@skaile/workspaces 6.5.0 → 6.7.0

package/dist/{chunk-TNQLDEM6.js → chunk-6RPS7JEH.js}

@@ -1,40 +1,41 @@
-import { WorkspacePlugin } from './chunk-TDPQOR3C.js';
-import { buildWorkspaceToolDefs } from './chunk-3KSLUVKB.js';
-import { findAiAssetsRoot } from './chunk-KYNCY3F3.js';
-import { startModelEndpoint } from './chunk-SN663FCA.js';
-import { WebSocketServerTransport } from './chunk-7H4GTP7V.js';
+import { WorkspacePlugin } from './chunk-RAHAZ7LP.js';
+import { buildWorkspaceToolDefs } from './chunk-37X4A6VZ.js';
+import { findAiAssetsRoot } from './chunk-HQAPUPBE.js';
+import { startModelEndpoint } from './chunk-U52FYGK5.js';
+import { WebSocketServerTransport } from './chunk-HLAEYFUN.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
-import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-HTGTNN2B.js';
-import { resolveFlowPath } from './chunk-USVUS4DJ.js';
-import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-3DA74PLW.js';
-import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-B4BLJUYN.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-2IAWVUW3.js';
-import { EventNormalizer } from './chunk-B436SG5P.js';
-import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-EN5REMWV.js';
-import { codexLoginFallbackNotice } from './chunk-OLHHN3NO.js';
+import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-CMXDFTA2.js';
+import { resolveFlowPath } from './chunk-IRK3LNG3.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-USSP43U3.js';
+import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-LX4TTTRR.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-ZBA4P5TD.js';
+import { EventNormalizer } from './chunk-HMVAGPYR.js';
+import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-HPXONAI2.js';
+import { codexLoginFallbackNotice } from './chunk-N6ZGB5ES.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-KSUT5KAE.js';
+import { dispatchCapability } from './chunk-LZPJOF7Y.js';
 import { classifyClaudeSdkError } from './chunk-5DE3DGVR.js';
 import { agentExecRequested } from './chunk-7DN6JKP2.js';
-import { toAgentEffort, toMergedRegistry } from './chunk-E6UWI3TP.js';
-import { unresolvedProviderCredentials, harnessCapabilities, createHarness, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-NSIOBKDX.js';
-import { loadFlow } from './chunk-X44XKBZX.js';
+import { toAgentEffort, toMergedRegistry } from './chunk-PLLZSKOO.js';
+import { unresolvedProviderCredentials, harnessCapabilities, createHarness, providerCredentialEnvName, registryCredentialEnv, supportsLiveToolUpdates } from './chunk-XON6ODIC.js';
+import { catalogLayer, AI_PROVIDER_PRESETS } from './chunk-6UP2EDFN.js';
+import { loadFlow } from './chunk-WFK4MUBL.js';
 import { renderStimulusPrompt } from './chunk-WD3L5QSU.js';
-import { TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-G5SYFFMD.js';
-import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-TGUMN5G7.js';
-import { createDefaultKindRegistry } from './chunk-22ZX33H6.js';
+import { TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-ASBZOTEO.js';
+import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-G44FFUMA.js';
+import { createDefaultKindRegistry } from './chunk-O5Y7VMVQ.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
 import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-VT6G5AJV.js';
-import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-UMLCKKIA.js';
-import { resolveRuntimeAssets } from './chunk-G4NCSYWR.js';
+import { readLock, ensureRunStateIgnored, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-TMJBEGS4.js';
+import { resolveRuntimeAssets } from './chunk-G7NMF5WQ.js';
 import { DEFAULT_HARNESS_ID, resolveHarnessPaths } from './chunk-C5HFK34M.js';
-import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-IWKKTCXY.js';
-import { globalSkaileDir } from './chunk-L5VSIPQD.js';
+import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-O7ADRMCR.js';
+import { globalSkaileDir, globalCacheRoot } from './chunk-L5VSIPQD.js';
