@serviceme/devtools-core 0.3.1 → 0.3.3

package/dist/index.js

@@ -96,6 +96,7 @@ __export(src_exports, {
   SCHEDULER_LOCK_FILENAME: () => SCHEDULER_LOCK_FILENAME,
   SCHEDULER_LOG_FILENAME: () => SCHEDULER_LOG_FILENAME,
   SCHEDULER_PID_FILENAME: () => SCHEDULER_PID_FILENAME,
+  SERVER_PROXY_GLOBAL_FILENAME: () => SERVER_PROXY_GLOBAL_FILENAME,
   SERVICEME_DIR_NAME: () => SERVICEME_DIR_NAME,
   SERVICEME_HOME_ENV: () => SERVICEME_HOME_ENV,
   SKILL_DRAFTS_SUBDIR: () => SKILL_DRAFTS_SUBDIR,
@@ -163,6 +164,7 @@ __export(src_exports, {
   getSchedulerLockPath: () => getSchedulerLockPath,
   getSchedulerLogPath: () => getSchedulerLogPath,
   getSchedulerPidPath: () => getSchedulerPidPath,
+  getServerProxyGlobalPath: () => getServerProxyGlobalPath,
   getServicemeHome: () => getServicemeHome,
   getSkillDraftsDir: () => getSkillDraftsDir,
   getToolboxJsonPath: () => getToolboxJsonPath,
@@ -173,6 +175,7 @@ __export(src_exports, {
   isUserRepo: () => isUserRepo,
   matchesCron: () => matchesCron,
   mergeWithDefaults: () => mergeWithDefaults,
+  migrateLegacyServerProxyEnabled: () => migrateLegacyServerProxyEnabled,
   migrateToGlobal: () => migrateToGlobal,
   moveFiles: () => moveFiles,
   narrowRepoConfig: () => narrowRepoConfig,
@@ -180,6 +183,7 @@ __export(src_exports, {
   parseAgentToolPermissions: () => parseAgentToolPermissions,
   parseIntervalMs: () => parseIntervalMs,
   randomInstallationId: () => randomInstallationId,
+  readServerProxyGlobal: () => readServerProxyGlobal,
   reindexOrder: () => reindexOrder,
   reposFileSchema: () => reposFileSchema,
   resetUserHomeOverrides: () => resetUserHomeOverrides,
@@ -194,7 +198,8 @@ __export(src_exports, {
   unzipFile: () => unzipFile,
   userRepoConfigSchema: () => userRepoSchema,
   validateReposFile: () => validateReposFile,
-  validateTaskPayload: () => validateTaskPayload
+  validateTaskPayload: () => validateTaskPayload,
+  writeServerProxyGlobal: () => writeServerProxyGlobal
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -647,6 +652,50 @@ var AccessControl = class {
   }
 };
 
