npm - @super-one/cli - Versions diffs - 0.49.4-alpha → 0.50.0-alpha - Mend

@super-one/cli 0.49.4-alpha → 0.50.0-alpha

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/lib/cli.mjs CHANGED Viewed

@@ -3212,6 +3212,13 @@ var init_descriptor = __esm({
   }
 });
+// ../../packages/shared/src/environment/cli-version.ts
+var init_cli_version = __esm({
+  "../../packages/shared/src/environment/cli-version.ts"() {
+    "use strict";
+  }
+});
 // ../../packages/shared/src/environment/known-environment.ts
 var init_known_environment = __esm({
   "../../packages/shared/src/environment/known-environment.ts"() {
@@ -3512,6 +3519,7 @@ var init_environment = __esm({
     init_host_action_browser_catalog();
     init_harness_installation();
     init_descriptor();
+    init_cli_version();
     init_known_environment();
     init_auth();
     init_rpc();
@@ -3584,9 +3592,9 @@ var require_node_gyp_build = __commonJS({
         var debug = getFirst(path.join(dir, "build/Debug"), matchBuild);
         if (debug) return debug;
       }
-      var prebuild = resolve10(dir);
+      var prebuild = resolve12(dir);
       if (prebuild) return prebuild;
-      var nearby = resolve10(path.dirname(process.execPath));
+      var nearby = resolve12(path.dirname(process.execPath));
       if (nearby) return nearby;
       var target = [
         "platform=" + platform2,
@@ -3602,18 +3610,18 @@ var require_node_gyp_build = __commonJS({
         // eslint-disable-line
       ].filter(Boolean).join(" ");
       throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
-      function resolve10(dir2) {
-        var tuples = readdirSync7(path.join(dir2, "prebuilds")).map(parseTuple);
+      function resolve12(dir2) {
+        var tuples = readdirSync8(path.join(dir2, "prebuilds")).map(parseTuple);
         var tuple2 = tuples.filter(matchTuple(platform2, arch2)).sort(compareTuples)[0];
         if (!tuple2) return;
         var prebuilds = path.join(dir2, "prebuilds", tuple2.name);
-        var parsed = readdirSync7(prebuilds).map(parseTags);
+        var parsed = readdirSync8(prebuilds).map(parseTags);
         var candidates = parsed.filter(matchTags(runtime, abi));
         var winner = candidates.sort(compareTags(runtime))[0];
         if (winner) return path.join(prebuilds, winner.file);
       }
     };
-    function readdirSync7(dir) {
+    function readdirSync8(dir) {
       try {
         return fs.readdirSync(dir);
       } catch (err) {
@@ -3621,7 +3629,7 @@ var require_node_gyp_build = __commonJS({
       }
     }
     function getFirst(dir, filter) {
-      var files = readdirSync7(dir).filter(filter);
+      var files = readdirSync8(dir).filter(filter);
       return files[0] && path.join(dir, files[0]);
     }
     function matchBuild(name) {
@@ -8008,12 +8016,12 @@ var init_agent_event_mapper = __esm({
 // ../../packages/codex/src/app-server-client.ts
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 async function openCodexAppServer(opts) {
   if (opts.signal?.aborted) {
     throw new Error("Codex app-server launch interrupted");
   }
-  if (!opts.binaryPath || !existsSync2(opts.binaryPath)) {
+  if (!opts.binaryPath || !existsSync3(opts.binaryPath)) {
     throw new Error(`Codex binary not found: ${opts.binaryPath || "(empty)"}`);
   }
   const spawnFn = opts.spawnFn ?? defaultSpawn;
@@ -8077,21 +8085,21 @@ async function openCodexAppServer(opts) {
   const terminateChild = async () => {
     if (processExited) return;
     const killTimeoutMs = opts.killTimeoutMs ?? 2e3;
-    await new Promise((resolve10) => {
+    await new Promise((resolve12) => {
       if (processExited) {
-        resolve10();
+        resolve12();
         return;
       }
       const onExit = () => {
         clearTimeout(t);
-        resolve10();
+        resolve12();
       };
       child.once("exit", onExit);
       try {
         child.kill("SIGTERM");
       } catch {
         child.removeListener("exit", onExit);
-        resolve10();
+        resolve12();
         return;
       }
       const t = setTimeout(() => {
@@ -8103,7 +8111,7 @@ async function openCodexAppServer(opts) {
         }
         setTimeout(() => {
           child.removeListener("exit", onExit);
-          resolve10();
+          resolve12();
         }, 500);
       }, killTimeoutMs);
     });
@@ -8183,7 +8191,7 @@ async function openCodexAppServer(opts) {
       failAll(safePublicError("Codex app-server read failed", readLoopError));
     }
   })();
-  const request = (method, params, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) => new Promise((resolve10, reject) => {
+  const request = (method, params, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) => new Promise((resolve12, reject) => {
     if (closed) {
       reject(new Error("Codex app-server connection closed"));
       return;
@@ -8201,7 +8209,7 @@ async function openCodexAppServer(opts) {
       pending.delete(id);
       reject(new Error(`Codex app-server ${method} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
-    pending.set(id, { resolve: resolve10, reject, timer });
+    pending.set(id, { resolve: resolve12, reject, timer });
     try {
       writeLine({ jsonrpc: "2.0", id, method, params: params ?? {} });
     } catch (err) {
@@ -8213,9 +8221,9 @@ async function openCodexAppServer(opts) {
   const notify = async (method, params) => {
     writeLine({ jsonrpc: "2.0", method, params: params ?? {} });
   };
-  const nextNotification = (timeoutMs = 3e4) => new Promise((resolve10, reject) => {
+  const nextNotification = (timeoutMs = 3e4) => new Promise((resolve12, reject) => {
     if (notificationQueue.length) {
-      resolve10(notificationQueue.shift());
+      resolve12(notificationQueue.shift());
       return;
     }
     if (readLoopError) {
@@ -8223,16 +8231,16 @@ async function openCodexAppServer(opts) {
       return;
     }
     if (closed) {
-      resolve10(null);
+      resolve12(null);
       return;
     }
     const timer = setTimeout(() => {
       const idx = notificationWaiters.findIndex((w) => w.timer === timer);
       if (idx >= 0) notificationWaiters.splice(idx, 1);
       if (readLoopError) reject(readLoopError);
-      else resolve10(null);
+      else resolve12(null);
     }, timeoutMs);
-    notificationWaiters.push({ resolve: resolve10, reject, timer });
+    notificationWaiters.push({ resolve: resolve12, reject, timer });
   });
   child.stdin.on("error", (err) => {
     const publicErr = safePublicError("Codex app-server stdin error", err);
@@ -9436,7 +9444,7 @@ var init_agent_event_mapper2 = __esm({
 // ../../packages/claude/src/resolve-sdk-binary.ts
 import { createRequire } from "node:module";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 function resolveSdkClaudeBinary() {
   if (cached !== void 0) return cached;
   try {
@@ -9451,7 +9459,7 @@ function resolveSdkClaudeBinary() {
         let p = req.resolve(c);
         if (p.includes("/app.asar/")) p = p.replace("/app.asar/", "/app.asar.unpacked/");
         if (p.includes("\\app.asar\\")) p = p.replace("\\app.asar\\", "\\app.asar.unpacked\\");
-        if (existsSync3(p)) {
+        if (existsSync4(p)) {
           cached = p;
           return p;
         }
@@ -9539,8 +9547,8 @@ var init_message_bridge = __esm({
             if (this.closed) {
               return Promise.resolve({ value: void 0, done: true });
             }
-            return new Promise((resolve10) => {
-              this.waiter = { resolve: resolve10 };
+            return new Promise((resolve12) => {
+              this.waiter = { resolve: resolve12 };
             });
           }
         };
@@ -9550,7 +9558,7 @@ var init_message_bridge = __esm({
 });
 // ../../packages/claude/src/claude-live-session.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { query as sdkQuery2 } from "@anthropic-ai/claude-agent-sdk";
 function buildLiveOptions(opts, onPermission, onQuestion, onPlan, signal, timing) {
@@ -9620,7 +9628,7 @@ function buildLiveOptions(opts, onPermission, onQuestion, onPlan, signal, timing
     if (decision === "allow") return { behavior: "allow" };
     return { behavior: "deny", message: "Permission denied by SuperOne node" };
   };
-  const binaryPath = (opts.binaryPath && existsSync4(opts.binaryPath) ? opts.binaryPath : null) ?? resolveSdkClaudeBinary() ?? void 0;
+  const binaryPath = (opts.binaryPath && existsSync5(opts.binaryPath) ? opts.binaryPath : null) ?? resolveSdkClaudeBinary() ?? void 0;
   const effort = opts.effort === "low" || opts.effort === "medium" || opts.effort === "high" || opts.effort === "xhigh" || opts.effort === "max" ? opts.effort : void 0;
   const env = opts.env ? { ...process.env, ...opts.env } : void 0;
   const base = {
@@ -9716,8 +9724,8 @@ var init_claude_live_session = __esm({
       planHandler;
       timing = { pausedMs: 0 };
       static open(opts) {
-        const binary = (opts.binaryPath && existsSync4(opts.binaryPath) ? opts.binaryPath : null) ?? resolveSdkClaudeBinary();
-        if (opts.binaryPath && !existsSync4(opts.binaryPath)) {
+        const binary = (opts.binaryPath && existsSync5(opts.binaryPath) ? opts.binaryPath : null) ?? resolveSdkClaudeBinary();
+        if (opts.binaryPath && !existsSync5(opts.binaryPath)) {
           throw new Error(`Claude binary not found: ${opts.binaryPath}`);
         }
         if (!binary && !opts.queryFn) {
@@ -9747,7 +9755,7 @@ var init_claude_live_session = __esm({
         const sessionId = this.sdkSessionId || "";
         const priorityNext = input.priorityNext !== false && this.active != null;
         const msg = toUserMessage(input.content, sessionId, priorityNext);
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve12, reject) => {
           if (input.signal?.aborted) {
             reject(new Error("Claude turn interrupted"));
             return;
@@ -9768,10 +9776,10 @@ var init_claude_live_session = __esm({
           };
           input.signal?.addEventListener("abort", onAbort, { once: true });
           if (this.active) {
-            this.pending.push({ tag, msg, input, resolve: resolve10, reject });
+            this.pending.push({ tag, msg, input, resolve: resolve12, reject });
             return;
           }
-          this.startTurn({ tag, msg, input, resolve: resolve10, reject });
+          this.startTurn({ tag, msg, input, resolve: resolve12, reject });
         });
       }
       async dispose() {
@@ -9913,16 +9921,16 @@ var init_claude_live_session = __esm({
 });
 // ../../packages/claude/src/fork-session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, realpathSync, renameSync } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, realpathSync, renameSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { forkSession as defaultSdkForkSession } from "@anthropic-ai/claude-agent-sdk";
 function claudeProjectSlug(p) {
   return p.replace(/[^a-zA-Z0-9]/g, "-");
 }
 function claudeProjectsDir(configDir) {
-  const root = configDir || process.env.CLAUDE_CONFIG_DIR || join3(homedir2(), ".claude");
-  return join3(root, "projects");
+  const root = configDir || process.env.CLAUDE_CONFIG_DIR || join4(homedir2(), ".claude");
+  return join4(root, "projects");
 }
 async function forkClaudeTranscript(input) {
   const providerSessionId = input.providerSessionId?.trim();
@@ -9942,13 +9950,13 @@ async function forkClaudeTranscript(input) {
     throw new Error("Claude forkSession did not return a session id");
   }
   const projectsDir = input.projectsDir ?? claudeProjectsDir();
-  if (!existsSync5(projectsDir)) {
+  if (!existsSync6(projectsDir)) {
     throw new Error(`Claude projects dir not found: ${projectsDir}`);
   }
   let forkedFile = null;
   for (const dir of readdirSync(projectsDir)) {
-    const candidate = join3(projectsDir, dir, `${newSdkId}.jsonl`);
-    if (existsSync5(candidate)) {
+    const candidate = join4(projectsDir, dir, `${newSdkId}.jsonl`);
+    if (existsSync6(candidate)) {
       forkedFile = candidate;
       break;
     }
@@ -9956,9 +9964,9 @@ async function forkClaudeTranscript(input) {
   if (!forkedFile) {
     throw new Error(`forked transcript ${newSdkId}.jsonl not found under ${projectsDir}`);
   }
-  const destDir = join3(projectsDir, claudeProjectSlug(realpathSync(targetCwd)));
+  const destDir = join4(projectsDir, claudeProjectSlug(realpathSync(targetCwd)));
   mkdirSync3(destDir, { recursive: true });
-  const dest = join3(destDir, `${newSdkId}.jsonl`);
+  const dest = join4(destDir, `${newSdkId}.jsonl`);
   if (dest !== forkedFile) {
     renameSync(forkedFile, dest);
   }
@@ -11406,7 +11414,7 @@ var init_session_runtime = __esm({
           eventType: SESSION_DURABLE_EVENT.hostActionRequested,
           payload: { actionId: row.actionId }
         });
-        return new Promise((resolve10) => {
+        return new Promise((resolve12) => {
           const remaining = Math.max(0, row.deadline - Date.now());
           const timer = setTimeout(() => {
             this.cancelHostActionInternal(row.actionId, "deadline_exceeded");
@@ -11433,7 +11441,7 @@ var init_session_runtime = __esm({
               clearTimeout(timer);
               for (const c of abortCleanups) c();
               this.hostActionWaiters.delete(row.actionId);
-              resolve10(result);
+              resolve12(result);
             },
             timer
           });
@@ -11474,14 +11482,14 @@ var init_session_runtime = __esm({
             cursor: existing.length ? existing[existing.length - 1].sequence : this.hostActions.headSequence()
           };
         }
-        await new Promise((resolve10) => {
+        await new Promise((resolve12) => {
           let settled = false;
           const done = () => {
             if (settled) return;
             settled = true;
             this.hostActionPollWaiters.delete(done);
             clearTimeout(timer);
-            resolve10();
+            resolve12();
           };
           const timer = setTimeout(done, waitMs);
           this.hostActionPollWaiters.add(done);
@@ -11727,7 +11735,7 @@ var init_session_runtime = __esm({
         if (session.pendingInteraction) {
           this.rejectPendingPermission(session, "aborted");
         }
-        return new Promise((resolve10) => {
+        return new Promise((resolve12) => {
           let settled = false;
           session.pendingInteraction = interaction;
           session.updatedAt = Date.now();
@@ -11773,7 +11781,7 @@ var init_session_runtime = __esm({
                 payload: { interactionId: interaction.interactionId, decision: "deny" }
               });
             }
-            resolve10(result.decision);
+            resolve12(result.decision);
           };
           const timer = setTimeout(() => {
             settle({ decision: "deny", reason: "timeout" });
@@ -11824,7 +11832,7 @@ var init_session_runtime = __esm({
           this.rejectPendingPermission(session, "aborted");
         }
         const pending = { ...interaction, kind: "question" };
-        return new Promise((resolve10) => {
+        return new Promise((resolve12) => {
           let settled = false;
           session.pendingInteraction = pending;
           session.updatedAt = Date.now();
@@ -11867,7 +11875,7 @@ var init_session_runtime = __esm({
                 payload: { interactionId: pending.interactionId }
               });
             }
-            resolve10(result.answers);
+            resolve12(result.answers);
           };
           const timer = setTimeout(() => {
             settle({ answers: {}, reason: "timeout" });
@@ -11895,7 +11903,7 @@ var init_session_runtime = __esm({
           this.rejectPendingPermission(session, "aborted");
         }
         const pending = { ...interaction, kind: "plan" };
-        return new Promise((resolve10) => {
+        return new Promise((resolve12) => {
           let settled = false;
           session.pendingInteraction = pending;
           session.updatedAt = Date.now();
@@ -11942,7 +11950,7 @@ var init_session_runtime = __esm({
                 payload: { interactionId: pending.interactionId, decision: "reject" }
               });
             }
-            resolve10({ decision: result.decision, options: result.options });
+            resolve12({ decision: result.decision, options: result.options });
           };
           const timer = setTimeout(() => {
             settle({ decision: "reject", reason: "timeout" });
@@ -12024,7 +12032,7 @@ var init_session_runtime = __esm({
             Promise.allSettled(batch).then(() => {
               settled = true;
             }),
-            new Promise((resolve10) => setTimeout(resolve10, remaining))
+            new Promise((resolve12) => setTimeout(resolve12, remaining))
           ]);
           if (!settled && Date.now() >= deadline) break;
         }
@@ -13636,12 +13644,12 @@ var init_resolve_service = __esm({
 // ../../packages/shared/src/attachment-store.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function resolveAttachmentsDir() {
   const override = process.env.SUPERONE_ATTACHMENTS_DIR?.trim();
   if (override) return override;
-  return join4(tmpdir(), SUPERONE_ATTACHMENTS_DIR_NAME);
+  return join5(tmpdir(), SUPERONE_ATTACHMENTS_DIR_NAME);
 }
 function extForAttachmentMime(mimeType) {
   const m = mimeType.toLowerCase();
@@ -13678,7 +13686,7 @@ function persistAttachment(base643, mimeType, opts) {
     const dir = resolveAttachmentsDir();
     mkdirSync4(dir, { recursive: true });
     const fileName = `${randomUUID5()}-${safeFileBase(opts?.name, mimeType)}`;
-    const filePath = join4(dir, fileName);
+    const filePath = join5(dir, fileName);
     writeFileSync2(filePath, buf);
     return filePath;
   } catch {
@@ -13761,26 +13769,26 @@ var init_turn_attachments = __esm({
 });
 // ../../packages/runtime/src/fs/path-security.ts
-import { realpathSync as realpathSync2, existsSync as existsSync6, lstatSync, statSync } from "node:fs";
-import { isAbsolute, join as join5, normalize, resolve, sep } from "node:path";
+import { realpathSync as realpathSync2, existsSync as existsSync7, lstatSync, statSync } from "node:fs";
+import { isAbsolute, join as join6, normalize, resolve, sep } from "node:path";
 function resolveProjectPath(projectRoot2, relativePath) {
   if (relativePath.includes("\0")) {
     return { ok: false, reason: "null byte in path" };
   }
   let root = resolve(projectRoot2);
   try {
-    if (existsSync6(root)) root = realpathSync2(root);
+    if (existsSync7(root)) root = realpathSync2(root);
   } catch {
   }
   if (isAbsolute(relativePath)) {
     return { ok: false, reason: "absolute paths are not allowed" };
   }
-  const candidate = normalize(join5(root, relativePath));
+  const candidate = normalize(join6(root, relativePath));
   if (candidate !== root && !candidate.startsWith(root + sep)) {
     return { ok: false, reason: "path escapes project root" };
   }
   try {
-    if (existsSync6(candidate)) {
+    if (existsSync7(candidate)) {
       const real = realpathSync2(candidate);
       if (real !== root && !real.startsWith(root + sep)) {
         return { ok: false, reason: "symlink escapes project root" };
@@ -13789,13 +13797,13 @@ function resolveProjectPath(projectRoot2, relativePath) {
     }
     let parent = resolve(candidate, "..");
