@skaile/workspaces 6.0.0 → 6.2.0

package/dist/{chunk-VJRTDKXS.js → chunk-SJNZ4WPA.js}

@@ -1,39 +1,39 @@
-import { WorkspacePlugin } from './chunk-VBI7HGHB.js';
-import { buildWorkspaceToolDefs } from './chunk-OULSJRXV.js';
-import { findAiAssetsRoot } from './chunk-6Z5KTFJT.js';
-import { startModelEndpoint } from './chunk-E3GPGTW3.js';
-import { WebSocketServerTransport } from './chunk-AF432MS3.js';
+import { WorkspacePlugin } from './chunk-GF5JXQIZ.js';
+import { buildWorkspaceToolDefs } from './chunk-OCQNUV4T.js';
+import { findAiAssetsRoot } from './chunk-TSTRH4SM.js';
+import { startModelEndpoint } from './chunk-3HACK2Z7.js';
+import { WebSocketServerTransport } from './chunk-KXJMQTOU.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
-import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-ZFUZ5AKM.js';
-import { resolveFlowPath } from './chunk-T2BDID2J.js';
-import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-H6UVIKQ2.js';
-import { ConnectFailureCarryOver, registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-SNEE6UGY.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-LN6QB7XI.js';
-import { EventNormalizer } from './chunk-4XWLB7JB.js';
-import { approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-4DWBSTYA.js';
+import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-I7LC5TDY.js';
+import { resolveFlowPath } from './chunk-5JPW27BI.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-PNUM7GUY.js';
+import { ConnectFailureCarryOver, registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-K3R2UKG7.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-QIHL3YPL.js';
+import { EventNormalizer } from './chunk-RQMIZONH.js';
+import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-QXKUFROW.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-BIRW3HOG.js';
-import { classifyClaudeSdkError } from './chunk-XFIEVEU7.js';
+import { classifyClaudeSdkError } from './chunk-6OHZUUR7.js';
 import { agentExecRequested } from './chunk-7DN6JKP2.js';
-import { toAgentEffort, toMergedRegistry } from './chunk-UVVVR4XO.js';
-import { unresolvedProviderCredentials, harnessCapabilities, createHarness, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-F2GOZMRA.js';
-import { loadFlow } from './chunk-SZXGRHQQ.js';
+import { toAgentEffort, toMergedRegistry } from './chunk-M4OG2YN4.js';
+import { unresolvedProviderCredentials, harnessCapabilities, createHarness, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-X37JUNEW.js';
+import { loadFlow } from './chunk-PJJSBZZP.js';
 import { renderStimulusPrompt } from './chunk-WD3L5QSU.js';
 import { TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-JCPD4QRM.js';
-import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-UL22SDGR.js';
-import { createDefaultKindRegistry } from './chunk-QOM5Z62G.js';
-import { parseFlowDefinition } from './chunk-X3RMRJNR.js';
-import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-E572OHGY.js';
-import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-L4YKW5AY.js';
-import { resolveRuntimeAssets } from './chunk-OTIB4D2K.js';
-import { DEFAULT_HARNESS_ID, resolveHarnessPaths } from './chunk-Z7ZEZZB6.js';
-import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-OHNKYHRR.js';
+import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-6CYKTHNT.js';
+import { createDefaultKindRegistry } from './chunk-MAZ3UXJK.js';
+import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
+import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-76FLBODK.js';
+import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-BRK5QZKI.js';
+import { resolveRuntimeAssets } from './chunk-QPWR3YMY.js';
+import { DEFAULT_HARNESS_ID, resolveHarnessPaths } from './chunk-C5HFK34M.js';
+import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-KJSC2ZD6.js';
 import { globalSkaileDir } from './chunk-L5VSIPQD.js';
 import { harnessNameForHarnessId, SUPPORTED_HARNESSES, HARNESS_TARGETS } from './chunk-VTETQCR6.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-GOCWM7FN.js';
-import { parseAssetRef } from './chunk-WDXZA7QW.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-JMIKGAUA.js';
