@super-one/cli 0.75.0-alpha.1 → 0.75.0

package/lib/cli.mjs

@@ -1,4 +1,4 @@
-process.env.SUPERONE_VARIANT = "alpha";
+process.env.SUPERONE_VARIANT = "stable";
 import { createRequire as __superoneCreateRequire } from 'node:module';
 import { fileURLToPath as __superoneFileURLToPath } from 'node:url';
 import { dirname as __superoneDirname } from 'node:path';
@@ -137,8 +137,8 @@ import { fileURLToPath } from "node:url";
 function resolveCliReleaseVersion() {
   const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
   if (fromEnv) return fromEnv;
-  if ("0.75.0-alpha.1".trim()) {
-    return "0.75.0-alpha.1".trim();
+  if ("0.75.0".trim()) {
+    return "0.75.0".trim();
   }
   const fromDist = readDistManifestVersion();
   if (fromDist) return fromDist;
@@ -466,7 +466,7 @@ var init_superone_tool_descriptions = __esm({
     SESSION_TAGS_FILTER_DESCRIPTION = "Tags from session_tag_list. Filter sessions that have these labels.";
     SESSION_TAG_MATCH_DESCRIPTION = "any = at least one listed tag (default). all = every listed tag. Ignored when tags is omitted.";
     SESSION_CLEANUP_DESCRIPTION = "Hide, unhide, or delete SuperOne sessions by id (from session_list; ids may be from any project). hide/unhide need no confirmation. delete always opens a user confirmation dialog. Never deletes the current session; skips pinned unless includePinned. Prefer session_list to choose ids first.";
-    CONFIG_READ_DESCRIPTION = "Read live SuperOne settings and their field schema. Always call this before config_apply. Omit domain to list settings and resource domains; pass domain to read exact keys, current values, and constraints. For resource domains, pass recordId to read one record before updating or deleting it. Use read_manual for documentation.";
+    CONFIG_READ_DESCRIPTION = "Read live SuperOne settings and their field schema. Always call this before config_apply. Omit domain to list settings and resource domains; pass domain to read exact keys, current values, and constraints. For resource domains, pass recordId to read one record before updating or deleting it. See read_manual product/settings for defaults, project preferences, Jev keys and icons.";
     CONFIG_APPLY_DESCRIPTION = "Propose a settings change or resource create/update/delete using keys returned by config_read. Pass exactly one of changes or resource. Every call opens an editable confirmation dialog and applies nothing without user approval. For updates, send only changed fields. Stop on cancelled or error; on rejected, use the returned feedback before retrying.";
     LIST_MEDIA_PROVIDERS_DESCRIPTION = "List configured media providers that have usable credentials. Filter by image or video. Use a returned provider id with media_generate_image or media_generate_video; use kind to select the matching media manual topic. Honor returned sizing and sizeNote constraints.";
     GENERATE_IMAGE_DESCRIPTION = "Generate or edit an image; pass source files in reference_image_paths for edits. Discover configured providers with media_list_providers when not already known. Read the matching media provider-task topic for unfamiliar options. Inspect previewPaths; savedPaths holds originals for export or edits. Check warnings for ignored options. Results display automatically; do not embed them again.";
@@ -509,8 +509,8 @@ var init_superone_tool_descriptions = __esm({
     ENVIRONMENT_GET_INFO_IDS_DESCRIPTION = "Environments to read; omit for all.";
     ENVIRONMENT_GET_INFO_INCLUDE_DESCRIPTION = 'Detail groups to add. Default ["hardware"]; [] returns IDs, labels and state only.';
     ARCHIVE_ENVIRONMENT_DESCRIPTION = "Target environment ID from environment_get_info. Omit or use localhost for the calling session host.";
-    LAYOUT_SNAPSHOT_DESCRIPTION = "Read a SuperOne session layout: tabs/groups, panels, sidebar and chat mode. layout reports the available split area, minimum tile sizes, maxSessions, environment-qualified tiles with geometry, focus, normal/maximized state and divider ids/ratios. Hidden saved layouts contain identities/proportions only. Area uses viewport CSS pixels; tile/divider coordinates are area-relative. Divider ids survive resizing/focus, expire on topology changes. Omit target for caller, use foreground or an explicit environment/session. Read ids and sizes before layout_act.";