     while (parent === root || parent.startsWith(root + sep)) {
-      if (existsSync6(parent)) {
+      if (existsSync7(parent)) {
         const realParent = realpathSync2(parent);
         if (realParent !== root && !realParent.startsWith(root + sep)) {
           return { ok: false, reason: "parent symlink escapes project root" };
         }
         const remainder = candidate === parent ? "" : candidate.slice(parent.length + (candidate.startsWith(parent + sep) ? sep.length : 0));
-        const absolutePath = remainder ? join5(realParent, remainder) : realParent;
+        const absolutePath = remainder ? join6(realParent, remainder) : realParent;
         if (absolutePath !== realParent && !absolutePath.startsWith(realParent + sep) && absolutePath !== root && !absolutePath.startsWith(root + sep)) {
           return { ok: false, reason: "path escapes project root" };
         }
@@ -13858,15 +13866,15 @@ var init_path_security = __esm({
 });
 // ../../packages/runtime/src/fs/list-files.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 function listFilesUnderRoot(projectRoot2, opts) {
   const startRel = opts?.relativePath?.trim() || ".";
   const resolved = resolveProjectPath(projectRoot2, startRel);
   if (!resolved.ok) {
     throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
   }
-  if (!existsSync7(resolved.absolutePath)) {
+  if (!existsSync8(resolved.absolutePath)) {
     throw Object.assign(new Error("path not found"), { code: "not_found" });
   }
   const st = statSync2(resolved.absolutePath);
@@ -13888,7 +13896,7 @@ function listFilesUnderRoot(projectRoot2, opts) {
     for (const ent of ents) {
       if (out.length >= maxFiles) return;
       if (LIST_FILES_EXCLUDED.has(ent.name) || ent.name === ".DS_Store") continue;
-      const abs = join6(absDir, ent.name);
+      const abs = join7(absDir, ent.name);
       const rel = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
       const check2 = resolveProjectPath(projectRoot2, rel);
       if (!check2.ok) continue;
@@ -13934,11 +13942,11 @@ var init_list_files = __esm({
 });
 // ../../packages/runtime/src/fs/skills-discover.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync3, readFileSync as readFileSync3 } from "node:fs";
+import { join as join8 } from "node:path";
 function safeReadText(path) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return "";
   }
@@ -13972,7 +13980,7 @@ function discoverClaudeSkillsAndCommands(projectRoot2, opts) {
   const seenSkills = /* @__PURE__ */ new Set();
   const seenCommands = /* @__PURE__ */ new Set();
   const scanSkills = (dir, scope) => {
-    if (!existsSync8(dir)) return;
+    if (!existsSync9(dir)) return;
     let ents;
     try {
       ents = readdirSync3(dir, { withFileTypes: true });
@@ -13981,8 +13989,8 @@ function discoverClaudeSkillsAndCommands(projectRoot2, opts) {
     }
     for (const ent of ents) {
       if (!ent.isDirectory()) continue;
-      const skillMd = join7(dir, ent.name, "SKILL.md");
-      if (!existsSync8(skillMd)) continue;
+      const skillMd = join8(dir, ent.name, "SKILL.md");
+      if (!existsSync9(skillMd)) continue;
       if (seenSkills.has(ent.name)) continue;
       seenSkills.add(ent.name);
       const fm = parseSimpleFrontmatter(safeReadText(skillMd));
@@ -13996,7 +14004,7 @@ function discoverClaudeSkillsAndCommands(projectRoot2, opts) {
     }
   };
   const scanCommands = (dir, scope) => {
-    if (!existsSync8(dir)) return;
+    if (!existsSync9(dir)) return;
     let ents;
     try {
       ents = readdirSync3(dir, { withFileTypes: true });
@@ -14008,7 +14016,7 @@ function discoverClaudeSkillsAndCommands(projectRoot2, opts) {
       const name = ent.name.replace(/\.md$/, "");
       if (seenCommands.has(name)) continue;
       seenCommands.add(name);
-      const content = safeReadText(join7(dir, ent.name));
+      const content = safeReadText(join8(dir, ent.name));
       const fm = parseSimpleFrontmatter(content);
       commands.push({
         name,
@@ -14021,12 +14029,12 @@ function discoverClaudeSkillsAndCommands(projectRoot2, opts) {
   };
   const home = opts?.homeDir === void 0 ? process.env.HOME || process.env.USERPROFILE || "" : opts.homeDir || "";
   if (home) {
-    scanSkills(join7(home, ".claude", "skills"), "user");
-    scanCommands(join7(home, ".claude", "commands"), "user");
+    scanSkills(join8(home, ".claude", "skills"), "user");
+    scanCommands(join8(home, ".claude", "commands"), "user");
   }
-  scanSkills(join7(projectRoot2, ".claude", "skills"), "project");
-  scanSkills(join7(projectRoot2, ".agents", "skills"), "project");
-  scanCommands(join7(projectRoot2, ".claude", "commands"), "project");
+  scanSkills(join8(projectRoot2, ".claude", "skills"), "project");
+  scanSkills(join8(projectRoot2, ".agents", "skills"), "project");
+  scanCommands(join8(projectRoot2, ".claude", "commands"), "project");
   return { skills, commands };
 }
 var init_skills_discover = __esm({
@@ -14037,15 +14045,15 @@ var init_skills_discover = __esm({
 // ../../packages/runtime/src/fs/skills-manage.ts
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   rmSync,
   statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename, dirname as dirname3, join as join8, resolve as resolve2, sep as sep2 } from "node:path";
+import { basename, dirname as dirname4, join as join9, resolve as resolve2, sep as sep2 } from "node:path";
 import { homedir as osHomedir } from "node:os";
 function homeOf(opts) {
   return opts?.homeDir ?? osHomedir();
@@ -14053,11 +14061,11 @@ function homeOf(opts) {
 function codexHomeOf(opts) {
   if (opts?.codexHome) return opts.codexHome;
   const env = process.env.CODEX_HOME?.trim();
-  return env || join8(homeOf(opts), ".codex");
+  return env || join9(homeOf(opts), ".codex");
 }
 function parseFrontmatterFile(filePath) {
   try {
-    const content = readFileSync3(filePath, "utf8");
+    const content = readFileSync4(filePath, "utf8");
     const fm = parseSimpleFrontmatter(content);
     let description = fm.description ?? "";
     if (!description && content.startsWith("---")) {
@@ -14092,7 +14100,7 @@ function isDirLike(dirPath, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return statSync3(join8(dirPath, entry.name)).isDirectory();
+      return statSync3(join9(dirPath, entry.name)).isDirectory();
     } catch {
       return false;
     }
@@ -14102,13 +14110,13 @@ function isDirLike(dirPath, entry) {
 function getClaudeSkillDirs(cwd, opts) {
   const home = homeOf(opts);
   const dirs = [
-    { dir: join8(home, ".claude", "skills"), scope: "user" },
-    { dir: join8(cwd, ".claude", "skills"), scope: "project" }
+    { dir: join9(home, ".claude", "skills"), scope: "user" },
+    { dir: join9(cwd, ".claude", "skills"), scope: "project" }
   ];
-  const pluginsFile = join8(home, ".claude", "plugins", "installed_plugins.json");
-  if (existsSync9(pluginsFile)) {
+  const pluginsFile = join9(home, ".claude", "plugins", "installed_plugins.json");
+  if (existsSync10(pluginsFile)) {
     try {
-      const data = JSON.parse(readFileSync3(pluginsFile, "utf8"));
+      const data = JSON.parse(readFileSync4(pluginsFile, "utf8"));
       const plugins = data.plugins ?? {};
       for (const [pluginKey, entries] of Object.entries(plugins)) {
         const pluginName = pluginKey.split("@")[0] ?? pluginKey;
@@ -14118,7 +14126,7 @@ function getClaudeSkillDirs(cwd, opts) {
           const isUser = entry.scope === "user";
           if (!isUser && !isProject) continue;
           dirs.push({
-            dir: join8(entry.installPath, "skills"),
+            dir: join9(entry.installPath, "skills"),
             scope: isUser ? "user" : "project",
             namePrefix: `${pluginName}:`,
             readOnly: true
@@ -14134,16 +14142,16 @@ function getCodexSkillDirs(cwd, opts) {
   const home = homeOf(opts);
   const cHome = codexHomeOf(opts);
   const dirs = [
-    { dir: join8(home, ".agents", "skills"), scope: "user" },
-    { dir: join8(cHome, "skills"), scope: "user" },
-    { dir: join8(cHome, "skills", ".system"), scope: "user", readOnly: true }
+    { dir: join9(home, ".agents", "skills"), scope: "user" },
+    { dir: join9(cHome, "skills"), scope: "user" },
+    { dir: join9(cHome, "skills", ".system"), scope: "user", readOnly: true }
   ];
   if (process.platform !== "win32") {
-    dirs.push({ dir: join8("/etc", "codex", "skills"), scope: "user", readOnly: true });
+    dirs.push({ dir: join9("/etc", "codex", "skills"), scope: "user", readOnly: true });
   }
   dirs.push(
-    { dir: join8(cwd, ".agents", "skills"), scope: "project" },
-    { dir: join8(cwd, ".codex", "skills"), scope: "project" }
+    { dir: join9(cwd, ".agents", "skills"), scope: "project" },
+    { dir: join9(cwd, ".codex", "skills"), scope: "project" }
   );
   return dirs;
 }
@@ -14151,7 +14159,7 @@ function getSkillDirs(provider, cwd, opts) {
   return provider === "codex" ? getCodexSkillDirs(cwd, opts) : getClaudeSkillDirs(cwd, opts);
 }
 function walkSkills(root, relPrefix, depth, scope, seen, skills, namePrefix, readOnly) {
-  const absDir = relPrefix ? join8(root, relPrefix) : root;
+  const absDir = relPrefix ? join9(root, relPrefix) : root;
   let entries;
   try {
     entries = readdirSync4(absDir, { withFileTypes: true });
@@ -14162,20 +14170,20 @@ function walkSkills(root, relPrefix, depth, scope, seen, skills, namePrefix, rea
     if (entry.name.startsWith(".")) continue;
     if (!isDirLike(absDir, entry)) continue;
     const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
-    const skillDir = join8(absDir, entry.name);
-    if (existsSync9(join8(skillDir, "SKILL.md"))) {
+    const skillDir = join9(absDir, entry.name);
+    if (existsSync10(join9(skillDir, "SKILL.md"))) {
       const name = (namePrefix ?? "") + relPath;
       const key = resolve2(skillDir);
       if (!seen.has(key)) {
         seen.add(key);
-        const fm = parseFrontmatterFile(join8(skillDir, "SKILL.md"));
+        const fm = parseFrontmatterFile(join9(skillDir, "SKILL.md"));
         skills.push({
           name,
           displayName: fm.name || entry.name,
           scope,
           description: fm.description,
           argumentHint: fm.argumentHint || void 0,
-          hasConfig: existsSync9(join8(skillDir, "config.json")),
+          hasConfig: existsSync10(join9(skillDir, "config.json")),
           sourcePath: skillDir,
           ...readOnly ? { builtin: true } : {}
         });
@@ -14191,7 +14199,7 @@ function listManagedSkills(provider, cwd, opts) {
   const skills = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { dir, scope, namePrefix, readOnly } of dirs) {
-    if (!existsSync9(dir)) continue;
+    if (!existsSync10(dir)) continue;
     walkSkills(dir, "", 0, scope, seen, skills, namePrefix, readOnly);
   }
   return skills;
@@ -14208,16 +14216,16 @@ function scanDir(dirPath, depth = 0, seen = /* @__PURE__ */ new Set()) {
   }
   try {
     return readdirSync4(dirPath, { withFileTypes: true }).filter((e) => !e.name.startsWith(".")).sort((a, b) => {
-      const aDir = a.isDirectory() || a.isSymbolicLink() && statSync3(join8(dirPath, a.name)).isDirectory();
-      const bDir = b.isDirectory() || b.isSymbolicLink() && statSync3(join8(dirPath, b.name)).isDirectory();
+      const aDir = a.isDirectory() || a.isSymbolicLink() && statSync3(join9(dirPath, a.name)).isDirectory();
+      const bDir = b.isDirectory() || b.isSymbolicLink() && statSync3(join9(dirPath, b.name)).isDirectory();
       if (aDir !== bDir) return aDir ? -1 : 1;
       return a.name.localeCompare(b.name);
     }).map((e) => {
-      const isDir = e.isDirectory() || e.isSymbolicLink() && statSync3(join8(dirPath, e.name)).isDirectory();
+      const isDir = e.isDirectory() || e.isSymbolicLink() && statSync3(join9(dirPath, e.name)).isDirectory();
       return {
         name: e.name,
         isDirectory: isDir,
-        ...isDir ? { children: scanDir(join8(dirPath, e.name), depth + 1, seen) } : {}
+        ...isDir ? { children: scanDir(join9(dirPath, e.name), depth + 1, seen) } : {}
       };
     });
   } catch {
@@ -14236,8 +14244,8 @@ function getManagedSkill(provider, cwd, name, sourcePath, opts) {
     const skillDir = resolveSkillDir(dir, dirName);
     if (!skillDir) continue;
     if (!isPathAtOrWithinAllowed(skillDir, [dir])) continue;
-    const skillMd = join8(skillDir, "SKILL.md");
-    if (!existsSync9(skillMd)) continue;
+    const skillMd = join9(skillDir, "SKILL.md");
+    if (!existsSync10(skillMd)) continue;
     const expectedName = (namePrefix ?? "") + dirName;
     if (expectedName !== name) continue;
     if (sourcePath && resolve2(skillDir) !== resolve2(sourcePath)) continue;
@@ -14248,7 +14256,7 @@ function getManagedSkill(provider, cwd, name, sourcePath, opts) {
       scope,
       description: fm.description,
       argumentHint: fm.argumentHint || void 0,
-      hasConfig: existsSync9(join8(skillDir, "config.json")),
+      hasConfig: existsSync10(join9(skillDir, "config.json")),
       sourcePath: sourcePath ?? skillDir,
       files: scanDir(skillDir)
     };
@@ -14264,16 +14272,16 @@ function readManagedSkillFile(provider, cwd, skillName, relativePath, sourcePath
     const skillDir = resolveSkillDir(dir, dirName);
     if (!skillDir) continue;
     if (!isPathAtOrWithinAllowed(skillDir, [dir])) continue;
-    if (!existsSync9(join8(skillDir, "SKILL.md"))) continue;
+    if (!existsSync10(join9(skillDir, "SKILL.md"))) continue;
     const expectedName = (namePrefix ?? "") + dirName;
     if (expectedName !== skillName) continue;
     if (sourcePath && resolve2(skillDir) !== resolve2(sourcePath)) continue;
     const resolved = resolve2(skillDir, relativePath);
     if (resolved !== skillDir && !resolved.startsWith(skillDir + sep2)) return null;
-    if (!existsSync9(resolved) || statSync3(resolved).isDirectory()) return null;
+    if (!existsSync10(resolved) || statSync3(resolved).isDirectory()) return null;
     if (!isPathAtOrWithinAllowed(resolved, [skillDir])) return null;
     try {
-      return readFileSync3(resolved, "utf8");
+      return readFileSync4(resolved, "utf8");
     } catch {
       return null;
     }
@@ -14318,7 +14326,7 @@ function deleteManagedSkill(provider, cwd, sourcePath, opts) {
       code: "forbidden"
     });
   }
-  if (!existsSync9(join8(target, "SKILL.md"))) {
+  if (!existsSync10(join9(target, "SKILL.md"))) {
     throw Object.assign(new Error("not a skill directory (missing SKILL.md)"), {
       code: "not_found"
     });
@@ -14352,8 +14360,8 @@ function installManagedSkill(provider, cwd, input, opts) {
       code: "failed_precondition"
     });
   }
-  const dest = join8(root.dir, input.name);
-  if (existsSync9(dest)) {
+  const dest = join9(root.dir, input.name);
+  if (existsSync10(dest)) {
     throw Object.assign(new Error(`skill already exists: ${input.name}`), {
       code: "conflict"
     });
@@ -14379,21 +14387,21 @@ function installManagedSkill(provider, cwd, input, opts) {
           code: "invalid_argument"
         });
       }
-      mkdirSync5(dirname3(abs), { recursive: true });
+      mkdirSync5(dirname4(abs), { recursive: true });
       writeFileSync3(abs, content, "utf8");
     }
   } catch (err) {
     rmSync(dest, { recursive: true, force: true });
     throw err;
   }
-  const fm = parseFrontmatterFile(join8(dest, "SKILL.md"));
+  const fm = parseFrontmatterFile(join9(dest, "SKILL.md"));
   return {
     name: input.name,
     displayName: fm.name || input.name,
     scope: input.scope,
     description: fm.description,
     argumentHint: fm.argumentHint || void 0,
-    hasConfig: existsSync9(join8(dest, "config.json")),
+    hasConfig: existsSync10(join9(dest, "config.json")),
     sourcePath: dest
   };
 }
@@ -14410,31 +14418,31 @@ var init_skills_manage = __esm({
 });
 // ../../packages/runtime/src/fs/mcp-config-claude.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
 import { homedir as osHomedir2 } from "node:os";
 function homeOf2(opts) {
   return opts?.homeDir ?? osHomedir2();
 }
 function getUserConfigPath(opts) {
-  return join9(homeOf2(opts), ".claude.json");
+  return join10(homeOf2(opts), ".claude.json");
 }
 function getProjectSettingsPath(cwd) {
-  return join9(cwd, ".claude", "settings.json");
+  return join10(cwd, ".claude", "settings.json");
 }
 function getProjectMcpJsonPath(cwd) {
-  return join9(cwd, ".mcp.json");
+  return join10(cwd, ".mcp.json");
 }
 function readJsonFile(filePath) {
-  if (!existsSync10(filePath)) return {};
+  if (!existsSync11(filePath)) return {};
   try {
-    return JSON.parse(readFileSync4(filePath, "utf8"));
+    return JSON.parse(readFileSync5(filePath, "utf8"));
   } catch {
     return {};
   }
 }
 function writeJsonFile(filePath, data) {
-  mkdirSync6(dirname4(filePath), { recursive: true });
+  mkdirSync6(dirname5(filePath), { recursive: true });
   writeFileSync4(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function extractServers(config2, scope) {
@@ -15464,8 +15472,8 @@ var init_dist = __esm({
 });
 // ../../packages/runtime/src/fs/mcp-config-codex.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join10 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 import { homedir as osHomedir3 } from "node:os";
 function homeOf3(opts) {
   return opts?.homeDir ?? osHomedir3();
@@ -15473,21 +15481,21 @@ function homeOf3(opts) {
 function codexHomeOf2(opts) {
   if (opts?.codexHome) return opts.codexHome;
   const env = process.env.CODEX_HOME?.trim();
-  return env || join10(homeOf3(opts), ".codex");
+  return env || join11(homeOf3(opts), ".codex");
 }
 function getCodexConfigPath(scope, cwd, opts) {
-  return scope === "project" ? join10(cwd, ".codex", "config.toml") : join10(codexHomeOf2(opts), "config.toml");
+  return scope === "project" ? join11(cwd, ".codex", "config.toml") : join11(codexHomeOf2(opts), "config.toml");
 }
 function readConfigFile(filePath) {
-  if (!existsSync11(filePath)) return {};
+  if (!existsSync12(filePath)) return {};
   try {
-    return parse(readFileSync5(filePath, "utf8"));
+    return parse(readFileSync6(filePath, "utf8"));
   } catch {
     return {};
   }
 }
 function writeConfigFile(filePath, data) {
-  mkdirSync7(dirname5(filePath), { recursive: true });
+  mkdirSync7(dirname6(filePath), { recursive: true });
   writeFileSync5(filePath, stringify(data), "utf8");
 }
 function parseConfigFile(filePath, scope) {
@@ -15516,8 +15524,8 @@ function parseConfigFile(filePath, scope) {
   return configs;
 }
 function listCodexMcpConfigs(cwd, opts) {
-  const userConfigs = parseConfigFile(join10(codexHomeOf2(opts), "config.toml"), "user");
-  const projectConfigs = parseConfigFile(join10(cwd, ".codex", "config.toml"), "project");
+  const userConfigs = parseConfigFile(join11(codexHomeOf2(opts), "config.toml"), "user");
+  const projectConfigs = parseConfigFile(join11(cwd, ".codex", "config.toml"), "project");
   const merged = /* @__PURE__ */ new Map();
   for (const config2 of userConfigs) merged.set(config2.name, config2);
   for (const config2 of projectConfigs) merged.set(config2.name, config2);
@@ -15643,11 +15651,11 @@ var init_fs = __esm({
 });
 // src/session/claude-turn-runner.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 function resolveClaudeBinaryPath(opts) {
-  if (opts.binaryPath && existsSync12(opts.binaryPath)) return opts.binaryPath;