+import { parseAssetRef } from './chunk-IZQOO6MN.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-DKXNKFKP.js';
-import { pickRegistryEntries, registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-LSI2IVFT.js';
+import { pickRegistryEntries, registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-RXGPFAMN.js';
 import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError, redactCredentials } from './chunk-BOFL7GIF.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import { createInterface } from 'readline';
@@ -44,7 +44,7 @@ import { markedTerminal } from 'marked-terminal';
 import { createHash, randomUUID, randomBytes, timingSafeEqual } from 'crypto';
 import * as z5 from 'zod';
 import { z } from 'zod';
-import { constants, unlinkSync, readFileSync, readdirSync, statSync, existsSync, lstatSync, realpathSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, rmSync } from 'fs';
+import { constants, unlinkSync, readFileSync, readdirSync, statSync, existsSync, lstatSync, realpathSync, mkdirSync, writeFileSync, renameSync, rmSync, watch, chmodSync, accessSync } from 'fs';
 import fs8, { readFile, readdir, lstat, realpath, rm, unlink, stat, mkdir, writeFile, readlink, rename, open, mkdtemp } from 'fs/promises';
 import { parse } from 'yaml';
 import { Ajv2020 } from 'ajv/dist/2020.js';
@@ -90,6 +90,10 @@ function createFinalTextFallback(write) {
 
 // runner/src/credential-notice.ts
 function unresolvedCredentialNotices(session) {
+  if (session.harnessType === "claude-sdk") {
+    const notice = sessionSurfaceNotice(session.registry, session.modelRef);
+    return notice ? [notice] : [];
+  }
   if (session.harnessType !== "omp") return [];
   return unresolvedProviderCredentials(session.registry, {
     env: { ...process.env, ...session.credentialEnv }
@@ -195,7 +199,7 @@ function scheduleRetention(cfg) {
   const dbPath = path3.join(cfg.workspacePath, ".skaile", "logs.db");
   const policy = resolveLogsRetention(cfg.retention);
   const log = createLogger({ kind: "runner", subkind: "logging", instance: cfg.sessionId });
-  return new Promise((resolve4) => setImmediate(resolve4)).then(() => enforceLogsRetention(dbPath, policy)).then(
+  return new Promise((resolve5) => setImmediate(resolve5)).then(() => enforceLogsRetention(dbPath, policy)).then(
     (result) => {
       if (result.deletedByAge + result.deletedByCount > 0) {
         log.info("logs.db retention trimmed rows", { ...result, ...policy });
@@ -379,16 +383,18 @@ async function openLocalIndexIfAvailable(log) {
 
 // runner/src/composition/errors.ts
 var CompositionError = class extends Error {
-  constructor(code, reason, message, ref) {
+  constructor(code, reason, message, ref, moved) {
     super(message);
     this.code = code;
     this.reason = reason;
     this.ref = ref;
+    this.moved = moved;
     this.name = "CompositionError";
   }
   code;
   reason;
   ref;
+  moved;
 };
 function isCompositionError(err, code) {
   return err instanceof CompositionError && (code === void 0 || err.code === code);
@@ -772,11 +778,27 @@ var DefaultCompositionContentSource = class _DefaultCompositionContentSource {
       }
     }
     if (!hit) {
+      let moved;
+      if (entry.library) {
+        for (const root of await registeredLibraryRoots(entry.library)) {
+          const other = this.scanner.findIn(root, kind, pin.name).find((h) => barePublisher(h.asset.publisher) === pin.publisher);
+          if (other?.asset.version) {
+            moved = {
+              key: pin.key,
+              library: entry.library.name,
+              libraryVersion: other.asset.version,
+              lockedVersion: pin.version
+            };
+            break;
+          }
+        }
+      }
       throw new CompositionError(
         "composition_asset_missing",
         "missing",
-        `"${ref}" (${kind}): skaile.lock.yaml pins ${pin.key} but no bytes for it are on disk \u2014 run \`skaile install\``,
-        ref