 import { harnessNameForHarnessId, SUPPORTED_HARNESSES, HARNESS_TARGETS } from './chunk-VTETQCR6.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-AVFRFGM2.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-GNUA7XT2.js';
 import { parseAssetRef } from './chunk-V5KG6CCV.js';
 import { pickRegistryEntries, registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-RXGPFAMN.js';
-import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-DKXNKFKP.js';
+import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention, scrubLogText } from './chunk-SGI5MRKP.js';
 import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError, redactCredentials } from './chunk-BOFL7GIF.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import { createInterface } from 'readline';
@@ -1429,6 +1430,22 @@ function buildCompositionRunSnapshot(sessionId, items, promptVersion) {
     items: entries
   };
 }
+var MAX_RUN_SNAPSHOTS = 20;
+async function pruneRunSnapshots(projectDir, except, keep) {
+  const dir = path3.join(projectDir, RUN_SNAPSHOT_DIR);
+  try {
+    const names = (await fs8.readdir(dir)).filter((n) => n.endsWith(".json"));
+    const dated = await Promise.all(
+      names.map(async (name) => ({
+        file: path3.join(dir, name),
+        mtime: (await fs8.stat(path3.join(dir, name))).mtimeMs
+      }))
+    );
+    const stale = dated.filter((d) => d.file !== except).sort((a, b) => b.mtime - a.mtime).slice(Math.max(keep - 1, 0));
+    await Promise.all(stale.map((d) => fs8.rm(d.file, { force: true })));
+  } catch {
+  }
+}
 async function saveCompositionRunSnapshot(projectDir, snapshot) {
   const file = compositionRunSnapshotPath(projectDir, snapshot.session_id);
   await fs8.mkdir(path3.dirname(file), { recursive: true });
@@ -1436,6 +1453,8 @@ async function saveCompositionRunSnapshot(projectDir, snapshot) {
   await fs8.writeFile(tmp, `${JSON.stringify(snapshot, null, 2)}
 `, "utf-8");
   await fs8.rename(tmp, file);
+  ensureRunStateIgnored(projectDir);
+  await pruneRunSnapshots(projectDir, file, MAX_RUN_SNAPSHOTS);
 }
 
 // runner/src/composition/resolve-instance.ts
@@ -5042,6 +5061,63 @@ async function nodeHttpsFetch(url, init, agent) {
     req.end(body);
   });
 }
+var SNAPSHOT_FORMAT = 1;
+function mcpToolsSnapshotDir() {
+  return process.env.SKAILE_MCP_TOOLS_CACHE_DIR || join(globalCacheRoot(), "mcp-tools");
+}
+function mcpToolsSnapshotKey(decl) {
+  return createHash("sha256").update(JSON.stringify([decl.id, decl.command ?? "", decl.args ?? []])).digest("hex").slice(0, 32);
+}
+function snapshotPath(decl) {
+  const safeId = decl.id.replace(/[^A-Za-z0-9_.-]/g, "_");
+  return join(mcpToolsSnapshotDir(), `${safeId}-${mcpToolsSnapshotKey(decl)}.json`);
+}
+function isToolDescriptor(v) {
+  if (!v || typeof v !== "object") return false;
+  const t = v;
+  return typeof t.name === "string" && t.name.length > 0 && (t.description === void 0 || typeof t.description === "string");
+}
+async function readMcpToolsSnapshot(decl) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(snapshotPath(decl), "utf8"));
+  } catch {
+    return void 0;
+  }
+  const file = parsed;
+  if (!file || file.format !== SNAPSHOT_FORMAT || file.id !== decl.id || file.key !== mcpToolsSnapshotKey(decl) || !Array.isArray(file.tools) || file.tools.length === 0 || !file.tools.every(isToolDescriptor)) {
+    return void 0;
+  }
+  return file.tools;
+}
+async function writeMcpToolsSnapshot(decl, tools) {
+  const path11 = snapshotPath(decl);
+  const body = {
+    format: SNAPSHOT_FORMAT,
+    id: decl.id,
+    key: mcpToolsSnapshotKey(decl),
+    tools: tools.map((t) => ({
+      name: t.name,
+      ...t.description !== void 0 ? { description: t.description } : {},
+      ...t.inputSchema !== void 0 ? { inputSchema: t.inputSchema } : {}
+    }))
+  };
+  const tmp = `${path11}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await mkdir(mcpToolsSnapshotDir(), { recursive: true });
