "signaled":
-      return "alive-same-user";
-    case "no-process":
-      return "stale";
-    case "foreign-owner":
-      return "foreign";
-    case "probe-error":
-      return "indeterminate";
-    default:
-      return assertNever(probe);
-  }
-}
-function decidePidAcquisition(reading) {
-  switch (reading.kind) {
-    case "absent":
-      return { action: "reclaim", reason: "no-file" };
-    case "corrupt":
-      return { action: "reclaim", reason: "corrupt" };
-    case "present":
-      return decideForLiveness(reading.liveness);
-    default:
-      return assertNever(reading);
-  }
-}
-function decideForLiveness(liveness) {
-  switch (liveness) {
-    case "stale":
-      return { action: "reclaim", reason: "stale" };
-    case "foreign":
-      return { action: "reclaim", reason: "foreign" };
-    case "alive-same-user":
-      return { action: "refuse", reason: "live-same-user" };
-    case "indeterminate":
-      return { action: "refuse", reason: "indeterminate" };
-    default:
-      return assertNever(liveness);
-  }
-}
-
 // src/services/bootstrap/lifecycle.ts
+var PID_META_SUFFIX = ".meta";
+function isPidMetaPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("pid" in value) || !("startTime" in value)) return false;
+  const { pid, startTime } = value;
+  return typeof pid === "number" && typeof startTime === "string";
+}
 function extractWasmPanicContext(error) {
   const stack = error instanceof Error && typeof error.stack === "string" ? error.stack : "";
   const frames = stack.split("\n").map((f2) => f2.trim());
@@ -5328,16 +5385,19 @@ var LifecycleManager = class {
   #isShuttingDown = false;
   #cleanupFns = [];
   #pidFilePath = null;
+  #sidecarFilePath = null;
   #log;
   #flushLogger;
   #deps;
   #probePid;
+  #readProcessStartTime;
   #started = false;
   constructor(log, deps, flushLogger2) {
     this.#log = log;
     this.#deps = deps;
     this.#flushLogger = flushLogger2 ?? (() => Promise.resolve());
     this.#probePid = deps.probePid ?? ((pid) => probePid(pid));
+    this.#readProcessStartTime = deps.readProcessStartTime ?? ((pid) => readProcessStartTime(pid));
   }
   start() {
     if (this.#started) return;
@@ -5414,15 +5474,19 @@ var LifecycleManager = class {
   }
   async acquirePidFile(shipyardHome) {
     const pidFilePath = join9(shipyardHome, "daemon.pid");
-    const reading = await this.#readPidFile(pidFilePath);
-    const decision = decidePidAcquisition(reading);
+    const sidecarPath = pidFilePath + PID_META_SUFFIX;
+    const ownStartTime = this.#readProcessStartTime(process.pid);
+    const reading = await this.#readPidFile(pidFilePath, sidecarPath);
+    const decision = decidePidAcquisition(reading, { selfTokenAvailable: ownStartTime !== null });
     this.#applyPidDecision(decision, reading, pidFilePath);
+    await this.#writeSidecar(sidecarPath, ownStartTime);
+    this.#sidecarFilePath = sidecarPath;
     await writeFile4(pidFilePath, String(process.pid), { mode: 420 });
     this.#pidFilePath = pidFilePath;
     this.#log.info({ pid: process.pid, pidFile: pidFilePath }, "PID file acquired");
   }
   /** GATHER: read + normalize the existing PID file into a `PidFileReading`. */
-  async #readPidFile(pidFilePath) {
+  async #readPidFile(pidFilePath, sidecarPath) {
     let existing;
     try {
       existing = await readFile3(pidFilePath, "utf-8");
@@ -5433,27 +5497,63 @@ var LifecycleManager = class {
     const raw = existing.trim();
     const pid = Number.parseInt(raw, 10);
     if (!Number.isInteger(pid) || pid <= 0) return { kind: "corrupt", raw };
-    return { kind: "present", pid, liveness: classifyPidLiveness(this.#probePid(pid)) };
+    const liveness = classifyPidLiveness(this.#probePid(pid));
+    const identity = liveness === "alive-same-user" ? this.#readIdentity(pid, sidecarPath) : "unrecorded";
+    return { kind: "present", pid, liveness, identity };
+  }
+  /** GATHER + DECIDE: compare the recorded token against the live start time. */
+  #readIdentity(pid, sidecarPath) {
+    const recorded = this.#readRecordedStartTime(pid, sidecarPath);
+    const live = this.#readProcessStartTime(pid);
+    return decideProcessIdentity(recorded, live);
+  }
+  /**
+   * Read the start-time token recorded for `pid` from the sidecar. Returns
+   * `null` when the sidecar is absent, unparseable, or was written for a
+   * different PID (a stale sidecar must not be trusted as this PID's identity).
+   */
+  #readRecordedStartTime(pid, sidecarPath) {
+    let raw;
+    try {
+      raw = readFileSync(sidecarPath, "utf-8");
+    } catch {
+      return null;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (!isPidMetaPayload(parsed) || parsed.pid !== pid) return null;
+    return parsed.startTime;
+  }
+  /**
+   * Persist the identity token alongside `daemon.pid`. When we could not read
+   * our own start time (`null`), remove any stale sidecar rather than writing a
+   * bogus one — a future reader then sees `unrecorded` and picks a safe default.
+   */
+  async #writeSidecar(sidecarPath, startTime) {
+    if (startTime === null) {
+      try {
+        await unlink2(sidecarPath);
+      } catch {
+      }
+      return;
+    }
+    const payload = { pid: process.pid, startTime };
+    await writeFile4(sidecarPath, JSON.stringify(payload), { mode: 420 });
   }
   /** EXECUTE: log the decision and refuse (exit) when mutual exclusion applies. */
   #applyPidDecision(decision, reading, pidFilePath) {
     if (decision.action === "refuse") {
       const pid = reading.kind === "present" ? reading.pid : null;
-      if (decision.reason === "live-same-user") {
-        this.#log.error(
-          { event: "pid_live_daemon_refused", pid, pidFile: pidFilePath },
-          "Another daemon is already running. Stop it first or remove the stale PID file."
-        );
-      } else {
-        this.#log.error(
-          { event: "pid_probe_indeterminate_refused", pid, pidFile: pidFilePath },
-          "Cannot determine if existing daemon is alive \u2014 refusing to overwrite PID file."
-        );
-      }
+      this.#logRefusal(decision.reason, pid, pidFilePath);
       process.exit(1);
     }
     const reclaimedPid = reading.kind === "present" ? reading.pid : null;
-    switch (decision.reason) {
+    const reason = decision.reason;
+    switch (reason) {
       case "no-file":
         return;
       case "corrupt":
@@ -5478,23 +5578,80 @@ var LifecycleManager = class {
           "PID file points at a process owned by another user \u2014 not our daemon, reclaiming"
         );
         return;
+      case "recycled-pid":
+        this.#log.info(
+          { event: "pid_reclaimed_recycled", stalePid: reclaimedPid, pidFile: pidFilePath },
+          "PID file points at a recycled PID (start time differs) \u2014 not our daemon, reclaiming"
+        );
+        return;
+      case "unrecorded-stale":
+        this.#log.info(
+          { event: "pid_reclaimed_unrecorded", stalePid: reclaimedPid, pidFile: pidFilePath },
+          "PID file has no identity sidecar (pre-fix leftover) \u2014 treating as stale and reclaiming"
+        );
+        return;
+      default:
+        assertNever(reason);
     }
   }
+  #logRefusal(reason, pid, pidFilePath) {
+    switch (reason) {
+      case "live-same-user":
+        this.#log.error(
+          { event: "pid_live_daemon_refused", pid, pidFile: pidFilePath },
+          "Another daemon is already running. Stop it first or remove the stale PID file."
+        );
+        return;
+      case "identity-unverifiable":
+        this.#log.error(
+          { event: "pid_identity_unverifiable_refused", pid, pidFile: pidFilePath },
+          "Existing PID is alive but its identity could not be verified \u2014 refusing to overwrite PID file."
+        );
+        return;
+      case "indeterminate":
+        this.#log.error(
+          { event: "pid_probe_indeterminate_refused", pid, pidFile: pidFilePath },
+          "Cannot determine if existing daemon is alive \u2014 refusing to overwrite PID file."
+        );
+        return;
+      default:
+        assertNever(reason);
+    }
+  }
+  /**
+   * Remove `daemon.pid` BEFORE the sidecar (mirror of the acquire ordering):
+   * once `daemon.pid` is gone a reader treats the slot as free regardless of
+   * the sidecar, so we never expose "pid present, sidecar gone" during teardown.
+   */
   #removePidFileSync() {
-    if (!this.#pidFilePath) return;
+    if (this.#pidFilePath) {
+      try {
+        unlinkSync(this.#pidFilePath);
+      } catch {
+      }
+      this.#pidFilePath = null;
+    }
+    if (!this.#sidecarFilePath) return;
     try {
-      unlinkSync(this.#pidFilePath);
+      unlinkSync(this.#sidecarFilePath);
     } catch {
     }
-    this.#pidFilePath = null;
+    this.#sidecarFilePath = null;
   }
   async #removePidFile() {
-    if (!this.#pidFilePath) return;
+    if (this.#pidFilePath) {
+      try {
+        await unlink2(this.#pidFilePath);
+      } catch {
+      }
+      this.#pidFilePath = null;
+    }
+    if (!this.#sidecarFilePath) return;
     try {
-      await unlink2(this.#pidFilePath);
+      await unlink2(this.#sidecarFilePath);
     } catch {
     }
-    this.#pidFilePath = null;
+    this.#sidecarFilePath = null;
   }
   /**
    * Wasm-specific recovery path. Runs when a panic originates inside
@@ -5828,7 +5985,7 @@ function buildReloadDocsFromStorage(repoRef, log) {
 }
 