+        moved ? `"${ref}" (${kind}): skaile.lock.yaml pins ${pin.key} but library "${moved.library}" is at ${moved.libraryVersion} \u2014 run \`skaile update\` to move the lock to it` : `"${ref}" (${kind}): skaile.lock.yaml pins ${pin.key} but no bytes for it are on disk \u2014 run \`skaile install\``,
+        ref,
+        moved
       );
     }
     const assetRoot = hit.asset.fileFilter.assetRoot;
@@ -2976,8 +2998,8 @@ function createRunController(deps) {
   }
   function subscribe(runId) {
     let notify;
-    const changed = new Promise((resolve4) => {
-      notify = resolve4;
+    const changed = new Promise((resolve5) => {
+      notify = resolve5;
     });
     const set = subscribers.get(runId) ?? /* @__PURE__ */ new Set();
     set.add(notify);
@@ -3740,7 +3762,7 @@ function extractJsonOutput(text2) {
 async function promptForReply(harness, prompt, signal) {
   let lastText = "";
   let streamed = "";
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const onAbort = () => {
       harness.off("agent-event", onEvent);
       reject(signal.reason ?? new Error("aborted"));
@@ -3755,7 +3777,7 @@ async function promptForReply(harness, prompt, signal) {
       } else if (event.type === "agent_end") {
         harness.off("agent-event", onEvent);
         signal.removeEventListener("abort", onAbort);
-        resolve4(lastText || streamed);
+        resolve5(lastText || streamed);
       } else if (event.type === "error" && event.retrying !== true) {
         harness.off("agent-event", onEvent);
         signal.removeEventListener("abort", onAbort);
@@ -4319,7 +4341,7 @@ async function prepareCodexTools(options) {
     options.signal.removeEventListener("abort", abort);
     await Promise.allSettled([...peers].map((peer) => peer.close()));
     http.closeAllConnections();
-    if (http.listening) await new Promise((resolve4) => http.close(() => resolve4()));
+    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
   })();
   const abort = () => {
     void dispose();
@@ -4327,9 +4349,9 @@ async function prepareCodexTools(options) {
   options.signal.addEventListener("abort", abort, { once: true });
   try {
     signal.throwIfAborted();
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       http.once("error", reject);
-      http.listen(0, "127.0.0.1", resolve4);
+      http.listen(0, "127.0.0.1", resolve5);
     });
     signal.throwIfAborted();
     const address = http.address();
@@ -4367,7 +4389,7 @@ async function prepareCodexTools(options) {
   } catch {
     await dispose();
     http.closeAllConnections();
-    if (http.listening) await new Promise((resolve4) => http.close(() => resolve4()));
+    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
     throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
   }
 }
@@ -4974,7 +4996,7 @@ async function nodeHttpsFetch(url, init, agent) {
     headers[key] = value;
   });
   const body = init?.body == null ? void 0 : Buffer.from(await new Response(init.body).arrayBuffer());
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const req = request(
       url,
       { method: init?.method ?? "GET", headers, agent, signal: init?.signal ?? void 0 },
@@ -4987,7 +5009,7 @@ async function nodeHttpsFetch(url, init, agent) {
         const status = res.statusCode ?? 0;
         const responseBody = NULL_BODY_STATUSES.has(status) ? null : Readable.toWeb(res);
         if (responseBody === null) res.resume();
-        resolve4(
+        resolve5(
           new Response(responseBody, {
             status,
             statusText: res.statusMessage,
@@ -6801,7 +6823,7 @@ async function runAgentChat(opts) {
 ${message}`;
   }
   try {
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       let settled = false;
       const onEvent = (event) => {
         if (event.type === "agent_end") {
@@ -6816,7 +6838,7 @@ ${message}`;
             process.stdout.write("\n");
           }
           harness.kill();
-          resolve4();
+          resolve5();
         } else if (event.type === "error" && event.retrying !== true) {
           settled = true;
           harness.off("agent-event", onEvent);
@@ -6854,9 +6876,9 @@ async function askApprovalOnTerminal(question, details) {
 `);
