@super-one/cli 0.53.1-alpha → 0.53.3-alpha

package/lib/cli.mjs

@@ -659,7 +659,7 @@ var init_host_action_superone_descriptors = __esm({
       },
       {
         "name": "session_rename",
-        "description": 'Rename the current chat session to a concise topic label shown in the sidebar.\n\nOnly the top-level agent talking directly to the user may call this. If you were launched as a Task/subagent worker, do NOT call it \u2014 you do not own the user-facing session title.\n\nIf the tool returns an error containing "user_locked", the user has manually named this session \u2014 do not call session_rename again for this session.',
+        "description": 'Rename the current chat session to a concise topic label shown in the sidebar. Optional tags (set) label it for session_list/session_search \u2014 discover names with session_tag_list.\n\nOnly the top-level agent talking directly to the user may call this. If you were launched as a Task/subagent worker, do NOT call it \u2014 you do not own the user-facing session title.\n\nIf the tool returns an error containing "user_locked", the user has manually named this session \u2014 do not call session_rename again. Tags in the same call were still applied; use session_tag for later tag edits.',
         "inputSchema": {
           "type": "object",
           "properties": {
@@ -668,6 +668,12 @@ var init_host_action_superone_descriptors = __esm({
               "description": "A concise 4-8 word title describing the current conversation topic.",
               "minLength": 1,
               "maxLength": 80
+            },
+            "tags": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Replace this session's tags (set). Discover names with session_tag_list. Empty array clears. Applied even when the title is user_locked."
             }
           },
           "required": [
@@ -676,6 +682,81 @@ var init_host_action_superone_descriptors = __esm({
           "additionalProperties": false
         }
       },
+      {
+        "name": "session_tag",
+        "description": "Tag SuperOne sessions so session_list/session_search can filter by tag. Default: current session. Pass sessionId for one other session, or sessionIds with add to tag many. Use add, remove, or set (exactly one). set: [] clears. Discover existing labels with session_tag_list first \u2014 do not invent names. Only the top-level agent may call this; subagents must not. Not session_rename (titles) and not live collab.",
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "One session to tag. Default: current. Mutually exclusive with sessionIds."
+            },
+            "sessionIds": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 50,
+              "description": "Bulk target ids (max 50). add required; set/remove not allowed. Mutually exclusive with sessionId."
+            },
+            "add": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Tags to add (normalized, de-duped). Mutually exclusive with remove/set."
+            },
+            "remove": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Tags to remove. Mutually exclusive with add/set."
+            },
+            "set": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Replace all tags. Empty array clears. Mutually exclusive with add/remove."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      {
+        "name": "session_tag_list",
+        "description": "List tags used on SuperOne sessions (tag + session count). Default: current project; projectId or allProjects for other scope. Filter with query (tag substring). Hidden sessions omitted unless includeHidden. Call this before session_list/session_search with tags. Then filter with tags + tagMatch any (at least one) or all (every tag). Not live collab.",
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "query": {
+              "type": "string",
+              "description": "Case-insensitive substring filter on tag name."
+            },
+            "includeHidden": {
+              "type": "boolean",
+              "description": "Count hidden sessions. Default false."
+            },
+            "projectId": {
+              "type": "string",
+              "description": "List tags in this SuperOne project id only (from project_list). Mutually exclusive with allProjects. Default: current project."
+            },
+            "allProjects": {
+              "type": "boolean",
+              "description": "List tags across every SuperOne project. Mutually exclusive with projectId. Default false."
+            },
+            "limit": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100,
+              "description": "Max rows. Default 50, max 100."
+            },
+            "offset": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Pagination offset. Default 0."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
       {
         "name": "project_list",
         "description": "List SuperOne projects (id, name, path, lastActiveAt). Call this to discover projectId before session_list/session_search with projectId. Default order is last-active desc. Filter with query (name/path substring). isCurrent marks the project of the calling session.",
@@ -703,7 +784,7 @@ var init_host_action_superone_descriptors = __esm({
       },
       {
         "name": "session_list",
-        "description": "List SuperOne sessions (metadata only). Default: current project. Pass projectId (from project_list) for another project, or allProjects=true for every project. Rows include projectId only \u2014 use project_list for path/name. Use before session_read/session_search to find ids. Filter by title query, harness, pin/hidden, dates. Sort with order (default last_active_desc; last_active_asc oldest-first; also created_*, message_count_*, size_*). When order is size_*, rows include sizeBytes (approx character length of stored message JSON for ranking \u2014 not disk page-file bytes). Paginate with limit/offset. Not live collab or harness resume.",
+        "description": "List SuperOne sessions (metadata only). Default: current project. Pass projectId (from project_list) or allProjects=true. Rows include projectId only \u2014 use project_list for path/name. Use before session_read/session_search. Filter by title query, harness, pin/hidden, dates, or tags + tagMatch (any=at least one, all=every tag; default any). Discover tags with session_tag_list. Sort with order (default last_active_desc; also created_*, message_count_*, size_*). When order is size_*, rows include sizeBytes (character length of message JSON, not disk bytes). Paginate with limit/offset. Not live collab or harness resume.",
         "inputSchema": {
           "type": "object",
           "properties": {
@@ -741,6 +822,17 @@ var init_host_action_superone_descriptors = __esm({
               "type": "string",
               "description": "ISO timestamp \u2014 only sessions last active after this."
             },
+            "tags": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Tags from session_tag_list. Filter sessions that have these labels."
+            },
+            "tagMatch": {
+              "type": "string",
+              "enum": ["any", "all"],
+              "description": "any = at least one listed tag (default). all = every listed tag. Ignored when tags is omitted."
+            },
             "projectId": {
               "type": "string",
               "description": "List sessions in this SuperOne project id only (from project_list). Mutually exclusive with allProjects. Default: current project."
@@ -780,7 +872,7 @@ var init_host_action_superone_descriptors = __esm({
       },
       {
         "name": "session_search",
-        "description": "Search SuperOne chat transcripts by text. Default: current project; projectId (from project_list) or allProjects for cross-project. Returns matching message hits with short snippets and projectId. Then call session_read with sessionId/messageId for full content. Snippets are pointers only \u2014 not full message bodies.",
+        "description": "Search SuperOne chat transcripts by text (title + message body). Default: current project; projectId or allProjects for cross-project. Optional tags + tagMatch (any/all, default any) narrows sessions in SQL before scanning messages. Discover tags with session_tag_list. Returns matching message hits with short snippets and projectId. Then call session_read with sessionId/messageId. Snippets are pointers only \u2014 not full bodies.",
         "inputSchema": {
           "type": "object",
           "properties": {
@@ -815,6 +907,17 @@ var init_host_action_superone_descriptors = __esm({
               ],
               "description": "Message role filter. Default any."
             },
+            "tags": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 8,
+              "description": "Tags from session_tag_list. Filter sessions that have these labels."
+            },
+            "tagMatch": {
+              "type": "string",
+              "enum": ["any", "all"],
+              "description": "any = at least one listed tag (default). all = every listed tag. Ignored when tags is omitted."
+            },
             "projectId": {
               "type": "string",
               "description": "Search this SuperOne project id only (from project_list). Mutually exclusive with allProjects. Default: current project."
@@ -838,14 +941,14 @@ var init_host_action_superone_descriptors = __esm({
       },
       {
         "name": "session_read",
-        "description": "Read any SuperOne session's saved transcript by id (any project; harness-agnostic content; does not resume provider threads). Views: meta | user | assistant | text | tools | tool_detail. user/assistant/text are pure conversation (no tool lines; assistant/text include toolCount). tools = index; tool_detail needs toolUseId. Paginate with limit/cursor; anchor with messageId/around. Prefer user then on-demand assistant/tools. meta includes projectId (use project_list for path/name).",
+        "description": "Read another SuperOne session's saved transcript by id (any project; harness-agnostic; does not resume provider threads). Do not read the current session \u2014 it is already in your context. Views: meta | user | assistant | text | tools | tool_detail. user/assistant/text are pure conversation (no tool lines; assistant/text include toolCount). tools = index; tool_detail needs toolUseId. Paginate with limit/cursor; anchor with messageId/around. Prefer user then on-demand assistant/tools. meta includes projectId and tags.",
         "inputSchema": {
           "type": "object",
           "properties": {
             "sessionId": {
               "type": "string",
               "minLength": 1,
-              "description": "Target SuperOne session id from session_list or session_search (any project)."
+              "description": "Target SuperOne session id from session_list or session_search (any project). Do not pass the current session."
             },
             "view": {
               "type": "string",
@@ -9691,6 +9794,8 @@ var init_superone_host_owned_tools = __esm({
       "miniapp_dev_pack",
       "miniapp_dev_update_types",
       "session_rename",
+      "session_tag",
+      "session_tag_list",
       "project_list",
       "session_list",
       "session_search",
@@ -13190,6 +13295,10 @@ var init_session_runtime = __esm({
             session.isUserRenamed = false;
             changed = true;
           }
+          if (!Array.isArray(session.tags)) {
+            session.tags = [];
+            changed = true;
+          }
           if (session.isAutomation !== true && session.isAutomation !== false) {
             session.isAutomation = false;
             changed = true;
@@ -13264,6 +13373,7 @@ var init_session_runtime = __esm({
           isPinned: false,
           isHidden: false,
           isUserRenamed: false,
+          tags: [],
           controllerClientSessionId: controller,
           hostActionCapabilityVersion: controller ? input.hostActionCapabilityVersion ?? HOST_ACTION_CAPABILITY_VERSION : 0,
           hostActionToolGroups: controller ? input.hostActionToolGroups ?? [...DEFAULT_HOST_ACTION_TOOL_GROUPS] : [],
@@ -13455,6 +13565,7 @@ var init_session_runtime = __esm({
           isHidden: false,
           // Fork title is derived; start unlocked so agent can rename the fork.
           isUserRenamed: false,
+          tags: [],
           // Fork inherits controller binding (same paired desktop).
           controllerClientSessionId: source.controllerClientSessionId,
           hostActionCapabilityVersion: source.hostActionCapabilityVersion,
@@ -13927,6 +14038,17 @@ var init_session_runtime = __esm({
         });
         return this.clone(session);
       }
+      setTags(sessionId, tags) {
+        const session = this.live.get(sessionId);
+        if (!session) throw Object.assign(new Error("session not found"), { code: "not_found" });
+        if (session.closed) {
+          throw Object.assign(new Error("session is closed"), { code: "failed_precondition" });
+        }
+        session.tags = [...tags];
+        session.updatedAt = Date.now();
+        this.persist(session);
+        return this.clone(session);
+      }
       setUiFlags(sessionId, flags) {
         const session = this.live.get(sessionId);
         if (!session) throw Object.assign(new Error("session not found"), { code: "not_found" });
@@ -14789,6 +14911,7 @@ var init_session_runtime = __esm({
           transcript: s2.transcript.map((t) => ({ ...t })),
           pendingInteraction: s2.pendingInteraction ? { ...s2.pendingInteraction } : null,
           isUserRenamed: s2.isUserRenamed === true,
+          tags: [...s2.tags ?? []],
           controllerClientSessionId: s2.controllerClientSessionId ?? null,
           hostActionCapabilityVersion: s2.hostActionCapabilityVersion ?? 0,
           hostActionToolGroups: [...s2.hostActionToolGroups ?? []],
@@ -14989,7 +15112,8 @@ function createSqliteSessionStore(db) {
                   COALESCE(always_allowed_tools_json, '[]') AS always_allowed_tools_json,
                   settings_json,
                   COALESCE(is_automation, 0) AS is_automation,
-                  automation_id
+                  automation_id,
+                  COALESCE(tags_json, '[]') AS tags_json
            FROM sessions`
       ).all();
       const parseStringArray = (raw) => {
@@ -15028,7 +15152,8 @@ function createSqliteSessionStore(db) {
           hostActionToolGroups: parseStringArray(r.host_action_tool_groups_json),
           alwaysAllowedTools: parseStringArray(r.always_allowed_tools_json),
           isAutomation: r.is_automation === 1,
-          automationId: r.automation_id ?? null
+          automationId: r.automation_id ?? null,
+          tags: parseStringArray(r.tags_json)
         };
       });
     },
@@ -15039,8 +15164,8 @@ function createSqliteSessionStore(db) {
           pending_interaction_json, provider_resume, cwd, created_at, updated_at, is_pinned, is_hidden,
           is_user_renamed,
           controller_client_session_id, host_action_capability_version, host_action_tool_groups_json,
-          always_allowed_tools_json, settings_json, is_automation, automation_id)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          always_allowed_tools_json, settings_json, is_automation, automation_id, tags_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(session_id) DO UPDATE SET
            title = excluded.title,
            status = excluded.status,
@@ -15058,7 +15183,8 @@ function createSqliteSessionStore(db) {
            always_allowed_tools_json = excluded.always_allowed_tools_json,
            settings_json = excluded.settings_json,
            is_automation = excluded.is_automation,
-           automation_id = excluded.automation_id`
+           automation_id = excluded.automation_id,
+           tags_json = excluded.tags_json`
       ).run(
         session.sessionId,
         session.projectId,
@@ -15081,7 +15207,8 @@ function createSqliteSessionStore(db) {
         JSON.stringify(session.alwaysAllowedTools ?? []),
         serializeSettingsJson(session),
         session.isAutomation ? 1 : 0,
-        session.automationId ?? null
+        session.automationId ?? null,
+        JSON.stringify(session.tags ?? [])
       );
     },
     delete(sessionId) {
@@ -42431,13 +42558,13 @@ var init_tool_normalization = __esm({
 // ../../packages/shared/src/session-archive-result-shape.ts
 function isSessionArchiveToolName(toolName) {
   if (!toolName) return false;
-  return /(?:^|__)(?:project_list|session_(?:list|search|read|cleanup))$/.test(toolName);
+  return /(?:^|__)(?:project_list|session_(?:list|search|read|cleanup|tag_list))$/.test(toolName);
 }
 function looksLikeSessionArchiveToon(summary) {
-  return /(?:^|\n)(?:projects|sessions|hits)\[\d+\]/.test(summary.trim());
+  return /(?:^|\n)(?:projects|sessions|hits|tags)\[\d+\]/.test(summary.trim());
 }
 function looksLikeSessionArchiveJson(obj) {
-  return Array.isArray(obj.sessions) || Array.isArray(obj.hits) || Array.isArray(obj.projects) || typeof obj.action === "string" && (Array.isArray(obj.deleted) || Array.isArray(obj.affected) || Array.isArray(obj.candidates) || Array.isArray(obj.failed));
+  return Array.isArray(obj.sessions) || Array.isArray(obj.hits) || Array.isArray(obj.projects) || Array.isArray(obj.tags) || typeof obj.action === "string" && (Array.isArray(obj.deleted) || Array.isArray(obj.affected) || Array.isArray(obj.candidates) || Array.isArray(obj.failed));
 }
 var init_session_archive_result_shape = __esm({
   "../../packages/shared/src/session-archive-result-shape.ts"() {
@@ -51316,6 +51443,139 @@ var init_cursor_sdk_available = __esm({
   }
 });
 
