@schoolai/shipyard 3.2.2 → 3.2.3-nightly.20260423.0

package/dist/{serve-O4AHOTL4.js → serve-IMSVRV3B.js}

@@ -47,11 +47,11 @@ import {
   VaultKeyPutRequestSchema,
   VaultKeyPutResponseSchema,
   classifyClaudeCodeCompatibility
-} from "./chunk-N4ZTO3K3.js";
+} from "./chunk-CUK27MYV.js";
 import "./chunk-EHQITHQX.js";
 import {
   loadAuthToken
-} from "./chunk-5RH5JP3R.js";
+} from "./chunk-GLH3V7NG.js";
 import {
   DiscoveryStateSchema,
   detectMCPServers,
@@ -62,19 +62,19 @@ import {
   redactEnv,
   resolveEnabledMcpServers,
   resolveStdioEnv
-} from "./chunk-NZFMJMJN.js";
+} from "./chunk-67VJDX7G.js";
 import {
   createChildLogger,
   flushLogger,
   logger
-} from "./chunk-DB5R6SKT.js";
+} from "./chunk-DNIC3FOH.js";
 import {
   external_exports,
   getShipyardHome,
   isVanillaAgentMode,
   toJSONSchema,
   validateEnv
-} from "./chunk-KUV4J6NI.js";
+} from "./chunk-M5M6VC5F.js";
 import {
   detectSkills
 } from "./chunk-DPMRSLYJ.js";
@@ -83,8 +83,8 @@ import {
 } from "./chunk-2H7UOFLK.js";
 
 // src/services/serve.ts
-import { mkdir as mkdir25, realpath as realpath2 } from "fs/promises";
-import { join as join56 } from "path";
+import { mkdir as mkdir25, realpath as realpath3 } from "fs/promises";
+import { join as join57 } from "path";
 import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 
 // ../../node_modules/.pnpm/@loro-extended+change@6.0.0-beta.0_loro-crdt@1.11.1/node_modules/@loro-extended/change/dist/index.js
@@ -27270,7 +27270,8 @@ var PlanDetectionSchema = external_exports.object({
   filePath: external_exports.string(),
   planDocId: external_exports.string(),
   allowedPrompts: external_exports.array(AllowedPromptSchema).optional(),
-  originalMarkdown: external_exports.string().optional()
+  originalMarkdown: external_exports.string().optional(),
+  approved: external_exports.boolean().optional()
 });
 var TaskRecordSchema = external_exports.object({
   taskId: external_exports.string(),
@@ -27307,9 +27308,10 @@ var TaskRecordSchema = external_exports.object({
   totalTurnCount: external_exports.number().int().nonnegative().default(0),
   mergedAt: external_exports.number().int().positive().nullable().default(null),
   attributedCommitShas: external_exports.array(external_exports.string()).max(50).default([]),
-  lastCommitScanSha: external_exports.string().nullable().default(null)
+  lastCommitScanSha: external_exports.string().nullable().default(null),
+  originalCwd: external_exports.string().nullable().default(null)
 });
-var TASK_STORE_VERSION = 11;
+var TASK_STORE_VERSION = 12;
 var TaskStoreSchema = external_exports.object({
   schemaVersion: external_exports.number(),
   tasks: external_exports.record(external_exports.string(), TaskRecordSchema)
@@ -28220,7 +28222,8 @@ var DaemonToBrowserControlMessageSchema = external_exports.discriminatedUnion("t
       tool: external_exports.string(),
       prompt: external_exports.string()
     })).optional(),
-    isRevision: external_exports.boolean().optional()
+    isRevision: external_exports.boolean().optional(),
+    approved: external_exports.boolean().optional()
   }),
   external_exports.object({
     type: external_exports.literal("plan_continuation_timeout"),
@@ -28267,7 +28270,8 @@ var DaemonToBrowserControlMessageSchema = external_exports.discriminatedUnion("t
           userId: external_exports.string(),
           username: external_exports.string(),
           avatarUrl: external_exports.string().nullable().optional(),
-          role: CollabRoleSchema
+          role: CollabRoleSchema,
+          connectionId: external_exports.string()
         })),
         expiresAt: external_exports.number()
       })
@@ -28633,7 +28637,12 @@ var HunkRangeSchema = external_exports.object({
   modifiedEnd: external_exports.number()
 });
 var BrowserToFileIOMessageSchema = external_exports.discriminatedUnion("type", [
-  external_exports.object({ type: external_exports.literal("read_file"), requestId: external_exports.string(), path: external_exports.string() }),
+  external_exports.object({
+    type: external_exports.literal("read_file"),
+    requestId: external_exports.string(),
+    path: external_exports.string(),
+    external: external_exports.boolean().optional()
+  }),
   external_exports.object({
     type: external_exports.literal("write_file"),
     requestId: external_exports.string(),
@@ -28641,7 +28650,12 @@ var BrowserToFileIOMessageSchema = external_exports.discriminatedUnion("type", [
     content: external_exports.string()
   }),
   external_exports.object({ type: external_exports.literal("readdir"), requestId: external_exports.string(), path: external_exports.string() }),
-  external_exports.object({ type: external_exports.literal("stat"), requestId: external_exports.string(), path: external_exports.string() }),
+  external_exports.object({
+    type: external_exports.literal("stat"),
+    requestId: external_exports.string(),
+    path: external_exports.string(),
+    external: external_exports.boolean().optional()
+  }),
   external_exports.object({ type: external_exports.literal("git_status"), requestId: external_exports.string() }),
   external_exports.object({
     type: external_exports.literal("git_diff_file"),
@@ -31283,8 +31297,11 @@ function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ESRCH") {
+      return false;
+    }
+    throw err;
   }
 }
 var LifecycleManager = class {
@@ -31362,15 +31379,36 @@ var LifecycleManager = class {
     const pidFilePath = join9(shipyardHome, "daemon.pid");
     try {
       const existing = await readFile5(pidFilePath, "utf-8");
-      const pid = Number.parseInt(existing.trim(), 10);
-      if (!Number.isNaN(pid) && isProcessAlive(pid)) {
-        this.#log.error(
-          { pid, pidFile: pidFilePath },
-          "Another daemon is already running. Stop it first or remove the stale PID file."
+      const raw = existing.trim();
+      const pid = Number.parseInt(raw, 10);
+      if (!Number.isInteger(pid) || pid <= 0) {
+        this.#log.warn(
+          { event: "pid_file_corrupt_reclaimed", rawContent: raw, pidFile: pidFilePath },
+          "PID file contains invalid content \u2014 treating as corrupt and reclaiming"
+        );
+      } else {
+        let alive;
+        try {
+          alive = isProcessAlive(pid);
+        } catch (killErr) {
+          this.#log.error(
+            { event: "pid_kill_check_failed", err: killErr, pid, pidFile: pidFilePath },
+            "Cannot determine if existing daemon is alive (EPERM) \u2014 refusing to overwrite PID file"
+          );
+          process.exit(1);
+        }
+        if (alive) {
+          this.#log.error(
+            { pid, pidFile: pidFilePath },
+            "Another daemon is already running. Stop it first or remove the stale PID file."
+          );
+          process.exit(1);
+        }
+        this.#log.info(
+          { event: "pid_reclaimed_stale", stalePid: pid, pidFile: pidFilePath },
+          "Stale PID file found (process no longer running) \u2014 reclaiming"
         );
-        process.exit(1);
       }
-      this.#log.info({ stalePid: pid, pidFile: pidFilePath }, "Removing stale PID file");
     } catch (err) {
       if (!isEnoent(err)) throw err;
     }
@@ -31690,7 +31728,7 @@ function nanoid(size2 = 21) {
 }
 
 // src/services/bootstrap/signaling.ts
-var DAEMON_NPM_VERSION = true ? "3.2.2" : "unknown";
+var DAEMON_NPM_VERSION = true ? "3.2.3" : "unknown";
 function createDaemonSignaling(config2) {
   const agentId = config2.agentId ?? nanoid();
   function send(msg) {
@@ -34005,7 +34043,6 @@ async function deleteAdvertisement(shipyardHome) {
 
 // src/services/local-direct/local-direct-wiring.ts
 async function setupLocalDirect(deps) {
-  if (!deps.env.SHIPYARD_LOCAL_DIRECT) return null;
   const token = generateLocalDirectToken();
   const server = await createLocalDirectServer({
     token,
@@ -36984,36 +37021,7 @@ function createPRPoller(callbacks, log, resolveTopLevel = getGitTopLevel) {
     resolveTopLevel(cwd).then((topLevel) => {
       if (disposed) return;
       removeFromPreviousRepo(taskId);
-      taskToRepo.set(taskId, { topLevel, cwd });
-      const existing = repos.get(topLevel);
-      if (existing) {
-        existing.subscribers.add(taskId);
-        if (existing.lastPayload) {
-          callbacks.onPRState({ ...existing.lastPayload, taskId });
-        }
-        log.info({ taskId, topLevel, cwd }, "PR polling joined existing repo");
-        return;
-      }
-      const entry = {
-        timer: null,
-        burstTimers: [],
-        lastContent: "",
-        lastBranch: "",
-        lastPayload: null,
-        cwd,
-        subscribers: /* @__PURE__ */ new Set([taskId]),
-        isPolling: false
-      };
-      poll(topLevel, entry).catch((err) => {
-        log.warn({ err, topLevel }, "Initial PR poll failed");
-      });
-      entry.timer = setInterval(() => {
-        poll(topLevel, entry).catch((err) => {
-          log.warn({ err, topLevel }, "PR poll tick failed");
-        });
-      }, PR_POLL_INTERVAL_MS);
-      repos.set(topLevel, entry);
-      log.info({ taskId, topLevel, cwd }, "PR polling started");
+      subscribeToRepo(taskId, topLevel, cwd);
     }).catch((err) => {
       log.warn({ err, taskId, cwd }, "Failed to resolve git toplevel for PR polling");
     });
@@ -37021,6 +37029,64 @@ function createPRPoller(callbacks, log, resolveTopLevel = getGitTopLevel) {
   function getCwd(taskId) {
     return taskToRepo.get(taskId)?.cwd ?? null;
   }
+  function subscribeToRepo(taskId, topLevel, cwd) {
+    taskToRepo.set(taskId, { topLevel, cwd });
+    const existing = repos.get(topLevel);
+    if (existing) {
+      existing.subscribers.add(taskId);
+      if (existing.lastPayload) {
+        callbacks.onPRState({ ...existing.lastPayload, taskId });
+      }
+      log.info({ taskId, topLevel, cwd }, "PR polling joined existing repo");
+      return;
+    }
+    const repoEntry = {
+      timer: null,
+      burstTimers: [],
+      lastContent: "",
+      lastBranch: "",
+      lastPayload: null,
+      cwd,
+      subscribers: /* @__PURE__ */ new Set([taskId]),
+      isPolling: false
+    };
+    poll(topLevel, repoEntry).catch((err) => {
+      log.warn({ err, topLevel }, "Initial PR poll failed");
+    });
+    repoEntry.timer = setInterval(() => {
+      poll(topLevel, repoEntry).catch((err) => {
+        log.warn({ err, topLevel }, "PR poll tick failed");
+      });
+    }, PR_POLL_INTERVAL_MS);
+    repos.set(topLevel, repoEntry);
+    log.info({ taskId, topLevel, cwd }, "PR polling started");
+  }
+  function applyResolvedCwd(taskId, newCwd, newTopLevel, currentTopLevel) {
+    if (newTopLevel === currentTopLevel) {
+      const repoEntry = repos.get(newTopLevel);
+      if (repoEntry) repoEntry.cwd = newCwd;
+      taskToRepo.set(taskId, { topLevel: newTopLevel, cwd: newCwd });
+      log.info({ taskId, topLevel: newTopLevel, cwd: newCwd }, "PR polling cwd updated");
+      return;
+    }
+    removeFromPreviousRepo(taskId);
+    subscribeToRepo(taskId, newTopLevel, newCwd);
+    log.info({ taskId, topLevel: newTopLevel, cwd: newCwd }, "PR polling migrated to new repo");
+  }
+  async function updateCwd(taskId, newCwd) {
+    if (disposed) return;
+    const entry = taskToRepo.get(taskId);
+    if (!entry || entry.cwd === newCwd) return;
+    try {
+      const newTopLevel = await resolveTopLevel(newCwd);
+      if (disposed) return;
+      const currentEntry = taskToRepo.get(taskId);
+      if (!currentEntry || currentEntry.cwd === newCwd) return;
+      applyResolvedCwd(taskId, newCwd, newTopLevel, currentEntry.topLevel);
+    } catch (err) {
+      log.warn({ err, taskId, newCwd }, "Failed to resolve git toplevel for updateCwd");
+    }
+  }
   function stopPolling(taskId) {
     removeFromPreviousRepo(taskId);
   }
@@ -37056,7 +37122,7 @@ function createPRPoller(callbacks, log, resolveTopLevel = getGitTopLevel) {
     repos.clear();
     taskToRepo.clear();
   }
-  return { startPolling, stopPolling, forceRefresh, getCwd, dispose };
+  return { startPolling, stopPolling, forceRefresh, getCwd, updateCwd, dispose };
 }
 
