@snowyroad/braid 0.82.0 → 0.83.0

package/dist/chunk-ORQHM6RG.js

@@ -1,2517 +0,0 @@
-#!/usr/bin/env node
-
-// src/types.ts
-var ACP_AGENT_IDS = [
-  "claude-code",
-  "codex",
-  "gemini",
-  "grok",
-  "cursor",
-  "opencode",
-  "goose",
-  "cline",
-  "copilot",
-  "qwen"
-];
-var AUTH_MODES = ["subscription", "api-key", "auto"];
-
-// src/knobs.ts
-var EMPTY_RUN_FLAGS = Object.freeze({
-  allowWrite: [],
-  allowRead: [],
-  allowDomains: []
-});
-var KNOWN_RUN_FLAGS = [
-  "--provider",
-  "--model",
-  "--fallback-model",
-  "--tools",
-  "--scope",
-  "--auth",
-  "--allow-write",
-  "--allow-read",
-  "--allow-domain",
-  "--invite",
-  "--ipc-profile",
-  "--socket",
-  "--no-socket"
-];
-var VALID_SCOPE = ["on", "off"];
-var VALID_TOOLS = ["readonly", "full"];
-var VALID_IPC_PROFILES = ["compat", "strict"];
-function parseRunFlags(argv) {
-  const flags = { allowWrite: [], allowRead: [], allowDomains: [] };
-  const rest = [];
-  const take = (name, i, inline) => {
-    if (inline !== void 0) return { value: inline, next: i };
-    const v = argv[i + 1];
-    if (v === void 0 || v.startsWith("--")) return { error: `Missing value for ${name}` };
-    return { value: v, next: i + 1 };
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const tok = argv[i];
-    if (!tok.startsWith("--")) {
-      rest.push(tok);
-      continue;
-    }
-    const eq = tok.indexOf("=");
-    const name = eq === -1 ? tok : tok.slice(0, eq);
-    const inline = eq === -1 ? void 0 : tok.slice(eq + 1);
-    if (name === "--invite") {
-      rest.push(tok);
-      if (inline === void 0 && argv[i + 1] !== void 0) {
-        rest.push(argv[i + 1]);
-        i++;
-      }
-      continue;
-    }
-    if (name === "--socket" || name === "--no-socket") {
-      continue;
-    }
-    if (!KNOWN_RUN_FLAGS.includes(name)) {
-      return { ok: false, error: `Unknown flag: ${name}` };
-    }
-    const got = take(name, i, inline);
-    if ("error" in got) return { ok: false, error: got.error };
-    i = got.next;
-    const v = got.value.trim();
-    switch (name) {
-      case "--provider":
-        if (!ACP_AGENT_IDS.includes(v)) {
-          return { ok: false, error: `Invalid --provider: ${v}. Expected one of: ${ACP_AGENT_IDS.join(", ")}` };
-        }
-        flags.provider = v;
-        break;
-      case "--model":
-        flags.model = v;
-        break;
-      case "--fallback-model":
-        flags.fallbackModel = v;
-        break;
-      case "--tools":
-        if (!VALID_TOOLS.includes(v)) {
-          return { ok: false, error: `Invalid --tools: ${v}. Expected "readonly" or "full"` };
-        }
-        flags.tools = v;
-        break;
-      case "--scope":
-        if (!VALID_SCOPE.includes(v)) {
-          return { ok: false, error: `Invalid --scope: ${v}. Expected "on" or "off"` };
-        }
-        flags.scope = v;
-        break;
-      case "--auth":
-        if (!AUTH_MODES.includes(v)) {
-          return { ok: false, error: `Invalid --auth: ${v}. Expected ${AUTH_MODES.join(", ")}` };
-        }
-        flags.auth = v;
-        break;
-      case "--allow-write":
-        flags.allowWrite.push(v);
-        break;
-      case "--allow-read":
-        flags.allowRead.push(v);
-        break;
-      case "--allow-domain":
-        flags.allowDomains.push(v);
-        break;
-      case "--ipc-profile":
-        if (!VALID_IPC_PROFILES.includes(v)) {
-          return { ok: false, error: `Invalid --ipc-profile: ${v}. Expected "compat" or "strict"` };
-        }
-        flags.ipcProfile = v;
-        break;
-    }
-  }
-  return { ok: true, flags, rest };
-}
-var DEFAULT_CLAUDE_FALLBACK_MODEL = "claude-sonnet-4-6";
-function parseListEnv(val) {
-  if (!val) return [];
-  return val.split(/[,:]/).map((s) => s.trim()).filter((s) => s.length > 0);
-}
-function resolveKnobs(flags, env, stored) {
-  const f = flags ?? EMPTY_RUN_FLAGS;
-  let provider;
-  const envAgent = env.BRAID_AGENT?.trim();
-  if (f.provider) provider = { value: f.provider, origin: "flag" };
-  else if (envAgent && ACP_AGENT_IDS.includes(envAgent)) provider = { value: envAgent, origin: "env" };
-  else if (stored?.provider && ACP_AGENT_IDS.includes(stored.provider)) provider = { value: stored.provider, origin: "file" };
-  else provider = { value: "claude-code", origin: "default" };
-  let model;
-  const envModel = env.BRAID_MODEL?.trim();
-  if (f.model !== void 0) model = { value: f.model, origin: "flag" };
-  else if (envModel) model = { value: envModel, origin: "env" };
-  else if (stored?.model) model = { value: stored.model, origin: "file" };
-  else model = { value: "", origin: "default" };
-  let toolMode;
-  const envTool = env.BRAID_TOOL_MODE?.trim();
-  if (f.tools) toolMode = { value: f.tools, origin: "flag" };
-  else if (envTool === "readonly" || envTool === "full") toolMode = { value: envTool, origin: "env" };
-  else if (stored?.toolMode) toolMode = { value: stored.toolMode, origin: "file" };
-  else toolMode = { value: void 0, origin: "default" };
-  let scopeOff;
-  if (f.scope) scopeOff = { value: f.scope === "off", origin: "flag" };
-  else if (env.BRAID_SCOPE === "off") scopeOff = { value: true, origin: "env" };
-  else if (stored?.scope?.disabled === true) scopeOff = { value: true, origin: "file" };
-  else scopeOff = { value: false, origin: "default" };
-  let auth;
-  const envAuth = env.BRAID_AUTH?.trim();
-  if (f.auth) auth = { value: f.auth, origin: "flag" };
-  else if (envAuth && AUTH_MODES.includes(envAuth)) auth = { value: envAuth, origin: "env" };
-  else if (stored?.auth && AUTH_MODES.includes(stored.auth)) auth = { value: stored.auth, origin: "file" };
-  else auth = { value: "auto", origin: "default" };
-  let fallbackModel;
-  if (f.fallbackModel !== void 0 && f.fallbackModel !== "") fallbackModel = { value: f.fallbackModel, origin: "flag" };
-  else if (stored?.fallbackModel) fallbackModel = { value: stored.fallbackModel, origin: "file" };
-  else fallbackModel = {
-    value: provider.value === "claude-code" ? DEFAULT_CLAUDE_FALLBACK_MODEL : void 0,
-    origin: "default"
-  };
-  return {
-    provider,
-    model,
-    toolMode,
-    scopeOff,
-    auth,
-    fallbackModel,
-    allowWrite: { flag: [...f.allowWrite], env: parseListEnv(env.BRAID_SCOPE_ALLOW_WRITE), file: [...stored?.scope?.allowWrite ?? []] },
-    allowRead: { flag: [...f.allowRead], env: parseListEnv(env.BRAID_SCOPE_ALLOW_READ), file: [...stored?.scope?.allowRead ?? []] },
-    allowDomains: { flag: [...f.allowDomains], env: parseListEnv(env.BRAID_SCOPE_ALLOW_DOMAINS), file: [...stored?.scope?.network?.allowedDomains ?? []] }
-  };
-}
-function newBeyondFile(list) {
-  const file = new Set(list.file);
-  return {
-    env: list.env.filter((x) => !file.has(x)),
-    flag: list.flag.filter((x) => !file.has(x))
-  };
-}
-function seg(n, singular, plural) {
-  if (n === 0) return null;
-  return `+${n} ${n === 1 ? singular : plural}`;
-}
-function computePostureWarnings(flags, env, stored) {
-  if (stored === void 0) return [];
-  const lines = [];
-  const k = resolveKnobs(flags, env, stored);
-  if (k.toolMode.value === "full" && stored.toolMode !== "full" && (k.toolMode.origin === "env" || k.toolMode.origin === "flag")) {
-    const src = k.toolMode.origin === "env" ? "env BRAID_TOOL_MODE" : "--tools";
-    const saved = stored.toolMode ? `saved choice is "${stored.toolMode}"` : "saved choice is unset (readonly default)";
-    lines.push(`[posture] tools: full (${src}) \u2014 ${saved}; this run only`);
-  }
-  if (flags.ipcProfile !== void 0) {
-    const savedProfile = stored.scope?.ipcProfile;
-    const savedLabel = savedProfile !== void 0 ? `"${savedProfile}"` : "unset";
-    lines.push(`[posture] ipc profile: ${flags.ipcProfile} (--ipc-profile) \u2014 saved profile is ${savedLabel}; this run only`);
-  }
-  if (k.scopeOff.value && stored.scope?.disabled !== true && (k.scopeOff.origin === "env" || k.scopeOff.origin === "flag")) {
-    const src = k.scopeOff.origin === "env" ? "env BRAID_SCOPE" : "--scope off";
-    lines.push(`[posture] sandbox: OFF (${src}) \u2014 this run only`);
-  }
-  if (k.auth.value === "api-key" && stored.auth === "subscription" && (k.auth.origin === "env" || k.auth.origin === "flag")) {
-    const src = k.auth.origin === "env" ? "env BRAID_AUTH" : "--auth api-key";
-    lines.push(`[posture] auth: api-key (${src}) \u2014 saved choice is "subscription"; bills per-token, this run only`);
-  }
-  const w = newBeyondFile(k.allowWrite);
-  const r = newBeyondFile(k.allowRead);
-  const d = newBeyondFile(k.allowDomains);
-  const layerLine = (layer) => {
-    const parts = [
-      seg((layer === "env" ? w.env : w.flag).length, "write path", "write paths"),
-      seg((layer === "env" ? r.env : r.flag).length, "read path", "read paths"),
-      seg((layer === "env" ? d.env : d.flag).length, "domain", "domains")
-    ].filter((p) => p !== null);
-    if (parts.length === 0) return null;
-    const src = layer === "env" ? "env BRAID_SCOPE_ALLOW_*" : "--allow-write/--allow-read/--allow-domain";
-    return `[posture] sandbox: ${parts.join(", ")} (${src}) \u2014 beyond saved scope; this run only`;
-  };
-  const envLine = layerLine("env");
-  if (envLine) lines.push(envLine);
-  const flagLine = layerLine("flag");
-  if (flagLine) lines.push(flagLine);
-  return lines;
-}
-
-// src/auth.ts
-var ANTHROPIC_KEY_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-function nonEmpty(v) {
-  return typeof v === "string" && v.trim() !== "";
-}
-function presentKeyEnvVars(env) {
-  return ANTHROPIC_KEY_ENV_KEYS.filter((k) => nonEmpty(env[k]));
-}
-function hasSubscriptionLogin(env, readText, homeDir, probeKeychain = () => false) {
-  if (nonEmpty(env.CLAUDE_CODE_OAUTH_TOKEN)) return true;
-  const sep2 = homeDir.endsWith("/") ? "" : "/";
-  const creds = safeJson(readText(`${homeDir}${sep2}.claude/.credentials.json`));
-  if (creds && isNonEmptyObject(creds.claudeAiOauth)) return true;
-  try {
-    if (probeKeychain()) return true;
-  } catch {
-  }
-  return false;
-}
-function safeJson(text) {
-  if (text === void 0) return null;
-  try {
-    const v = JSON.parse(text);
-    return typeof v === "object" && v !== null && !Array.isArray(v) ? v : null;
-  } catch {
-    return null;
-  }
-}
-function isNonEmptyObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).length > 0;
-}
-function resolveAnthropicAuth(input) {
-  const { agent, agentMode, authMode, env } = input;
-  if (agent !== "claude-code" || agentMode !== "acp") return { stripKeys: [], notices: [] };
-  const present = presentKeyEnvVars(env);
-  const baseUrlSet = nonEmpty(env.ANTHROPIC_BASE_URL);
-  const notices = [];
-  if (authMode === "api-key") {
-    if (present.length === 0) {
-      notices.push(
-        "[auth] api-key mode is set but no ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN is present; Claude Code will have no API credential to authenticate with."