+// src/logger.ts
+var noopLogger = {
+  debug() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  }
+};
+function formatArgs(args) {
+  return args.map((arg) => {
+    if (typeof arg === "string") {
+      return arg;
+    }
+    try {
+      return JSON.stringify(arg);
+    } catch {
+      return String(arg);
+    }
+  }).join(" ");
+}
+function createConsoleLogger(prefix = "serviceme") {
+  return {
+    debug(message, ...args) {
+      process.stderr.write(`[${prefix}] DEBUG ${message} ${formatArgs(args)}
+`);
+    },
+    info(message, ...args) {
+      process.stderr.write(`[${prefix}] INFO ${message} ${formatArgs(args)}
+`);
+    },
+    warn(message, ...args) {
+      process.stderr.write(`[${prefix}] WARN ${message} ${formatArgs(args)}
+`);
+    },
+    error(message, ...args) {
+      process.stderr.write(`[${prefix}] ERROR ${message} ${formatArgs(args)}
+`);
+    }
+  };
+}
+
 // src/auth/AuthStateManager.ts
 var import_node_events = require("events");
 var AuthStateManager = class {
@@ -809,6 +858,7 @@ var AuthCore = class {
     this.state = opts.stateManager ?? new AuthStateManager();
     this.tokenStore = opts.tokenStore;
     this.accessControl = opts.accessControl;
+    this.logger = opts.logger ?? noopLogger;
   }
   /** Snapshot of every account, the active provider, and the last error. */
   status() {
@@ -830,16 +880,28 @@ var AuthCore = class {
    */
   async login(provider, ui, shouldContinue) {
     const providerImpl = this.registry.get(provider);
+    this.logger.info("[AuthCore] Starting device-flow login", { provider });
     try {
       const initial = await providerImpl.requestDeviceFlow();
       await ui(initial);
+      if (!initial.deviceCode) {
+        this.logger.error("[AuthCore] Provider did not return deviceCode", provider);
+        throw new Error("Auth provider did not return deviceCode for device flow completion");
+      }
       const session = await providerImpl.completeDeviceFlow(
-        initial.userCode ? initial.deviceCode ?? "" : "",
-        shouldContinue
+        initial.deviceCode,
+        shouldContinue,
+        initial.pollIntervalMs
       );
-      return await this.persistSession(providerImpl, session);
+      const result = await this.persistSession(providerImpl, session);
+      this.logger.info("[AuthCore] Device-flow login completed", { provider });
+      return result;
     } catch (err) {
-      this.state.recordError(err instanceof Error ? err.message : String(err));
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error("[AuthCore] Device-flow login failed", message, {
+        provider
+      });
+      this.state.recordError(message);
       throw err;
     }
   }
@@ -864,7 +926,10 @@ var AuthCore = class {
     if (!provider) return null;
     const account = this.state.getActiveAccount();
     if (!account) return null;
-    const envelope = await this.tokenStore.get({ provider, accountId: account.id });
+    const envelope = await this.tokenStore.get({
+      provider,
+      accountId: account.id
+    });
     if (!envelope) return null;
     return { provider, account, token: envelope.token };
   }
@@ -874,9 +939,15 @@ var AuthCore = class {
    * every account.
    */
   async logout(provider) {
+    this.logger.info("[AuthCore] Logout requested", {
+      provider: provider ?? "all"
+    });
     if (!provider) {
       for (const account of this.state.listAccounts()) {
-        await this.tokenStore.delete({ provider: account.provider, accountId: account.id });
+        await this.tokenStore.delete({
+          provider: account.provider,
+          accountId: account.id
+        });
         this.state.removeAccount(account.provider, account.id);
       }
       this.state.clearAll();
@@ -951,6 +1022,10 @@ var AuthCore = class {
       avatarUrl: meta.avatarUrl,
       expiresAt: meta.expiresAt ?? expiresAt
     };
+    this.logger.debug("[AuthCore] Persisting session", {
+      provider: meta.provider,
+      accountId: meta.id
+    });
     await this.tokenStore.set({ provider: meta.provider, accountId: meta.id }, session.token, {
       expiresAt
     });
@@ -1053,11 +1128,13 @@ var GitHubAuthProvider = class {
       userUrl: config.userUrl ?? DEFAULT_USER_URL,
       scope: config.scope ?? DEFAULT_SCOPE,
       minPollIntervalMs: config.minPollIntervalMs ?? 1e3,
-      maxPollIntervalMs: config.maxPollIntervalMs ?? 15e3,
+      maxPollIntervalMs: config.maxPollIntervalMs ?? 6e4,
       maxWaitMs: config.maxWaitMs,
       fetchImpl: config.fetchImpl ?? fetch,
       deviceCodeRetryBaseDelayMs: config.deviceCodeRetryBaseDelayMs ?? DEFAULT_DEVICE_CODE_RETRY_BASE_DELAY_MS
     };
+    this.logger = config.logger ?? noopLogger;
+    this.sleepImpl = config.sleepImpl ?? sleep;
   }
   async requestDeviceFlow(opts) {
     const body = JSON.stringify({
@@ -1066,6 +1143,10 @@ var GitHubAuthProvider = class {
     });
     let lastNetworkError;
     for (let attempt = 1; attempt <= DEVICE_CODE_MAX_ATTEMPTS; attempt++) {
+      this.logger.debug("[GitHubAuthProvider] Requesting device code", {
+        attempt,
+        maxAttempts: DEVICE_CODE_MAX_ATTEMPTS
+      });
       let resp;
       try {
         resp = await this.cfg.fetchImpl(this.cfg.deviceCodeUrl, {
@@ -1079,45 +1160,99 @@ var GitHubAuthProvider = class {
         });
       } catch (error) {
         if (!isTransientNetworkError(error) || attempt === DEVICE_CODE_MAX_ATTEMPTS) {
+          this.logger.error(
+            "[GitHubAuthProvider] Device-code request failed (non-retryable)",
+            error instanceof Error ? error.message : String(error),
+            { attempt }
+          );
           throw error;
         }
+        const delayMs = this.cfg.deviceCodeRetryBaseDelayMs * 2 ** (attempt - 1);
+        this.logger.warn(
+          "[GitHubAuthProvider] Transient network error requesting device code, retrying",
+          {
+            attempt,
+            delayMs,
+            error: error instanceof Error ? error.message : String(error)
+          }
+        );
         lastNetworkError = error;
-        await sleep(this.cfg.deviceCodeRetryBaseDelayMs * 2 ** (attempt - 1));
+        await this.sleepImpl(delayMs);
         continue;
       }
       if (!resp.ok) {
+        this.logger.error(
+          "[GitHubAuthProvider] Device-code request rejected by GitHub",
+          `HTTP ${resp.status}`
+        );
         throw new Error(`GitHub device-code request failed: HTTP ${resp.status}`);
       }
       const data = await resp.json();
       if (!data.device_code || !data.user_code || !data.verification_uri) {
+        this.logger.error(
+          "[GitHubAuthProvider] Device-code response missing required fields",
+          JSON.stringify(Object.keys(data))
+        );
         throw new Error("GitHub device-code response missing required fields");
       }
+      this.logger.info("[GitHubAuthProvider] Device code obtained", {
+        userCode: data.user_code,
+        verificationUri: data.verification_uri,
+        expiresInSec: data.expires_in,
+        pollIntervalSec: data.interval
+      });
       return {
         provider: this.providerId,
+        deviceCode: data.device_code,
         userCode: data.user_code,
         verificationUrl: data.verification_uri,
         expiresAt: Date.now() + data.expires_in * 1e3,
+        pollIntervalMs: data.interval * 1e3,
         message: `Open ${data.verification_uri} and enter ${data.user_code}`
       };
     }
     throw lastNetworkError ?? new Error("GitHub device-code request failed");
   }
-  async completeDeviceFlow(deviceCode, shouldContinue) {
+  async completeDeviceFlow(deviceCode, shouldContinue, initialPollIntervalMs) {
     const start = Date.now();
-    let pollIntervalMs = this.cfg.minPollIntervalMs;
+    let pollIntervalMs = Math.max(this.cfg.minPollIntervalMs, initialPollIntervalMs ?? 0);
     let consecutiveSlowDown = 0;
+    let pollCount = 0;
+    this.logger.info("[GitHubAuthProvider] Starting device-flow polling", {
+      initialPollIntervalMs: pollIntervalMs,
+      maxWaitMs: this.cfg.maxWaitMs
+    });
     while (true) {
       if (shouldContinue && !shouldContinue()) {
+        this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
+          elapsedMs: Date.now() - start,
+          pollCount
+        });
         throw new Error("GitHub device flow cancelled by caller");
       }
       const elapsed = Date.now() - start;
       if (this.cfg.maxWaitMs !== void 0 && elapsed > this.cfg.maxWaitMs) {
+        this.logger.warn("[GitHubAuthProvider] Device flow exceeded max wait time", {
+          elapsedMs: elapsed,
+          maxWaitMs: this.cfg.maxWaitMs,
+          pollCount
+        });
         throw new Error("GitHub device flow exceeded max wait time");
       }
-      await sleep(pollIntervalMs);
+      await this.sleepImpl(pollIntervalMs);
       if (shouldContinue && !shouldContinue()) {
+        this.logger.info("[GitHubAuthProvider] Device flow cancelled by caller", {
+          elapsedMs: Date.now() - start,
+          pollCount
+        });
         throw new Error("GitHub device flow cancelled by caller");
       }
+      pollCount++;
+      this.logger.debug("[GitHubAuthProvider] Polling for authorization", {
+        pollCount,
+        elapsedMs: Date.now() - start,
+        pollIntervalMs
+      });
       let resp;
       try {
         resp = await this.cfg.fetchImpl(this.cfg.tokenUrl, {
@@ -1135,19 +1270,59 @@ var GitHubAuthProvider = class {
         });
       } catch (error) {
         if (!isTransientNetworkError(error)) {
+          this.logger.error(
+            "[GitHubAuthProvider] Non-retryable error while polling token endpoint",
+            error instanceof Error ? error.message : String(error),
+            { pollCount }
+          );
           throw error;
         }
-        pollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), this.cfg.maxPollIntervalMs);
+        const nextPollIntervalMs = Math.min(
+          Math.round(pollIntervalMs * 1.5),
+          this.cfg.maxPollIntervalMs
+        );
+        this.logger.warn(
+          "[GitHubAuthProvider] Transient network error while polling, backing off",
+          {
+            pollCount,
+            error: error instanceof Error ? error.message : String(error),
+            previousPollIntervalMs: pollIntervalMs,
+            nextPollIntervalMs
+          }
+        );
+        pollIntervalMs = nextPollIntervalMs;
         continue;
       }
       if (!resp.ok) {
-        pollIntervalMs = Math.min(Math.round(pollIntervalMs * 1.5), this.cfg.maxPollIntervalMs);
+        const nextPollIntervalMs = Math.min(
+          Math.round(pollIntervalMs * 1.5),
+          this.cfg.maxPollIntervalMs
+        );
+        this.logger.warn(
+          "[GitHubAuthProvider] Token endpoint returned non-OK status, backing off",
+          {
+            pollCount,
+            status: resp.status,
+            previousPollIntervalMs: pollIntervalMs,
+            nextPollIntervalMs
+          }
+        );
+        pollIntervalMs = nextPollIntervalMs;
         continue;
       }
       const data = await resp.json();
       if (data.access_token) {
+        this.logger.info("[GitHubAuthProvider] Authorization granted, fetching user profile", {
+          pollCount,
+          elapsedMs: Date.now() - start
+        });
         const rawUser = await this.fetchGitHubUser(data.access_token);
         const email = await this.resolveEmail(data.access_token, rawUser);
+        this.logger.info("[GitHubAuthProvider] Device-flow login completed", {
+          pollCount,
+          elapsedMs: Date.now() - start,
+          login: rawUser.login
+        });
         return {
           token: data.access_token,
           refreshToken: data.refresh_token,
@@ -1162,22 +1337,42 @@ var GitHubAuthProvider = class {
         };
       }
       if (data.error === "authorization_pending") {
+        this.logger.debug("[GitHubAuthProvider] Authorization still pending", {
+          pollCount,
+          elapsedMs: Date.now() - start
+        });
         continue;
       }
       if (data.error === "slow_down") {
         consecutiveSlowDown++;
-        pollIntervalMs = Math.min(
-          Math.round(pollIntervalMs * 1.5 + Math.min(consecutiveSlowDown * 500, 2e3)),
-          this.cfg.maxPollIntervalMs
-        );
+        const nextPollIntervalMs = Math.min(pollIntervalMs + 5e3, this.cfg.maxPollIntervalMs);
+        this.logger.warn("[GitHubAuthProvider] GitHub requested slower polling (slow_down)", {
+          pollCount,
+          consecutiveSlowDown,
+          previousPollIntervalMs: pollIntervalMs,
+          nextPollIntervalMs
+        });
+        pollIntervalMs = nextPollIntervalMs;
         continue;
       }
       if (data.error === "access_denied") {
+        this.logger.warn("[GitHubAuthProvider] User denied authorization", {
+          pollCount
+        });
         throw new Error("User denied authorization");
       }
       if (data.error === "expired_token") {
+        this.logger.warn(
+          "[GitHubAuthProvider] Device code expired before authorization completed",
+          { pollCount, elapsedMs: Date.now() - start }
+        );
         throw new Error("GitHub device code expired \u2014 restart the flow");
       }
+      this.logger.error(
+        "[GitHubAuthProvider] Unexpected device-flow error from token endpoint",
+        data.error ?? "unknown",
+        { pollCount }
+      );
       throw new Error(`GitHub device flow error: ${data.error ?? "unknown"}`);
     }
   }
@@ -1857,6 +2052,7 @@ var DRAFTS_SUBDIR = "drafts";
 var SKILL_DRAFTS_SUBDIR = "skills";
 var AGENT_DRAFTS_SUBDIR = "agents";
 var REPOS_CONFIG_FILENAME = "repos.json";
+var SERVER_PROXY_GLOBAL_FILENAME = "server-proxy.json";
 var SAFE_REPO_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 var SERVICEME_HOME_ENV = "SERVICEME_HOME";
 var activeOverrides = {};
@@ -1957,6 +2153,9 @@ function getMigrationFailuresPath() {
 function getKnownWorkspacesPath() {
   return path2.join(getServicemeHome(), KNOWN_WORKSPACES_FILENAME);
 }
+function getServerProxyGlobalPath() {
+  return path2.join(getServicemeHome(), SERVER_PROXY_GLOBAL_FILENAME);
+}
 var CREDENTIALS_CONFIG_FILENAME = "credentials.json";
 var DEVICE_JSON_FILENAME = "device.json";
 var TOOLBOX_JSON_FILENAME = "toolbox.json";
@@ -2048,10 +2247,20 @@ function isRecord(value) {
 function isNodeError(value) {
   return value instanceof Error && typeof value.code === "string";
 }
+var LOCK_PID_FILE = "pid";
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var FileLock = class {
   constructor(filePath, timeoutMs, retryMs) {
     this.acquired = false;
     this.dirPath = `${filePath}.lock`;
+    this.pidFilePath = path3.join(this.dirPath, LOCK_PID_FILE);
     this.timeoutMs = timeoutMs;
     this.retryMs = retryMs;
   }
@@ -2060,12 +2269,18 @@ var FileLock = class {
     while (true) {
       try {
         await fsp.mkdir(this.dirPath, { mode: LOCK_DIR_MODE });
+        await fsp.writeFile(this.pidFilePath, String(process.pid), "utf8").catch(() => void 0);
         this.acquired = true;
         return;
       } catch (err) {
         if (!isNodeError(err) || err.code !== "EEXIST") {
           throw err;
         }
+        const stale = await this.isStaleLock();
+        if (stale) {
+          await fsp.rm(this.dirPath, { recursive: true, force: true });
+          continue;
+        }
         if (Date.now() - start >= this.timeoutMs) {
           throw new Error(`IdentityStore lock acquisition timed out for ${this.dirPath}`);
         }
@@ -2073,6 +2288,16 @@ var FileLock = class {
       }
     }
   }
+  async isStaleLock() {
+    try {
+      const pidStr = await fsp.readFile(this.pidFilePath, "utf8");
+      const pid = Number.parseInt(pidStr.trim(), 10);
+      if (!Number.isFinite(pid) || pid <= 0) return true;
+      return !isProcessAlive(pid);
+    } catch {
+      return true;
+    }
+  }
   async release() {
     if (!this.acquired) return;
     this.acquired = false;
@@ -2498,6 +2723,14 @@ var TOOL_CHECK_TIMEOUT_MS = {
   pnpm: 15e3,
   nrm: 15e3
 };
+var POSIX_LOGIN_SHELL_FALLBACK_TOOLS = /* @__PURE__ */ new Set([
+  "npm",
+  "pnpm",
+  "nrm",
+  "node",
+  "dotnet",
+  "rtk"
+]);
 var ERROR_CODE_NOT_FOUND = 127;
 var ERROR_CODE_TIMEOUT = "ETIMEDOUT";
 var EnvironmentInspector = class {
@@ -2541,6 +2774,23 @@ var EnvironmentInspector = class {
         timeoutMs: this.getToolTimeout(toolName)
       });
       return result.stdout.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
+    } catch {
+      if (this.shouldUsePosixLoginShellFallback(toolName)) {
+        return this.getToolPathFromLoginShell(toolName);
+      }
+      return void 0;
+    }
+  }
+  async getToolPathFromLoginShell(toolName) {
+    try {
+      const result = await this.runCommandFn("/bin/bash", {
+        args: [
+          "-lc",
+          'export NVM_DIR="$HOME/.nvm"; [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"; command -v ' + toolName
+        ],
+        timeoutMs: this.getToolTimeout(toolName)
+      });
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
     } catch {
       return void 0;
     }
@@ -2565,12 +2815,33 @@ var EnvironmentInspector = class {
     }
   }
   async getToolVersion(toolName) {
-    const invocation = await this.getVersionInvocation(toolName);
-    const result = await this.runCommandFn(invocation.command, {
-      args: invocation.args,
-      timeoutMs: this.getToolTimeout(toolName)
-    });
-    return this.parseVersion(toolName, result.stdout || result.stderr);
+    try {
+      const invocation = await this.getVersionInvocation(toolName);
+      const result = await this.runCommandFn(invocation.command, {
+        args: invocation.args,
+        timeoutMs: this.getToolTimeout(toolName)
+      });
+      return this.parseVersion(toolName, result.stdout || result.stderr);
+    } catch (error) {
+      if (!this.shouldUsePosixLoginShellFallback(toolName)) {
+        throw error;
+      }
+      const fallbackResult = await this.runCommandFn("/bin/bash", {
+        args: [
+          "-lc",
+          `export NVM_DIR="$HOME/.nvm"; [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"; ${toolName} --version`
+        ],
+        timeoutMs: this.getToolTimeout(toolName)
+      });
+      const fallbackOutput = (fallbackResult.stdout || fallbackResult.stderr).trim();
+      if (!fallbackOutput) {
+        throw error;
+      }
+      return this.parseVersion(toolName, fallbackOutput);
+    }
+  }
+  shouldUsePosixLoginShellFallback(toolName) {
+    return this.platform !== "win32" && POSIX_LOGIN_SHELL_FALLBACK_TOOLS.has(toolName);
   }
   async checkNvm() {
     if (this.platform === "win32") {
@@ -2620,7 +2891,7 @@ var EnvironmentInspector = class {
       };
     }
     try {
-      const result = await this.runCommandFn("dotnet", {
+      const result = await this.runCommandFn(dotnetPath, {
         args: ["nuget", "list", "source"],
         timeoutMs: this.getToolTimeout("nuget")
       });
@@ -3151,54 +3422,85 @@ function detectIndent(text) {
   return 2;
 }
 