 // src/services/bootstrap/signaling.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { hostname } from "os";
 import { dirname as dirname5, join as join12 } from "path";
 
@@ -5864,7 +6021,7 @@ function nanoid(size = 21) {
 }
 
 // src/services/bootstrap/signaling.ts
-var DAEMON_NPM_VERSION = true ? "3.19.0" : "unknown";
+var DAEMON_NPM_VERSION = true ? "3.20.0" : "unknown";
 function createDaemonSignaling(config) {
   const agentId = config.agentId ?? nanoid();
   function send(msg) {
@@ -5895,7 +6052,7 @@ function createDaemonSignaling(config) {
 function getOrCreateAgentId(shipyardHome) {
   const filePath = join12(shipyardHome, "agent-id");
   try {
-    const existing = readFileSync(filePath, "utf-8").trim();
+    const existing = readFileSync2(filePath, "utf-8").trim();
     if (existing) return existing;
   } catch {
   }
@@ -7583,10 +7740,21 @@ function runOnCloseCleanup(isLive, cleanup) {
   cleanup.liveOnly.deleteEpochEntry();
 }
 function runTaskSearch(args) {
-  const { daemon, controlHandler, logAdapter, requestId, query: query3, limit, includeReviews, projectId } = args;
+  const {
+    daemon,
+    controlHandler,
+    logAdapter,
+    requestId,
+    query: query3,
+    limit,
+    includeReviews,
+    includeArchived,
+    projectId
+  } = args;
   daemon.taskStateStore.searchTasks(query3, {
     limit: limit ?? 100,
     includeReviews,
+    includeArchived,
     ...projectId !== void 0 && { projectId }
   }).then(({ tasks, truncated }) => {
     controlHandler.sendControl({
@@ -10624,7 +10792,7 @@ import { basename as basename5, join as join19 } from "path";
 
 // src/services/publish/published-artifact-store.ts
 import { createHash, randomUUID as randomUUID7 } from "crypto";
-import { mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
 import { mkdir as mkdir7, readFile as readFile9, rename as rename6, unlink as unlink5, writeFile as writeFile9 } from "fs/promises";
 import { dirname as dirname9, join as join17, relative as relative3 } from "path";
 import { isDeepStrictEqual } from "util";
@@ -10647,7 +10815,7 @@ async function atomicWrite(filePath, content) {
 function parseRecord(filePath, log) {
   let raw;
   try {
-    raw = readFileSync2(filePath, "utf-8");
+    raw = readFileSync3(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -14326,6 +14494,13 @@ function filterOutboundForCollab(msg, collabTaskId, getTaskSync) {
      */
     case "auth_refresh_failed":
     case "open_canvas":
+    /**
+     * open_file: owner-local UI navigation, suppressed for the same reason as
+     * open_canvas. Auto-hijacking a viewer's code panel to a file the owner's
+     * agent opened is intrusive, and the path is owner-cwd-relative so it may
+     * not even resolve on a viewer's tree. Viewers navigate their own file view.
+     */
+    case "open_file":
     case "plugin_data_response":
     case "plugin_auth_status":
     case "plugin_panels_updated":
@@ -15500,6 +15675,7 @@ function routeMessage(msg, callbacks, sendControl, log) {
         query: msg.query,
         limit: msg.limit,
         includeReviews: msg.includeReviews ?? false,
+        includeArchived: msg.includeArchived ?? false,
         projectId: msg.projectId
       });
       break;
@@ -19316,7 +19492,7 @@ function decideCodexAuthFromAccountUpdated(authMode) {
 }
 
 // src/services/serve-factory-helpers.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { join as join28 } from "path";
 
 // src/shared/capabilities/runtime/rate-limit-account-key.ts
@@ -19713,7 +19889,7 @@ function isSafeStorageReply(msg) {
 }
 
 // src/services/harness/lsp-agent-server.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { basename as basename6, relative as relative4, resolve as resolve6 } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 var LspPositionSchema = external_exports.object({ line: external_exports.number(), character: external_exports.number() });
@@ -19808,7 +19984,7 @@ function isSecretFile(absolutePath) {
 }
 function readSnippet(absolutePath, line0, context = 2) {
   try {
-    const lines = readFileSync3(absolutePath, "utf8").split("\n");
+    const lines = readFileSync4(absolutePath, "utf8").split("\n");
     const start = Math.max(0, line0 - context);
     const end = Math.min(lines.length - 1, line0 + context);
     return lines.slice(start, end + 1).map((l, i) => `  ${start + i + 1}  ${l}`).join("\n");
@@ -20203,6 +20379,9 @@ var REGISTER_DELIVERABLE_PROMPT_DOC = [
   "",
   "**Required fields:** `kind` (one of `screenshot`, `video`, `log`, `markdown`, `html`, `json`, `ax-tree`, `dom-snapshot`, `other`), `title`, and exactly one of `assetId` or `filePath`."
 ].join("\n");
+var OPEN_FILE_PROMPT_DOC = [
+  "`open_file` opens a file in the code-editor side panel \u2014 pass `path` (absolute or workspace-relative) and an optional 1-based `line` to scroll to. Reach for it to surface a file the reviewer should see: right after you edit it, when your reply references specific code, or when pointing them at what to review next. Not a substitute for a diff comment \u2014 use `add_comment` to explain a change; use `open_file` to put the file in front of them."
+].join("\n");
 var SKILLS_PROMPT_DOC = [
   "Shipyard curates a set of skills for this task \u2014 reusable, expert instructions for specific workflows. **Before starting domain-specific work, check skills first:** call `list_skills` to see what's available, then `load_skill({ name })` to pull a skill's full instructions (and a directory path for any sibling files it references) before you dive in. A relevant skill saves you re-deriving conventions the team already wrote down. Some skills are also reachable through your own `/name` mentions; for anything in `list_skills`, `load_skill` always works."
 ].join("\n");
@@ -20317,7 +20496,9 @@ var HARNESS_TOOL_REGISTRY = [
     appliesTo: "all",
     modeGate: "task",
     promptDoc: `\`${LSP_RENAME_SYMBOL_TOOL}\` \u2014 ${LSP_RENAME_SYMBOL_DESCRIPTION}`
-  }
+  },
+  /** File viewer — gate: task. */
+  { name: OPEN_FILE_TOOL, appliesTo: "all", modeGate: "task", promptDoc: OPEN_FILE_PROMPT_DOC }
 ];
 