+  if (opts.binaryPath && existsSync13(opts.binaryPath)) return opts.binaryPath;
   const status = opts.harnesses?.get("claude");
-  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync12(status.command)) {
+  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync13(status.command)) {
     return status.command;
   }
   if (!opts.skipSdkBinary) {
@@ -15655,7 +15663,7 @@ function resolveClaudeBinaryPath(opts) {
     if (sdk) return sdk;
   }
   const fromEnv = process.env.SUPERONE_CLAUDE_BINARY?.trim();
-  if (fromEnv && existsSync12(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync13(fromEnv)) return fromEnv;
   return null;
 }
 function isClaudeRuntimeRunnable() {
@@ -32987,12 +32995,12 @@ var init_jsonrpc = __esm({
         const id = this.nextRequestId++;
         let cancel = () => {
         };
-        const responsePromise = new Promise((resolve10, reject) => {
+        const responsePromise = new Promise((resolve12, reject) => {
           const pendingResponse = {
             resolve: (response) => {
               try {
                 const value = mapResponse ? mapResponse(response) : response;
-                resolve10(value);
+                resolve12(value);
               } catch (error51) {
                 reject(error51);
               }
@@ -33070,8 +33078,8 @@ var init_jsonrpc = __esm({
       initialize(stream, handlers) {
         this.stream = stream;
         this.staticHandlers = handlers;
-        this.closedPromise = new Promise((resolve10) => {
-          this.abortController.signal.addEventListener("abort", () => resolve10());
+        this.closedPromise = new Promise((resolve12) => {
+          this.abortController.signal.addEventListener("abort", () => resolve12());
         });
         void this.receive();
       }
@@ -33975,8 +33983,8 @@ var init_acp = __esm({
         if (this.failed) {
           return Promise.reject(this.failure);
         }
-        return new Promise((resolve10, reject) => {
-          this.waiters.push({ resolve: resolve10, reject });
+        return new Promise((resolve12, reject) => {
+          this.waiters.push({ resolve: resolve12, reject });
         });
       }
     };
@@ -36775,7 +36783,7 @@ async function stopProcess(child, closed) {
   signalProcess(child, "SIGTERM");
   const stopped = await Promise.race([
     closed.then(() => true),
-    new Promise((resolve10) => setTimeout(() => resolve10(false), KILL_ESCALATE_MS))
+    new Promise((resolve12) => setTimeout(() => resolve12(false), KILL_ESCALATE_MS))
   ]);
   if (stopped) return;
   signalProcess(child, "SIGKILL");
@@ -36803,9 +36811,9 @@ function spawnAcpProcess(launch2) {
   const output = Writable.toWeb(stdin);
   const input = Readable.toWeb(stdout);
   const stream = ndJsonStream(output, input);
-  const closed = new Promise((resolve10) => {
+  const closed = new Promise((resolve12) => {
     child.once("exit", (code, signal) => {
-      resolve10({ code, signal, stderr: stderrChunks.join("") });
+      resolve12({ code, signal, stderr: stderrChunks.join("") });
     });
   });
   let killPromise = null;
@@ -36986,7 +36994,7 @@ var init_run_turn = __esm({
 });
 // ../../packages/acp/src/simulated-runner.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 function createSimulatedAcpTurnRunner(opts) {
   return createSimulatedTurnRunner({
     delayMs: opts?.delayMs ?? 15,
@@ -37000,7 +37008,7 @@ function resolveLaunch(opts) {
   const fromEnv = process.env.SUPERONE_ACP_BINARY?.trim() || process.env.SUPERONE_ACP_COMMAND?.trim() || opts.binaryPath?.trim();
   if (!fromEnv) return null;
   if (fromEnv.includes("/") || fromEnv.includes("\\")) {
-    if (!existsSync13(fromEnv)) return null;
+    if (!existsSync14(fromEnv)) return null;
   }
   return {
     command: fromEnv,
@@ -37064,7 +37072,7 @@ var init_serverSentEvents_gen = __esm({
   "../../node_modules/@opencode-ai/sdk/dist/v2/gen/core/serverSentEvents.gen.js"() {
     createSseClient = ({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url: url2, ...options }) => {
       let lastEventId;
-      const sleep = sseSleepFn ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+      const sleep = sseSleepFn ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
       const createStream = async function* () {
         let retryDelay = sseDefaultRetryDelay ?? 3e3;
         let attempt = 0;
@@ -42548,9 +42556,9 @@ var init_client2 = __esm({
   }
 });
-// ../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/windows.js
+// ../../node_modules/isexe/windows.js
 var require_windows = __commonJS({
-  "../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/windows.js"(exports, module) {
+  "../../node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
     var fs = __require("fs");
@@ -42588,9 +42596,9 @@ var require_windows = __commonJS({
   }
 });
-// ../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/mode.js
+// ../../node_modules/isexe/mode.js
 var require_mode = __commonJS({
-  "../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/mode.js"(exports, module) {
+  "../../node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
     var fs = __require("fs");
@@ -42621,9 +42629,9 @@ var require_mode = __commonJS({
   }
 });
-// ../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/index.js
+// ../../node_modules/isexe/index.js
 var require_isexe = __commonJS({
-  "../../node_modules/cross-spawn/node_modules/which/node_modules/isexe/index.js"(exports, module) {
+  "../../node_modules/isexe/index.js"(exports, module) {
     var fs = __require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
@@ -42642,12 +42650,12 @@ var require_isexe = __commonJS({
         if (typeof Promise !== "function") {
           throw new TypeError("callback not provided");
         }
-        return new Promise(function(resolve10, reject) {
+        return new Promise(function(resolve12, reject) {
           isexe(path, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
-              resolve10(is);
+              resolve12(is);
             }
           });
         });
@@ -42676,9 +42684,9 @@ var require_isexe = __commonJS({
   }
 });
-// ../../node_modules/cross-spawn/node_modules/which/which.js
+// ../../node_modules/which/which.js
 var require_which = __commonJS({
-  "../../node_modules/cross-spawn/node_modules/which/which.js"(exports, module) {
+  "../../node_modules/which/which.js"(exports, module) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
     var path = __require("path");
     var COLON = isWindows ? ";" : ":";
@@ -42713,27 +42721,27 @@ var require_which = __commonJS({
         opt = {};
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
       const found = [];
-      const step = (i) => new Promise((resolve10, reject) => {
+      const step = (i) => new Promise((resolve12, reject) => {
         if (i === pathEnv.length)
-          return opt.all && found.length ? resolve10(found) : reject(getNotFoundError(cmd));
+          return opt.all && found.length ? resolve12(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
         const pCmd = path.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
-        resolve10(subStep(p, i, 0));
+        resolve12(subStep(p, i, 0));
       });
-      const subStep = (p, i, ii) => new Promise((resolve10, reject) => {
+      const subStep = (p, i, ii) => new Promise((resolve12, reject) => {
         if (ii === pathExt.length)
-          return resolve10(step(i + 1));
+          return resolve12(step(i + 1));
         const ext = pathExt[ii];
         isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
           if (!er && is) {
             if (opt.all)
               found.push(p + ext);
             else
-              return resolve10(p + ext);
+              return resolve12(p + ext);
           }
-          return resolve10(subStep(p, i, ii + 1));
+          return resolve12(subStep(p, i, ii + 1));
         });
       });
       return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
@@ -43025,7 +43033,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse4 = require_parse();
     var enoent = require_enoent();
-    function spawn5(command, args, options) {
+    function spawn6(command, args, options) {
       const parsed = parse4(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -43037,8 +43045,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn5;
-    module.exports.spawn = spawn5;
+    module.exports = spawn6;
+    module.exports.spawn = spawn6;
     module.exports.sync = spawnSync2;
     module.exports._parse = parse4;
     module.exports._enoent = enoent;
@@ -43430,24 +43438,24 @@ var init_parse4 = __esm({
 // ../../packages/opencode/src/server.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter, join as join11 } from "node:path";
+import { delimiter, join as join12 } from "node:path";
 function appendOutput(current, chunk) {
   const next = current + chunk.toString();
   return next.length <= maxServerOutput ? next : next.slice(-maxServerOutput);
 }
 function defaultOpenCodeBinaryPath() {
   const filename = process.platform === "win32" ? "opencode.exe" : "opencode";
-  const installed = join11(homedir3(), ".opencode", "bin", filename);
-  return existsSync14(installed) ? installed : filename;
+  const installed = join12(homedir3(), ".opencode", "bin", filename);
+  return existsSync15(installed) ? installed : filename;
 }
 function openCodePath(pathEnv) {
   const home = homedir3();
   const paths = [
-    join11(home, ".opencode", "bin"),
-    join11(home, ".local", "bin"),
-    join11(home, ".bun", "bin"),
+    join12(home, ".opencode", "bin"),
+    join12(home, ".local", "bin"),
+    join12(home, ".bun", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     ...(pathEnv ?? "").split(delimiter)
@@ -43465,7 +43473,7 @@ async function stopChild(child, exited) {
   signalChild(child, "SIGTERM");
   const stopped = await Promise.race([
     exited.then(() => true),
-    new Promise((resolve10) => setTimeout(() => resolve10(false), 1500))
+    new Promise((resolve12) => setTimeout(() => resolve12(false), 1500))
   ]);
   if (stopped) return;
   signalChild(child, "SIGKILL");
@@ -43473,7 +43481,7 @@ async function stopChild(child, exited) {
 }
 async function waitForServer(child, exited, timeoutMs, signal) {
   let output = "";
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve12, reject) => {
     let settled = false;
     const finish = (error51, url2) => {
       if (settled) return;
@@ -43483,7 +43491,7 @@ async function waitForServer(child, exited, timeoutMs, signal) {
       child.stderr.off("data", onData);
       signal?.removeEventListener("abort", onAbort);
       if (error51) reject(error51);
-      else resolve10(url2);
+      else resolve12(url2);
     };
     const onData = (chunk) => {
       output = appendOutput(output, chunk);
@@ -43524,12 +43532,12 @@ async function startOpenCodeServer(opts) {
     },
     stdio: "pipe"
   });
-  const exited = new Promise((resolve10) => {
+  const exited = new Promise((resolve12) => {
     let settled = false;
     const finish = (code, signal) => {
       if (settled) return;
       settled = true;
-      resolve10({ code, signal });
+      resolve12({ code, signal });
     };
     child.once("exit", finish);
     child.once("close", finish);
@@ -43554,7 +43562,7 @@ function isOpenCodeBinaryRunnable(binaryPath) {
   const fromEnv = process.env.SUPERONE_OPENCODE_BINARY?.trim();
   const candidate = binaryPath?.trim() || fromEnv;
   if (!candidate) return false;
-  return existsSync14(candidate);
+  return existsSync15(candidate);
 }
 var OPENCODE_SERVE_ARGS, maxServerOutput;
 var init_server2 = __esm({
@@ -43826,7 +43834,7 @@ var init_harness_runners = __esm({
 });
 // src/session/codex-turn-runner.ts
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync16 } from "node:fs";
 function mapCodexReasoningEffort(effort) {
   if (!effort) return void 0;
   const e = effort.trim().toLowerCase();
@@ -43837,18 +43845,18 @@ function mapCodexReasoningEffort(effort) {
   return void 0;
 }
 function resolveCodexBinaryPath(opts) {
-  if (opts.binaryPath && existsSync15(opts.binaryPath)) return opts.binaryPath;
+  if (opts.binaryPath && existsSync16(opts.binaryPath)) return opts.binaryPath;
   const fromEnv = process.env.SUPERONE_CODEX_BINARY?.trim();
-  if (fromEnv && existsSync15(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync16(fromEnv)) return fromEnv;
   const status = opts.harnesses?.get("codex");
-  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync15(status.command)) {
+  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync16(status.command)) {
     return status.command;
   }
   return null;
 }
 function isCodexBinaryOverrideRunnable() {
   const fromEnv = process.env.SUPERONE_CODEX_BINARY?.trim();
-  return Boolean(fromEnv && existsSync15(fromEnv));
+  return Boolean(fromEnv && existsSync16(fromEnv));
 }
 function createNodeCodexTurnRunner(opts) {
   const simulatedCodex = createSimulatedCodexRunner();
@@ -43967,6 +43975,199 @@ var init_codex_turn_runner = __esm({
   }
 });
+// src/session/managed-harness-official.ts
+var managed_harness_official_exports = {};
+__export(managed_harness_official_exports, {
+  OFFICIAL_CLAUDE_SDK_PACKAGE: () => OFFICIAL_CLAUDE_SDK_PACKAGE,
+  OFFICIAL_CLAUDE_SDK_VERSION: () => OFFICIAL_CLAUDE_SDK_VERSION,
+  OFFICIAL_CODEX_NPM_VERSION: () => OFFICIAL_CODEX_NPM_VERSION,
+  OFFICIAL_CODEX_PACKAGE: () => OFFICIAL_CODEX_PACKAGE,
+  claudePlatformPackageName: () => claudePlatformPackageName,
+  installManagedFromOfficialNpm: () => installManagedFromOfficialNpm,
+  managedNpmPrefix: () => managedNpmPrefix,
+  officialPackageSpecs: () => officialPackageSpecs,
+  resolveOfficialInstallBinary: () => resolveOfficialInstallBinary
+});
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync8, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
+import { arch as osArch2, platform as osPlatform2 } from "node:os";
+import { join as join14, resolve as resolve4 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+function managedNpmPrefix(nodeHome, harnessId) {
+  return resolve4(nodeHome, "managed-npm", harnessId);
+}
+function claudePlatformPackageName() {
+  const p = osPlatform2();
+  const a = osArch2();
+  if (a !== "arm64" && a !== "x64") {
+    throw new Error(`unsupported arch for Claude Agent SDK: ${a}`);
+  }
+  if (p === "darwin") return `@anthropic-ai/claude-agent-sdk-darwin-${a}`;
+  if (p === "win32") return `@anthropic-ai/claude-agent-sdk-win32-${a}`;
+  if (p === "linux") {
+    if (isMuslLinux()) return `@anthropic-ai/claude-agent-sdk-linux-${a}-musl`;
+    return `@anthropic-ai/claude-agent-sdk-linux-${a}`;
+  }
+  throw new Error(`unsupported platform for Claude Agent SDK: ${p}`);
+}
+function isMuslLinux() {
+  try {
+    if (existsSync19("/etc/alpine-release")) return true;
+    const lib = readdirSync5("/lib").some((n) => n.startsWith("ld-musl"));
+    if (lib) return true;
+  } catch {
+  }
+  return false;
+}
+function officialPackageSpecs(harnessId) {
+  if (harnessId === "claude") {
+    const ver2 = process.env.SUPERONE_CLAUDE_SDK_VERSION?.trim() || OFFICIAL_CLAUDE_SDK_VERSION;
+    const platform2 = claudePlatformPackageName();
+    return {
+      runtimeVersion: ver2,
+      specs: [`${OFFICIAL_CLAUDE_SDK_PACKAGE}@${ver2}`, `${platform2}@${ver2}`]
+    };
+  }
+  const ver = process.env.SUPERONE_CODEX_NPM_VERSION?.trim() || OFFICIAL_CODEX_NPM_VERSION;
+  return {
+    runtimeVersion: ver,
+    specs: [`${OFFICIAL_CODEX_PACKAGE}@${ver}`]
+  };
+}
+function resolveOfficialInstallBinary(harnessId, prefix) {
+  if (harnessId === "codex") {
+    const candidates = [
+      join14(prefix, "bin", "codex"),
+      join14(prefix, "bin", "codex.cmd"),
+      join14(prefix, "lib", "node_modules", "@openai", "codex", "bin", "codex.js")
+    ];
+    for (const c of candidates) {
+      if (existsSync19(c) && (c.endsWith(".js") || isExecutableFile(c))) return c;
+    }
+    return null;
+  }
+  const nm = join14(prefix, "lib", "node_modules");
+  const scoped = join14(nm, "@anthropic-ai");
+  try {
+    if (existsSync19(scoped)) {
+      const names = readdirSync5(scoped).filter((n) => n.startsWith("claude-agent-sdk-"));
+      for (const n of names) {
+        const ext = process.platform === "win32" ? ".exe" : "";
+        const bin = join14(scoped, n, `claude${ext}`);
+        if (existsSync19(bin)) return bin;
+      }
+    }
+  } catch {
+  }
+  const direct = join14(
+    nm,
+    ...claudePlatformPackageName().split("/"),
+    process.platform === "win32" ? "claude.exe" : "claude"
+  );
+  if (existsSync19(direct)) return direct;
+  return null;
+}
+function isExecutableFile(path) {
+  try {
+    const st = statSync5(path);
+    if (!st.isFile()) return false;
+    if (process.platform === "win32") return true;
+    return (st.mode & 73) !== 0;
+  } catch {
+    return false;
+  }
+}
+async function installManagedFromOfficialNpm(opts) {
+  const { specs, runtimeVersion } = officialPackageSpecs(opts.harnessId);
+  const prefix = managedNpmPrefix(opts.nodeHome, opts.harnessId);
+  mkdirSync9(prefix, { recursive: true });
+  const existing = resolveOfficialInstallBinary(opts.harnessId, prefix);
+  if (existing) {
+    return {
+      harnessId: opts.harnessId,
+      command: existing,
+      runtimeVersion: readInstalledVersion(prefix, opts.harnessId) ?? runtimeVersion,
+      source: "official-npm",
+      packageSpec: specs.join(" "),
+      installPrefix: prefix
+    };
+  }
+  const runNpm = opts.runNpm ?? defaultRunNpm;
+  await runNpm(
+    ["install", "--prefix", prefix, "--omit=dev", "--no-fund", "--no-audit", ...specs],
+    prefix
+  );
+  const command = resolveOfficialInstallBinary(opts.harnessId, prefix);
+  if (!command) {
+    throw new Error(
+      `official npm install of ${specs.join(" ")} succeeded but binary was not found under ${prefix}`
+    );
+  }
+  return {
+    harnessId: opts.harnessId,
+    command,
+    runtimeVersion: readInstalledVersion(prefix, opts.harnessId) ?? runtimeVersion,
+    source: "official-npm",
+    packageSpec: specs.join(" "),
+    installPrefix: prefix
+  };
+}
+function readInstalledVersion(prefix, harnessId) {
+  try {
+    const pkgPath = harnessId === "claude" ? join14(prefix, "lib", "node_modules", "@anthropic-ai", "claude-agent-sdk", "package.json") : join14(prefix, "lib", "node_modules", "@openai", "codex", "package.json");
+    if (!existsSync19(pkgPath)) return null;
+    const raw = JSON.parse(readFileSync8(pkgPath, "utf8"));
+    return raw.version?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function defaultRunNpm(args, cwd) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn4("npm", args, {
+      cwd,
+      env: { ...process.env, npm_config_update_notifier: "false" },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stderr = "";
+    child.stderr?.on("data", (c) => {
+      stderr += c.toString();
+    });
+    child.on("error", (err) => {
+      reject(
+        new Error(
+          `failed to spawn npm (${err.message}). Node.js/npm is required on the host for official harness install.`
+        )
+      );
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error(`npm install timed out after 10m: npm ${args.join(" ")}`));