+    await writeFile(tmp, JSON.stringify(body), "utf8");
+    await rename(tmp, path11);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function sameToolList(a, b) {
+  const norm = (list) => JSON.stringify(
+    [...list].sort((x, y) => x.name.localeCompare(y.name)).map((t) => [t.name, t.description ?? null, t.inputSchema ?? null])
+  );
+  return norm(a) === norm(b);
+}
 var execFileAsync2 = promisify(execFile);
 var DEFAULT_NIX_TIMEOUT_MS = 3e4;
 var NIX_TIMEOUT_ENV_VAR = "SKAILE_NIX_TIMEOUT_MS";
@@ -5405,6 +5481,27 @@ function isMcpAuthError(err) {
   if (typeof message !== "string") return false;
   return /\b401\b|invalid[_ ]token|invalid[_ ]grant/i.test(message);
 }
+function isLazyDeclaration(decl) {
+  return decl.lazy === true && (decl.transport ?? "stdio") === "stdio";
+}
+function untilAborted(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.reject(signal.reason ?? new Error("aborted"));
+  return new Promise((resolve5, reject) => {
+    const onAbort = () => reject(signal.reason ?? new Error("aborted"));
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (v) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve5(v);
+      },
+      (e) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(e);
+      }
+    );
+  });
+}
 function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -5515,21 +5612,30 @@ var ExternalMcpManager = class {
    * Connect one MCP server and register its tools into the capability registry.
    * Returns the server id and the registered tool capability names.
    * Throws if the id is already registered or if connect/listTools fails.
+   *
+   * A `lazy: true` stdio server with a tools snapshot is registered from the
+   * snapshot and not started: its first tool call connects it. Without a
+   * snapshot it starts now and writes one for the next session.
    */
   async addServer(decl) {
     if (this.servers.some((s) => s.id === decl.id)) {
       throw new McpServerAlreadyRegisteredError(decl.id);
     }
+    const lazy = isLazyDeclaration(decl);
+    const snapshot = lazy ? await readMcpToolsSnapshot(decl) : void 0;
+    if (snapshot) return this.registerFromSnapshot(decl, snapshot);
     const client = await this.connectWithReauth(decl);
-    const server = { id: decl.id, decl, client, toolNames: [] };
+    const server = { id: decl.id, decl, client, tools: [], toolNames: [] };
     const toolNames = [];
     try {
       const { tools } = await client.listTools();
+      server.tools = tools;
       for (const tool of tools) {
         const cap = this.buildToolCapability(server, tool);
         this.registry.register(cap, "agent");
         toolNames.push(cap.name);
       }
+      if (lazy) await writeMcpToolsSnapshot(decl, tools);
     } catch (err) {
       for (const name of toolNames) this.registry.deregister(name);
       try {
@@ -5548,6 +5654,93 @@ var ExternalMcpManager = class {
     });
     return { id: decl.id, toolNames };
   }
+  /** Register a lazy server's capabilities from its snapshot, without starting it. */
+  registerFromSnapshot(decl, tools) {
+    const server = { id: decl.id, decl, tools, toolNames: [] };
+    try {
+      for (const tool of tools) {
+        const cap = this.buildToolCapability(server, tool);
+        this.registry.register(cap, "agent");
+        server.toolNames.push(cap.name);
+      }
+    } catch (err) {
+      for (const name of server.toolNames) this.registry.deregister(name);
+      throw err;
+    }
+    this.servers.push(server);
+    this.log.info("MCP server registered (runner-managed)", {
+      id: decl.id,
+      transport: "stdio",
+      toolCount: server.toolNames.length,
+      tools: server.toolNames,
+      lazy: true,
+      started: false
+    });
+    return { id: decl.id, toolNames: [...server.toolNames] };
+  }
+  /**
+   * The server's live client, starting a lazy server on first use. Concurrent
+   * first calls share one connect; a failed connect is not cached, so the next
+   * call tries again.