-      );
-    }
-    return { stripKeys: [], notices };
-  }
-  if (authMode === "subscription") {
-    if (baseUrlSet && present.length > 0) {
-      notices.push(
-        `[auth] subscription mode: removing ${present.join(" / ")} so your Claude subscription is used. NOTE: ANTHROPIC_BASE_URL is also set, so the custom gateway will no longer receive a token.`
-      );
-    } else if (!input.hasSubscriptionLogin) {
-      const tail = present.length > 0 ? `${present.join(" / ")} will be removed, leaving no working credential. ` : "";
-      notices.push(
-        `[auth] subscription mode is set but no Claude subscription login was detected. ${tail}Run \`claude\` to log in, or use --auth api-key with an ANTHROPIC_API_KEY.`
-      );
-    }
-    return { stripKeys: present, notices };
-  }
-  if (baseUrlSet) return { stripKeys: [], notices };
-  if (present.length === 0) return { stripKeys: [], notices };
-  if (input.hasSubscriptionLogin) {
-    notices.push(
-      `[auth] using your Claude subscription login; ignoring ${present.join(" / ")} in the environment (set --auth api-key to bill the API per-token instead).`
-    );
-    return { stripKeys: present, notices };
-  }
-  notices.push(
-    `[auth] no Claude subscription login found; authenticating with ${present.join(" / ")} (bills per-token). Run \`claude\` to log in, or set --auth subscription once you have.`
-  );
-  return { stripKeys: [], notices };
-}
-function effectiveAnthropicCredential(input) {
-  if (input.agent !== "claude-code" || input.agentMode !== "acp") return "the provider's own login";
-  const { stripKeys } = resolveAnthropicAuth(input);
-  if (stripKeys.length > 0) return "your Claude subscription login";
-  if (nonEmpty(input.env.ANTHROPIC_BASE_URL) && presentKeyEnvVars(input.env).length > 0) {
-    return "a custom gateway (ANTHROPIC_BASE_URL)";
-  }
-  if (presentKeyEnvVars(input.env).length > 0) return "an API key (bills per-token)";
-  return "your Claude subscription login";
-}
-
-// src/authProbe.ts
-import { execFileSync } from "child_process";
-import { homedir } from "os";
-function macKeychainHasClaudeLogin() {
-  if (process.platform !== "darwin") return false;
-  try {
-    execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
-      stdio: "ignore",
-      timeout: 2e3
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function keychainProbeFor(home) {
-  return home === homedir() ? macKeychainHasClaudeLogin : () => false;
-}
-
-// src/invite.ts
-var REQUIRED_FIELDS = ["relayUrl", "code"];
-function decodeInvite(code) {
-  const trimmed = (code ?? "").trim();
-  if (trimmed === "") throw new Error("Invalid invite: empty");
-  const json = Buffer.from(trimmed, "base64url").toString("utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    throw new Error("Invalid invite: payload is not valid JSON");
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-    throw new Error("Invalid invite: payload is not an object");
-  }
-  const p = parsed;
-  for (const field of REQUIRED_FIELDS) {
-    const v = p[field];
-    if (typeof v !== "string" || v.trim() === "") {
-      throw new Error(`Invalid invite: missing or empty field "${field}"`);
-    }
-  }
-  const relayUrl = p.relayUrl.trim();
-  if (!/^wss?:\/\//.test(relayUrl)) {
-    throw new Error("Invalid invite: relayUrl must start with ws:// or wss://");
-  }
-  return {
-    relayUrl,
-    code: p.code.trim()
-  };
-}
-
-// src/redeem.ts
-var InviteExpiredError = class extends Error {
-  constructor() {
-    super("This invite has expired or been revoked. Ask an admin to mint a new one.");
-    this.name = "InviteExpiredError";
-  }
-};
-async function redeemInvite(relayHttpUrl, code) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-HW3QESWO.js");
-  const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/invites/redeem`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ code }),
-    requestClass: "relay.invite.redeem"
-  });
-  if (!r.ok) {
-    if (r.category === "http" && r.status === 410) {
-      throw new InviteExpiredError();
-    }
-    if (r.category === "http") throw new Error(`Invite redemption failed (HTTP ${r.status}).`);
-    throw new Error(`Invite redemption failed (${r.category}).`);
-  }
-  const data = r.json;
-  if (!data.ok || !data.agentKey || !data.agentId || !data.agentUuid) {
-    throw new Error("Invite redemption returned an incomplete response.");
-  }
-  return {
-    agentKey: data.agentKey,
-    agentId: data.agentId,
-    agentName: data.agentName ?? data.agentId,
-    agentUuid: data.agentUuid,
-    channelId: data.channelId
-  };
-}
-
-// src/config.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
-import { homedir as homedir4 } from "os";
-
-// src/keystore.ts
-import { spawnSync as nodeSpawnSync } from "child_process";
-import { mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync, unlinkSync, chmodSync, openSync, closeSync, existsSync, statSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join, dirname } from "path";
-import path from "path";
-
-// src/token.ts
-var RebootstrapError = class extends Error {
-  constructor() {
-    super(
-      "This agent's credential was revoked or invalidated. Re-issue a connection from the website."
-    );
-    this.name = "RebootstrapError";
-  }
-};
-var MAX_TOKEN_LENGTH = 8192;
-var MAX_TOKEN_TTL_S = 48 * 3600;
-var CLOCK_SKEW_S = 300;
-function decodeJwtClaims(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  try {
-    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-    if (typeof header !== "object" || header === null || Array.isArray(header)) return null;
-    const alg = header.alg;
-    if (typeof alg !== "string" || alg.toLowerCase() === "none") return null;
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return null;
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
-  if (newToken.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "token too large" };
-  const claims = decodeJwtClaims(newToken);
-  if (!claims) return { ok: false, reason: "not a well-formed JWT" };
-  const exp = claims.exp;
-  if (typeof exp !== "number" || !Number.isFinite(exp)) {
-    return { ok: false, reason: "missing or non-numeric exp claim" };
-  }
-  const nowS = nowMs / 1e3;
-  if (exp <= nowS - CLOCK_SKEW_S) return { ok: false, reason: "already expired" };
-  if (exp > nowS + MAX_TOKEN_TTL_S) return { ok: false, reason: "expiry implausibly far in the future" };
-  const current = decodeJwtClaims(currentToken);
-  if (current) {
-    if (typeof current.sub === "string" && typeof claims.sub === "string" && current.sub !== claims.sub) {
-      return { ok: false, reason: "subject (sub) does not match the current token" };
-    }
-    if (typeof current.iss === "string" && typeof claims.iss === "string" && current.iss !== claims.iss) {
-      return { ok: false, reason: "issuer (iss) does not match the current token" };
-    }
-  }
-  return { ok: true };
-}
-async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch, dpopProof) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-HW3QESWO.js");
-  const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${agentKey}`,
-      ...dpopProof ? { "Content-Type": "application/json" } : {}
-    },
-    ...dpopProof ? { body: JSON.stringify({ dpop: dpopProof }) } : {},
-    fetchFn,
-    requestClass: "relay.token.mint"
-  });
-  if (!r.ok) {
-    if (r.category === "http" && r.status === 401) throw new RebootstrapError();
-    if (r.category === "http") throw new Error(`Token mint failed (HTTP ${r.status}).`);
-    throw new Error(`Token mint failed (${r.category}).`);
-  }
-  const data = r.json;
-  if (!data.ok || !data.accessToken || !data.agentKey) {
-    throw new Error("Token mint returned an incomplete response.");
-  }
-  return {
-    accessToken: data.accessToken,
-    expiresIn: typeof data.expiresIn === "number" ? data.expiresIn : 3600,
-    agentKey: data.agentKey,
-    ...typeof data.clerkIssuer === "string" && data.clerkIssuer ? { clerkIssuer: data.clerkIssuer } : {},
-    ...typeof data.cardAttestation === "string" && data.cardAttestation ? { cardAttestation: data.cardAttestation } : {}
-  };
-}
-
-// src/exitCodes.ts
-var EXIT_OK = 0;
-var EXIT_NEEDS_HUMAN = 78;
-var EXIT_CRASH = 1;
-var KeystorePermsError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "KeystorePermsError";
-  }
-};
-var NEEDS_HUMAN_CLOSE_CODES = /* @__PURE__ */ new Set([4002, 4003, 4004]);
-function classifyFatal(codeOrError) {
-  if (typeof codeOrError === "number") {
-    return NEEDS_HUMAN_CLOSE_CODES.has(codeOrError) ? EXIT_NEEDS_HUMAN : EXIT_CRASH;
-  }
-  if (codeOrError instanceof RebootstrapError || codeOrError instanceof KeystorePermsError) {
-    return EXIT_NEEDS_HUMAN;
-  }
-  return EXIT_CRASH;
-}
-
-// src/keystore.ts
-function productionWin32Deps() {
-  return {
-    platform: process.platform,
-    env: process.env,
-    spawnSync: (cmd, args) => {
-      const r = nodeSpawnSync(cmd, args, { shell: false, encoding: "utf8" });
-      return { status: r.status, stdout: typeof r.stdout === "string" ? r.stdout : void 0, error: r.error };
-    }
-  };
-}
-function resolveCurrentUser(deps) {
-  const env = deps.env ?? process.env;
-  const systemRoot = env["SystemRoot"] ?? "C:\\Windows";
-  const whoami = path.win32.join(systemRoot, "System32", "whoami.exe");
-  const result = deps.spawnSync(whoami, ["/user", "/fo", "csv", "/nh"]);
-  if (result.error || result.status !== 0) {
-    throw new KeystorePermsError(
-      `[braid] refusing to start: could not resolve current user SID (whoami exited ${result.status ?? "null"}${result.error ? ": " + result.error.message : ""}). Run 'whoami /user' to diagnose.`
-    );
-  }
-  const stdout = result.stdout ?? "";
-  const allMatches = [...stdout.matchAll(/"(S-\d[\d-]+)"/g)];
-  const sidMatch = allMatches.length > 0 ? allMatches[allMatches.length - 1] : null;
-  if (!sidMatch) {
-    throw new KeystorePermsError(
-      `[braid] refusing to start: could not parse SID from whoami output. Run 'whoami /user /fo csv /nh' to diagnose.`
-    );
-  }
-  const nameMatch = stdout.match(/^"([^"]+)"/);
-  const userName = nameMatch ? nameMatch[1].toLowerCase() : "";
-  return { sid: sidMatch[1], userName };
-}
-function applyWin32Acl(target, sid, kind, deps) {
-  const env = deps.env ?? process.env;
-  const systemRoot = env["SystemRoot"] ?? "C:\\Windows";
-  const icacls = path.win32.join(systemRoot, "System32", "icacls.exe");
-  const resetResult = deps.spawnSync(icacls, [target, "/reset"]);
-  if (resetResult.error || resetResult.status !== 0) {
-    throw new KeystorePermsError(
-      `[braid] refusing to start: icacls /reset failed on ${target} (exit ${resetResult.status ?? "null"}${resetResult.error ? ": " + resetResult.error.message : ""}). Command: icacls ${target} /reset`
-    );
-  }
-  const grant = kind === "dir" ? `*${sid}:(OI)(CI)F` : `*${sid}:F`;
-  const args = [target, "/inheritance:r", "/grant:r", grant];
-  const result = deps.spawnSync(icacls, args);
-  if (result.error || result.status !== 0) {
-    throw new KeystorePermsError(
-      `[braid] refusing to start: icacls failed to set ACL on ${target} (exit ${result.status ?? "null"}${result.error ? ": " + result.error.message : ""}). Command: icacls ${args.join(" ")}`
-    );
-  }
-}
-function verifyWin32Acl(target, sid, deps, userName = "") {
-  const env = deps.env ?? process.env;
-  const systemRoot = env["SystemRoot"] ?? "C:\\Windows";
-  const icacls = path.win32.join(systemRoot, "System32", "icacls.exe");
-  const result = deps.spawnSync(icacls, [target]);
-  if (result.error || result.status !== 0) {
-    console.warn(
-      `[braid] warn: icacls verify on ${target} exited ${result.status ?? "null"} \u2014 could not confirm ACL.`
-    );
-    return [];
-  }
-  const stdout = result.stdout ?? "";
-  const ALLOWED = /* @__PURE__ */ new Set([
-    `*${sid}`,
-    "NT AUTHORITY\\SYSTEM",
-    "BUILTIN\\Administrators"
-  ]);
-  const unexpected = [];
-  for (const line of stdout.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const colonIdx = trimmed.search(/:[(A-Z]/);
-    if (colonIdx < 0) continue;
-    let principalRaw = trimmed.slice(0, colonIdx).trim();
-    if (!principalRaw) continue;
-    if (principalRaw.startsWith(target)) {
-      principalRaw = principalRaw.slice(target.length).trim();
-    }
-    if (!principalRaw) continue;
-    const principal = principalRaw;
-    if (ALLOWED.has(principal)) continue;
-    if (principal === sid) continue;
-    if (userName && principal.toLowerCase() === userName) continue;
-    unexpected.push(principal);
-  }
-  if (unexpected.length > 0) {
-    console.warn(
-      `[braid] warn: unexpected principals in ACL on ${target}: ${unexpected.join(", ")}. Consider running: icacls "${target}" /inheritance:r /grant:r "*${sid}:(OI)(CI)F"`
-    );
-  }
-  return unexpected;
-}
-function assertKeystorePerms(dir, agentFile, deps) {
-  const platform = deps?.platform ?? process.platform;
-  if (platform === "win32") {
-    const d = deps ?? productionWin32Deps();
-    const fsExists = d.existsSync ?? existsSync;
-    if (!fsExists(dir)) return;
-    const { sid, userName } = resolveCurrentUser(d);
-    applyWin32Acl(dir, sid, "dir", d);
-    const filePresent = agentFile && agentFile.trim() !== "" && fsExists(agentFile);
-    if (filePresent) {
-      applyWin32Acl(agentFile, sid, "file", d);
-    }
-    verifyWin32Acl(dir, sid, d, userName);
-    if (filePresent) {
-      verifyWin32Acl(agentFile, sid, d, userName);
-    }
-    return;
-  }
-  try {
-    const dmode = statSync(dir).mode & 511;
-    if ((dmode & 63) !== 0) {
-      throw new KeystorePermsError(
-        `[braid] refusing to start: the state directory is accessible to other users on this machine.
-  path : ${dir}
-  mode : ${dmode.toString(8).padStart(3, "0")} (expected 700)
-  fix  : chmod 700 ${dir}`
-      );
-    }
-  } catch (err) {
-    if (err instanceof KeystorePermsError) throw err;
-  }
-  try {
-    const fmode = statSync(agentFile).mode & 511;
-    if ((fmode & 63) !== 0) {
-      throw new KeystorePermsError(
-        `[braid] refusing to start: your agent credential file is readable by other users on this machine.