 // src/services/serve-factory.ts
@@ -37367,7 +37433,8 @@ async function rehydrateFromPersistence(persistence, taskManager, log, taskState
           mode: record?.mode,
           initialRoiStartedEmitted: record?.roiStartedEmitted ?? false,
           taskCreatedAt: record?.createdAt ?? Date.now(),
-          initialTurnCount: record?.totalTurnCount ?? 0
+          initialTurnCount: record?.totalTurnCount ?? 0,
+          initialOriginalCwd: record?.originalCwd ?? null
         });
         log({ event: "task_restored", taskId: action.taskId, kind: "resumable" });
         break;
@@ -66609,22 +66676,22 @@ function isTextSelectionAcrossCells({ $from, $to }) {
 function normalizeSelection(state, tr2, allowTableNodeSelection) {
   const sel = (tr2 || state).selection;
   const doc3 = (tr2 || state).doc;
-  let normalize7;
+  let normalize8;
   let role;
   if (sel instanceof NodeSelection && (role = sel.node.type.spec.tableRole)) {
-    if (role == "cell" || role == "header_cell") normalize7 = CellSelection.create(doc3, sel.from);
+    if (role == "cell" || role == "header_cell") normalize8 = CellSelection.create(doc3, sel.from);
     else if (role == "row") {
       const $cell = doc3.resolve(sel.from + 1);
-      normalize7 = CellSelection.rowSelection($cell, $cell);
+      normalize8 = CellSelection.rowSelection($cell, $cell);
     } else if (!allowTableNodeSelection) {
       const map3 = TableMap.get(sel.node);
       const start = sel.from + 1;
       const lastCell = start + map3.map[map3.width * map3.height - 1];
-      normalize7 = CellSelection.create(doc3, start + 1, lastCell);
+      normalize8 = CellSelection.create(doc3, start + 1, lastCell);
     }
-  } else if (sel instanceof TextSelection && isCellBoundarySelection(sel)) normalize7 = TextSelection.create(doc3, sel.from);
-  else if (sel instanceof TextSelection && isTextSelectionAcrossCells(sel)) normalize7 = TextSelection.create(doc3, sel.$from.start(), sel.$from.end());
-  if (normalize7) (tr2 || (tr2 = state.tr)).setSelection(normalize7);
+  } else if (sel instanceof TextSelection && isCellBoundarySelection(sel)) normalize8 = TextSelection.create(doc3, sel.from);
+  else if (sel instanceof TextSelection && isTextSelectionAcrossCells(sel)) normalize8 = TextSelection.create(doc3, sel.$from.start(), sel.$from.end());
+  if (normalize8) (tr2 || (tr2 = state.tr)).setSelection(normalize8);
   return tr2;
 }
 var fixTablesKey = new PluginKey("fix-tables");
@@ -75659,6 +75726,14 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
   #onEvent;
   #spawnMcpServers;
   #harnessTaskIdSetter = null;
+  /**
+   * Mutable slot for the CwdChanged handler. The SDK hook is registered
+   * unconditionally at spawn time and reads through this slot on each
+   * event, so pre-warm (no handler at spawn) → claim (handler installed
+   * via `setOnCwdChanged`) works without re-spawning. Matches the
+   * `#harnessTaskIdSetter` slot pattern.
+   */
+  #onCwdChangedHandler = null;
   /**
    * Set to `true` when the message loop finishes (subprocess exited or errored).
    * Guards all SDK write operations to prevent "ProcessTransport not ready" errors.
@@ -75667,13 +75742,28 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
   #forceKilled = false;
   #pidRef;
   #exitRef;
-  constructor(query3, controller, onEvent, spawnMcpServers, pidRef, exitRef) {
+  constructor(query3, controller, onEvent, spawnMcpServers, pidRef, exitRef, initialOnCwdChanged) {
     this.#query = query3;
     this.#controller = controller;
     this.#onEvent = onEvent;
     this.#spawnMcpServers = spawnMcpServers;
     this.#pidRef = pidRef;
     this.#exitRef = exitRef;
+    this.#onCwdChangedHandler = initialOnCwdChanged;
+  }
+  /**
+   * Install or replace the CwdChanged handler. Pre-warm spawns register no
+   * handler at startup (no Task yet); when the subprocess is claimed and
+   * adopted by a Thread, the Task wires its `#applyCwdChange` funnel via
+   * this method so subsequent SDK `CwdChanged` events (including
+   * ExitWorktree, which the regex fallback misses) reach the funnel.
+   */
+  setOnCwdChanged(handler) {
+    this.#onCwdChangedHandler = handler;
+  }
+  /** Dispatch a CwdChanged event to the current handler. Invoked by the SDK hook. */
+  dispatchCwdChanged(newCwd) {
+    this.#onCwdChangedHandler?.(newCwd);
   }
   /** True once the subprocess has exited and SDK writes will throw. */
   get isClosed() {
@@ -75729,6 +75819,7 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
       exitRef.resolveReady();
     }
     const sdkEffort = resolveSupportedEffort(options.effort, log);
+    const subprocessRef = { current: null };
     const queryInstance = queryFn({
       prompt: controller.iterable(),
       options: {
@@ -75751,7 +75842,21 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
         spawnClaudeCodeProcess,
         resumeSessionAt: options.resumeSessionAt,
         forkSession: options.forkSession,
-        pathToClaudeCodeExecutable: options.pathToClaudeCodeExecutable
+        pathToClaudeCodeExecutable: options.pathToClaudeCodeExecutable,
+        hooks: {
+          CwdChanged: [
+            {
+              hooks: [
+                async (input) => {
+                  if (input.hook_event_name === "CwdChanged") {
+                    subprocessRef.current?.dispatchCwdChanged(input.new_cwd);
+                  }
+                  return {};
+                }
+              ]
+            }
+          ]
+        }
       }
     });
     const spawnMcpServers = options.mcpServers ?? {};
@@ -75761,8 +75866,10 @@ var AnthropicAgentSubprocess = class _AnthropicAgentSubprocess {
       onEvent,
       spawnMcpServers,
       pidRef,
-      exitRef
+      exitRef,
+      options.onCwdChanged ?? null
     );
+    subprocessRef.current = subprocess;
     if (initialContent.length > 0) {
       controller.push(toSdkContent(initialContent));
     }
@@ -76071,7 +76178,8 @@ function buildSpawnOptions(args) {
     log,
     metricsCollector,
     claudeCodePath,
-    disallowedTools
+    disallowedTools,
+    onCwdChanged
   } = args;
   const vanillaMode = isVanillaAgentMode();
   const mcpServers = {
@@ -76128,7 +76236,8 @@ ${additionalSystemPrompt}` : basePrompt;
         limitMB: sample.limitMB,
         thresholdExceeded: sample.thresholdExceeded
       });
-    }
+    },
+    onCwdChanged
   };
 }
 async function detectInitialCapabilities(tokenStore, settings) {
@@ -83101,6 +83210,9 @@ var DirectApiSubprocess = class _DirectApiSubprocess {
   /** No-op in Phase 1 -- harness task context not used by direct API mode. */
   setHarnessTaskId(_taskId) {
   }
+  /** No-op: direct API mode does not surface SDK CwdChanged events. */
+  setOnCwdChanged(_handler) {
+  }
   async #stream() {
     this.#abortController = new AbortController();
     const startTime = Date.now();
@@ -84572,16 +84684,18 @@ async function buildRateLimitStore(dataDir, opts) {
     }
   };
 }
+function deriveWindowFromEvent(incoming, eventTime) {
+  if (!isWindowKey(incoming.rateLimitType)) return void 0;
+  const utilization = typeof incoming.utilization === "number" ? incoming.utilization : incoming.status === "rejected" ? 1 : void 0;
+  if (utilization === void 0) return void 0;
+  return { utilization, resetsAt: incoming.resetsAt, updatedAt: eventTime };
+}
 function mergeEvent(prev, incoming, eventTime) {
   const prevByWindow = prev?.byWindow ?? {};
   const byWindow = { ...prevByWindow };
-  if (isWindowKey(incoming.rateLimitType) && typeof incoming.utilization === "number") {
-    const window2 = {
-      utilization: incoming.utilization,
-      resetsAt: incoming.resetsAt,
-      updatedAt: eventTime
-    };
-    byWindow[incoming.rateLimitType] = window2;
+  const derived = deriveWindowFromEvent(incoming, eventTime);
+  if (derived && isWindowKey(incoming.rateLimitType)) {
+    byWindow[incoming.rateLimitType] = derived;
   }
   const nowInOverage = incoming.isUsingOverage === true;
   const wasInOverage = prev?.overageStartedAt !== void 0;
@@ -84635,12 +84749,15 @@ function migrateV1toV2(v1) {
   for (const [accountKey, record] of Object.entries(v1.records)) {
     const { info, updatedAt } = record;
     const byWindow = {};
-    if (isWindowKey(info.rateLimitType) && typeof info.utilization === "number") {
-      byWindow[info.rateLimitType] = {
-        utilization: info.utilization,
-        resetsAt: info.resetsAt,
-        updatedAt
-      };
+    if (isWindowKey(info.rateLimitType)) {
+      const utilization = typeof info.utilization === "number" ? info.utilization : info.status === "rejected" ? 1 : void 0;
+      if (utilization !== void 0) {
+        byWindow[info.rateLimitType] = {
+          utilization,
+          resetsAt: info.resetsAt,
+          updatedAt
+        };
+      }
     }
     const nowInOverage = info.isUsingOverage === true;
     records[accountKey] = {
@@ -86967,6 +87084,9 @@ var Thread = class {
       this.#subprocess = config2.adoptedSubprocess.subprocess;
       this.#effectiveSpawnMode = { kind: "fresh" };
       config2.adoptedSubprocess.redirectEvents((event) => this.#enqueueSubprocessEvent(event));
+      if (config2.onCwdChanged) {
+        this.#subprocess.setOnCwdChanged(config2.onCwdChanged);
+      }
     }
     const warmState = "warm_idle";
     const initialSnapshot = config2.adoptedSubprocess ? { state: warmState, sessionId: null } : config2.initialState && config2.initialState !== "cold_idle" ? {
@@ -87129,6 +87249,7 @@ var Thread = class {
     this.#stateChangeListeners.clear();
     this.#manager.dispose();
     await this.#asyncQueue;
+    this.#subprocess?.setOnCwdChanged(null);
     this.#subprocess?.close();
     this.#subprocess = null;
   }
@@ -87293,7 +87414,8 @@ ${conversationReplay}` : conversationReplay;
         this.#config.threadId,
         systemPrompt,
         this.#config.disallowedTools,
-        this.#config.mode
+        this.#config.mode,
+        this.#config.onCwdChanged
       );
     };
     doSpawn().catch((err) => {
@@ -87369,6 +87491,7 @@ ${conversationReplay}` : conversationReplay;
     });
   }
   #handleClose() {
+    this.#subprocess?.setOnCwdChanged(null);
     this.#subprocess?.close();
     this.#subprocess = null;
   }
@@ -87585,6 +87708,47 @@ ${conversationReplay}` : conversationReplay;
       }
     });
   }
+  /**
+   * Deduped append for echoed user messages. Browser-originated writes carry
+   * a correlationId so dedup catches the twin row via `corr:<id>`. Synthetic
+   * pushes (plan injection, side threads, model-set) have no correlationId —
+   * we pass `event.sdkUuid` so the `sdk:<uuid>` pass catches SDK replays
+   * instead of falling back to the 60s fingerprint window, which would
+   * wrongly collapse two distinct synthetic pushes with identical content.
+   */
+  async #handleUserMessageEcho(event) {
+    const echoMsgId = crypto.randomUUID();
+    const meta = this.#callbacks.onBeforeStoreUserMessage?.(event);
+    const result = await this.#config.store.appendMessageDeduped(
+      {
+        channelId: this.#config.channelId,
+        messageId: echoMsgId,
+        participantId: meta?.participantId ?? this.#config.humanParticipantId ?? PENDING_AGENT_PARTICIPANT_ID,
+        senderKind: "human",
+        content: meta?.content ?? event.content,
+        timestamp: Date.now(),
+        model: meta?.model ?? null,
+        reasoningEffort: meta?.reasoningEffort ?? null,
+        permissionMode: meta?.permissionMode ?? null,
+        ...meta?.isSynthetic && { isSynthetic: true },
+        ...meta?.correlationId && { correlationId: meta.correlationId },
+        ...event.sdkUuid && { sdkUuid: event.sdkUuid }
+      },
+      {}
+    );
+    if (result.isDuplicate) {
+      this.#config.log({
+        event: "thread_echo_dedup_hit",
+        threadId: this.#config.threadId,
+        dedupKey: result.dedupKey,
+        seqNo: result.seqNo
+      });
+    }
+    this.#callbacks.onMessageStored?.(result.seqNo, echoMsgId, "human", event.sdkUuid);
+    if (meta?.correlationId) {
+      this.#callbacks.onUserMessageConfirmed?.(meta.correlationId, event.sdkUuid);
+    }
+  }
   async #handleSubprocessEvent(event) {
     switch (event.type) {
       case "init_received":
@@ -87639,25 +87803,7 @@ ${conversationReplay}` : conversationReplay;
       case "rate_limit_error":
         break;
       case "user_message_echo": {
-        const echoMsgId = crypto.randomUUID();
-        const meta = this.#callbacks.onBeforeStoreUserMessage?.(event);
-        const echoSeqNo = await this.#config.store.appendMessage({
-          channelId: this.#config.channelId,
-          messageId: echoMsgId,
-          participantId: meta?.participantId ?? this.#config.humanParticipantId ?? PENDING_AGENT_PARTICIPANT_ID,
-          senderKind: "human",
-          content: meta?.content ?? event.content,
-          timestamp: Date.now(),
-          model: meta?.model ?? null,
-          reasoningEffort: meta?.reasoningEffort ?? null,
-          permissionMode: meta?.permissionMode ?? null,
-          ...meta?.isSynthetic && { isSynthetic: true },
-          ...meta?.correlationId && { correlationId: meta.correlationId }
-        });
-        this.#callbacks.onMessageStored?.(echoSeqNo, echoMsgId, "human", event.sdkUuid);
-        if (meta?.correlationId) {
-          this.#callbacks.onUserMessageConfirmed?.(meta.correlationId, event.sdkUuid);
-        }
+        await this.#handleUserMessageEcho(event);
         break;
       }
       case "assistant_message": {
@@ -87735,6 +87881,7 @@ function skipForMainChannel(content) {
 
 // src/services/plan/plan-handler.ts
 import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { readFile as readFile30 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join39 } from "path";
 