+// ../../packages/cursor/src/cursor-platform-binaries.ts
+import { existsSync as existsSync21, statSync as statSync5 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { dirname as dirname11, join as join18 } from "node:path";
+function cursorPlatformPackageName(platform2 = process.platform, arch2 = process.arch) {
+  return `@cursor/sdk-${platform2}-${arch2}`;
+}
+function toUnpackedAsarPath(filePath) {
+  return filePath.replace(/app\.asar([\\/])/, "app.asar.unpacked$1");
+}
+function isExecutableFile(candidate) {
+  try {
+    const st = statSync5(candidate);
+    if (!st.isFile()) return false;
+    if (process.platform === "win32") return true;
+    return (st.mode & 73) !== 0;
+  } catch {
+    return false;
+  }
+}
+function cursorSdkRequire() {
+  try {
+    return createRequire3(requireFromHere.resolve("@cursor/sdk/package.json"));
+  } catch {
+    return requireFromHere;
+  }
+}
+function resolveCursorPlatformRoot() {
+  const name = cursorPlatformPackageName();
+  const req = cursorSdkRequire();
+  try {
+    const pkgJson = toUnpackedAsarPath(req.resolve(`${name}/package.json`));
+    return existsSync21(pkgJson) ? dirname11(pkgJson) : null;
+  } catch {
+    return null;
+  }
+}
+function platformBinName(base) {
+  return process.platform === "win32" ? `${base}.exe` : base;
+}
+function resolveCursorSandboxBinary() {
+  const root = resolveCursorPlatformRoot();
+  if (!root) return null;
+  const bin = join18(root, "bin", platformBinName("cursorsandbox"));
+  return isExecutableFile(bin) ? bin : null;
+}
+function resolveCursorRipgrepBinary() {
+  const root = resolveCursorPlatformRoot();
+  if (!root) return null;
+  const bin = join18(root, "bin", platformBinName("rg"));
+  return isExecutableFile(bin) ? bin : null;
+}
+function resolveCursorTreeSitterVendorDir() {
+  const root = resolveCursorPlatformRoot();
+  if (!root) return null;
+  const vendor = join18(root, "vendor");
+  return existsSync21(join18(vendor, "tree-sitter", "index.js")) ? vendor : null;
+}
+function sandboxExecAvailable() {
+  try {
+    statSync5("/usr/bin/sandbox-exec");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isCursorLocalSandboxSupported(probe = {}) {
+  const platform2 = probe.platform ?? process.platform;
+  if (platform2 === "win32") return false;
+  const binary = probe.sandboxBinary !== void 0 ? probe.sandboxBinary : resolveCursorSandboxBinary();
+  if (!binary) return false;
+  if (platform2 === "darwin") {
+    const execOk = probe.sandboxExecExists ?? sandboxExecAvailable();
+    return execOk;
+  }
+  return true;
+}
+function resolveCursorSandboxEnabled(requested, probe) {
+  return requested && isCursorLocalSandboxSupported(probe);
+}
+function isCursorSandboxUnsupportedError(error51) {
+  const message = error51 instanceof Error ? error51.message : String(error51);
+  return /sandboxing is not supported/i.test(message);
+}
+function primeHelperEnv() {
+  if (!process.env.CURSOR_RIPGREP_PATH) {
+    const rg = resolveCursorRipgrepBinary();
+    if (rg) process.env.CURSOR_RIPGREP_PATH = rg;
+  }
+  if (!process.env.CURSOR_TREE_SITTER_VENDOR_DIR) {
+    const vendor = resolveCursorTreeSitterVendorDir();
+    if (vendor) process.env.CURSOR_TREE_SITTER_VENDOR_DIR = vendor;
+  }
+}
+function beginPlatformLookup() {
+  if (lookupDepth === 0) {
+    savedArgv1 = process.argv[1];
+    const root = resolveCursorPlatformRoot();
+    if (root) process.argv[1] = join18(root, "package.json");
+    primeHelperEnv();
+  }
+  lookupDepth += 1;
+  return () => {
+    lookupDepth = Math.max(0, lookupDepth - 1);
+    if (lookupDepth === 0 && savedArgv1 !== void 0) {
+      process.argv[1] = savedArgv1;
+      savedArgv1 = void 0;
+    }
+  };
+}
+function withCursorPlatformLookup(fn) {
+  const restore = beginPlatformLookup();
+  try {
+    const result = fn();
+    if (result && typeof result.then === "function") {
+      return result.finally(restore);
+    }
+    restore();
+    return result;
+  } catch (error51) {
+    restore();
+    throw error51;
+  }
+}
+var requireFromHere, lookupDepth, savedArgv1;
+var init_cursor_platform_binaries = __esm({
+  "../../packages/cursor/src/cursor-platform-binaries.ts"() {
+    "use strict";
+    requireFromHere = createRequire3(import.meta.url);
+    lookupDepth = 0;
+  }
+});
+
 // ../../packages/cursor/src/cursor-mcp-map.ts
 function mcpServersToStatus(servers) {
   return Object.keys(servers).map((name) => ({ name, status: "connected" }));
@@ -51841,7 +52101,7 @@ var init_cursor_event_map = __esm({
 import Database2 from "better-sqlite3";
 import { mkdirSync as mkdirSync11 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function workspaceHash(workspaceRef) {
   return createHash4("md5").update(workspaceRef).digest("hex");
 }
@@ -51884,7 +52144,7 @@ var init_cursor_store = __esm({
       runEvents;
       db;
       constructor(dbPath) {
-        mkdirSync11(join18(dbPath, ".."), { recursive: true });
+        mkdirSync11(join19(dbPath, ".."), { recursive: true });
         this.db = new Database2(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.migrate();
@@ -51894,9 +52154,9 @@ var init_cursor_store = __esm({
         this.runEvents = this.createRunEvents();
       }
       static openForWorkspace(userDataRoot, workspaceRef) {
-        const dir = join18(userDataRoot, "cursor-sdk", workspaceHash(workspaceRef));
+        const dir = join19(userDataRoot, "cursor-sdk", workspaceHash(workspaceRef));
         mkdirSync11(dir, { recursive: true });
-        return new _BetterSqliteLocalAgentStore(join18(dir, "agent-store.db"));
+        return new _BetterSqliteLocalAgentStore(join19(dir, "agent-store.db"));
       }
       dispose() {
         this.db.close();
@@ -52374,6 +52634,126 @@ var init_cursor_sdk_auth = __esm({
   }
 });
 