+   */
+  ensureClient(server) {
+    if (server.client) return Promise.resolve(server.client);
+    if (server.removed) return Promise.reject(new Error(`MCP server '${server.id}' was removed`));
+    server.connectInFlight ??= this.startLazyServer(server).finally(() => {
+      server.connectInFlight = void 0;
+    });
+    return server.connectInFlight;
+  }
+  async startLazyServer(server) {
+    let client;
+    let tools;
+    try {
+      client = await this.connectWithReauth(server.decl);
+    } catch (err) {
+      this.log.error("MCP server lazy start failed", err, { id: server.id });
+      throw new Error(`MCP server '${server.id}' failed to start: ${errMessage(err)}`);
+    }
+    try {
+      ({ tools } = await client.listTools());
+    } catch (err) {
+      await client.close().catch(() => {
+      });
+      this.log.error("MCP server lazy start failed", err, { id: server.id });
+      throw new Error(`MCP server '${server.id}' failed to start: ${errMessage(err)}`);
+    }
+    server.client = client;
+    if (server.removed) throw new Error(`MCP server '${server.id}' was removed`);
+    if (!sameToolList(server.tools, tools)) this.reregisterTools(server, tools);
+    this.log.info("MCP server registered (runner-managed)", {
+      id: server.id,
+      transport: "stdio",
+      toolCount: server.toolNames.length,
+      tools: server.toolNames,
+      lazy: true,
+      started: true
+    });
+    return client;
+  }
+  /**
+   * The snapshot disagreed with what the started server advertises: replace the
+   * registered capabilities with the live list and rewrite the snapshot.
+   */
+  reregisterTools(server, tools) {
+    this.log.warn("MCP tools snapshot is stale; re-registering from the live server", {
+      id: server.id,
+      snapshotCount: server.tools.length,
+      liveCount: tools.length
+    });
+    for (const name of server.toolNames) this.registry.deregister(name);
+    server.toolNames = [];
+    server.tools = tools;
+    for (const tool of tools) {
+      const cap = this.buildToolCapability(server, tool);
+      this.registry.register(cap, "agent");
+      server.toolNames.push(cap.name);
+    }
+    void writeMcpToolsSnapshot(server.decl, tools);
+  }
   /**
    * Deregister a running MCP server's tools and close its client.
    * No-op when the id is not found.
@@ -5560,14 +5753,17 @@ var ExternalMcpManager = class {
     const idx = this.servers.findIndex((s) => s.id === id);
     if (idx === -1) return;
     const server = this.servers[idx];
+    server.removed = true;
     if (server.reauthInFlight) await server.reauthInFlight.catch(() => {
     });
+    if (server.connectInFlight) await server.connectInFlight.catch(() => {
+    });
     this.servers.splice(idx, 1);
     for (const name of server.toolNames) {
       this.registry.deregister(name);
     }
     try {
-      await server.client.close();
+      await server.client?.close();
     } catch {
     }
     this.log.info("MCP server removed (runner-managed)", { id });
@@ -5630,7 +5826,7 @@ var ExternalMcpManager = class {
     const old = server.client;
     server.client = next;
     try {
-      await old.close();
+      await old?.close();
     } catch {
     }
     this.log.info("MCP server reconnected after 401 re-mint", { id: server.id });
@@ -5661,7 +5857,10 @@ var ExternalMcpManager = class {
       inputZod: PASSTHROUGH_INPUT_ZOD,
       handler: async (input, ctx) => {
         const call = { name: tool.name, arguments: input ?? {} };
-        const invoke = () => ctx.signal ? server.client.callTool(call, void 0, { signal: ctx.signal }) : server.client.callTool(call);
+        const invoke = async () => {
+          const client = await untilAborted(this.ensureClient(server), ctx.signal);
+          return ctx.signal ? client.callTool(call, void 0, { signal: ctx.signal }) : client.callTool(call);
+        };
         let result;
         try {
           result = await invoke();
@@ -5695,13 +5894,16 @@ var ExternalMcpManager = class {
    */
   async dispose(options = {}) {
     const failures = [];
-    await Promise.allSettled(this.servers.map((s) => s.reauthInFlight).filter(Boolean));
+    for (const server of this.servers) server.removed = true;