@@ -87812,6 +87959,80 @@ var PlanFileBridge = class _PlanFileBridge {
       });
     }, PERIODIC_REREAD_MS);
   }
+  /**
+   * Re-initialize the bridge for a plan file known from a prior daemon session.
+   *
+   * Differs from `attach()` in that the caller explicitly decides whether to
+   * preserve CRDT content. This lets PlanHandler do a three-way compare
+   * (file vs CRDT vs last stored PlanVersion) and tell the bridge which side
+   * is authoritative:
+   *
+   * - `preserveCrdt: false` — file is truth (fresh daemon start, or Claude
+   *   rewrote the plan while the daemon was down). Overwrite CRDT with file
+   *   content, same as `attach()`.
+   * - `preserveCrdt: true` — CRDT has edits not yet written to disk (browser
+   *   edited before the daemon's debounced write-back fired). Keep CRDT
+   *   content; the subscription below will flush it on the next loro change.
+   *
+   * Returns `{ fileContent }` so callers can emit catch-up versions, or
+   * `null` if the file is unreadable.
+   */
+  async reattach(filePath, options) {
+    if (this.#disposed) return null;
+    this.#dirWatcher?.close();
+    this.#dirWatcher = null;
+    this.#crdtUnsub?.();
+    this.#crdtUnsub = null;
+    if (this.#periodicRereadTimer) {
+      clearInterval(this.#periodicRereadTimer);
+      this.#periodicRereadTimer = null;
+    }
+    let fileContent;
+    try {
+      fileContent = await this.#readFileWithRetry(filePath);
+    } catch (err) {
+      this.#config.log({
+        event: "plan_bridge_reattach_read_failed",
+        taskId: this.#config.taskId,
+        filePath,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+    this.#filePath = filePath;
+    this.#config.planRepo.setMetadata(this.#config.taskId, filePath);
+    this.#lastWrittenHash = contentHash(fileContent);
+    if (!options.preserveCrdt) {
+      this.#config.planRepo.updateContent(this.#config.taskId, fileContent);
+    }
+    this.#hasAttachedContent = true;
+    this.#config.log({
+      event: "plan_bridge_reattached",
+      taskId: this.#config.taskId,
+      filePath,
+      crdtPreserved: options.preserveCrdt,
+      fileLength: fileContent.length
+    });
+    this.#startDirectoryWatcher(filePath);
+    this.#startCrdtSubscription();
+    this.#periodicRereadTimer = setInterval(() => {
+      this.#handleFileChanged().catch(() => {
+      });
+    }, PERIODIC_REREAD_MS);
+    if (options.preserveCrdt) {
+      try {
+        await this.flushWriteBack();
+      } catch (err) {
+        this.#config.log({
+          event: "plan_bridge_reattach_flush_failed",
+          taskId: this.#config.taskId,
+          filePath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    return { fileContent };
+  }
   /**
    * Watch the plans DIRECTORY (not the file) for changes.
    * This survives inode changes from atomic writes (tmp + rename).
@@ -88234,8 +88455,177 @@ var PlanHandler = class {
       this.#lastPersistedPlanDetection = deps.initialPlanDetection;
       this.#planPublished = true;
       this.#processedPlanToolUseIds.add(deps.initialPlanDetection.toolUseId);
+      const seedFilePath = deps.initialPlanDetection.filePath;
+      const seedToolUseId = deps.initialPlanDetection.toolUseId;
+      deps.enqueueAsync(() => this.#rehydratePlanFileBridge(seedFilePath, seedToolUseId));
+    }
+  }
+  async #rehydratePlanFileBridge(filePath, toolUseId) {
+    if (this.#deps.isDisposed()) return;
+    if (!existsSync7(filePath)) {
+      this.#deps.log({
+        event: "plan_bridge_rehydrate_file_missing",
+        taskId: this.#deps.taskId,
+        filePath
+      });
+      return;
+    }
+    const fileContent = await this.#readFileForRehydrate(filePath);
+    if (fileContent === null || this.#deps.isDisposed()) return;
+    const versions = await this.#deps.annotationStore.getPlanVersions(this.#deps.taskId);
+    if (this.#deps.isDisposed()) return;
+    const lastVersionMarkdown = versions.at(-1)?.markdown ?? "";
+    const preserveCrdt = this.#shouldPreserveCrdt(fileContent, lastVersionMarkdown);
+    const result = await this.#ensureBridgeAttached(filePath, toolUseId, {
+      mode: "rehydrate",
+      preserveCrdt
+    });
+    if (!result || this.#deps.isDisposed()) return;
+    await this.#maybeEmitRehydrateCatchup(lastVersionMarkdown, preserveCrdt, toolUseId);
+  }
+  /**
+   * Three-way compare of {file on disk, CRDT content, last stored PlanVersion}:
+   *
+   *   Case 1 (all equal)            → preserveCrdt=false (no-op attach)
+   *   Case 2 (file drifted)         → preserveCrdt=false (file wins)
+   *   Case 3 (browser-edited CRDT)  → preserveCrdt=true (keep in-flight edits)
+   *   Case 4 (both drifted)         → preserveCrdt=false (file wins)
+   *
+   * Case 3 also requires a non-empty lastVersionMarkdown — otherwise a
+   * brand-new task with no prior stored versions would preserve whatever
+   * happens to be in CRDT (e.g. a stale browser session's edits on a fresh
+   * epoch) over an authoritative empty file.
+   */
+  #shouldPreserveCrdt(fileContent, lastVersionMarkdown) {
+    if (lastVersionMarkdown === "") return false;
+    const crdtContent = this.#deps.planRepo.getContent(this.#deps.taskId);
+    const fileMatchesLast = fileContent === lastVersionMarkdown;
+    const crdtHasUnsavedEdits = crdtContent.length > 0 && crdtContent !== lastVersionMarkdown;
+    return fileMatchesLast && crdtHasUnsavedEdits;
+  }
+  /**
+   * Post-attach catch-up: read whatever CRDT now holds (file content or
+   * preserved CRDT content) and emit a single version if it drifted from
+   * `lastVersionMarkdown`. Covers file-drifted and browser-edited cases.
+   *
+   * Source labeling follows authoritative side: preserved CRDT = 'human',
+   * file-overwritten CRDT = 'agent'. Mislabeling would corrupt
+   * `findLastAgentVersion`'s baseline for plan-review diffs.
+   */
+  async #maybeEmitRehydrateCatchup(lastVersionMarkdown, preserveCrdt, toolUseId) {
+    const postAttachMarkdown = this.#deps.planRepo.getContent(this.#deps.taskId);
+    if (postAttachMarkdown.length === 0 || postAttachMarkdown === lastVersionMarkdown) return;
+    const source = preserveCrdt ? "human" : "agent";
+    await this.#emitCatchupVersion(postAttachMarkdown, toolUseId, source);
+  }
+  async #readFileForRehydrate(filePath) {
+    try {
+      return await readFile30(filePath, "utf-8");
+    } catch (err) {
+      this.#deps.log({
+        event: "plan_bridge_rehydrate_read_failed",
+        taskId: this.#deps.taskId,
+        filePath,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+  async #emitCatchupVersion(markdown, toolUseId, source) {
+    const version = {
+      markdown,
+      timestamp: Date.now(),
+      source,
+      toolUseId
+    };
+    try {
+      await this.#deps.annotationStore.addPlanVersion(this.#deps.taskId, version);
+      const msg = {
+        type: "annotation_version_added",
+        taskId: this.#deps.taskId,
+        version
+      };
+      const send = this.#deps.getSendControlMessage();
+      if (send) {
+        send(msg);
+      } else {
+        this.#deps.enqueueControlMessage(msg);
+      }
+    } catch (err) {
+      this.#deps.log({
+        event: "plan_version_add_failed",
+        taskId: this.#deps.taskId,
+        error: err instanceof Error ? err.message : String(err)
+      });
     }
   }
+  /**
+   * Ensure a PlanFileBridge is attached for this task at the given file path.
+   * Creates the bridge lazily and routes attach vs reattach based on options:
+   *
+   * - `mode: 'fresh'` — new ExitPlanMode cycle, no prior context. Uses
+   *   `attach()` which overwrites CRDT with file content.
+   * - `mode: 'rehydrate'` — daemon restart. Uses `reattach()` with an
+   *   explicit `preserveCrdt` flag so the caller's three-way compare picks
+   *   the authoritative side.
+   *
+   * Noop if the bridge is already attached to the same filePath. Re-attaches
+   * if the bridge points at a different filePath (Scenario A: a 2nd
+   * ExitPlanMode cycle writes to a new UUID).
+   */
+  async #ensureBridgeAttached(filePath, toolUseId, options) {
+    if (this.#deps.isDisposed()) return null;
+    const isFirstAttach = !this.#planFileBridge;
+    if (!this.#planFileBridge) {
+      this.#planFileBridge = this.#createPlanFileBridge(toolUseId);
+    } else if (this.#planFileBridge.filePath === filePath) {
+      return { isFirstAttach: false };
+    }
+    if (options.mode === "rehydrate") {
+      const result = await this.#planFileBridge.reattach(filePath, {
+        preserveCrdt: options.preserveCrdt
+      });
+      if (!result) return null;
+    } else {
+      await this.#planFileBridge.attach(filePath);
+    }
+    if (this.#deps.isDisposed()) return null;
+    return { isFirstAttach };
+  }
+  #createPlanFileBridge(fallbackToolUseId) {
+    return new PlanFileBridge({
+      taskId: this.#deps.taskId,
+      planRepo: this.#deps.planRepo,
+      log: this.#deps.log,
+      onBeforeContentUpdate: (currentMarkdown) => {
+        const version = {
+          markdown: currentMarkdown,
+          timestamp: Date.now(),
+          source: "agent",
+          toolUseId: this.#lastPlanDetection?.toolUseId ?? fallbackToolUseId
+        };
+        this.#deps.annotationStore.addPlanVersion(this.#deps.taskId, version).then(() => {
+          const msg = {
+            type: "annotation_version_added",
+            taskId: this.#deps.taskId,
+            version
+          };
+          const send = this.#deps.getSendControlMessage();
+          if (send) {
+            send(msg);
+          } else {
+            this.#deps.enqueueControlMessage(msg);
+          }
+        }).catch((err) => {
+          this.#deps.log({
+            event: "plan_version_add_failed",
+            taskId: this.#deps.taskId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        });
+      }
+    });
+  }
   /**
    * Persist a detection (or null clear) with shadow-pending semantics:
    * optimistically update #lastPlanDetection so concurrent reads see the new
@@ -88292,14 +88682,17 @@ var PlanHandler = class {
     });
     if (this.#approvalReceived) {
       this.#approvalReceived = false;
-      this.#persistDetection(null).catch((err) => {
-        this.#deps.log({
-          event: "plan_persist_clear_failed",
-          taskId: this.#deps.taskId,
-          toolUseId,
-          error: err instanceof Error ? err.message : String(err)
+      const previous = this.#lastPlanDetection;
+      if (previous) {
+        this.#persistDetection({ ...previous, approved: true }).catch((err) => {
+          this.#deps.log({
+            event: "plan_persist_approve_failed",
+            taskId: this.#deps.taskId,
+            toolUseId,
+            error: err instanceof Error ? err.message : String(err)
+          });
         });
-      });
+      }
       this.#deps.log({
         event: "exit_plan_mode_approved",
         taskId: this.#deps.taskId,
@@ -88368,9 +88761,10 @@ var PlanHandler = class {
     });
   }
   detectPlanEvents(content) {
-    if (this.#approvalReceived || this.#planPublished) return;
+    if (this.#approvalReceived) return;
     for (const block2 of content) {
       if (block2.type !== "tool_use" || block2.toolName !== "ExitPlanMode") continue;
+      if (this.#processedPlanToolUseIds.has(block2.toolUseId)) continue;
       this.#deps.log({
         event: "exit_plan_mode_detected",
         taskId: this.#deps.taskId,
@@ -88402,7 +88796,7 @@ var PlanHandler = class {
    */
   replayPlanDetection(send) {
     if (!this.#lastPlanDetection) return;
-    const { toolUseId, filePath, planDocId, allowedPrompts } = this.#lastPlanDetection;
+    const { toolUseId, filePath, planDocId, allowedPrompts, approved } = this.#lastPlanDetection;
     const markdown = this.#deps.planRepo.getContent(this.#deps.taskId);
     send({
       type: "plan_detected",
@@ -88411,7 +88805,8 @@ var PlanHandler = class {
       filePath,
       planDocId,
       markdown,
-      allowedPrompts
+      allowedPrompts,
+      approved
     });
   }
   /**
@@ -88534,51 +88929,32 @@ var PlanHandler = class {
     this.#pendingPlanAllowedPrompts.delete(toolUseId);
     this.#deps.enqueueAsync(async () => {
       if (this.#deps.isDisposed()) return;
-      const isFirstAttach = !this.#planFileBridge;
-      if (!this.#planFileBridge) {
-        this.#planFileBridge = new PlanFileBridge({
-          taskId: this.#deps.taskId,
-          planRepo: this.#deps.planRepo,
-          log: this.#deps.log,
-          onBeforeContentUpdate: (currentMarkdown) => {
-            const version = {
-              markdown: currentMarkdown,
-              timestamp: Date.now(),
-              source: "agent",
-              toolUseId: this.#lastPlanDetection?.toolUseId ?? toolUseId
-            };
-            this.#deps.annotationStore.addPlanVersion(this.#deps.taskId, version).then(() => {
-              this.#deps.getSendControlMessage()?.({
-                type: "annotation_version_added",
-                taskId: this.#deps.taskId,
-                version
-              });
-            }).catch((err) => {
-              this.#deps.log({
-                event: "plan_version_add_failed",
-                taskId: this.#deps.taskId,
-                error: err instanceof Error ? err.message : String(err)
-              });
-            });
-          }
-        });
-      }
-      await this.#planFileBridge.attach(filePath);
+      const attachResult = await this.#ensureBridgeAttached(filePath, toolUseId, {
+        mode: "fresh"
+      });
+      if (!attachResult) return;
       const markdown = this.#deps.planRepo.getContent(this.#deps.taskId);
-      if (isFirstAttach && markdown.length > 0) {
-        const initialVersion = {
-          markdown,
-          timestamp: Date.now(),
-          source: "agent",
-          toolUseId
-        };
-        await this.#deps.annotationStore.addPlanVersion(this.#deps.taskId, initialVersion);
-        this.#deps.getSendControlMessage()?.({
-          type: "annotation_version_added",
-          taskId: this.#deps.taskId,
-          version: initialVersion
-        });
+      if (markdown.length > 0) {
+        const existingVersions = await this.#deps.annotationStore.getPlanVersions(
+          this.#deps.taskId
+        );
+        const lastVersion = existingVersions.at(-1);
+        if (lastVersion?.markdown !== markdown) {
+          const initialVersion = {
+            markdown,
+            timestamp: Date.now(),
+            source: "agent",
+            toolUseId
+          };
+          await this.#deps.annotationStore.addPlanVersion(this.#deps.taskId, initialVersion);
+          this.#deps.getSendControlMessage()?.({
+            type: "annotation_version_added",
+            taskId: this.#deps.taskId,
+            version: initialVersion
+          });
+        }
       }
+      const isFirstAttach = attachResult.isFirstAttach;
       const pendingDetection = {
         toolUseId,
         filePath,
@@ -89230,6 +89606,16 @@ var ResourcePushManager = class {
   #batchTimer;
   #pushCountThisTurn = 0;
   #pushedThisTurn = /* @__PURE__ */ new Set();
+  /**
+   * Ref-counted session-lifetime claims. Each `markPushed` increments;
+   * each `unmarkPushed` decrements. Entries are deleted when the count
+   * hits zero. Used for "inject exactly once per subprocess session"
+   * callers (the task-list prepend) where two concurrent paths (sync
+   * prepend + async push pipeline) may both legitimately claim the URI.
+   * A plain Set would let an optimistic claim's rollback erase another
+   * caller's successful mark; the ref count prevents that.
+   */
+  #pushedEverCount = /* @__PURE__ */ new Map();
   #disposed = false;
   #epoch = 0;
   #flushInProgress = Promise.resolve();
@@ -89282,12 +89668,46 @@ var ResourcePushManager = class {
     return this.#pushedThisTurn;
   }
   /**
-   * Mark a URI as already pushed this turn (e.g. when injected
-   * synchronously in handleBeforeSpawn rather than via the async
-   * push pipeline).
+   * Whether a URI has been pushed at least once this session. For one-shot
+   * callers (task-list prepend) to decide whether to inject again.
+   */
+  isSessionPushed(uri) {
+    return this.#pushedEverCount.has(uri);
+  }
+  /**
+   * Seed the session-lifetime claim for URIs already pushed in a prior
+   * daemon run (resumable_idle tasks whose JSONL already contains a
+   * prepend synthetic). Without this, restart re-injects the task-list
+   * because the fresh push manager has an empty count map.
+   */
+  seedSessionPushed(uri) {
+    if (!this.#pushedEverCount.has(uri)) this.#pushedEverCount.set(uri, 1);
+  }
+  /**
+   * Mark a URI as pushed this turn AND record a session-lifetime claim.
+   * Call from both the sync prepend (before awaiting resolve) and the
+   * async push pipeline (after a successful write). Pair each call with
+   * `unmarkPushed` only if the operation did NOT ultimately write.
    */
   markPushed(uri) {
     this.#pushedThisTurn.add(uri);
+    this.#pushedEverCount.set(uri, (this.#pushedEverCount.get(uri) ?? 0) + 1);
+  }
+  /**
+   * Release a `markPushed` claim. Decrements the session-lifetime count —
+   * the entry is only removed when the count hits zero, so a concurrent
+   * caller's successful write stays recorded even if this caller rolls
+   * back. Also clears the per-turn set unconditionally (a successful
+   * parallel caller re-adds it as needed before its own write).
+   */
+  unmarkPushed(uri) {
+    this.#pushedThisTurn.delete(uri);
+    const current2 = this.#pushedEverCount.get(uri) ?? 0;
+    if (current2 <= 1) {
+      this.#pushedEverCount.delete(uri);
+    } else {
+      this.#pushedEverCount.set(uri, current2 - 1);
+    }
   }
   /** Permanently shut down. Use reset() for clearSession. */
   dispose() {
@@ -89309,6 +89729,7 @@ var ResourcePushManager = class {
     this.#subscriptions.clear();
     this.#dirtyUris.clear();
     this.#pushedThisTurn.clear();
+    this.#pushedEverCount.clear();
     this.#pushCountThisTurn = 0;
   }
   #markDirty(uri) {
@@ -89419,35 +89840,11 @@ var ResourcePushManager = class {
     this.#batchTimer.reset();
     const batch = this.#drainDirtyBatch();
     if (!batch) return;
+    const markedUris = /* @__PURE__ */ new Set();
     try {
-      const resolved = await this.#resolveBatch(batch);
-      if (this.#disposed || this.#epoch !== startEpoch) return;
-      if (resolved.size === 0) {
-        if (this.#dirtyUris.size > 0) this.#batchTimer.schedule();
-        return;
-      }
-      const plan = await this.#planPush(resolved);
-      if (this.#disposed || this.#epoch !== startEpoch || plan.syntheticMessages.length === 0)
-        return;
-      const allContent = await this.#writeSynthetics(plan.syntheticMessages);
-      if (this.#disposed || this.#epoch !== startEpoch) return;
-      this.#deliverToSubprocess(allContent, resolved.size);
-      for (const uri of resolved.keys()) {
-        this.#pushedThisTurn.add(uri);
-      }
-      this.#deps.log({
-        event: "resource_push_delivered",
-        taskId: this.#deps.taskId,
-        uriCount: resolved.size
-      });
-      this.#deps.log({
-        event: "resource_push_flushed",
-        taskId: this.#deps.taskId,
-        uriCount: batch.size,
-        syntheticCount: plan.syntheticMessages.length,
-        pushCountThisTurn: this.#pushCountThisTurn
-      });
+      await this.#executeFlush(batch, startEpoch, markedUris);
     } catch (err) {
+      for (const uri of markedUris) this.unmarkPushed(uri);
       this.#requeueBatch(batch);
       this.#deps.log({
         event: "resource_push_flush_error",
@@ -89457,6 +89854,30 @@ var ResourcePushManager = class {
       });
     }
   }
+  async #executeFlush(batch, startEpoch, markedUris) {
+    const resolved = await this.#resolveBatch(batch);
+    if (this.#disposed || this.#epoch !== startEpoch) return;
+    if (resolved.size === 0) {
+      if (this.#dirtyUris.size > 0) this.#batchTimer.schedule();
+      return;
+    }
+    const plan = await this.#planPush(resolved);
+    if (this.#disposed || this.#epoch !== startEpoch || plan.syntheticMessages.length === 0) return;
+    for (const uri of resolved.keys()) {
+      this.markPushed(uri);
+      markedUris.add(uri);
+    }
+    const allContent = await this.#writeSynthetics(plan.syntheticMessages);
+    if (this.#disposed || this.#epoch !== startEpoch) return;
+    this.#deliverToSubprocess(allContent, resolved.size);
+    this.#deps.log({
+      event: "resource_push_flushed",
+      taskId: this.#deps.taskId,
+      uriCount: batch.size,
+      syntheticCount: plan.syntheticMessages.length,
+      pushCountThisTurn: this.#pushCountThisTurn
+    });
+  }
 };
 