     for (const line of details) process.stderr.write(`    ${pc.dim(line)}
 `);
-    return await new Promise((resolve4) => {
-      rl.question("  Approve once? [y/N] ", (answer) => resolve4(/^y(es)?$/i.test(answer.trim())));
-      rl.once("close", () => resolve4(false));
+    return await new Promise((resolve5) => {
+      rl.question("  Approve once? [y/N] ", (answer) => resolve5(/^y(es)?$/i.test(answer.trim())));
+      rl.once("close", () => resolve5(false));
     });
   } finally {
     rl.close();
@@ -6905,7 +6927,7 @@ function buildClientCapabilityHandler(args) {
         `Capability ${args.wire.name} (callId=${callId}) rejected: a call with this id is already in flight`
       );
     }
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const timer = setTimeout(() => {
         args.pending.delete(callId);
         reject(
@@ -6914,7 +6936,7 @@ function buildClientCapabilityHandler(args) {
           )
         );
       }, timeoutMs);
-      args.pending.set(callId, { resolve: resolve4, reject, timer });
+      args.pending.set(callId, { resolve: resolve5, reject, timer });
       args.emit({
         type: "capability_invoked",
         callId,
@@ -6933,19 +6955,28 @@ async function dispatchRunnerCapabilityInvocation(cmd, deps) {
     deps.emit({
       type: "capability_result",
       callId: cmd.callId,
-      result: { error: capabilityErrorText(cmd.name, err) }
+      result: capabilityFailure(cmd.name, err)
     });
   }
 }
-function capabilityErrorText(name, err) {
+function capabilityFailure(name, err) {
   if (err instanceof Error && err.name === "ZodError" && "issues" in err) {
     const issues = err.issues;
     const parts = issues.map(
       (i) => `${i.path.length > 0 ? `${i.path.map(String).join(".")}: ` : ""}${i.message}`
     );
-    return `invalid input for ${name}: ${parts.join("; ")}`;
+    return {
+      ok: false,
+      code: "invalid_input",
+      message: `invalid input for ${name}: ${parts.join("; ")}`
+    };
   }
-  return err instanceof Error ? err.message : String(err);
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    ok: false,
+    code: message.startsWith("Unknown capability:") ? "unknown_capability" : "capability_failed",
+    message
+  };
 }
 function resolveCapabilityResult(pending, cmd) {
   const entry = pending.get(cmd.callId);
@@ -8419,12 +8450,12 @@ function createInitBuildHold(now = Date.now) {
   }
   return {
     beginBuild() {
-      let resolve4;
+      let resolve5;
       const build = {
         done: false,
         error: null,
         settled: new Promise((r) => {
-          resolve4 = r;
+          resolve5 = r;
         })
       };
       current = build;
@@ -8432,7 +8463,7 @@ function createInitBuildHold(now = Date.now) {
         if (build.done) return;
         build.done = true;
         build.error = error;
-        resolve4();
+        resolve5();
       };
       return { succeed: () => settle(null), fail: (error) => settle(error) };
     },
@@ -8446,13 +8477,13 @@ function createInitBuildHold(now = Date.now) {
       const previous = tail;
       const turn = previous.then(awaitNewestBuild);
       let timer;
-      const deadline = deadlineMs === void 0 ? null : new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4("timeout"), deadlineMs);
+      const deadline = deadlineMs === void 0 ? null : new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5("timeout"), deadlineMs);
         timer.unref?.();
       });
       let markStarted;
-      const started = new Promise((resolve4) => {
-        markStarted = resolve4;
+      const started = new Promise((resolve5) => {
+        markStarted = resolve5;
       });
       const result = (async () => {
         const first = deadline ? await Promise.race([turn, deadline]) : await turn;
@@ -8505,7 +8536,7 @@ function createCoalescedRestartScheduler(deps) {
   const quietMs = deps.quietMs ?? 250;
   const maxWaitMs = deps.maxWaitMs ?? 2e3;
   const now = deps.now ?? Date.now;
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let open4 = null;
   return (reason) => {
     if (open4) {
@@ -8844,8 +8875,8 @@ var CompactionGate = class {
   begin() {