-    LAYOUT_ACT_DESCRIPTION = "Arrange SuperOne. focus_session focuses an existing tile or replaces the focused tile without collapsing splits. split_session sessionIds sets the final list: automatic sizing by default, or layout for explicit nested splits/order/ratios; sessionId+direction adds one. close_split removes tiles; closeAll retains focus and clears restore state. maximize_split isolates a tile; restore_splits restores it. resize_splits changes divider ratios atomically; use split_session layout to change structure. Returns layout geometry/capacity. Hidden targets skip window changes; tab changes queue. Never stops/deletes sessions. Open via browser_tabs / terminal_tabs. visible reports on-screen results.";
+    LAYOUT_SNAPSHOT_DESCRIPTION = "Read a SuperOne session layout: tabs/groups, panels, sidebar, chat and window mode. window.native reports outer bounds, minimum size, display work area, fullscreen/maximized state in DIP. layout reports split area/capacity, environment-qualified tiles, focus and divider ids/ratios. Hidden saved layouts contain identities/proportions only. Area uses viewport CSS pixels; tile/divider coordinates are area-relative. Divider ids survive resizing/focus, expire on topology changes. Omit target for caller, or use foreground or an explicit session. Reuse layout_act state/layout results; read a snapshot for missing ids or after external changes.";
+    LAYOUT_ACT_DESCRIPTION = "Arrange SuperOne. focus_session preserves splits. split_session sessionIds sets the final list, automatically sized or with nested layout/order/ratios; sessionId+direction adds one. close_split removes tiles; closeAll retains focus. maximize_split isolates a tile; restore_splits restores it; resize_splits adjusts ratios. window_mode selects mini/full; resize_window sets size; enter_fullscreen/exit_fullscreen set OS fullscreen. Returns relevant state and layout geometry when affected: reuse ids/sizes instead of rereading layout_snapshot. Hidden targets skip window changes; tab changes queue. Never stops/deletes sessions. Open via browser_tabs/terminal_tabs. visible reports on-screen results.";
     LAYOUT_TARGET_DESCRIPTION = "caller (default), foreground, or {environmentId, sessionId} from session_list/search/collab. localhost means the invoking session host. focus_session requires an explicit object; other actions can prepare a background layout without switching.";
     LAYOUT_ACT_PATH_DESCRIPTION = "open_file: the file, absolute or relative to your working folder.";
     LAYOUT_ACT_LINE_DESCRIPTION = "open_file: 1-based line to reveal.";
@@ -518,9 +518,9 @@ var init_superone_tool_descriptions = __esm({
     LAYOUT_ACT_GROUP_DESCRIPTION = "Group index from layout_snapshot groups. resize_group; move_tab target, default the tab's own group (a tab alone there goes beside the group before it).";
     LAYOUT_ACT_DIRECTION_DESCRIPTION = "move_tab: right / down / left / up of the group as a new group, or into it. split_session: any side. Default right.";
     LAYOUT_ACT_INDEX_DESCRIPTION = "move_tab: 0-based position among the destination group's tabs; with into and your own group it reorders.";
-    LAYOUT_ACT_WIDTH_DESCRIPTION = "resize_sidebar / resize_panel / resize_group: target width in px. Sidebar and panel clamp to layout_snapshot sizes; the result has the applied size.";
-    LAYOUT_ACT_HEIGHT_DESCRIPTION = "resize_group: target height in px.";
-    LAYOUT_ACT_MODE_DESCRIPTION = "chat_mode: docked (a column beside the panel), floating (a movable window over the panel, which then fills the window) or icon (that window collapsed).";
+    LAYOUT_ACT_WIDTH_DESCRIPTION = "resize_sidebar/resize_panel/resize_group: CSS px, clamped to layout sizes. resize_window: outer width in DIP, clamped to layout minimum and display work area; exits maximized state, requires exit_fullscreen first. Result reports actual size. resize_window/resize_group need width, height, or both.";