 // src/services/harness/system-prompt.ts
@@ -20348,7 +20529,8 @@ var TOOL_SECTIONS = [
   {
     heading: "### Code Navigation (LSP)",
     tools: ["lsp_go_to_definition", "lsp_find_references", "lsp_rename_symbol"]
-  }
+  },
+  { heading: "### File Viewer", tools: ["open_file"] }
 ];
 var TOOL_SECTION_HEADINGS = TOOL_SECTIONS.map((s2) => s2.heading);
 function buildToolsBlock(agent, intro) {
@@ -20368,14 +20550,10 @@ function buildToolsBlock(agent, intro) {
   return parts.join("\n\n");
 }
 var CLAUDE_TOOLS = buildToolsBlock("claude-code", null);
-var CODEX_TOOLS = buildToolsBlock(
-  "codex",
-  "You have access to a Shipyard MCP server. The tools below are MCP tools registered on that server \u2014 call them by their unqualified names (e.g. `add_comment`, `visualize`, `present`). For shell access use the native `shell` tool; for file edits use `apply_patch`; for the live task list use the native `update_plan` tool."
-);
-var CURSOR_TOOLS = buildToolsBlock(
-  "cursor",
-  "You have access to a Shipyard MCP server. The tools below are MCP tools registered on that server \u2014 call them by their unqualified names (e.g. `add_comment`, `visualize`, `present`). For shell access use the native `Shell` tool; for file edits use `Write` / `Edit`; for the live task list use the `shipyard_update_plan` MCP tool."
-);
+var CODEX_TOOLS_PREAMBLE = "You have access to a Shipyard MCP server. The tools below are MCP tools registered on that server \u2014 call them by their unqualified names (e.g. `add_comment`, `visualize`, `present`). For shell access use the native `shell` tool; for file edits use `apply_patch`; for the live task list use the native `update_plan` tool; for spawning subagents use the native `spawn_agent` tool. Those native tools are always available even though they are NOT in the MCP tool list below \u2014 do not go looking for them there.";
+var CURSOR_TOOLS_PREAMBLE = "You have access to a Shipyard MCP server. The tools below are MCP tools registered on that server \u2014 call them by their unqualified names (e.g. `add_comment`, `visualize`, `present`). For shell access use the native `Shell` tool; for file edits use `Write` / `Edit`; for spawning subagents use the native `task` tool; for the live task list use the `shipyard_update_plan` MCP tool. Those native tools are always available even though they are NOT in the MCP tool list below. Careful: the list below also registers a Shipyard MCP tool named `task` \u2014 that one manages sibling tasks (send/cancel/snapshot) and does NOT spawn subagents; only your native `task` tool does.";
+var CODEX_TOOLS = buildToolsBlock("codex", CODEX_TOOLS_PREAMBLE);
+var CURSOR_TOOLS = buildToolsBlock("cursor", CURSOR_TOOLS_PREAMBLE);
 function sharedIntro(shellWord) {
   return `# Shipyard
 
@@ -20615,7 +20793,7 @@ var CODEX_NOTES = `## Codex-specific Notes
 - **Plan mode** \u2014 Publish plans by wrapping them in \`<proposed_plan>...</proposed_plan>\` blocks (Codex's native publish marker, parsed out of your streamed text and rendered as a structured plan on the Shipyard canvas). There is no \`ExitPlanMode\` tool. To revise, emit a fresh \`<proposed_plan>\` block in the next turn \u2014 each block is a complete replacement of the prior one. See the \`<plan>\` resource section above for full semantics (sandbox shape, reviewer feedback flow, approval signal).
 - **\`request_user_input\`** \u2014 Codex's tool for asking the user multiple-choice questions during plan refinement. Routes to the same UX as Claude's \`AskUserQuestion\`. Use it whenever you need a decision from the user that materially changes the plan. Options-only \u2014 freeform input (\`options: null\`) and secret input (\`isSecret: true\`) are not yet supported by Shipyard and will return an error suggesting you re-ask with multiple-choice options.
 - **Todo list** \u2014 Use the \`update_plan\` tool to keep the user-visible task list in sync **in non-plan modes only**. Codex blocks \`update_plan\` while you are in plan-collaboration mode and will return an error \u2014 \`update_plan\` is a checklist/progress tool, distinct from the \`<proposed_plan>\` publishing flow. In normal mode: when starting, include any items already visible in \`<task-list>\` using their exact subjects, then add your own steps below them. Don't paraphrase template subjects or you'll create duplicate sidebar entries. Update statuses (pending \u2192 in_progress \u2192 completed) as you go; call \`update_plan\` whenever you start, finish, or reorder a step.
-- **Subagents** \u2014 Use the \`spawn_agent\` tool to launch a sub-thread for a self-contained task. Codex runs sub-agents in separate threads; results land on the parent turn via \`wait\`. \`spawn_agent\` has no \`run_in_background\` field \u2014 every call is foreground from your perspective.
+- **Subagents** \u2014 Use your native \`spawn_agent\` tool to launch a sub-thread for a self-contained task. It is a built-in Codex tool, NOT a Shipyard MCP tool, so it will not appear in the MCP tool list \u2014 call it directly rather than searching the MCP surface for it. Codex runs sub-agents in separate threads; results land on the parent turn via \`wait\`. \`spawn_agent\` has no \`run_in_background\` field \u2014 every call is foreground from your perspective.
 - **Edits** \u2014 Use the \`apply_patch\` tool for all file edits. Codex does not have separate Read/Edit/Write tools; \`apply_patch\` is the single edit verb.
 - **Patching** \u2014 \`apply_patch\` does NOT enforce string uniqueness the way Claude's \`Edit\` tool does. When editing a repeated pattern (e.g. \`return null;\` appearing in many functions), include enough surrounding context in the hunk to make the match unambiguous, or you will silently edit the wrong occurrence. Concretely: prefer a 3+ line context window above and below the change, and include the enclosing function header in the hunk when in doubt.
 - **Permission failures \u2014 do not retry escalated** \u2014 this runtime's approval policy is \`never\` and sandbox escalation requests will be rejected. If a \`shell\` command fails on permissions or sandboxing, report the failure to the user and stop; do NOT retry with elevated permissions, do NOT loop on \`with_escalated_permissions\`. The \`openai-docs\` skill's "immediately retry with escalated permissions" advice does not apply here \u2014 it would just burn turns hitting the same rejection.
@@ -20678,7 +20856,7 @@ var CURSOR_NOTES = `## Cursor-specific Notes
 - **Ignore \`run_in_background: true\`** \u2014 that is a Claude-Code-only flag on \`Bash\`/Task. Cursor's \`Shell\` and \`task\` do not accept it. AGENTS.md says "Always use \`run_in_background: true\` on all Task tool calls" \u2014 that rule does not apply here.
 - **Background execution** \u2014 Cursor does not support background execution at all. Long-running \`Shell\` commands block the current turn; keep them short or break work into smaller steps so the user sees progress. For genuinely long work, ask the user to split it into multiple turns.
 - **Todo list** \u2014 Use the \`shipyard_update_plan\` MCP tool to keep the user-visible task list in sync. Pass the FULL list of steps with their statuses on every call \u2014 partial updates are not supported. When starting, include any items already visible in \`<${XML_TAGS.TASK_LIST}>\` with their visible IDs (for example, use \`id: "1"\` for \`#1\`). Keep that same ID if you rename a template item, and omit \`id\` only for brand-new steps. Do NOT use Cursor's native \`task\` subagent tool for todo tracking \u2014 \`task\` is for spawning subagents, not the user-facing plan.
-- **Subagents** \u2014 Use the \`task\` tool to launch a sub-agent for a self-contained piece of work. \`task\` has no \`run_in_background\` field (every call is foreground from your perspective) and no cancel API.
+- **Subagents** \u2014 Use your native \`task\` tool to launch a sub-agent for a self-contained piece of work. It is a built-in Cursor tool, NOT the same-named Shipyard \`task\` MCP tool (that one manages sibling tasks \u2014 see below); call the native one directly rather than searching the MCP surface. The native \`task\` has no \`run_in_background\` field (every call is foreground from your perspective) and no cancel API.
 - **Edits** \u2014 Use \`Write\` (new files) and \`Edit\` (modify existing files) for all file changes.
 - **Permission failures \u2014 do not retry** \u2014 when a tool call is blocked (plan mode, or a denied permission prompt), it fails with a clear message. Report the failure to the user and stop; do NOT loop retrying the same blocked call.
 - **Skills** \u2014 Invoke a skill by typing \`/skill-name\` in a message. If a skill fails to load, read its \`SKILL.md\` directly via \`Shell\` (e.g. \`cat ~/.claude/skills/<name>/SKILL.md\`). The Shipyard repo's domain docs (\`docs/architecture.md\`, \`docs/engineering-standards.md\`, \`docs/development.md\`, and \`AGENTS.md\`) are always available via \`Shell\` regardless of skill resolution.
@@ -21196,6 +21374,22 @@ function matchCollabQueueCorrelationIds(messages, queueEntries) {
   return claimedIds;
 }
 