-  path : ${agentFile}
-  mode : ${fmode.toString(8).padStart(3, "0")} (expected 600)
-  fix  : chmod 600 ${agentFile}`
-      );
-    }
-  } catch (err) {
-    if (err instanceof KeystorePermsError) throw err;
-  }
-}
-function configDir(env = process.env) {
-  const override = env.BRAID_CONFIG_DIR?.trim();
-  return override && override !== "" ? override : join(homedir2(), ".braid");
-}
-function legacyConfigDir(env = process.env) {
-  const override = env.BRAID_CONFIG_DIR?.trim();
-  if (override && override !== "") return null;
-  return join(homedir2(), ".arp");
-}
-function readPathWithFallback(dir, segments, env = process.env) {
-  const primary = join(dir, ...segments);
-  if (existsSync(primary)) return primary;
-  const legacy = legacyTwinPath(dir, segments, env);
-  if (legacy && existsSync(legacy)) return legacy;
-  return primary;
-}
-function legacyTwinPath(dir, segments, env = process.env) {
-  const legacy = legacyConfigDir(env);
-  if (!legacy || dir !== configDir(env)) return null;
-  return join(legacy, ...segments);
-}
-function relayHostSegment(relayUrl) {
-  try {
-    const u = new URL(relayUrl);
-    return `${u.hostname}${u.port ? "_" + u.port : ""}`.replace(/[^a-zA-Z0-9._-]/g, "_");
-  } catch {
-    return relayUrl.replace(/[^a-zA-Z0-9._-]/g, "_");
-  }
-}
-function agentFilePath(dir, relayUrl, agentName) {
-  const safeName = agentName.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return join(dir, "agents", relayHostSegment(relayUrl), `${safeName}.json`);
-}
-function legacyAgentFilePath(dir, relayUrl, agentName, env = process.env) {
-  const safeName = agentName.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return legacyTwinPath(dir, ["agents", relayHostSegment(relayUrl), `${safeName}.json`], env);
-}
-function saveAgent(dir, agent, deps) {
-  const file = agentFilePath(dir, agent.relayUrl, agent.agentName);
-  mkdirSync(dirname(file), { recursive: true, mode: 448 });
-  const tmp = `${file}.tmp-${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(agent, null, 2) + "\n", { mode: 384 });
-  renameSync(tmp, file);
-  try {
-    chmodSync(file, 384);
-  } catch {
-  }
-  const platform = deps?.platform ?? process.platform;
-  if (platform === "win32") {
-    const d = deps ?? productionWin32Deps();
-    try {
-      const { sid } = resolveCurrentUser(d);
-      applyWin32Acl(file, sid, "file", d);
-    } catch (err) {
-      console.warn(
-        `[braid] warn: could not set ACL on agent file ${file} (startup gate will enforce on next start): ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  return file;
-}
-function parsePinnedEndpoints(v) {
-  if (!Array.isArray(v)) return void 0;
-  const out = [];
-  for (const item of v) {
-    if (typeof item !== "object" || item === null || Array.isArray(item)) continue;
-    const o = item;
-    if (typeof o.host === "string" && o.host.trim() !== "" && typeof o.source === "string" && o.source.trim() !== "" && typeof o.pinnedAt === "string" && o.pinnedAt.trim() !== "") {
-      out.push({ host: o.host.trim(), source: o.source.trim(), pinnedAt: o.pinnedAt.trim() });
-    }
-  }
-  return out.length > 0 ? out : void 0;
-}
-function parseScope(v) {
-  if (typeof v !== "object" || v === null || Array.isArray(v)) return void 0;
-  const o = v;
-  const strArr = (x) => Array.isArray(x) && x.every((s) => typeof s === "string") ? x : void 0;
-  const out = {};
-  const allowWrite = strArr(o.allowWrite);
-  if (allowWrite) out.allowWrite = allowWrite;
-  const allowRead = strArr(o.allowRead);
-  if (allowRead) out.allowRead = allowRead;
-  const denyWrite = strArr(o.denyWrite);
-  if (denyWrite) out.denyWrite = denyWrite;
-  const denyRead = strArr(o.denyRead);
-  if (denyRead) out.denyRead = denyRead;
-  if (typeof o.disabled === "boolean") out.disabled = o.disabled;
-  if (o.ipcProfile === "compat" || o.ipcProfile === "strict") out.ipcProfile = o.ipcProfile;
-  if (typeof o.network === "object" && o.network !== null && !Array.isArray(o.network)) {
-    const n = o.network;
-    const net = {};
-    const allowedDomains = strArr(n.allowedDomains);
-    if (allowedDomains) net.allowedDomains = allowedDomains;
-    const deniedDomains = strArr(n.deniedDomains);
-    if (deniedDomains) net.deniedDomains = deniedDomains;
-    if (Object.keys(net).length > 0) out.network = net;
-  }
-  return Object.keys(out).length > 0 ? out : void 0;
-}
-function parseStoredAgent(file) {
-  let raw;
-  try {
-    raw = readFileSync(file, "utf8");
-  } catch {
-    throw new Error(`No saved credential at ${file}`);
-  }
-  let p;
-  try {
-    p = JSON.parse(raw);
-  } catch {
-    throw new Error(`Corrupt credential file at ${file}`);
-  }
-  const a = p;
-  for (const field of ["relayUrl", "agentId", "agentName", "agentUuid", "agentKey"]) {
-    if (typeof a[field] !== "string" || a[field].trim() === "") {
-      throw new Error(`Corrupt credential file at ${file} (missing "${field}")`);
-    }
-  }
-  const tm = a.toolMode;
-  const toolMode = tm === "readonly" || tm === "full" ? tm : void 0;
-  const signingPrivateJwk = typeof a.signingPrivateJwk === "string" && a.signingPrivateJwk.trim() !== "" ? a.signingPrivateJwk : void 0;
-  const signingKid = typeof a.signingKid === "string" && a.signingKid.trim() !== "" ? a.signingKid : void 0;
-  const clerkIssuer = typeof a.clerkIssuer === "string" && a.clerkIssuer.trim() !== "" ? a.clerkIssuer : void 0;
-  const scope = parseScope(a.scope);
-  const pinnedEndpoints = parsePinnedEndpoints(a.pinnedEndpoints);
-  const providerRaw = typeof a.provider === "string" ? a.provider.trim() : void 0;
-  const provider = providerRaw && providerRaw !== "" ? providerRaw : void 0;
-  const model = typeof a.model === "string" && a.model.trim() !== "" ? a.model.trim() : void 0;
-  const fallbackModel = typeof a.fallbackModel === "string" && a.fallbackModel.trim() !== "" ? a.fallbackModel.trim() : void 0;
-  const authRaw = typeof a.auth === "string" ? a.auth.trim() : void 0;
-  const auth = authRaw && AUTH_MODES.includes(authRaw) ? authRaw : void 0;
-  return {
-    relayUrl: a.relayUrl.trim(),
-    agentId: a.agentId.trim(),
-    agentName: a.agentName.trim(),
-    agentUuid: a.agentUuid.trim(),
-    agentKey: a.agentKey.trim(),
-    ...toolMode ? { toolMode } : {},
-    ...provider ? { provider } : {},
-    ...model ? { model } : {},
-    ...auth ? { auth } : {},
-    ...fallbackModel ? { fallbackModel } : {},
-    ...signingPrivateJwk ? { signingPrivateJwk } : {},
-    ...signingKid ? { signingKid } : {},
-    ...clerkIssuer ? { clerkIssuer } : {},
-    ...scope ? { scope } : {},
-    ...pinnedEndpoints ? { pinnedEndpoints } : {}
-  };
-}
-function listAgents(dir) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = scanAgentsDir(dir, seen);
-  const legacy = legacyConfigDir();
-  if (legacy && dir === configDir()) {
-    out.push(...scanAgentsDir(legacy, seen));
-  }
-  return out;
-}
-function scanAgentsDir(dir, seen) {
-  const root = join(dir, "agents");
-  const out = [];
-  let hosts = [];
-  try {
-    hosts = readdirSync(root);
-  } catch {
-    return out;
-  }
-  for (const host of hosts) {
-    let files = [];
-    try {
-      files = readdirSync(join(root, host));
-    } catch {
-      continue;
-    }
-    for (const f of files) {
-      if (!f.endsWith(".json")) continue;
-      const key = join(host, f);
-      if (seen.has(key)) continue;
-      const file = join(root, host, f);
-      try {
-        out.push({ file, agent: parseStoredAgent(file) });
-        seen.add(key);
-      } catch {
-      }
-    }
-  }
-  return out;
-}
-function loadAgent(dir, agentName, multiAgentRemedy = "Run: npx @snowyroad/braid start <name>") {
-  const all = listAgents(dir);
-  if (agentName && agentName.trim() !== "") {
-    const matches = all.filter((e) => e.agent.agentName === agentName.trim());
-    if (matches.length === 0) {
-      const safeName = agentName.trim().replace(/[^a-zA-Z0-9._-]/g, "_");
-      const root = join(dir, "agents");
-      let hosts = [];
-      try {
-        hosts = readdirSync(root);
-      } catch {
-      }
-      for (const host of hosts) {
-        const candidate = join(root, host, `${safeName}.json`);
-        if (existsSync(candidate)) parseStoredAgent(candidate);
-      }
-      throw new Error(
-        `No saved credential for "${agentName}". Run: npx @snowyroad/braid join <code>`
-      );
-    }
-    if (matches.length > 1) {
-      const relays = matches.map((m) => m.agent.relayUrl).join(", ");
-      throw new Error(
-        `Agent "${agentName}" has credentials for multiple relays (${relays}). Set BRAID_CONFIG_DIR or remove the stale file.`
-      );
-    }
-    return matches[0];
-  }
-  if (all.length === 0) {
-    throw new Error("No saved credentials. Run: npx @snowyroad/braid join <code>");
-  }
-  if (all.length > 1) {
-    const names = all.map((e) => e.agent.agentName).join(", ");
-    throw new Error(`Multiple saved agents (${names}). ${multiAgentRemedy}`);
-  }
-  return all[0];
-}
-function acquireAgentLock(agentFile) {
-  const lockFile = `${agentFile}.lock`;
-  const tryAcquire = () => {
-    try {
-      const fd = openSync(lockFile, "wx", 384);
-      writeFileSync(lockFile, String(process.pid));
-      closeSync(fd);
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  if (!tryAcquire()) {
-    let holderPid = NaN;
-    try {
-      holderPid = Number(readFileSync(lockFile, "utf8").trim());
-    } catch {
-    }
-    if (holderPid === process.pid) {
-      return () => {
-        try {
-          unlinkSync(lockFile);
-        } catch {
-        }
-      };
-    }
-    let holderAlive = false;
-    if (Number.isFinite(holderPid) && holderPid > 0) {
-      try {
-        process.kill(holderPid, 0);
-        holderAlive = true;
-      } catch (err) {
-        holderAlive = err.code === "EPERM";
-      }
-    }
-    if (holderAlive) {
-      throw new Error(
-        `This agent is already running on this machine (pid ${holderPid}). Running it twice would trip credential reuse detection.`
-      );
-    }
-    try {
-      unlinkSync(lockFile);
-    } catch {
-    }
-    if (!tryAcquire()) {
-      throw new Error("This agent is already running on this machine.");
-    }
-  }
-  return () => {
-    try {
-      if (existsSync(lockFile) && readFileSync(lockFile, "utf8").trim() === String(process.pid)) {
-        unlinkSync(lockFile);
-      }
-    } catch {
-    }
-  };
-}
-function acquireAgentLockWithLegacy(agentFile, legacyAgentFile) {
-  let releaseLegacy = null;
-  if (legacyAgentFile !== null && existsSync(legacyAgentFile)) {
-    releaseLegacy = acquireAgentLock(legacyAgentFile);
-  }
-  let releasePrimary;
-  try {
-    releasePrimary = acquireAgentLock(agentFile);
-  } catch (err) {
-    releaseLegacy?.();
-    throw err;
-  }
-  return () => {
-    releasePrimary();
-    releaseLegacy?.();
-  };
-}
-function pinEndpoint(dir, agentName, pin) {
-  const entry = loadAgent(dir, agentName);
-  const agent = entry.agent;
-  const existing = agent.pinnedEndpoints ?? [];
-  const next = existing.filter((p) => p.source !== pin.source);
-  next.push({ host: pin.host, source: pin.source, pinnedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  agent.pinnedEndpoints = next;
-  saveAgent(dir, agent);
-}
-
-// src/relayPrompt.ts
-import { createInterface } from "readline";
-
-// src/tty.ts
-var ANSI_RE = /\u001b(?:\[[0-?]*[ -\/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|[@-Z\\-_])/g;
-var CTRL_RE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
-function sanitizeForTty(s) {
-  return s.replace(ANSI_RE, "").replace(CTRL_RE, "");
-}
-function pipeSanitizedToTty(src, dst = process.stderr) {
-  if (!src) return;
-  src.setEncoding("utf8");
-  src.on("data", (chunk) => {
-    const clean = sanitizeForTty(chunk);
-    if (clean) dst.write(clean);
-  });
-}
-var ESC = String.fromCharCode(27);
-function restoreTerminal(out = process.stdout, stdin = process.stdin) {
-  if (!out.isTTY) return;
-  out.write(
-    `${ESC}[?1l${ESC}>${ESC}[?25h${ESC}[?2004l${ESC}[>4;0m${ESC}[?1000l${ESC}[?1002l${ESC}[?1003l${ESC}[?1006l${ESC}7${ESC}[r${ESC}8`
-  );
-  try {
-    if (stdin.isTTY) stdin.setRawMode?.(false);
-  } catch {
-  }
-}
-function isShellSafeName(s) {
-  return /^[A-Za-z0-9_.-]+$/.test(s);
-}
-
-// src/relayPrompt.ts
-function buildRelayPrompt(agentName, matches) {
-  const name = sanitizeForTty(agentName);
-  const rows = matches.map((m, i) => {
-    const n = i + 1;
-    const pad = n < 10 ? " " : "";
-    return `  ${pad}${n}) ${sanitizeForTty(m.agent.relayUrl)}`;
-  }).join("\n");
-  return `Agent "${name}" has saved credentials for multiple relays.