 // src/services/rewind.ts
@@ -89605,10 +90026,10 @@ var RewindCheckpointHandler = class {
     this.#allCheckpointTurnNos = [...allTurnNos];
   }
   recordSeqNo(seqNo) {
-    this.#latestSeqNo = seqNo;
+    if (seqNo > this.#latestSeqNo) this.#latestSeqNo = seqNo;
   }
   recordSdkUuid(seqNo, sdkUuid) {
-    this.#seqNoToSdkUuid.set(seqNo, sdkUuid);
+    if (!this.#seqNoToSdkUuid.has(seqNo)) this.#seqNoToSdkUuid.set(seqNo, sdkUuid);
   }
   findSdkUuidForSeqNo(targetSeqNo) {
     let bestUuid = null;
@@ -90021,7 +90442,7 @@ var RewindCheckpointHandler = class {
 };
 
 // src/services/task/side-thread-registry.ts
-import { mkdir as mkdir17, readFile as readFile30, rename as rename17, writeFile as writeFile23 } from "fs/promises";
+import { mkdir as mkdir17, readFile as readFile31, rename as rename17, writeFile as writeFile23 } from "fs/promises";
 import { dirname as dirname15, join as join40 } from "path";
 var ThreadFileSchema = external_exports.object({
   threads: external_exports.record(external_exports.string(), ThreadMetadataSchema)
@@ -90355,7 +90776,7 @@ var SideThreadRegistry = class {
     const filePath = this.#filePath();
     let raw;
     try {
-      raw = await readFile30(filePath, "utf-8");
+      raw = await readFile31(filePath, "utf-8");
     } catch (err) {
       if (isEnoent(err)) return;
       throw err;
@@ -90794,7 +91215,7 @@ async function resolveResources(ctx, content, history2, excludeUris) {
 