+// ../../packages/cursor/src/cursor-local-options.ts
+function resolveCursorLocalSessionPlan(input) {
+  const config2 = readCursorConfig(input.config);
+  const resolveApiKey = input.resolveApiKey ?? resolveCursorApiKeyPlain;
+  const buildMcpServers = input.buildMcpServers ?? (() => ({}));
+  const isCloud = config2.runtime === "cloud" || (input.providerSessionId?.startsWith("bc-") ?? false);
+  const perm = mapPermissionToCursorLocal(input.permissionMode);
+  const settingSources = config2.settingSources ?? DEFAULT_CURSOR_SETTING_SOURCES;
+  const sandboxRequested = input.sandboxEnabled ?? config2.sandboxEnabled ?? false;
+  const sandboxEnabled = isCloud ? false : resolveCursorSandboxEnabled(sandboxRequested);
+  const mcpServers = isCloud ? stripStdioCwd(buildMcpServers(input.cwd, input.sessionId)) : buildMcpServers(input.cwd, input.sessionId);
+  return {
+    apiKey: resolveApiKey(input.config),
+    config: config2,
+    isCloud,
+    settingSources,
+    sandboxEnabled,
+    sandboxRequested,
+    perm,
+    enableAgentRetries: config2.enableAgentRetries ?? true,
+    mcpServers
+  };
+}
+var DEFAULT_CURSOR_SETTING_SOURCES;
+var init_cursor_local_options = __esm({
+  "../../packages/cursor/src/cursor-local-options.ts"() {
+    "use strict";
+    init_cursor_config();
+    init_cursor_platform_binaries();
+    init_cursor_mcp_map();
+    DEFAULT_CURSOR_SETTING_SOURCES = ["project", "user"];
+  }
+});
+
+// ../../packages/cursor/src/cursor-network-retry.ts
+import { NetworkError } from "@cursor/sdk";
+function isCursorRetryableNetworkError(error51) {
+  if (error51 instanceof NetworkError) return error51.isRetryable;
+  if (!error51 || typeof error51 !== "object") return false;
+  const name = "name" in error51 ? String(error51.name) : "";
+  if (name !== "NetworkError") return false;
+  if (!("isRetryable" in error51)) return true;
+  return Boolean(error51.isRetryable);
+}
+function defaultSleep(ms) {
+  return new Promise((resolve13) => {
+    setTimeout(resolve13, ms);
+  });
+}
+async function withCursorNetworkRetries(fn, opts) {
+  const retries = opts?.retries ?? CURSOR_NETWORK_RETRY_ATTEMPTS;
+  const baseDelayMs = opts?.baseDelayMs ?? CURSOR_NETWORK_RETRY_BASE_DELAY_MS;
+  const maxDelayMs = opts?.maxDelayMs ?? CURSOR_NETWORK_RETRY_MAX_DELAY_MS;
+  const sleep = opts?.sleep ?? defaultSleep;
+  let lastError;
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    try {
+      return await fn();
+    } catch (error51) {
+      lastError = error51;
+      if (!isCursorRetryableNetworkError(error51) || attempt === retries) throw error51;
+      const delayMs = Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+      opts?.onRetry?.({ attempt: attempt + 1, retries, delayMs, error: error51 });
+      await sleep(delayMs);
+    }
+  }
+  throw lastError;
+}
+var CURSOR_NETWORK_RETRY_ATTEMPTS, CURSOR_NETWORK_RETRY_BASE_DELAY_MS, CURSOR_NETWORK_RETRY_MAX_DELAY_MS;
+var init_cursor_network_retry = __esm({
+  "../../packages/cursor/src/cursor-network-retry.ts"() {
+    "use strict";
+    CURSOR_NETWORK_RETRY_ATTEMPTS = 5;
+    CURSOR_NETWORK_RETRY_BASE_DELAY_MS = 2e3;
+    CURSOR_NETWORK_RETRY_MAX_DELAY_MS = 8e3;
+  }
+});
+
+// ../../packages/cursor/src/cursor-sdk-trace.ts
+function createCursorSdkTracer(onSdkTrace) {
+  const emit = (source, type, data, tag) => {
+    if (!onSdkTrace) return;
+    try {
+      onSdkTrace(source, type, data, tag);
+    } catch {
+    }
+  };
+  return {
+    sdk(type, data, tag) {
+      emit("agent.sdk", type || "unknown", data, tag);
+    },
+    runtime(type, data, tag) {
+      emit("cursor.runtime", type || "unknown", data, tag);
+    }
+  };
+}
+function cursorSdkType(value, fallback) {
+  if (!value || typeof value !== "object") return fallback;
+  const type = value.type;
+  return typeof type === "string" && type ? type : fallback;
+}
+function cursorUserSendTracePayload(message) {
+  if (typeof message === "string") return { text: message };
+  if (!message || typeof message !== "object") return message;
+  const rec = message;
+  if (!Array.isArray(rec.images)) return message;
+  return {
+    text: rec.text,
+    images: rec.images.map((img) => ({
+      mimeType: typeof img?.mimeType === "string" ? img.mimeType : "",
+      bytes: typeof img?.data === "string" ? img.data.length : 0
+    }))
+  };
+}
+var init_cursor_sdk_trace = __esm({
+  "../../packages/cursor/src/cursor-sdk-trace.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/cursor/src/cursor-runtime.ts
 import {
   Agent as Agent4,
@@ -52402,41 +52782,63 @@ async function createCursorRuntime(opts) {
     error: opts.log?.error ?? noopLog.error,
     debug: opts.log?.debug ?? noopLog.debug
   };
-  const resolveApiKey = opts.resolveApiKey ?? resolveCursorApiKeyPlain;
-  const buildMcpServers = opts.buildMcpServers ?? (() => ({}));
-  const config2 = readCursorConfig(opts.config);
-  const apiKey = resolveApiKey(opts.config);
+  const tracer = createCursorSdkTracer(opts.onSdkTrace);
+  const plan = resolveCursorLocalSessionPlan(opts);
+  const apiKey = plan.apiKey;
   if (!apiKey) {
     throw new Error(
       "Cursor User API Key missing. Create one at https://cursor.com/dashboard/api, set it on the Cursor provider, or export CURSOR_API_KEY."
     );
   }
-  if (config2.useHttp1ForAgent != null) {
+  if (plan.config.useHttp1ForAgent != null) {
     try {
-      Cursor4.configure({ local: { useHttp1ForAgent: config2.useHttp1ForAgent } });
+      Cursor4.configure({ local: { useHttp1ForAgent: plan.config.useHttp1ForAgent } });
     } catch (error51) {
       log2.debug("[CursorRuntime] Cursor.configure useHttp1ForAgent failed:", error51);
     }
   }
-  const isCloud = config2.runtime === "cloud" || (opts.providerSessionId?.startsWith("bc-") ?? false);
-  const modelId = opts.modelSelection?.id || opts.model || config2.model;
+  const isCloud = plan.isCloud;
+  const modelId = opts.modelSelection?.id || opts.model || plan.config.model;
   if (!isCloud && !modelId) {
     throw new Error("Cursor model is required for local agents. Connect Cursor to load models, then select one.");
   }
-  const perm = mapPermissionToCursorLocal(opts.permissionMode);
+  const perm = plan.perm;
   const model = opts.modelSelection ?? (modelId ? { id: modelId } : void 0);
-  const settingSources = config2.settingSources ?? ["project", "user"];
-  const sandboxEnabled = opts.sandboxEnabled ?? config2.sandboxEnabled ?? false;
-  const mcpServers = isCloud ? stripStdioCwd(buildMcpServers(opts.cwd, opts.sessionId)) : buildMcpServers(opts.cwd, opts.sessionId);
+  const settingSources = plan.settingSources;
+  let sandboxEnabled = plan.sandboxEnabled;
+  if (plan.sandboxRequested && !sandboxEnabled) {
+    log2.warn(
+      "[CursorRuntime] sandbox requested but Cursor local sandbox is unavailable; running unsandboxed"
+    );
+  }
+  const mcpServers = plan.mcpServers;
+  const config2 = plan.config;
+  const buildMcpServers = opts.buildMcpServers ?? (() => ({}));
   const customTools = isCloud ? void 0 : buildCursorCustomTools({ sessionId: opts.sessionId, cwd: opts.cwd });
   const agentName = opts.agentName?.trim() || void 0;
   const toolRestrictions = isCloud ? {} : resolveCursorToolRestrictions(config2);
   const toolsOpt = toolRestrictions.tools ? { tools: toolRestrictions.tools } : {};
   const disallowedOpt = toolRestrictions.disallowedTools ? { disallowedTools: toolRestrictions.disallowedTools } : {};
-  let agent;
-  try {
+  const createStarted = Date.now();
+  log2.info("[CursorRuntime] opening agent", {
+    sessionId: opts.sessionId,
+    sandboxEnabled,
+    mcpCount: Object.keys(mcpServers).length,
+    settingSources
+  });
+  tracer.runtime("create_session", {
+    sessionId: opts.sessionId,
+    cwd: opts.cwd,
+    sandboxEnabled,
+    mcpCount: Object.keys(mcpServers).length,
+    settingSources,
+    resume: opts.providerSessionId ?? null,
+    model: modelId ?? null,
+    isCloud
+  }, opts.sessionId);
+  const openAgent = (sandbox) => withCursorPlatformLookup(async () => {
     if (opts.providerSessionId) {
-      agent = await Agent4.resume(opts.providerSessionId, {
+      return Agent4.resume(opts.providerSessionId, {
         apiKey,
         ...model ? { model } : {},
         ...agentName ? { name: agentName } : {},
@@ -52449,16 +52851,17 @@ async function createCursorRuntime(opts) {
             cwd: opts.cwd,
             store: getCursorAgentStore(opts.userDataRoot, opts.cwd),
             settingSources,
-            sandboxOptions: { enabled: sandboxEnabled },
+            sandboxOptions: { enabled: sandbox },
             // Session permission UI owns autoReview; static config must not override.
             autoReview: perm.autoReview,
-            enableAgentRetries: config2.enableAgentRetries ?? true,
+            enableAgentRetries: plan.enableAgentRetries,
             ...customTools ? { customTools } : {}
           }
         }
       });
-    } else if (isCloud) {
-      agent = await Agent4.create({
+    }
+    if (isCloud) {
+      return Agent4.create({
         apiKey,
         ...model ? { model } : {},
         ...agentName ? { name: agentName } : {},
@@ -52466,30 +52869,77 @@ async function createCursorRuntime(opts) {
         mcpServers,
         cloud: buildCloudOptions(config2)
       });
-    } else {
-      agent = await Agent4.create({
-        apiKey,
-        model,
-        ...agentName ? { name: agentName } : {},
-        mode: perm.mode,
-        mcpServers,
-        ...toolsOpt,
-        ...disallowedOpt,
-        local: {
-          cwd: opts.cwd,
-          store: getCursorAgentStore(opts.userDataRoot, opts.cwd),
-          settingSources,
-          sandboxOptions: { enabled: sandboxEnabled },
-          // Session permission UI owns autoReview; static config must not override.
-          autoReview: perm.autoReview,
-          enableAgentRetries: config2.enableAgentRetries ?? true,
-          ...customTools ? { customTools } : {}
-        }
+    }
+    return Agent4.create({
+      apiKey,
+      model,
+      ...agentName ? { name: agentName } : {},
+      mode: perm.mode,
+      mcpServers,
+      ...toolsOpt,
+      ...disallowedOpt,
+      local: {
+        cwd: opts.cwd,
+        store: getCursorAgentStore(opts.userDataRoot, opts.cwd),
+        settingSources,
+        sandboxOptions: { enabled: sandbox },
+        // Session permission UI owns autoReview; static config must not override.
+        autoReview: perm.autoReview,
+        enableAgentRetries: plan.enableAgentRetries,
+        ...customTools ? { customTools } : {}
+      }
+    });
+  });
+  const openAgentRetrying = (sandbox) => withCursorNetworkRetries(() => openAgent(sandbox), {
+    onRetry: ({ attempt, retries, delayMs, error: error51 }) => {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      log2.warn("[CursorRuntime] retryable network error on Agent.create", {
+        attempt,
+        retries,
+        delayMs,
+        message
       });
+      tracer.runtime("create_retry", {
+        attempt,
+        retries,
+        delayMs,
+        message,
+        name: error51 instanceof Error ? error51.name : "Error"
+      }, opts.sessionId);
     }
+  });
+  let agent;
+  try {
+    agent = await openAgentRetrying(sandboxEnabled);
   } catch (error51) {
-    throw formatCursorError(error51);
+    if (!isCloud && sandboxEnabled && isCursorSandboxUnsupportedError(error51)) {
+      log2.warn(
+        "[CursorRuntime] Cursor SDK rejected local sandbox; retrying with sandbox disabled"
+      );
+      tracer.runtime("sandbox_fallback", {
+        sessionId: opts.sessionId,
+        message: error51 instanceof Error ? error51.message : String(error51)
+      }, opts.sessionId);
+      sandboxEnabled = false;
+      try {
+        agent = await openAgentRetrying(false);
+      } catch (retryError) {
+        throw formatCursorError(retryError);
+      }
+    } else {
+      throw formatCursorError(error51);
+    }
   }
+  log2.info("[CursorRuntime] agent ready", {
+    agentId: agent.agentId,
+    ms: Date.now() - createStarted,
+    sandboxEnabled
+  });
+  tracer.runtime("agent_ready", {
+    agentId: agent.agentId,
+    ms: Date.now() - createStarted,
+    sandboxEnabled
+  }, opts.sessionId);
   opts.onProviderSessionId?.(agent.agentId);
   opts.onEvent({ type: "provider_session_id", providerSessionId: agent.agentId });
   let currentRun = null;
@@ -52547,18 +52997,28 @@ async function createCursorRuntime(opts) {
       lastMcpServers = servers;
       const contextWindow = resolveContextWindow(modelSelection);
       const callIdBridge = new CursorTurnCallIdBridge();
+      const sendStarted = Date.now();
+      log2.info("[CursorRuntime] send start", { messageId });
+      tracer.sdk("user_send", cursorUserSendTracePayload(userMessage2), messageId);
+      tracer.runtime("send_start", {
+        messageId,
+        model: modelSelection?.id ?? null,
+        force: Boolean(sendOpts?.force)
+      }, messageId);
       const sendOptions = {
         ...modelSelection ? { model: modelSelection } : {},
         mode: permLocal.mode,
         mcpServers: Object.keys(servers).length ? servers : void 0,
         ...sendOpts?.idempotencyKey ? { idempotencyKey: sendOpts.idempotencyKey } : {},
         onDelta: ({ update }) => {
+          tracer.sdk(cursorSdkType(update, "delta"), update, messageId);
           callIdBridge.observeDelta(update);
           for (const event of mapInteractionUpdate(messageId, update, { contextWindow })) {
             opts.onEvent(event);
           }
         },
         onStep: ({ step }) => {
+          tracer.sdk(cursorSdkType(step, "step"), step, messageId);
           for (const event of mapConversationStep(messageId, step, {
             resolveCallId: () => callIdBridge.claimNextCallId()
           })) {
@@ -52579,28 +53039,54 @@ async function createCursorRuntime(opts) {
       } catch (error51) {
         if (error51 instanceof AgentBusyError && !sendOpts?.force && !isCloud) {
           log2.warn("[CursorRuntime] AgentBusyError \u2014 retrying with local.force");
+          tracer.runtime("agent_busy_retry", {
+            message: error51 instanceof Error ? error51.message : String(error51)
+          }, messageId);
           try {
             run = await agent.send(userMessage2, {
               ...sendOptions,
               local: { force: true }
             });
           } catch (retryError) {
+            tracer.runtime("send_error", {
+              message: retryError instanceof Error ? retryError.message : String(retryError),
+              name: retryError instanceof Error ? retryError.name : "Error",
+              afterForce: true
+            }, messageId);
             throw formatCursorError(retryError);
           }
         } else {
+          tracer.runtime("send_error", {
+            message: error51 instanceof Error ? error51.message : String(error51),
+            name: error51 instanceof Error ? error51.name : "Error",
+            ms: Date.now() - sendStarted
+          }, messageId);
           throw formatCursorError(error51);
         }
       }
       currentRun = run;
       lastRunId = run.id;
-      log2.debug("[CursorRuntime] run started", { runId: run.id, agentId: run.agentId });
+      log2.info("[CursorRuntime] run started", {
+        runId: run.id,
+        agentId: run.agentId,
+        ms: Date.now() - sendStarted
+      });
+      tracer.runtime("run_started", {
+        runId: run.id,
+        agentId: run.agentId,
+        ms: Date.now() - sendStarted
+      }, messageId);
       void (async () => {
         try {
           if (!run.supports("stream")) {
             log2.debug("[CursorRuntime] stream unsupported:", run.unsupportedReason("stream"));
+            tracer.runtime("stream_unsupported", {
+              reason: run.unsupportedReason("stream") ?? null
+            }, messageId);
             return;
           }
           for await (const message of run.stream()) {
+            tracer.sdk(cursorSdkType(message, "stream"), message, messageId);
             for (const event of mapSdkMessageLifecycle(messageId, message, {
               includeContent: false,
               contextWindow
@@ -52610,9 +53096,23 @@ async function createCursorRuntime(opts) {
           }
         } catch (error51) {
           log2.debug("[CursorRuntime] stream consumer ended:", error51);
+          tracer.runtime("stream_error", {
+            message: error51 instanceof Error ? error51.message : String(error51),
+            name: error51 instanceof Error ? error51.name : "Error"
+          }, messageId);
         }
       })();
-      const result = await run.wait();
+      let result;
+      try {
+        result = await run.wait();
+      } catch (error51) {
+        tracer.runtime("wait_error", {
+          message: error51 instanceof Error ? error51.message : String(error51),
+          name: error51 instanceof Error ? error51.name : "Error"
+        }, messageId);
+        throw formatCursorError(error51);
+      }
+      tracer.sdk("result", result, messageId);
       currentRun = null;
       lastRunId = result.id || lastRunId;
       if (result.usage) {
@@ -52689,10 +53189,14 @@ var init_cursor_runtime = __esm({
   "../../packages/cursor/src/cursor-runtime.ts"() {
     "use strict";
     init_cursor_config();
+    init_cursor_local_options();
+    init_cursor_network_retry();
     init_cursor_custom_tools();
     init_cursor_event_map();
     init_cursor_mcp_map();
     init_cursor_model_selection();
+    init_cursor_platform_binaries();
+    init_cursor_sdk_trace();
     init_cursor_store();
     noopLog = {
       info: () => void 0,
@@ -52713,6 +53217,25 @@ var init_cursor_runtime = __esm({
   }
 });
 