-// src/logger.ts
-var noopLogger = {
-  debug() {
-  },
-  info() {
-  },
-  warn() {
-  },
-  error() {
-  }
-};
-function formatArgs(args) {
-  return args.map((arg) => {
-    if (typeof arg === "string") {
-      return arg;
-    }
-    try {
-      return JSON.stringify(arg);
-    } catch {
-      return String(arg);
-    }
-  }).join(" ");
-}
-function createConsoleLogger(prefix = "serviceme") {
-  return {
-    debug(message, ...args) {
-      process.stderr.write(`[${prefix}] DEBUG ${message} ${formatArgs(args)}
-`);
-    },
-    info(message, ...args) {
-      process.stderr.write(`[${prefix}] INFO ${message} ${formatArgs(args)}
-`);
-    },
-    warn(message, ...args) {
-      process.stderr.write(`[${prefix}] WARN ${message} ${formatArgs(args)}
-`);
-    },
-    error(message, ...args) {
-      process.stderr.write(`[${prefix}] ERROR ${message} ${formatArgs(args)}
-`);
+// src/paths/serverProxyGlobal.ts
+var import_node_crypto4 = require("crypto");
+var fs6 = __toESM(require("fs/promises"));
+var import_promises2 = require("fs/promises");
+var path9 = __toESM(require("path"));
+async function readServerProxyGlobal() {
+  const filePath = getServerProxyGlobalPath();
+  try {
+    const raw = await fs6.readFile(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!isServerProxyGlobalState(parsed)) {
+      throw new Error(
+        `Invalid ${SERVER_PROXY_GLOBAL_FILENAME}: expected {enabled: boolean, lastServerUrl?: string, updatedAt: string}, got ${JSON.stringify(parsed).slice(0, 80)}`
+      );
     }
+    return parsed;
+  } catch (err) {
+    if (isENOENT(err)) return null;
+    throw err;
+  }
+}
+async function writeServerProxyGlobal(patch) {
+  const filePath = getServerProxyGlobalPath();
+  const dirPath = path9.dirname(filePath);
+  await fs6.mkdir(dirPath, { recursive: true });
+  const current = await readServerProxyGlobal() ?? {
+    enabled: false,
+    allowOverride: false,
+    lastServerUrl: void 0,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
   };
+  const next = {
+    enabled: patch.enabled !== void 0 ? patch.enabled : current.enabled,
+    allowOverride: patch.allowOverride !== void 0 ? patch.allowOverride : current.allowOverride,
+    lastServerUrl: patch.lastServerUrl === void 0 ? current.lastServerUrl : patch.lastServerUrl === null ? void 0 : patch.lastServerUrl,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const tmpPath = `${filePath}.tmp-${(0, import_node_crypto4.randomUUID)()}`;
+  const fh = await (0, import_promises2.open)(tmpPath, "w");
+  try {
+    await fh.writeFile(JSON.stringify(next, null, "	"), "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  await fs6.rename(tmpPath, filePath);
+  return next;
+}
+async function migrateLegacyServerProxyEnabled(readLegacy, clearLegacy) {
+  const legacyEnabled = readLegacy();
+  if (legacyEnabled !== true) return null;
+  const existing = await readServerProxyGlobal();
+  if (existing?.enabled === true) {
+    await clearLegacy();
+    return null;
+  }
+  const next = await writeServerProxyGlobal({ enabled: true });
+  await clearLegacy();
+  return next;
+}
+function isServerProxyGlobalState(v) {
+  if (!v || typeof v !== "object") return false;
+  const obj = v;
+  if (typeof obj.enabled !== "boolean") return false;
+  if (typeof obj.allowOverride !== "boolean") return false;
+  if (typeof obj.updatedAt !== "string") return false;
+  if (obj.lastServerUrl !== void 0 && obj.lastServerUrl !== null && typeof obj.lastServerUrl !== "string") {
+    return false;
+  }
+  return true;
+}
+function isENOENT(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
 
 // src/phase5/bootstrap.ts
-var import_node_crypto4 = require("crypto");
-var fs6 = __toESM(require("fs/promises"));
-var path9 = __toESM(require("path"));
+var import_node_crypto5 = require("crypto");
+var fs7 = __toESM(require("fs/promises"));
+var path10 = __toESM(require("path"));
 function getPhase5FileSpecs() {
   return [
     {
@@ -3229,7 +3531,7 @@ function getPhase5FileSpecs() {
       path: getMachineIdPath(),
       // Random uuid, written as a bare string. Subsequent
       // activations see the file and skip re-randomizing.
-      defaultContent: (0, import_node_crypto4.randomUUID)()
+      defaultContent: (0, import_node_crypto5.randomUUID)()
     },
     {
       path: getProfilesJsonPath(),
@@ -3243,19 +3545,19 @@ async function bootstrapPhase5Placeholders() {
   const result = { created: [], skipped: [], failed: [] };
   const home = getServicemeHome();
   try {
-    await fs6.mkdir(home, { recursive: true });
+    await fs7.mkdir(home, { recursive: true });
   } catch (err) {
     result.failed.push({ path: home, reason: err.message });
     return result;
   }
   for (const spec of getPhase5FileSpecs()) {
     try {
-      await fs6.access(spec.path);
+      await fs7.access(spec.path);
       result.skipped.push(spec.path);
     } catch {
       try {
-        await fs6.mkdir(path9.dirname(spec.path), { recursive: true });
-        await fs6.writeFile(spec.path, spec.defaultContent, "utf8");
+        await fs7.mkdir(path10.dirname(spec.path), { recursive: true });
+        await fs7.writeFile(spec.path, spec.defaultContent, "utf8");
         result.created.push(spec.path);
       } catch (writeErr) {
         result.failed.push({ path: spec.path, reason: writeErr.message });
@@ -3266,13 +3568,13 @@ async function bootstrapPhase5Placeholders() {
 }
 
 // src/project/projectTools.ts
-var fs7 = __toESM(require("fs/promises"));
-var path10 = __toESM(require("path"));
+var fs8 = __toESM(require("fs/promises"));
+var path11 = __toESM(require("path"));
 var import_devtools_protocol7 = require("@serviceme/devtools-protocol");
 