 // src/services/task/cc-task-file-store.ts
 import { watch as watch4 } from "fs";
-import { readdir as readdir9, readFile as readFile31 } from "fs/promises";
+import { readdir as readdir9, readFile as readFile32 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { basename as basename4, dirname as dirname16, join as join41 } from "path";
 var VALID_STATUSES2 = /* @__PURE__ */ new Set(["pending", "in_progress", "completed"]);
@@ -90830,7 +91251,7 @@ function createCCTaskFileWatcher(listId, log) {
   async function readTask(taskId) {
     const filePath = join41(dir, `${taskId}.json`);
     try {
-      const raw = await readFile31(filePath, "utf-8");
+      const raw = await readFile32(filePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (isCCTaskFile(parsed)) return parsed;
       log?.({
@@ -91117,11 +91538,24 @@ var StructuredTaskTracker = class {
   #ccTaskWatcherDispose = null;
   #suppressWriteThrough = false;
   #ccTaskFileWriter;
-  #restoreInProgress = false;
+  /**
+   * Gate the first flush until an overlay has either been applied or the
+   * caller has explicitly signaled that none is coming. Both flags below
+   * must be false for the flush to proceed during restore.
+   */
+  #restoreNeedsOverlay = false;
+  /**
+   * Gate the first flush until the file watcher's initial disk reconcile
+   * has fired. Only set during restore for tasks with a session id.
+   */
+  #restoreNeedsDisk = false;
   constructor(deps) {
     this.#deps = deps;
     this.#ccTaskFileWriter = createCCTaskFileWriter(null, deps.log);
-    this.#restoreInProgress = deps.restoreInProgress ?? false;
+    if (deps.restoreInProgress) {
+      this.#restoreNeedsOverlay = true;
+      this.#restoreNeedsDisk = deps.restoreExpectDisk ?? false;
+    }
   }
   get currentOverlay() {
     return this.#currentOverlay;
@@ -91165,24 +91599,37 @@ var StructuredTaskTracker = class {
   }
   /**
    * Apply an overlay on top of CC tasks. Stores the overlay and re-flushes.
-   * Exits restore mode — applyOverlay is the terminal piece of restoration
-   * (disk reconcile is idempotent with the seeded overlay, so we flush once
-   * here with full inputs instead of producing a partial pre-overlay flush).
+   * Clears the overlay-pending gate. The flush still waits if a disk reconcile
+   * is expected (restoreExpectDisk=true at construction): without that second
+   * gate, the applyOverlay-first restart ordering would emit an overlay-only
+   * map to the store on every boot, bumping TaskRecord.lastActivityAt for
+   * every restored task that has an overlay.
    */
   applyOverlay(overlay) {
     this.#currentOverlay = overlay;
-    this.#restoreInProgress = false;
+    this.#restoreNeedsOverlay = false;
+    this.#flushStructuredTasks();
+  }
+  /**
+   * Signal that no overlay will be applied during this restore. Clears the
+   * overlay-pending gate but NOT the disk gate — if the restored task has a
+   * session id, the file watcher's first reconcile remains the terminal
+   * signal before the store receives a flush.
+   */
+  markNoOverlay() {
+    if (!this.#restoreNeedsOverlay) return;
+    this.#restoreNeedsOverlay = false;
     this.#flushStructuredTasks();
   }
   /**
-   * Signal that restoration has finished for tasks that have no persisted
-   * overlay to apply. Unblocks #flushStructuredTasks and runs one flush with
-   * the current state (disk-only, no overlay). Must be called by the
-   * restoration caller whenever applyOverlay will not be invoked.
+   * Clear BOTH restore gates. Used in error paths (hydration promise rejected)
+   * and by restorers that know neither an overlay nor a disk reconcile will
+   * arrive. If either signal fires after this, the natural flush handles it.
    */
   markRestoreComplete() {
-    if (!this.#restoreInProgress) return;
-    this.#restoreInProgress = false;
+    if (!this.#restoreNeedsOverlay && !this.#restoreNeedsDisk) return;
+    this.#restoreNeedsOverlay = false;
+    this.#restoreNeedsDisk = false;
     this.#flushStructuredTasks();
   }
   processStructuredTaskEvents(content) {
@@ -91292,7 +91739,7 @@ var StructuredTaskTracker = class {
    * 7. Push to updateStructuredTasks
    */
   #flushStructuredTasks() {
-    if (this.#restoreInProgress) return;
+    if (this.#restoreNeedsOverlay || this.#restoreNeedsDisk) return;
     const overlay = this.#currentOverlay ?? DEFAULT_TASK_OVERLAY;
     const merged = applyOverlayToMap(this.#structuredTasks, overlay);
     const todoProgress = computeTodoProgress(merged);
@@ -91314,6 +91761,7 @@ var StructuredTaskTracker = class {
    * - Re-flush with overlay applied
    */
   #reconcileFromDisk(ccTasks) {
+    this.#restoreNeedsDisk = false;
     const currentDiskIds = /* @__PURE__ */ new Set();
     for (const file of ccTasks) {
       currentDiskIds.add(file.id);
@@ -92013,31 +92461,20 @@ function trackWorktreeToolUse(content, pendingIds) {
   }
 }
 function handleWorktreeToolResults(content, params) {
-  let newCwd;
-  let newOriginalCwd;
-  let currentCwd = params.currentCwd;
-  let originalCwd = params.originalCwd;
   for (const block2 of content) {
     if (block2.type !== "tool_result") continue;
     if (!params.pendingIds.delete(block2.toolUseId)) continue;
     if (block2.isError) continue;
     const extracted = extractWorktreePath(block2.content);
     if (!extracted) continue;
-    if (!originalCwd) {
-      originalCwd = currentCwd;
-      newOriginalCwd = currentCwd;
-    }
-    currentCwd = extracted;
-    newCwd = extracted;
+    params.onCwdChanged(extracted);
     params.log({
       event: "worktree_cwd_changed",
       taskId: params.taskId,
       newCwd: extracted,
-      originalCwd
+      originalCwd: params.getOriginalCwd() ?? null
     });
-    params.onCwdChanged(params.taskId, extracted);
   }
-  return { newCwd, newOriginalCwd };
 }
 function trackPlanFileFromToolUse(content, onPlanFile) {
   for (const block2 of content) {
@@ -92412,6 +92849,12 @@ function classifyRoiTransition(nextStatus, roiEverRan) {
   if (nextStatus === "in_progress") return "reset-cycle";
   return "nothing";
 }
+function isTaskListSynthetic(msg, taskUri) {
+  if (!msg.isSynthetic || msg.content.length !== 1) return false;
+  const block2 = msg.content[0];
+  if (!block2 || block2.type !== "resource") return false;
+  return "uri" in block2.resource && block2.resource.uri === taskUri;
+}
 var Task = class {
   #deps;
   #mainThread;
@@ -92481,6 +92924,7 @@ var Task = class {
   constructor(deps) {
     this.#deps = deps;
     this.#cwd = deps.cwd;
+    this.#originalCwd = deps.initialOriginalCwd ?? void 0;
     this.#broadcastToAllPeers = deps.sendControlMessage ?? null;
     this.#costBaseline = deps.costBaseline;
     this.#lastTurnStats = deps.initialTurnStats ?? null;
@@ -92497,7 +92941,12 @@ var Task = class {
       taskId: deps.taskId,
       log: deps.log,
       updateStructuredTasks: deps.updateStructuredTasks,
-      restoreInProgress: deps.restoreInProgress ?? false
+      restoreInProgress: deps.restoreInProgress ?? false,
+      /**
+       * Only wait for a disk reconcile if a CC session exists — else the file
+       * watcher never attaches and the gate would never clear.
+       */
+      restoreExpectDisk: Boolean(deps.restoreInProgress && deps.existingSessionId)
     });
     this.#pushManager = new ResourcePushManager({
       taskId: deps.taskId,
@@ -92542,6 +92991,8 @@ var Task = class {
           error: err instanceof Error ? err.message : String(err)
         });
       });
+      const seedPromise = this.#seedPushManagerFromHistory();
+      this.#hydrationPromise = this.#hydrationPromise ? this.#hydrationPromise.then(() => seedPromise) : seedPromise;
     }
     this.#subagentManager = new SubagentManager({
       taskId: deps.taskId,
@@ -92681,7 +93132,7 @@ var Task = class {
     });
     const spawnMode = deps.existingSessionId ? { kind: "resume", sessionId: deps.existingSessionId } : { kind: "fresh" };
     const initialCwd = deps.cwd;
-    const wrappedSpawn = (reason, content, onEvent, canUseTool, settings, _cwd, taskId, additionalPrompt, disallowedTools, mode) => {
+    const wrappedSpawn = (reason, content, onEvent, canUseTool, settings, _cwd, taskId, additionalPrompt, disallowedTools, mode, onCwdChanged) => {
       const effectiveCwd = _cwd && _cwd !== initialCwd ? _cwd : this.#cwd;
       return deps.spawnSubprocess(
         reason,
@@ -92693,7 +93144,8 @@ var Task = class {
         taskId,
         additionalPrompt,
         disallowedTools,
-        mode
+        mode,
+        onCwdChanged
       );
     };
     this.#mainThread = new Thread(
@@ -92717,7 +93169,8 @@ var Task = class {
         initialState: deps.initialState,
         existingSessionId: deps.existingSessionId,
         metricsCollector: deps.metricsCollector,
-        adoptedSubprocess: deps.adoptedSubprocess
+        adoptedSubprocess: deps.adoptedSubprocess,
+        onCwdChanged: (newCwd) => this.#applyCwdChange(newCwd)
       },
       {
         onStatusChange: (status) => this.#handleStatusChange(status),
@@ -92844,6 +93297,10 @@ var Task = class {
   get cwd() {
     return this.#cwd;
   }
+  /** The cwd at the time of the first directory switch; undefined if the agent never switched. */
+  get originalCwd() {
+    return this.#originalCwd;
+  }
   get latestSettings() {
     return this.#latestSettings;
   }
@@ -93119,6 +93576,16 @@ var Task = class {
   setCwd(cwd) {
     this.#cwd = cwd;
   }
+  /**
+   * Public funnel entry for cwd changes originating outside the SDK/tool
+   * signal path (browser `send_message.cwd`, schedule). Delegates to
+   * `#applyCwdChange` so originalCwd capture, rewind-checkpoint reset,
+   * prev-cwd commit scan, and downstream listener fan-out run once per
+   * change regardless of source.
+   */
+  applyCwdChange(cwd) {
+    this.#applyCwdChange(cwd);
+  }
   setMode(mode) {
     const previousMode = this.#deps.mode;
     this.#deps.mode = mode;
@@ -93558,6 +94025,33 @@ var Task = class {
     if (!arr || arr.length === 0) return void 0;
     return arr.shift();
   }
+  /**
+   * Resume path: if a prior daemon run already injected the task-list for
+   * this channel, its synthetic row is in the JSONL. Seed the push manager
+   * so `#resolveTaskListPrepend`'s `isSessionPushed` guard matches on the
+   * first spawn — otherwise restart re-prepends, duplicating the chip and
+   * dumping the full resource text back into the agent's context.
+   *
+   * Chained into `#hydrationPromise` (which `#awaitHydration` blocks on at
+   * every spawn/flush entry point) so the seed completes before any
+   * caller reaches `#resolveTaskListPrepend`. A fire-and-forget scan would
+   * race against a fast-arriving first user message.
+   */
+  async #seedPushManagerFromHistory() {
+    const taskUri = buildTaskResourceUri(this.#deps.taskId);
+    try {
+      const msgs = await this.#deps.store.getMessages(this.#deps.channelId);
+      if (msgs.some((msg) => isTaskListSynthetic(msg, taskUri))) {
+        this.#pushManager.seedSessionPushed(taskUri);
+      }
+    } catch (err) {
+      this.#deps.log({
+        event: "push_manager_seed_failed",
+        taskId: this.#deps.taskId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
   async #awaitHydration() {
     if (this.#hydrationPromise) {
       await this.#hydrationPromise;
@@ -93678,10 +94172,12 @@ Use this context to maintain continuity. You have already done this work \u2014
     const registry = this.#deps.resourceRegistry;
     if (!registry) return null;
     const taskUri = buildTaskResourceUri(this.#deps.taskId);
-    if (this.#pushManager.getPushedUris().has(taskUri)) return null;
+    if (this.#pushManager.isSessionPushed(taskUri)) return null;
+    this.#pushManager.markPushed(taskUri);
+    let injected = false;
     try {
       const taskResource = await registry.resolve(taskUri);
-      if ("text" in taskResource && !taskResource.text.includes('task-count="0"')) {
+      if ("text" in taskResource && !taskResource.text.includes('<task-list task-count="0"')) {
         const rootMsg = buildRootMessage(
           taskUri,
           taskResource,
@@ -93696,10 +94192,12 @@ Use this context to maintain continuity. You have already done this work \u2014
           },
           [rootMsg]
         );
-        this.#pushManager.markPushed(taskUri);
+        injected = true;
         return rootMsg.content;
       }
     } catch {
+    } finally {
+      if (!injected) this.#pushManager.unmarkPushed(taskUri);
     }
     return null;
   }
@@ -94107,16 +94605,37 @@ Use this context to maintain continuity. You have already done this work \u2014
     trackWorktreeToolUse(content, this.#pendingWorktreeToolUseIds);
   }
   #handleWorktreeToolResults(content) {
-    const { newCwd, newOriginalCwd } = handleWorktreeToolResults(content, {
+    handleWorktreeToolResults(content, {
       pendingIds: this.#pendingWorktreeToolUseIds,
-      currentCwd: this.#cwd,
-      originalCwd: this.#originalCwd,
-      onCwdChanged: this.#deps.onCwdChanged,
+      onCwdChanged: (newCwd) => this.#applyCwdChange(newCwd),
       taskId: this.#deps.taskId,
+      getOriginalCwd: () => this.#originalCwd,
       log: this.#deps.log
     });
-    if (newOriginalCwd !== void 0) this.#originalCwd = newOriginalCwd;
-    if (newCwd !== void 0) this.#cwd = newCwd;
+  }
+  /**
+   * Unified funnel for cwd changes — both the SDK's native `CwdChanged`
+   * hook and the regex-based EnterWorktree tool-result fallback converge
+   * here. Dedups by value, captures `originalCwd` on first change, resets
+   * rewind-checkpoint state, fires a one-shot commit scan against the
+   * previous cwd to retain attribution, and notifies downstream listeners.
+   */
+  #applyCwdChange(newCwd) {
+    if (this.#disposed) return;
+    if (newCwd === this.#cwd) return;
+    const prevCwd = this.#cwd;
+    if (!this.#originalCwd) this.#originalCwd = prevCwd;
+    this.#cwd = newCwd;
+    this.#rewindCheckpoint.resetForCwdChange();
+    if (prevCwd) this.#triggerCommitScanForCwd(prevCwd);
+    this.#deps.onCwdChanged(this.#deps.taskId, newCwd);
+    this.#deps.log({
+      event: "task_cwd_changed_via_apply",
+      taskId: this.#deps.taskId,
+      newCwd,
+      prevCwd: prevCwd ?? null,
+      originalCwd: this.#originalCwd ?? null
+    });
   }
   #trackPlanFileFromToolUse(content) {
     trackPlanFileFromToolUse(content, (path2) => this.#planHandler.trackCreatedFile(path2));
@@ -94145,12 +94664,12 @@ Use this context to maintain continuity. You have already done this work \u2014
       this.#deps.persistAbandonedAt(Date.now());
     }
   }
-  #triggerCommitScan() {
-    const cwd = this.#cwd;
-    if (!cwd) return;
+  #chainCommitScan(resolveCwd, failEvent) {
     this.#trailerInjectionChain = this.#trailerInjectionChain.then(async () => {
       try {
         const state = await this.#deps.getCommitScanState();
+        const cwd = resolveCwd();
+        if (!cwd) return;
         await scanAndAttributeCommits(
           {
             cwd,
@@ -94177,7 +94696,7 @@ Use this context to maintain continuity. You have already done this work \u2014
         );
       } catch (err) {
         this.#deps.log({
-          event: "roi_commit_scan_failed",
+          event: failEvent,
           taskId: this.#deps.taskId,
           error: err instanceof Error ? err.message : String(err)
         });
@@ -94185,6 +94704,17 @@ Use this context to maintain continuity. You have already done this work \u2014
     }).catch(() => {
     });
   }
+  #triggerCommitScan() {
+    this.#chainCommitScan(() => this.#cwd, "roi_commit_scan_failed");
+  }
+  /**
+   * Trigger a one-shot commit scan against an explicit cwd. Used at
+   * cwd-switch time to retain attribution for commits made in the
+   * outgoing directory before the agent's next Bash turn moves us on.
+   */
+  #triggerCommitScanForCwd(cwd) {
+    this.#chainCommitScan(() => cwd, "roi_commit_scan_for_cwd_failed");
+  }
   applyOverlay(overlay) {
     this.#structuredTaskTracker.applyOverlay(overlay);
   }
@@ -94192,6 +94722,10 @@ Use this context to maintain continuity. You have already done this work \u2014
   markStructuredTaskRestoreComplete() {
     this.#structuredTaskTracker.markRestoreComplete();
   }
+  /** See StructuredTaskTracker.markNoOverlay. */
+  markStructuredTaskNoOverlay() {
+    this.#structuredTaskTracker.markNoOverlay();
+  }
   /** ---------------------------------------------------------------- */
   /** Resource resolution                                              */
   /** ---------------------------------------------------------------- */
@@ -94668,14 +95202,23 @@ function findSdkUuidForSeqNoInTask(tasks, taskId, seqNo) {
 // src/services/task/manager/task-manager-template.ts
 function buildInitialOverlayFromTemplate(template, now) {
   if (!template || template.items.length === 0) return void 0;
-  const userTasks = template.items.map((item2) => ({
-    id: item2.id,
+  const idRemap = new Map(template.items.map((item2, index) => [item2.id, String(index + 1)]));
+  const userTasks = template.items.map((item2, index) => ({
+    id: String(index + 1),
     subject: item2.content,
     description: item2.description,
     status: "pending",
     owner: "user",
     blocks: [],
-    blockedBy: item2.deps,
+    /**
+     * Drop deps pointing outside the template. Falling through the
+     * original colon-bearing ID would leave a dangling `blockedBy` that
+     * CC's TaskUpdate can't resolve — silently stuck in the UI.
+     */
+    blockedBy: item2.deps.flatMap((dep) => {
+      const mapped = idRemap.get(dep);
+      return mapped ? [mapped] : [];
+    }),
     createdAt: now,
     updatedAt: now
   }));
@@ -94706,6 +95249,13 @@ var TaskManager = class {
   #pendingStreamSubs = /* @__PURE__ */ new Map();
   #onAuthNotLoggedIn = null;
   #onCwdChanged = null;
+  /**
+   * Multi-listener fan-out for cwd changes. Populated by per-peer wirings
+   * (e.g. PR poller) that need to react to cwd switches without clobbering
+   * the primary daemon-level listener set via `setOnCwdChanged`. Each
+   * registration returns an unsubscribe function.
+   */
+  #cwdChangedListeners = /* @__PURE__ */ new Set();
   #onCheckpointReady = null;
   #onRateLimitEvent = null;
   #onTurnCostDelta = null;
@@ -94779,6 +95329,17 @@ var TaskManager = class {
   setOnCwdChanged(handler) {
     this.#onCwdChanged = handler;
   }
+  /**
+   * Register an additional cwd-change listener. Unlike `setOnCwdChanged`
+   * this is multi-listener and intended for per-peer wirings (PR poller,
+   * etc). Returns an unsubscribe function.
+   */
+  addOnCwdChanged(handler) {
+    this.#cwdChangedListeners.add(handler);
+    return () => {
+      this.#cwdChangedListeners.delete(handler);
+    };
+  }
   setOnCheckpointReady(handler) {
     this.#onCheckpointReady = handler;
   }
@@ -94806,7 +95367,7 @@ var TaskManager = class {
     }
     if (task.cwd === cwd) return;
     task.cwd = cwd;
-    task.orchestrator.setCwd(cwd);
+    task.orchestrator.applyCwdChange(cwd);
     this.#deps.taskStateStore.updateCwd(taskId, cwd).catch((err) => {
       this.#deps.log({
         event: "task_state_store_update_cwd_failed",
@@ -94814,8 +95375,37 @@ var TaskManager = class {
         error: err instanceof Error ? err.message : String(err)
       });
     });
+    const originalCwd = task.orchestrator.originalCwd;
+    if (originalCwd) {
+      this.#deps.taskStateStore.setOriginalCwd(taskId, originalCwd).catch((err) => {
+        this.#deps.log({
+          event: "task_state_store_set_original_cwd_failed",
+          taskId,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      });
+    }
     this.#deps.log({ event: "task_cwd_updated", taskId, cwd });
-    this.#onCwdChanged?.(taskId, cwd);
+    try {
+      this.#onCwdChanged?.(taskId, cwd);
+    } catch (err) {
+      this.#deps.log({
+        event: "cwd_changed_primary_listener_error",
+        taskId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    for (const listener of this.#cwdChangedListeners) {
+      try {
+        listener(taskId, cwd);
+      } catch (err) {
+        this.#deps.log({
+          event: "cwd_changed_listener_error",
+          taskId,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
   }
   get taskStateStore() {
     return this.#deps.taskStateStore;
@@ -95132,11 +95722,14 @@ var TaskManager = class {
     const cwd = opts.cwd;
     const mode = opts.mode ?? "task";
     let orchestratorRef = null;
+    const hasSession = Boolean(opts.existingSessionId);
     const restoreHydration = async () => {
       const record = await this.#deps.taskStateStore.getTask(taskId);
       if (!orchestratorRef || !this.#tasks.has(taskId)) return;
       if (record?.taskOverlay) {
         orchestratorRef.applyOverlay(record.taskOverlay);
+      } else if (hasSession) {
+        orchestratorRef.markStructuredTaskNoOverlay();
       } else {
         orchestratorRef.markStructuredTaskRestoreComplete();
       }
@@ -95165,6 +95758,7 @@ var TaskManager = class {
       initialRoiStartedEmitted: opts.initialRoiStartedEmitted,
       taskCreatedAt: opts.taskCreatedAt,
       initialTurnCount: opts.initialTurnCount,
+      initialOriginalCwd: opts.initialOriginalCwd,
       restoreInProgress: true
     });
     orchestratorRef = orchestrator;
@@ -95224,7 +95818,8 @@ var TaskManager = class {
         initialPlanDetection: record.lastPlanDetection,
         initialRoiStartedEmitted: record.roiStartedEmitted,
         taskCreatedAt: record.createdAt,
-        initialTurnCount: record.totalTurnCount
+        initialTurnCount: record.totalTurnCount,
+        initialOriginalCwd: record.originalCwd ?? null
       });
       task = this.#tasks.get(taskId);
       if (!task) {
@@ -95233,15 +95828,7 @@ var TaskManager = class {
       this.#deps.log({ event: "task_lazy_restored", taskId, channelId: record.channelId });
     }
     if (cwd && cwd !== task.cwd) {
-      task.cwd = cwd;
-      task.orchestrator.setCwd(cwd);
-      this.#deps.taskStateStore.updateCwd(taskId, cwd).catch((err) => {
-        this.#deps.log({
-          event: "task_state_store_update_cwd_failed",
-          taskId,
-          error: err instanceof Error ? err.message : String(err)
-        });
-      });
+      this.updateTaskCwd(taskId, cwd);
     }
     task.orchestrator.handleUserMessage(
       content,
@@ -95661,7 +96248,8 @@ var TaskManager = class {
       onForwardedAck: (correlationId) => {
         this.#forwardedAckEmitters.get(taskId)?.(correlationId);
       },
-      restoreInProgress: opts?.restoreInProgress ?? false
+      restoreInProgress: opts?.restoreInProgress ?? false,
+      initialOriginalCwd: opts?.initialOriginalCwd
     });
   }
 };
@@ -95803,6 +96391,7 @@ function buildTaskStateStore(dataDir) {
         mergedAt: null,
         attributedCommitShas: [],
         lastCommitScanSha: null,
+        originalCwd: null,
         mode: mode ?? "task",
         ...scheduleId ? { scheduleId } : {},
         ...scheduleName ? { scheduleName } : {},
@@ -96022,6 +96611,13 @@ function buildTaskStateStore(dataDir) {
         { ...options, broadcast: false }
       );
     },
+    async setOriginalCwd(taskId, originalCwd, options) {
+      await safeUpdate(
+        taskId,
+        (task) => task.originalCwd != null ? task : { ...task, originalCwd },
+        { ...options, broadcast: false }
+      );
+    },
     async sweepToInputRequired(taskId, options) {
       await safeUpdate(
         taskId,
@@ -97003,7 +97599,7 @@ function isPlainObject2(v2) {
 }
 