+// src/services/session/claude-tool-guard.ts
+var SHIPYARD_DENIED_CLAUDE_TOOLS = ["Artifact"];
+function detectDeniedToolsPresent(initTools, denied = SHIPYARD_DENIED_CLAUDE_TOOLS) {
+  const present = new Set(initTools);
+  return denied.filter((name) => present.has(name));
+}
+function partitionInitTools(initTools) {
+  const builtin = [];
+  const mcp = [];
+  for (const name of initTools) {
+    if (name.startsWith("mcp__")) mcp.push(name);
+    else builtin.push(name);
+  }
+  return { builtin, mcp };
+}
+
 // src/services/session/codex-home-isolation.ts
 import { join as join26 } from "path";
 var ISOLATED_CODEX_HOME_DIR = "codex-isolated";
@@ -21807,9 +22001,26 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
           ...options.env,
           DISABLE_AUTO_COMPACT: "1",
           CLAUDE_CODE_ENTRYPOINT: "shipyard",
+          /**
+           * The `shipyard` entrypoint above opts Shipyard OUT of the runtime's
+           * SDK-session default that hides claude.ai Artifacts, so the built-in
+           * `Artifact` tool would otherwise be live and compete with Shipyard's
+           * own `visualize` / `present` / `register_deliverable` surface (#4992).
+           * This is the runtime's dedicated kill switch: it disables the tool,
+           * its prompt guidance, and the coupled claude.ai publish flow. It is
+           * the belt to the `disallowedTools` suspenders below. The runtime does
+           * a raw truthiness check — set `'1'`, never `'0'` to "disable".
+           */
+          CLAUDE_CODE_DISABLE_ARTIFACT: "1",
           ...buildAgentSubprocessCodexHomeEnv()
         },
-        disallowedTools: options.disallowedTools,
+        /**
+         * Deny Shipyard-suppressed built-in tools unconditionally at this
+         * chokepoint (not via the caller's option, which `Thread.setMode` may
+         * clear to `undefined`). Union with any caller-supplied denies so this
+         * never clobbers them. See `claude-tool-guard.ts`.
+         */
+        disallowedTools: [...options.disallowedTools ?? [], ...SHIPYARD_DENIED_CLAUDE_TOOLS],
         skills: options.skills,
         // eslint-disable-next-line no-restricted-syntax -- SpawnOptions.betas is string[] for loose protocol compat; SDK expects SdkBeta[] which is a branded subset
         betas: options.betas,
@@ -22074,6 +22285,34 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
       })
     });
   }
+  /**
+   * Record the built-in tool surface the SDK reported at init, and alarm if a
+   * Shipyard-denied tool leaked through despite the spawn-time deny config
+   * (`claude-tool-guard.ts`). `agent_tool_surface` is emitted once per spawn so
+   * fleet telemetry can spot a silently-added opt-in tool across an SDK bump
+   * without a hardcoded baseline; `agent_denied_tool_leaked` is the regression
+   * canary for our own disable (e.g. the runtime renamed `Artifact`).
+   */
+  #reportToolSurface(event, log) {
+    if (!log) return;
+    const tools = event.metadata?.tools ?? [];
+    const { builtin, mcp } = partitionInitTools(tools);
+    log({
+      event: "agent_tool_surface",
+      builtinCount: builtin.length,
+      mcpCount: mcp.length,
+      builtinTools: builtin,
+      agentRuntimeVersion: event.metadata?.agentRuntimeVersion
+    });
+    const leaked = detectDeniedToolsPresent(tools);
+    if (leaked.length > 0) {
+      log({
+        event: "agent_denied_tool_leaked",
+        leaked,
+        agentRuntimeVersion: event.metadata?.agentRuntimeVersion
+      });
+    }
+  }
   async #runMessageLoop(log) {
     const taskFilter = createSubagentTaskFilter();
     try {
@@ -22083,6 +22322,7 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
         if (event) {
           if (event.type === "init_received") {
             await this.#awaitMcpSettleForInit(message, log);
+            this.#reportToolSurface(event, log);
           }
           this.#onEvent(event);
         }
@@ -22482,7 +22722,7 @@ async function runFastSliceAgentBroadcast(deps) {
   if (deps.isDisposed?.()) return;
   const current = deps.capabilitiesRef.current;
   if (!current) return;
-  deps.capabilitiesRef.current = {
+  deps.commit({
     ...current,
     installedAgents: agents,
     installedRuntimes: agents,
@@ -22494,7 +22734,7 @@ async function runFastSliceAgentBroadcast(deps) {
      * must not also assume other slices are populated until the second broadcast.
      */
     detectionComplete: true
-  };
+  });
   deps.broadcast();
 }
 function decidePreferredAuthBackfill(args) {
@@ -22635,7 +22875,7 @@ function rehydrateVizRegistry(registry, vizWatcher, resolvedTaskId, vizDir, log)
   const registryPath = join28(vizDir, resolvedTaskId, "registry.json");
   if (!existsSync3(registryPath)) return Promise.resolve();
   try {
-    const raw = readFileSync4(registryPath, "utf-8");
+    const raw = readFileSync5(registryPath, "utf-8");
     const parsed = PersistedVisualizationRegistrySchema.safeParse(JSON.parse(raw));
     if (parsed.success) {
       const effects = registry.rehydrate(resolvedTaskId, parsed.data);
@@ -23924,6 +24164,7 @@ import { randomUUID as randomUUID9 } from "crypto";
 var NOTIFICATIONS_PER_TASK_CAP = 50;
 var CREATE_THEN_RESOLVE_WINDOW_MS = 500;
 var DEFAULT_GC_HORIZON_MS = 24 * 60 * 60 * 1e3;
+var EVENT_AGE_OUT_HORIZON_MS = 7 * 24 * 60 * 60 * 1e3;
 var STATEFUL_NOTIFICATION_KINDS = /* @__PURE__ */ new Set([
   "permission",
   "plan_review",
@@ -24128,19 +24369,28 @@ var NotificationsHandler = class {
    * the dedup window) are NOT replayed — they aren't durable yet.
    *
    * `viewerUserId` is accepted for symmetry with the handler signature
-   * documented in the plan, but per-user `targetUserIds` filtering is
-   * applied browser-side. Forwarding the entire map keeps the daemon
-   * simple and matches the `notification_snapshot` schema.
+   * documented in the plan, but per-user `targetUserIds`/dismiss filtering is
+   * applied browser-side. Aged pure events are dropped here (viewer-independent)
+   * so this per-task path agrees with `buildInboxSnapshot`'s read-path age
+   * filter — otherwise opening the active task on a long-uptime daemon would
+   * re-surface events the cross-task `inbox_snapshot` just aged out.
    */
   replayNotificationsToPeer(send, _viewerUserId) {
     this.#runWhenReady(() => {
       const record = this.#deps.taskStateStore.getTaskSync(this.#deps.taskId);
       if (record?.archivedAt != null) return;
-      if (Object.keys(this.#notifications).length === 0) return;
+      const now = Date.now();
+      const notifications = {};
+      for (const [id, n] of Object.entries(this.#notifications)) {
+        if (n.resolvedAt == null && isPureEventPastHorizon(n, now, EVENT_AGE_OUT_HORIZON_MS))
+          continue;
+        notifications[id] = n;
+      }
+      if (Object.keys(notifications).length === 0) return;
       send({
         type: "notification_snapshot",
         taskId: this.#deps.taskId,
-        notifications: { ...this.#notifications }
+        notifications
       });
     });
   }
@@ -24416,6 +24666,19 @@ function passReplaceByKind(next, bootTimestamp) {
   }
   return retired;
 }
+function passRetireAgedEvents(next, bootTimestamp, eventHorizonMs) {
+  let retired = 0;
+  for (const [id, n] of Object.entries(next)) {
+    if (n.resolvedAt != null) continue;
+    if (!isPureEventPastHorizon(n, bootTimestamp, eventHorizonMs)) continue;
+    next[id] = { ...n, resolvedAt: bootTimestamp, resolvedBy: "aged_out" };
+    retired++;
+  }
+  return retired;
+}
+function isPureEventPastHorizon(n, now, horizonMs) {
+  return notificationDedupKey(n) === null && now - n.createdAt >= horizonMs;
+}
 function passPruneResolved(next, bootTimestamp, pruneHorizonMs) {
   const pruneCutoff = bootTimestamp - pruneHorizonMs;
   const after = {};
@@ -24429,31 +24692,46 @@ function passPruneResolved(next, bootTimestamp, pruneHorizonMs) {
   }
   return { after, pruned };
 }
-function sweepNotificationsForTask(notifications, bootTimestamp, pruneHorizonMs = DEFAULT_GC_HORIZON_MS) {
+function sweepNotificationsForTask(notifications, bootTimestamp, pruneHorizonMs = DEFAULT_GC_HORIZON_MS, eventHorizonMs = EVENT_AGE_OUT_HORIZON_MS) {
   const working = { ...notifications };
   const retired1 = passRetireStatefulOrphans(working, bootTimestamp);
   const retired2 = passReplaceByKind(working, bootTimestamp);
+  const retired3 = passRetireAgedEvents(working, bootTimestamp, eventHorizonMs);
   const { after, pruned } = passPruneResolved(working, bootTimestamp, pruneHorizonMs);
-  const retired = retired1 + retired2;
+  const retired = retired1 + retired2 + retired3;
   const changed = retired > 0 || pruned > 0;
   return { next: changed ? after : null, retired, pruned };
 }
-function buildInboxSnapshot(tasks) {
+function isInboxVisible(n, ownerUserId, acknowledgedAt, now) {
+  if (n.resolvedAt != null) return false;
+  if (n.ackByUser[ownerUserId]?.dismissedAt != null) return false;
+  if (acknowledgedAt != null && acknowledgedAt >= n.createdAt) return false;
+  if (isPureEventPastHorizon(n, now, EVENT_AGE_OUT_HORIZON_MS)) return false;
+  return true;
+}
+function selectInboxNotificationsForTask(record, ownerUserId, now) {
+  if (record.archivedAt != null) return null;
+  const notifications = record.notifications;
+  if (!notifications) return null;
+  const acknowledgedAt = record.acknowledgedAt ?? null;
+  let visible = null;
+  for (const [id, n] of Object.entries(notifications)) {
+    if (!isInboxVisible(n, ownerUserId, acknowledgedAt, now)) continue;
+    if (visible === null) visible = {};
+    visible[id] = n;
+  }
+  return visible;
+}
+function buildInboxSnapshot(tasks, ownerUserId) {
+  const now = Date.now();
   const out = {};
   for (const [taskId, record] of Object.entries(tasks)) {
-    const notifications = record.notifications;
-    if (!notifications) continue;
-    let unresolved = null;
-    for (const [id, n] of Object.entries(notifications)) {
-      if (n.resolvedAt != null) continue;
-      if (unresolved === null) unresolved = {};
-      unresolved[id] = n;
-    }
-    if (unresolved !== null) out[taskId] = unresolved;
+    const visible = selectInboxNotificationsForTask(record, ownerUserId, now);
+    if (visible !== null) out[taskId] = visible;
   }
   return out;
 }
-async function sweepOrphanedNotifications(taskStateStore, log) {
+async function sweepOrphanedNotifications(taskStateStore, log, eventHorizonMs = EVENT_AGE_OUT_HORIZON_MS) {
   const bootTimestamp = Date.now();
   let tasks;
   try {
@@ -24471,7 +24749,12 @@ async function sweepOrphanedNotifications(taskStateStore, log) {
   for (const [taskId, record] of Object.entries(tasks)) {
     const notifications = record.notifications;
     if (!notifications || Object.keys(notifications).length === 0) continue;
-    const { next, retired, pruned } = sweepNotificationsForTask(notifications, bootTimestamp);
+    const { next, retired, pruned } = sweepNotificationsForTask(
+      notifications,
+      bootTimestamp,
+      DEFAULT_GC_HORIZON_MS,
+      eventHorizonMs
+    );
     if (!next) continue;
     sweptTasks++;
     sweptNotifications += retired;
@@ -25034,7 +25317,7 @@ function buildTaskCallbacks(deps) {
       daemon.taskStateStore.listTasks().then((all) => {
         getControlHandler().sendControl({
           type: "inbox_snapshot",
-          notificationsByTask: buildInboxSnapshot(all)
+          notificationsByTask: buildInboxSnapshot(all, daemon.userId)
         });
       }).catch((err3) => {
         logAdapter({
@@ -30383,7 +30666,7 @@ function isNodeBuildReleaseDir(dir) {
 }
 