 // src/utils/fileUtils.ts
 var import_node_fs = require("fs");
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_path = require("path");
 var import_yauzl = __toESM(require("yauzl"));
 var unzipFile = (zipPath, dest) => {
@@ -3283,12 +3585,12 @@ var unzipFile = (zipPath, dest) => {
       zipfile.readEntry();
       zipfile.on("entry", (entry) => {
         if (/\/$/.test(entry.fileName)) {
-          void (0, import_promises2.mkdir)((0, import_node_path.join)(dest, entry.fileName), { recursive: true }).then(() => {
+          void (0, import_promises3.mkdir)((0, import_node_path.join)(dest, entry.fileName), { recursive: true }).then(() => {
             zipfile.readEntry();
           }).catch(reject);
         } else {
           const outputPath = (0, import_node_path.join)(dest, entry.fileName);
-          void (0, import_promises2.mkdir)((0, import_node_path.dirname)(outputPath), { recursive: true }).then(() => {
+          void (0, import_promises3.mkdir)((0, import_node_path.dirname)(outputPath), { recursive: true }).then(() => {
             zipfile.openReadStream(
               entry,
               (streamError, readStream) => {
@@ -3317,54 +3619,54 @@ var unzipFile = (zipPath, dest) => {
 };
 var tryLstat = async (targetPath) => {
   try {
-    return await (0, import_promises2.lstat)(targetPath);
+    return await (0, import_promises3.lstat)(targetPath);
   } catch {
     return null;
   }
 };
 var mergeEntry = async (sourcePath, destPath, overwrite) => {
-  const sourceStat = await (0, import_promises2.lstat)(sourcePath);
+  const sourceStat = await (0, import_promises3.lstat)(sourcePath);
   const destStat = await tryLstat(destPath);
   if (sourceStat.isDirectory()) {
     if (destStat && !destStat.isDirectory()) {
       if (!overwrite) {
-        await (0, import_promises2.rm)(sourcePath, { recursive: true, force: true });
+        await (0, import_promises3.rm)(sourcePath, { recursive: true, force: true });
         return;
       }
-      await (0, import_promises2.rm)(destPath, { recursive: true, force: true });
+      await (0, import_promises3.rm)(destPath, { recursive: true, force: true });
     }
-    await (0, import_promises2.mkdir)(destPath, { recursive: true });
-    const children = await (0, import_promises2.readdir)(sourcePath);
+    await (0, import_promises3.mkdir)(destPath, { recursive: true });
+    const children = await (0, import_promises3.readdir)(sourcePath);
     for (const child of children) {
       await mergeEntry((0, import_node_path.join)(sourcePath, child), (0, import_node_path.join)(destPath, child), overwrite);
     }
-    await (0, import_promises2.rm)(sourcePath, { recursive: true, force: true });
+    await (0, import_promises3.rm)(sourcePath, { recursive: true, force: true });
     return;
   }
   if (destStat) {
     if (!overwrite) {
-      await (0, import_promises2.rm)(sourcePath, { recursive: true, force: true });
+      await (0, import_promises3.rm)(sourcePath, { recursive: true, force: true });
       return;
     }
-    await (0, import_promises2.rm)(destPath, { recursive: true, force: true });
+    await (0, import_promises3.rm)(destPath, { recursive: true, force: true });
   }
   try {
-    await (0, import_promises2.rename)(sourcePath, destPath);
+    await (0, import_promises3.rename)(sourcePath, destPath);
   } catch {
-    await (0, import_promises2.copyFile)(sourcePath, destPath);
-    await (0, import_promises2.rm)(sourcePath, { recursive: true, force: true });
+    await (0, import_promises3.copyFile)(sourcePath, destPath);
+    await (0, import_promises3.rm)(sourcePath, { recursive: true, force: true });
   }
 };
 var moveFiles = async (sourceDir, destDir, overwrite = false) => {
-  await (0, import_promises2.mkdir)(destDir, { recursive: true });
-  const files = await (0, import_promises2.readdir)(sourceDir);
+  await (0, import_promises3.mkdir)(destDir, { recursive: true });
+  const files = await (0, import_promises3.readdir)(sourceDir);
   for (const file of files) {
     const sourceFile = (0, import_node_path.join)(sourceDir, file);
     const destFile = (0, import_node_path.join)(destDir, file);
     if (!overwrite) {
       try {
-        await (0, import_promises2.access)(destFile, import_node_fs.constants.F_OK);
-        await (0, import_promises2.rm)(sourceFile, { recursive: true, force: true });
+        await (0, import_promises3.access)(destFile, import_node_fs.constants.F_OK);
+        await (0, import_promises3.rm)(sourceFile, { recursive: true, force: true });
         continue;
       } catch {
       }
@@ -3377,10 +3679,10 @@ var moveFiles = async (sourceDir, destDir, overwrite = false) => {
 var ProjectTools = class {
   async extractTemplate(zipPath, workspacePath, tempExtractDir, input) {
     await unzipFile(zipPath, tempExtractDir);
-    let sourceDir = path10.join(tempExtractDir, input.extractedDirName);
+    let sourceDir = path11.join(tempExtractDir, input.extractedDirName);
     let actualDirName = input.extractedDirName;
     if (!await this.pathExists(sourceDir)) {
-      const entries = await fs7.readdir(tempExtractDir, { withFileTypes: true });
+      const entries = await fs8.readdir(tempExtractDir, { withFileTypes: true });
       const directories = entries.filter(
         (entry) => entry.isDirectory() && !entry.name.startsWith(".")
       );
@@ -3392,7 +3694,7 @@ var ProjectTools = class {
       );
       if (selectedDirectory) {
         actualDirName = selectedDirectory;
-        sourceDir = path10.join(tempExtractDir, actualDirName);
+        sourceDir = path11.join(tempExtractDir, actualDirName);
       } else if (directories.length === 0) {
         throw new Error(
           `No directory found after extraction. Expected directory: ${input.extractedDirName}`
@@ -3442,7 +3744,7 @@ var ProjectTools = class {
     } else {
       for (const scriptPath of scripts) {
         try {
-          await fs7.chmod(scriptPath, 493);
+          await fs8.chmod(scriptPath, 493);
           updatedCount += 1;
         } catch {
         }
@@ -3490,7 +3792,7 @@ var ProjectTools = class {
     };
   }
   async ensurePresetManifest(workspacePath, preset) {
-    const presetManifestPath = path10.join(
+    const presetManifestPath = path11.join(
       workspacePath,
       ".ms-scaffold",
       "presets",
@@ -3499,11 +3801,11 @@ var ProjectTools = class {
     if (await this.pathExists(presetManifestPath)) {
       return;
     }
-    const projectModePath = path10.join(workspacePath, ".ms-scaffold", "project-mode.json");
+    const projectModePath = path11.join(workspacePath, ".ms-scaffold", "project-mode.json");
     if (!await this.pathExists(projectModePath)) {
       return;
     }
-    const projectModeRaw = await fs7.readFile(projectModePath, "utf8");
+    const projectModeRaw = await fs8.readFile(projectModePath, "utf8");
     const projectMode = JSON.parse(projectModeRaw);
     const synthesizedPreset = {
       preset,
@@ -3515,8 +3817,8 @@ var ProjectTools = class {
       mergeManagedFiles: [],
       userOwnedPaths: []
     };
-    await fs7.mkdir(path10.dirname(presetManifestPath), { recursive: true });
-    await fs7.writeFile(
+    await fs8.mkdir(path11.dirname(presetManifestPath), { recursive: true });
+    await fs8.writeFile(
       presetManifestPath,
       `${JSON.stringify(synthesizedPreset, null, 2)}
 `,
@@ -3527,12 +3829,12 @@ var ProjectTools = class {
     const results = [];
     let entries;
     try {
-      entries = await fs7.readdir(dir, { withFileTypes: true });
+      entries = await fs8.readdir(dir, { withFileTypes: true });
     } catch {
       return results;
     }
     for (const entry of entries) {
-      const fullPath = path10.join(dir, entry.name);
+      const fullPath = path11.join(dir, entry.name);
       if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) {
         results.push(...await this.findScripts(fullPath, extensions));
       } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
@@ -3543,7 +3845,7 @@ var ProjectTools = class {
   }
   async pathExists(targetPath) {
     try {
-      await fs7.access(targetPath);
+      await fs8.access(targetPath);
       return true;
     } catch {
       return false;
@@ -3560,7 +3862,7 @@ var ProjectTools = class {
     const matches = [];
     for (const directoryName of directoryNames) {
       if (await this.directoryMatchesProjectPattern(
-        path10.join(tempExtractDir, directoryName),
+        path11.join(tempExtractDir, directoryName),
         projectFilePattern
       )) {
         matches.push(directoryName);
@@ -3572,7 +3874,7 @@ var ProjectTools = class {
     return null;
   }
   async directoryMatchesProjectPattern(directoryPath, projectFilePattern) {
-    const entries = await fs7.readdir(directoryPath);
+    const entries = await fs8.readdir(directoryPath);
     if (projectFilePattern.includes("*")) {
       const regex = new RegExp(`^${projectFilePattern.replace("*", ".*")}$`);
       return entries.some((entry) => regex.test(entry));
@@ -3585,8 +3887,8 @@ function createProjectTools() {
 }
 
 // src/repo-manager/index.ts
-var fs8 = __toESM(require("fs/promises"));
-var path11 = __toESM(require("path"));
+var fs9 = __toESM(require("fs/promises"));
+var path12 = __toESM(require("path"));
 