+// ../../packages/cursor/src/cursor-workspace-prewarm.ts
+import { createAgentPlatform } from "@cursor/sdk";
+var init_cursor_workspace_prewarm = __esm({
+  "../../packages/cursor/src/cursor-workspace-prewarm.ts"() {
+    "use strict";
+    init_cursor_sdk_trace();
+    init_cursor_local_options();
+    init_cursor_platform_binaries();
+  }
+});
+
+// ../../packages/cursor/src/cursor-skills-discover.ts
+var init_cursor_skills_discover = __esm({
+  "../../packages/cursor/src/cursor-skills-discover.ts"() {
+    "use strict";
+    init_fs();
+  }
+});
+
 // ../../packages/cursor/src/run-sdk-turn.ts
 async function runCursorSdkTurn(opts) {
   if (opts.signal?.aborted) {
@@ -52839,6 +53362,7 @@ var init_src5 = __esm({
     "use strict";
     init_cursor_config();
     init_cursor_sdk_available();
+    init_cursor_platform_binaries();
     init_cursor_mcp_map();
     init_cursor_custom_tools();
     init_cursor_event_map();
@@ -52848,6 +53372,10 @@ var init_src5 = __esm({
     init_cursor_cloud();
     init_cursor_sdk_auth();
     init_cursor_runtime();
+    init_cursor_sdk_trace();
+    init_cursor_workspace_prewarm();
+    init_cursor_skills_discover();
+    init_cursor_network_retry();
     init_run_sdk_turn2();
     init_simulated_runner3();
   }
@@ -53061,7 +53589,7 @@ var init_codex_live_turn = __esm({
 });
 
 // src/session/codex-turn-runner.ts
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function mapCodexReasoningEffort(effort) {
   if (!effort) return void 0;
   const e = effort.trim().toLowerCase();
@@ -53072,18 +53600,18 @@ function mapCodexReasoningEffort(effort) {
   return void 0;
 }
 function resolveCodexBinaryPath(opts) {
-  if (opts.binaryPath && existsSync21(opts.binaryPath)) return opts.binaryPath;
+  if (opts.binaryPath && existsSync22(opts.binaryPath)) return opts.binaryPath;
   const fromEnv = process.env.SUPERONE_CODEX_BINARY?.trim();
-  if (fromEnv && existsSync21(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync22(fromEnv)) return fromEnv;
   const status = opts.harnesses?.get("codex");
-  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync21(status.command)) {
+  if (status?.enabled && (status.state === "ready" || status.state === "needs_auth") && status.command && existsSync22(status.command)) {
     return status.command;
   }
   return null;
 }
 function isCodexBinaryOverrideRunnable() {
   const fromEnv = process.env.SUPERONE_CODEX_BINARY?.trim();
-  return Boolean(fromEnv && existsSync21(fromEnv));
+  return Boolean(fromEnv && existsSync22(fromEnv));
 }
 function providerEnvKeyOf(env) {
   return [
@@ -60528,8 +61056,8 @@ import { fileURLToPath } from "node:url";
 function resolveCliReleaseVersion() {
   const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
   if (fromEnv) return fromEnv;
-  if ("0.53.1-alpha".trim()) {
-    return "0.53.1-alpha".trim();
+  if ("0.53.3-alpha".trim()) {
+    return "0.53.3-alpha".trim();
   }
   const fromDist = readDistManifestVersion();
   if (fromDist) return fromDist;
@@ -60779,7 +61307,7 @@ function regenerateIdentity(nodeHome, label) {
 }
 
 // src/runtime.ts
-import { existsSync as existsSync39, readFileSync as readFileSync19, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync40, readFileSync as readFileSync19, writeFileSync as writeFileSync17 } from "node:fs";
 
 // src/auth/auth-service.ts
 init_environment();
@@ -61249,7 +61777,8 @@ CREATE TABLE IF NOT EXISTS sessions (
   settings_json TEXT,
   -- Automation ownership markers (filterable in session.list metadata)
   is_automation INTEGER NOT NULL DEFAULT 0,
-  automation_id TEXT
+  automation_id TEXT,
+  tags_json TEXT NOT NULL DEFAULT '[]'
 );
 
 -- Host Action channel (durable poll/claim/respond). Also ensured at open time.
@@ -61412,6 +61941,7 @@ function openNodeDatabase(dbPath) {
   ensureSessionSettingsColumn(db);
   ensureCollaborationTables(db);
   ensureAutomationsSupport(db);
+  ensureSessionTagsColumn(db);
   ensureSessionProvidersSupport(db);
   const row = db.prepare("SELECT value FROM meta WHERE key = ?").get("schema_generation");
   if (!row) {
@@ -61608,6 +62138,12 @@ CREATE TABLE IF NOT EXISTS session_collaboration_cursors (
     db.exec(`ALTER TABLE session_collaboration_grants ADD COLUMN kind TEXT NOT NULL DEFAULT 'spawn'`);
   }
 }
+function ensureSessionTagsColumn(db) {
+  const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+  if (!cols.some((c) => c.name === "tags_json")) {
+    db.exec(`ALTER TABLE sessions ADD COLUMN tags_json TEXT NOT NULL DEFAULT '[]'`);
+  }
+}
 function ensureAutomationsSupport(db) {
   const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
   const names = new Set(cols.map((c) => c.name));
@@ -61682,6 +62218,86 @@ init_environment();
 // src/rpc/handlers.ts
 init_environment();
 
+// ../../packages/shared/src/session-tags.ts
+var SESSION_TAG_MAX_LENGTH = 32;
+var SESSION_TAG_MAX_PER_SESSION = 8;
+var TAG_CHAR = /^[\p{L}\p{N}]+(?:-[\p{L}\p{N}]+)*$/u;
+function normalizeSessionTag(raw) {
+  const collapsed = raw.trim().toLowerCase().replace(/\s+/g, "-");
+  if (!collapsed || collapsed.length > SESSION_TAG_MAX_LENGTH) return null;
+  if (!TAG_CHAR.test(collapsed)) return null;
+  return collapsed;
+}
+function normalizeSessionTagList(raw) {
+  if (!Array.isArray(raw)) {
+    return { error: "tags must be an array of strings" };
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (typeof item !== "string") {
+      return { error: "each tag must be a string" };
+    }
+    const tag = normalizeSessionTag(item);
+    if (!tag) {
+      return {
+        error: `Invalid tag "${item}". Use 1\u2013${SESSION_TAG_MAX_LENGTH} letters, numbers, or hyphens (CJK allowed).`
+      };
+    }
+    if (seen.has(tag)) continue;
+    seen.add(tag);
+    out.push(tag);
+    if (out.length > SESSION_TAG_MAX_PER_SESSION) {
+      return { error: `A session can have at most ${SESSION_TAG_MAX_PER_SESSION} tags.` };
+    }
+  }
+  return { tags: out };
+}
+function parseSessionTagOp(args) {
+  const present = [args.add !== void 0, args.remove !== void 0, args.set !== void 0].filter(Boolean).length;
+  if (present === 0) {
+    return { error: "Pass exactly one of add, remove, or set." };
+  }
+  if (present > 1) {
+    return { error: "Pass exactly one of add, remove, or set \u2014 not more than one." };
+  }
+  if (args.set !== void 0) {
+    const parsed2 = normalizeSessionTagList(args.set);
+    if ("error" in parsed2) return parsed2;
+    return { kind: "set", tags: parsed2.tags };
+  }
+  if (args.add !== void 0) {
+    const parsed2 = normalizeSessionTagList(args.add);
+    if ("error" in parsed2) return parsed2;
+    if (parsed2.tags.length === 0) return { error: "add requires at least one tag." };
+    return { kind: "add", tags: parsed2.tags };
+  }
+  const parsed = normalizeSessionTagList(args.remove);
+  if ("error" in parsed) return parsed;
+  if (parsed.tags.length === 0) return { error: "remove requires at least one tag." };
+  return { kind: "remove", tags: parsed.tags };
+}
+function applySessionTagOp(current, op) {
+  if (op.kind === "set") return op.tags;
+  if (op.kind === "add") {
+    const seen = new Set(current);
+    const next = [...current];
+    for (const tag of op.tags) {
+      if (seen.has(tag)) continue;
+      if (next.length >= SESSION_TAG_MAX_PER_SESSION) {
+        return {
+          error: `A session can have at most ${SESSION_TAG_MAX_PER_SESSION} tags. Remove some first.`
+        };
+      }
+      seen.add(tag);
+      next.push(tag);
+    }
+    return next;
+  }
+  const drop = new Set(op.tags);
+  return current.filter((tag) => !drop.has(tag));
+}
+
 // ../../packages/runtime/src/settings/node-agent-settings.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
@@ -62185,11 +62801,11 @@ function parseState(raw) {
 
 // ../../packages/runtime/src/harness/home-path.ts
 import { homedir as homedir6 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var HARNESS_HOME_DIRNAME = "harness";
 var SUPERONE_DIRNAME = ".superone";
 function defaultHarnessHomeRoot(userHome = homedir6()) {
-  return join19(userHome, SUPERONE_DIRNAME, HARNESS_HOME_DIRNAME);
+  return join20(userHome, SUPERONE_DIRNAME, HARNESS_HOME_DIRNAME);
 }
 function resolveHarnessHomeRoot(opts = {}) {
   const explicit = opts.override?.trim();
@@ -62203,16 +62819,16 @@ function resolveHarnessHomeRoot(opts = {}) {
 