-${rows}
-Which relay should it connect to? [1-${matches.length}]: `;
-}
-async function promptRelaySelection(agentName, matches, input, output) {
-  const rl = createInterface({ input, output });
-  return new Promise((resolve2) => {
-    let resolved = false;
-    const done = (result) => {
-      if (resolved) return;
-      resolved = true;
-      rl.close();
-      resolve2(result);
-    };
-    output.write(buildRelayPrompt(agentName, matches));
-    rl.on("line", (line) => {
-      const t = line.trim();
-      const n = Number(t);
-      if (Number.isInteger(n) && n >= 1 && n <= matches.length) {
-        done(matches[n - 1]);
-        return;
-      }
-      output.write(`Please enter 1-${matches.length}: `);
-    });
-    rl.once("close", () => done(null));
-  });
-}
-async function chooseRelayWhenAmbiguous(agentName, matches, io = { input: process.stdin, output: process.stderr }) {
-  if (io.input.isTTY === true) {
-    return await promptRelaySelection(agentName, matches, io.input, io.output);
-  }
-  return null;
-}
-
-// src/toolPolicy.ts
-import { homedir as homedir3 } from "os";
-import { join as join2, resolve, sep } from "path";
-function narrowestMode(...modes) {
-  for (const m of modes) {
-    if (m === "readonly") return "readonly";
-  }
-  return "full";
-}
-function narrowestOverride(effective, standing) {
-  return effective === "readonly" && standing !== "readonly" ? "readonly" : void 0;
-}
-function toolModeLabel(mode) {
-  return mode === "full" ? "full access" : "read and reply";
-}
-function toolStatusLine(mode, cause = "operator") {
-  if (mode === "full") {
-    return "Tool status: the operator has granted this agent full tool access.";
-  }
-  if (cause === "channel") {
-    return "Tool status: your operator granted this agent full tool access, but THIS CHANNEL restricts you to read-only here. You can still read channel context, sources, tasks, artifacts, and memory, but requests to run commands, edit files, or write to the channel are denied for this channel. This is governed by the channel's own configuration (its capability bundle), NOT your agent's bridge tool mode \u2014 changing the agent's bridge settings will not lift it. A channel admin must adjust the channel's capability bundle to allow writes.";
-  }
-  return "Tool status: this agent runs in read-and-reply mode; requests to run commands or edit files are denied by the operator's bridge settings (changeable with: braid tools full <agent>).";
-}
-var denialHintShown = false;
-function takeDenialHint(policy, cause = "operator") {
-  if (denialHintShown) return null;
-  denialHintShown = true;
-  if (cause === "channel") {
-    return `[braid] This channel restricts this agent to read-only (its capability bundle or a read-only channel policy). The agent's own tool mode is unchanged; adjust the channel's capability bundle in the web app to allow writes.`;
-  }
-  const raw = policy.agentName;
-  const name = raw && isShellSafeName(raw) ? raw : "<agent-name>";
-  return `[braid] To allow tools for this agent: stop the bridge, run \`braid tools full ${name}\`, then start it again (advanced override: BRAID_TOOL_MODE=full).`;
-}
-function parseToolMode(env) {
-  const raw = env.BRAID_TOOL_MODE?.trim();
-  if (!raw) return "readonly";
-  if (raw === "readonly" || raw === "full") return raw;
-  throw new Error(
-    `Invalid BRAID_TOOL_MODE: ${raw}. Expected "readonly" (default) or "full"`
-  );
-}
-var READONLY_ACP_KINDS = /* @__PURE__ */ new Set(["read", "search", "think"]);
-var READONLY_BRAID_MCP_TOOLS = /* @__PURE__ */ new Set([
-  "list_sources",
-  "read_source",
-  "recall",
-  "recall_private",
-  "list_tasks",
-  "list_artifacts",
-  "get_artifact"
-]);
-var FLOOR_BRAID_MCP_TOOLS = /* @__PURE__ */ new Set(["raise_attention"]);
-function braidMcpReadToolName(title) {
-  if (typeof title !== "string" || !title.startsWith("mcp__")) return null;
-  const short = title.slice(title.lastIndexOf("__") + 2);
-  return READONLY_BRAID_MCP_TOOLS.has(short) ? short : null;
-}
-function braidMcpFloorToolName(title) {
-  if (typeof title !== "string" || !title.startsWith("mcp__")) return null;
-  const short = title.slice(title.lastIndexOf("__") + 2);
-  return FLOOR_BRAID_MCP_TOOLS.has(short) ? short : null;
-}
-function expandTilde(p) {
-  if (p === "~") return homedir3();
-  if (p.startsWith("~/") || p.startsWith(`~${sep}`)) return join2(homedir3(), p.slice(2));
-  return p;
-}
-function isInsideConfigDir(configDirAbs, rawPath) {
-  const cfg = resolve(expandTilde(configDirAbs));
-  const p = resolve(expandTilde(rawPath));
-  return p === cfg || p.startsWith(cfg + sep);
-}
-function pathsFromInput(input) {
-  if (input == null || typeof input !== "object") return [];
-  const o = input;
-  const out = [];
-  for (const key of ["file_path", "path", "notebook_path"]) {
-    const v = o[key];
-    if (typeof v === "string" && v.trim() !== "") out.push(v);
-  }
-  return out;
-}
-function findConfigDirHit(configDirAbs, paths) {
-  for (const p of paths) {
-    if (isInsideConfigDir(configDirAbs, p)) return p;
-  }
-  return null;
-}
-function evaluateAcpPermission(mode, configDirAbs, req) {
-  const tc = req.toolCall;
-  const locationPaths = (tc?.locations ?? []).map((l) => l?.path).filter((p) => typeof p === "string" && p.trim() !== "");
-  const candidates = [...locationPaths, ...pathsFromInput(tc?.rawInput)];
-  const hit = findConfigDirHit(configDirAbs, candidates);
-  if (hit) {
-    return { allow: false, reason: `tool call touches the Braid config dir (${hit})` };
-  }
-  const arpFloor = braidMcpFloorToolName(tc?.title);
-  if (arpFloor) {
-    return { allow: true, reason: `floor capability (${arpFloor}): help-request escape hatch, never gated by tool mode` };
-  }
-  if (mode === "full") return { allow: true, reason: "BRAID_TOOL_MODE=full" };
-  const kind = tc?.kind ?? null;
-  if (kind != null && READONLY_ACP_KINDS.has(kind)) {
-    return { allow: true, reason: `read-only tool kind "${kind}"` };
-  }
-  const arpRead = braidMcpReadToolName(tc?.title);
-  if (arpRead) {
-    return { allow: true, reason: `read-only Braid tool ${arpRead}` };
-  }
-  return {
-    allow: false,
-    reason: `tool kind "${kind ?? "unknown"}" is not read-only (readonly / read-and-reply mode)`,
-    deniedByMode: true
-  };
-}
-var READONLY_SDK_TOOLS = /* @__PURE__ */ new Set([
-  "Read",
-  "Grep",
-  "Glob",
-  "TodoWrite",
-  "ExitPlanMode"
-]);
-function evaluateSdkTool(mode, configDirAbs, toolName, input) {
-  const hit = findConfigDirHit(configDirAbs, pathsFromInput(input));
-  if (hit) {
-    return { allow: false, reason: `tool ${toolName} touches the Braid config dir (${hit})` };
-  }
-  const arpFloor = braidMcpFloorToolName(toolName);
-  if (arpFloor) {
-    return { allow: true, reason: `floor capability (${arpFloor}): help-request escape hatch, never gated by tool mode` };
-  }
-  if (mode === "full") return { allow: true, reason: "BRAID_TOOL_MODE=full" };
-  if (READONLY_SDK_TOOLS.has(toolName)) {
-    return { allow: true, reason: `read-only tool ${toolName}` };
-  }
-  const arpRead = braidMcpReadToolName(toolName);
-  if (arpRead) {
-    return { allow: true, reason: `read-only Braid tool ${arpRead}` };
-  }
-  return {
-    allow: false,
-    reason: `tool ${toolName} is not read-only (readonly / read-and-reply mode)`,
-    deniedByMode: true
-  };
-}
-function pickRejectOptionId(req) {
-  const opts = req.options ?? [];
-  const once = opts.find((o) => o.kind === "reject_once");
-  if (once) return once.optionId;
-  const always = opts.find((o) => o.kind === "reject_always");
-  if (always) return always.optionId;
-  return null;
-}
-
-// src/toolModePrompt.ts
-import { createInterface as createInterface2 } from "readline";
-function buildToolModePrompt(agentName) {
-  const name = sanitizeForTty(agentName);
-  return `How much can ${name} do on this machine when channel members ask?
-  1) Read and reply only (recommended): the agent can read and respond, but requests to run commands or edit files are denied
-  2) Full access: channel content can drive the agent to run commands and edit files on this machine
-Choose [1/2] (default 1): `;
-}
-function buildDefaultNote(agentName) {
-  const name = sanitizeForTty(agentName);
-  const cmdName = isShellSafeName(agentName) ? agentName : "<agent-name>";
-  return `[braid] Tool access not chosen for ${name}; defaulting to read and reply. To allow tools later: braid tools full ${cmdName}
-`;
-}
-async function promptToolMode(agentName, input, output) {
-  const rl = createInterface2({ input, output });
-  let closed = false;
-  rl.once("close", () => {
-    closed = true;
-  });
-  const ask = (q) => new Promise((resolve2) => {
-    if (closed) {
-      resolve2(null);
-      return;
-    }
-    rl.once("close", () => resolve2(null));
-    rl.question(q, (answer) => resolve2(answer));
-  });
-  try {
-    let query = buildToolModePrompt(agentName);
-    for (; ; ) {
-      const answer = await ask(query);
-      if (answer === null) return null;
-      const t = answer.trim();
-      if (t === "" || t === "1") return "readonly";
-      if (t === "2") return "full";
-      query = "Please enter 1 or 2 (or press Enter for 1): ";
-    }
-  } finally {
-    rl.close();
-  }
-}
-async function chooseFirstRunToolMode(agentName, io = { input: process.stdin, output: process.stdout }, env = process.env) {
-  if (io.input.isTTY === true) {
-    const chosen = await promptToolMode(agentName, io.input, io.output);
-    if (chosen !== null) return { mode: chosen, persist: true };
-  } else if (env.BRAID_SERVICE === "1") {
-    return { mode: "readonly", persist: true };
-  }
-  io.output.write(buildDefaultNote(agentName));
-  return { mode: "readonly", persist: false };
-}
-
-// src/providerPrompt.ts
-import { createInterface as createInterface3 } from "readline";
-function buildProviderPrompt(agentName) {
-  const name = sanitizeForTty(agentName);
-  const rows = ACP_AGENT_IDS.map((id, i) => {
-    const n = i + 1;
-    const pad = n < 10 ? " " : "";
-    return `  ${pad}${n}) ${id}${id === "claude-code" ? " (default)" : ""}`;
-  }).join("\n");
-  return `Which agent should ${name} run?
-${rows}
-Choose [1-${ACP_AGENT_IDS.length}] (default 1): `;
-}
-async function promptProvider(agentName, input, output) {
-  const rl = createInterface3({ input, output });
-  return new Promise((resolve2) => {
-    let resolved = false;
-    const done = (result) => {
-      if (resolved) return;
-      resolved = true;
-      rl.close();
-      resolve2(result);
-    };
-    output.write(buildProviderPrompt(agentName));
-    rl.on("line", (line) => {
-      const t = line.trim();
-      if (t === "") {
-        done("claude-code");
-        return;
-      }
-      const n = Number(t);
-      if (Number.isInteger(n) && n >= 1 && n <= ACP_AGENT_IDS.length) {
-        done(ACP_AGENT_IDS[n - 1]);
-        return;
-      }
-      if (ACP_AGENT_IDS.includes(t)) {
-        done(t);
-        return;
-      }
-      output.write(
-        `Please enter 1-${ACP_AGENT_IDS.length}, a provider name, or press Enter for claude-code: `
-      );
-    });
-    rl.once("close", () => done(null));
-  });
-}
-async function chooseFirstRunProvider(agentName, io = { input: process.stdin, output: process.stdout }) {
-  if (io.input.isTTY === true) {
-    const chosen = await promptProvider(agentName, io.input, io.output);
-    if (chosen !== null) return { provider: chosen, persist: true };
-  }
-  const name = sanitizeForTty(agentName);
-  io.output.write(
-    `[braid] Provider not chosen for ${name}; defaulting to claude-code. To run a different agent: BRAID_AGENT=<provider> npx @snowyroad/braid start, or re-join with --provider.