 // src/repos/types.ts
 function isDefaultRepo(repo) {
@@ -3668,11 +3970,11 @@ var RepoManager = class {
       const exists = await this.pathExists(localPath);
       if (exists) {
         if (await this.isValidGitRepo(localPath)) continue;
-        await fs8.rm(localPath, { recursive: true, force: true });
+        await fs9.rm(localPath, { recursive: true, force: true });
       }
       try {
         if (!this.skipClone) {
-          await fs8.mkdir(path11.dirname(localPath), { recursive: true });
+          await fs9.mkdir(path12.dirname(localPath), { recursive: true });
           await this.git.clone(repo.id, repo.url, localPath, repo.branch, true);
         }
         await this.store.updateRepo(repo.id, {
@@ -3707,10 +4009,10 @@ var RepoManager = class {
     const localPath = getRepoDir(repoId);
     const exists = await this.pathExists(localPath);
     if (exists && !await this.isValidGitRepo(localPath)) {
-      await fs8.rm(localPath, { recursive: true, force: true });
+      await fs9.rm(localPath, { recursive: true, force: true });
     }
     if (!exists || !await this.pathExists(localPath)) {
-      await fs8.mkdir(path11.dirname(localPath), { recursive: true });
+      await fs9.mkdir(path12.dirname(localPath), { recursive: true });
       if (!this.skipClone) {
         await this.git.clone(proxyId, repo.url, localPath, repo.branch, useProxy);
       }
@@ -3810,7 +4112,7 @@ var RepoManager = class {
     let cloned = false;
     if (!this.skipClone) {
       const localPath = getRepoDir(id);
-      await fs8.mkdir(path11.dirname(localPath), { recursive: true });
+      await fs9.mkdir(path12.dirname(localPath), { recursive: true });
       await this.git.clone(userProxyId, url, localPath, branch, useProxy);
       cloned = true;
     }
@@ -3835,7 +4137,7 @@ var RepoManager = class {
     await this.store.removeUserRepo(repoId);
     const localPath = getRepoDir(repoId);
     try {
-      await fs8.rm(localPath, { recursive: true, force: true });
+      await fs9.rm(localPath, { recursive: true, force: true });
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -3858,7 +4160,7 @@ var RepoManager = class {
   }
   /** Force-create the SERVICEME home directory tree (idempotent). */
   async ensureHome() {
-    await fs8.mkdir(getServicemeHome(), { recursive: true });
+    await fs9.mkdir(getServicemeHome(), { recursive: true });
   }
   /**
    * Returns `true` when `p` contains a `.git` entry — i.e. it is an
@@ -3866,11 +4168,11 @@ var RepoManager = class {
    * (e.g. from an interrupted clone) return `false`.
    */
   async isValidGitRepo(p) {
-    return this.pathExists(path11.join(p, ".git"));
+    return this.pathExists(path12.join(p, ".git"));
   }
   async pathExists(p) {
     try {
-      await fs8.stat(p);
+      await fs9.stat(p);
       return true;
     } catch {
       return false;
@@ -3995,8 +4297,8 @@ function resolveDefaultRepoId(existing, existingIds) {
 }
 
 // src/repos/loader.ts
-var fs9 = __toESM(require("fs/promises"));
-var path12 = __toESM(require("path"));
+var fs10 = __toESM(require("fs/promises"));
+var path13 = __toESM(require("path"));
 var import_zod = require("zod");
 var ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})$/;
 var repoIdSchema = import_zod.z.string().min(1).max(64).regex(SAFE_REPO_ID_PATTERN, "repo id must match /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/");
@@ -4079,7 +4381,7 @@ var ReposLoader = class {
     this.configPath = options.configPath;
     this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
     this.randomSuffix = options.randomSuffix ?? defaultRandomSuffix;
-    this.fileSystem = options.fileSystem ?? fs9;
+    this.fileSystem = options.fileSystem ?? fs10;
   }
   /** Absolute path of the file this loader reads/writes. */
   getConfigPath() {
@@ -4132,7 +4434,7 @@ var ReposLoader = class {
    */
   async save(config) {
     const validated = reposFileSchema.parse(config);
-    const dir = path12.dirname(this.configPath);
+    const dir = path13.dirname(this.configPath);
     await this.fileSystem.mkdir(dir, { recursive: true });
     const serialized = `${JSON.stringify(validated, null, 2)}
 `;
@@ -4141,7 +4443,7 @@ var ReposLoader = class {
     try {
       await this.fileSystem.rename(tempPath, this.configPath);
     } catch (error) {
-      const unlink2 = this.fileSystem.unlink ?? fs9.unlink;
+      const unlink2 = this.fileSystem.unlink ?? fs10.unlink;
       await unlink2(tempPath).catch(() => void 0);
       throw error;
     }
@@ -4201,7 +4503,7 @@ function narrowRepoConfig(repo) {
 
 // src/repos/store.ts
 var import_node_events2 = require("events");
-var fs10 = __toESM(require("fs"));
+var fs11 = __toESM(require("fs"));
 var ReposStore = class {
   constructor(options = {}) {
     this.config = null;
@@ -4210,7 +4512,7 @@ var ReposStore = class {
     this.reloadTimer = null;
     this.lastLoadResult = null;
     this.loader = options.loader ?? new ReposLoader({ configPath: "" });
-    this.fileSystem = options.fileSystem ?? { watch: fs10.watch };
+    this.fileSystem = options.fileSystem ?? { watch: fs11.watch };
     this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
     this.debounceMs = options.debounceMs ?? 50;
     this.createFsWatcher = options.createFsWatcher ?? ((p, cb) => this.defaultCreateFsWatcher(p, cb));
@@ -4492,17 +4794,17 @@ async function bootstrapDefaults(store) {
 }
 
 // src/scheduled-tasks/daemon/DaemonLogger.ts
-var fs11 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
+var fs12 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
 var CONFIG_DIR = ".serviceme";
 var LOG_FILE = "scheduler.log";
 var MAX_LOG_SIZE = 1024 * 1024;
 var DaemonLogger = class {
   constructor(workspacePath, options = {}) {
-    this.logPath = options.logPath ?? path13.join(workspacePath, CONFIG_DIR, LOG_FILE);
-    const dir = path13.dirname(this.logPath);
-    if (!fs11.existsSync(dir)) {
-      fs11.mkdirSync(dir, { recursive: true });
+    this.logPath = options.logPath ?? path14.join(workspacePath, CONFIG_DIR, LOG_FILE);
+    const dir = path14.dirname(this.logPath);
+    if (!fs12.existsSync(dir)) {
+      fs12.mkdirSync(dir, { recursive: true });
     }
   }
   getLogPath() {
@@ -4513,16 +4815,16 @@ var DaemonLogger = class {
     const line = `[${ts}] [${level.toUpperCase()}] ${message}
 `;
     this.rotateIfNeeded();
-    fs11.appendFileSync(this.logPath, line, "utf-8");
+    fs12.appendFileSync(this.logPath, line, "utf-8");
   }
   rotateIfNeeded() {
     try {
-      const stats = fs11.statSync(this.logPath);
+      const stats = fs12.statSync(this.logPath);
       if (stats.size > MAX_LOG_SIZE) {
-        const content = fs11.readFileSync(this.logPath, "utf-8");
+        const content = fs12.readFileSync(this.logPath, "utf-8");
         const halfIdx = content.indexOf("\n", Math.floor(content.length / 2));
         if (halfIdx > 0) {
-          fs11.writeFileSync(this.logPath, content.slice(halfIdx + 1), "utf-8");
+          fs12.writeFileSync(this.logPath, content.slice(halfIdx + 1), "utf-8");
         }
       }
     } catch {
@@ -4531,39 +4833,39 @@ var DaemonLogger = class {
 };
 
 // src/scheduled-tasks/daemon/PidManager.ts
-var fs12 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var fs13 = __toESM(require("fs"));
+var path15 = __toESM(require("path"));
 var CONFIG_DIR2 = ".serviceme";
 var PID_FILE = "scheduler.pid";
 var PidManager = class {
   constructor(workspacePath, options = {}) {
-    this.pidPath = options.pidPath ?? path14.join(workspacePath, CONFIG_DIR2, PID_FILE);
+    this.pidPath = options.pidPath ?? path15.join(workspacePath, CONFIG_DIR2, PID_FILE);
   }
   getPidPath() {
     return this.pidPath;
   }
   writePid(pid) {
-    const dir = path14.dirname(this.pidPath);
-    if (!fs12.existsSync(dir)) {
-      fs12.mkdirSync(dir, { recursive: true });
+    const dir = path15.dirname(this.pidPath);
+    if (!fs13.existsSync(dir)) {
+      fs13.mkdirSync(dir, { recursive: true });
     }
-    fs12.writeFileSync(this.pidPath, String(pid), "utf-8");
+    fs13.writeFileSync(this.pidPath, String(pid), "utf-8");
   }
   readPid() {
     let stat5;
     try {
-      stat5 = fs12.statSync(this.pidPath);
+      stat5 = fs13.statSync(this.pidPath);
     } catch {
       return null;
     }
     if (!stat5.isFile()) return null;
-    const raw = fs12.readFileSync(this.pidPath, "utf-8").trim();
+    const raw = fs13.readFileSync(this.pidPath, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isNaN(pid) ? null : pid;
   }
   removePid() {
-    if (fs12.existsSync(this.pidPath)) {
-      fs12.unlinkSync(this.pidPath);
+    if (fs13.existsSync(this.pidPath)) {
+      fs13.unlinkSync(this.pidPath);
     }
   }
   isProcessRunning(pid) {
@@ -4584,13 +4886,13 @@ var PidManager = class {
 };
 