+    }, 10 * 6e4);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else {
+        reject(
+          new Error(
+            `npm install failed (exit ${code}): npm ${args.join(" ")}
+${stderr.slice(-1200)}`
+          )
+        );
+      }
+    });
+  });
+}
+var OFFICIAL_CLAUDE_SDK_VERSION, OFFICIAL_CODEX_NPM_VERSION, OFFICIAL_CLAUDE_SDK_PACKAGE, OFFICIAL_CODEX_PACKAGE;
+var init_managed_harness_official = __esm({
+  "src/session/managed-harness-official.ts"() {
+    "use strict";
+    OFFICIAL_CLAUDE_SDK_VERSION = "0.3.223";
+    OFFICIAL_CODEX_NPM_VERSION = "0.146.1";
+    OFFICIAL_CLAUDE_SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
+    OFFICIAL_CODEX_PACKAGE = "@openai/codex";
+  }
+});
 // src/session/harness-fork.ts
 var harness_fork_exports = {};
 __export(harness_fork_exports, {
@@ -44414,11 +44615,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants2);
+          this.rhs = optimizeExpr(this.rhs, names, constants3);
         return this;
       }
       get names() {
@@ -44435,10 +44636,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants2);
+        this.rhs = optimizeExpr(this.rhs, names, constants3);
         return this;
       }
       get names() {
@@ -44499,8 +44700,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants2) {
-        this.code = optimizeExpr(this.code, names, constants2);
+      optimizeNames(names, constants3) {
+        this.code = optimizeExpr(this.code, names, constants3);
         return this;
       }
       get names() {
@@ -44529,12 +44730,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants2))
+          if (n.optimizeNames(names, constants3))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -44587,12 +44788,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants2);
-        if (!(super.optimizeNames(names, constants2) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants3);
+        if (!(super.optimizeNames(names, constants3) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants2);
+        this.condition = optimizeExpr(this.condition, names, constants3);
         return this;
       }
       get names() {
@@ -44615,10 +44816,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants3) {
+        if (!super.optimizeNames(names, constants3))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants2);
+        this.iteration = optimizeExpr(this.iteration, names, constants3);
         return this;
       }
       get names() {
@@ -44654,10 +44855,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants3) {
+        if (!super.optimizeNames(names, constants3))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants2);
+        this.iterable = optimizeExpr(this.iterable, names, constants3);
         return this;
       }
       get names() {
@@ -44699,11 +44900,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants3) {
         var _a3, _b;
-        super.optimizeNames(names, constants2);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants2);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants2);
+        super.optimizeNames(names, constants3);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants3);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants3);
         return this;
       }
       get names() {
@@ -45004,7 +45205,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants2) {
+    function optimizeExpr(expr, names, constants3) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -45019,14 +45220,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants2[n.str];
+        const c = constants3[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants3[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -46988,7 +47189,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve10.call(this, root, ref);
+      let _sch = resolve12.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -47015,7 +47216,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve10(root, ref) {
+    function resolve12(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -47646,7 +47847,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve10(baseURI, relativeURI, options) {
+    function resolve12(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -47904,7 +48105,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize2,
-      resolve: resolve10,
+      resolve: resolve12,
       resolveComponent,
       equal,
       serialize,
@@ -50895,7 +51096,7 @@ var require_dist = __commonJS({
 // src/cli.ts
 import { homedir as homedir7 } from "node:os";
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 // src/config.ts
 import { homedir } from "node:os";
@@ -50929,10 +51130,59 @@ function nodePaths(nodeHome) {
   };
 }
+// src/cli-release-version.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveCliReleaseVersion() {
+  const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
+  if (fromEnv) return fromEnv;
+  if ("0.50.0-alpha".trim()) {
+    return "0.50.0-alpha".trim();
+  }
+  const fromDist = readDistManifestVersion();
+  if (fromDist) return fromDist;
+  const fromRepo = readMonorepoPackageVersion();
+  if (fromRepo) return fromRepo;
+  throw new Error(
+    "unable to determine CLI version for harness release coupling (set SUPERONE_CLI_VERSION or use a built dist with MANIFEST.json)"
+  );
+}
+function readDistManifestVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+      join2(here, "..", "MANIFEST.json"),
+      join2(here, "MANIFEST.json"),
+      join2(here, "..", "..", "MANIFEST.json")
+    ];
+    for (const p of candidates) {
+      if (!existsSync(p)) continue;
+      const raw = JSON.parse(readFileSync(p, "utf8"));
+      if (typeof raw.version === "string" && raw.version.trim()) return raw.version.trim();
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function readMonorepoPackageVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const rootPkg = join2(here, "..", "..", "..", "package.json");
+    if (!existsSync(rootPkg)) return null;
+    const raw = JSON.parse(readFileSync(rootPkg, "utf8"));
+    if (typeof raw.version === "string" && raw.version.trim()) return raw.version.trim();
+  } catch {
+    return null;
+  }
+  return null;
+}
 // src/identity.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { hostname, userInfo } from "node:os";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join3 } from "node:path";
 import { createPublicKey as createPublicKey2 } from "node:crypto";
 // ../../packages/runtime/src/crypto/crypto-util.ts
@@ -51035,7 +51285,7 @@ function ensureDir(path, mode = 448) {
   }
 }
 function writeSecretFile(path, content) {
-  ensureDir(dirname(path));
+  ensureDir(dirname2(path));
   writeFileSync(path, content, { encoding: "utf8", mode: 384 });
   try {
     chmodSync(path, 384);
@@ -51057,8 +51307,8 @@ function loadOrCreateIdentity(nodeHome, label) {
   ensureDir(paths.secretsDir);
   ensureDir(paths.logsDir);
   let environmentId;
-  if (existsSync(paths.environmentId)) {
-    environmentId = readFileSync(paths.environmentId, "utf8").trim();
+  if (existsSync2(paths.environmentId)) {
+    environmentId = readFileSync2(paths.environmentId, "utf8").trim();
     if (!environmentId) {
       environmentId = crypto.randomUUID();
       writeSecretFile(paths.environmentId, `${environmentId}
@@ -51070,8 +51320,8 @@ function loadOrCreateIdentity(nodeHome, label) {
 `);
   }
   let keyPair;
-  if (existsSync(paths.instanceKey)) {
-    const privateKeyPem = readFileSync(paths.instanceKey, "utf8");
+  if (existsSync2(paths.instanceKey)) {
+    const privateKeyPem = readFileSync2(paths.instanceKey, "utf8");
     const privateKey = loadPrivateKey(privateKeyPem);
     const publicKey = createPublicKey2(privateKey);
     const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
@@ -51087,11 +51337,11 @@ function loadOrCreateIdentity(nodeHome, label) {
     writeSecretFile(paths.instanceKey, keyPair.privateKeyPem);
   }
   const bindingHash = computeBindingHash(nodeHome);
-  const bindingPath = join2(paths.secretsDir, "binding-hash");
+  const bindingPath = join3(paths.secretsDir, "binding-hash");
   let persistedBindingHash = null;
   let identityConflict = false;
-  if (existsSync(bindingPath)) {
-    persistedBindingHash = readFileSync(bindingPath, "utf8").trim() || null;
+  if (existsSync2(bindingPath)) {
+    persistedBindingHash = readFileSync2(bindingPath, "utf8").trim() || null;
     if (persistedBindingHash && persistedBindingHash !== bindingHash) {
       identityConflict = true;
     }
@@ -51122,7 +51372,7 @@ function regenerateIdentity(nodeHome, label) {
   const keyPair = generateEd25519KeyPair();
   writeSecretFile(paths.instanceKey, keyPair.privateKeyPem);
   const bindingHash = computeBindingHash(nodeHome);
-  writeSecretFile(join2(paths.secretsDir, "binding-hash"), `${bindingHash}
+  writeSecretFile(join3(paths.secretsDir, "binding-hash"), `${bindingHash}
 `);
   return {
     environmentId,
@@ -51138,7 +51388,7 @@ function regenerateIdentity(nodeHome, label) {
 }
 // src/runtime.ts
-import { existsSync as existsSync24, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync28, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "node:fs";
 // src/auth/auth-service.ts
 init_environment();
@@ -51455,7 +51705,7 @@ var AuthService = class {
 // src/db/database.ts
 import Database from "better-sqlite3";
 import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 // src/db/schema.ts
 var SCHEMA_SQL = `
@@ -51651,7 +51901,7 @@ var SCHEMA_GENERATION = 1;
 // src/db/database.ts
 function openNodeDatabase(dbPath) {
-  mkdirSync2(dirname2(dbPath), { recursive: true });
+  mkdirSync2(dirname3(dbPath), { recursive: true });
   const db = new Database(dbPath);
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
@@ -51824,13 +52074,13 @@ init_claude_turn_runner();
 init_claude_turn_runner();
 init_codex_turn_runner();
 init_resolve_service();
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 function commandExists(command) {
-  return Boolean(command && existsSync16(command));
+  return Boolean(command && existsSync17(command));
 }
 function envBinaryExists(envName) {
   const v = process.env[envName]?.trim();
-  return Boolean(v && existsSync16(v));
+  return Boolean(v && existsSync17(v));
 }
 function assertSessionHarnessRuntimeReady(sessionHarnessId, harnesses) {
   const id = sessionHarnessId === "acp" ? "acp" : sessionHarnessId;
@@ -52000,10 +52250,675 @@ function isAuthSatisfied(id, providers) {
   };
 }
+// src/session/harness-enable.ts
+init_environment();
+init_src2();
+import { accessSync, constants, existsSync as existsSync20, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve5 } from "node:path";
+// src/session/managed-harness-release.ts
+import {
+  copyFileSync,
+  createReadStream,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync8,
+  mkdtempSync,
+  readFileSync as readFileSync7,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync as statSync4,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { createHash as createHash3, randomBytes as randomBytes3 } from "node:crypto";
+import { dirname as dirname7, join as join13, relative, resolve as resolve3, sep as sep3 } from "node:path";
+import { arch as osArch, platform as osPlatform } from "node:os";
+var MANAGED_PAYLOAD_BASENAME = "payload.bin";
+var MANAGED_META_BASENAME = "artifact.json";
+var MANAGED_CURRENT_BASENAME = "current";
+var MAX_SEGMENT_LEN = 64;
+var SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function currentCliVersion() {
+  const v = resolveCliReleaseVersion();
+  return assertSafePathSegment(v, "cli version");
+}
+function currentHostPlatform() {
+  const p = osPlatform();
+  if (p === "darwin") return "darwin";
+  if (p === "linux") return "linux";
+  if (p === "win32") return "windows";
+  throw new Error(`unsupported host platform for managed harnesses: ${p}`);
+}
+function currentHostArch() {
+  const a = osArch();
+  if (a === "arm64") return "arm64";
+  if (a === "x64") return "x64";
+  throw new Error(`unsupported host arch for managed harnesses: ${a}`);
+}
+function assertSafePathSegment(value, label) {
+  const v = value.trim();
+  if (!v) throw new Error(`${label} must be non-empty`);
+  if (v.length > MAX_SEGMENT_LEN) throw new Error(`${label} exceeds ${MAX_SEGMENT_LEN} chars`);
+  if (v === "." || v === "..") throw new Error(`${label} must not be '.' or '..'`);
+  if (v.includes("/") || v.includes("\\") || v.includes("\0")) {
+    throw new Error(`${label} must be a single path segment`);
+  }
+  if (!SAFE_SEGMENT.test(v)) {
+    throw new Error(`${label} contains invalid characters`);
+  }
+  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(v)) {
+    throw new Error(`${label} is a reserved name`);
+  }
+  return v;
+}
+function parseHarnessReleaseManifest(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("release manifest must be an object");
+  }
+  const obj = raw;
+  if (typeof obj.cliVersion !== "string") {
+    throw new Error("release manifest missing cliVersion");
+  }
+  const cliVersion = assertSafePathSegment(obj.cliVersion, "cliVersion");
+  const mh = obj.managedHarnesses;
+  if (!mh || typeof mh !== "object") {
+    throw new Error("release manifest missing managedHarnesses");
+  }
+  const managedHarnesses = {};
+  for (const id of ["claude", "codex"]) {
+    const entry = mh[id];
+    if (entry == null) continue;
+    managedHarnesses[id] = parseManagedHarnessPin(id, entry);
+  }
+  return { cliVersion, managedHarnesses };
+}
+function parseManagedHarnessPin(id, raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`manifest harness ${id} must be an object`);
+  }
+  const o = raw;
+  if (typeof o.runtimeVersion !== "string" || typeof o.artifactVersion !== "string") {
+    throw new Error(`manifest harness ${id} missing runtimeVersion/artifactVersion`);
+  }
+  const runtimeVersion = assertSafePathSegment(o.runtimeVersion, `${id}.runtimeVersion`);
+  const artifactVersion = assertSafePathSegment(o.artifactVersion, `${id}.artifactVersion`);
+  if (!Array.isArray(o.artifacts) || o.artifacts.length === 0) {
+    throw new Error(`manifest harness ${id} must list artifacts`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const artifacts = o.artifacts.map((a, i) => {
+    if (!a || typeof a !== "object") throw new Error(`manifest ${id} artifacts[${i}] invalid`);
+    const art = a;
+    const platform2 = art.platform;
+    const arch2 = art.arch;
+    const digest = art.digestSha256;
+    if (platform2 !== "darwin" && platform2 !== "linux" && platform2 !== "windows") {
+      throw new Error(`manifest ${id} artifacts[${i}] invalid platform`);
+    }
+    if (arch2 !== "arm64" && arch2 !== "x64") {
+      throw new Error(`manifest ${id} artifacts[${i}] invalid arch`);
+    }
+    if (typeof digest !== "string" || !/^[a-f0-9]{64}$/i.test(digest)) {
+      throw new Error(`manifest ${id} artifacts[${i}] digestSha256 must be 64 hex chars`);
+    }
+    const key = `${platform2}/${arch2}`;
+    if (seen.has(key)) {
+      throw new Error(`manifest ${id} has duplicate artifact pin for ${key}`);
+    }
+    seen.add(key);
+    let fileName;
+    if (typeof art.fileName === "string") {
+      if (art.fileName.includes("/") || art.fileName.includes("\\") || art.fileName.includes("\0")) {
+        throw new Error(`manifest ${id} artifacts[${i}] fileName must not contain path separators`);
+      }
+      fileName = art.fileName.slice(0, 128);
+    }
+    return {
+      platform: platform2,
+      arch: arch2,
+      digestSha256: digest.toLowerCase(),
+      fileName
+    };
+  });
+  return { runtimeVersion, artifactVersion, artifacts };
+}
+function loadHarnessReleaseManifest(nodeHome) {
+  const fromEnv = process.env.SUPERONE_HARNESS_MANIFEST;
+  if (fromEnv) {
+    if (!existsSync18(fromEnv)) {
+      throw new Error(`SUPERONE_HARNESS_MANIFEST not found: ${fromEnv}`);
+    }
+    return parseHarnessReleaseManifest(JSON.parse(readFileSync7(fromEnv, "utf8")));
+  }
+  const local = join13(nodeHome, "release-manifest.json");
+  if (existsSync18(local)) {
+    return parseHarnessReleaseManifest(JSON.parse(readFileSync7(local, "utf8")));
+  }
+  return null;
+}
+function selectArtifactPin(pin, platform2 = currentHostPlatform(), arch2 = currentHostArch()) {
+  const match = pin.artifacts.find((a) => a.platform === platform2 && a.arch === arch2);
+  if (!match) {
+    throw new Error(
+      `no managed artifact pin for ${platform2}/${arch2} (available: ${pin.artifacts.map((a) => `${a.platform}/${a.arch}`).join(", ")})`
+    );
+  }
+  return match;
+}
+async function sha256File(path) {
+  return new Promise((resolveHash, reject) => {
+    const hash2 = createHash3("sha256");
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolveHash(hash2.digest("hex")));
+  });
+}
+function releasesRoot(nodeHome) {
+  return resolve3(nodeHome, "releases");
+}
+function harnessVersionDir(nodeHome, cliVersion, harnessId, artifactVersion) {
+  const cli = assertSafePathSegment(cliVersion, "cliVersion");
+  const ver = assertSafePathSegment(artifactVersion, "artifactVersion");
+  const root = releasesRoot(nodeHome);
+  const dest = resolve3(root, cli, "harnesses", harnessId, ver);
+  assertPathInside(dest, resolve3(root, cli, "harnesses", harnessId), "version install dir");
+  return dest;
+}
+function assertPathInside(path, root, label) {
+  const resolvedPath = resolve3(path);
+  const resolvedRoot = resolve3(root);
+  const rel = relative(resolvedRoot, resolvedPath);
+  if (rel.startsWith("..") || rel === "..") {
+    throw new Error(`${label} escapes install root: ${resolvedPath}`);
+  }
+  if (rel.startsWith("/") || /^[A-Za-z]:/.test(rel)) {
+    throw new Error(`${label} escapes install root: ${resolvedPath}`);
+  }
+  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(resolvedRoot + sep3)) {
+    throw new Error(`${label} escapes install root: ${resolvedPath}`);
+  }
+}
+function assertStrictChild(path, parent, label) {
+  const resolvedPath = resolve3(path);
+  const resolvedParent = resolve3(parent);
+  if (resolvedPath === resolvedParent) {
+    throw new Error(`${label} must be a child of ${resolvedParent}`);
+  }
+  assertPathInside(resolvedPath, resolvedParent, label);
+}
+async function installManagedArtifactFromFile(opts) {
+  const mode = opts.mode ?? "enable";
+  const expected = opts.expectedCliVersion ?? currentCliVersion();
+  if (opts.manifest.cliVersion !== expected) {
+    throw new Error(
+      `release manifest cliVersion ${opts.manifest.cliVersion} does not match CLI ${expected}`
+    );
+  }
+  const pin = opts.manifest.managedHarnesses[opts.harnessId];
+  if (!pin) {
+    throw new Error(`release manifest does not pin managed harness ${opts.harnessId}`);
+  }
+  const art = selectArtifactPin(pin);
+  if (!existsSync18(opts.artifactPath)) {
+    throw new Error(`artifact not found: ${opts.artifactPath}`);
+  }
+  if (!statSync4(opts.artifactPath).isFile()) {
+    throw new Error(`artifact is not a regular file: ${opts.artifactPath}`);
+  }
+  const digest = await sha256File(opts.artifactPath);
+  if (digest !== art.digestSha256) {
+    throw new Error(
+      `artifact digest mismatch for ${opts.harnessId}: expected ${art.digestSha256}, got ${digest}`
+    );
+  }
+  const destDir = harnessVersionDir(
+    opts.nodeHome,
+    opts.manifest.cliVersion,
+    opts.harnessId,
+    pin.artifactVersion