-`
-  );
-  return { provider: "claude-code", persist: false };
-}
-
-// src/scope/scopeConfig.ts
-import { realpathSync, readdirSync as readdirSync2, lstatSync } from "fs";
-import { execSync } from "child_process";
-import { join as join3 } from "path";
-function resolveIpcProfile(scope, flagValue) {
-  if (flagValue !== void 0) return flagValue;
-  if (scope?.ipcProfile !== void 0) return scope.ipcProfile;
-  return "compat";
-}
-var STRICT_IPC_ENV_STRIP = [
-  "SSH_AUTH_SOCK",
-  "DOCKER_HOST",
-  "DBUS_SESSION_BUS_ADDRESS",
-  "DBUS_SYSTEM_BUS_ADDRESS",
-  "GPG_AGENT_INFO",
-  "DISPLAY",
-  "WAYLAND_DISPLAY"
-];
-function strictIpcDenyRead(env, lstatFn = lstatSync) {
-  const base = ["/run", "/var/run", "/tmp/.X11-unix"];
-  const xdg = env["XDG_RUNTIME_DIR"];
-  const candidates = xdg ? (() => {
-    const segments = xdg.split("/").filter((s) => s.length > 0);
-    if (!xdg.startsWith("/") || segments.length < 2) {
-      console.warn(
-        `[braid] warn: XDG_RUNTIME_DIR="${xdg}" failed the sanity gate (must be absolute, not "/", and have \u22652 path segments) \u2014 skipping from strict IPC denyRead shroud`
-      );
-      return base;
-    }
-    return [...base, xdg];
-  })() : base;
-  return candidates.filter((p) => {
-    try {
-      return !lstatFn(p).isSymbolicLink();
-    } catch {
-      return true;
-    }
-  });
-}
-var DEFAULT_ALLOWED_DOMAINS = [
-  // Anthropic / Claude
-  "api.anthropic.com",
-  "*.anthropic.com",
-  // OpenAI / Codex
-  "api.openai.com",
-  // Google / Gemini
-  "generativelanguage.googleapis.com",
-  "*.googleapis.com",
-  // xAI / Grok
-  "api.x.ai",
-  // Cursor
-  "api.cursor.sh",
-  // opencode (BL-169): its serve process fetches the models.dev registry AT BOOT;
-  // without it opencode dies inside the jail (`ServeError` / ACP connection closed
-  // on every connect). `models.dev` is repro-CONFIRMED (blocked → 403, allowed →
-  // 200 through the srt proxy). `opencode.ai` (opencode's own service) and the
-  // ChatGPT-sign-in OAuth hosts are opencode's documented auth/boot endpoints
-  // (from the 2026-07-02 dry-run that hard-failed opencode). claude-code was
-  // unaffected because all its hosts were already listed above.
-  "models.dev",
-  "opencode.ai",
-  "*.opencode.ai",
-  "auth.openai.com",
-  "chatgpt.com",
-  // npm
-  "registry.npmjs.org",
-  "*.npmjs.org",
-  // PyPI
-  "pypi.org",
-  "files.pythonhosted.org",
-  // Go modules
-  "proxy.golang.org",
-  // Crates.io
-  "crates.io",
-  "static.crates.io",
-  // Source hosts
-  "github.com",
-  "*.github.com",
-  "*.githubusercontent.com",
-  "gitlab.com",
-  "bitbucket.org"
-];
-var PROVIDER_PATHS = {
-  "claude-code": ["~/.claude", "~/.claude.json"],
-  codex: ["~/.codex"],
-  gemini: ["~/.gemini"],
-  grok: ["~/.grok"],
-  cursor: ["~/.cursor"],
-  opencode: ["~/.local/share/opencode", "~/.config/opencode"],
-  goose: ["~/.config/goose"],
-  cline: ["~/.cline"],
-  copilot: ["~/.copilot"],
-  qwen: ["~/.qwen"]
-};
-function expandHome(p, home) {
-  if (p.startsWith("~/")) return `${home}${p.slice(1)}`;
-  if (p === "~") return home;
-  return p;
-}
-function canonicalize(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
-  }
-}
-function parseEnvList(val) {
-  if (!val) return [];
-  return val.split(/[,:]/).map((s) => s.trim()).filter((s) => s.length > 0);
-}
-function dedup(arr) {
-  return [...new Set(arr)];
-}
-function darwinMdsCacheDir() {
-  try {
-    const cacheRoot = execSync("/usr/bin/getconf DARWIN_USER_CACHE_DIR", {
-      encoding: "utf8"
-    }).trim();
-    if (!cacheRoot) return [];
-    return [`${cacheRoot.replace(/\/+$/, "")}/mds`];
-  } catch {
-    return [];
-  }
-}
-function resolvePaths(paths, home) {
-  return dedup(paths.map((p) => canonicalize(expandHome(p, home))));
-}
-function foldCase(p, platform) {
-  return platform === "darwin" || platform === "win32" ? p.toLowerCase() : p;
-}
-function checkGrantsAgainstReservations(grants, reservations, platform) {
-  const sep2 = platform === "win32" ? "\\" : "/";
-  const out = [];
-  for (const g of grants) {
-    const gf = foldCase(g.path, platform);
-    for (const r of reservations) {
-      const rf = foldCase(r, platform);
-      if (gf === rf) {
-        out.push({ grant: g.path, source: g.source, reservation: r, relation: "equal" });
-      } else if (gf.startsWith(rf + sep2)) {
-        out.push({ grant: g.path, source: g.source, reservation: r, relation: "descendant" });
-      }
-    }
-  }
-  return out;
-}
-function resolveScope(cfg, provider, env, platform = process.platform) {
-  const scope = cfg.scope ?? {};
-  const home = env["HOME"] ?? "";
-  const cwd = env["PWD"] ?? process.cwd();
-  const tmpDir = env["TMPDIR"] ?? "/tmp";
-  const braidConfigDir = env["BRAID_CONFIG_DIR"]?.trim() || expandHome("~/.braid", home);
-  const legacyArpConfigDir = expandHome("~/.arp", home);
-  const protectedConfigDirs = braidConfigDir === legacyArpConfigDir ? [braidConfigDir] : [braidConfigDir, legacyArpConfigDir];
-  const flagOverride = cfg.scopeFlags?.scopeOverride;
-  const disabled = flagOverride !== void 0 ? flagOverride === "off" : scope.disabled === true || env["BRAID_SCOPE"] === "off";
-  const secretDirs = [
-    "~/.ssh",
-    "~/.aws",
-    "~/.gnupg",
-    "~/.kube/config"
-  ].map((p) => expandHome(p, home));
-  const protectedConfigDirEntries = protectedConfigDirs.flatMap((configDirPath) => {
-    if (platform !== "win32") return [configDirPath];
-    try {
-      const children = readdirSync2(configDirPath, { withFileTypes: true });
-      const denied = children.filter((entry) => entry.name !== "runtime").map((entry) => canonicalize(join3(configDirPath, entry.name)));
-      if (denied.length === 0) return [configDirPath];
-      return denied;
-    } catch {
-      return [configDirPath];
-    }
-  });
-  const providerPaths = PROVIDER_PATHS[provider].map((p) => expandHome(p, home));
-  const uid = process.getuid?.();
-  const claudeTmpRoot = provider === "claude-code" && uid !== void 0 ? [`${canonicalize("/tmp")}/claude-${uid}`, `${canonicalize("/tmp")}/claude-*-cwd`] : [];
-  const mdsCacheDir = platform === "darwin" ? darwinMdsCacheDir() : [];
-  const opAllowWrite = (scope.allowWrite ?? []).map((p) => expandHome(p, home));
-  const envAllowWrite = parseEnvList(env["BRAID_SCOPE_ALLOW_WRITE"]).map((p) => expandHome(p, home));
-  const flagAllowWrite = (cfg.scopeFlags?.allowWrite ?? []).map((p) => expandHome(p, home));
-  const rawAllowWrite = [
-    cwd,
-    ...providerPaths,
-    ...claudeTmpRoot,
-    ...mdsCacheDir,
-    expandHome("~/.npm", home),
-    tmpDir,
-    ...opAllowWrite,
-    ...envAllowWrite,
-    ...flagAllowWrite
-  ];
-  const allowWrite = resolvePaths(rawAllowWrite, home);
-  const rawDenyWrite = [
-    ...secretDirs,
-    ...protectedConfigDirEntries,
-    ...(scope.denyWrite ?? []).map((p) => expandHome(p, home)),
-    ...parseEnvList(env["BRAID_SCOPE_DENY_WRITE"]).map((p) => expandHome(p, home))
-  ];
-  const denyWrite = resolvePaths(rawDenyWrite, home);
-  const ipcProfile = resolveIpcProfile(scope, cfg.scopeFlags?.ipcProfile);
-  const rawDenyRead = [
-    ...secretDirs,
-    ...protectedConfigDirEntries,
-    ...(scope.denyRead ?? []).map((p) => expandHome(p, home)),
-    ...parseEnvList(env["BRAID_SCOPE_DENY_READ"]).map((p) => expandHome(p, home))
-  ];
-  const denyRead = dedup([
-    ...resolvePaths(rawDenyRead, home),
-    ...ipcProfile === "strict" && platform === "linux" ? strictIpcDenyRead(env) : []
-  ]);
-  const opAllowRead = (scope.allowRead ?? []).map((p) => expandHome(p, home));
-  const envAllowRead = parseEnvList(env["BRAID_SCOPE_ALLOW_READ"]).map((p) => expandHome(p, home));
-  const flagAllowRead = (cfg.scopeFlags?.allowRead ?? []).map((p) => expandHome(p, home));
-  const rawAllowRead = [
-    ...opAllowRead,
-    ...envAllowRead,
-    ...flagAllowRead
-  ];
-  const allowRead = resolvePaths(rawAllowRead, home);
-  if (!disabled) {
-    const reservations = resolvePaths([...secretDirs, ...protectedConfigDirs], home);
-    const labelled = (paths, source) => resolvePaths(paths, home).map((p) => ({ path: p, source }));
-    const grants = [
-      ...labelled([cwd], "launch directory (cwd)"),
-      ...labelled(providerPaths, "provider default paths"),
-      ...labelled(opAllowWrite, "scope.allowWrite"),
-      ...labelled(envAllowWrite, "BRAID_SCOPE_ALLOW_WRITE"),
-      ...labelled(flagAllowWrite, "--allow-write"),
-      ...labelled(opAllowRead, "scope.allowRead"),
-      ...labelled(envAllowRead, "BRAID_SCOPE_ALLOW_READ"),
-      ...labelled(flagAllowRead, "--allow-read")
-    ];
-    const conflicts = checkGrantsAgainstReservations(grants, reservations, platform);
-    if (conflicts.length > 0) {
-      const detail = conflicts.map((c) => `  - ${c.source}: "${c.grant}" is ${c.relation === "equal" ? "" : "inside "}the protected path "${c.reservation}"`).join("\n");
-      throw new Error(
-        `[braid] SCOPE ERROR: a grant covers a protected credential/secret path and was refused:
-${detail}
-Protected paths (never grantable): ${reservations.join(", ")}
-Narrow the grant to a path outside the protected set. (Ancestor grants like "~" are fine \u2014 the protected dirs are carved back out automatically.)`
-      );
-    }
-    const writableDefaults = resolvePaths(
-      [...providerPaths, expandHome("~/.npm", home), tmpDir],
-      home
-    );
-    const resolvedConfigDir = canonicalize(braidConfigDir);
-    const placement = checkGrantsAgainstReservations(
-      [{ path: resolvedConfigDir, source: "BRAID_CONFIG_DIR" }],
-      writableDefaults,
-      platform
-    );
-    if (placement.length > 0) {
-      const c = placement[0];
-      throw new Error(
-        `[braid] SCOPE ERROR: BRAID_CONFIG_DIR ("${c.grant}") is ${c.relation === "equal" ? "" : "inside "}a default provider-writable location ("${c.reservation}"). The bridge credential store must live outside provider/tmp/npm paths. Move it (default: ~/.braid) or unset BRAID_CONFIG_DIR.`
-      );
-    }
-  }
-  const allowedDomains = dedup([
-    ...DEFAULT_ALLOWED_DOMAINS,
-    ...scope.network?.allowedDomains ?? [],
-    ...cfg.derivedAllowedDomains ?? [],
-    ...parseEnvList(env["BRAID_SCOPE_ALLOW_DOMAINS"]),
-    ...cfg.scopeFlags?.allowDomains ?? []
-  ]);
-  const deniedDomains = dedup([
-    ...scope.network?.deniedDomains ?? [],
-    ...parseEnvList(env["BRAID_SCOPE_DENY_DOMAINS"])
-  ]);
-  function describe() {
-    const lines = [];
-    if (disabled) {
-      lines.push("[scope] SANDBOX DISABLED (BRAID_SCOPE=off or scope.disabled:true) \u2014 agent runs unconfined");
-      return lines;
-    }
-    lines.push("[scope] Agent sandbox is ACTIVE");
-    lines.push(
-      `[scope] protected (never readable/writable by the agent): ${resolvePaths([...secretDirs, ...protectedConfigDirs], home).join(", ")}`
-    );
-    lines.push(`[scope] cwd (writable): ${cwd}`);
-    if (providerPaths.length > 0) {
-      lines.push(`[scope] provider paths (writable): ${providerPaths.join(", ")}`);
-    }
-    lines.push(`[scope] allowed domains (${allowedDomains.length}): ${allowedDomains.slice(0, 5).join(", ")}${allowedDomains.length > 5 ? " ..." : ""}`);
-    if ((cfg.derivedAllowedDomains ?? []).length > 0) {
-      lines.push(`[scope] model endpoints (derived): ${(cfg.derivedAllowedDomains ?? []).join(", ")}`);
-    }
-    lines.push(`[scope] denied read: ${denyRead.join(", ")}`);
-    if (denyWrite.length > 0) {
-      lines.push(`[scope] denied write: ${denyWrite.join(", ")}`);
-    }
-    if (deniedDomains.length > 0) {
-      lines.push(`[scope] denied domains: ${deniedDomains.join(", ")}`);
-    }
-    if (ipcProfile === "compat") {
-      lines.push("[scope] ipc profile: compat \u2014 all unix sockets reachable inside the jail (Linux seccomp constraint)");
-    } else {
-      lines.push("[scope] ipc profile: strict \u2014 /run, /var/run, XDG_RUNTIME_DIR, /tmp/.X11-unix hidden; socket env vars stripped");
-    }
-    lines.push("[scope] To widen: add paths to scope.allowWrite/allowRead in agent config, or BRAID_SCOPE_ALLOW_WRITE/BRAID_SCOPE=off env.");
-    return lines;
-  }
-  return {
-    runtimeConfig: {
-      filesystem: { allowWrite, denyWrite, allowRead, denyRead },
-      network: { allowedDomains, deniedDomains }
-    },
-    disabled,
-    ipcProfile,
-    describe
-  };
-}
-
-// src/cardSigning.ts
-import canonicalize2 from "canonicalize";
-import {
-  FlattenedSign,
-  flattenedVerify,
-  importJWK,
-  exportJWK,
-  calculateJwkThumbprint,
-  generateKeyPair,
-  CompactSign
-} from "jose";
-import { randomUUID } from "crypto";
-var SIGNING_ALG = "EdDSA";
-var REQUIRED_TOP = /* @__PURE__ */ new Set(["name", "description", "skills"]);
-var RELAY_OWNED_TOP = [
-  "version",
-  "provider",
-  "braidKeyAttestation",
-  "arpKeyAttestation"