     const hold = /* @__PURE__ */ Symbol("compaction");
     if (this.held.size === 0) {
-      this.opened = new Promise((resolve4) => {
-        this.release = resolve4;
+      this.opened = new Promise((resolve5) => {
+        this.release = resolve5;
       });
     }
     this.held.add(hold);
@@ -8902,8 +8933,8 @@ var CompactionGate = class {
 };
 async function raceDeadline(opened, ms) {
   let timer;
-  const expired = new Promise((resolve4) => {
-    timer = setTimeout(() => resolve4("timeout"), ms);
+  const expired = new Promise((resolve5) => {
+    timer = setTimeout(() => resolve5("timeout"), ms);
     timer.unref?.();
   });
   try {
@@ -8990,8 +9021,8 @@ var HarnessSwapGate = class {
    */
   beginTurn() {
     let resolveTurn;
-    const turn = new Promise((resolve4) => {
-      resolveTurn = resolve4;
+    const turn = new Promise((resolve5) => {
+      resolveTurn = resolve5;
     });
     this.turnTail = this.turnTail.then(() => turn);
     let ended = false;
@@ -9154,8 +9185,8 @@ var PromptTurnQueue = class {
   join(owner = {}) {
     const queued = this.entries.length > 0;
     let release2;
-    const ready = new Promise((resolve4) => {
-      release2 = resolve4;
+    const ready = new Promise((resolve5) => {
+      release2 = resolve5;
     });
     const entry = { owner, active: false, dropped: false, release: release2 };
     this.entries.push(entry);
@@ -9516,7 +9547,7 @@ function freshTurnReplyPrompt(answer, question) {
 (The answer above is to your question "${asked}")`;
 }
 function awaitAgentEnd(harness, prompt, timeoutMs) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const onEvent = (raw) => {
       const event = raw;
@@ -9531,7 +9562,7 @@ function awaitAgentEnd(harness, prompt, timeoutMs) {
       if (harness.off) harness.off("agent-event", onEvent);
       else harness.removeListener("agent-event", onEvent);
       if (err) reject(err);
-      else resolve4();
+      else resolve5();
     };
     const timer = setTimeout(
       () => done(new Error(`Flow turn timed out after ${timeoutMs / 1e3}s`)),
@@ -10192,13 +10223,13 @@ var CompactionOrchestrator = class {
     const timeoutMs = compactionTimeoutMs();
     const inactivityMs = compactionInactivityMs();
     try {
-      const expiry = new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4("expired"), timeoutMs);
+      const expiry = new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5("expired"), timeoutMs);
         let lastEventAt = Date.now();
         const check = () => {
           const lastSeen = Math.max(lastEventAt, this.harness.lastActivityAt?.() ?? 0);
           const idleMs = Date.now() - lastSeen;
-          if (idleMs >= inactivityMs) resolve4("stalled");
+          if (idleMs >= inactivityMs) resolve5("stalled");
           else idleTimer = setTimeout(check, inactivityMs - idleMs);
         };
         rearmInactivity = () => {
@@ -10222,8 +10253,8 @@ var CompactionOrchestrator = class {
           this.opts.onLog?.(`[compaction] abort after timeout failed: ${String(abortErr)}`);
         });
         let settleTimer;
-        const graceExpired = new Promise((resolve4) => {
-          settleTimer = setTimeout(resolve4, ABORT_SETTLE_GRACE_MS);
+        const graceExpired = new Promise((resolve5) => {
+          settleTimer = setTimeout(resolve5, ABORT_SETTLE_GRACE_MS);
           settleTimer.unref?.();
         });
         await Promise.race([Promise.all([aborted, settled]), graceExpired]);
@@ -12023,9 +12054,9 @@ function createSessionStimulusBus(opts) {
         connectorId,
         fragmentLength: sig.promptFragment.length
       });
-      return new Promise((resolve4, reject) => {
+      return new Promise((resolve5, reject) => {
         const q = getQueue(connectorId);
-        q.pending.push({ signal: sig, resolve: resolve4, reject });
+        q.pending.push({ signal: sig, resolve: resolve5, reject });
         startTimerIfNeeded(connectorId, q, coalesceMs);
       });
     }
@@ -12512,13 +12543,18 @@ async function guardClaudeAiConnectors(home, serverLog) {
     );
   }
 }
-function ensureGitConfigInclude(managedGitconfigPath) {