+  );
+  const finalFile = join13(destDir, MANAGED_PAYLOAD_BASENAME);
+  const metaPath = join13(destDir, MANAGED_META_BASENAME);
+  assertStrictChild(finalFile, destDir, "payload path");
+  assertStrictChild(metaPath, destDir, "meta path");
+  const metaBody = JSON.stringify(
+    {
+      harnessId: opts.harnessId,
+      cliVersion: opts.manifest.cliVersion,
+      runtimeVersion: pin.runtimeVersion,
+      artifactVersion: pin.artifactVersion,
+      platform: art.platform,
+      arch: art.arch,
+      digestSha256: art.digestSha256,
+      displayFileName: art.fileName ?? null,
+      installedAt: Date.now()
+    },
+    null,
+    2
+  );
+  let reusedExisting = false;
+  if (existsSync18(destDir)) {
+    const payloadOk = existsSync18(finalFile) && statSync4(finalFile).isFile() && await sha256File(finalFile) === art.digestSha256;
+    if (payloadOk) {
+      reusedExisting = true;
+    } else if (mode === "repair") {
+      await replacePayloadAtomically({
+        destDir,
+        finalFile,
+        metaPath,
+        sourceArtifact: opts.artifactPath,
+        expectedDigest: art.digestSha256,
+        metaBody
+      });
+      reusedExisting = false;
+    } else {
+      throw new Error(
+        `existing install digest mismatch for ${opts.harnessId}@${pin.artifactVersion}: refusing to overwrite (use harness repair)`
+      );
+    }
+  } else {
+    const harnessRoot2 = dirname7(destDir);
+    mkdirSync8(harnessRoot2, { recursive: true });
+    assertPathInside(destDir, harnessRoot2, "version dir");
+    const stagingDir = mkdtempSync(
+      join13(harnessRoot2, `.staging-${opts.harnessId}-${randomBytes3(8).toString("hex")}-`)
+    );
+    assertPathInside(stagingDir, harnessRoot2, "staging dir");
+    const stagingFile = join13(stagingDir, MANAGED_PAYLOAD_BASENAME);
+    const stagingMeta = join13(stagingDir, MANAGED_META_BASENAME);
+    try {
+      copyFileSync(opts.artifactPath, stagingFile);
+      const stagedDigest = await sha256File(stagingFile);
+      if (stagedDigest !== art.digestSha256) {
+        throw new Error(`staged artifact digest mismatch for ${opts.harnessId}`);
+      }
+      writeFileSync6(stagingMeta, metaBody, "utf8");
+      renameSync2(stagingDir, destDir);
+    } catch (err) {
+      rmSync2(stagingDir, { recursive: true, force: true });
+      if (existsSync18(destDir) && existsSync18(finalFile)) {
+        const existingDigest = await sha256File(finalFile);
+        if (existingDigest === art.digestSha256) {
+          reusedExisting = true;
+        } else if (mode === "repair") {
+          await replacePayloadAtomically({
+            destDir,
+            finalFile,
+            metaPath,
+            sourceArtifact: opts.artifactPath,
+            expectedDigest: art.digestSha256,
+            metaBody
+          });
+        } else {
+          throw err;
+        }
+      } else {
+        throw err;
+      }
+    }
+  }
+  const finalDigest = await sha256File(finalFile);
+  if (finalDigest !== art.digestSha256) {
+    throw new Error(`final payload digest mismatch for ${opts.harnessId}`);
+  }
+  const harnessRoot = join13(
+    releasesRoot(opts.nodeHome),
+    opts.manifest.cliVersion,
+    "harnesses",
+    opts.harnessId
+  );
+  assertPathInside(harnessRoot, releasesRoot(opts.nodeHome), "harness root");
+  mkdirSync8(harnessRoot, { recursive: true });
+  const currentPath = join13(harnessRoot, MANAGED_CURRENT_BASENAME);
+  const currentTmp = join13(
+    harnessRoot,
+    `.${MANAGED_CURRENT_BASENAME}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`
+  );
+  assertStrictChild(currentTmp, harnessRoot, "current pointer temp");
+  try {
+    writeFileSync6(
+      currentTmp,
+      JSON.stringify(
+        {
+          artifactVersion: pin.artifactVersion,
+          installPath: finalFile,
+          digestSha256: art.digestSha256,
+          runtimeVersion: pin.runtimeVersion
+        },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    renameSync2(currentTmp, currentPath);
+  } catch (err) {
+    rmSync2(currentTmp, { force: true });
+    throw err;
+  }
+  return {
+    harnessId: opts.harnessId,
+    cliVersion: opts.manifest.cliVersion,
+    runtimeVersion: pin.runtimeVersion,
+    artifactVersion: pin.artifactVersion,
+    digestSha256: art.digestSha256,
+    installPath: finalFile,
+    source: "offline-artifact",
+    reusedExisting
+  };
+}
+async function replacePayloadAtomically(opts) {
+  mkdirSync8(opts.destDir, { recursive: true });
+  const nonce = randomBytes3(8).toString("hex");
+  const payloadTmp = join13(opts.destDir, `.${MANAGED_PAYLOAD_BASENAME}.${nonce}.tmp`);
+  const metaTmp = join13(opts.destDir, `.${MANAGED_META_BASENAME}.${nonce}.tmp`);
+  assertStrictChild(payloadTmp, opts.destDir, "payload temp");
+  assertStrictChild(metaTmp, opts.destDir, "meta temp");
+  try {
+    copyFileSync(opts.sourceArtifact, payloadTmp);
+    const d = await sha256File(payloadTmp);
+    if (d !== opts.expectedDigest) {
+      throw new Error(`repair staged digest mismatch: expected ${opts.expectedDigest}, got ${d}`);
+    }
+    writeFileSync6(metaTmp, opts.metaBody, "utf8");
+    renameSync2(payloadTmp, opts.finalFile);
+    renameSync2(metaTmp, opts.metaPath);
+  } catch (err) {
+    rmSync2(payloadTmp, { force: true });
+    rmSync2(metaTmp, { force: true });
+    throw err;
+  }
+}
+function describeExpectedArtifact(harnessId, manifest) {
+  const pin = manifest.managedHarnesses[harnessId];
+  if (!pin) return `harness ${harnessId} is not pinned in the release manifest`;
+  try {
+    const art = selectArtifactPin(pin);
+    return `${harnessId} requires offline --artifact matching ${art.platform}/${art.arch} digest ${art.digestSha256} (runtime ${pin.runtimeVersion}, artifact ${pin.artifactVersion}); network download is not enabled in Stage 3`;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+}
+function requiredRuntimeVersion(harnessId, manifest) {
+  if (harnessId !== "claude" && harnessId !== "codex") return null;
+  return manifest?.managedHarnesses[harnessId]?.runtimeVersion ?? null;
+}
+// src/session/harness-enable.ts
+init_codex_turn_runner();
+async function enableHarness(manager, input, providers) {
+  const id = input.harnessId;
+  if (!isNodeHarnessId(id)) throw new Error(`unknown harnessId: ${id}`);
+  let status;
+  if (id === "claude" || id === "codex") {
+    status = await enableManaged(manager, id, input.artifactPath);
+  } else if (id === "opencode") {
+    status = enableOpencode(manager, {
+      command: input.command,
+      serverUrl: input.serverUrl
+    });
+  } else {
+    status = enableAcpGrok(manager, {
+      command: input.command,
+      args: input.args ?? []
+    });
+  }
+  try {
+    probeHarnessReadiness(manager, id, providers ?? null);
+  } catch {
+  }
+  return manager.get(id);
+}
+function disableHarness(manager, harnessId) {
+  if (!isNodeHarnessId(harnessId)) throw new Error(`unknown harnessId: ${harnessId}`);
+  return manager.disable(harnessId);
+}
+async function enableManaged(manager, id, artifact, mode = "enable") {
+  const nodeHome = resolveNodeHome(void 0);
+  const def = getNodeHarnessDefinition(id);
+  if (artifact) {
+    const manifest = loadHarnessReleaseManifest(nodeHome);
+    if (!manifest) {
+      throw new Error(
+        `no release manifest found (set SUPERONE_HARNESS_MANIFEST or write ${nodeHome}/release-manifest.json)`
+      );
+    }
+    if (!manifest.managedHarnesses[id]) {
+      throw new Error(`release manifest does not pin ${id}`);
+    }
+    const abs = requireRegularReadableFile(artifact);
+    const installed = await installManagedArtifactFromFile({
+      nodeHome,
+      harnessId: id,
+      artifactPath: abs,
+      manifest,
+      expectedCliVersion: currentCliVersion(),
+      mode
+    });
+    return manager.update(id, {
+      enabled: true,
+      state: def.requiresAuth ? "needs_auth" : "ready",
+      command: installed.installPath,
+      runtimeVersion: installed.runtimeVersion,
+      diagnosticCode: def.requiresAuth ? "needs_auth" : null,
+      diagnosticFields: def.requiresAuth ? { command: installed.installPath, runtimeVersion: installed.runtimeVersion } : null,
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({
+        artifactPath: installed.installPath,
+        source: installed.source,
+        cliVersion: installed.cliVersion,
+        artifactVersion: installed.artifactVersion,
+        digestSha256: installed.digestSha256
+      })
+    });
+  }
+  const auto = resolveManagedAutoRuntime(id);
+  if (auto) {
+    return manager.update(id, {
+      enabled: true,
+      state: def.requiresAuth ? "needs_auth" : "ready",
+      command: auto.command,
+      runtimeVersion: auto.runtimeVersion ?? null,
+      diagnosticCode: def.requiresAuth ? "needs_auth" : null,
+      diagnosticFields: def.requiresAuth ? { command: auto.command, runtimeVersion: auto.runtimeVersion } : null,
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({
+        command: auto.command,
+        source: auto.source
+      })
+    });
+  }
+  try {
+    const { installManagedFromOfficialNpm: installManagedFromOfficialNpm2 } = await Promise.resolve().then(() => (init_managed_harness_official(), managed_harness_official_exports));
+    const official = await installManagedFromOfficialNpm2({ nodeHome, harnessId: id });
+    return manager.update(id, {
+      enabled: true,
+      state: def.requiresAuth ? "needs_auth" : "ready",
+      command: official.command,
+      runtimeVersion: official.runtimeVersion,
+      diagnosticCode: def.requiresAuth ? "needs_auth" : null,
+      diagnosticFields: def.requiresAuth ? { command: official.command, runtimeVersion: official.runtimeVersion } : null,
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({
+        command: official.command,
+        source: official.source,
+        packageSpec: official.packageSpec,
+        installPrefix: official.installPrefix,
+        runtimeVersion: official.runtimeVersion
+      })
+    });
+  } catch (officialErr) {
+    const detail = officialErr instanceof Error ? officialErr.message : String(officialErr);
+    const manifest = loadHarnessReleaseManifest(nodeHome);
+    if (manifest?.managedHarnesses[id]) {
+      throw new Error(
+        `official install failed (${detail}); ${describeExpectedArtifact(id, manifest)} as offline fallback`
+      );
+    }
+    throw new Error(
+      `official install of ${id} failed: ${detail}. Ensure npm is on PATH and the host can reach registry.npmjs.org.`
+    );
+  }
+}
+function resolveManagedAutoRuntime(id) {
+  if (id === "claude") {
+    const sdk = resolveSdkClaudeBinary();
+    if (sdk && existsSync20(sdk)) {
+      return { command: sdk, source: "agent-sdk-optional" };
+    }
+    return null;
+  }
+  const fromEnv = resolveCodexBinaryPath({});
+  if (fromEnv) return { command: fromEnv, source: "env-or-catalog" };
+  const fromPath = resolveExternalCommand(void 0, ["codex"]);
+  if (fromPath) return { command: fromPath, source: "path" };
+  return null;
+}
+function enableOpencode(manager, opts) {
+  if (opts.serverUrl) {
+    const safeUrl = validateServerUrl(opts.serverUrl);
+    return manager.update("opencode", {
+      enabled: true,
+      state: "ready",
+      command: null,
+      diagnosticCode: null,
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({ serverUrl: safeUrl })
+    });
+  }
+  const resolved = resolveExternalCommand(opts.command, ["opencode"]);
+  if (!resolved) {
+    return manager.update("opencode", {
+      enabled: true,
+      state: "missing",
+      command: null,
+      diagnosticCode: "not_found",
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({})
+    });
+  }
+  return manager.update("opencode", {
+    enabled: true,
+    state: "ready",
+    command: resolved,
+    diagnosticCode: null,
+    lastProbedAt: Date.now(),
+    configJson: JSON.stringify({ command: resolved })
+  });
+}
+function enableAcpGrok(manager, opts) {
+  const defaultArgs = ["agent", "stdio"];
+  const args = sanitizeHarnessArgs(opts.args.length > 0 ? opts.args : defaultArgs);
+  const resolved = resolveExternalCommand(opts.command, ["grok"]);
+  if (!resolved) {
+    return manager.update("acp-grok", {
+      enabled: true,
+      state: "missing",
+      command: null,
+      diagnosticCode: "not_found",
+      lastProbedAt: Date.now(),
+      configJson: JSON.stringify({ args, usesDefaultArgs: opts.args.length === 0 })
+    });
+  }
+  return manager.update("acp-grok", {
+    enabled: true,
+    state: "ready",
+    command: resolved,
+    diagnosticCode: null,
+    lastProbedAt: Date.now(),
+    configJson: JSON.stringify({
+      command: resolved,
+      args,
+      usesDefaultArgs: opts.args.length === 0
+    })
+  });
+}
+function requireRegularReadableFile(path) {
+  if (!isAbsolute2(path)) {
+    throw new Error(`path must be absolute: ${path}`);
+  }
+  const abs = resolve5(path);
+  if (!existsSync20(abs) || !statSync6(abs).isFile()) {
+    throw new Error(`not a regular file: ${abs}`);
+  }
+  accessSync(abs, constants.R_OK);
+  return realpathSync3(abs);
+}
+function resolveExternalCommand(explicit, searchNames) {
+  if (explicit) {
+    const abs = isAbsolute2(explicit) ? explicit : resolve5(explicit);
+    if (!existsSync20(abs)) return null;
+    try {
+      if (!statSync6(abs).isFile()) return null;
+      accessSync(abs, constants.X_OK);
+    } catch {
+      return null;
+    }
+    return realpathSync3(abs);
+  }
+  const pathEnv = process.env.PATH || "";
+  const dirs = pathEnv.split(process.platform === "win32" ? ";" : ":");
+  for (const name of searchNames) {
+    for (const dir of dirs) {
+      if (!dir) continue;
+      const candidate = resolve5(dir, name);
+      if (!existsSync20(candidate)) continue;
+      try {
+        if (!statSync6(candidate).isFile()) continue;
+        accessSync(candidate, constants.X_OK);
+        return realpathSync3(candidate);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function validateServerUrl(raw) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new Error("--server-url is not a valid URL");
+  }
+  if (url2.username || url2.password) {
+    throw new Error("--server-url must not include credentials");
+  }
+  if (url2.search && url2.search !== "?") {
+    throw new Error("--server-url must not include query parameters");
+  }
+  if (url2.hash) {
+    throw new Error("--server-url must not include a fragment");
+  }
+  const host = url2.hostname.toLowerCase();
+  const loopback = host === "localhost" || host === "127.0.0.1" || host === "::1";
+  if (url2.protocol === "http:") {
+    if (!loopback) {
+      throw new Error("--server-url http is only allowed for loopback hosts");
+    }
+  } else if (url2.protocol !== "https:") {
+    throw new Error("--server-url must be http(s)");
+  }
+  return `${url2.origin}${url2.pathname === "/" ? "" : url2.pathname}`;
+}
+function sanitizeHarnessArgs(args) {
+  for (const a of args) {
+    if (looksLikeSecretArg(a)) {
+      throw new Error("refusing to store credential-like --arg values");
+    }
+  }
+  return args.map((a) => a.slice(0, 512)).filter((a) => a.length > 0);
+}
+function looksLikeSecretArg(value) {
+  if (/Bearer\s+\S+/i.test(value)) return true;
+  if (/\b(password|passwd|token|secret|api[_-]?key)\b\s*=/i.test(value)) return true;
+  if (/^[A-Z][A-Z0-9_]*(KEY|TOKEN|SECRET|PASSWORD)\s*=/.test(value)) return true;
+  if (/\bsk-[A-Za-z0-9_-]{8,}\b/.test(value)) return true;
+  return false;
+}
 // ../../packages/shared/src/git-clone.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync8 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join12, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join15, resolve as resolve6 } from "node:path";
 // ../../packages/shared/src/git-remote.ts
 function repoNameFromGitUrl(url2) {
@@ -52061,24 +52976,24 @@ function resolveCloneDestination(input) {
   if (urlError) throw invalid(urlError);
   const parent = input.parentPath.trim();
   if (!parent) throw invalid("destination directory is required");
-  if (!isAbsolute2(parent)) throw invalid("destination directory must be an absolute path");
+  if (!isAbsolute3(parent)) throw invalid("destination directory must be an absolute path");
   const requested = input.directoryName?.trim();
   const name = requested || repoNameFromGitUrl(input.remoteUrl);
   if (!name) throw invalid("cannot determine a folder name for this repository");
   if (name.includes("/") || name.includes("\\") || name === "." || name === "..") {
     throw invalid(`invalid folder name: ${name}`);
   }
-  return { path: join12(resolve3(parent), name), name };
+  return { path: join15(resolve6(parent), name), name };
 }
 async function cloneRepository(input) {
   const destination = resolveCloneDestination(input);
-  if (existsSync17(destination.path)) {
+  if (existsSync21(destination.path)) {
     throw Object.assign(new Error(`destination already exists: ${destination.path}`), {
       code: "conflict"
     });
   }
-  const parent = resolve3(input.parentPath.trim());
-  mkdirSync8(parent, { recursive: true });
+  const parent = resolve6(input.parentPath.trim());
+  mkdirSync10(parent, { recursive: true });
   await new Promise((resolvePromise, reject) => {
     execFile(
       "git",
@@ -52116,7 +53031,7 @@ async function cloneRepository(input) {
 // src/rpc/handlers.ts
 init_resolve_service();
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readdirSync as readdirSync6, statSync as statSync7 } from "node:fs";
 import { join as pathJoin, resolve as pathResolve } from "node:path";
 import { arch, cpus, freemem, homedir as homedir4, hostname as hostname4, platform, totalmem, uptime } from "node:os";
@@ -52640,6 +53555,10 @@ async function dispatchRpcInner(method, payload, ctx) {
       return handleHarnessShow(payload, ctx);
     case "harness.probe":
       return handleHarnessProbe(payload, ctx);
+    case "harness.enable":
+      return handleHarnessEnable(payload, ctx);
+    case "harness.disable":
+      return handleHarnessDisable(payload, ctx);
     case "terminal.create":
       return handleTerminalCreate(payload, ctx);
     case "terminal.attach":
@@ -52936,11 +53855,18 @@ function handleDescriptor(ctx) {
   if (isClaudeBinaryOverrideRunnable() && !harnessIds.includes("claude")) {
     harnessIds.push("claude");
   }
+  let cliVersion;
+  try {
+    cliVersion = resolveCliReleaseVersion();
+  } catch {
+    cliVersion = process.env.SUPERONE_CLI_VERSION?.trim() || void 0;
+  }
   const descriptor = {
     environmentId: ctx.identity.environmentId,
     label: ctx.identity.label,
     platform: { os: mapOs(), arch: arch() },
     nodeVersion: process.version,
+    cliVersion,
     protocolVersion: PROTOCOL_GENERATION.current,
     capabilities: {
       ...PHASE1_NODE_CAPABILITIES,
@@ -52992,6 +53918,46 @@ function handleHarnessProbe(payload, ctx) {
     return mapThrown2(err);
   }
 }
+async function handleHarnessEnable(payload, ctx) {
+  const denied = requireScopes2(ctx.client, OPERATION_SCOPES.adminNode);
+  if (denied) return denied;
+  const p = asRecord7(payload);
+  const id = typeof p.harnessId === "string" ? p.harnessId : typeof p.id === "string" ? p.id : "";
+  if (!isNodeHarnessId(id)) {