-  // braid-rename: legacy-accept (old peers' cards must keep verifying)
-];
-function isEmptyValue(v) {
-  if (v === "" || v === null || v === void 0) return true;
-  if (Array.isArray(v)) return v.length === 0;
-  if (typeof v === "object") return Object.keys(v).length === 0;
-  return false;
-}
-function pruneNode(node, requiredKeys) {
-  if (Array.isArray(node)) return node.map((e) => e && typeof e === "object" ? pruneNode(e, /* @__PURE__ */ new Set()) : e);
-  if (!node || typeof node !== "object") return node;
-  const out = {};
-  for (const [k, v] of Object.entries(node)) {
-    const pv = v && typeof v === "object" ? pruneNode(v, /* @__PURE__ */ new Set()) : v;
-    if (requiredKeys.has(k)) {
-      out[k] = pv;
-      continue;
-    }
-    if (isEmptyValue(pv)) continue;
-    out[k] = pv;
-  }
-  return out;
-}
-function pruneForSigning(card) {
-  const clone = JSON.parse(JSON.stringify(card ?? {}));
-  delete clone.signatures;
-  for (const f of RELAY_OWNED_TOP) delete clone[f];
-  if (Array.isArray(clone.supportedInterfaces)) {
-    clone.supportedInterfaces = clone.supportedInterfaces.map((i) => {
-      if (i && typeof i === "object") {
-        const { url, ...rest } = i;
-        return rest;
-      }
-      return i;
-    });
-  }
-  return pruneNode(clone, REQUIRED_TOP);
-}
-function canonicalCardString(card) {
-  return canonicalize2(pruneForSigning(card));
-}
-function publicOkpJwk(jwk) {
-  return { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
-}
-async function generateSigningKey() {
-  const { privateKey } = await generateKeyPair(SIGNING_ALG, { crv: "Ed25519", extractable: true });
-  const privateJwk = await exportJWK(privateKey);
-  const kid = await calculateJwkThumbprint(publicOkpJwk(privateJwk));
-  return { privateJwk, kid };
-}
-async function buildDpopProof(privateJwk, htu) {
-  const key = await importJWK(privateJwk, SIGNING_ALG);
-  const pub = publicOkpJwk(privateJwk);
-  const payload = new TextEncoder().encode(JSON.stringify({
-    htm: "POST",
-    htu,
-    iat: Math.floor(Date.now() / 1e3),
-    jti: randomUUID()
-  }));
-  return await new CompactSign(payload).setProtectedHeader({ alg: SIGNING_ALG, typ: "dpop+jwt", jwk: pub }).sign(key);
-}
-async function signCard(card, privateJwk) {
-  const key = await importJWK(privateJwk, SIGNING_ALG);
-  const pub = publicOkpJwk(privateJwk);
-  const kid = await calculateJwkThumbprint(pub);
-  const payload = new TextEncoder().encode(canonicalCardString(card));
-  const jws = await new FlattenedSign(payload).setProtectedHeader({ alg: SIGNING_ALG, typ: "JOSE", kid, jwk: pub }).sign(key);
-  return [{ protected: jws.protected, signature: jws.signature }];
-}
-async function verifyCardSignature(card) {
-  const sigs = card?.signatures;
-  if (!Array.isArray(sigs) || sigs.length === 0) return { status: "unsigned" };
-  const payload = Buffer.from(canonicalCardString(card), "utf8").toString("base64url");
-  for (const sig of sigs) {
-    try {
-      if (!sig || typeof sig.protected !== "string" || typeof sig.signature !== "string") continue;
-      const header = JSON.parse(Buffer.from(sig.protected, "base64url").toString("utf8"));
-      if (header.alg !== SIGNING_ALG || !header.jwk) continue;
-      const pub = publicOkpJwk(header.jwk);
-      const kid = await calculateJwkThumbprint(pub);
-      if (typeof header.kid !== "string" || header.kid !== kid) continue;
-      const key = await importJWK(pub, SIGNING_ALG);
-      await flattenedVerify({ protected: sig.protected, payload, signature: sig.signature }, key, {
-        algorithms: [SIGNING_ALG]
-      });
-      return { status: "valid", kid };
-    } catch {
-    }
-  }
-  return { status: "invalid" };
-}
-
-// src/messageSigning.ts
-import { createHash, createPrivateKey, sign as cryptoSign } from "crypto";
-var MSG_SIG_VERSION = "braid-msg-v1";
-function cleanContent(content) {
-  let out = "";
-  for (const ch of content) {
-    const cp = ch.codePointAt(0);
-    const isCc = cp <= 31 || cp >= 127 && cp <= 159;
-    if (!isCc || ch === "\n" || ch === "\r" || ch === "	") out += ch;
-  }
-  return out.trim();
-}
-function contentSha256Hex(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function buildMessageEnvelope(kid, f) {
-  return [
-    MSG_SIG_VERSION,
-    f.agentUuid,
-    kid,
-    f.channelId,
-    f.flowId ?? "",
-    f.messageId,
-    String(f.ts),
-    contentSha256Hex(f.content)
-  ].join("\n");
-}
-function makeMessageSigner(privateJwkJson, kid) {
-  let key = null;
-  return (f) => {
-    if (!key) key = createPrivateKey({ key: JSON.parse(privateJwkJson), format: "jwk" });
-    const sig = cryptoSign(null, Buffer.from(buildMessageEnvelope(kid, f), "utf8"), key);
-    return `${MSG_SIG_VERSION}.${kid}.${f.ts}.${sig.toString("base64url")}`;
-  };
-}
-var ART_SIG_VERSION = "braid-art-v1";
-function buildArtifactEnvelope(kid, f) {
-  return [
-    ART_SIG_VERSION,
-    f.agentUuid,
-    kid,
-    f.channelId,
-    f.artifactId,
-    String(f.ts),
-    contentSha256Hex(f.docJson)
-  ].join("\n");
-}
-function makeArtifactSigner(privateJwkJson, kid) {
-  let key = null;
-  return (f) => {
-    if (!key) key = createPrivateKey({ key: JSON.parse(privateJwkJson), format: "jwk" });
-    const sig = cryptoSign(null, Buffer.from(buildArtifactEnvelope(kid, f), "utf8"), key);
-    return `${ART_SIG_VERSION}.${kid}.${f.ts}.${sig.toString("base64url")}`;
-  };
-}
-
-// src/config.ts
-var DEFAULT_MODEL = "claude-opus-4-8";
-var DEFAULT_AGENT_MODE = "acp";
-var DEFAULT_AGENT = "claude-code";
-var VALID_AGENT_MODES = ["acp", "generic"];
-function positiveIntEnv(v, dflt) {
-  const n = v == null ? NaN : Number(v);
-  return Number.isFinite(n) && n > 0 ? Math.floor(n) : dflt;
-}
-function required(env, key) {
-  const v = env[key];
-  if (!v || v.trim() === "") throw new Error(`Missing required env var: ${key}`);
-  return v.trim();
-}
-var GEMINI_AUTH_ENV_KEYS = [
-  "GEMINI_API_KEY",
-  "GOOGLE_API_KEY",
-  "GOOGLE_GENAI_USE_VERTEXAI",
-  "GOOGLE_APPLICATION_CREDENTIALS",
-  "GOOGLE_CLOUD_PROJECT"
-];
-function warnIfGeminiAuthMissing(agent, agentMode, env) {
-  if (agent !== "gemini" || agentMode !== "acp") return;
-  const hasAuth = GEMINI_AUTH_ENV_KEYS.some((k) => env[k] && env[k].trim() !== "");
-  if (hasAuth) return;
-  console.error(
-    `[braid] WARNING: gemini selected but no Gemini API key found in the environment. Google deprecated gemini-cli's free "Sign in with Google" tier on 2026-06-18; without a key the agent will fail to authenticate (IneligibleTierError) and channel messages routed to it will be dropped. Set a Google AI Studio key before starting:
-  export GEMINI_API_KEY=...   (get one free at https://aistudio.google.com/apikey)
-Vertex AI / enterprise users: set GOOGLE_GENAI_USE_VERTEXAI=true and GOOGLE_CLOUD_PROJECT instead.`
-  );
-}
-var ANTHROPIC_KEY_ENV_KEYS2 = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-function detectSubscriptionLogin(env) {
-  const readText = (p) => {
-    try {
-      return readFileSync2(p, "utf8");
-    } catch {
-      return void 0;
-    }
-  };
-  const home = env.HOME?.trim() || homedir4();
-  return hasSubscriptionLogin(env, readText, home, keychainProbeFor(home));
-}
-function isHttpsOrLocalhostUrl(s) {
-  if (/[\s;&|`$(){}<>"'\\]/.test(s)) return false;
-  let parsed;
-  try {
-    parsed = new URL(s);
-  } catch {
-    return false;
-  }
-  if (parsed.protocol === "https:") return true;
-  if (parsed.protocol !== "http:") return false;
-  const h = parsed.hostname.toLowerCase();
-  return h === "localhost" || h === "127.0.0.1";
-}
-function warnIfAnthropicKeyWillBill(agent, agentMode, env) {
-  if (agent !== "claude-code" || agentMode !== "acp") return;
-  const baseUrl = env.ANTHROPIC_BASE_URL?.trim() ?? "";
-  if (baseUrl === "") return;
-  if (!isHttpsOrLocalhostUrl(baseUrl)) {
-    console.error(
-      `[braid] WARNING: ANTHROPIC_BASE_URL is set to "${baseUrl}" which is not https or a localhost address. The gateway key will be sent over a non-encrypted connection. Use an https base URL outside of local development.`
-    );
-  }
-  const present = ANTHROPIC_KEY_ENV_KEYS2.filter((k) => env[k] && env[k].trim() !== "");
-  if (present.length === 0) {
-    console.error(
-      `[braid] WARNING: ANTHROPIC_BASE_URL is set to "${baseUrl}" but neither ANTHROPIC_AUTH_TOKEN nor ANTHROPIC_API_KEY is present. Claude Code will likely fail to authenticate with the gateway. Set ANTHROPIC_AUTH_TOKEN to your gateway key before starting.`
-    );
-    return;
-  }
-  console.error(
-    `[braid] NOTE: ${present.join(" / ")} is set and ANTHROPIC_BASE_URL is "${baseUrl}". Claude Code will send the token to that gateway, not to Anthropic. This bills your gateway account, not your Anthropic account. (Keeping it set is correct -- removing it would disable the gateway.)`
-  );
-}
-function resolveAgentSelection(env, providerOverride) {
-  const agentMode = env.BRAID_AGENT_MODE?.trim() || DEFAULT_AGENT_MODE;
-  if (!VALID_AGENT_MODES.includes(agentMode)) {
-    throw new Error(
-      `Invalid BRAID_AGENT_MODE: ${agentMode}. Expected one of: ${VALID_AGENT_MODES.join(", ")}`
-    );
-  }
-  const agent = providerOverride ?? (env.BRAID_AGENT?.trim() || DEFAULT_AGENT);
-  if (!ACP_AGENT_IDS.includes(agent)) {
-    throw new Error(
-      `Invalid BRAID_AGENT: ${agent}. Expected one of: ${ACP_AGENT_IDS.join(", ")}`
-    );
-  }
-  if (agentMode === "generic") required(env, "ANTHROPIC_API_KEY");
-  warnIfGeminiAuthMissing(agent, agentMode, env);
-  warnIfAnthropicKeyWillBill(agent, agentMode, env);
-  return { agentMode, agent };
-}
-function isLoopbackHost(hostname) {
-  const h = hostname.toLowerCase();
-  return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]" || h.endsWith(".localhost");
-}
-function validateRelayWsUrl(url, env, sourceLabel) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid relay URL from ${sourceLabel}: must start with ws:// or wss://, got: ${url}`);
-  }
-  if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-    throw new Error(`Invalid relay URL from ${sourceLabel}: must start with ws:// or wss://, got: ${url}`);
-  }
-  if (parsed.protocol === "wss:") return;
-  if (isLoopbackHost(parsed.hostname)) return;
-  if (env.BRAID_ALLOW_INSECURE === "1") {
-    console.error(
-      `[braid] WARNING: connecting over cleartext ws:// to ${parsed.hostname} (${sourceLabel}). Credentials and traffic are exposed to the network path. Use wss:// outside local development.`
-    );
-    return;
-  }
-  throw new Error(
-    `Refusing cleartext ws:// relay URL from ${sourceLabel}: ${url}. Credentials sent over ws:// to a non-loopback host are exposed to the network path. Use wss:// instead, or set BRAID_ALLOW_INSECURE=1 for local development.`
-  );
-}
-function loadConfig(env) {
-  const { agentMode, agent } = resolveAgentSelection(env);
-  const relayWsUrl = required(env, "BRAID_RELAY_URL");
-  validateRelayWsUrl(relayWsUrl, env, "BRAID_RELAY_URL");
-  const relayHttpUrl = wsToHttp(relayWsUrl);
-  const agentName = required(env, "BRAID_AGENT_NAME");
-  const knobs = resolveKnobs(void 0, env, void 0);
-  const authMode = knobs.auth.value;
-  const authRes = resolveAnthropicAuth({
-    agent,
-    agentMode,
-    authMode,
-    env,
-    hasSubscriptionLogin: detectSubscriptionLogin(env)
-  });
-  return {
-    relayWsUrl,
-    relayHttpUrl,
-    token: required(env, "BRAID_TOKEN"),
-    agentId: required(env, "BRAID_AGENT_ID"),
-    agentName,
-    agentUuid: required(env, "BRAID_AGENT_UUID"),
-    agentMode,
-    agent,
-    model: env.BRAID_MODEL?.trim() || (agentMode === "acp" ? "" : DEFAULT_MODEL),
-    toolMode: parseToolMode(env),
-    catchUpTtlMs: positiveIntEnv(env.BRAID_CATCHUP_TTL_MS, 72e5),
-    catchUpMaxMentions: positiveIntEnv(env.BRAID_CATCHUP_MAX_MENTIONS, 3),
-    authMode,
-    ...authRes.stripKeys.length > 0 ? { stripEnvKeys: authRes.stripKeys } : {},
-    ...authRes.notices.length > 0 ? { authNotices: authRes.notices } : {},
-    ...knobs.fallbackModel.value ? { fallbackModel: knobs.fallbackModel.value } : {}
-  };
-}
-function wsToHttp(relayWsUrl) {
-  return relayWsUrl.replace(/^wss:\/\//i, "https://").replace(/^ws:\/\//i, "http://");
-}
-async function buildFromStoredAgent(dir, stored, env, flags) {
-  if (stored.provider !== void 0 && !ACP_AGENT_IDS.includes(stored.provider)) {
-    throw new Error(
-      `Invalid provider in saved agent config: ${stored.provider}. Expected one of: ${ACP_AGENT_IDS.join(", ")}`
-    );
-  }
-  const envAgentRaw = env.BRAID_AGENT?.trim();
-  const providerOverride = flags?.provider ?? (envAgentRaw ? void 0 : stored.provider);
-  const { agentMode, agent } = resolveAgentSelection(env, providerOverride);
-  const postureWarnings = computePostureWarnings(flags ?? EMPTY_RUN_FLAGS, env, stored);
-  const relayWsUrl = stored.relayUrl;