+    await Promise.allSettled(
+      this.servers.flatMap((s) => [s.reauthInFlight, s.connectInFlight]).filter(Boolean)
+    );
     for (const server of this.servers) {
       for (const toolName of server.toolNames) {
         this.registry.deregister(toolName);
       }
       try {
-        await server.client.close();
+        await server.client?.close();
       } catch (err) {
         failures.push(err);
         this.log.warn("MCP server close failed", {
@@ -6012,12 +6214,20 @@ async function maybeInstallNpmPeerDeps(runtimeAssets, projectDir, resLog) {
     }
   }
 }
+function scrubConnectorError(error) {
+  if (typeof error === "string") return scrubLogText(error);
+  if (error instanceof Error) return scrubLogText(error.message);
+  return error;
+}
 function logConnectorReport(results, resLog) {
   for (const r of results) {
     if (r.connected) {
       resLog.info("connector ok", { id: r.id, mountPath: r.mountPath });
     } else {
-      resLog.error("connector failed", void 0, { id: r.id, error: r.error });
+      resLog.error("connector failed", void 0, {
+        id: r.id,
+        error: scrubConnectorError(r.error)
+      });
     }
   }
 }
@@ -6972,7 +7182,7 @@ function buildClientCapabilityHandler(args) {
 }
 async function dispatchRunnerCapabilityInvocation(cmd, deps) {
   try {
-    const result = await deps.invoke(cmd.name, cmd.input);
+    const result = withErrorMirror(await deps.invoke(cmd.name, cmd.input));
     deps.emit({ type: "capability_result", callId: cmd.callId, result });
   } catch (err) {
     deps.emit({
@@ -6982,6 +7192,12 @@ async function dispatchRunnerCapabilityInvocation(cmd, deps) {
     });
   }
 }
+function withErrorMirror(result) {
+  if (typeof result !== "object" || result === null) return result;
+  const r = result;
+  if (r.ok !== false || typeof r.message !== "string" || "error" in r) return result;
+  return { ...result, error: r.message };
+}
 function capabilityFailure(name, err) {
   if (err instanceof Error && err.name === "ZodError" && "issues" in err) {
     const issues = err.issues;
@@ -12618,23 +12834,36 @@ function ensureGitConfigInclude(managedGitconfigPath, alsoMatching = []) {
     throw err;
   }
 }
-function userGitconfigToInclude(managedGitconfigPath) {
+function userGitconfigsToInclude(managedGitconfigPath) {
   const home = process.env.HOME || homedir();
-  if (!home) return void 0;
-  const userPath = join(home, ".gitconfig");
-  let text2;
-  try {
-    text2 = readFileSync(userPath, "utf-8");
-  } catch {
-    return void 0;
-  }
+  if (!home) return [];
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const xdgDir = xdg && isAbsolute(xdg) ? xdg : join(home, ".config");
   let realManaged = managedGitconfigPath;
   try {
     realManaged = join(realpathSync(dirname(managedGitconfigPath)), "managed-gitconfig");
   } catch {
   }
-  if (text2.includes(managedGitconfigPath) || text2.includes(realManaged)) return void 0;
-  return userPath;
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const userPath of [join(xdgDir, "git", "config"), join(home, ".gitconfig")]) {
+    let text2;
+    try {
+      text2 = readFileSync(userPath, "utf-8");
+    } catch {
+      continue;
+    }
+    if (text2.includes(managedGitconfigPath) || text2.includes(realManaged)) continue;
+    let identity = userPath;
+    try {
+      identity = realpathSync(userPath);
+    } catch {
+    }
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    found.push(userPath);
+  }
+  return found;
 }
 function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
   const managedGitconfigPath = join(resolve(projectDir), ".skaile", "managed-gitconfig");
@@ -12642,7 +12871,7 @@ function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
   try {
     writeUserGitconfigInclude({
       gitconfigPath: managedGitconfigPath,
-      userGitconfigPath: includeInHome ? void 0 : userGitconfigToInclude(managedGitconfigPath)
+      userGitconfigPaths: includeInHome ? void 0 : userGitconfigsToInclude(managedGitconfigPath)
     });
   } catch (err) {
     serverLog.warn("failed to write managed-gitconfig \u2014 the agent's git has no global config", {