 // src/services/themes/theme-store.ts
-import { mkdir as mkdir19, readdir as readdir11, readFile as readFile32, rename as rename19, stat as stat8, unlink as unlink9, writeFile as writeFile26 } from "fs/promises";
+import { mkdir as mkdir19, readdir as readdir11, readFile as readFile33, rename as rename19, stat as stat8, unlink as unlink9, writeFile as writeFile26 } from "fs/promises";
 import { join as join47 } from "path";
 function planSeed(input) {
   if (input.configExists) {
@@ -97083,7 +97679,7 @@ function buildThemeStore(dataDir) {
   }
   async function readConfigFile() {
     try {
-      const raw = await readFile32(configPath, "utf-8");
+      const raw = await readFile33(configPath, "utf-8");
       const parsed = ThemeConfigSchema.safeParse(JSON.parse(raw));
       if (!parsed.success) return null;
       return parsed.data;
@@ -97102,7 +97698,7 @@ function buildThemeStore(dataDir) {
     await atomicWrite3(themePath(id), serialized);
   }
   async function readThemeFile(id) {
-    const raw = await readFile32(themePath(id), "utf-8");
+    const raw = await readFile33(themePath(id), "utf-8");
     const parsed = VSCodeThemeSchema.safeParse(JSON.parse(raw));
     if (!parsed.success) {
       throw new Error(
@@ -97254,7 +97850,7 @@ function buildThemeStore(dataDir) {
 }
 
 // src/services/themes/vscode-scanner.ts
-import { readdir as readdir12, readFile as readFile33, stat as stat9 } from "fs/promises";
+import { readdir as readdir12, readFile as readFile34, stat as stat9 } from "fs/promises";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname17, join as join48, normalize as normalize5, resolve } from "path";
 var VSCodeThemeEntrySchema2 = external_exports.object({
@@ -97313,7 +97909,7 @@ var PackageJsonContribSchema = external_exports.object({
 async function tryReadPackageJson(extDir) {
   let pkgRaw;
   try {
-    pkgRaw = await readFile33(join48(extDir, "package.json"), "utf-8");
+    pkgRaw = await readFile34(join48(extDir, "package.json"), "utf-8");
   } catch {
     return null;
   }
@@ -97383,7 +97979,7 @@ async function readVSCodeThemeWithIncludes(absolutePath) {
     if (!validateScanPath(filePath)) {
       throw new Error(`Include path outside allowed directories: ${filePath}`);
     }
-    const raw = await readFile33(filePath, "utf-8");
+    const raw = await readFile34(filePath, "utf-8");
     const errors2 = [];
     const parsed = parse3(raw, errors2, {
       allowTrailingComma: true,
@@ -97784,7 +98380,7 @@ async function createDaemon(deps) {
     previewLifecycleSubs.set(taskId, unsub);
     reconcilePreviewRefs(taskId);
   }
-  const spawnSubprocessFn = (reason, initialContent, onEvent, canUseTool, settings, cwd, taskId, additionalSystemPrompt, disallowedTools, mode) => {
+  const spawnSubprocessFn = (reason, initialContent, onEvent, canUseTool, settings, cwd, taskId, additionalSystemPrompt, disallowedTools, mode, onCwdChanged) => {
     const resolvedTaskId = taskId ?? "unknown";
     const { watcher: vizWatcher } = getOrCreateVizWatcher(resolvedTaskId);
     deps.log({ event: "spawn_subprocess", mode, taskId: resolvedTaskId, hasMode: mode != null });
@@ -97821,7 +98417,8 @@ async function createDaemon(deps) {
       log: deps.log,
       metricsCollector: deps.metricsCollector,
       claudeCodePath: deps.claudeCodePath,
-      disallowedTools
+      disallowedTools,
+      onCwdChanged
     });
     const subprocess = AnthropicAgentSubprocess.spawn(
       deps.queryFn,
@@ -99787,7 +100384,7 @@ function friendlyExecError(err) {
 async function refreshPluginCapabilities(daemon, tokenStore) {
   const [updatedMarketplace, updatedMcp, updatedSkills] = await Promise.all([
     detectMarketplacePlugins(),
-    import("./mcp-servers-YT5BADYE.js").then(
+    import("./mcp-servers-MUVTAMDT.js").then(
       (m2) => m2.detectMCPServers(daemon.capabilities.environments, tokenStore)
     ),
     import("./skills-NCKYNLUS.js").then(
@@ -100456,6 +101053,15 @@ async function emitTaskCreatedAck(controlHandler, daemon, taskId, templateId, lo
     });
   }
 }
+var controlChannelEpochs = /* @__PURE__ */ new Map();
+function isLiveControlChannelEpoch(controlPeerId, channelEpoch, registry = controlChannelEpochs) {
+  return registry.get(controlPeerId) === channelEpoch;
+}
+function registerControlChannelEpoch(controlPeerId, registry = controlChannelEpochs) {
+  const epoch = crypto.randomUUID();
+  registry.set(controlPeerId, epoch);
+  return epoch;
+}
 function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
   const dc = narrow(rawChannel);
   const wsRoot = deps?.workspaceRoot ?? findProjectRoot(process.cwd());
@@ -100657,6 +101263,9 @@ function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
     },
     prPollerLog
   );
+  const unsubscribeCwdChanged = daemon.taskManager.addOnCwdChanged((taskId, newCwd) => {
+    void prPoller.updateCwd(taskId, newCwd);
+  });
   function attributePrIfFirstDiscovery(payload) {
     const { taskId } = payload;
     const pr = payload.currentBranchPR;
@@ -101489,6 +102098,7 @@ function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
   }
   controlHandler = handler;
   const controlPeerId = deps?.machineId ?? `_control_${crypto.randomUUID()}`;
+  const channelEpoch = registerControlChannelEpoch(controlPeerId);
   daemon.taskManager.registerControlChannel(controlPeerId, handler.sendControl);
   daemon.taskManager.setOnAuthNotLoggedIn(() => {
     const preferred = daemon.capabilities?.anthropicAuth?.method !== "none" ? daemon.capabilities?.anthropicAuth?.method : void 0;
@@ -101590,6 +102200,15 @@ function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
     handler.onMessage(raw);
   };
   dc.onclose = () => {
+    if (!isLiveControlChannelEpoch(controlPeerId, channelEpoch)) {
+      logAdapter({
+        event: "control_channel_onclose_stale",
+        peerId: controlPeerId,
+        staleEpoch: channelEpoch,
+        currentEpoch: controlChannelEpochs.get(controlPeerId) ?? null
+      });
+      return;
+    }
     reassembler.clear();
     if (loginChild) {
       loginChild.kill();
@@ -101598,6 +102217,7 @@ function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
     for (const unsub of resourceUnsubs.values()) unsub();
     resourceUnsubs.clear();
     userSettingsUnsub();
+    unsubscribeCwdChanged();
     prPoller.dispose();
     handler.dispose();
     guardedChannel.dispose();
@@ -101609,6 +102229,7 @@ function wireControlChannel(rawChannel, daemon, logAdapter, deps) {
       ref.pool = removePresence(ref.pool, controlPeerId);
       daemon.taskManager.broadcastControl({ type: "presence_state", peers: ref.pool });
     }
+    controlChannelEpochs.delete(controlPeerId);
   };
   logAdapter({
     event: "control_channel_wired",
@@ -101746,8 +102367,12 @@ function handleParticipantsList(room, participants, deps) {
     userId: p2.userId,
     username: p2.username,
     avatarUrl: p2.avatarUrl,
-    role: p2.role
+    role: p2.role,
+    connectionId: p2.connectionId
   }));
+  for (const p2 of participants) {
+    room.connectionIdByUser.set(p2.userId, p2.connectionId);
+  }
   bumpAndNotify(room, deps);
   for (const participant of participants) {
     if (participant.userId === room.myUserId) continue;
@@ -101765,6 +102390,7 @@ function handleParticipantsList(room, participants, deps) {
 function handleParticipantJoined(room, participant, deps) {
   if (!room.myUserId) return;
   if (participant.userId === room.myUserId) return;
+  room.connectionIdByUser.set(participant.userId, participant.connectionId);
   if (room.knownPeers.has(participant.userId)) return;
   room.participants = [
     ...room.participants,
@@ -101772,31 +102398,38 @@ function handleParticipantJoined(room, participant, deps) {
       userId: participant.userId,
       username: participant.username,
       avatarUrl: participant.avatarUrl,
-      role: participant.role
+      role: participant.role,
+      connectionId: participant.connectionId
     }
   ];
   bumpAndNotify(room, deps);
   registerCollabParticipant(room, participant.userId, participant.role, participant.username, deps);
   maybeInitiateOffer(room, participant.userId, deps);
 }
-function handleParticipantLeft(room, userId, deps) {
+function handleParticipantLeft(room, msg, deps) {
+  const { userId, connectionId } = msg;
+  const tracked = room.connectionIdByUser.get(userId);
+  if (tracked !== void 0 && tracked !== connectionId) {
+    deps.log({
+      event: "participant_left_stale_dropped",
+      roomId: room.roomId,
+      userId,
+      incomingConnectionId: connectionId,
+      trackedConnectionId: tracked
+    });
+    return;
+  }
   room.knownPeers.delete(userId);
   room.participants = room.participants.filter((p2) => p2.userId !== userId);
+  room.connectionIdByUser.delete(userId);
   bumpAndNotify(room, deps);
-  deps.peerRoleRegistry.unregisterPeer(namespacePeerId(room.roomId, userId));
-  room.peerManager.closePeer(namespacePeerId(room.roomId, userId));
+  const peerId = namespacePeerId(room.roomId, userId);
+  deps.peerRoleRegistry.unregisterPeer(peerId);
+  room.peerManager.closePeer(peerId);
   deps.log({ event: "collab_participant_left", roomId: room.roomId, userId });
 }
-function handleWebrtcSignaling(room, type, targetUserId, payload, deps) {
+function handleWebrtcSignaling(room, type, targetUserId, generationId, payload, deps) {
   const peerId = namespacePeerId(room.roomId, targetUserId);
-  const generationId = `collab:${peerId}`;
-  deps.log({
-    event: "collab_generationid_placeholder",
-    roomId: room.roomId,
-    targetUserId,
-    type,
-    generationId
-  });
   const actions = {
     // eslint-disable-next-line no-restricted-syntax -- SDP is opaque z.unknown() from signaling
     offer: () => room.peerManager.handleOffer(peerId, payload, generationId),
@@ -101806,7 +102439,12 @@ function handleWebrtcSignaling(room, type, targetUserId, payload, deps) {
     ice: () => room.peerManager.handleIce(peerId, payload, generationId)
   };
   actions[type]().catch((err) => {
-    deps.log({ event: `collab_${type}_failed`, roomId: room.roomId, error: String(err) });
+    deps.log({
+      event: `collab_${type}_failed`,
+      roomId: room.roomId,
+      generationId,
+      error: String(err)
+    });
   });
 }
 function handleCollabRoomMessage(room, msg, deps) {
@@ -101822,16 +102460,16 @@ function handleCollabRoomMessage(room, msg, deps) {
       handleParticipantJoined(room, msg.participant, deps);
       break;
     case "participant-left":
-      handleParticipantLeft(room, msg.userId, deps);
+      handleParticipantLeft(room, { userId: msg.userId, connectionId: msg.connectionId }, deps);
       break;
     case "webrtc-offer":
-      handleWebrtcSignaling(room, "offer", msg.targetUserId, msg.offer, deps);
+      handleWebrtcSignaling(room, "offer", msg.targetUserId, msg.generationId, msg.offer, deps);
       break;
     case "webrtc-answer":
-      handleWebrtcSignaling(room, "answer", msg.targetUserId, msg.answer, deps);
+      handleWebrtcSignaling(room, "answer", msg.targetUserId, msg.generationId, msg.answer, deps);
       break;
     case "webrtc-ice":
-      handleWebrtcSignaling(room, "ice", msg.targetUserId, msg.candidate, deps);
+      handleWebrtcSignaling(room, "ice", msg.targetUserId, msg.generationId, msg.candidate, deps);
       break;
     case "ice-servers":
       room.peerManager.updateIceServers(msg.iceServers);
@@ -101967,6 +102605,7 @@ function createCollabRoomManager(deps) {
         myUserId: null,
         knownPeers: /* @__PURE__ */ new Set(),
         participants: [],
+        connectionIdByUser: /* @__PURE__ */ new Map(),
         expiresAt,
         generation: 0,
         expiryTimer: setTimeout(() => {
@@ -102000,6 +102639,7 @@ function createCollabRoomManager(deps) {
           );
           room.myUserId = null;
           room.knownPeers.clear();
+          room.connectionIdByUser.clear();
         }
       });
       connection.connect();
@@ -102046,10 +102686,53 @@ function createCollabRoomManager(deps) {
 