 // src/services/port-detection.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname19, join as join35 } from "path";
 var LSOF_TIMEOUT_MS = 8e3;
 var LSOF_TTL_MS = 5e3;
@@ -30570,7 +30853,7 @@ function resolveProjectRoot(cwd) {
     if (existsSync6(candidate)) {
       let packageName;
       try {
-        const raw = readFileSync5(candidate, "utf8");
+        const raw = readFileSync6(candidate, "utf8");
         const parsed = JSON.parse(raw);
         if (parsed !== null && typeof parsed === "object" && hasStringName(parsed)) {
           packageName = parsed.name;
@@ -30685,7 +30968,7 @@ import { randomUUID as randomUUID10 } from "crypto";
 import {
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
@@ -30705,7 +30988,7 @@ function recordFilePath2(rootDir, taskId, elementId) {
 function parseRecord2(filePath, logger2) {
   let raw;
   try {
-    raw = readFileSync6(filePath, "utf-8");
+    raw = readFileSync7(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -37899,10 +38182,10 @@ function isWakeableSession(state) {
   }
 }
 function buildWakeMessage(prNumber, ciState) {
-  if (ciState === "failure") {
-    return `[Shipyard] CI checks failed on your open pull request #${prNumber}. Review the failing checks in the <branch> resource, fix them, and push to the same PR.`;
-  }
-  return `[Shipyard] CI checks passed on your open pull request #${prNumber}. Review the <branch> resource and continue your task \u2014 merge it if it is ready, or address any remaining work.`;
+  const body = ciState === "failure" ? `CI checks failed on your open pull request #${prNumber}. Review the failing checks in the <branch> resource, fix them, and push to the same PR.` : `CI checks passed on your open pull request #${prNumber}. Review the <branch> resource and continue your task \u2014 merge it if it is ready, or address any remaining work.`;
+  return `<system-reminder>
+${body}
+</system-reminder>`;
 }
 function maybeWakeAgentOnPrCheck(deps, taskId, prev, next) {
   const decision = decidePrCheckWake({
@@ -37925,7 +38208,17 @@ function buildPrCheckWakeDeps(taskManager, log) {
   return {
     getSessionState: (taskId) => taskManager.getTaskState(taskId)?.sessionState ?? null,
     wake: (taskId, message) => {
-      void taskManager.handleUserMessage(taskId, [{ type: "text", text: message }]).catch((err3) => {
+      void taskManager.handleUserMessage(
+        taskId,
+        [{ type: "text", text: message }],
+        void 0,
+        void 0,
+        void 0,
+        void 0,
+        void 0,
+        "human",
+        true
+      ).catch((err3) => {
         log({
           event: "pr_check_wake_failed",
           taskId,
@@ -39580,6 +39873,56 @@ function createDeliverableTools(ctx) {
   ];
 }
 