 // src/scheduled-tasks/daemon/SchedulerDaemon.ts
-var fs17 = __toESM(require("fs"));
+var fs18 = __toESM(require("fs"));
 var os5 = __toESM(require("os"));
-var path18 = __toESM(require("path"));
+var path19 = __toESM(require("path"));
 
 // src/scheduled-tasks/executors/GithubCopilotCliExecutor.ts
 var import_node_child_process3 = require("child_process");
-var fs13 = __toESM(require("fs"));
+var fs14 = __toESM(require("fs"));
 
 // src/scheduled-tasks/executors/timeout.ts
 function resolveConfiguredTimeoutMs(timeoutSeconds, defaultTimeoutMs) {
@@ -4625,7 +4927,7 @@ function redactArgs(args) {
 function writeDiagnostic(message) {
   const logPath = process.env.SERVICEME_SCHEDULER_LOG_PATH;
   if (logPath) {
-    fs13.appendFileSync(logPath, message);
+    fs14.appendFileSync(logPath, message);
     return;
   }
   process.stderr.write(message);
@@ -4831,15 +5133,15 @@ ${body}`.trim()
 
 // src/scheduled-tasks/executors/ShellExecutor.ts
 var import_node_child_process4 = require("child_process");
-var fs14 = __toESM(require("fs"));
-var path15 = __toESM(require("path"));
+var fs15 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
 var MAX_OUTPUT_BYTES2 = 1024 * 1024;
 var DEFAULT_TIMEOUT_MS4 = 6e4;
 var POSIX_SHELL_CANDIDATES = ["bash.exe", "sh.exe"];
 function resolveShellExecution(script, options = {}) {
   const platform3 = options.platform ?? process.platform;
   const env = options.env ?? process.env;
-  const fileExists = options.fileExists ?? fs14.existsSync;
+  const fileExists = options.fileExists ?? fs15.existsSync;
   if (platform3 === "win32") {
     const posixShell = usesPosixShellSyntax(script) ? findWindowsPosixShell(env, fileExists) : null;
     if (posixShell) {
@@ -4884,10 +5186,10 @@ function findWindowsPosixShell(env, fileExists) {
     if (fileExists(candidate)) return candidate;
   }
   const pathValue = env.Path ?? env.PATH ?? "";
-  for (const dir of pathValue.split(path15.win32.delimiter)) {
+  for (const dir of pathValue.split(path16.win32.delimiter)) {
     if (!dir) continue;
     for (const executable of POSIX_SHELL_CANDIDATES) {
-      const candidate = path15.win32.join(dir, executable);
+      const candidate = path16.win32.join(dir, executable);
       if (fileExists(candidate) && !isWindowsWslLauncher(candidate)) {
         return candidate;
       }
@@ -4896,13 +5198,13 @@ function findWindowsPosixShell(env, fileExists) {
   return null;
 }
 function isWindowsWslLauncher(candidate) {
-  const normalized = path15.win32.normalize(candidate).toLowerCase();
+  const normalized = path16.win32.normalize(candidate).toLowerCase();
   return normalized.endsWith("\\windows\\system32\\bash.exe") || normalized.endsWith("\\windows\\syswow64\\bash.exe");
 }
 function writeDiagnostic2(message) {
   const logPath = process.env.SERVICEME_SCHEDULER_LOG_PATH;
   if (logPath) {
-    fs14.appendFileSync(logPath, message);
+    fs15.appendFileSync(logPath, message);
     return;
   }
   process.stderr.write(message);
@@ -5044,10 +5346,10 @@ function getExecutor(taskType) {
 }
 
 // src/scheduled-tasks/TaskConfigManager.ts
-var import_node_crypto5 = require("crypto");
-var fs15 = __toESM(require("fs"));
+var import_node_crypto6 = require("crypto");
+var fs16 = __toESM(require("fs"));
 var os4 = __toESM(require("os"));
-var path16 = __toESM(require("path"));
+var path17 = __toESM(require("path"));
 var import_devtools_protocol8 = require("@serviceme/devtools-protocol");
 function emptyConfig() {
   return { version: 2, tasks: [] };
@@ -5071,7 +5373,7 @@ function v1ContainerShape(value) {
 }
 function defaultWorkspaceContext() {
   const home = os4.homedir() || "/";
-  return { path: home, name: path16.basename(home) || home };
+  return { path: home, name: path17.basename(home) || home };
 }
 function requireNonEmptyString(payload, field, taskType) {
   if (!isRecord2(payload) || typeof payload[field] !== "string" || !payload[field].trim()) {
@@ -5106,10 +5408,10 @@ var TaskConfigManager = class {
     return this.configPath;
   }
   readConfig() {
-    if (!fs15.existsSync(this.configPath)) {
+    if (!fs16.existsSync(this.configPath)) {
       return emptyConfig();
     }
-    const raw = fs15.readFileSync(this.configPath, "utf-8");
+    const raw = fs16.readFileSync(this.configPath, "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -5162,7 +5464,7 @@ var TaskConfigManager = class {
       const target = this.migrationFailuresPath ?? getMigrationFailuresPath();
       const prior = (() => {
         try {
-          return JSON.parse(fs15.readFileSync(target, "utf-8"));
+          return JSON.parse(fs16.readFileSync(target, "utf-8"));
         } catch {
           return [];
         }
@@ -5175,8 +5477,8 @@ var TaskConfigManager = class {
         snippet: raw.slice(0, 500),
         recordedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
-      fs15.mkdirSync(path16.dirname(target), { recursive: true });
-      fs15.writeFileSync(target, JSON.stringify(failures, null, "	"), "utf-8");
+      fs16.mkdirSync(path17.dirname(target), { recursive: true });
+      fs16.writeFileSync(target, JSON.stringify(failures, null, "	"), "utf-8");
     } catch (writeError) {
       this.warn(
         `TaskConfigManager: also failed to write migration-failures log: ${String(writeError)}`
@@ -5184,13 +5486,13 @@ var TaskConfigManager = class {
     }
   }
   writeConfig(config) {
-    const dir = path16.dirname(this.configPath);
-    if (!fs15.existsSync(dir)) {
-      fs15.mkdirSync(dir, { recursive: true });
+    const dir = path17.dirname(this.configPath);
+    if (!fs16.existsSync(dir)) {
+      fs16.mkdirSync(dir, { recursive: true });
     }
     const tmp = `${this.configPath}.tmp`;
-    fs15.writeFileSync(tmp, JSON.stringify(config, null, "	"), "utf-8");
-    fs15.renameSync(tmp, this.configPath);
+    fs16.writeFileSync(tmp, JSON.stringify(config, null, "	"), "utf-8");
+    fs16.renameSync(tmp, this.configPath);
   }
   listTasks() {
     return this.readConfig().tasks;
@@ -5212,7 +5514,7 @@ var TaskConfigManager = class {
     const config = this.readConfig();
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const task = {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       name: input.name,
       description: input.description,
       enabled: input.enabled ?? true,
@@ -5467,9 +5769,9 @@ var TaskExecutionEngine = class {
 };
 
 // src/scheduled-tasks/TaskLogManager.ts
-var import_node_crypto6 = require("crypto");
-var fs16 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
+var import_node_crypto7 = require("crypto");
+var fs17 = __toESM(require("fs"));
+var path18 = __toESM(require("path"));
 var MAX_LOGS = 200;
 function emptyLogFile() {
   return { logs: [] };
@@ -5498,11 +5800,11 @@ var TaskLogManager = class {
     return this.logPath;
   }
   readLogFile() {
-    if (!fs16.existsSync(this.logPath)) {
+    if (!fs17.existsSync(this.logPath)) {
       return emptyLogFile();
     }
     try {
-      const raw = fs16.readFileSync(this.logPath, "utf-8");
+      const raw = fs17.readFileSync(this.logPath, "utf-8");
       const parsed = JSON.parse(raw);
       const file = validateAndRepairLogFile(parsed);
       if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.logs) || parsed.logs.length !== file.logs.length) {
@@ -5518,26 +5820,26 @@ var TaskLogManager = class {
   }
   backupCorruptedFile() {
     try {
-      if (fs16.existsSync(this.logPath)) {
+      if (fs17.existsSync(this.logPath)) {
         const backupPath = `${this.logPath}.corrupted.${Date.now()}`;
-        fs16.copyFileSync(this.logPath, backupPath);
+        fs17.copyFileSync(this.logPath, backupPath);
       }
     } catch {
     }
   }
   writeLogFile(file) {
-    const dir = path17.dirname(this.logPath);
-    if (!fs16.existsSync(dir)) {
-      fs16.mkdirSync(dir, { recursive: true });
+    const dir = path18.dirname(this.logPath);
+    if (!fs17.existsSync(dir)) {
+      fs17.mkdirSync(dir, { recursive: true });
     }
     const tmp = `${this.logPath}.tmp`;
-    fs16.writeFileSync(tmp, JSON.stringify(file, null, "	"), "utf-8");
-    fs16.renameSync(tmp, this.logPath);
+    fs17.writeFileSync(tmp, JSON.stringify(file, null, "	"), "utf-8");
+    fs17.renameSync(tmp, this.logPath);
   }
   appendLog(input) {
     const file = this.readLogFile();
     const log = {
-      id: (0, import_node_crypto6.randomUUID)(),
+      id: (0, import_node_crypto7.randomUUID)(),
       taskId: input.taskId,
       taskName: input.taskName,
       startedAt: input.startedAt,
@@ -5592,12 +5894,12 @@ var SchedulerDaemon = class {
     this.lastRun = /* @__PURE__ */ new Map();
     this.taskRunning = /* @__PURE__ */ new Set();
     this.workspacePath = workspacePath;
-    const configDir = path18.join(workspacePath, ".serviceme");
+    const configDir = path19.join(workspacePath, ".serviceme");
     this.configManager = new TaskConfigManager({
-      configPath: path18.join(configDir, "scheduled-tasks.json")
+      configPath: path19.join(configDir, "scheduled-tasks.json")
     });
     this.logManager = new TaskLogManager({
-      logPath: path18.join(configDir, "scheduled-tasks-log.json")
+      logPath: path19.join(configDir, "scheduled-tasks-log.json")
     });
     this.pidManager = new PidManager(workspacePath);
     this.logger = new DaemonLogger(workspacePath);
@@ -5649,8 +5951,8 @@ var SchedulerDaemon = class {
     const configPath = this.configManager.getConfigPath();
     const dir = configPath.substring(0, configPath.lastIndexOf("/"));
     try {
-      if (fs17.existsSync(dir)) {
-        this.watcher = fs17.watch(dir, (_eventType, filename) => {
+      if (fs18.existsSync(dir)) {
+        this.watcher = fs18.watch(dir, (_eventType, filename) => {
           if (filename === "scheduled-tasks.json") {
             this.logger.log("info", "Config file changed, reconciling...");
           }
@@ -5803,9 +6105,9 @@ function matchCronField(field, value) {
 }
 