@@ -13174,7 +13403,11 @@ async function applyConnectorMutate(cmd, deps, respond, connectorWaitMs) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    deps.log.warn("connector_mutate failed", { id: cmd.id, op: cmd.op, error: message });
+    deps.log.warn("connector_mutate failed", {
+      id: cmd.id,
+      op: cmd.op,
+      error: scrubLogText(message)
+    });
     respond({ ok: false, code: "op_failed", error: message });
   }
 }
@@ -13264,7 +13497,8 @@ async function startAgentServer(opts) {
   serverLog.info("ws auth token", {
     source: opts.authToken ? "caller" : takenAuthToken.source
   });
-  if (!opts.transport && !authToken) {
+  const warnNoAuthAtListen = !opts.transport && !authToken && (opts.port ?? 8080) === 0;
+  if (!opts.transport && !authToken && !warnNoAuthAtListen) {
     serverLog.warn(wsNoAuthWarning(opts.port ?? 8080, opts.host));
   }
   if (takenAuthToken.unlinkError)
@@ -13312,7 +13546,12 @@ async function startAgentServer(opts) {
     onLog: log,
     ...opts.host ? { host: opts.host } : {},
     ...authToken ? { authToken } : {},
-    ...opts.onListening ? { onListening: opts.onListening } : {}
+    ...opts.onListening || warnNoAuthAtListen ? {
+      onListening: (info) => {
+        if (warnNoAuthAtListen) serverLog.warn(wsNoAuthWarning(info.port, opts.host));
+        opts.onListening?.(info);
+      }
+    } : {}
   });
   logStore.addSink(
     new WsLogSink({
@@ -13323,13 +13562,20 @@ async function startAgentServer(opts) {
   );
   const turnStatus = new TurnStatusTracker();
   const eventGapBuffer = new EventGapBuffer();
+  const initLessRunner = !managedHost && (wsConfig.secrets?.provider ?? "env") === "env";
+  let clientEverConnected = false;
+  transport.onConnect(() => {
+    clientEverConnected = true;
+  });
   function sendEvent(event) {
     turnStatus.observe(event);
     if (transport.connected) {
       transport.send(event);
       return;
     }
-    if (!initAcknowledged) return;
+    if (!initAcknowledged && !(initLessRunner && initGeneration === 0 && clientEverConnected)) {
+      return;
+    }
     eventGapBuffer.push(event, { isStale: settledCapabilityCallCheck(event) });
   }
   function settledCapabilityCallCheck(event) {
@@ -15121,6 +15367,7 @@ async function startAgentServer(opts) {
     const initReceivedAt = Date.now();
     const thisInit = ++initGeneration;
     initAcknowledged = false;
+    if (thisInit === 1) eventGapBuffer.clear();
     if (cmd.protocolVersion.major !== PROTOCOL_VERSION.major) {
       log(
         `[serve] incompatible protocol: agent=${PROTOCOL_VERSION.major} platform=${cmd.protocolVersion.major}`
@@ -15962,7 +16209,8 @@ async function startAgentServer(opts) {
   });
   transport.onConnect(() => {
     if (!eventGapBuffer.hasPending) return;
-    if (!initAcknowledged || sessionReadyOutcome === "rejected") {
+    const initLessTurn = initLessRunner && initGeneration === 0;
+    if (!initAcknowledged && !initLessTurn || sessionReadyOutcome === "rejected") {
       const discarded = eventGapBuffer.clear();
       serverLog.warn(
         `[serve] discarded ${discarded} event(s) buffered while disconnected: the init they belong to is no longer acknowledged`
@@ -16221,6 +16469,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptHarness, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsHarnessRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, harnessActiveAfterTurnEnd, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompilePinCurrent, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, manifestModelForHarness, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
-//# sourceMappingURL=chunk-TNQLDEM6.js.map
-//# sourceMappingURL=chunk-TNQLDEM6.js.map
+export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptHarness, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsHarnessRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, harnessActiveAfterTurnEnd, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompilePinCurrent, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, logConnectorReport, manifestModelForHarness, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
+//# sourceMappingURL=chunk-6RPS7JEH.js.map
+//# sourceMappingURL=chunk-6RPS7JEH.js.map