+function ensureGitConfigInclude(managedGitconfigPath, alsoMatching = []) {
   const home = process.env.HOME ?? homedir();
   if (!home) return;
   const gitconfigPath = join(home, ".gitconfig");
+  let target = gitconfigPath;
+  try {
+    target = realpathSync(gitconfigPath);
+  } catch {
+  }
   let existing = "";
   try {
-    existing = readFileSync(gitconfigPath, "utf-8");
+    existing = readFileSync(target, "utf-8");
   } catch {
   }
   const sectionRe = /^\s*\[([^\]\s]+)(?:\s+"[^"]*")?\]\s*$/;
@@ -12532,23 +12568,42 @@ function ensureGitConfigInclude(managedGitconfigPath) {
     }
     if (currentSection !== "include" && currentSection !== "includeif") continue;
     const pathMatch = line.match(pathKeyRe);
-    if (pathMatch?.[1] === managedGitconfigPath) return;
+    const found = pathMatch?.[1];
+    if (found === managedGitconfigPath || found !== void 0 && alsoMatching.includes(found))
+      return;
   }
-  if (!existsSync(dirname(gitconfigPath))) {
-    mkdirSync(dirname(gitconfigPath), { recursive: true });
+  if (!existsSync(dirname(target))) {
+    mkdirSync(dirname(target), { recursive: true });
   }
-  const block = `${existing.trimEnd()}
-# skaile-runner: managed-gitconfig include
+  let mode = 420;
+  try {
+    mode = statSync(target).mode & 511;
+  } catch {
+  }
+  const block = `${existing.trimEnd()}${existing.trim() === "" ? "" : "\n"}# skaile-runner: managed-gitconfig include
 [include]
 	path = ${managedGitconfigPath}
 `;
-  writeFileSync(gitconfigPath, block, { mode: 420 });
+  const tmp = `${target}.skaile-${process.pid}-${Date.now().toString(36)}.tmp`;
+  try {
+    writeFileSync(tmp, block, { mode });
+    renameSync(tmp, target);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
 }
-function setupManagedGitconfig(projectDir, serverLog) {
-  const managedGitconfigPath = join(projectDir, ".skaile", "managed-gitconfig");
+function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
+  const managedGitconfigPath = join(resolve(projectDir), ".skaile", "managed-gitconfig");
   process.env.GIT_CONFIG_GLOBAL = managedGitconfigPath;
+  if (!includeInHome) return;
   try {
-    ensureGitConfigInclude(managedGitconfigPath);
+    let includePath = managedGitconfigPath;
+    try {
+      includePath = join(realpathSync(resolve(projectDir)), ".skaile", "managed-gitconfig");
+    } catch {
+    }
+    ensureGitConfigInclude(includePath, [managedGitconfigPath]);
   } catch (err) {
     serverLog.warn("failed to write ~/.gitconfig include \u2014 relying on env only", {
       error: err instanceof Error ? err.message : String(err)
@@ -12688,19 +12743,19 @@ function createFlowConnectorReadiness(isReady) {
     wait(timeoutMs, isSatisfied) {
       const satisfied = isSatisfied ?? isReady;
       if (satisfied()) return Promise.resolve(true);
-      return new Promise((resolve4) => {
+      return new Promise((resolve5) => {
         let timer;
         const waiter = {
           satisfied,
           release: () => {
             clearTimeout(timer);
-            resolve4(true);
+            resolve5(true);
           }
         };
         timer = setTimeout(() => {
           const idx = waiters.indexOf(waiter);
           if (idx >= 0) waiters.splice(idx, 1);
-          resolve4(false);
+          resolve5(false);
         }, timeoutMs);
         timer.unref?.();
         waiters.push(waiter);
@@ -13182,7 +13237,11 @@ async function startAgentServer(opts) {
   let teardownProcessHandlers = stopOutputWatch;
   const profile = wsConfig.agent_config?.default;
   const maxTurns = wsConfig.agent?.permissions?.max_turns ?? profile?.max_turns;
-  setupManagedGitconfig(opts.projectDir, serverLog);
+  setupManagedGitconfig(
+    opts.projectDir,
+    serverLog,
+    opts.gitConfigInclude ?? process.env.SKAILE_GIT_CONFIG_INCLUDE === "1"
+  );
   const agentDir = opts.agentDir ?? resolveAgentDir(opts.projectDir);
   if (agentDir) {
     serverLog.info("agent dir resolved", { agentDir });
@@ -13258,7 +13317,7 @@ async function startAgentServer(opts) {
   transport.onConnect(() => rejectCallsSentToPreviousPeer("replaced connection"));