 // src/scheduled-tasks/daemon/SchedulerDaemonV2.ts
-var fs18 = __toESM(require("fs"));
+var fs19 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
-var path19 = __toESM(require("path"));
+var path20 = __toESM(require("path"));
 var TICK_INTERVAL2 = 1e3;
 var MIN_SCHEDULE_INTERVAL2 = 1e3;
 var SCHEDULER_LOG_FILENAME2 = "scheduler.log";
@@ -5825,7 +6127,7 @@ var SchedulerDaemonV2 = class {
     this.logManager = options.logManager ?? new TaskLogManager();
     this.pidManager = options.pidManager ?? new PidManager("", { pidPath: getSchedulerPidPath() });
     this.logger = options.logger ?? new DaemonLogger(os6.homedir(), {
-      logPath: path19.join(path19.dirname(this.pidManager.getPidPath()), SCHEDULER_LOG_FILENAME2)
+      logPath: path20.join(path20.dirname(this.pidManager.getPidPath()), SCHEDULER_LOG_FILENAME2)
     });
     this.getExecutor = options.getExecutor ?? getExecutor;
     this.tryAcquireLock = options.tryAcquireLock ?? (() => true);
@@ -5883,7 +6185,7 @@ var SchedulerDaemonV2 = class {
     const now = Date.now();
     for (const task of config.tasks) {
       if (!task.enabled) continue;
-      if (!fs18.existsSync(task.workspace.path)) {
+      if (!fs19.existsSync(task.workspace.path)) {
         this.disableTaskForMissingWorkspace(task, config);
         continue;
       }
@@ -6040,21 +6342,21 @@ function matchCronField2(field, value) {
 }
 
 // src/scheduled-tasks/migration/MigrateToGlobal.ts
-var fs19 = __toESM(require("fs"));
-var path20 = __toESM(require("path"));
+var fs20 = __toESM(require("fs"));
+var path21 = __toESM(require("path"));
 var import_devtools_protocol9 = require("@serviceme/devtools-protocol");
 var WORKSPACE_DIR = ".serviceme";
 var V1_FILENAME = "scheduled-tasks.json";
 function defaultProbe(workspacePath) {
   return {
     path: workspacePath,
-    name: path20.basename(workspacePath) || workspacePath
+    name: path21.basename(workspacePath) || workspacePath
   };
 }
 function readV1Config(v1Path) {
   let raw;
   try {
-    raw = fs19.readFileSync(v1Path, "utf-8");
+    raw = fs20.readFileSync(v1Path, "utf-8");
   } catch (err) {
     return {
       ok: false,
@@ -6077,27 +6379,27 @@ function readV1Config(v1Path) {
 }
 function safeDelete(filePath) {
   try {
-    fs19.unlinkSync(filePath);
+    fs20.unlinkSync(filePath);
   } catch {
   }
 }
 function ensureDir(filePath) {
-  const dir = path20.dirname(filePath);
-  if (!fs19.existsSync(dir)) {
-    fs19.mkdirSync(dir, { recursive: true });
+  const dir = path21.dirname(filePath);
+  if (!fs20.existsSync(dir)) {
+    fs20.mkdirSync(dir, { recursive: true });
   }
 }
 function readJsonFile(filePath) {
-  if (!fs19.existsSync(filePath)) return null;
+  if (!fs20.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs19.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs20.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeJsonFile(filePath, data) {
   ensureDir(filePath);
-  fs19.writeFileSync(filePath, JSON.stringify(data, null, "	"), "utf-8");
+  fs20.writeFileSync(filePath, JSON.stringify(data, null, "	"), "utf-8");
 }
 function disambiguateName(task, existingNames, workspaceName) {
   if (!existingNames.has(task.name)) {
@@ -6127,8 +6429,8 @@ async function migrateToGlobal(options) {
   const conflicts = [];
   const issues = [];
   for (const workspacePath of options.workspacePaths) {
-    const v1Path = path20.join(workspacePath, WORKSPACE_DIR, V1_FILENAME);
-    if (!fs19.existsSync(v1Path)) continue;
+    const v1Path = path21.join(workspacePath, WORKSPACE_DIR, V1_FILENAME);
+    if (!fs20.existsSync(v1Path)) continue;
     const v1 = readV1Config(v1Path);
     if (!v1.ok) {
       failures.push({
@@ -6170,8 +6472,8 @@ async function migrateToGlobal(options) {
   if (migrated > 0) {
     ensureDir(globalConfigPath);
     const tmp = `${globalConfigPath}.tmp`;
-    fs19.writeFileSync(tmp, JSON.stringify(baseConfig, null, "	"), "utf-8");
-    fs19.renameSync(tmp, globalConfigPath);
+    fs20.writeFileSync(tmp, JSON.stringify(baseConfig, null, "	"), "utf-8");
+    fs20.renameSync(tmp, globalConfigPath);
   }
   if (failures.length > priorFailures.length) {
     writeJsonFile(migrationFailuresPath, failures);
@@ -6188,8 +6490,8 @@ async function migrateToGlobal(options) {
 
 // src/scheduled-tasks/workspace-probe/WorkspaceProbe.ts
 var import_node_child_process5 = require("child_process");
-var fs20 = __toESM(require("fs"));
-var path21 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var path22 = __toESM(require("path"));
 var DEFAULT_TIMEOUT_MS5 = 2e3;
 var GitTimeoutError = class extends Error {
   constructor() {
@@ -6252,8 +6554,8 @@ var WorkspaceProbe = class {
     }
   }
   async probe(workspacePath) {
-    const name = path21.basename(workspacePath) || workspacePath;
-    if (!workspacePath || !fs20.existsSync(workspacePath)) {
+    const name = path22.basename(workspacePath) || workspacePath;
+    if (!workspacePath || !fs21.existsSync(workspacePath)) {
       return {
         workspace: { path: workspacePath, name },
         error: "path-not-found"
@@ -6405,8 +6707,8 @@ var SkillReconciler = class {
 };
 
 // src/skills/SkillStore.ts
-var fs21 = __toESM(require("fs/promises"));
-var path22 = __toESM(require("path"));
+var fs22 = __toESM(require("fs/promises"));
+var path23 = __toESM(require("path"));
 var USER_SKILL_MARKER_FILE = ".serviceme-skill.json";
 var LEGACY_USER_SKILL_MARKER_FILE = ".ms-devtools-skill.json";
 var WORKSPACE_SKILLS_ROOT_RELATIVE = ".github/skills";
@@ -6422,7 +6724,7 @@ var SkillStore = class {
   constructor(options) {
     this.workspacePath = options.workspacePath;
     this.userSkillsRoot = options.userSkillsRoot;
-    this.fileSystem = options.fileSystem ?? fs21;
+    this.fileSystem = options.fileSystem ?? fs22;
   }
   normalizeRemoteSkillId(remoteId) {
     if (remoteId.startsWith("official/")) {
@@ -6441,10 +6743,10 @@ var SkillStore = class {
     return WORKSPACE_SKILLS_MARKER_RELATIVE;
   }
   getUserSkillPath(skillId) {
-    return path22.join(this.userSkillsRoot, skillId);
+    return path23.join(this.userSkillsRoot, skillId);
   }
   async listWorkspaceSkillIds() {
-    const skillsRootPath = path22.join(this.workspacePath, WORKSPACE_SKILLS_ROOT_RELATIVE);
+    const skillsRootPath = path23.join(this.workspacePath, WORKSPACE_SKILLS_ROOT_RELATIVE);
     try {
       const entries = await this.fileSystem.readdir(skillsRootPath, {
         withFileTypes: true
@@ -6468,7 +6770,7 @@ var SkillStore = class {
     const targetDir = this.getUserSkillPath(skillId);
     await this.fileSystem.mkdir(targetDir, { recursive: true });
     await this.fileSystem.writeFile(
-      path22.join(targetDir, USER_SKILL_MARKER_FILE),
+      path23.join(targetDir, USER_SKILL_MARKER_FILE),
       JSON.stringify({ skillId, installedBy: "serviceme" }, null, 2),
       "utf-8"
     );
@@ -6477,7 +6779,7 @@ var SkillStore = class {
     await this.migrateLegacyUserSkillMarker(skillId);
     try {
       const marker = await this.fileSystem.readFile(
-        path22.join(this.getUserSkillPath(skillId), USER_SKILL_MARKER_FILE),
+        path23.join(this.getUserSkillPath(skillId), USER_SKILL_MARKER_FILE),
         "utf-8"
       );
       const parsed = JSON.parse(marker);
@@ -6494,8 +6796,8 @@ var SkillStore = class {
    */
   async migrateLegacyUserSkillMarker(skillId) {
     const targetDir = this.getUserSkillPath(skillId);
-    const newPath = path22.join(targetDir, USER_SKILL_MARKER_FILE);
-    const legacyPath = path22.join(targetDir, LEGACY_USER_SKILL_MARKER_FILE);
+    const newPath = path23.join(targetDir, USER_SKILL_MARKER_FILE);
+    const legacyPath = path23.join(targetDir, LEGACY_USER_SKILL_MARKER_FILE);
     try {
       await this.fileSystem.readFile(newPath, "utf-8");
       return;
@@ -6508,12 +6810,12 @@ var SkillStore = class {
     }
   }
   async writeSkillFiles(skillId, scope, files) {
-    const root = scope === "workspace" ? path22.join(this.workspacePath, WORKSPACE_SKILLS_ROOT_RELATIVE) : this.userSkillsRoot;
-    const targetDir = path22.join(root, skillId);
+    const root = scope === "workspace" ? path23.join(this.workspacePath, WORKSPACE_SKILLS_ROOT_RELATIVE) : this.userSkillsRoot;
+    const targetDir = path23.join(root, skillId);
     await this.fileSystem.mkdir(targetDir, { recursive: true });
     for (const file of files) {
-      const filePath = path22.join(targetDir, file.path);
-      await this.fileSystem.mkdir(path22.dirname(filePath), { recursive: true });
+      const filePath = path23.join(targetDir, file.path);
+      await this.fileSystem.mkdir(path23.dirname(filePath), { recursive: true });
       await this.fileSystem.writeFile(filePath, file.content, "utf-8");
       if (file.executable) {
         try {
@@ -6526,8 +6828,8 @@ var SkillStore = class {
 };
 