+    return { error: { code: "invalid_argument", message: `unknown harnessId: ${id}` } };
+  }
+  try {
+    const args = Array.isArray(p.args) ? p.args.filter((a) => typeof a === "string") : void 0;
+    const status = await enableHarness(
+      ctx.harnesses,
+      {
+        harnessId: id,
+        artifactPath: typeof p.artifactPath === "string" ? p.artifactPath : void 0,
+        command: typeof p.command === "string" ? p.command : void 0,
+        serverUrl: typeof p.serverUrl === "string" ? p.serverUrl : void 0,
+        args
+      },
+      ctx.providers ?? null
+    );
+    return { result: status };
+  } catch (err) {
+    return mapThrown2(err);
+  }
+}
+function handleHarnessDisable(payload, ctx) {
+  const denied = requireScopes2(ctx.client, OPERATION_SCOPES.adminNode);
+  if (denied) return denied;
+  const p = asRecord7(payload);
+  const id = typeof p.harnessId === "string" ? p.harnessId : typeof p.id === "string" ? p.id : "";
+  if (!isNodeHarnessId(id)) {
+    return { error: { code: "invalid_argument", message: `unknown harnessId: ${id}` } };
+  }
+  try {
+    return { result: disableHarness(ctx.harnesses, id) };
+  } catch (err) {
+    return mapThrown2(err);
+  }
+}
 function handleHealth(ctx) {
   const denied = requireScopes2(ctx.client, OPERATION_SCOPES.readEnvironment);
   if (denied) return denied;
@@ -53222,8 +54188,8 @@ function handleProjectOpen(payload, ctx) {
   }
   const name = typeof p.name === "string" ? p.name : void 0;
   try {
-    if (p.createIfMissing === true && !existsSync18(path)) {
-      mkdirSync9(path, { recursive: true });
+    if (p.createIfMissing === true && !existsSync22(path)) {
+      mkdirSync11(path, { recursive: true });
     }
     return { result: ctx.projects.open(path, name) };
   } catch (err) {
@@ -53259,13 +54225,13 @@ function handleFsListDir(payload, ctx) {
   }
   try {
     const resolved = expandHostPath(raw);
-    if (!existsSync18(resolved)) {
+    if (!existsSync22(resolved)) {
       return { error: { code: "not_found", message: "path not found" } };
     }
-    if (!statSync4(resolved).isDirectory()) {
+    if (!statSync7(resolved).isDirectory()) {
       return { error: { code: "invalid_argument", message: "not a directory" } };
     }
-    const entries = readdirSync5(resolved, { withFileTypes: true }).filter((ent) => ent.isDirectory() && !ent.name.startsWith(".")).map((ent) => ({
+    const entries = readdirSync6(resolved, { withFileTypes: true }).filter((ent) => ent.isDirectory() && !ent.name.startsWith(".")).map((ent) => ({
       name: ent.name,
       path: pathJoin(resolved, ent.name),
       type: "directory"
@@ -54516,9 +55482,9 @@ async function startNodeServer(opts) {
       }
     });
   });
-  await new Promise((resolve10, reject) => {
+  await new Promise((resolve12, reject) => {
     httpServer.once("error", reject);
-    httpServer.listen(opts.bindPort, opts.bindHost, () => resolve10());
+    httpServer.listen(opts.bindPort, opts.bindHost, () => resolve12());
   });
   const address = httpServer.address();
   const port = typeof address === "object" && address ? address.port : opts.bindPort;
@@ -54531,9 +55497,9 @@ async function startNodeServer(opts) {
     async close() {
       for (const ws of activeSockets.keys()) ws.close();
       activeSockets.clear();
-      await new Promise((resolve10) => wss.close(() => resolve10()));
-      await new Promise((resolve10, reject) => {
-        httpServer.close((err) => err ? reject(err) : resolve10());
+      await new Promise((resolve12) => wss.close(() => resolve12()));
+      await new Promise((resolve12, reject) => {
+        httpServer.close((err) => err ? reject(err) : resolve12());
       });
     }
   };
@@ -54644,9 +55610,9 @@ async function handleHttp(req, res, opts) {
 // src/terminal/manager.ts
 import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 var nodeRequire = createRequire2(import.meta.url);
-var { spawn: spawn4 } = nodeRequire("node-pty");
+var { spawn: spawn5 } = nodeRequire("node-pty");
 var SNAPSHOT_SOFT_LIMIT = 64 * 1024;
 var OUTPUT_BUFFER_SOFT_LIMIT = 256 * 1024;
 function defaultShell() {
@@ -54659,7 +55625,7 @@ var NodeTerminalManager = class {
   }
   byId = /* @__PURE__ */ new Map();
   create(opts) {
-    if (!existsSync19(opts.cwd)) {
+    if (!existsSync23(opts.cwd)) {
       throw Object.assign(new Error(`cwd does not exist: ${opts.cwd}`), { code: "invalid_argument" });
     }
     const terminalId = crypto.randomUUID();
@@ -54678,7 +55644,7 @@ var NodeTerminalManager = class {
       sequence: 0
     };
     const shell = opts.shell || defaultShell();
-    const proc = spawn4(shell, [], {
+    const proc = spawn5(shell, [], {
       cwd: opts.cwd,
       env: { ...process.env, TERM: "xterm-256color" },
       name: "xterm-256color",
@@ -54799,9 +55765,9 @@ var NodeTerminalManager = class {
 };
 // src/workspace/project-registry.ts
-import { basename as basename2, resolve as resolve4 } from "node:path";
-import { existsSync as existsSync20, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
-import { createHash as createHash3 } from "node:crypto";
+import { basename as basename2, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync24, realpathSync as realpathSync4, statSync as statSync8 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 var ProjectRegistry = class {
   constructor(db) {
@@ -54821,7 +55787,7 @@ var ProjectRegistry = class {
     return this.toSnapshot(r);
   }
   getByPath(path) {
-    const abs = resolve4(path);
+    const abs = resolve7(path);
     const r = this.db.prepare(
       `SELECT project_id, path, name, repo_identity, opened_at, last_active_at FROM projects WHERE path = ?`
     ).get(abs);
@@ -54829,14 +55795,14 @@ var ProjectRegistry = class {
     return this.toSnapshot(r);
   }
   open(path, name) {
-    let abs = resolve4(path);
-    if (!existsSync20(abs) || !statSync5(abs).isDirectory()) {
+    let abs = resolve7(path);
+    if (!existsSync24(abs) || !statSync8(abs).isDirectory()) {
       throw Object.assign(new Error(`project path is not a directory: ${abs}`), {
         code: "invalid_argument"
       });
     }
     try {
-      abs = realpathSync3(abs);
+      abs = realpathSync4(abs);
     } catch {
     }
     const existing = this.getByPath(abs);
@@ -54845,7 +55811,7 @@ var ProjectRegistry = class {
       this.db.prepare(`UPDATE projects SET last_active_at = ?, name = COALESCE(?, name) WHERE project_id = ?`).run(now, name ?? null, existing.projectId);
       return this.get(existing.projectId);
     }
-    const projectId = createHash3("sha256").update(abs).digest("hex").slice(0, 32);
+    const projectId = createHash4("sha256").update(abs).digest("hex").slice(0, 32);
     const repoIdentity = detectRepoIdentity(abs);
     this.db.prepare(
       `INSERT INTO projects (project_id, path, name, repo_identity, opened_at, last_active_at)
@@ -54874,7 +55840,7 @@ var ProjectRegistry = class {
   toSnapshot(r) {
     let missing = false;
     try {
-      missing = !statSync5(r.path).isDirectory();
+      missing = !statSync8(r.path).isDirectory();
     } catch {
       missing = true;
     }
@@ -54904,7 +55870,7 @@ function detectRepoIdentity(abs) {
       if (remote) return `git:${remote}`;
     } catch {
     }
-    return `gitdir:${resolve4(abs, out)}`;
+    return `gitdir:${resolve7(abs, out)}`;
   } catch {
     return null;
   }
@@ -54914,21 +55880,21 @@ function detectRepoIdentity(abs) {
 init_fs();
 import {
   closeSync,
-  existsSync as existsSync21,
+  existsSync as existsSync25,
   fstatSync,
-  mkdirSync as mkdirSync10,
+  mkdirSync as mkdirSync12,
   openSync,
   readSync,
-  readdirSync as readdirSync6,
-  readFileSync as readFileSync6,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
-  statSync as statSync6,
+  readdirSync as readdirSync7,
+  readFileSync as readFileSync9,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  statSync as statSync9,
   unlinkSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname6, join as join13, relative } from "node:path";
-import { createHash as createHash4 } from "node:crypto";
+import { dirname as dirname8, join as join16, relative as relative2 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
 function normalizeRel(path) {
   return path.replace(/\\/g, "/").replace(/\/+$/, "") || ".";
 }
@@ -54973,21 +55939,21 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync21(resolved.absolutePath)) {
+    if (!existsSync25(resolved.absolutePath)) {
       throw Object.assign(new Error("path not found"), { code: "not_found" });
     }
-    const st = statSync6(resolved.absolutePath);
+    const st = statSync9(resolved.absolutePath);
     if (!st.isDirectory()) {
       throw Object.assign(new Error("not a directory"), { code: "invalid_argument" });
     }
     this.projects.touch(projectId);
-    const ents = readdirSync6(resolved.absolutePath, { withFileTypes: true });
+    const ents = readdirSync7(resolved.absolutePath, { withFileTypes: true });
     return ents.map((ent) => {
-      const abs = join13(resolved.absolutePath, ent.name);
+      const abs = join16(resolved.absolutePath, ent.name);
       let size;
       let mtimeMs;
       try {
-        const s = statSync6(abs);
+        const s = statSync9(abs);
         size = s.size;
         mtimeMs = s.mtimeMs;
       } catch {
@@ -54995,7 +55961,7 @@ var WorkspaceFsService = class {
       const kind = pathKind(abs);
       return {
         name: ent.name,
-        path: relative(root, abs).split("\\").join("/") || ".",
+        path: relative2(root, abs).split("\\").join("/") || ".",
         type: kind === "symlink" ? "symlink" : kind === "directory" ? "directory" : kind === "file" ? "file" : "other",
         size,
         mtimeMs
@@ -55008,10 +55974,10 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync21(resolved.absolutePath)) {
+    if (!existsSync25(resolved.absolutePath)) {
       throw Object.assign(new Error("file not found"), { code: "not_found" });
     }
-    const st = statSync6(resolved.absolutePath);
+    const st = statSync9(resolved.absolutePath);
     if (!st.isFile()) {
       throw Object.assign(new Error("not a file"), { code: "invalid_argument" });
     }
@@ -55034,7 +56000,7 @@ var WorkspaceFsService = class {
       const slice = Buffer.alloc(toRead);
       if (toRead > 0) readSync(fd, slice, 0, toRead, offset);
       const content = slice.toString("base64");
-      const hash2 = createHash4("sha256").update(slice).digest("hex");
+      const hash2 = createHash5("sha256").update(slice).digest("hex");
       this.projects.touch(projectId);
       return { content, hash: hash2, encoding: "base64" };
     } finally {
@@ -55047,8 +56013,8 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (existsSync21(resolved.absolutePath) && expectedHash) {
-      const st = statSync6(resolved.absolutePath);
+    if (existsSync25(resolved.absolutePath) && expectedHash) {
+      const st = statSync9(resolved.absolutePath);
       if (st.size > MAX_READ_BYTES) {
         throw Object.assign(
           new Error(`optimistic-write target too large (${st.size} bytes; max ${MAX_READ_BYTES})`),
@@ -55060,27 +56026,27 @@ var WorkspaceFsService = class {
         throw Object.assign(new Error("content hash mismatch"), { code: "conflict" });
       }
     }
-    mkdirSync10(dirname6(resolved.absolutePath), { recursive: true });
+    mkdirSync12(dirname8(resolved.absolutePath), { recursive: true });
     const data = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
     if (data.length > MAX_READ_BYTES) {
       throw Object.assign(new Error("write payload too large"), { code: "invalid_argument" });
     }
     let mode = 384;
-    if (existsSync21(resolved.absolutePath)) {
+    if (existsSync25(resolved.absolutePath)) {
       try {
-        mode = statSync6(resolved.absolutePath).mode & 511;
+        mode = statSync9(resolved.absolutePath).mode & 511;
       } catch {
       }
     }
     const tmp = `${resolved.absolutePath}.tmp-${crypto.randomUUID()}`;
     let renamed = false;
     try {
-      writeFileSync6(tmp, data, { mode });
+      writeFileSync7(tmp, data, { mode });
       const again = resolveProjectPath(root, relativePath);
       if (!again.ok || again.absolutePath !== resolved.absolutePath) {
         throw Object.assign(new Error("path changed during write"), { code: "failed_precondition" });
       }
-      renameSync2(tmp, resolved.absolutePath);
+      renameSync3(tmp, resolved.absolutePath);
       renamed = true;
     } finally {
       if (!renamed) {
@@ -55090,7 +56056,7 @@ var WorkspaceFsService = class {
         }
       }
     }
-    const hash2 = createHash4("sha256").update(data).digest("hex");
+    const hash2 = createHash5("sha256").update(data).digest("hex");
     this.projects.touch(projectId);
     return { hash: hash2 };
   }
@@ -55129,15 +56095,15 @@ var WorkspaceFsService = class {
       if (hits.length >= MAX_SEARCH_HITS) return;
       let ents;
       try {
-        ents = readdirSync6(dir, { withFileTypes: true });
+        ents = readdirSync7(dir, { withFileTypes: true });
       } catch {
         return;
       }
       for (const ent of ents) {
         if (hits.length >= MAX_SEARCH_HITS) return;
         if (ent.name === ".git" || ent.name === "node_modules") continue;
-        const abs = join13(dir, ent.name);
-        const rel = relative(root, abs).split("\\").join("/");
+        const abs = join16(dir, ent.name);
+        const rel = relative2(root, abs).split("\\").join("/");
         const check2 = resolveProjectPath(root, rel);
         if (!check2.ok) continue;
         if (ent.isDirectory()) {
@@ -55146,9 +56112,9 @@ var WorkspaceFsService = class {
         }
         if (!ent.isFile()) continue;
         try {
-          const st = statSync6(abs);
+          const st = statSync9(abs);
           if (st.size > MAX_SEARCH_FILE_BYTES) continue;
-          const text = readFileSync6(abs, "utf8");
+          const text = readFileSync9(abs, "utf8");
           const lines = text.split(/\r?\n/);
           for (let i = 0; i < lines.length; i++) {
             if (lines[i].includes(query)) {
@@ -55210,15 +56176,15 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (existsSync21(resolved.absolutePath)) {
-      const st = statSync6(resolved.absolutePath);
+    if (existsSync25(resolved.absolutePath)) {
+      const st = statSync9(resolved.absolutePath);
       if (!st.isDirectory()) {
         throw Object.assign(new Error("path exists and is not a directory"), { code: "conflict" });
       }
       this.projects.touch(projectId);
       return { path: rel };
     }
-    mkdirSync10(resolved.absolutePath, { recursive: true });
+    mkdirSync12(resolved.absolutePath, { recursive: true });
     this.projects.touch(projectId);
     return { path: rel };
   }
@@ -55233,13 +56199,13 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync21(resolved.absolutePath)) {
+    if (!existsSync25(resolved.absolutePath)) {
       throw Object.assign(new Error("path not found"), { code: "not_found" });
     }
     if (resolved.absolutePath === root) {
       throw Object.assign(new Error("cannot delete project root"), { code: "invalid_argument" });
     }
-    rmSync2(resolved.absolutePath, { recursive: true, force: false });
+    rmSync3(resolved.absolutePath, { recursive: true, force: false });
     this.projects.touch(projectId);
     return { path: rel };
   }
@@ -55257,20 +56223,20 @@ var WorkspaceFsService = class {
     if (!from.ok) {
       throw Object.assign(new Error(from.reason), { code: "invalid_argument" });
     }
-    if (!existsSync21(from.absolutePath)) {
+    if (!existsSync25(from.absolutePath)) {
       throw Object.assign(new Error("source not found"), { code: "not_found" });
     }
     const to = resolveProjectPath(root, toN);
     if (!to.ok) {
       throw Object.assign(new Error(to.reason), { code: "invalid_argument" });
     }
-    if (existsSync21(to.absolutePath)) {
+    if (existsSync25(to.absolutePath)) {
       throw Object.assign(new Error(`target already exists: ${baseNameRel(toN)}`), {
         code: "conflict"
       });
     }
-    mkdirSync10(dirname6(to.absolutePath), { recursive: true });
-    renameSync2(from.absolutePath, to.absolutePath);
+    mkdirSync12(dirname8(to.absolutePath), { recursive: true });
+    renameSync3(from.absolutePath, to.absolutePath);
     this.projects.touch(projectId);
     return { from: fromN, to: toN };
   }
@@ -55278,7 +56244,7 @@ var WorkspaceFsService = class {
 function hashFileBounded(absolutePath, size) {
   const fd = openSync(absolutePath, "r");
   try {
-    const hash2 = createHash4("sha256");
+    const hash2 = createHash5("sha256");
     const buf = Buffer.alloc(Math.min(64 * 1024, Math.max(1, size)));
     let offset = 0;
     while (offset < size) {
@@ -55294,8 +56260,8 @@ function hashFileBounded(absolutePath, size) {
 }
 // src/workspace/git-service.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, realpathSync as realpathSync4, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join15, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, realpathSync as realpathSync5, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join18, resolve as resolve9 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -55490,19 +56456,19 @@ function gitRunSync(folderPath, args, env) {
 }
 // ../../packages/runtime/src/git/worktree-plan.ts
-import { basename as basename3, dirname as dirname7, join as join14, resolve as resolve5, sep as sep3 } from "node:path";
+import { basename as basename3, dirname as dirname9, join as join17, resolve as resolve8, sep as sep4 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 function resolveMainDirFromCommonDir(folderPath, gitCommonDir) {
-  const repoRoot = resolve5(folderPath, gitCommonDir.trim());
-  return repoRoot.endsWith(`${sep3}.git`) || repoRoot.endsWith("/.git") ? dirname7(repoRoot) : repoRoot;
+  const repoRoot = resolve8(folderPath, gitCommonDir.trim());
+  return repoRoot.endsWith(`${sep4}.git`) || repoRoot.endsWith("/.git") ? dirname9(repoRoot) : repoRoot;
 }
 function planNewWorktreePaths(input) {
   const home = input.homeDir ?? homedir5();
   const repoName = basename3(input.mainDir);
   const epoch = Math.floor((input.nowMs ?? Date.now()) / 1e3).toString(36);
   const short = input.shortHash.slice(0, 7);
-  const wtDir = join14(home, ".worktrees", repoName);
-  const wtPath = join14(wtDir, `${epoch}-${short}`);
+  const wtDir = join17(home, ".worktrees", repoName);
+  const wtPath = join17(wtDir, `${epoch}-${short}`);
   return { wtDir, wtPath };
 }
 function worktreeAddArgs(mode, wtPath, baseRef, branchName) {
@@ -55561,11 +56527,11 @@ function resolveMainWorktreeDir(folderPath) {
 }
 function samePath(a, b) {
   try {
-    const ra = existsSync22(a) ? realpathSync4(a) : resolve6(a);
-    const rb = existsSync22(b) ? realpathSync4(b) : resolve6(b);
+    const ra = existsSync26(a) ? realpathSync5(a) : resolve9(a);
+    const rb = existsSync26(b) ? realpathSync5(b) : resolve9(b);
     return ra === rb;
   } catch {
-    return resolve6(a) === resolve6(b);
+    return resolve9(a) === resolve9(b);
   }
 }
 var WorkspaceGitService = class {
@@ -55594,7 +56560,7 @@ var WorkspaceGitService = class {
    * --ignored walks the whole tree of ignored paths and dominates remote latency.