 // src/services/file-io-handler.ts
 import { execFile as execFile10, spawn as spawn6 } from "child_process";
-import { readdir as readdir14, readFile as readFile34, realpath, stat as stat10, unlink as unlink10, writeFile as writeFile28 } from "fs/promises";
-import { normalize as normalize6, relative as relative3, resolve as resolve2 } from "path";
+import { readdir as readdir14, readFile as readFile35, realpath as realpath2, stat as stat10, unlink as unlink10, writeFile as writeFile28 } from "fs/promises";
+import { normalize as normalize7, relative as relative3, resolve as resolve2 } from "path";
 import { promisify as promisify7 } from "util";
 
+// src/shared/file-io-path-safety.ts
+import { realpath } from "fs/promises";
+import { basename as basename5, dirname as dirname19, join as join52, normalize as normalize6 } from "path";
+async function safeAbsolutePath(userPath, isHidden2, allowedHiddenNames) {
+  const normalized = prepareAbsolutePath(userPath, isHidden2, allowedHiddenNames);
+  if (normalized === null) return null;
+  const canonical = await canonicalizeOrRecombine(normalized);
+  if (canonical === null) return null;
+  if (!checkSegmentsAllowed(canonical, isHidden2, allowedHiddenNames)) return null;
+  return canonical;
+}
+function prepareAbsolutePath(userPath, isHidden2, allowedHiddenNames) {
+  if (!userPath.startsWith("/")) return null;
+  const normalized = normalize6(userPath);
+  if (normalized.startsWith("..") || normalized.includes("/..") || normalized.includes("\\..")) {
+    return null;
+  }
+  if (!checkSegmentsAllowed(normalized, isHidden2, allowedHiddenNames)) return null;
+  return normalized;
+}
+async function canonicalizeOrRecombine(path2) {
+  try {
+    return await realpath(path2);
+  } catch (err) {
+    if (!isEnoent2(err)) return null;
+    const parentCanonical = await realpath(dirname19(path2)).catch(() => null);
+    if (parentCanonical === null) return null;
+    return join52(parentCanonical, basename5(path2));
+  }
+}
+function isEnoent2(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+function checkSegmentsAllowed(path2, isHidden2, allowedHiddenNames) {
+  const segments = path2.split(/[/\\]/).filter((s2) => s2.length > 0 && s2 !== ".");
+  for (const seg of segments) {
+    if (!isHidden2(seg)) continue;
+    if (allowedHiddenNames?.has(seg)) continue;
+    return false;
+  }
+  return true;
+}
+
 // src/services/channels/handlers/snapshot-diff-handler.ts
 function planSnapshotDiff(input) {
   const { fromRef, toRef, fromRefExists, toRefExists, autoFetch, parentIsMerged } = input;
@@ -102280,7 +102963,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
     return safePathWithOverrides(userPath, /* @__PURE__ */ new Set(["node_modules"]));
   }
   function safePathWithOverrides(userPath, allowedHiddenNames) {
-    const normalized = normalize6(userPath);
+    const normalized = normalize7(userPath);
     if (normalized.startsWith("..") || normalized.includes("/..") || normalized.includes("\\..")) {
       return null;
     }
@@ -102295,6 +102978,9 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
     if (rel.startsWith("..") || rel.startsWith("/")) return null;
     return abs;
   }
+  function safeAbsolutePath2(userPath, allowedHiddenNames) {
+    return safeAbsolutePath(userPath, isHidden, allowedHiddenNames);
+  }
   function onMessage(data) {
     let parsed;
     try {
@@ -102347,26 +103033,38 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
         assertNever3(msg);
     }
   }
-  function dispatchFileOp(msg) {
+  async function dispatchFileOp(msg) {
     const isReadOnlyOp = msg.type === "read_file" || msg.type === "stat";
-    const abs = isReadOnlyOp ? safePathForRead(msg.path) : safePath(msg.path);
+    const isExternal = isReadOnlyOp && msg.external === true;
+    if (isExternal && !deps.allowExternalReads) {
+      log({ event: "file_io_external_denied", path: msg.path });
+      respondError(msg.requestId, `external_not_allowed:${msg.path}`);
+      return;
+    }
+    let abs;
+    if (isExternal) {
+      abs = await safeAbsolutePath2(msg.path, /* @__PURE__ */ new Set(["node_modules"]));
+    } else {
+      abs = isReadOnlyOp ? safePathForRead(msg.path) : safePath(msg.path);
+    }
     if (!abs) {
-      log({ event: "file_io_path_rejected", path: msg.path });
-      respondError(msg.requestId, `hidden_path:${msg.path}`);
+      log({ event: "file_io_path_rejected", path: msg.path, external: isExternal });
+      const code2 = isExternal ? "external_blocked" : "hidden_path";
+      respondError(msg.requestId, `${code2}:${msg.path}`);
       return;
     }
     switch (msg.type) {
       case "read_file":
-        handleReadFile(msg.requestId, abs);
+        await handleReadFile(msg.requestId, abs);
         break;
       case "write_file":
-        handleWriteFile(msg.requestId, abs, msg.content);
+        await handleWriteFile(msg.requestId, abs, msg.content);
         break;
       case "readdir":
-        handleReaddir(msg.requestId, abs);
+        await handleReaddir(msg.requestId, abs);
         break;
       case "stat":
-        handleStat(msg.requestId, abs);
+        await handleStat(msg.requestId, abs);
         break;
       default:
         assertNever3(msg);
@@ -102389,7 +103087,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
       case "write_file":
       case "readdir":
       case "stat":
-        dispatchFileOp(msg);
+        void dispatchFileOp(msg);
         break;
       case "set_cwd":
         handleSetCwd(msg.requestId, msg.path);
@@ -102456,7 +103154,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
         respondError(requestId, "File too large (>10MB)");
         return;
       }
-      const content = await readFile34(absPath, "utf-8");
+      const content = await readFile35(absPath, "utf-8");
       respond({ type: "file_content", requestId, content });
     } catch (err) {
       respondError(requestId, formatError(err));
@@ -102505,7 +103203,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
   async function handleSetCwd(requestId, newPath) {
     try {
       const resolved = resolve2(newPath);
-      const canonical = await realpath(resolved);
+      const canonical = await realpath2(resolved);
       if (!deps.isAllowedCwd(canonical)) {
         respondError(requestId, "cwd not allowed");
         log({ event: "file_io_cwd_rejected", cwd: canonical });
@@ -102544,7 +103242,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
       const { stdout } = await execFileAsync3(
         "git",
         ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
-        { cwd, maxBuffer: 10 * 1024 * 1024 }
+        { cwd, maxBuffer: 100 * 1024 * 1024 }
       );
       const files = stdout.split("\0").filter((f2) => f2.length > 0);
       respond({ type: "git_ls_files_result", requestId, files });
@@ -102650,7 +103348,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
       const originalContent = await readGitObject(`${mergeBase}:${filePath}`) ?? "";
       let modifiedContent;
       try {
-        modifiedContent = await readFile34(resolve2(cwd, filePath), "utf-8");
+        modifiedContent = await readFile35(resolve2(cwd, filePath), "utf-8");
       } catch {
         modifiedContent = "";
       }
@@ -102707,7 +103405,7 @@ function handleFileIOChannel(initialCwd, send, log, deps) {
         const indexContent = await readGitObject(`:${safeRelPath}`);
         originalContent = indexContent ?? await readGitObject(`HEAD:${safeRelPath}`) ?? "";
         try {
-          modifiedContent = await readFile34(absPath, "utf-8");
+          modifiedContent = await readFile35(absPath, "utf-8");
         } catch {
           modifiedContent = "";
         }
@@ -103332,13 +104030,13 @@ function wireThreadErrorFallback(daemon, dc, taskId, threadId, channelId, log) {
 // src/shared/pty-manager.ts
 import { accessSync, chmodSync, constants as constants2 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { dirname as dirname19, resolve as resolve3 } from "path";
+import { dirname as dirname20, resolve as resolve3 } from "path";
 import * as pty from "node-pty";
 function ensureSpawnHelperExecutable() {
   if (globalThis.process.platform === "win32") return;
   try {
     const req = createRequire4(import.meta.url);
-    const nodePtyDir = dirname19(req.resolve("node-pty/package.json"));
+    const nodePtyDir = dirname20(req.resolve("node-pty/package.json"));
     const spawnHelper = resolve3(
       nodePtyDir,
       "prebuilds",
@@ -103753,32 +104451,35 @@ function buildCollabRoomManager(deps) {
       webrtcAdapter: collabWebrtcAdapter,
       log: createChildLogger({ mode: `collab-peer:${roomId}` }),
       logAdapter,
-      onAnswer(namespacedId, answer) {
+      onAnswer(namespacedId, answer, generationId) {
         const prefix = `collab:${roomId}:`;
         const targetUserId = namespacedId.startsWith(prefix) ? namespacedId.slice(prefix.length) : namespacedId;
         connection.send({
           type: "webrtc-answer",
           targetUserId,
+          generationId,
           // eslint-disable-next-line no-restricted-syntax -- SDP is opaque over signaling
           answer
         });
       },
-      onOffer(namespacedId, offer) {
+      onOffer(namespacedId, offer, generationId) {
         const prefix = `collab:${roomId}:`;
         const targetUserId = namespacedId.startsWith(prefix) ? namespacedId.slice(prefix.length) : namespacedId;
         connection.send({
           type: "webrtc-offer",
           targetUserId,
+          generationId,
           // eslint-disable-next-line no-restricted-syntax -- SDP is opaque over signaling
           offer
         });
       },
-      onIceCandidate(namespacedId, candidate) {
+      onIceCandidate(namespacedId, candidate, generationId) {
         const prefix = `collab:${roomId}:`;
         const targetUserId = namespacedId.startsWith(prefix) ? namespacedId.slice(prefix.length) : namespacedId;
         connection.send({
           type: "webrtc-ice",
           targetUserId,
+          generationId,
           // eslint-disable-next-line no-restricted-syntax -- ICE candidate is opaque over signaling
           candidate
         });
@@ -103933,7 +104634,16 @@ function buildCollabRoomManager(deps) {
                 const taskCwd = daemon.taskManager.getTaskCwd(collabTaskId);
                 if (!taskCwd) return false;
                 return isUnderAllowedRoot2(abs, [taskCwd]);
-              }
+              },
+              /**
+               * Collab peers must NOT get external-path reads — a peer
+               * could otherwise send `{external: true, path: '/etc/hosts'}`
+               * or walk to another task's cwd via the abs-path flag, which
+               * would defeat the entire task-isolation allowlist above.
+               * The daemon rejects external:true with
+               * `external_not_allowed:...` when this flag is false.
+               */
+              allowExternalReads: false
             }
           });
           log.info("Collab file I/O channel wired");
@@ -104065,13 +104775,13 @@ function buildCollabRoomManager(deps) {
 import { execSync } from "child_process";
 import { existsSync as existsSync8 } from "fs";
 import { createRequire as createRequire5 } from "module";
-import { dirname as dirname20, join as join53 } from "path";
+import { dirname as dirname21, join as join54 } from "path";
 