-  const file = agentFilePath(dir, stored.relayUrl, stored.agentName);
-  validateRelayWsUrl(relayWsUrl, env, `stored credential ${file}`);
-  const relayHttpUrl = wsToHttp(relayWsUrl);
-  mkdirSync2(dirname2(file), { recursive: true, mode: 448 });
-  const legacyFile = legacyAgentFilePath(dir, stored.relayUrl, stored.agentName, env);
-  const legacyTwinExisted = legacyFile !== null && existsSync2(legacyFile);
-  const release = acquireAgentLockWithLegacy(file, legacyTwinExisted ? legacyFile : null);
-  process.once("exit", release);
-  let current = stored;
-  const envToolMode = env.BRAID_TOOL_MODE?.trim();
-  let toolMode;
-  if (flags?.tools) {
-    toolMode = flags.tools;
-  } else if (envToolMode) {
-    toolMode = parseToolMode(env);
-  } else if (current.toolMode) {
-    toolMode = current.toolMode;
-  } else {
-    const choice = await chooseFirstRunToolMode(current.agentName);
-    toolMode = choice.mode;
-    if (choice.persist) {
-      current = { ...current, toolMode };
-      saveAgent(dir, current);
-    }
-  }
-  let signingPrivateJwk = current.signingPrivateJwk;
-  if (!signingPrivateJwk) {
-    try {
-      const gen = await generateSigningKey();
-      signingPrivateJwk = JSON.stringify(gen.privateJwk);
-      current = { ...current, signingPrivateJwk, signingKid: gen.kid };
-      saveAgent(dir, current);
-    } catch (e) {
-      console.warn("[braid] signing key generation failed; cards will be unsigned:", String(e));
-    }
-  }
-  let clerkIssuer = current.clerkIssuer;
-  let cardAttestation;
-  let inflight = null;
-  const mintToken = () => {
-    if (inflight) return inflight;
-    inflight = (async () => {
-      try {
-        let dpop;
-        if (signingPrivateJwk) {
-          try {
-            dpop = await buildDpopProof(JSON.parse(signingPrivateJwk), `${relayHttpUrl.replace(/\/$/, "")}/agents/token`);
-          } catch (e) {
-            console.warn("[braid] dpop proof build failed; minting without attestation:", String(e));
-          }
-        }
-        const r = await mintAccessToken(relayHttpUrl, current.agentKey, fetch, dpop);
-        current = { ...current, agentKey: r.agentKey };
-        if (r.clerkIssuer && r.clerkIssuer !== clerkIssuer) {
-          clerkIssuer = r.clerkIssuer;
-          current = { ...current, clerkIssuer };
-        }
-        saveAgent(dir, current);
-        if (legacyTwinExisted) {
-          const legacyRoot = legacyConfigDir(env);
-          if (legacyRoot) {
-            try {
-              saveAgent(legacyRoot, current);
-            } catch (e) {
-              console.warn(
-                "[braid] warn: rotated key saved, but updating the pre-rename credential copy failed; an installed pre-rename service may be left with a stale key (migrate it with `braid service install`):",
-                String(e)
-              );
-            }
-          }
-        }
-        cardAttestation = r.cardAttestation;
-        return r.accessToken;
-      } finally {
-        inflight = null;
-      }
-    })();
-    return inflight;
-  };
-  const token = await mintToken();
-  const signCardFn = signingPrivateJwk ? async (card) => {
-    try {
-      const sigs = await signCard(card, JSON.parse(signingPrivateJwk));
-      const signed = { ...card, signatures: sigs };
-      return cardAttestation ? { ...signed, braidKeyAttestation: cardAttestation } : signed;
-    } catch (e) {
-      console.warn("[braid] card signing failed; publishing unsigned:", String(e));
-      return card;
-    }
-  } : void 0;
-  const signMessageFn = signingPrivateJwk && current.signingKid ? makeMessageSigner(signingPrivateJwk, current.signingKid) : void 0;
-  const signArtifactFn = signingPrivateJwk && current.signingKid ? makeArtifactSigner(signingPrivateJwk, current.signingKid) : void 0;
-  const knobs = resolveKnobs(flags, env, current);
-  const authMode = knobs.auth.value;
-  const authRes = resolveAnthropicAuth({
-    agent,
-    agentMode,
-    authMode,
-    env,
-    hasSubscriptionLogin: detectSubscriptionLogin(env)
-  });
-  return {
-    relayWsUrl,
-    relayHttpUrl,
-    token,
-    agentId: stored.agentId,
-    agentName: stored.agentName,
-    agentUuid: stored.agentUuid,
-    agentMode,
-    agent,
-    model: flags?.model ?? (env.BRAID_MODEL?.trim() || void 0) ?? stored.model ?? (agentMode === "acp" ? "" : DEFAULT_MODEL),
-    toolMode,
-    catchUpTtlMs: positiveIntEnv(env.BRAID_CATCHUP_TTL_MS, 72e5),
-    catchUpMaxMentions: positiveIntEnv(env.BRAID_CATCHUP_MAX_MENTIONS, 3),
-    // Persisted per-agent sandbox scope (BL-005): threads into the startup gate,
-    // initScopeRuntime, scopedLaunch, and the handoff. Absent = defaults + env only.
-    ...current.scope ? { scope: current.scope } : {},
-    // BL-149b: per-run scope widenings from flags; consumed by resolveScope.
-    // A-11: ipcProfile is included in the guard and the literal so --ipc-profile
-    // is not silently discarded before resolveScope reads scopeFlags?.ipcProfile.
-    ...flags && (flags.allowWrite.length > 0 || flags.allowRead.length > 0 || flags.allowDomains.length > 0 || flags.scope !== void 0 || flags.ipcProfile !== void 0) ? { scopeFlags: {
-      allowWrite: flags.allowWrite,
-      allowRead: flags.allowRead,
-      allowDomains: flags.allowDomains,
-      ...flags.scope !== void 0 ? { scopeOverride: flags.scope } : {},
-      ...flags.ipcProfile !== void 0 ? { ipcProfile: flags.ipcProfile } : {}
-    } } : {},
-    ...postureWarnings.length > 0 ? { postureWarnings } : {},
-    authMode,
-    ...authRes.stripKeys.length > 0 ? { stripEnvKeys: authRes.stripKeys } : {},
-    ...authRes.notices.length > 0 ? { authNotices: authRes.notices } : {},
-    ...knobs.fallbackModel.value ? { fallbackModel: knobs.fallbackModel.value } : {},
-    mintToken,
-    agentFile: file,
-    ...clerkIssuer ? { clerkIssuer } : {},
-    ...signCardFn ? { signCard: signCardFn } : {},
-    ...signMessageFn ? { signMessage: signMessageFn } : {},
-    ...signArtifactFn ? { signArtifact: signArtifactFn } : {}
-  };
-}
-function parseToolModeForJoin(env) {
-  const raw = env.BRAID_TOOL_MODE?.trim();
-  if (!raw) return void 0;
-  if (raw === "readonly" || raw === "full") return raw;
-  console.error(
-    `[braid] WARNING: invalid BRAID_TOOL_MODE "${raw}" \u2014 expected "readonly" or "full". Ignoring and falling through to the first-run tool-mode prompt.`
-  );
-  return void 0;
-}
-async function loadConfigFromInvite(code, env, flags) {
-  resolveAgentSelection(env, flags?.provider);
-  const joinToolMode = flags?.tools ?? parseToolModeForJoin(env);
-  const envForBuild = env.BRAID_TOOL_MODE && joinToolMode === void 0 ? { ...env, BRAID_TOOL_MODE: void 0 } : env;
-  const inv = decodeInvite(code);
-  validateRelayWsUrl(inv.relayUrl, env, "invite");
-  const relayWsUrl = inv.relayUrl;
-  const relayHttpUrl = wsToHttp(relayWsUrl);
-  const bundle = await redeemInvite(relayHttpUrl, inv.code);
-  let provider = flags?.provider;
-  let providerExplicit = provider !== void 0;
-  if (provider === void 0) {
-    const envAgent = env.BRAID_AGENT?.trim();
-    if (envAgent) {
-      provider = envAgent;
-      providerExplicit = true;
-    }
-  }
-  if (provider === void 0) {
-    const choice = await chooseFirstRunProvider(bundle.agentName);
-    provider = choice.provider;
-    providerExplicit = choice.persist;
-  }
-  const joinModel = flags?.model ?? (env.BRAID_MODEL?.trim() || void 0);
-  const scopePersist = buildJoinScopeBlock(flags, env);
-  const dir = configDir(env);
-  const stored = {
-    relayUrl: relayWsUrl,
-    agentId: bundle.agentId,
-    agentName: bundle.agentName,
-    agentUuid: bundle.agentUuid,
-    agentKey: bundle.agentKey,
-    ...joinToolMode ? { toolMode: joinToolMode } : {},
-    ...providerExplicit ? { provider } : {},
-    ...joinModel ? { model: joinModel } : {},
-    ...scopePersist ? { scope: scopePersist } : {},
-    ...flags?.auth ? { auth: flags.auth } : {},
-    ...flags?.fallbackModel ? { fallbackModel: flags.fallbackModel } : {}
-  };
-  const file = saveAgent(dir, stored);
-  const cmdName = isShellSafeName(bundle.agentName) ? bundle.agentName : "<agent-name>";
-  console.log(`[braid] credential saved to ${file} (restart later with: npx @snowyroad/braid start ${cmdName})`);
-  return buildFromStoredAgent(dir, stored, envForBuild, flags);
-}
-function buildJoinScopeBlock(flags, env) {
-  const split = (v) => v ? v.split(/[,:]/).map((s) => s.trim()).filter((s) => s.length > 0) : [];
-  const dedup2 = (arr) => [...new Set(arr)];
-  const allowWrite = dedup2([...split(env.BRAID_SCOPE_ALLOW_WRITE), ...flags?.allowWrite ?? []]);
-  const allowRead = dedup2([...split(env.BRAID_SCOPE_ALLOW_READ), ...flags?.allowRead ?? []]);
-  const allowedDomains = dedup2([...split(env.BRAID_SCOPE_ALLOW_DOMAINS), ...flags?.allowDomains ?? []]);
-  const disabled = flags?.scope === "off" || flags?.scope === void 0 && env.BRAID_SCOPE === "off";
-  if (allowWrite.length === 0 && allowRead.length === 0 && allowedDomains.length === 0 && !disabled) {
-    return void 0;
-  }
-  return {
-    ...allowWrite.length > 0 ? { allowWrite } : {},
-    ...allowRead.length > 0 ? { allowRead } : {},
-    ...allowedDomains.length > 0 ? { network: { allowedDomains } } : {},
-    ...disabled ? { disabled: true } : {}
-  };
-}
-async function loadConfigFromStore(agentName, env, flags, io) {
-  const dir = configDir(env);
-  const entry = await resolveStoredAgent(dir, agentName, io);
-  return buildFromStoredAgent(dir, entry.agent, env, flags);
-}
-async function resolveStoredAgent(dir, agentName, io) {
-  const name = agentName?.trim();
-  if (name) {
-    const matches = listAgents(dir).filter((e) => e.agent.agentName === name);
-    if (matches.length > 1) {
-      const chosen = await chooseRelayWhenAmbiguous(name, matches, io);
-      return chosen ?? loadAgent(dir, agentName);
-    }
-  }
-  return loadAgent(dir, agentName);
-}
-function getFlag(argv, name) {
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === name) return argv[i + 1] ?? "";
-    if (a.startsWith(`${name}=`)) return a.slice(name.length + 1);
-  }
-  return void 0;
-}
-async function resolveConfig(argv, env) {
-  const parsed = parseRunFlags(argv);
-  if (!parsed.ok) throw new Error(parsed.error);
-  const { flags, rest } = parsed;
-  let positional = rest;
-  if (positional[0] === "join") {
-    const code = positional[1];
-    if (!code || code.trim() === "") throw new Error("Missing value for join");
-    return loadConfigFromInvite(code.trim(), env, flags);
-  }
-  if (positional[0] === "start") {
-    const restAfter = positional.slice(1);
-    const name = restAfter[0] && !restAfter[0].startsWith("-") ? restAfter[0].trim() : void 0;
-    if (name) return loadConfigFromStore(name, env, flags);
-    positional = restAfter;
-  }
-  const argInvite = getFlag(positional, "--invite");
-  if (argInvite !== void 0 && argInvite.trim() === "") {
-    throw new Error("Missing value for --invite");
-  }
-  const invite = (argInvite ?? env.BRAID_INVITE)?.trim();
-  if (invite) return loadConfigFromInvite(invite, env, flags);
-  if (env.BRAID_TOKEN && env.BRAID_TOKEN.trim() !== "") return loadConfig(env);
-  return loadConfigFromStore(void 0, env, flags);
-}
-function parseClaudeConfigModel(jsonText) {
-  try {
-    const parsed = JSON.parse(jsonText);
-    const m = typeof parsed.model === "string" ? parsed.model.trim() : "";
-    return m || null;
-  } catch {
-    return null;
-  }
-}
-function readClaudeConfigModel(agent) {
-  if (agent !== "claude-code") return null;
-  try {
-    const text = readFileSync2(join4(homedir4(), ".claude.json"), "utf8");
-    return parseClaudeConfigModel(text);
-  } catch {
-    return null;
-  }
-}
-function redactConfig(cfg) {
-  let model;
-  if (cfg.agentMode !== "acp") {
-    model = cfg.model;
-  } else if (cfg.model.trim() !== "") {
-    model = cfg.model;
-  } else {
-    const discovered = readClaudeConfigModel(cfg.agent);
-    model = discovered ? `${discovered} (provider default)` : "(provider default)";
-  }
-  return { ...cfg, token: "<redacted>", model };
-}
-function buildVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
-    return String(pkg.version ?? "");
-  } catch {
-    return "";
-  }
-}
-function startingLines(cfg) {
-  const row = (label, value) => `${label.padEnd(8)} : ${value}`;
-  const anthropicCredential = cfg.agentMode !== "acp" || cfg.agent === "claude-code";
-  const catchUpHours = cfg.catchUpTtlMs % 36e5 === 0 ? `${cfg.catchUpTtlMs / 36e5}h` : `${Math.round(cfg.catchUpTtlMs / 6e4)}min`;
-  return [
-    // The running braid version — the fastest way to confirm which build a live bridge
-    // is (BL-229). Sourced from the runtimeVersion threaded onto config; an honest
-    // placeholder shows when it could not be read, never a blank row.