    */
   statusForCwd(cwd) {
-    if (!existsSync22(join15(cwd, ".git")) && !isGitWorktree(cwd)) {
+    if (!existsSync26(join18(cwd, ".git")) && !isGitWorktree(cwd)) {
       return { isRepo: false, branch: null, dirty: false, ahead: 0, behind: 0, porcelain: "" };
     }
     try {
@@ -55701,21 +56667,21 @@ var WorkspaceGitService = class {
     if (worktreePath.includes("\0") || worktreePath.includes("..")) {
       throw Object.assign(new Error("invalid worktree path"), { code: "invalid_argument" });
     }
-    const abs = resolve6(worktreePath);
-    const main2 = resolve6(this.root(projectId));
-    if (samePath(abs, main2)) return existsSync22(abs) ? realpathSync4(abs) : abs;
+    const abs = resolve9(worktreePath);
+    const main2 = resolve9(this.root(projectId));
+    if (samePath(abs, main2)) return existsSync26(abs) ? realpathSync5(abs) : abs;
     const listed = this.worktrees(projectId);
     for (const wt of listed) {
       if (samePath(abs, wt.path)) {
-        return existsSync22(abs) ? realpathSync4(abs) : resolve6(wt.path);
+        return existsSync26(abs) ? realpathSync5(abs) : resolve9(wt.path);
       }
     }
     try {
-      if (existsSync22(abs) && isGitWorktree(abs)) {
-        const commonA = resolve6(abs, git(abs, ["rev-parse", "--git-common-dir"]).trim());
-        const commonB = resolve6(main2, git(main2, ["rev-parse", "--git-common-dir"]).trim());
+      if (existsSync26(abs) && isGitWorktree(abs)) {
+        const commonA = resolve9(abs, git(abs, ["rev-parse", "--git-common-dir"]).trim());
+        const commonB = resolve9(main2, git(main2, ["rev-parse", "--git-common-dir"]).trim());
         if (samePath(commonA, commonB)) {
-          return realpathSync4(abs);
+          return realpathSync5(abs);
         }
       }
     } catch {
@@ -55753,7 +56719,7 @@ var WorkspaceGitService = class {
       mainDir,
       shortHash: commitHash.slice(0, 7)
     });
-    if (!existsSync22(wtDir)) mkdirSync11(wtDir, { recursive: true });
+    if (!existsSync26(wtDir)) mkdirSync13(wtDir, { recursive: true });
     try {
       const addArgs = worktreeAddArgs(mode, wtPath, baseBranch, safeBranchName);
       git(folderPath, ["worktree", ...addArgs]);
@@ -55849,11 +56815,11 @@ var WorkspaceGitService = class {
       const mainStatus = git(diff.mainDir, ["status", "--porcelain"]).trim();
       if (mainStatus) return { ok: false, reason: "main-dirty" };
       const patch = git(diff.worktreePath, ["diff", "--binary", diff.base, diff.tree]);
-      const patchFile = join15(tmpdir2(), `s1-handoff-${randomUUID6()}.patch`);
-      writeFileSync7(patchFile, `${patch}
+      const patchFile = join18(tmpdir2(), `s1-handoff-${randomUUID6()}.patch`);
+      writeFileSync8(patchFile, `${patch}
 `);
       if (git(diff.mainDir, ["status", "--porcelain"]).trim()) {
-        rmSync3(patchFile, { force: true });
+        rmSync4(patchFile, { force: true });
         return { ok: false, reason: "main-dirty" };
       }
       try {
@@ -55866,7 +56832,7 @@ var WorkspaceGitService = class {
         }
         return { ok: false, reason: "conflict", error: gitErrorMessage(err) };
       } finally {
-        rmSync3(patchFile, { force: true });
+        rmSync4(patchFile, { force: true });
       }
       try {
         git(diff.mainDir, ["reset", "--quiet"]);
@@ -55911,14 +56877,14 @@ var WorkspaceGitService = class {
     };
   }
   writeWorkingTree(worktreePath) {
-    const tmpIndex = join15(tmpdir2(), `s1-handoff-${randomUUID6()}.index`);
+    const tmpIndex = join18(tmpdir2(), `s1-handoff-${randomUUID6()}.index`);
     const env = { GIT_INDEX_FILE: tmpIndex };
     try {
       git(worktreePath, ["read-tree", "HEAD"], env);
       git(worktreePath, ["add", "-A"], env);
       return git(worktreePath, ["write-tree"], env).trim();
     } finally {
-      rmSync3(tmpIndex, { force: true });
+      rmSync4(tmpIndex, { force: true });
     }
   }
   repoIdentity(projectId) {
@@ -56445,9 +57411,9 @@ var WorkspaceWatchService = class {
     try {
       while (!closed) {
         if (queue.length === 0) {
-          await new Promise((resolve10) => {
-            wake = resolve10;
-            setTimeout(() => resolve10(), 100);
+          await new Promise((resolve12) => {
+            wake = resolve12;
+            setTimeout(() => resolve12(), 100);
           });
           wake = null;
           continue;
@@ -56504,14 +57470,14 @@ var WorkspaceWatchService = class {
 };
 // src/auth/idempotency.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var IdempotencyService = class {
   constructor(db) {
     this.db = db;
   }
   inflight = /* @__PURE__ */ new Map();
   payloadHash(payload) {
-    return createHash5("sha256").update(JSON.stringify(payload ?? null)).digest("hex");
+    return createHash6("sha256").update(JSON.stringify(payload ?? null)).digest("hex");
   }
   key(clientIdentity, operation, idempotencyKey) {
     return `${clientIdentity}\0${operation}\0${idempotencyKey}`;
@@ -56613,22 +57579,22 @@ var IdempotencyService = class {
 import { randomUUID as randomUUID9 } from "node:crypto";
 // src/provider/secret-crypto.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync7, writeFileSync as writeFileSync8, chmodSync as chmodSync2 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync10, writeFileSync as writeFileSync9, chmodSync as chmodSync2 } from "node:fs";
+import { dirname as dirname10 } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4 } from "node:crypto";
 var ENC_PREFIX = "enc:v1:";
 var KEY_BYTES = 32;
 function isEncryptedSecret(value) {
   return typeof value === "string" && value.startsWith(ENC_PREFIX);
 }
 function ensureKeyFile(keyPath) {
-  if (existsSync23(keyPath)) {
-    const raw = readFileSync7(keyPath);
+  if (existsSync27(keyPath)) {
+    const raw = readFileSync10(keyPath);
     if (raw.length === KEY_BYTES) return raw;
   }
-  mkdirSync12(dirname8(keyPath), { recursive: true, mode: 448 });
-  const key = randomBytes3(KEY_BYTES);
-  writeFileSync8(keyPath, key, { mode: 384 });
+  mkdirSync14(dirname10(keyPath), { recursive: true, mode: 448 });
+  const key = randomBytes4(KEY_BYTES);
+  writeFileSync9(keyPath, key, { mode: 384 });
   try {
     chmodSync2(keyPath, 384);
   } catch {
@@ -56641,7 +57607,7 @@ function createNodeSecretCrypto(keyPath) {
     encrypt(plain) {
       if (!plain) return "";
       if (isEncryptedSecret(plain)) return plain;
-      const iv = randomBytes3(12);
+      const iv = randomBytes4(12);
       const cipher = createCipheriv("aes-256-gcm", key, iv);
       const ciphertext = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
       const tag = cipher.getAuthTag();
@@ -57385,7 +58351,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve10) => setTimeout(resolve10));
+            await new Promise((resolve12) => setTimeout(resolve12));
             maxReadCount = 3;
             continue;
           }
@@ -59419,9 +60385,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve10) => {
+        return new Promise((resolve12) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve10,
+            resolveJson: resolve12,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -65664,7 +66630,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
+        await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error51) {
@@ -65681,7 +66647,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve12, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -65759,7 +66725,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve10(parseResult.data);
+            resolve12(parseResult.data);
           }
         } catch (error51) {
           reject(error51);
@@ -66020,12 +66986,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve12, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve10, interval);
+      const timeoutId = setTimeout(resolve12, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -67129,7 +68095,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
+      await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -68036,11 +69002,11 @@ async function startHostActionMcpServer(opts) {
       writeHttpError(res, 500, err instanceof Error ? err.message : "Internal MCP server error");
     }
   }
-  await new Promise((resolve10, reject) => {
+  await new Promise((resolve12, reject) => {
     httpServer.once("error", reject);
     httpServer.listen(0, "127.0.0.1", () => {
       httpServer.off("error", reject);
-      resolve10();
+      resolve12();
     });
   });
   const address = httpServer.address();
@@ -68091,8 +69057,8 @@ async function startHostActionMcpServer(opts) {
       }
       httpSessions.clear();
       httpSessionsBySuperone.clear();
-      await new Promise((resolve10) => {
-        httpServer.close(() => resolve10());
+      await new Promise((resolve12) => {
+        httpServer.close(() => resolve12());
       });
     }
   };
@@ -68178,7 +69144,7 @@ async function startNodeRuntime(partial2 = {}) {
     startedAt,
     simulatedHarness
   });
-  writeFileSync9(
+  writeFileSync10(
     paths.runtimeJson,
     JSON.stringify(
       {
@@ -68246,9 +69212,9 @@ function createLocalPairingToken(nodeHome) {
 }
 function readRuntimeStatus(nodeHome) {
   const paths = nodePaths(resolveRuntimeConfig({ nodeHome }).nodeHome);
-  if (!existsSync24(paths.runtimeJson)) return null;
+  if (!existsSync28(paths.runtimeJson)) return null;
   try {
-    return JSON.parse(readFileSync8(paths.runtimeJson, "utf8"));
+    return JSON.parse(readFileSync11(paths.runtimeJson, "utf8"));
   } catch {
     return null;
   }
@@ -68256,8 +69222,8 @@ function readRuntimeStatus(nodeHome) {
 // src/systemd/install.ts
 import { spawnSync } from "node:child_process";
-import { chmodSync as chmodSync3, existsSync as existsSync25, mkdirSync as mkdirSync13, unlinkSync as unlinkSync2, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync29, mkdirSync as mkdirSync15, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname11 } from "node:path";
 // src/systemd/unit.ts
 function renderSystemdUserUnit(opts) {
@@ -68314,8 +69280,8 @@ function checkLinger(user) {
   return { enabled: null, raw };
 }
 function writeSystemdUserUnit(opts, unitPath = systemdUserUnitPath()) {
-  mkdirSync13(dirname9(unitPath), { recursive: true });
-  writeFileSync10(unitPath, renderSystemdUserUnit(opts), { encoding: "utf8", mode: 420 });
+  mkdirSync15(dirname11(unitPath), { recursive: true });
+  writeFileSync11(unitPath, renderSystemdUserUnit(opts), { encoding: "utf8", mode: 420 });
   try {
     chmodSync3(unitPath, 420);
   } catch {
@@ -68368,7 +69334,7 @@ function uninstallSystemdUserService(removeUnitFile = true) {
   }
   if (removeUnitFile) {
     const path = systemdUserUnitPath();
-    if (existsSync25(path)) {
+    if (existsSync29(path)) {
       try {
         unlinkSync2(path);
       } catch (err) {
@@ -68391,452 +69357,9 @@ function systemdUserStatus() {
 // src/session/harness-cli.ts
 init_environment();
-import { accessSync, constants, existsSync as existsSync28, realpathSync as realpathSync5, statSync as statSync8 } from "node:fs";
-import { isAbsolute as isAbsolute3, resolve as resolve8 } from "node:path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync30, realpathSync as realpathSync6, statSync as statSync10 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve10 } from "node:path";
 import { homedir as homedir6 } from "node:os";
-// src/session/managed-harness-release.ts
-import {
-  copyFileSync,
-  createReadStream,
-  existsSync as existsSync27,
-  mkdirSync as mkdirSync14,
-  mkdtempSync,
-  readFileSync as readFileSync10,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  statSync as statSync7,
-  writeFileSync as writeFileSync11
-} from "node:fs";
-import { createHash as createHash6, randomBytes as randomBytes4 } from "node:crypto";
-import { dirname as dirname11, join as join17, relative as relative2, resolve as resolve7, sep as sep4 } from "node:path";
-import { arch as osArch, platform as osPlatform } from "node:os";
-// src/cli-release-version.ts
-import { existsSync as existsSync26, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname10, join as join16 } from "node:path";
-import { fileURLToPath } from "node:url";
-function resolveCliReleaseVersion() {
-  const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
-  if (fromEnv) return fromEnv;
-  if ("0.49.4-alpha".trim()) {
-    return "0.49.4-alpha".trim();
-  }
-  const fromDist = readDistManifestVersion();
-  if (fromDist) return fromDist;
-  const fromRepo = readMonorepoPackageVersion();
-  if (fromRepo) return fromRepo;
-  throw new Error(
-    "unable to determine CLI version for harness release coupling (set SUPERONE_CLI_VERSION or use a built dist with MANIFEST.json)"
-  );
-}
-function readDistManifestVersion() {
-  try {
-    const here = dirname10(fileURLToPath(import.meta.url));
-    const candidates = [
-      join16(here, "..", "MANIFEST.json"),
-      join16(here, "MANIFEST.json"),
-      join16(here, "..", "..", "MANIFEST.json")
-    ];
-    for (const p of candidates) {
-      if (!existsSync26(p)) continue;
-      const raw = JSON.parse(readFileSync9(p, "utf8"));
-      if (typeof raw.version === "string" && raw.version.trim()) return raw.version.trim();
-    }
-  } catch {
-    return null;
-  }
-  return null;
-}
-function readMonorepoPackageVersion() {
-  try {
-    const here = dirname10(fileURLToPath(import.meta.url));
-    const rootPkg = join16(here, "..", "..", "..", "package.json");
-    if (!existsSync26(rootPkg)) return null;
-    const raw = JSON.parse(readFileSync9(rootPkg, "utf8"));
-    if (typeof raw.version === "string" && raw.version.trim()) return raw.version.trim();
-  } catch {
-    return null;
-  }
-  return null;
-}
-// src/session/managed-harness-release.ts
-var MANAGED_PAYLOAD_BASENAME = "payload.bin";
-var MANAGED_META_BASENAME = "artifact.json";
-var MANAGED_CURRENT_BASENAME = "current";
-var MAX_SEGMENT_LEN = 64;
-var SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-function currentCliVersion() {
-  const v = resolveCliReleaseVersion();
-  return assertSafePathSegment(v, "cli version");
-}
-function currentHostPlatform() {
-  const p = osPlatform();
-  if (p === "darwin") return "darwin";
-  if (p === "linux") return "linux";
-  if (p === "win32") return "windows";
-  throw new Error(`unsupported host platform for managed harnesses: ${p}`);
-}
-function currentHostArch() {
-  const a = osArch();
-  if (a === "arm64") return "arm64";
-  if (a === "x64") return "x64";
-  throw new Error(`unsupported host arch for managed harnesses: ${a}`);
-}
-function isManagedHarnessId(id) {
-  return id === "claude" || id === "codex";
-}
-function assertSafePathSegment(value, label) {
-  const v = value.trim();
-  if (!v) throw new Error(`${label} must be non-empty`);
-  if (v.length > MAX_SEGMENT_LEN) throw new Error(`${label} exceeds ${MAX_SEGMENT_LEN} chars`);
-  if (v === "." || v === "..") throw new Error(`${label} must not be '.' or '..'`);
-  if (v.includes("/") || v.includes("\\") || v.includes("\0")) {
-    throw new Error(`${label} must be a single path segment`);
-  }
-  if (!SAFE_SEGMENT.test(v)) {
-    throw new Error(`${label} contains invalid characters`);
-  }
-  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(v)) {
-    throw new Error(`${label} is a reserved name`);
-  }
-  return v;
-}
-function parseHarnessReleaseManifest(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("release manifest must be an object");
-  }
-  const obj = raw;
-  if (typeof obj.cliVersion !== "string") {
-    throw new Error("release manifest missing cliVersion");
-  }
-  const cliVersion = assertSafePathSegment(obj.cliVersion, "cliVersion");
-  const mh = obj.managedHarnesses;
-  if (!mh || typeof mh !== "object") {
-    throw new Error("release manifest missing managedHarnesses");
-  }
-  const managedHarnesses = {};
-  for (const id of ["claude", "codex"]) {
-    const entry = mh[id];
-    if (entry == null) continue;
-    managedHarnesses[id] = parseManagedHarnessPin(id, entry);
-  }
-  return { cliVersion, managedHarnesses };
-}
-function parseManagedHarnessPin(id, raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error(`manifest harness ${id} must be an object`);
-  }
-  const o = raw;
-  if (typeof o.runtimeVersion !== "string" || typeof o.artifactVersion !== "string") {
-    throw new Error(`manifest harness ${id} missing runtimeVersion/artifactVersion`);
-  }
-  const runtimeVersion = assertSafePathSegment(o.runtimeVersion, `${id}.runtimeVersion`);
-  const artifactVersion = assertSafePathSegment(o.artifactVersion, `${id}.artifactVersion`);
-  if (!Array.isArray(o.artifacts) || o.artifacts.length === 0) {
-    throw new Error(`manifest harness ${id} must list artifacts`);
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const artifacts = o.artifacts.map((a, i) => {
-    if (!a || typeof a !== "object") throw new Error(`manifest ${id} artifacts[${i}] invalid`);
-    const art = a;
-    const platform2 = art.platform;
-    const arch2 = art.arch;
-    const digest = art.digestSha256;
-    if (platform2 !== "darwin" && platform2 !== "linux" && platform2 !== "windows") {
-      throw new Error(`manifest ${id} artifacts[${i}] invalid platform`);
-    }
-    if (arch2 !== "arm64" && arch2 !== "x64") {
-      throw new Error(`manifest ${id} artifacts[${i}] invalid arch`);
-    }
-    if (typeof digest !== "string" || !/^[a-f0-9]{64}$/i.test(digest)) {
-      throw new Error(`manifest ${id} artifacts[${i}] digestSha256 must be 64 hex chars`);
-    }
-    const key = `${platform2}/${arch2}`;
-    if (seen.has(key)) {
-      throw new Error(`manifest ${id} has duplicate artifact pin for ${key}`);
-    }
-    seen.add(key);
-    let fileName;
-    if (typeof art.fileName === "string") {
-      if (art.fileName.includes("/") || art.fileName.includes("\\") || art.fileName.includes("\0")) {
-        throw new Error(`manifest ${id} artifacts[${i}] fileName must not contain path separators`);
-      }
-      fileName = art.fileName.slice(0, 128);
-    }
-    return {
-      platform: platform2,
-      arch: arch2,
-      digestSha256: digest.toLowerCase(),
-      fileName
-    };
-  });
-  return { runtimeVersion, artifactVersion, artifacts };
-}
-function loadHarnessReleaseManifest(nodeHome) {
-  const fromEnv = process.env.SUPERONE_HARNESS_MANIFEST;
-  if (fromEnv) {
-    if (!existsSync27(fromEnv)) {
-      throw new Error(`SUPERONE_HARNESS_MANIFEST not found: ${fromEnv}`);
-    }
-    return parseHarnessReleaseManifest(JSON.parse(readFileSync10(fromEnv, "utf8")));
-  }
-  const local = join17(nodeHome, "release-manifest.json");
-  if (existsSync27(local)) {
-    return parseHarnessReleaseManifest(JSON.parse(readFileSync10(local, "utf8")));
-  }
-  return null;
-}
-function selectArtifactPin(pin, platform2 = currentHostPlatform(), arch2 = currentHostArch()) {
-  const match = pin.artifacts.find((a) => a.platform === platform2 && a.arch === arch2);
-  if (!match) {
-    throw new Error(
-      `no managed artifact pin for ${platform2}/${arch2} (available: ${pin.artifacts.map((a) => `${a.platform}/${a.arch}`).join(", ")})`
-    );
-  }
-  return match;
-}
-async function sha256File(path) {
-  return new Promise((resolveHash, reject) => {
-    const hash2 = createHash6("sha256");
-    const stream = createReadStream(path);
-    stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("error", reject);
-    stream.on("end", () => resolveHash(hash2.digest("hex")));
-  });
-}
-function releasesRoot(nodeHome) {
-  return resolve7(nodeHome, "releases");
-}
-function harnessVersionDir(nodeHome, cliVersion, harnessId, artifactVersion) {
-  const cli = assertSafePathSegment(cliVersion, "cliVersion");
-  const ver = assertSafePathSegment(artifactVersion, "artifactVersion");
-  const root = releasesRoot(nodeHome);
-  const dest = resolve7(root, cli, "harnesses", harnessId, ver);
-  assertPathInside(dest, resolve7(root, cli, "harnesses", harnessId), "version install dir");
-  return dest;
-}
-function assertPathInside(path, root, label) {
-  const resolvedPath = resolve7(path);
-  const resolvedRoot = resolve7(root);
-  const rel = relative2(resolvedRoot, resolvedPath);
-  if (rel.startsWith("..") || rel === "..") {
-    throw new Error(`${label} escapes install root: ${resolvedPath}`);
-  }
-  if (rel.startsWith("/") || /^[A-Za-z]:/.test(rel)) {
-    throw new Error(`${label} escapes install root: ${resolvedPath}`);
-  }
-  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(resolvedRoot + sep4)) {
-    throw new Error(`${label} escapes install root: ${resolvedPath}`);
-  }
-}
-function assertStrictChild(path, parent, label) {
-  const resolvedPath = resolve7(path);
-  const resolvedParent = resolve7(parent);
-  if (resolvedPath === resolvedParent) {
-    throw new Error(`${label} must be a child of ${resolvedParent}`);