 // ../../packages/runtime/src/harness/managed-layout.ts
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync8,
   readFileSync as readFileSync13,
   renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync5,
+  statSync as statSync6,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 var MANAGED_VERSIONS_DIRNAME = "versions";
 var MANAGED_CURRENT_BASENAME = "current";
@@ -62229,17 +62845,17 @@ function sanitizeRuntimeVersionForPath(runtimeVersion) {
   return v2;
 }
 function managedVersionsDir(prefix) {
-  return join20(prefix, MANAGED_VERSIONS_DIRNAME);
+  return join21(prefix, MANAGED_VERSIONS_DIRNAME);
 }
 function managedVersionDir(prefix, runtimeVersion) {
-  return join20(managedVersionsDir(prefix), sanitizeRuntimeVersionForPath(runtimeVersion));
+  return join21(managedVersionsDir(prefix), sanitizeRuntimeVersionForPath(runtimeVersion));
 }
 function managedCurrentPath(prefix) {
-  return join20(prefix, MANAGED_CURRENT_BASENAME);
+  return join21(prefix, MANAGED_CURRENT_BASENAME);
 }
 function readCurrentPointer(prefix) {
   const path = managedCurrentPath(prefix);
-  if (!existsSync22(path)) return null;
+  if (!existsSync23(path)) return null;
   try {
     const raw = JSON.parse(readFileSync13(path, "utf8"));
     if (typeof raw.runtimeVersion !== "string" || !raw.runtimeVersion.trim()) return null;
@@ -62265,7 +62881,7 @@ function writeCurrentPointer(prefix, runtimeVersion, extras) {
     null,
     2
   );
-  const tmp = join20(
+  const tmp = join21(
     prefix,
     `.${MANAGED_CURRENT_BASENAME}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`
   );
@@ -62274,7 +62890,7 @@ function writeCurrentPointer(prefix, runtimeVersion, extras) {
     renameSync2(tmp, path);
   } catch {
     try {
-      if (existsSync22(path)) rmSync2(path, { force: true });
+      if (existsSync23(path)) rmSync2(path, { force: true });
       renameSync2(tmp, path);
     } catch {
       writeFileSync9(path, body);
@@ -62286,26 +62902,26 @@ function writeCurrentPointer(prefix, runtimeVersion, extras) {
   }
 }
 function resolveActiveInstallRoot(prefix) {
-  if (!prefix || !existsSync22(prefix)) return null;
+  if (!prefix || !existsSync23(prefix)) return null;
   const pointer = readCurrentPointer(prefix);
   if (pointer) {
-    if (pointer.installRoot && existsSync22(pointer.installRoot) && statSync5(pointer.installRoot).isDirectory()) {
+    if (pointer.installRoot && existsSync23(pointer.installRoot) && statSync6(pointer.installRoot).isDirectory()) {
       return pointer.installRoot;
     }
     const dir = managedVersionDir(prefix, pointer.runtimeVersion);
-    if (existsSync22(dir) && statSync5(dir).isDirectory()) return dir;
+    if (existsSync23(dir) && statSync6(dir).isDirectory()) return dir;
   }
   const versionsRoot = managedVersionsDir(prefix);
-  if (existsSync22(versionsRoot)) {
+  if (existsSync23(versionsRoot)) {
     try {
       const kids = readdirSync8(versionsRoot).filter((n) => {
         try {
-          return statSync5(join20(versionsRoot, n)).isDirectory();
+          return statSync6(join21(versionsRoot, n)).isDirectory();
         } catch {
           return false;
         }
       });
-      if (kids.length === 1) return join20(versionsRoot, kids[0]);
+      if (kids.length === 1) return join21(versionsRoot, kids[0]);
     } catch {
     }
   }
@@ -62313,7 +62929,7 @@ function resolveActiveInstallRoot(prefix) {
 }
 function pruneManagedVersions(prefix, keep, maxKeep = MANAGED_VERSION_KEEP) {
   const versionsRoot = managedVersionsDir(prefix);
-  if (!existsSync22(versionsRoot)) return;
+  if (!existsSync23(versionsRoot)) return;
   const keepSet = new Set(
     keep.filter(Boolean).map((v2) => {
       try {
@@ -62327,7 +62943,7 @@ function pruneManagedVersions(prefix, keep, maxKeep = MANAGED_VERSION_KEEP) {
   try {
     entries = readdirSync8(versionsRoot).map((name) => {
       try {
-        const st = statSync5(join20(versionsRoot, name));
+        const st = statSync6(join21(versionsRoot, name));
         if (!st.isDirectory()) return null;
         return { name, mtime: st.mtimeMs };
       } catch {
@@ -62346,7 +62962,7 @@ function pruneManagedVersions(prefix, keep, maxKeep = MANAGED_VERSION_KEEP) {
   }
   for (const e of entries) {
     if (retain.has(e.name)) continue;
-    const dir = join20(versionsRoot, e.name);
+    const dir = join21(versionsRoot, e.name);
     try {
       rmSync2(dir, { recursive: true, force: true });
     } catch {
@@ -62358,17 +62974,17 @@ function pruneManagedVersions(prefix, keep, maxKeep = MANAGED_VERSION_KEEP) {
 import {
   copyFileSync,
   createReadStream,
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync13,
   mkdtempSync,
   readFileSync as readFileSync14,
   renameSync as renameSync3,
   rmSync as rmSync3,
-  statSync as statSync6,
+  statSync as statSync7,
   writeFileSync as writeFileSync10
 } from "node:fs";
 import { createHash as createHash5, randomBytes as randomBytes4 } from "node:crypto";
-import { dirname as dirname11, join as join21, relative, resolve as resolve4, sep as sep3 } from "node:path";
+import { dirname as dirname12, join as join22, relative, resolve as resolve4, sep as sep3 } from "node:path";
 import { arch as osArch, platform as osPlatform } from "node:os";
 var releaseVersionProvider = null;
 function setHarnessReleaseVersionProvider(fn) {
@@ -62512,13 +63128,13 @@ function parseManagedHarnessPin(id, raw) {
 function loadHarnessReleaseManifest(nodeHome) {
   const fromEnv = process.env.SUPERONE_HARNESS_MANIFEST;
   if (fromEnv) {
-    if (!existsSync23(fromEnv)) {
+    if (!existsSync24(fromEnv)) {
       throw new Error(`SUPERONE_HARNESS_MANIFEST not found: ${fromEnv}`);
     }
     return parseHarnessReleaseManifest(JSON.parse(readFileSync14(fromEnv, "utf8")));
   }
-  const local = join21(nodeHome, "release-manifest.json");
-  if (existsSync23(local)) {
+  const local = join22(nodeHome, "release-manifest.json");
+  if (existsSync24(local)) {
     return parseHarnessReleaseManifest(JSON.parse(readFileSync14(local, "utf8")));
   }
   return null;
@@ -62587,10 +63203,10 @@ async function installManagedArtifactFromFile(opts) {
     throw new Error(`release manifest does not pin managed harness ${opts.harnessId}`);
   }
   const art = selectArtifactPin(pin);
-  if (!existsSync23(opts.artifactPath)) {
+  if (!existsSync24(opts.artifactPath)) {
     throw new Error(`artifact not found: ${opts.artifactPath}`);
   }
-  if (!statSync6(opts.artifactPath).isFile()) {
+  if (!statSync7(opts.artifactPath).isFile()) {
     throw new Error(`artifact is not a regular file: ${opts.artifactPath}`);
   }
   const digest = await sha256File(opts.artifactPath);
@@ -62605,8 +63221,8 @@ async function installManagedArtifactFromFile(opts) {
     opts.harnessId,
     pin.artifactVersion
   );
-  const finalFile = join21(destDir, MANAGED_PAYLOAD_BASENAME);
-  const metaPath = join21(destDir, MANAGED_META_BASENAME);
+  const finalFile = join22(destDir, MANAGED_PAYLOAD_BASENAME);
+  const metaPath = join22(destDir, MANAGED_META_BASENAME);
   assertStrictChild(finalFile, destDir, "payload path");
   assertStrictChild(metaPath, destDir, "meta path");
   const metaBody = JSON.stringify(
@@ -62625,8 +63241,8 @@ async function installManagedArtifactFromFile(opts) {
     2
   );
   let reusedExisting = false;
-  if (existsSync23(destDir)) {
-    const payloadOk = existsSync23(finalFile) && statSync6(finalFile).isFile() && await sha256File(finalFile) === art.digestSha256;
+  if (existsSync24(destDir)) {
+    const payloadOk = existsSync24(finalFile) && statSync7(finalFile).isFile() && await sha256File(finalFile) === art.digestSha256;
     if (payloadOk) {
       reusedExisting = true;
     } else if (mode === "repair") {
@@ -62645,15 +63261,15 @@ async function installManagedArtifactFromFile(opts) {
       );
     }
   } else {
-    const harnessRoot2 = dirname11(destDir);
+    const harnessRoot2 = dirname12(destDir);
     mkdirSync13(harnessRoot2, { recursive: true });
     assertPathInside(destDir, harnessRoot2, "version dir");
     const stagingDir = mkdtempSync(
-      join21(harnessRoot2, `.staging-${opts.harnessId}-${randomBytes4(8).toString("hex")}-`)
+      join22(harnessRoot2, `.staging-${opts.harnessId}-${randomBytes4(8).toString("hex")}-`)
     );
     assertPathInside(stagingDir, harnessRoot2, "staging dir");
-    const stagingFile = join21(stagingDir, MANAGED_PAYLOAD_BASENAME);
-    const stagingMeta = join21(stagingDir, MANAGED_META_BASENAME);
+    const stagingFile = join22(stagingDir, MANAGED_PAYLOAD_BASENAME);
+    const stagingMeta = join22(stagingDir, MANAGED_META_BASENAME);
     try {
       copyFileSync(opts.artifactPath, stagingFile);
       const stagedDigest = await sha256File(stagingFile);
@@ -62664,7 +63280,7 @@ async function installManagedArtifactFromFile(opts) {
       renameSync3(stagingDir, destDir);
     } catch (err) {
       rmSync3(stagingDir, { recursive: true, force: true });
-      if (existsSync23(destDir) && existsSync23(finalFile)) {
+      if (existsSync24(destDir) && existsSync24(finalFile)) {
         const existingDigest = await sha256File(finalFile);
         if (existingDigest === art.digestSha256) {
           reusedExisting = true;
@@ -62689,7 +63305,7 @@ async function installManagedArtifactFromFile(opts) {
   if (finalDigest !== art.digestSha256) {
     throw new Error(`final payload digest mismatch for ${opts.harnessId}`);
   }
-  const harnessRoot = join21(
+  const harnessRoot = join22(
     releasesRoot(opts.nodeHome),
     opts.manifest.cliVersion,
     "harnesses",
@@ -62697,8 +63313,8 @@ async function installManagedArtifactFromFile(opts) {
   );
   assertPathInside(harnessRoot, releasesRoot(opts.nodeHome), "harness root");
   mkdirSync13(harnessRoot, { recursive: true });
-  const currentPath = join21(harnessRoot, MANAGED_CURRENT_BASENAME2);
-  const currentTmp = join21(
+  const currentPath = join22(harnessRoot, MANAGED_CURRENT_BASENAME2);
+  const currentTmp = join22(
     harnessRoot,
     `.${MANAGED_CURRENT_BASENAME2}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`
   );
@@ -62737,8 +63353,8 @@ async function installManagedArtifactFromFile(opts) {
 async function replacePayloadAtomically(opts) {
   mkdirSync13(opts.destDir, { recursive: true });
   const nonce = randomBytes4(8).toString("hex");
-  const payloadTmp = join21(opts.destDir, `.${MANAGED_PAYLOAD_BASENAME}.${nonce}.tmp`);
-  const metaTmp = join21(opts.destDir, `.${MANAGED_META_BASENAME}.${nonce}.tmp`);
+  const payloadTmp = join22(opts.destDir, `.${MANAGED_PAYLOAD_BASENAME}.${nonce}.tmp`);
+  const metaTmp = join22(opts.destDir, `.${MANAGED_META_BASENAME}.${nonce}.tmp`);
   assertStrictChild(payloadTmp, opts.destDir, "payload temp");
   assertStrictChild(metaTmp, opts.destDir, "meta temp");
   try {
@@ -62772,12 +63388,33 @@ function requiredRuntimeVersion(harnessId, manifest) {
 }
 
 // ../../packages/runtime/src/harness/managed-official.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync14, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync14, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import { arch as osArch2, platform as osPlatform2 } from "node:os";
-import { join as join22, resolve as resolve5 } from "node:path";
+import { join as join23, resolve as resolve5 } from "node:path";
 var OFFICIAL_CLAUDE_SDK_VERSION = "0.3.226";
-var OFFICIAL_CODEX_NPM_VERSION = "0.146.1";
+var OFFICIAL_CODEX_NPM_VERSION = "0.147.0";
 var OFFICIAL_CODEX_PACKAGE = "@openai/codex";
+function codexPlatformPackageVersion(baseVersion = OFFICIAL_CODEX_NPM_VERSION) {
+  const platform2 = process.platform;
+  const arch2 = process.arch;
+  if (arch2 !== "arm64" && arch2 !== "x64") {
+    throw new Error(`unsupported arch for Codex: ${arch2}`);
+  }
+  const suffix = platform2 === "darwin" ? `darwin-${arch2}` : platform2 === "linux" ? `linux-${arch2}` : platform2 === "win32" ? `win32-${arch2}` : null;
+  if (!suffix) throw new Error(`unsupported platform for Codex: ${platform2}`);
+  return `${baseVersion}-${suffix}`;
+}
+function codexTargetTriple() {
+  const triples = {
+    "darwin-arm64": "aarch64-apple-darwin",
+    "darwin-x64": "x86_64-apple-darwin",
+    "linux-arm64": "aarch64-unknown-linux-musl",
+    "linux-x64": "x86_64-unknown-linux-musl",
+    "win32-arm64": "aarch64-pc-windows-msvc",
+    "win32-x64": "x86_64-pc-windows-msvc"
+  };
+  return triples[`${process.platform}-${process.arch}`] ?? null;
+}
 function managedHarnessPrefix(nodeHome, harnessId) {
   return resolve5(nodeHome, harnessId);
 }
@@ -62797,7 +63434,7 @@ function claudePlatformPackageName() {
 }
 function isMuslLinux() {
   try {
-    if (existsSync24("/etc/alpine-release")) return true;
+    if (existsSync25("/etc/alpine-release")) return true;
     const lib = readdirSync9("/lib").some((n) => n.startsWith("ld-musl"));
     if (lib) return true;
   } catch {
@@ -62805,42 +63442,49 @@ function isMuslLinux() {
   return false;
 }
 function resolveOfficialInstallBinaryInRoot(harnessId, installRoot) {
-  if (!installRoot || !existsSync24(installRoot)) return null;
+  if (!installRoot || !existsSync25(installRoot)) return null;
   if (harnessId === "codex") {
+    const triple = codexTargetTriple();
+    const nativeName = process.platform === "win32" ? "codex.exe" : "codex";
     const candidates = [
-      join22(installRoot, "bin", "codex"),
-      join22(installRoot, "bin", "codex.cmd"),
-      join22(installRoot, "lib", "node_modules", "@openai", "codex", "bin", "codex.js")
+      join23(installRoot, "bin", "codex"),
+      join23(installRoot, "bin", "codex.cmd"),
+      join23(installRoot, "lib", "node_modules", "@openai", "codex", "bin", "codex.js"),
+      join23(installRoot, "node_modules", "@openai", "codex", "bin", "codex.js"),
+      ...triple ? [
+        join23(installRoot, "lib", "node_modules", "@openai", "codex", "vendor", triple, "bin", nativeName),
+        join23(installRoot, "node_modules", "@openai", "codex", "vendor", triple, "bin", nativeName)
+      ] : []
     ];
     for (const c of candidates) {
-      if (existsSync24(c) && (c.endsWith(".js") || isExecutableFile(c))) return c;
+      if (existsSync25(c) && (c.endsWith(".js") || isExecutableFile2(c))) return c;
     }
     return null;
   }
-  const nm = join22(installRoot, "lib", "node_modules");
-  const scoped = join22(nm, "@anthropic-ai");
+  const nm = join23(installRoot, "lib", "node_modules");
+  const scoped = join23(nm, "@anthropic-ai");
   try {
-    if (existsSync24(scoped)) {
+    if (existsSync25(scoped)) {
       const names = readdirSync9(scoped).filter((n) => n.startsWith("claude-agent-sdk-"));
       for (const n of names) {
         const ext = process.platform === "win32" ? ".exe" : "";
-        const bin = join22(scoped, n, `claude${ext}`);
-        if (existsSync24(bin)) return bin;
+        const bin = join23(scoped, n, `claude${ext}`);
+        if (existsSync25(bin)) return bin;
       }
     }
   } catch {
   }
-  const direct = join22(
+  const direct = join23(
     nm,
     ...claudePlatformPackageName().split("/"),
     process.platform === "win32" ? "claude.exe" : "claude"
   );
-  if (existsSync24(direct)) return direct;
+  if (existsSync25(direct)) return direct;
   return null;
 }
-function isExecutableFile(path) {
+function isExecutableFile2(path) {
   try {
-    const st = statSync7(path);
+    const st = statSync8(path);
     if (!st.isFile()) return false;
     if (process.platform === "win32") return true;
     return (st.mode & 73) !== 0;
@@ -62850,7 +63494,7 @@ function isExecutableFile(path) {
 }
 