-    row("version", cfg.runtimeVersion ? sanitizeForTty(cfg.runtimeVersion) : "(unknown)"),
-    row("agent", sanitizeForTty(cfg.agentName)),
-    row("relay", sanitizeForTty(cfg.relayWsUrl)),
-    row("provider", cfg.agentMode === "acp" ? cfg.agent : "bundled SDK (generic mode)"),
-    row("model", sanitizeForTty(redactConfig(cfg).model)),
-    row("fallback", cfg.fallbackModel ? sanitizeForTty(cfg.fallbackModel) : "(none \u2014 a rate limit is surfaced, not switched)"),
-    row("tools", cfg.toolMode),
-    row("auth", anthropicCredential ? cfg.authMode ?? "auto" : `(managed by ${cfg.agent})`),
-    row("sandbox", cfg.scope?.disabled ? "OFF (unconfined)" : "on"),
-    row("ipc", resolveIpcProfile(cfg.scope, cfg.scopeFlags?.ipcProfile)),
-    row("catch-up", `${catchUpHours} window \xB7 up to ${cfg.catchUpMaxMentions} missed mentions`),
-    row("keystore", cfg.agentFile ? sanitizeForTty(cfg.agentFile) : "(env-provided credential \u2014 no saved file)")
-  ];
-}
-
-// src/http.ts
-var DEFAULT_TIMEOUT_MS = 15e3;
-var DEFAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
-var warnedInsecure = false;
-function warnInsecureOnce(source) {
-  if (warnedInsecure) return;
-  warnedInsecure = true;
-  console.error(`[braid] WARNING: cleartext http to a non-loopback host allowed by BRAID_ALLOW_INSECURE=1 (${source}). Never use this outside development.`);
-}
-function assertHttpEndpoint(url, source, env = process.env) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`[braid] invalid URL from ${source}: not parseable`);
-  }
-  if (parsed.protocol === "https:") return;
-  if (parsed.protocol !== "http:") throw new Error(`[braid] refusing non-http(s) URL from ${source}`);
-  if (isLoopbackHost(parsed.hostname)) return;
-  if (env.BRAID_ALLOW_INSECURE === "1") {
-    warnInsecureOnce(source);
-    return;
-  }
-  throw new Error(
-    `[braid] refusing cleartext http to a non-loopback host (from ${source}). Use https, or BRAID_ALLOW_INSECURE=1 for local development only.`
-  );
-}
-var metrics = /* @__PURE__ */ new Map();
-function record(cls, ms, err) {
-  const m = metrics.get(cls) ?? { count: 0, errors: {}, totalMs: 0, maxMs: 0 };
-  m.count++;
-  m.totalMs += ms;
-  if (ms > m.maxMs) m.maxMs = ms;
-  if (err) m.errors[err] = (m.errors[err] ?? 0) + 1;
-  metrics.set(cls, m);
-}
-function snapshotHttpMetrics() {
-  return Object.fromEntries([...metrics.entries()].map(([k, v]) => [k, { ...v, errors: { ...v.errors } }]));
-}
-function resetHttpMetricsForTest() {
-  metrics.clear();
-  warnedInsecure = false;
-}
-async function boundedJsonFetch(url, opts) {
-  assertHttpEndpoint(url, opts.requestClass, opts.env ?? process.env);
-  const fetchFn = opts.fetchFn ?? fetch;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const maxBody = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
-  const started = Date.now();
-  const done = (r) => {
-    record(opts.requestClass, Date.now() - started, r.ok ? void 0 : r.category);
-    return r;
-  };
-  let res;
-  try {
-    const signal = AbortSignal.timeout(timeoutMs);
-    const timeoutPromise = new Promise((_, reject) => {
-      const err = Object.assign(new Error(`fetch timed out after ${timeoutMs}ms`), { name: "TimeoutError" });
-      if (signal.aborted) {
-        reject(err);
-        return;
-      }
-      signal.addEventListener("abort", () => reject(err), { once: true });
-    });
-    res = await Promise.race([
-      fetchFn(url, {
-        method: opts.method ?? "GET",
-        ...opts.headers ? { headers: opts.headers } : {},
-        ...opts.body !== void 0 ? { body: opts.body } : {},
-        signal
-      }),
-      timeoutPromise
-    ]);
-  } catch (err) {
-    const name = err?.name ?? "";
-    const isTimeout = name === "TimeoutError" || name === "AbortError";
-    return done({ ok: false, category: isTimeout ? "timeout" : "network", detail: name || "fetch failed" });
-  }
-  if (!res.ok) {
-    const errJson = await (async () => {
-      try {
-        const ct2 = res.headers?.get?.("content-type");
-        if (ct2) {
-          const mime = ct2.split(";")[0].trim().toLowerCase();
-          if (mime !== "application/json" && !mime.endsWith("+json")) return void 0;
-        }
-        const cl2 = Number(res.headers?.get?.("content-length") ?? NaN);
-        if (Number.isFinite(cl2) && cl2 > maxBody) {
-          try {
-            await res.body?.cancel?.();
-          } catch {
-          }
-          return void 0;
-        }
-        let text2;
-        const body = res.body;
-        if (body && typeof body.getReader === "function") {
-          const reader = body.getReader();
-          const chunks = [];
-          let total = 0;
-          for (; ; ) {
-            const { done: eof, value } = await reader.read();
-            if (eof) break;
-            total += value.byteLength;
-            if (total > maxBody) {
-              try {
-                await reader.cancel();
-              } catch {
-              }
-              return void 0;
-            }
-            chunks.push(value);
-          }
-          text2 = Buffer.concat(chunks).toString("utf8");
-        } else if (typeof res.text === "function") {
-          text2 = await res.text();
-          if (text2 !== void 0 && Buffer.byteLength(text2, "utf8") > maxBody) return void 0;
-        } else if (typeof res.json === "function") {
-          return await res.json();
-        }
-        if (text2 === void 0 || text2 === "") return void 0;
-        return JSON.parse(text2);
-      } catch {
-        return void 0;
-      }
-    })();
-    return done({ ok: false, category: "http", status: res.status, detail: `HTTP ${res.status}`, ...errJson !== void 0 ? { json: errJson } : {} });
-  }
-  const ct = res.headers?.get?.("content-type");
-  if (ct) {
-    const mime = ct.split(";")[0].trim().toLowerCase();
-    if (mime !== "application/json" && !mime.endsWith("+json")) {
-      try {
-        await res.body?.cancel?.();
-      } catch {
-      }
-      return done({ ok: false, category: "bad_content_type", status: res.status, detail: mime });
-    }
-  }
-  const cl = Number(res.headers?.get?.("content-length") ?? NaN);
-  if (Number.isFinite(cl) && cl > maxBody) {
-    try {
-      await res.body?.cancel?.();
-    } catch {
-    }
-    return done({ ok: false, category: "too_large", status: res.status, detail: `content-length ${cl} > ${maxBody}` });
-  }
-  let text;
-  try {
-    const body = res.body;
-    if (body && typeof body.getReader === "function") {
-      const reader = body.getReader();
-      const chunks = [];
-      let total = 0;
-      for (; ; ) {
-        const { done: eof, value } = await reader.read();
-        if (eof) break;
-        total += value.byteLength;
-        if (total > maxBody) {
-          try {
-            await reader.cancel();
-          } catch {
-          }
-          return done({ ok: false, category: "too_large", status: res.status, detail: `body exceeded ${maxBody}` });
-        }
-        chunks.push(value);
-      }
-      text = Buffer.concat(chunks).toString("utf8");
-    } else if (typeof res.text === "function") {
-      text = await res.text();
-      if (text !== void 0 && Buffer.byteLength(text, "utf8") > maxBody) {
-        return done({ ok: false, category: "too_large", status: res.status, detail: `body exceeded ${maxBody}` });
-      }
-    }
-  } catch (err) {
-    return done({ ok: false, category: "network", detail: String(err?.message ?? err) });
-  }
-  try {
-    const parsed = text !== void 0 ? text === "" ? void 0 : JSON.parse(text) : await res.json();
-    return done({ ok: true, status: res.status, json: parsed });
-  } catch {
-    return done({ ok: false, category: "bad_json", status: res.status, detail: "malformed JSON body" });
-  }
-}
-
-export {
-  ACP_AGENT_IDS,
-  parseRunFlags,
-  resolveKnobs,
-  newBeyondFile,
-  hasSubscriptionLogin,
-  effectiveAnthropicCredential,
-  macKeychainHasClaudeLogin,
-  decodeInvite,
-  assertHttpEndpoint,
-  snapshotHttpMetrics,
-  resetHttpMetricsForTest,
-  boundedJsonFetch,
-  InviteExpiredError,
-  redeemInvite,
-  RebootstrapError,
-  validateReplacementToken,
-  mintAccessToken,
-  EXIT_OK,
-  EXIT_NEEDS_HUMAN,
-  EXIT_CRASH,
-  KeystorePermsError,
-  classifyFatal,
-  assertKeystorePerms,
-  configDir,
-  readPathWithFallback,
-  legacyTwinPath,
-  relayHostSegment,
-  saveAgent,
-  listAgents,
-  loadAgent,
-  acquireAgentLock,
-  pinEndpoint,
-  sanitizeForTty,
-  pipeSanitizedToTty,
-  restoreTerminal,
-  isShellSafeName,
-  narrowestMode,
-  narrowestOverride,
-  toolModeLabel,
-  toolStatusLine,
-  takeDenialHint,
-  evaluateAcpPermission,
-  evaluateSdkTool,
-  pickRejectOptionId,
-  resolveIpcProfile,
-  STRICT_IPC_ENV_STRIP,
-  resolveScope,
-  verifyCardSignature,
-  cleanContent,
-  resolveAgentSelection,
-  validateRelayWsUrl,
-  wsToHttp,
-  resolveConfig,
-  buildVersion,
-  startingLines
-};