 // src/submit/index.ts
-var fs22 = __toESM(require("fs/promises"));
-var path23 = __toESM(require("path"));
+var fs23 = __toESM(require("fs/promises"));
+var path24 = __toESM(require("path"));
 
 // src/submit/types.ts
 var SubmitError = class extends Error {
@@ -6577,14 +6879,14 @@ var SubmitClient = class {
       throw new SubmitError(v.reason ?? "unknown", v.detail ?? "validation denied");
     }
     const localRepoPath = getRepoDir(repoId);
-    const targetDir = path23.join(localRepoPath, "skills", skillName);
-    await fs22.mkdir(targetDir, { recursive: true });
+    const targetDir = path24.join(localRepoPath, "skills", skillName);
+    await fs23.mkdir(targetDir, { recursive: true });
     for (const f of files) {
-      const full = path23.join(targetDir, f.path);
-      await fs22.mkdir(path23.dirname(full), { recursive: true });
+      const full = path24.join(targetDir, f.path);
+      await fs23.mkdir(path24.dirname(full), { recursive: true });
       const tmp = `${full}.${process.pid}.${Date.now()}.tmp`;
-      await fs22.writeFile(tmp, f.content, "utf8");
-      await fs22.rename(tmp, full);
+      await fs23.writeFile(tmp, f.content, "utf8");
+      await fs23.rename(tmp, full);
     }
     const commitMessage = `feat(skills): add ${skillName}`;
     const { commitSha } = await this.git.commit(localRepoPath, commitMessage);
@@ -6653,8 +6955,8 @@ function touchLastUsedAt(tools, id, when = /* @__PURE__ */ new Date()) {
 
 // src/toolbox/ToolboxStore.ts
 var fsp2 = __toESM(require("fs/promises"));
-var path24 = __toESM(require("path"));
-var import_promises3 = require("timers/promises");
+var path25 = __toESM(require("path"));
+var import_promises4 = require("timers/promises");
 
 // src/toolbox/types.ts
 var TOOLBOX_JSON_SCHEMA_VERSION = 1;
@@ -6688,11 +6990,11 @@ var LOCK_DIR_MODE2 = 448;
 var DEFAULT_LOCK_TIMEOUT_MS2 = 5e3;
 var DEFAULT_LOCK_RETRY_MS2 = 25;
 var TMP_SUFFIX2 = ".tmp";
-var WORKSPACE_TOOLBOX_RELATIVE_PATH = path24.join(".github", ".serviceme-toolbox.json");
+var WORKSPACE_TOOLBOX_RELATIVE_PATH = path25.join(".github", ".serviceme-toolbox.json");
 var LEGACY_WORKSPACE_TOOLBOX_FILENAME = ".ms-devtools-toolbox.json";
 async function migrateLegacyWorkspaceToolboxFile(filePath) {
   if (!filePath) return;
-  const legacyPath = path24.join(path24.dirname(filePath), LEGACY_WORKSPACE_TOOLBOX_FILENAME);
+  const legacyPath = path25.join(path25.dirname(filePath), LEGACY_WORKSPACE_TOOLBOX_FILENAME);
   if (legacyPath === filePath) return;
   try {
     await fsp2.access(filePath);
@@ -6737,7 +7039,7 @@ var FsToolboxFileBackend = class {
     }
   }
   async write(filePath, payload) {
-    await fsp2.mkdir(path24.dirname(filePath), { recursive: true });
+    await fsp2.mkdir(path25.dirname(filePath), { recursive: true });
     const tmpPath = `${filePath}${TMP_SUFFIX2}`;
     const bytes = Buffer.from(JSON.stringify(payload, null, "	"), "utf8");
     await fsp2.rm(tmpPath, { force: true });
@@ -6769,10 +7071,19 @@ function coercePersistedToolbox(parsed) {
 function isNodeError2(value) {
   return value instanceof Error && typeof value.code === "string";
 }
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var ToolboxFileLock = class {
   constructor(filePath, timeoutMs, retryMs) {
     this.acquired = false;
     this.dirPath = `${filePath}.lock`;
+    this.pidFilePath = path25.join(this.dirPath, "pid");
     this.timeoutMs = timeoutMs;
     this.retryMs = retryMs;
   }
@@ -6781,17 +7092,33 @@ var ToolboxFileLock = class {
     while (true) {
       try {
         await fsp2.mkdir(this.dirPath, { mode: LOCK_DIR_MODE2 });
+        await fsp2.writeFile(this.pidFilePath, String(process.pid), "utf8").catch(() => void 0);
         this.acquired = true;
         return;
       } catch (err) {
         if (!isNodeError2(err) || err.code !== "EEXIST") throw err;
+        const stale = await this.isStaleLock();
+        if (stale) {
+          await fsp2.rm(this.dirPath, { recursive: true, force: true });
+          continue;
+        }
         if (Date.now() - start >= this.timeoutMs) {
           throw new Error(`ToolboxStore lock acquisition timed out for ${this.dirPath}`);
         }
-        await (0, import_promises3.setTimeout)(this.retryMs);
+        await (0, import_promises4.setTimeout)(this.retryMs);
       }
     }
   }
+  async isStaleLock() {
+    try {
+      const pidStr = await fsp2.readFile(this.pidFilePath, "utf8");
+      const pid = Number.parseInt(pidStr.trim(), 10);
+      if (!Number.isFinite(pid) || pid <= 0) return true;
+      return !isProcessAlive2(pid);
+    } catch {
+      return true;
+    }
+  }
   async release() {
     if (!this.acquired) return;
     this.acquired = false;
@@ -6800,7 +7127,7 @@ var ToolboxFileLock = class {
 };
 function defaultWorkspacePath() {
   if (process.env.SERVICEME_NO_WORKSPACE_TOOLBOX === "1") return null;
-  return path24.join(process.cwd(), WORKSPACE_TOOLBOX_RELATIVE_PATH);
+  return path25.join(process.cwd(), WORKSPACE_TOOLBOX_RELATIVE_PATH);
 }
 var ToolboxStore = class {
   constructor(opts = {}) {
@@ -7108,6 +7435,7 @@ var ToolboxCore = class {
   SCHEDULER_LOCK_FILENAME,
   SCHEDULER_LOG_FILENAME,
   SCHEDULER_PID_FILENAME,
+  SERVER_PROXY_GLOBAL_FILENAME,
   SERVICEME_DIR_NAME,
   SERVICEME_HOME_ENV,
   SKILL_DRAFTS_SUBDIR,
@@ -7175,6 +7503,7 @@ var ToolboxCore = class {
   getSchedulerLockPath,
   getSchedulerLogPath,
   getSchedulerPidPath,
+  getServerProxyGlobalPath,
   getServicemeHome,
   getSkillDraftsDir,
   getToolboxJsonPath,
@@ -7185,6 +7514,7 @@ var ToolboxCore = class {
   isUserRepo,
   matchesCron,
   mergeWithDefaults,
+  migrateLegacyServerProxyEnabled,
   migrateToGlobal,
   moveFiles,
   narrowRepoConfig,
@@ -7192,6 +7522,7 @@ var ToolboxCore = class {
   parseAgentToolPermissions,
   parseIntervalMs,
   randomInstallationId,
+  readServerProxyGlobal,
   reindexOrder,
   reposFileSchema,
   resetUserHomeOverrides,
@@ -7206,6 +7537,7 @@ var ToolboxCore = class {
   unzipFile,
   userRepoConfigSchema,
   validateReposFile,
-  validateTaskPayload
+  validateTaskPayload,
+  writeServerProxyGlobal
 });
 //# sourceMappingURL=index.js.map