 // ../../packages/runtime/src/harness/tarball-fetch.ts
-import { existsSync as existsSync25, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync26, rmSync as rmSync4 } from "node:fs";
 var NPM_REGISTRY = "https://registry.npmjs.org";
 function assertSha256(actualHex, expectedHex) {
   if (actualHex !== expectedHex.toLowerCase()) {
@@ -62868,7 +63512,7 @@ function assertSha512Integrity(actualBase64, integrity) {
 }
 function discardPartial(destPath) {
   try {
-    if (existsSync25(destPath)) rmSync4(destPath, { force: true });
+    if (existsSync26(destPath)) rmSync4(destPath, { force: true });
   } catch {
   }
 }
@@ -62949,13 +63593,13 @@ import {
   appendFileSync,
   createReadStream as createReadStream2,
   createWriteStream,
-  existsSync as existsSync26,
+  existsSync as existsSync27,
   mkdirSync as mkdirSync15,
   rmSync as rmSync5,
-  statSync as statSync8,
+  statSync as statSync9,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { dirname as dirname13 } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Readable as Readable2, Transform } from "node:stream";
 var HARNESS_PROGRESS_THROTTLE_MS = 200;
@@ -62984,7 +63628,7 @@ function parseContentRange(header) {
 async function seedHashesFromFile(path) {
   const sha256 = createHash6("sha256");
   const sha512 = createHash6("sha512");
-  const size = statSync8(path).size;
+  const size = statSync9(path).size;
   if (size === 0) return { sha256, sha512, size };
   await new Promise((resolve13, reject) => {
     const stream = createReadStream2(path);
@@ -63016,7 +63660,7 @@ async function streamResponseToFile(res, destPath, onProgress, opts = {}) {
   const keepPartial = opts.keepPartialOnError !== false;
   const contentLen = Number(res.headers.get("content-length") ?? 0);
   const total = opts.totalBytes && opts.totalBytes > 0 ? opts.totalBytes : append ? resumeFrom + contentLen : contentLen;
-  mkdirSync15(dirname12(destPath), { recursive: true });
+  mkdirSync15(dirname13(destPath), { recursive: true });
   const emit = createThrottledProgress(onProgress, opts.progressThrottleMs);
   let sha256;
   let sha512;
@@ -63074,7 +63718,7 @@ async function streamResponseToFile(res, destPath, onProgress, opts = {}) {
   } catch (err) {
     if (!keepPartial) {
       try {
-        if (existsSync26(destPath)) rmSync5(destPath, { force: true });
+        if (existsSync27(destPath)) rmSync5(destPath, { force: true });
       } catch {
       }
     }
@@ -63118,14 +63762,14 @@ async function downloadResumableToFile(httpFetch, url2, destPath, onProgress, lo
   );
 }
 async function downloadResumableToFileUnlocked(httpFetch, url2, destPath, onProgress, log2) {
-  mkdirSync15(dirname12(destPath), { recursive: true });
-  let existing = existsSync26(destPath) ? statSync8(destPath).size : 0;
+  mkdirSync15(dirname13(destPath), { recursive: true });
+  let existing = existsSync27(destPath) ? statSync9(destPath).size : 0;
   if (existing > 0 && existing < 64) {
     rmSync5(destPath, { force: true });
     existing = 0;
   }
   const tryOnce = async (from) => {
-    const diskNow = existsSync26(destPath) ? statSync8(destPath).size : 0;
+    const diskNow = existsSync27(destPath) ? statSync9(destPath).size : 0;
     const start = from > 0 ? diskNow : 0;
     if (from > 0 && diskNow !== from) {
       log2?.warn?.(
@@ -63207,17 +63851,17 @@ function createResumableDownloadToFile(httpFetch, log2) {
 
 // ../../packages/runtime/src/harness/managed-tarball-installer.ts
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   mkdirSync as mkdirSync16,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync16,
   renameSync as renameSync4,
   rmSync as rmSync6,
-  statSync as statSync9,
+  statSync as statSync10,
   writeFileSync as writeFileSync13
 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname13, join as join23 } from "node:path";
+import { dirname as dirname14, join as join24 } from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 
 // ../../packages/shared/src/update-channels.ts
@@ -63264,17 +63908,6 @@ function selectHarnessArtifact(manifest, harnessId, platform2, arch2) {
 }
 
 // ../../packages/runtime/src/harness/managed-tarball-installer.ts
-function codexPlatformVersion(baseVersion = OFFICIAL_CODEX_NPM_VERSION) {
-  const p2 = process.platform;
-  const a = process.arch;
-  if (a !== "arm64" && a !== "x64") {
-    throw new Error(`unsupported arch for Codex: ${a}`);
-  }
-  if (p2 === "darwin") return `${baseVersion}-darwin-${a}`;
-  if (p2 === "linux") return `${baseVersion}-linux-${a}`;
-  if (p2 === "win32") return `${baseVersion}-win32-${a}`;
-  throw new Error(`unsupported platform for Codex: ${p2}`);
-}
 function managedPackagePins(id) {
   if (id === "claude") {
     const ver = process.env.SUPERONE_CLAUDE_SDK_VERSION?.trim() || OFFICIAL_CLAUDE_SDK_VERSION;
@@ -63290,7 +63923,7 @@ function managedPackagePins(id) {
     packages: [
       {
         name: OFFICIAL_CODEX_PACKAGE,
-        version: codexPlatformVersion(base),
+        version: codexPlatformPackageVersion(base),
         nodeModulesDir: OFFICIAL_CODEX_PACKAGE
       }
     ]
@@ -63308,7 +63941,7 @@ function resolveHarnessManifestChannel(explicit, releaseVersion) {
   return "alpha";
 }
 function harnessDownloadDir(homeRoot) {
-  return join23(homeRoot, ".download");
+  return join24(homeRoot, ".download");
 }
 function harnessArtifactDownloadKey(opts) {
   const digest = opts.digestSha256?.trim().toLowerCase();
@@ -63322,7 +63955,7 @@ function harnessPartialPath(homeRoot, key) {
   if (!key || key.includes("..") || key.includes("/") || key.includes("\\")) {
     throw new Error(`unsafe download key: ${key}`);
   }
-  return join23(harnessDownloadDir(homeRoot), `${key}.partial`);
+  return join24(harnessDownloadDir(homeRoot), `${key}.partial`);
 }
 function extractTgzWithSystemTar(tgzPath, destDir) {
   return new Promise((resolve13, reject) => {
@@ -63342,13 +63975,13 @@ function extractTgzWithSystemTar(tgzPath, destDir) {
   });
 }
 function installPackageDir(packageDir, prefix, nodeModulesRel) {
-  const dest = join23(prefix, "lib", "node_modules", ...nodeModulesRel.split("/"));
-  const parent = dirname13(dest);
+  const dest = join24(prefix, "lib", "node_modules", ...nodeModulesRel.split("/"));
+  const parent = dirname14(dest);
   mkdirSync16(parent, { recursive: true });
-  if (existsSync27(dest)) {
+  if (existsSync28(dest)) {
     rmSync6(dest, { recursive: true, force: true });
   }
-  const staging = join23(
+  const staging = join24(
     parent,
     `.staging-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -63356,12 +63989,12 @@ function installPackageDir(packageDir, prefix, nodeModulesRel) {
     renameSync4(packageDir, staging);
     renameSync4(staging, dest);
   } catch (err) {
-    if (existsSync27(staging)) rmSync6(staging, { recursive: true, force: true });
+    if (existsSync28(staging)) rmSync6(staging, { recursive: true, force: true });
     throw err instanceof Error ? err : new Error(`failed to place package into ${dest}: ${String(err)}`);
   }
   return dest;
 }
-function codexTargetTriple() {
+function codexTargetTriple2() {
   const key = `${process.platform}-${process.arch}`;
   const map2 = {
     "darwin-arm64": "aarch64-apple-darwin",
@@ -63374,12 +64007,12 @@ function codexTargetTriple() {
   return map2[key] ?? null;
 }
 function resolveCodexNativeUnderPrefix(prefix) {
-  const triple = codexTargetTriple();
+  const triple = codexTargetTriple2();
   if (!triple) return null;
   const binaryName = process.platform === "win32" ? "codex.exe" : "codex";
   const candidates = [
-    join23(prefix, "lib", "node_modules", "@openai", "codex", "vendor", triple, "bin", binaryName),
-    join23(
+    join24(prefix, "lib", "node_modules", "@openai", "codex", "vendor", triple, "bin", binaryName),
+    join24(
       prefix,
       "lib",
       "node_modules",
@@ -63392,7 +64025,7 @@ function resolveCodexNativeUnderPrefix(prefix) {
     )
   ];
   for (const c of candidates) {
-    if (existsSync27(c) && statSync9(c).isFile()) return c;
+    if (existsSync28(c) && statSync10(c).isFile()) return c;
   }
   return null;
 }
@@ -63402,16 +64035,16 @@ function resolveManagedTarballBinary(id, installRoot) {
 }
 function readRuntimeVersionFromRoot(id, installRoot) {
   try {
-    const metaPath = join23(installRoot, "install-meta.json");
-    if (existsSync27(metaPath)) {
+    const metaPath = join24(installRoot, "install-meta.json");
+    if (existsSync28(metaPath)) {
       const raw = JSON.parse(readFileSync16(metaPath, "utf8"));
       if (raw.runtimeVersion) return raw.runtimeVersion;
     }
   } catch {
   }
   try {
-    const pkgPath = id === "claude" ? null : join23(installRoot, "lib", "node_modules", "@openai", "codex", "package.json");
-    if (pkgPath && existsSync27(pkgPath)) {
+    const pkgPath = id === "claude" ? null : join24(installRoot, "lib", "node_modules", "@openai", "codex", "package.json");
+    if (pkgPath && existsSync28(pkgPath)) {
       const raw = JSON.parse(readFileSync16(pkgPath, "utf8"));
       const v2 = raw.version?.trim();
       if (!v2) return null;
@@ -63501,7 +64134,7 @@ function createManagedTarballInstaller(opts = {}) {
           npmVersion
         });
         const partialPath = harnessPartialPath(home.root, downloadKey);
-        const work = mkdtempSync2(join23(tmpdir2(), `superone-harness-${id}-`));
+        const work = mkdtempSync2(join24(tmpdir2(), `superone-harness-${id}-`));
         try {
           const { from } = await fetchTarballWithFallback({
             destPath: partialPath,
@@ -63515,15 +64148,15 @@ function createManagedTarballInstaller(opts = {}) {
             log: log2
           });
           source = from;
-          const extractRoot = join23(work, "out");
+          const extractRoot = join24(work, "out");
           await extractTgz(partialPath, extractRoot);
-          const packageDir = join23(extractRoot, "package");
-          if (!existsSync27(packageDir) || !statSync9(packageDir).isDirectory()) {
+          const packageDir = join24(extractRoot, "package");
+          if (!existsSync28(packageDir) || !statSync10(packageDir).isDirectory()) {
             throw new Error(`tarball for ${packageSpec} has no package/ directory`);
           }
           installPackageDir(packageDir, versionDir, npmName);
           try {
-            if (existsSync27(partialPath)) rmSync6(partialPath, { force: true });
+            if (existsSync28(partialPath)) rmSync6(partialPath, { force: true });
           } catch {
           }
         } finally {
@@ -63531,7 +64164,7 @@ function createManagedTarballInstaller(opts = {}) {
         }
       }
       writeFileSync13(
-        join23(versionDir, "install-meta.json"),
+        join24(versionDir, "install-meta.json"),
         JSON.stringify(
           {
             harnessId: id,
@@ -63575,8 +64208,8 @@ function createManagedTarballInstaller(opts = {}) {
 }
 
 // ../../packages/runtime/src/harness/cursor-availability.ts
-import { createRequire as createRequire3 } from "node:module";
-var require3 = createRequire3(import.meta.url);
+import { createRequire as createRequire4 } from "node:module";
+var require3 = createRequire4(import.meta.url);
 function isCursorSdkAvailable2() {
   try {
     require3.resolve("@cursor/sdk");
@@ -63752,7 +64385,7 @@ function isAuthSatisfied(id, deps) {
 
 // ../../packages/runtime/src/harness/enable.ts
 init_environment();
-import { accessSync, constants, existsSync as existsSync28, realpathSync as realpathSync3, statSync as statSync10 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync29, realpathSync as realpathSync3, statSync as statSync11 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve6 } from "node:path";
 async function enableHarness(manager, input, deps) {
   const id = input.harnessId;
@@ -63959,7 +64592,7 @@ function requireRegularReadableFile(path) {
     throw new Error(`path must be absolute: ${path}`);
   }
   const abs = resolve6(path);
-  if (!existsSync28(abs) || !statSync10(abs).isFile()) {
+  if (!existsSync29(abs) || !statSync11(abs).isFile()) {
     throw new Error(`not a regular file: ${abs}`);
   }
   accessSync(abs, constants.R_OK);
@@ -63968,9 +64601,9 @@ function requireRegularReadableFile(path) {
 function resolveExternalCommand(explicit, searchNames) {
   if (explicit) {
     const abs = isAbsolute2(explicit) ? explicit : resolve6(explicit);
-    if (!existsSync28(abs)) return null;
+    if (!existsSync29(abs)) return null;
     try {
-      if (!statSync10(abs).isFile()) return null;
+      if (!statSync11(abs).isFile()) return null;
       accessSync(abs, constants.X_OK);
     } catch {
       return null;
@@ -63983,9 +64616,9 @@ function resolveExternalCommand(explicit, searchNames) {
     for (const dir of dirs) {
       if (!dir) continue;
       const candidate = resolve6(dir, name);
-      if (!existsSync28(candidate)) continue;
+      if (!existsSync29(candidate)) continue;
       try {
-        if (!statSync10(candidate).isFile()) continue;
+        if (!statSync11(candidate).isFile()) continue;
         accessSync(candidate, constants.X_OK);
         return realpathSync3(candidate);
       } catch {
@@ -64038,7 +64671,7 @@ function looksLikeSecretArg(value) {
 }
 