 // src/services/bootstrap/self-update.ts
 import { execFile as execFile11, spawn as spawn8 } from "child_process";
 import { createHash as createHash6 } from "crypto";
-import { chmod as chmod3, mkdir as mkdir22, readFile as readFile35, rename as rename20, unlink as unlink11, writeFile as writeFile29 } from "fs/promises";
-import { join as join52 } from "path";
+import { chmod as chmod3, mkdir as mkdir22, readFile as readFile36, rename as rename20, unlink as unlink11, writeFile as writeFile29 } from "fs/promises";
+import { join as join53 } from "path";
 
 // src/services/bootstrap/self-update-installer-scripts.ts
 function buildPosixInstallerScript(params) {
@@ -104473,7 +105183,7 @@ async function downloadTarball(url, destPath, fetchFn) {
       throw new Error(`download failed: HTTP ${response.status} ${response.statusText}`);
     }
     const bytes = new Uint8Array(await response.arrayBuffer());
-    await mkdir22(join52(destPath, ".."), { recursive: true });
+    await mkdir22(join53(destPath, ".."), { recursive: true });
     try {
       await writeFile29(tmpPath, bytes);
       await rename20(tmpPath, destPath);
@@ -104492,7 +105202,7 @@ async function downloadTarball(url, destPath, fetchFn) {
 }
 async function verifyChecksum(path2, expectedHash) {
   const algo = expectedHash.length === 40 ? "sha1" : "sha256";
-  const raw = await readFile35(path2);
+  const raw = await readFile36(path2);
   const actual = createHash6(algo).update(raw).digest("hex");
   if (actual !== expectedHash) {
     try {
@@ -104503,7 +105213,7 @@ async function verifyChecksum(path2, expectedHash) {
   }
 }
 async function stageInstallerScript(scriptPath, params) {
-  await mkdir22(join52(scriptPath, ".."), { recursive: true });
+  await mkdir22(join53(scriptPath, ".."), { recursive: true });
   const body = process.platform === "win32" ? buildWindowsInstallerScript(params) : buildPosixInstallerScript(params);
   await writeFile29(scriptPath, body);
   await chmod3(scriptPath, 493);
@@ -104553,16 +105263,16 @@ function buildInstallerParams(state, deps) {
     targetVersion: state.resolved.version,
     previousVersion: deps.currentVersion,
     parentPid: deps.pid,
-    statusFilePath: join52(deps.shipyardHome, "update-status.json"),
-    pidFilePath: join52(deps.shipyardHome, "daemon.pid"),
-    logPath: join52(deps.shipyardHome, "updates", `install-${deps.pid}.log`),
-    snapshotPath: join52(deps.shipyardHome, "updates", `rollback-${deps.currentVersion}`),
+    statusFilePath: join53(deps.shipyardHome, "update-status.json"),
+    pidFilePath: join53(deps.shipyardHome, "daemon.pid"),
+    logPath: join53(deps.shipyardHome, "updates", `install-${deps.pid}.log`),
+    snapshotPath: join53(deps.shipyardHome, "updates", `rollback-${deps.currentVersion}`),
     npmBin: "npm"
   };
 }
 function tarballPathFor(shipyardHome, version, shasum) {
   const shaPrefix = shasum.slice(0, 12);
-  return join52(shipyardHome, "updates", `${version}-${shaPrefix}.tgz`);
+  return join53(shipyardHome, "updates", `${version}-${shaPrefix}.tgz`);
 }
 async function runResolveStep(step, state, deps) {
   const resolver = deps.resolveVersion ?? defaultResolveVersion;
@@ -104728,7 +105438,7 @@ function resolveClaudeCodePath(log) {
   try {
     const req = createRequire5(import.meta.url);
     const sdkMain = req.resolve("@anthropic-ai/claude-agent-sdk");
-    const p2 = join53(dirname20(sdkMain), "cli.js");
+    const p2 = join54(dirname21(sdkMain), "cli.js");
     if (existsSync8(p2)) return ok("sdk_bundled", p2);
   } catch {
   }
@@ -104738,7 +105448,7 @@ function resolveClaudeCodePath(log) {
   } catch {
   }
   for (const c of [
-    join53(process.env.HOME ?? "", ".local", "bin", "claude"),
+    join54(process.env.HOME ?? "", ".local", "bin", "claude"),
     "/usr/local/bin/claude"
   ])
     if (existsSync8(c)) return ok("well_known", c);
@@ -105069,7 +105779,14 @@ function buildSharedChannelCallbacks(deps) {
           diffTurn: (taskId, turnIndex) => daemon.taskManager.diffTurn(taskId, turnIndex),
           diffTurnFile: (taskId, turnIndex, path2) => daemon.taskManager.diffTurnFile(taskId, turnIndex, path2),
           revertTurn: (taskId, turnIndex, mode, filePath) => daemon.taskManager.revertTurn(taskId, turnIndex, mode, filePath),
-          isAllowedCwd: (abs) => isUnderAllowedRoot2(abs, daemon.taskManager.getAllowedCwds())
+          isAllowedCwd: (abs) => isUnderAllowedRoot2(abs, daemon.taskManager.getAllowedCwds()),
+          /**
+           * Personal-mode: owner is operating on their own host, so reading
+           * arbitrary files outside the workspace (subject to HIDDEN_PATTERNS)
+           * is the feature that lets them open ~/.claude/plans/*.md and
+           * similar. Collab wiring must pass `false` here.
+           */
+          allowExternalReads: true
         },
         onCwdChange: (newCwd) => {
           portDetectorRef.current?.setCwd(newCwd);
@@ -105236,8 +105953,8 @@ function buildLocalDirectChannelCallbacks(deps) {
 
 // src/services/storage/daemon-settings-store.ts
 import { createHash as createHash7 } from "crypto";
-import { mkdir as mkdir23, readFile as readFile36, rename as rename21, writeFile as writeFile30 } from "fs/promises";
-import { join as join54 } from "path";
+import { mkdir as mkdir23, readFile as readFile37, rename as rename21, writeFile as writeFile30 } from "fs/promises";
+import { join as join55 } from "path";
 var ProjectSettingsSchema = external_exports.object({
   disabledMcpServers: external_exports.array(external_exports.string()).optional()
 });
@@ -105245,9 +105962,9 @@ function hashProjectPath(projectPath) {
   return createHash7("sha256").update(projectPath).digest("hex").slice(0, 16);
 }
 function buildDaemonSettingsStore(dataDir) {
-  const settingsDir = join54(dataDir, "settings");
+  const settingsDir = join55(dataDir, "settings");
   function settingsPath(projectPath) {
-    return join54(settingsDir, `${hashProjectPath(projectPath)}.json`);
+    return join55(settingsDir, `${hashProjectPath(projectPath)}.json`);
   }
   async function ensureDir() {
     await mkdir23(settingsDir, { recursive: true });
@@ -105255,7 +105972,7 @@ function buildDaemonSettingsStore(dataDir) {
   return {
     async load(projectPath) {
       try {
-        const raw = await readFile36(settingsPath(projectPath), "utf-8");
+        const raw = await readFile37(settingsPath(projectPath), "utf-8");
         return ProjectSettingsSchema.parse(JSON.parse(raw));
       } catch (err) {
         if (isEnoent(err)) return {};
@@ -105273,19 +105990,19 @@ function buildDaemonSettingsStore(dataDir) {
 }
 
 // src/services/storage/plugin-config-store.ts
-import { mkdir as mkdir24, readFile as readFile37, rename as rename22, writeFile as writeFile31 } from "fs/promises";
-import { join as join55 } from "path";
+import { mkdir as mkdir24, readFile as readFile38, rename as rename22, writeFile as writeFile31 } from "fs/promises";
+import { join as join56 } from "path";
 function buildPluginConfigStore(pluginsDir) {
   const cache2 = /* @__PURE__ */ new Map();
   const writeQueues = /* @__PURE__ */ new Map();
   function configPath(pluginId) {
-    return join55(pluginsDir, pluginId, "config.json");
+    return join56(pluginsDir, pluginId, "config.json");
   }
   async function ensureLoaded(pluginId) {
     const cached2 = cache2.get(pluginId);
     if (cached2) return cached2;
     try {
-      const raw = await readFile37(configPath(pluginId), "utf-8");
+      const raw = await readFile38(configPath(pluginId), "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         const record = Object.fromEntries(Object.entries(parsed));
@@ -105310,7 +106027,7 @@ function buildPluginConfigStore(pluginsDir) {
       const next = prev.then(async () => {
         const filePath = configPath(pluginId);
         const tmpPath = `${filePath}.tmp`;
-        await mkdir24(join55(pluginsDir, pluginId), { recursive: true });
+        await mkdir24(join56(pluginsDir, pluginId), { recursive: true });
         await writeFile31(tmpPath, JSON.stringify(config2, null, 2), "utf-8");
         await rename22(tmpPath, filePath);
       });
@@ -105331,13 +106048,13 @@ function buildPluginConfigStore(pluginsDir) {
 var LEGACY_EPOCH = 5;
 async function serve(options = {}) {
   const shipyardHome = options.shipyardHome ?? getShipyardHome();
-  const dataDir = join56(shipyardHome, options.isDev ? "data-dev" : "data");
+  const dataDir = join57(shipyardHome, options.isDev ? "data-dev" : "data");
   const log = createChildLogger({ mode: "serve" });
-  const workspaceRoot = await realpath2(findProjectRoot(process.cwd())).catch(
+  const workspaceRoot = await realpath3(findProjectRoot(process.cwd())).catch(
     () => findProjectRoot(process.cwd())
   );
   registerBuiltinPlugins();
-  const pluginConfigStore = buildPluginConfigStore(join56(dataDir, "plugins"));
+  const pluginConfigStore = buildPluginConfigStore(join57(dataDir, "plugins"));
   await mkdir25(dataDir, { recursive: true });
   log.info({ shipyardHome, dataDir, workspaceRoot }, "Starting daemon");
   function logAdapter(entry) {
@@ -105363,8 +106080,8 @@ async function serve(options = {}) {
   await lifecycle.acquirePidFile(shipyardHome);
   const pidTracker = buildPidTracker(shipyardHome);
   await pidTracker.sweepOrphans(logAdapter);
-  await pruneOldEpochData(join56(dataDir, "loro"), LEGACY_EPOCH, logAdapter);
-  const storage = new FileStorageAdapter(join56(dataDir, "loro"));
+  await pruneOldEpochData(join57(dataDir, "loro"), LEGACY_EPOCH, logAdapter);
+  const storage = new FileStorageAdapter(join57(dataDir, "loro"));
   const personalWebrtcAdapter = new WebRtcDataChannelAdapter();
   const peerRoleRegistry = createPeerRoleRegistry();
   const presencePoolRef = { pool: {} };
@@ -105425,7 +106142,7 @@ async function serve(options = {}) {
     previewProxy
   });
   daemon.healthMetrics.start();
-  const pluginsDir = join56(shipyardHome, "plugins");
+  const pluginsDir = join57(shipyardHome, "plugins");
   await mkdir25(pluginsDir, { recursive: true });
   let loadedPlugins = [];
   const loadedPluginsRef = {
@@ -105558,7 +106275,6 @@ async function serve(options = {}) {
   const peerManager = peerSetupDeps ? buildPeerManager(peerSetupDeps) : null;
   if (peerSetupDeps && !localDirectRef.current) {
     const handle = await setupLocalDirect({
-      env,
       shipyardHome,
       daemonId: daemonPeerId,
       userId: auth3.userId,
@@ -105701,4 +106417,4 @@ export {
   _testing,
   serve
 };
-//# sourceMappingURL=serve-O4AHOTL4.js.map
+//# sourceMappingURL=serve-IMSVRV3B.js.map