-  }
-  assertPathInside(resolvedPath, resolvedParent, label);
-}
-async function installManagedArtifactFromFile(opts) {
-  const mode = opts.mode ?? "enable";
-  const expected = opts.expectedCliVersion ?? currentCliVersion();
-  if (opts.manifest.cliVersion !== expected) {
-    throw new Error(
-      `release manifest cliVersion ${opts.manifest.cliVersion} does not match CLI ${expected}`
-    );
-  }
-  const pin = opts.manifest.managedHarnesses[opts.harnessId];
-  if (!pin) {
-    throw new Error(`release manifest does not pin managed harness ${opts.harnessId}`);
-  }
-  const art = selectArtifactPin(pin);
-  if (!existsSync27(opts.artifactPath)) {
-    throw new Error(`artifact not found: ${opts.artifactPath}`);
-  }
-  if (!statSync7(opts.artifactPath).isFile()) {
-    throw new Error(`artifact is not a regular file: ${opts.artifactPath}`);
-  }
-  const digest = await sha256File(opts.artifactPath);
-  if (digest !== art.digestSha256) {
-    throw new Error(
-      `artifact digest mismatch for ${opts.harnessId}: expected ${art.digestSha256}, got ${digest}`
-    );
-  }
-  const destDir = harnessVersionDir(
-    opts.nodeHome,
-    opts.manifest.cliVersion,
-    opts.harnessId,
-    pin.artifactVersion
-  );
-  const finalFile = join17(destDir, MANAGED_PAYLOAD_BASENAME);
-  const metaPath = join17(destDir, MANAGED_META_BASENAME);
-  assertStrictChild(finalFile, destDir, "payload path");
-  assertStrictChild(metaPath, destDir, "meta path");
-  const metaBody = JSON.stringify(
-    {
-      harnessId: opts.harnessId,
-      cliVersion: opts.manifest.cliVersion,
-      runtimeVersion: pin.runtimeVersion,
-      artifactVersion: pin.artifactVersion,
-      platform: art.platform,
-      arch: art.arch,
-      digestSha256: art.digestSha256,
-      displayFileName: art.fileName ?? null,
-      installedAt: Date.now()
-    },
-    null,
-    2
-  );
-  let reusedExisting = false;
-  if (existsSync27(destDir)) {
-    const payloadOk = existsSync27(finalFile) && statSync7(finalFile).isFile() && await sha256File(finalFile) === art.digestSha256;
-    if (payloadOk) {
-      reusedExisting = true;
-    } else if (mode === "repair") {
-      await replacePayloadAtomically({
-        destDir,
-        finalFile,
-        metaPath,
-        sourceArtifact: opts.artifactPath,
-        expectedDigest: art.digestSha256,
-        metaBody
-      });
-      reusedExisting = false;
-    } else {
-      throw new Error(
-        `existing install digest mismatch for ${opts.harnessId}@${pin.artifactVersion}: refusing to overwrite (use harness repair)`
-      );
-    }
-  } else {
-    const harnessRoot2 = dirname11(destDir);
-    mkdirSync14(harnessRoot2, { recursive: true });
-    assertPathInside(destDir, harnessRoot2, "version dir");
-    const stagingDir = mkdtempSync(
-      join17(harnessRoot2, `.staging-${opts.harnessId}-${randomBytes4(8).toString("hex")}-`)
-    );
-    assertPathInside(stagingDir, harnessRoot2, "staging dir");
-    const stagingFile = join17(stagingDir, MANAGED_PAYLOAD_BASENAME);
-    const stagingMeta = join17(stagingDir, MANAGED_META_BASENAME);
-    try {
-      copyFileSync(opts.artifactPath, stagingFile);
-      const stagedDigest = await sha256File(stagingFile);
-      if (stagedDigest !== art.digestSha256) {
-        throw new Error(`staged artifact digest mismatch for ${opts.harnessId}`);
-      }
-      writeFileSync11(stagingMeta, metaBody, "utf8");
-      renameSync3(stagingDir, destDir);
-    } catch (err) {
-      rmSync4(stagingDir, { recursive: true, force: true });
-      if (existsSync27(destDir) && existsSync27(finalFile)) {
-        const existingDigest = await sha256File(finalFile);
-        if (existingDigest === art.digestSha256) {
-          reusedExisting = true;
-        } else if (mode === "repair") {
-          await replacePayloadAtomically({
-            destDir,
-            finalFile,
-            metaPath,
-            sourceArtifact: opts.artifactPath,
-            expectedDigest: art.digestSha256,
-            metaBody
-          });
-        } else {
-          throw err;
-        }
-      } else {
-        throw err;
-      }
-    }
-  }
-  const finalDigest = await sha256File(finalFile);
-  if (finalDigest !== art.digestSha256) {
-    throw new Error(`final payload digest mismatch for ${opts.harnessId}`);
-  }
-  const harnessRoot = join17(
-    releasesRoot(opts.nodeHome),
-    opts.manifest.cliVersion,
-    "harnesses",
-    opts.harnessId
-  );
-  assertPathInside(harnessRoot, releasesRoot(opts.nodeHome), "harness root");
-  mkdirSync14(harnessRoot, { recursive: true });
-  const currentPath = join17(harnessRoot, MANAGED_CURRENT_BASENAME);
-  const currentTmp = join17(
-    harnessRoot,
-    `.${MANAGED_CURRENT_BASENAME}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`
-  );
-  assertStrictChild(currentTmp, harnessRoot, "current pointer temp");
-  try {
-    writeFileSync11(
-      currentTmp,
-      JSON.stringify(
-        {
-          artifactVersion: pin.artifactVersion,
-          installPath: finalFile,
-          digestSha256: art.digestSha256,
-          runtimeVersion: pin.runtimeVersion
-        },
-        null,
-        2
-      ),
-      "utf8"
-    );
-    renameSync3(currentTmp, currentPath);
-  } catch (err) {
-    rmSync4(currentTmp, { force: true });
-    throw err;
-  }
-  return {
-    harnessId: opts.harnessId,
-    cliVersion: opts.manifest.cliVersion,
-    runtimeVersion: pin.runtimeVersion,
-    artifactVersion: pin.artifactVersion,
-    digestSha256: art.digestSha256,
-    installPath: finalFile,
-    source: "offline-artifact",
-    reusedExisting
-  };
-}
-async function replacePayloadAtomically(opts) {
-  mkdirSync14(opts.destDir, { recursive: true });
-  const nonce = randomBytes4(8).toString("hex");
-  const payloadTmp = join17(opts.destDir, `.${MANAGED_PAYLOAD_BASENAME}.${nonce}.tmp`);
-  const metaTmp = join17(opts.destDir, `.${MANAGED_META_BASENAME}.${nonce}.tmp`);
-  assertStrictChild(payloadTmp, opts.destDir, "payload temp");
-  assertStrictChild(metaTmp, opts.destDir, "meta temp");
-  try {
-    copyFileSync(opts.sourceArtifact, payloadTmp);
-    const d = await sha256File(payloadTmp);
-    if (d !== opts.expectedDigest) {
-      throw new Error(`repair staged digest mismatch: expected ${opts.expectedDigest}, got ${d}`);
-    }
-    writeFileSync11(metaTmp, opts.metaBody, "utf8");
-    renameSync3(payloadTmp, opts.finalFile);
-    renameSync3(metaTmp, opts.metaPath);
-  } catch (err) {
-    rmSync4(payloadTmp, { force: true });
-    rmSync4(metaTmp, { force: true });
-    throw err;
-  }
-}
-function describeExpectedArtifact(harnessId, manifest) {
-  const pin = manifest.managedHarnesses[harnessId];
-  if (!pin) return `harness ${harnessId} is not pinned in the release manifest`;
-  try {
-    const art = selectArtifactPin(pin);
-    return `${harnessId} requires offline --artifact matching ${art.platform}/${art.arch} digest ${art.digestSha256} (runtime ${pin.runtimeVersion}, artifact ${pin.artifactVersion}); network download is not enabled in Stage 3`;
-  } catch (err) {
-    return err instanceof Error ? err.message : String(err);
-  }
-}
-function requiredRuntimeVersion(harnessId, manifest) {
-  if (harnessId !== "claude" && harnessId !== "codex") return null;
-  return manifest?.managedHarnesses[harnessId]?.runtimeVersion ?? null;
-}
-// src/session/harness-cli.ts
 var DEFERRED_FLAGS = /* @__PURE__ */ new Set([
   "--env-file",
   "--server-password-stdin",
@@ -68851,7 +69374,7 @@ function harnessUsage() {
 Commands:
   list [--json]
   show <HARNESS_ID> [--json]
-  enable claude|codex --artifact <FILE> [--json]
+  enable claude|codex [--artifact <FILE>] [--json]
   enable opencode [--command <ABS_PATH> | --server-url <URL>] [--json]
   enable acp-grok [--command <ABS_PATH>] [--arg <VALUE>|--arg=<VALUE>]... [--json]
   configure opencode [--command <ABS_PATH> | --server-url <URL>] [--json]
@@ -68866,7 +69389,7 @@ Notes:
   No public --home / --data-dir.
   Stage 2 deferred (rejected if passed): --env-file, --server-password-stdin,
   --clear-server-password, --clear-env, --startup-timeout, --initialize-timeout,
-  managed download without --artifact.
+  signed SuperOne artifact CDN (managed enable pulls official npm packages).
 `;
 }
 function subUsage(sub) {
@@ -68877,7 +69400,7 @@ function subUsage(sub) {
       return "Usage: superone harness show <HARNESS_ID> [--json]";
     case "enable":
       return `Usage:
-  superone harness enable claude|codex --artifact <FILE> [--json]
+  superone harness enable claude|codex [--artifact <FILE>] [--json]
   superone harness enable opencode [--command <ABS_PATH> | --server-url <URL>] [--json]
   superone harness enable acp-grok [--command <ABS_PATH>] [--arg <VALUE>]... [--json]`;
     case "configure":
@@ -69172,88 +69695,12 @@ async function cmdRepair(manager, args) {
     return fail(err instanceof Error ? err.message : String(err), parsed.json);
   }
 }
-async function enableManaged(manager, id, artifact, mode = "enable") {
-  if (!isManagedHarnessId(id)) {
-    throw new Error(`not a managed harness: ${id}`);
-  }
-  const nodeHome = resolveNodeHome(void 0);
-  const manifest = loadHarnessReleaseManifest(nodeHome);
-  if (!manifest) {
-    throw new Error(
-      `no release manifest found (set SUPERONE_HARNESS_MANIFEST or write ${nodeHome}/release-manifest.json)`
-    );
-  }
-  if (!manifest.managedHarnesses[id]) {
-    throw new Error(`release manifest does not pin ${id}`);
-  }
-  if (!artifact) {
-    throw new Error(describeExpectedArtifact(id, manifest));
-  }
-  const abs = requireRegularReadableFile(artifact);
-  const installed = await installManagedArtifactFromFile({
-    nodeHome,
-    harnessId: id,
-    artifactPath: abs,
-    manifest,
-    expectedCliVersion: currentCliVersion(),
-    mode
-  });
-  const def = getNodeHarnessDefinition(id);
-  return manager.update(id, {
-    enabled: true,
-    state: def.requiresAuth ? "needs_auth" : "ready",
-    command: installed.installPath,
-    runtimeVersion: installed.runtimeVersion,
-    diagnosticCode: def.requiresAuth ? "needs_auth" : null,
-    diagnosticFields: def.requiresAuth ? { command: installed.installPath, runtimeVersion: installed.runtimeVersion } : null,
-    lastProbedAt: Date.now(),
-    configJson: JSON.stringify({
-      artifactPath: installed.installPath,
-      source: installed.source,
-      cliVersion: installed.cliVersion,
-      artifactVersion: installed.artifactVersion,
-      digestSha256: installed.digestSha256
-    })
-  });
-}
-function enableOpencode(manager, opts) {
-  if (opts.serverUrl) {
-    const safeUrl = validateServerUrl(opts.serverUrl);
-    return manager.update("opencode", {
-      enabled: true,
-      state: "ready",
-      command: null,
-      diagnosticCode: null,
-      lastProbedAt: Date.now(),
-      configJson: JSON.stringify({ serverUrl: safeUrl })
-    });
-  }
-  const resolved = resolveExternalCommand(opts.command, ["opencode"]);
-  if (!resolved) {
-    return manager.update("opencode", {
-      enabled: true,
-      state: "missing",
-      command: null,
-      diagnosticCode: "not_found",
-      lastProbedAt: Date.now(),
-      configJson: JSON.stringify({})
-    });
-  }
-  return manager.update("opencode", {
-    enabled: true,
-    state: "ready",
-    command: resolved,
-    diagnosticCode: null,
-    lastProbedAt: Date.now(),
-    configJson: JSON.stringify({ command: resolved })
-  });
-}
 function configureOpencode(manager, opts) {
   if (!opts.command && !opts.serverUrl) {
     throw new Error("configure opencode requires --command or --server-url");
   }
   if (opts.serverUrl) {
-    const safeUrl = validateServerUrl(opts.serverUrl);
+    const safeUrl = validateServerUrl2(opts.serverUrl);
     return manager.update("opencode", {
       enabled: true,
       state: "ready",
@@ -69263,7 +69710,7 @@ function configureOpencode(manager, opts) {
       configJson: JSON.stringify({ serverUrl: safeUrl })
     });
   }
-  const resolved = resolveExternalCommand(opts.command, []);
+  const resolved = resolveExternalCommand2(opts.command, []);
   if (!resolved) {
     throw new Error(
       `proposed opencode command is not a usable executable: ${opts.command ?? "(missing)"}`
@@ -69278,33 +69725,6 @@ function configureOpencode(manager, opts) {
     configJson: JSON.stringify({ command: resolved })
   });
 }
-function enableAcpGrok(manager, opts) {
-  const defaultArgs = ["agent", "stdio"];
-  const args = sanitizeHarnessArgs(opts.args.length > 0 ? opts.args : defaultArgs);
-  const resolved = resolveExternalCommand(opts.command, ["grok"]);
-  if (!resolved) {
-    return manager.update("acp-grok", {
-      enabled: true,
-      state: "missing",
-      command: null,
-      diagnosticCode: "not_found",
-      lastProbedAt: Date.now(),
-      configJson: JSON.stringify({ args, usesDefaultArgs: opts.args.length === 0 })
-    });
-  }
-  return manager.update("acp-grok", {
-    enabled: true,
-    state: "ready",
-    command: resolved,
-    diagnosticCode: null,
-    lastProbedAt: Date.now(),
-    configJson: JSON.stringify({
-      command: resolved,
-      args,
-      usesDefaultArgs: opts.args.length === 0
-    })
-  });
-}
 function configureAcpGrok(manager, opts) {
   const current = manager.get("acp-grok");
   const raw = manager.readRawRow("acp-grok");
@@ -69316,12 +69736,12 @@ function configureAcpGrok(manager, opts) {
     } catch {
     }
   }
-  const args = opts.defaultArgs ? ["agent", "stdio"] : opts.args.length > 0 ? sanitizeHarnessArgs(opts.args) : previousArgs;
+  const args = opts.defaultArgs ? ["agent", "stdio"] : opts.args.length > 0 ? sanitizeHarnessArgs2(opts.args) : previousArgs;
   if (!opts.command && opts.args.length === 0 && !opts.defaultArgs) {
     throw new Error("configure acp-grok requires --command, --arg, and/or --default-args");
   }
   const commandToProbe = opts.command ?? current.command ?? void 0;
-  const resolved = resolveExternalCommand(commandToProbe, opts.command ? [] : ["grok"]);
+  const resolved = resolveExternalCommand2(commandToProbe, opts.command ? [] : ["grok"]);
   if (!resolved) {
     throw new Error(
       `proposed acp-grok command is not a usable executable: ${commandToProbe ?? "(missing)"}`
@@ -69417,7 +69837,7 @@ function buildPublicConfigSummary(id, configJson, status) {
   }
   const out = {};
   if (id === "claude" || id === "codex") {
-    if (typeof parsed.artifactPath === "string" && isAbsolute3(parsed.artifactPath)) {
+    if (typeof parsed.artifactPath === "string" && isAbsolute4(parsed.artifactPath)) {
       out.artifactPath = parsed.artifactPath;
     }
     if (parsed.source === "offline-artifact") out.source = "offline-artifact";
@@ -69427,14 +69847,14 @@ function buildPublicConfigSummary(id, configJson, status) {
       out.digestSha256 = parsed.digestSha256;
     }
   } else if (id === "opencode") {
-    if (typeof parsed.command === "string" && isAbsolute3(parsed.command)) {
+    if (typeof parsed.command === "string" && isAbsolute4(parsed.command)) {
       out.command = parsed.command;
     }
     if (typeof parsed.serverUrl === "string") {
       out.serverUrl = redactServerUrlForDisplay(parsed.serverUrl);
     }
   } else if (id === "acp-grok") {
-    if (typeof parsed.command === "string" && isAbsolute3(parsed.command)) {
+    if (typeof parsed.command === "string" && isAbsolute4(parsed.command)) {
       out.command = parsed.command;
     }
     if (Array.isArray(parsed.args)) {
@@ -69446,31 +69866,9 @@ function buildPublicConfigSummary(id, configJson, status) {
   }
   return Object.keys(out).length ? out : null;
 }
-function requireRegularReadableFile(path) {
-  if (!isAbsolute3(path)) {
-    throw new Error(`path must be absolute: ${path}`);
-  }
-  if (!existsSync28(path)) {
-    throw new Error(`artifact not found: ${path}`);
-  }
-  const st = statSync8(path);
-  if (!st.isFile()) {
-    throw new Error(`artifact is not a regular file: ${path}`);
-  }
-  try {
-    accessSync(path, constants.R_OK);
-  } catch {
-    throw new Error(`artifact not readable: ${path}`);
-  }
-  try {
-    return realpathSync5(path);
-  } catch {
-    return path;
-  }
-}
-function resolveExternalCommand(explicit, pathCandidates) {
+function resolveExternalCommand2(explicit, pathCandidates) {
   if (explicit) {
-    if (!isAbsolute3(explicit)) {
+    if (!isAbsolute4(explicit)) {
       return null;
     }
     return isUsableExecutable(explicit);
@@ -69486,7 +69884,7 @@ function resolveExternalCommand(explicit, pathCandidates) {
   ];
   for (const name of pathCandidates) {
     for (const dir of [...dirs, ...extra]) {
-      const candidate = resolve8(dir, name);
+      const candidate = resolve10(dir, name);
       const ok = isUsableExecutable(candidate);
       if (ok) return ok;
     }
@@ -69494,56 +69892,56 @@ function resolveExternalCommand(explicit, pathCandidates) {
   return null;
 }
 function isUsableExecutable(path) {
-  if (!existsSync28(path)) return null;
+  if (!existsSync30(path)) return null;
   let st;
   try {
-    st = statSync8(path);
+    st = statSync10(path);
   } catch {
     return null;
   }
   if (!st.isFile()) return null;
   try {
-    accessSync(path, constants.X_OK);
+    accessSync2(path, constants2.X_OK);
   } catch {
     return null;
   }
   try {
-    return realpathSync5(path);
+    return realpathSync6(path);
   } catch {
     return path;
   }
 }
 function probeExecutableIssues(path) {
-  if (!existsSync28(path)) return ["command_missing"];
+  if (!existsSync30(path)) return ["command_missing"];
   let st;
   try {
-    st = statSync8(path);
+    st = statSync10(path);
   } catch {
     return ["command_missing"];
   }
   if (!st.isFile()) return ["command_not_file"];
   try {
-    accessSync(path, constants.X_OK);
+    accessSync2(path, constants2.X_OK);
   } catch {
     return ["command_not_executable"];
   }
   return [];
 }
 function probeReadableFileIssues(path) {
-  if (!existsSync28(path)) return ["artifact_missing"];
+  if (!existsSync30(path)) return ["artifact_missing"];
   try {
-    if (!statSync8(path).isFile()) return ["artifact_not_file"];
+    if (!statSync10(path).isFile()) return ["artifact_not_file"];
   } catch {
     return ["artifact_missing"];
   }
   try {
-    accessSync(path, constants.R_OK);
+    accessSync2(path, constants2.R_OK);
   } catch {
     return ["artifact_not_readable"];
   }
   return [];
 }
-function validateServerUrl(raw) {
+function validateServerUrl2(raw) {
   let url2;
   try {
     url2 = new URL(raw);
@@ -69578,15 +69976,15 @@ function redactServerUrlForDisplay(raw) {
     return "[invalid-url]";
   }
 }
-function sanitizeHarnessArgs(args) {
+function sanitizeHarnessArgs2(args) {
   for (const a of args) {
-    if (looksLikeSecretArg(a)) {
+    if (looksLikeSecretArg2(a)) {
       throw new Error("refusing to store credential-like --arg values");
     }
   }
   return args;
 }
-function looksLikeSecretArg(value) {
+function looksLikeSecretArg2(value) {
   if (/Bearer\s+\S+/i.test(value)) return true;
   if (/\b(password|passwd|token|secret|api[_-]?key)\b\s*=/i.test(value)) return true;
   if (/^[A-Z][A-Z0-9_]*(KEY|TOKEN|SECRET|PASSWORD)\s*=/.test(value)) return true;
@@ -69732,6 +70130,7 @@ Commands:
   status [--home DIR]
   identity [--home DIR]
   identity regenerate [--home DIR]
+  version
   install-systemd [--home DIR] [--exec PATH] [--host HOST] [--port PORT]
   uninstall-systemd
   systemd-status
@@ -69837,7 +70236,8 @@ async function main() {
             regenerated: true,
             environmentId: identity2.environmentId,
             nodePublicKeyFingerprint: identity2.publicKeyFingerprint,
-            bindingHash: identity2.bindingHash
+            bindingHash: identity2.bindingHash,
+            cliVersion: resolveCliReleaseVersion()
           },
           null,
           2
@@ -69853,7 +70253,8 @@ async function main() {
           nodePublicKeyFingerprint: identity.publicKeyFingerprint,
           bindingHash: identity.bindingHash,
           label: identity.label,
-          nodeHome
+          nodeHome,
+          cliVersion: resolveCliReleaseVersion()
         },
         null,
         2
@@ -69861,9 +70262,13 @@ async function main() {
     );
     return;
   }
+  if (cmd === "version") {
+    console.log(resolveCliReleaseVersion());
+    return;
+  }
   if (cmd === "install-systemd") {
     const nodeHome = resolveNodeHome(argValue(rest, "--home"));
-    const execStart = argValue(rest, "--exec") || resolve9(process.argv[1] || "superone");
+    const execStart = argValue(rest, "--exec") || resolve11(process.argv[1] || "superone");
     const host = argValue(rest, "--host") || DEFAULT_BIND_HOST;
     const port = Number(argValue(rest, "--port") || DEFAULT_BIND_PORT);
     const result = installSystemdUserService({