 // src/session/harness-host.ts
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 init_src2();
 init_claude_turn_runner();
 init_codex_turn_runner();
@@ -64046,7 +64679,7 @@ init_resolve_service();
 setHarnessReleaseVersionProvider(resolveCliReleaseVersion);
 function envBinaryExists(envName) {
   const v2 = process.env[envName]?.trim();
-  return Boolean(v2 && existsSync29(v2));
+  return Boolean(v2 && existsSync30(v2));
 }
 var cliHarnessResolver = {
   resolveBinary(id, harnesses) {
@@ -64056,7 +64689,7 @@ var cliHarnessResolver = {
       return null;
     }
     const command = harnesses.get(id).command;
-    return command && existsSync29(command) ? command : null;
+    return command && existsSync30(command) ? command : null;
   },
   isRunnableWithoutCatalog(id) {
     if (id === "claude") return isClaudeRuntimeRunnable();
@@ -64068,7 +64701,7 @@ var cliHarnessResolver = {
   autoRuntime(id) {
     if (id === "claude") {
       const sdk = resolveSdkClaudeBinary();
-      if (sdk && existsSync29(sdk)) return { command: sdk, source: "agent-sdk-optional" };
+      if (sdk && existsSync30(sdk)) return { command: sdk, source: "agent-sdk-optional" };
       return null;
     }
     const fromEnv = resolveCodexBinaryPath({});
@@ -64151,8 +64784,8 @@ function enableManaged2(manager, id, artifact, mode = "enable") {
 
 // ../../packages/shared/src/git-clone.ts
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync17 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join24, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync17 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join25, resolve as resolve7 } from "node:path";
 
 // ../../packages/shared/src/git-remote.ts
 function repoNameFromGitUrl(url2) {
@@ -64217,11 +64850,11 @@ function resolveCloneDestination(input) {
   if (name.includes("/") || name.includes("\\") || name === "." || name === "..") {
     throw invalid(`invalid folder name: ${name}`);
   }
-  return { path: join24(resolve7(parent), name), name };
+  return { path: join25(resolve7(parent), name), name };
 }
 async function cloneRepository(input) {
   const destination = resolveCloneDestination(input);
-  if (existsSync30(destination.path)) {
+  if (existsSync31(destination.path)) {
     throw Object.assign(new Error(`destination already exists: ${destination.path}`), {
       code: "conflict"
     });
@@ -64265,7 +64898,7 @@ async function cloneRepository(input) {
 
 // src/rpc/handlers.ts
 init_resolve_service();
-import { existsSync as existsSync31, mkdirSync as mkdirSync18, readdirSync as readdirSync10, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync18, readdirSync as readdirSync10, statSync as statSync12 } from "node:fs";
 import { join as pathJoin, resolve as pathResolve } from "node:path";
 import { arch, cpus, freemem, homedir as homedir7, hostname as hostname4, platform, totalmem, uptime } from "node:os";
 
@@ -66189,6 +66822,7 @@ var MUTATING_METHODS = /* @__PURE__ */ new Set([
   "session.close",
   "session.remove",
   "session.rename",
+  "session.setTags",
   "session.setUiFlags",
   // pin/hide
   "terminal.acquireControl",
@@ -66460,6 +67094,8 @@ async function dispatchRpcInner(method, payload, ctx) {
       return handleSessionRemove(payload, ctx);
     case "session.rename":
       return handleSessionRename(payload, ctx);
+    case "session.setTags":
+      return handleSessionSetTags(payload, ctx);
     case "session.setUiFlags":
       return handleSessionSetUiFlags(payload, ctx);
     case "collaboration.listProfiles":
@@ -67030,7 +67666,7 @@ function handleProjectOpen(payload, ctx) {
   }
   const name = typeof p2.name === "string" ? p2.name : void 0;
   try {
-    if (p2.createIfMissing === true && !existsSync31(path)) {
+    if (p2.createIfMissing === true && !existsSync32(path)) {
       mkdirSync18(path, { recursive: true });
     }
     return { result: ctx.projects.open(path, name) };
@@ -67067,10 +67703,10 @@ function handleFsListDir(payload, ctx) {
   }
   try {
     const resolved = expandHostPath(raw);
-    if (!existsSync31(resolved)) {
+    if (!existsSync32(resolved)) {
       return { error: { code: "not_found", message: "path not found" } };
     }
-    if (!statSync11(resolved).isDirectory()) {
+    if (!statSync12(resolved).isDirectory()) {
       return { error: { code: "invalid_argument", message: "not a directory" } };
     }
     const entries = readdirSync10(resolved, { withFileTypes: true }).filter((ent) => ent.isDirectory() && !ent.name.startsWith(".")).map((ent) => ({
@@ -67953,6 +68589,32 @@ function handleSessionRename(payload, ctx) {
     return mapThrown7(err);
   }
 }
+function handleSessionSetTags(payload, ctx) {
+  const denied = requireScopes7(ctx.client, OPERATION_SCOPES.operateSession);
+  if (denied) return denied;
+  const p2 = asRecord17(payload);
+  const sessionId = String(p2.sessionId ?? "");
+  if (!sessionId) {
+    return { error: { code: "invalid_argument", message: "sessionId required" } };
+  }
+  const op = parseSessionTagOp({ add: p2.add, remove: p2.remove, set: p2.set });
+  if ("error" in op) {
+    return { error: { code: "invalid_argument", message: op.error } };
+  }
+  try {
+    const session = ctx.sessions.get(sessionId);
+    if (!session) {
+      return { error: { code: "not_found", message: "session not found" } };
+    }
+    const next = applySessionTagOp(session.tags ?? [], op);
+    if ("error" in next) {
+      return { error: { code: "failed_precondition", message: next.error } };
+    }
+    return { result: ctx.sessions.setTags(sessionId, next) };
+  } catch (err) {
+    return mapThrown7(err);
+  }
+}
 function handleSessionSetUiFlags(payload, ctx) {
   const denied = requireScopes7(ctx.client, OPERATION_SCOPES.operateSession);
   if (denied) return denied;
@@ -68795,9 +69457,9 @@ async function handleHttp(req, res, opts) {
 }
 
 // src/terminal/manager.ts
-import { createRequire as createRequire4 } from "node:module";
-import { existsSync as existsSync32 } from "node:fs";
-var nodeRequire = createRequire4(import.meta.url);
+import { createRequire as createRequire5 } from "node:module";
+import { existsSync as existsSync33 } from "node:fs";
+var nodeRequire = createRequire5(import.meta.url);
 var { spawn: spawn5 } = nodeRequire("node-pty");
 var SNAPSHOT_SOFT_LIMIT = 64 * 1024;
 var OUTPUT_BUFFER_SOFT_LIMIT = 256 * 1024;
@@ -68811,7 +69473,7 @@ var NodeTerminalManager = class {
   }
   byId = /* @__PURE__ */ new Map();
   create(opts) {
-    if (!existsSync32(opts.cwd)) {
+    if (!existsSync33(opts.cwd)) {
       throw Object.assign(new Error(`cwd does not exist: ${opts.cwd}`), { code: "invalid_argument" });
     }
     const terminalId = crypto.randomUUID();
@@ -68952,7 +69614,7 @@ var NodeTerminalManager = class {
 
 // src/workspace/project-registry.ts
 import { basename as basename2, resolve as resolve8 } from "node:path";
-import { existsSync as existsSync33, realpathSync as realpathSync4, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync34, realpathSync as realpathSync4, statSync as statSync13 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 var ProjectRegistry = class {
@@ -68982,7 +69644,7 @@ var ProjectRegistry = class {
   }
   open(path, name) {
     let abs = resolve8(path);
-    if (!existsSync33(abs) || !statSync12(abs).isDirectory()) {
+    if (!existsSync34(abs) || !statSync13(abs).isDirectory()) {
       throw Object.assign(new Error(`project path is not a directory: ${abs}`), {
         code: "invalid_argument"
       });
@@ -69026,7 +69688,7 @@ var ProjectRegistry = class {
   toSnapshot(r) {
     let missing = false;
     try {
-      missing = !statSync12(r.path).isDirectory();
+      missing = !statSync13(r.path).isDirectory();
     } catch {
       missing = true;
     }
@@ -69066,7 +69728,7 @@ function detectRepoIdentity(abs) {
 init_fs();
 import {
   closeSync,
-  existsSync as existsSync34,
+  existsSync as existsSync35,
   fstatSync,
   mkdirSync as mkdirSync19,
   openSync,
@@ -69075,11 +69737,11 @@ import {
   readFileSync as readFileSync17,
   renameSync as renameSync5,
   rmSync as rmSync7,
-  statSync as statSync13,
+  statSync as statSync14,
   unlinkSync,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { dirname as dirname14, join as join25, relative as relative2 } from "node:path";
+import { dirname as dirname15, join as join26, relative as relative2 } from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 function normalizeRel(path) {
   return path.replace(/\\/g, "/").replace(/\/+$/, "") || ".";
@@ -69125,21 +69787,21 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync34(resolved.absolutePath)) {
+    if (!existsSync35(resolved.absolutePath)) {
       throw Object.assign(new Error("path not found"), { code: "not_found" });
     }
-    const st = statSync13(resolved.absolutePath);
+    const st = statSync14(resolved.absolutePath);
     if (!st.isDirectory()) {
       throw Object.assign(new Error("not a directory"), { code: "invalid_argument" });
     }
     this.projects.touch(projectId);
     const ents = readdirSync11(resolved.absolutePath, { withFileTypes: true });
     return ents.map((ent) => {
-      const abs = join25(resolved.absolutePath, ent.name);
+      const abs = join26(resolved.absolutePath, ent.name);
       let size;
       let mtimeMs;
       try {
-        const s2 = statSync13(abs);
+        const s2 = statSync14(abs);
         size = s2.size;
         mtimeMs = s2.mtimeMs;
       } catch {
@@ -69160,10 +69822,10 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync34(resolved.absolutePath)) {
+    if (!existsSync35(resolved.absolutePath)) {
       throw Object.assign(new Error("file not found"), { code: "not_found" });
     }
-    const st = statSync13(resolved.absolutePath);
+    const st = statSync14(resolved.absolutePath);
     if (!st.isFile()) {
       throw Object.assign(new Error("not a file"), { code: "invalid_argument" });
     }
@@ -69199,8 +69861,8 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (existsSync34(resolved.absolutePath) && expectedHash) {
-      const st = statSync13(resolved.absolutePath);
+    if (existsSync35(resolved.absolutePath) && expectedHash) {
+      const st = statSync14(resolved.absolutePath);
       if (st.size > MAX_READ_BYTES) {
         throw Object.assign(
           new Error(`optimistic-write target too large (${st.size} bytes; max ${MAX_READ_BYTES})`),
@@ -69212,15 +69874,15 @@ var WorkspaceFsService = class {
         throw Object.assign(new Error("content hash mismatch"), { code: "conflict" });
       }
     }
-    mkdirSync19(dirname14(resolved.absolutePath), { recursive: true });
+    mkdirSync19(dirname15(resolved.absolutePath), { recursive: true });
     const data = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
     if (data.length > MAX_READ_BYTES) {
       throw Object.assign(new Error("write payload too large"), { code: "invalid_argument" });
     }
     let mode = 384;
-    if (existsSync34(resolved.absolutePath)) {
+    if (existsSync35(resolved.absolutePath)) {
       try {
-        mode = statSync13(resolved.absolutePath).mode & 511;
+        mode = statSync14(resolved.absolutePath).mode & 511;
       } catch {
       }
     }
@@ -69288,7 +69950,7 @@ var WorkspaceFsService = class {
       for (const ent of ents) {
         if (hits.length >= MAX_SEARCH_HITS) return;
         if (ent.name === ".git" || ent.name === "node_modules") continue;
-        const abs = join25(dir, ent.name);
+        const abs = join26(dir, ent.name);
         const rel = relative2(root, abs).split("\\").join("/");
         const check2 = resolveProjectPath(root, rel);
         if (!check2.ok) continue;
@@ -69298,7 +69960,7 @@ var WorkspaceFsService = class {
         }
         if (!ent.isFile()) continue;
         try {
-          const st = statSync13(abs);
+          const st = statSync14(abs);
           if (st.size > MAX_SEARCH_FILE_BYTES) continue;
           const text = readFileSync17(abs, "utf8");
           const lines = text.split(/\r?\n/);
@@ -69362,8 +70024,8 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (existsSync34(resolved.absolutePath)) {
-      const st = statSync13(resolved.absolutePath);
+    if (existsSync35(resolved.absolutePath)) {
+      const st = statSync14(resolved.absolutePath);
       if (!st.isDirectory()) {
         throw Object.assign(new Error("path exists and is not a directory"), { code: "conflict" });
       }
@@ -69385,7 +70047,7 @@ var WorkspaceFsService = class {
     if (!resolved.ok) {
       throw Object.assign(new Error(resolved.reason), { code: "invalid_argument" });
     }
-    if (!existsSync34(resolved.absolutePath)) {
+    if (!existsSync35(resolved.absolutePath)) {
       throw Object.assign(new Error("path not found"), { code: "not_found" });
     }
     if (resolved.absolutePath === root) {
@@ -69409,19 +70071,19 @@ var WorkspaceFsService = class {
     if (!from.ok) {
       throw Object.assign(new Error(from.reason), { code: "invalid_argument" });
     }
-    if (!existsSync34(from.absolutePath)) {
+    if (!existsSync35(from.absolutePath)) {
       throw Object.assign(new Error("source not found"), { code: "not_found" });
     }
     const to = resolveProjectPath(root, toN);
     if (!to.ok) {
       throw Object.assign(new Error(to.reason), { code: "invalid_argument" });
     }
-    if (existsSync34(to.absolutePath)) {
+    if (existsSync35(to.absolutePath)) {
       throw Object.assign(new Error(`target already exists: ${baseNameRel(toN)}`), {
         code: "conflict"
       });
     }
-    mkdirSync19(dirname14(to.absolutePath), { recursive: true });
+    mkdirSync19(dirname15(to.absolutePath), { recursive: true });
     renameSync5(from.absolutePath, to.absolutePath);
     this.projects.touch(projectId);
     return { from: fromN, to: toN };
@@ -69446,8 +70108,8 @@ function hashFileBounded(absolutePath, size) {
 }
 