   const remoteCapabilityInvoker = (name, input, timeoutMs, signal) => {
     const callId = typeof crypto?.randomUUID === "function" ? crypto.randomUUID() : `rcap-${Date.now()}-${Math.floor(Math.random() * 1e9)}`;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (!transport.connected) {
         reject(new Error(`Transport disconnected; cannot invoke remote capability ${name}`));
         return;
@@ -13272,7 +13331,7 @@ async function startAgentServer(opts) {
         signal?.removeEventListener("abort", abort);
         pendingCapabilityCalls.delete(callId);
         if (error) reject(error);
-        else resolve4(value);
+        else resolve5(value);
       };
       const abort = () => finish(signal?.reason ?? new Error("Remote capability aborted"));
       const timer = setTimeout(
@@ -13293,8 +13352,8 @@ async function startAgentServer(opts) {
     });
   };
   let aiProviderConfigId;
-  const sleep = (ms) => new Promise((resolve4) => {
-    const t = setTimeout(resolve4, ms);
+  const sleep = (ms) => new Promise((resolve5) => {
+    const t = setTimeout(resolve5, ms);
     t.unref?.();
   });
   async function mintAndPersistAiCredential(args) {
@@ -13679,10 +13738,10 @@ async function startAgentServer(opts) {
   let resolveSessionReady;
   let rejectSessionReady;
   let sessionReadyOutcome = "pending";
-  const sessionReady = new Promise((resolve4, reject) => {
+  const sessionReady = new Promise((resolve5, reject) => {
     resolveSessionReady = () => {
       if (sessionReadyOutcome === "pending") sessionReadyOutcome = "resolved";
-      resolve4();
+      resolve5();
     };
     rejectSessionReady = (err) => {
       if (sessionReadyOutcome === "pending") sessionReadyOutcome = "rejected";
@@ -13823,7 +13882,7 @@ async function startAgentServer(opts) {
     log(`[serve] model endpoint listening on ${modelEndpoint.url}`);
   }
   if (secretsMode === "provisioned") {
-    log("[serve] secrets mode: provisioned \u2014 waiting for provision_secrets command");
+    log("[serve] secrets mode: provisioned \u2014 waiting for session_init with a `secrets` map");
   } else {
     try {
       sessionConfig = buildSessionConfig(new EnvSecretProvider());
@@ -14424,8 +14483,8 @@ async function startAgentServer(opts) {
     try {
       await Promise.race([
         sessionReady,
-        new Promise((resolve4) => {
-          const t = setTimeout(resolve4, 2e3);
+        new Promise((resolve5) => {
+          const t = setTimeout(resolve5, 2e3);
           t.unref?.();
         })
       ]);
@@ -15327,7 +15386,7 @@ async function startAgentServer(opts) {
           log("[serve] prompt received before secrets provisioned \u2014 rejecting");
           sendEvent({
             type: "error",
-            message: "Secrets not yet provisioned \u2014 send provision_secrets first",
+            message: "Secrets not yet provisioned: send session_init with a `secrets` map",
             fatal: false
           });
           return false;
@@ -15920,7 +15979,7 @@ async function startAgentServer(opts) {
       `[serve] harness=${agentSession.harnessType} model=${agentSession.model ?? "(default)"} maxTurns=${maxTurns ?? "(default)"}`
     );
   } else {
-    log(`[serve] secrets=provisioned \u2014 session will initialize after provision_secrets`);
+    log(`[serve] secrets=provisioned \u2014 session will initialize after session_init`);
   }
   log(`[serve] project=${opts.projectDir}`);
   installProcessHandlers();
@@ -16110,5 +16169,5 @@ function touchSession(state) {
 }
 
 export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptHarness, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsHarnessRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, harnessActiveAfterTurnEnd, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompilePinCurrent, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, manifestModelForHarness, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
-//# sourceMappingURL=chunk-VJRTDKXS.js.map
-//# sourceMappingURL=chunk-VJRTDKXS.js.map
+//# sourceMappingURL=chunk-SJNZ4WPA.js.map
+//# sourceMappingURL=chunk-SJNZ4WPA.js.map