+// src/services/harness/open-file-server.ts
+var OPEN_FILE_DESCRIPTION = [
+  "Open a file in Shipyard's code-editor side panel.",
+  "",
+  "Use it to surface a file in the UI at the moment it matters \u2014 right after you edit it, when your reply references specific code, or when you point the reviewer at what to look at next. Opens the panel if closed, selects the file, and (with `line`) scrolls to that line.",
+  "",
+  "WHEN: after an edit the reviewer should see, when your answer references a file, or when directing attention to a specific spot.",
+  'WHEN NOT: for a file the reviewer is already looking at, or as a substitute for explaining a change \u2014 use `add_comment` for the "why" on a diff hunk.',
+  "",
+  "Params:",
+  "  path \u2014 the file to open. Absolute or workspace-relative; the browser resolves it against the task working directory.",
+  "  line \u2014 optional 1-based line to scroll to and place the cursor on.",
+  "",
+  "EXAMPLES:",
+  '  {"path": "src/db.ts"}',
+  '  {"path": "src/index.ts", "line": 42}'
+].join("\n");
+var OpenFileInput = {
+  path: external_exports.string().trim().min(1, "path cannot be empty").describe(
+    "File to open, absolute or workspace-relative. Resolved against the task working directory in the browser."
+  ),
+  line: external_exports.number().int().positive().optional().describe("Optional 1-based line number to scroll to and place the cursor on.")
+};
+var OpenFileSchema = external_exports.object(OpenFileInput);
+function createOpenFileTools(ctx) {
+  return [
+    {
+      name: OPEN_FILE_TOOL,
+      description: OPEN_FILE_DESCRIPTION,
+      inputSchema: OpenFileInput,
+      handler: async (input) => {
+        const parsed = OpenFileSchema.safeParse(input);
+        if (!parsed.success) {
+          const reason = parsed.error.issues.map((i) => i.message).join("; ");
+          return {
+            content: [{ type: "text", text: `Invalid open_file input: ${reason}` }],
+            isError: true
+          };
+        }
+        const { path: path5, line } = parsed.data;
+        ctx.broadcastControl({ type: "open_file", taskId: ctx.taskId.current, path: path5, line });
+        const where = line !== void 0 ? ` at line ${line}` : "";
+        return {
+          content: [{ type: "text", text: `Opened ${path5}${where} in the file viewer.` }]
+        };
+      }
+    }
+  ];
+}
+
 // src/services/harness/plugin-server.ts
 import { mkdir as mkdir19, writeFile as writeFile19 } from "fs/promises";
 import { join as join52 } from "path";
@@ -40433,6 +40776,12 @@ var CreateTaskInputSchema = external_exports.object({
       "Must be a model id registered with this daemon (see the `models` capability snapshot). The daemon validates the id against the registered profile catalog at handler time and refuses spawn if the model is unknown.",
       "The spawned task always runs on the agent that owns this model \u2014 pre-warm adoption respects the target agent."
     ].join("\n")
+  ),
+  mcpServers: external_exports.array(external_exports.string()).optional().describe(
+    [
+      "ALLOWLIST of MCP server names the spawned task may use. Omit to inherit the parent task's MCP set (the default). When set, ONLY the named servers stay enabled for the spawned task \u2014 all other configured servers are filtered out, so a spawned sub-task does not inherit the full workspace roster.",
+      "Pass [] to spawn with no MCP servers at all. Names must match the daemon's configured MCP set (see the `mcpServers` capability snapshot); unknown names are reported and the spawn is refused so you can correct."
+    ].join("\n")
   )
 });
 var TASK_TOOL_DESCRIPTION = [
@@ -40518,6 +40867,18 @@ function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUS_SET.has(status);
 }
 var TASK_SNAPSHOT_URI_PREFIX = "shipyard://task-snapshot/";
+function planMcpAllowlist(allowlist, knownNames) {
+  if (allowlist === void 0) return { kind: "inherit" };
+  const known = knownNames ? [...knownNames] : [];
+  const knownSet = new Set(known);
+  const unknown = [...new Set(allowlist.filter((name) => !knownSet.has(name)))];
+  if (unknown.length > 0) return { kind: "unknown", unknown, known };
+  return { kind: "filter", mcpServerSnapshot: [...new Set(allowlist)], disabledMcpServers: [] };
+}
+function unknownMcpServersMessage(unknown, known) {
+  const suggestion = known.length === 0 ? "This daemon has no MCP servers configured \u2014 omit `mcpServers` to inherit the parent set, or pass [] to spawn with none." : `Configured MCP servers: ${[...known].sort((a, b2) => a.localeCompare(b2)).join(", ")}.`;
+  return `Unknown MCP server(s) in the mcpServers allowlist: ${unknown.join(", ")}. ${suggestion}`;
+}
 async function handleCreateTask(input, ctx) {
   const parsed = CreateTaskInputSchema.safeParse(input);
   if (!parsed.success) {
@@ -40527,9 +40888,17 @@ async function handleCreateTask(input, ctx) {
   const callingTaskId = ctx.callingTaskId.current;
   const inputError = validateCreateTaskInputs(args, ctx);
   if (inputError !== null) return inputError;
+  const mcpPlan = planMcpAllowlist(
+    args.mcpServers,
+    args.mcpServers === void 0 ? void 0 : ctx.getKnownMcpServerNames()
+  );
+  if (mcpPlan.kind === "unknown") {
+    return errorResult(unknownMcpServersMessage(mcpPlan.unknown, mcpPlan.known));
+  }
   const inheritedDefaults = await resolveInheritedTaskDefaults(
     args.permissionMode,
     args.model,
+    mcpPlan,
     callingTaskId,
     ctx
   );
@@ -40836,7 +41205,7 @@ async function spawnWithFreshWorktree(args, callingTaskId, ctx, inheritedDefault
   }
   return successResult(taskId, args.title, branchName, "create");
 }
-async function resolveInheritedTaskDefaults(permissionModeOverride, modelOverride, callingTaskId, ctx) {
+async function resolveInheritedTaskDefaults(permissionModeOverride, modelOverride, mcpPlan, callingTaskId, ctx) {
   const parent = await ctx.taskStateStore.getTask(callingTaskId);
   const parentSettings = parent?.composerSettings ?? {};
   const merged = { ...parentSettings };
@@ -40846,6 +41215,10 @@ async function resolveInheritedTaskDefaults(permissionModeOverride, modelOverrid
   if (modelOverride !== void 0) {
     merged.model = modelOverride;
   }
+  if (mcpPlan.kind === "filter") {
+    merged.disabledMcpServers = mcpPlan.disabledMcpServers;
+    merged.mcpServerSnapshot = mcpPlan.mcpServerSnapshot;
+  }
   return {
     initialComposerSettings: Object.keys(merged).length === 0 ? void 0 : merged,
     projectId: parent?.projectId ?? null
@@ -50252,6 +50625,7 @@ var LSP_TOOL_NAMES = [
   "lsp_find_references",
   "lsp_rename_symbol"
 ];
+var OPEN_FILE_TOOL_NAMES = ["open_file"];
 function buildHarnessTools(ctx) {
   const taskIdRef = { current: ctx.taskId };
   const epochRef = { current: null };
@@ -50305,6 +50679,7 @@ function buildHarnessTools(ctx) {
     defaultRepoPath: ctx.projectRoot,
     isKnownModel: ctx.isKnownModel,
     getModels: ctx.getModels,
+    getKnownMcpServerNames: ctx.getKnownMcpServerNames,
     resolveSnapshot: ctx.resolveSnapshot
   };
   const lspAgentCtx = {
@@ -50312,6 +50687,10 @@ function buildHarnessTools(ctx) {
     log: ctx.log,
     getClient: ctx.getLspClient
   };
+  const openFileCtx = {
+    taskId: taskIdRef,
+    broadcastControl: ctx.broadcastControl
+  };
   const skillsCtx = {
     taskId: taskIdRef,
     agentSystem: ctx.agentSystem,
@@ -50335,6 +50714,7 @@ function buildHarnessTools(ctx) {
   registerFactory(TASK_CONTROL_TOOL_NAMES, () => createTaskControlTools(taskControlCtx));
   registerFactory(DELIVERABLE_TOOL_NAMES, () => createDeliverableTools(deliverableCtx));
   registerFactory(LSP_TOOL_NAMES, () => createLspAgentTools(lspAgentCtx));
+  registerFactory(OPEN_FILE_TOOL_NAMES, () => createOpenFileTools(openFileCtx));
   const tools = [];
   for (const spec of HARNESS_TOOL_REGISTRY) {
     if (!passes(spec)) continue;
@@ -50398,12 +50778,12 @@ function createHarnessMcpServer(ctx) {
 
 // src/services/harness/lsp-agent-client.ts
 import { spawn as spawn10 } from "child_process";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { extname as extname3 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/services/lsp/language-server-registry.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 import { createRequire as createRequire3 } from "module";
 import { dirname as dirname22, isAbsolute as isAbsolute4, join as join53 } from "path";
 function decideTypescriptServer(d) {
@@ -50532,7 +50912,7 @@ function createRegistryDeps(requireFrom) {
     fileExists: (path5) => existsSync7(path5),
     readJsonFile: (path5) => {
       try {
-        return parse2(readFileSync7(path5, "utf-8"));
+        return parse2(readFileSync8(path5, "utf-8"));
       } catch {
         return void 0;
       }
@@ -50560,7 +50940,7 @@ function resolveTsgoBinaryPath(req) {
 }
 function resolveBinViaPackageJson(pkg, binName, req) {
   const pkgJsonPath = req.resolve(`${pkg}/package.json`);
-  const manifest = parse2(readFileSync7(pkgJsonPath, "utf-8"));
+  const manifest = parse2(readFileSync8(pkgJsonPath, "utf-8"));
   const binField = isRecord7(manifest) ? manifest.bin : void 0;
   const named = isRecord7(binField) ? binField[binName] : void 0;
   const bin = typeof binField === "string" ? binField : typeof named === "string" ? named : void 0;
@@ -50716,7 +51096,7 @@ var LspAgentClient = class {
     if (this.#disposed) return;
     this.#armIdleTimer();
     const uri = pathToFileURL3(absolutePath).href;
-    const text = readFileSync8(absolutePath, "utf8");
+    const text = readFileSync9(absolutePath, "utf8");
     const prevVersion = this.#openedVersions.get(uri);
     if (prevVersion === void 0) {
       this.#notify("textDocument/didOpen", {
@@ -59983,6 +60363,13 @@ var ScheduleEvaluator = class {
   }
 };
 
+// src/services/serve-factory/capability-writer.ts
+function createCapabilityWriter(capabilitiesRef) {
+  return (next) => {
+    capabilitiesRef.current = next;
+  };
+}
+
 // ../../packages/session/src/codex-app-server/shared-protocol-types.ts
 var ReasoningEffortSchema = external_exports2.string();
 var TurnStatusSchema = external_exports2.enum(["completed", "interrupted", "failed", "inProgress"]);
@@ -63107,6 +63494,29 @@ function buildCodexPlanUpdateHandler(deps) {
   };
 }
 