 // src/workspace/git-service.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync20, realpathSync as realpathSync5, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join27, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync20, realpathSync as realpathSync5, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join28, resolve as resolve10 } from "node:path";
 import { tmpdir as tmpdir3 } from "node:os";
 import { randomUUID as randomUUID8 } from "node:crypto";
 
@@ -69524,19 +70186,19 @@ function gitRunSync(folderPath, args, env) {
 }
 
 // ../../packages/runtime/src/git/worktree-plan.ts
-import { basename as basename3, dirname as dirname15, join as join26, resolve as resolve9, sep as sep4 } from "node:path";
+import { basename as basename3, dirname as dirname16, join as join27, resolve as resolve9, sep as sep4 } from "node:path";
 import { homedir as homedir8 } from "node:os";
 function resolveMainDirFromCommonDir(folderPath, gitCommonDir) {
   const repoRoot = resolve9(folderPath, gitCommonDir.trim());
-  return repoRoot.endsWith(`${sep4}.git`) || repoRoot.endsWith("/.git") ? dirname15(repoRoot) : repoRoot;
+  return repoRoot.endsWith(`${sep4}.git`) || repoRoot.endsWith("/.git") ? dirname16(repoRoot) : repoRoot;
 }
 function planNewWorktreePaths(input) {
   const home = input.homeDir ?? homedir8();
   const repoName = basename3(input.mainDir);
   const epoch = Math.floor((input.nowMs ?? Date.now()) / 1e3).toString(36);
   const short = input.shortHash.slice(0, 7);
-  const wtDir = join26(home, ".worktrees", repoName);
-  const wtPath = join26(wtDir, `${epoch}-${short}`);
+  const wtDir = join27(home, ".worktrees", repoName);
+  const wtPath = join27(wtDir, `${epoch}-${short}`);
   return { wtDir, wtPath };
 }
 function worktreeAddArgs(mode, wtPath, baseRef, branchName) {
@@ -69595,8 +70257,8 @@ function resolveMainWorktreeDir(folderPath) {
 }
 function samePath(a, b2) {
   try {
-    const ra = existsSync35(a) ? realpathSync5(a) : resolve10(a);
-    const rb = existsSync35(b2) ? realpathSync5(b2) : resolve10(b2);
+    const ra = existsSync36(a) ? realpathSync5(a) : resolve10(a);
+    const rb = existsSync36(b2) ? realpathSync5(b2) : resolve10(b2);
     return ra === rb;
   } catch {
     return resolve10(a) === resolve10(b2);
@@ -69628,7 +70290,7 @@ var WorkspaceGitService = class {
    * --ignored walks the whole tree of ignored paths and dominates remote latency.
    */
   statusForCwd(cwd) {
-    if (!existsSync35(join27(cwd, ".git")) && !isGitWorktree(cwd)) {
+    if (!existsSync36(join28(cwd, ".git")) && !isGitWorktree(cwd)) {
       return { isRepo: false, branch: null, dirty: false, ahead: 0, behind: 0, porcelain: "" };
     }
     try {
@@ -69737,15 +70399,15 @@ var WorkspaceGitService = class {
     }
     const abs = resolve10(worktreePath);
     const main2 = resolve10(this.root(projectId));
-    if (samePath(abs, main2)) return existsSync35(abs) ? realpathSync5(abs) : abs;
+    if (samePath(abs, main2)) return existsSync36(abs) ? realpathSync5(abs) : abs;
     const listed = this.worktrees(projectId);
     for (const wt of listed) {
       if (samePath(abs, wt.path)) {
-        return existsSync35(abs) ? realpathSync5(abs) : resolve10(wt.path);
+        return existsSync36(abs) ? realpathSync5(abs) : resolve10(wt.path);
       }
     }
     try {
-      if (existsSync35(abs) && isGitWorktree(abs)) {
+      if (existsSync36(abs) && isGitWorktree(abs)) {
         const commonA = resolve10(abs, git(abs, ["rev-parse", "--git-common-dir"]).trim());
         const commonB = resolve10(main2, git(main2, ["rev-parse", "--git-common-dir"]).trim());
         if (samePath(commonA, commonB)) {
@@ -69787,7 +70449,7 @@ var WorkspaceGitService = class {
       mainDir,
       shortHash: commitHash.slice(0, 7)
     });
-    if (!existsSync35(wtDir)) mkdirSync20(wtDir, { recursive: true });
+    if (!existsSync36(wtDir)) mkdirSync20(wtDir, { recursive: true });
     try {
       const addArgs = worktreeAddArgs(mode, wtPath, baseBranch, safeBranchName);
       git(folderPath, ["worktree", ...addArgs]);
@@ -69883,7 +70545,7 @@ var WorkspaceGitService = class {
       const mainStatus = git(diff.mainDir, ["status", "--porcelain"]).trim();
       if (mainStatus) return { ok: false, reason: "main-dirty" };
       const patch = git(diff.worktreePath, ["diff", "--binary", diff.base, diff.tree]);
-      const patchFile = join27(tmpdir3(), `s1-handoff-${randomUUID8()}.patch`);
+      const patchFile = join28(tmpdir3(), `s1-handoff-${randomUUID8()}.patch`);
       writeFileSync15(patchFile, `${patch}
 `);
       if (git(diff.mainDir, ["status", "--porcelain"]).trim()) {
@@ -69945,7 +70607,7 @@ var WorkspaceGitService = class {
     };
   }
   writeWorkingTree(worktreePath) {
-    const tmpIndex = join27(tmpdir3(), `s1-handoff-${randomUUID8()}.index`);
+    const tmpIndex = join28(tmpdir3(), `s1-handoff-${randomUUID8()}.index`);
     const env = { GIT_INDEX_FILE: tmpIndex };
     try {
       git(worktreePath, ["read-tree", "HEAD"], env);
@@ -70142,7 +70804,7 @@ init_agent_types();
 init_environment();
 init_resolve_service();
 import { createHash as createHash9, randomBytes as randomBytes5, randomUUID as randomUUID10 } from "node:crypto";
-import { existsSync as existsSync36, statSync as statSync14 } from "node:fs";
+import { existsSync as existsSync37, statSync as statSync15 } from "node:fs";
 import { resolve as pathResolve2 } from "node:path";
 var MAX_MESSAGES_PER_RETRIEVE = 100;
 var EMPTY_MAILBOX_HINT = "No peer has replied yet. Do not retrieve again, do not sleep, do not wait in place \u2014 end your turn or do unrelated work. A task notification will start a new turn for you as soon as a message arrives.";
@@ -71063,7 +71725,7 @@ var CollaborationService = class {
     const project = this.deps.projects.get(projectId);
     const fallback = parentCwd || project?.path || process.cwd();
     const cwd = pathResolve2(config2.cwd || fallback);
-    if (!existsSync36(cwd) || !statSync14(cwd).isDirectory()) {
+    if (!existsSync37(cwd) || !statSync15(cwd).isDirectory()) {
       throw Object.assign(new Error(`Working directory does not exist: ${cwd}`), {
         code: "invalid_argument"
       });
@@ -71202,8 +71864,8 @@ var CollaborationService = class {
 };
 
 // src/provider/secret-crypto.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync21, readFileSync as readFileSync18, writeFileSync as writeFileSync16, chmodSync as chmodSync2 } from "node:fs";
-import { dirname as dirname16 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync21, readFileSync as readFileSync18, writeFileSync as writeFileSync16, chmodSync as chmodSync2 } from "node:fs";
+import { dirname as dirname17 } from "node:path";
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes6 } from "node:crypto";
 var ENC_PREFIX2 = "enc:v1:";
 var KEY_BYTES = 32;
@@ -71211,11 +71873,11 @@ function isEncryptedSecret(value) {
   return typeof value === "string" && value.startsWith(ENC_PREFIX2);
 }
 function ensureKeyFile(keyPath) {
-  if (existsSync37(keyPath)) {
+  if (existsSync38(keyPath)) {
     const raw = readFileSync18(keyPath);
     if (raw.length === KEY_BYTES) return raw;
   }
-  mkdirSync21(dirname16(keyPath), { recursive: true, mode: 448 });
+  mkdirSync21(dirname17(keyPath), { recursive: true, mode: 448 });
   const key = randomBytes6(KEY_BYTES);
   writeFileSync16(keyPath, key, { mode: 384 });
   try {
@@ -71359,7 +72021,7 @@ var WorkspaceWatchService = class {
 
 // src/workspace/tail-watch-service.ts
 init_fs();
-import { existsSync as existsSync38, fstatSync as fstatSync2, openSync as openSync2, closeSync as closeSync2, statSync as statSync15, readSync as readSync2, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync39, fstatSync as fstatSync2, openSync as openSync2, closeSync as closeSync2, statSync as statSync16, readSync as readSync2, realpathSync as realpathSync6 } from "node:fs";
 var MAX_POLL_BYTES = 10 * 1024 * 1024;
 var WorkspaceTailWatchService = class {
   constructor(projects, fs) {
@@ -71381,7 +72043,7 @@ var WorkspaceTailWatchService = class {
         );
       }
       try {
-        resolvedAbs = existsSync38(absolutePath) ? realpathSync6(absolutePath) : absolutePath;
+        resolvedAbs = existsSync39(absolutePath) ? realpathSync6(absolutePath) : absolutePath;
       } catch {
         resolvedAbs = absolutePath;
       }
@@ -71412,9 +72074,9 @@ var WorkspaceTailWatchService = class {
         code: "invalid_argument"
       });
     }
-    if (existsSync38(resolvedAbs)) {
+    if (existsSync39(resolvedAbs)) {
       try {
-        const st = statSync15(resolvedAbs);
+        const st = statSync16(resolvedAbs);
         if (!st.isFile()) {
           throw Object.assign(new Error("not a file"), { code: "invalid_argument" });
         }
@@ -71463,7 +72125,7 @@ var WorkspaceTailWatchService = class {
         { code: "invalid_argument" }
       );
     }
-    if (!existsSync38(absolutePath)) {
+    if (!existsSync39(absolutePath)) {
       return {
         content: "",
         encoding: "base64",
@@ -84603,7 +85265,7 @@ function createLocalPairingToken(nodeHome) {
 }
 function readRuntimeStatus(nodeHome) {
   const paths = nodePaths(resolveRuntimeConfig({ nodeHome }).nodeHome);
-  if (!existsSync39(paths.runtimeJson)) return null;
+  if (!existsSync40(paths.runtimeJson)) return null;
   try {
     return JSON.parse(readFileSync19(paths.runtimeJson, "utf8"));
   } catch {
@@ -84613,8 +85275,8 @@ function readRuntimeStatus(nodeHome) {
 
 // src/systemd/install.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { chmodSync as chmodSync3, existsSync as existsSync40, mkdirSync as mkdirSync22, unlinkSync as unlinkSync2, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname17 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync41, mkdirSync as mkdirSync22, unlinkSync as unlinkSync2, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname18 } from "node:path";
 
 // src/systemd/unit.ts
 function renderSystemdUserUnit(opts) {
@@ -84671,7 +85333,7 @@ function checkLinger(user) {
   return { enabled: null, raw };
 }
 function writeSystemdUserUnit(opts, unitPath = systemdUserUnitPath()) {
-  mkdirSync22(dirname17(unitPath), { recursive: true });
+  mkdirSync22(dirname18(unitPath), { recursive: true });
   writeFileSync18(unitPath, renderSystemdUserUnit(opts), { encoding: "utf8", mode: 420 });
   try {
     chmodSync3(unitPath, 420);
@@ -84725,7 +85387,7 @@ function uninstallSystemdUserService(removeUnitFile = true) {
   }
   if (removeUnitFile) {
     const path = systemdUserUnitPath();
-    if (existsSync40(path)) {
+    if (existsSync41(path)) {
       try {
         unlinkSync2(path);
       } catch (err) {
@@ -84748,7 +85410,7 @@ function systemdUserStatus() {
 
 // src/session/harness-cli.ts
 init_environment();
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync41, realpathSync as realpathSync7, statSync as statSync16 } from "node:fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync42, realpathSync as realpathSync7, statSync as statSync17 } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve11 } from "node:path";
 import { homedir as homedir9 } from "node:os";
 var DEFERRED_FLAGS = /* @__PURE__ */ new Set([
@@ -85297,10 +85959,10 @@ function resolveExternalCommand2(explicit, pathCandidates) {
   return null;
 }
 function isUsableExecutable(path) {
-  if (!existsSync41(path)) return null;
+  if (!existsSync42(path)) return null;
   let st;
   try {
-    st = statSync16(path);
+    st = statSync17(path);
   } catch {
     return null;
   }
@@ -85317,10 +85979,10 @@ function isUsableExecutable(path) {
   }
 }
 function probeExecutableIssues(path) {
-  if (!existsSync41(path)) return ["command_missing"];
+  if (!existsSync42(path)) return ["command_missing"];
   let st;
   try {
-    st = statSync16(path);
+    st = statSync17(path);
   } catch {
     return ["command_missing"];
   }
@@ -85333,9 +85995,9 @@ function probeExecutableIssues(path) {
   return [];
 }
 function probeReadableFileIssues(path) {
-  if (!existsSync41(path)) return ["artifact_missing"];
+  if (!existsSync42(path)) return ["artifact_missing"];
   try {
-    if (!statSync16(path).isFile()) return ["artifact_not_file"];
+    if (!statSync17(path).isFile()) return ["artifact_not_file"];
   } catch {
     return ["artifact_missing"];
   }