+// src/services/session/codex-resume-classifier.ts
+function isCodexArchiveThreadNotFound(err3) {
+  const message = err3 instanceof Error ? err3.message : String(err3);
+  return err3 instanceof JsonRpcRequestError && err3.method === "thread/archive" && /(?:no rollout found for thread id|ThreadNotFound|thread not found|no rollout|rollout.*not.*found)/i.test(
+    message
+  );
+}
+function isCodexResumeThreadNotFound(err3) {
+  const message = err3 instanceof Error ? err3.message : String(err3);
+  return err3 instanceof JsonRpcRequestError && err3.method === "thread/resume" && /(?:no rollout found for thread id|ThreadNotFound|thread not found|no rollout|rollout.*not.*found)/i.test(
+    message
+  );
+}
+function isCodexResumeThreadArchived(err3) {
+  const message = err3 instanceof Error ? err3.message : String(err3);
+  return err3 instanceof JsonRpcRequestError && err3.method === "thread/resume" && /archived/i.test(message);
+}
+function classifyResumeFallback(err3) {
+  if (isCodexResumeThreadArchived(err3)) return { reason: "archived" };
+  if (isCodexResumeThreadNotFound(err3)) return { reason: "no_rollout" };
+  return null;
+}
+
 // src/services/session/codex-turn-event-dispatch.ts
 function maybeEmitBlockBoundary(nextType, cell, onEvent) {
   if (!cell) return;
@@ -63123,6 +63533,7 @@ function maybeEmitBlockBoundary(nextType, cell, onEvent) {
   cell.current = nextType;
 }
 function dispatchCodexTurnEvent(frame, deps) {
+  deps.onLiveness();
   switch (frame.method) {
     case CodexNotifications.itemStarted:
     case CodexNotifications.itemCompleted:
@@ -64259,8 +64670,13 @@ var CodexAgentSubprocess = class _CodexAgentSubprocess {
     try {
       return await client.resumeThread(opts.resume, threadParams);
     } catch (err3) {
-      if (!isCodexResumeThreadNotFound(err3)) throw err3;
-      opts.log({ event: "codex_resume_no_rollout_fallback", threadId: opts.resume });
+      const fallback = classifyResumeFallback(err3);
+      if (fallback === null) throw err3;
+      opts.log({
+        event: "codex_resume_no_rollout_fallback",
+        threadId: opts.resume,
+        reason: fallback.reason
+      });
       if (opts.onResumeNoRollout !== void 0) {
         try {
           await opts.onResumeNoRollout(opts.resume);
@@ -64429,8 +64845,13 @@ var CodexAgentSubprocess = class _CodexAgentSubprocess {
       try {
         startResponse = await client.resumeThread(priorThreadId, startParams);
       } catch (err3) {
-        if (!isCodexResumeThreadNotFound(err3)) throw err3;
-        this.#log({ event: "codex_engine_resume_no_rollout_fallback", threadId: priorThreadId });
+        const fallback = classifyResumeFallback(err3);
+        if (fallback === null) throw err3;
+        this.#log({
+          event: "codex_engine_resume_no_rollout_fallback",
+          threadId: priorThreadId,
+          reason: fallback.reason
+        });
         startResponse = await client.startThread(startParams);
       }
     } else {
@@ -64628,6 +65049,13 @@ var CodexAgentSubprocess = class _CodexAgentSubprocess {
     dispatchCodexTurnEvent(event, {
       translatorCtx: this.#translatorCtx,
       onEvent: this.#onEvent,
+      /**
+       * Stall-watchdog liveness (#4921): every turn frame is proof of life.
+       * `stream_activity` resets the (agent-neutral) session-manager watchdog;
+       * the manager throttles high-rate deltas and no-ops when the watchdog is
+       * disabled, so this is safe to fire per frame.
+       */
+      onLiveness: () => this.#onEvent({ type: "stream_activity" }),
       onTokenUsage: (payload) => {
         this.#lastTurnTokenUsage = payload.tokenUsage;
       },
@@ -64919,7 +65347,7 @@ var CodexAgentSubprocess = class _CodexAgentSubprocess {
    */
   async rollback(numTurns) {
     const threadId = this.#threadId;
-    if (!threadId || this.#closed) return;
+    if (!threadId || this.#closed || numTurns < 1) return;
     await this.#client.rollback(threadId, { numTurns });
   }
   /**
@@ -65211,18 +65639,6 @@ var CodexAgentSubprocess = class _CodexAgentSubprocess {
 function toCodexWireEffort(effort) {
   return effort;
 }
-function isCodexArchiveThreadNotFound(err3) {
-  const message = err3 instanceof Error ? err3.message : String(err3);
-  return err3 instanceof JsonRpcRequestError && err3.method === "thread/archive" && /(?:no rollout found for thread id|ThreadNotFound|thread not found|no rollout|rollout.*not.*found)/i.test(
-    message
-  );
-}
-function isCodexResumeThreadNotFound(err3) {
-  const message = err3 instanceof Error ? err3.message : String(err3);
-  return err3 instanceof JsonRpcRequestError && err3.method === "thread/resume" && /(?:no rollout found for thread id|ThreadNotFound|thread not found|no rollout|rollout.*not.*found)/i.test(
-    message
-  );
-}
 
 // src/services/session/codex-subprocess-facade.ts
 function detectedCodexVersionForLog(input) {
@@ -72353,13 +72769,13 @@ async function defaultFileExists2(path5) {
     return false;
   }
 }
-function defaultExec(command, args, cwd) {
+function defaultExec2(command, args, cwd) {
   return runWithTimeout(command, args, cwd, STACK_TIMEOUT_MS);
 }
 async function detectStack(cwd, currentBranch, deps = {}) {
   const isCommandAvailable = deps.isCommandAvailable ?? defaultIsCommandAvailable;
   const fileExists2 = deps.fileExists ?? defaultFileExists2;
-  const exec = deps.exec ?? defaultExec;
+  const exec = deps.exec ?? defaultExec2;
   const getDefaultBranch2 = deps.getDefaultBranch ?? getRepoDefaultBranch;
   const graphite = await detectGraphite(
     cwd,
@@ -77233,7 +77649,7 @@ function handleSpawning(snapshot, event) {
     b2.log("spawning", "cold_idle", event.type);
     b2.taskStatus("input_required");
     b2.emitError(
-      "Cursor timed out waiting for the first response. Send a message to try again.",
+      "The agent timed out waiting for the first response. Send a message to try again.",
       "sdk_error",
       "run_stall_timeout"
     );
@@ -77256,7 +77672,7 @@ function runningStallTimeout(sessionId, event) {
   if (!event.recoveryArmed) {
     b2.taskStatus("input_required");
     b2.emitError(
-      "Cursor stopped responding mid-run. Send a message to try again.",
+      "The agent stopped responding mid-run. Send a message to try again.",
       "sdk_error",
       "run_stall_timeout"
     );
@@ -81163,6 +81579,15 @@ function createPlanFileWatcher(deps) {
 }
 
 // src/services/plan/plan-handler-helpers.ts
+function narrowPrePlanMode(mode) {
+  if (mode === void 0 || mode === "plan") return void 0;
+  return mode;
+}
+function decidePostApprovalMode(incoming, prePlanMode) {
+  if (incoming !== void 0 && incoming !== "default") return incoming;
+  if (prePlanMode !== void 0) return prePlanMode;
+  return incoming;
+}
 function parseAllowedPrompts(input) {
   if (input === null || input === void 0 || typeof input !== "object" || Array.isArray(input))
     return [];
@@ -82311,7 +82736,14 @@ var PlanHandler = class {
     }
   }
   async #tryPersistPreAttach(toolUseId, filePath, planDocId, allowedPrompts) {
-    const pendingDetection = { toolUseId, filePath, planDocId, allowedPrompts };
+    const prePlanPermissionMode = narrowPrePlanMode(this.#deps.getLatestSettings().permissionMode);
+    const pendingDetection = {
+      toolUseId,
+      filePath,
+      planDocId,
+      allowedPrompts,
+      prePlanPermissionMode
+    };
     try {
       await this.#persistDetection(pendingDetection);
       return true;
@@ -82409,8 +82841,12 @@ var PlanHandler = class {
     });
   }
   #applyPermissionMode(permissionMode) {
-    if (!permissionMode) return;
-    this.#deps.applyTaskSettings({ permissionMode });
+    const target = decidePostApprovalMode(
+      permissionMode,
+      this.#lastPlanDetection?.prePlanPermissionMode
+    );
+    if (!target) return;
+    this.#deps.applyTaskSettings({ permissionMode: target });
   }
   /**
    * Build the narrow Context for the review-resolution free functions. State
@@ -83849,18 +84285,27 @@ var RewindCheckpointHandler = class {
     return { kind: "fresh" };
   }
   /**
-   * Count the number of completed agent turns AFTER the checkpoint turn
-   * that corresponds to `targetSeqNo`. Used to compute `numTurns` for
-   * Codex's count-based `client.rollback` call.
+   * Count the completed agent turns dropped by rewinding to `targetSeqNo`,
+   * inclusive of the turn that STARTS at the target. Used to compute
+   * `numTurns` for Codex's count-based `client.rollback` call and Cursor's
+   * store truncation.
    *
-   * Each user-facing turn = 1 spawn + 1 end = 2 consecutive entries in
-   * `#allCheckpointTurnNos`. The number of turns after `targetTurnNo`
-   * is therefore floor(count of entries > targetTurnNo / 2).
+   * A user-facing turn = 1 spawn + 1 end = 2 consecutive entries in
+   * `#allCheckpointTurnNos` (`[spawn0, end0, spawn1, end1, ...]`). A rewind
+   * target seqNo is a user message, which maps to that turn's SPAWN
+   * checkpoint (even index) — and `rewind_files` restores the tree to that
+   * spawn checkpoint, i.e. to BEFORE the turn ran. So the target's own turn
+   * is being dropped and must be counted: the answer is
+   * floor(count of entries `>= targetTurnNo` / 2), not `>`. Using `>` here
+   * undercounts by one whenever the target lands on a spawn checkpoint,
+   * yielding `numTurns: 0` for a rewind to the initial or most-recent turn —
+   * an invalid Codex `thread/rollback` (#5041). (For an odd/end target the
+   * two forms agree, so this only corrects the spawn-checkpoint case.)
    */
   #countTurnsAfter(targetSeqNo) {
     const targetTurnNo = this.#findCheckpointForSeqNo(targetSeqNo);
     if (targetTurnNo === null) return 0;
-    return Math.floor(this.#allCheckpointTurnNos.filter((t) => t > targetTurnNo).length / 2);
+    return Math.floor(this.#allCheckpointTurnNos.filter((t) => t >= targetTurnNo).length / 2);
   }
   async rewind(targetSeqNo, mode) {
     if (this.#rewindInProgress) {
@@ -92960,6 +93405,7 @@ async function persistUserMessageAtChokepoint(args) {
       senderKind: args.senderKind ?? "human",
       content: stripBlobResourcesForStorage(args.content),
       timestamp: Date.now(),
+      ...args.isSynthetic === true && { isSynthetic: true },
       ...persistedCorrelationId !== void 0 && { correlationId: persistedCorrelationId },
       model: effectiveSettings.model ?? null,
       reasoningEffort: effectiveSettings.reasoningEffort ?? null,
@@ -94449,7 +94895,7 @@ var TaskManager = class {
     });
     return task;
   }
-  async handleUserMessage(taskId, content, settings, cwd, participantId, senderDisplayName, correlationId, senderKind = "human") {
+  async handleUserMessage(taskId, content, settings, cwd, participantId, senderDisplayName, correlationId, senderKind = "human", isSynthetic = false) {
     const task = await this.#ensureTaskForUserMessage(taskId);
     if (cwd && cwd !== task.cwd) {
       if (task.mode === "review" && !task.cwd) {
@@ -94480,7 +94926,8 @@ var TaskManager = class {
       latestSettings: task.orchestrator.latestSettings,
       participantId,
       senderKind,
-      correlationId
+      correlationId,
+      isSynthetic
     });
     task.orchestrator.handleUserMessage(
       content,
@@ -95761,6 +96208,7 @@ async function createDaemon(deps) {
   shipyardResolver.addSubResolver("plugin", pluginResourceResolver);
   resourceRegistry.register(shipyardResolver);
   const capabilitiesRef = { current: null };
+  const commitCapabilities = createCapabilityWriter(capabilitiesRef);
   const rateLimitStoreRef = { current: null };
   const gitCheckpoint = createGitCheckpointService();
   const skillResolution = buildSkillResolutionService({
@@ -96266,6 +96714,7 @@ async function createDaemon(deps) {
        * fallback to Claude.
        */
       getModels: () => profileRegistry.list().flatMap((p2) => p2.models),
+      getKnownMcpServerNames: () => mcpCoordinatorRef.current?.getKnownServerNames(),
       /**
        * Lazy: taskSnapshotResolver is assigned after this function is defined
        * (same pattern as `getTaskManager: () => taskManager`). The callback is
@@ -96403,6 +96852,7 @@ async function createDaemon(deps) {
        * fallback to Claude.
        */
       getModels: () => profileRegistry.list().flatMap((p2) => p2.models),
+      getKnownMcpServerNames: () => mcpCoordinatorRef.current?.getKnownServerNames(),
       /**
        * Same lazy-resolver pattern as the Codex path above — taskSnapshotResolver
        * is assigned later in this function but always before any handler fires.
@@ -97424,14 +97874,14 @@ async function createDaemon(deps) {
   if (stallProfilerConfig.enabled) {
     stallProfiler.start();
   }
-  capabilitiesRef.current = await buildCapabilitiesStubWithDiskSeed();
+  commitCapabilities(await buildCapabilitiesStubWithDiskSeed());
   function markDetectionFailed(err3) {
     deps.log({
       event: "background_capability_init_failed",
       error: err3 instanceof Error ? err3.message : String(err3)
     });
     if (disposed || !capabilitiesRef.current) return;
-    capabilitiesRef.current = { ...capabilitiesRef.current, detectionComplete: true };
+    commitCapabilities({ ...capabilitiesRef.current, detectionComplete: true });
     broadcastRealCapabilities();
   }
   async function detectAndCommitCapabilities() {
@@ -97444,7 +97894,7 @@ async function createDaemon(deps) {
     const cursorDetect = profileRegistry.get("cursor")?.authDetector;
     next = await mergeCursorAuthFromVault(next, cursorDetect, deps.log);
     if (disposed) return null;
-    capabilitiesRef.current = next;
+    commitCapabilities(next);
     void saveCapabilitiesCache({
       environments: next.environments,
       mcpServers: next.mcpServers
@@ -97455,6 +97905,7 @@ async function createDaemon(deps) {
     await runFastSliceAgentBroadcast({
       detectAgents: (lastKnown) => detectAgentProviders(lastKnown),
       capabilitiesRef,
+      commit: commitCapabilities,
       broadcast: broadcastRealCapabilities,
       log: deps.log,
       isDisposed: () => disposed
@@ -97603,12 +98054,12 @@ async function createDaemon(deps) {
   function wireProxyAuthCallbacks(proxyServer) {
     proxyServer.setOnAuthRequired((serverName) => {
       if (capabilitiesRef.current?.mcpServers) {
-        capabilitiesRef.current = {
+        commitCapabilities({
           ...capabilitiesRef.current,
           mcpServers: capabilitiesRef.current.mcpServers.map(
             (s2) => s2.name === serverName ? { ...s2, authStatus: "unauthenticated" } : s2
           )
-        };
+        });
       }
       refreshCoordinatorFromCaps();
     });
@@ -97616,12 +98067,12 @@ async function createDaemon(deps) {
   function markConnectedProxyServersAuthed(proxyServer) {
     if (!capabilitiesRef.current?.mcpServers) return;
     const connectedNames = new Set(proxyServer.getServerNames());
-    capabilitiesRef.current = {
+    commitCapabilities({
       ...capabilitiesRef.current,
       mcpServers: capabilitiesRef.current.mcpServers.map(
         (s2) => connectedNames.has(s2.name) ? { ...s2, authStatus: "authenticated" } : s2
       )
-    };
+    });
   }
   function buildEnrichedSkillRows(skills) {
     try {
@@ -97913,7 +98364,7 @@ async function createDaemon(deps) {
       return capabilitiesRef.current;
     },
     set capabilities(c) {
-      capabilitiesRef.current = applyPluginSupersession(c);
+      commitCapabilities(applyPluginSupersession(c));
       refreshCoordinatorFromCaps();
       taskManager.refreshAllTaskSkillsSnapshots();
       reBroadcastEnrichedSkillsAfterWarm();
@@ -101194,4 +101645,4 @@ export {
   decideWorkspaceScope,
   serve
 };
-//# sourceMappingURL=serve-AA4FCUY6.js.map
+//# sourceMappingURL=serve-WG7HQAYG.js.map