+    LAYOUT_ACT_HEIGHT_DESCRIPTION = "resize_group: CSS px. resize_window: outer height in DIP, clamped to layout minimum and display work area; requires exit_fullscreen first.";
+    LAYOUT_ACT_MODE_DESCRIPTION = "chat_mode: docked (column), floating (over the panel), icon (collapsed). window_mode: mini (convert this native window in place) or full (restore the complete app, not OS fullscreen). Requires a visible target; close splits with close_split first. Waits for the window animation; repeated mode is a no-op.";
     LAYOUT_ACT_POSITION_DESCRIPTION = "chat_mode: where the floating chat or its icon snaps. Alone it moves the chat without changing mode; while docked it is kept for the next float.";
     LAYOUT_ACT_SESSION_DESCRIPTION = "split_session / close_split: a session id from session_list, session_search or session_collab_*.";
   }
@@ -786,11 +786,37 @@ var init_host_action_collaboration_descriptors = __esm({
   }
 });
 
+// ../../packages/shared/src/config-tool-schema.ts
+var CONFIG_SETTINGS_DOMAINS;
+var init_config_tool_schema = __esm({
+  "../../packages/shared/src/config-tool-schema.ts"() {
+    "use strict";
+    CONFIG_SETTINGS_DOMAINS = [
+      "general",
+      "appearance",
+      "browser",
+      "computer-use",
+      "agent-claude",
+      "agent-codex",
+      "agent-acp",
+      "agent-cursor",
+      "agent-dsh",
+      "ai-provider",
+      "custom-platform",
+      "default-provider",
+      "project-claude",
+      "jev",
+      "app-icon"
+    ];
+  }
+});
+
 // ../../packages/shared/src/environment/host-action-setup-descriptors.ts
 var HOST_ACTION_SETUP_DESCRIPTORS;
 var init_host_action_setup_descriptors = __esm({
   "../../packages/shared/src/environment/host-action-setup-descriptors.ts"() {
     "use strict";
+    init_config_tool_schema();
     init_superone_tool_descriptions();
     HOST_ACTION_SETUP_DESCRIPTORS = [
       {
@@ -843,16 +869,7 @@ var init_host_action_setup_descriptors = __esm({
           "properties": {
             "domain": {
               "type": "string",
-              "enum": [
-                "general",
-                "appearance",
-                "browser",
-                "computer-use",
-                "agent-claude",
-                "agent-codex",
-                "ai-provider",
-                "custom-platform"
-              ],
+              "enum": CONFIG_SETTINGS_DOMAINS,
               "description": "Which settings domain to read. Omit to list all domains with their descriptions."
             },
             "recordId": {
@@ -871,7 +888,7 @@ var init_host_action_setup_descriptors = __esm({
           "properties": {
             "changes": {
               "type": "array",
-              "description": "Scalar settings changes to propose. Each item targets one field key from config_read. Mutually exclusive with `resource`.",
+              "description": "Settings changes to propose. Each item targets one field key from config_read. Mutually exclusive with `resource`.",
               "items": {
                 "type": "object",
                 "properties": {
@@ -884,7 +901,9 @@ var init_host_action_setup_descriptors = __esm({
                       "string",
                       "number",
                       "boolean",
-                      "null"
+                      "null",
+                      "array",
+                      "object"
                     ],
                     "description": 'The new value. Use null (or "") to reset a clearable field to its default.'
                   }
@@ -4578,7 +4597,7 @@ var init_host_action_terminal_descriptors = __esm({
 });
 
 // ../../packages/shared/src/layout-control.ts
-var LAYOUT_ACT_ACTIONS, LAYOUT_DIRECTIONS, LAYOUT_CHAT_MODES, LAYOUT_CHAT_POSITIONS;
+var LAYOUT_ACT_ACTIONS, LAYOUT_DIRECTIONS, LAYOUT_CHAT_MODES, LAYOUT_WINDOW_MODES, LAYOUT_CHAT_POSITIONS;
 var init_layout_control = __esm({
   "../../packages/shared/src/layout-control.ts"() {
     "use strict";
@@ -4602,6 +4621,10 @@ var init_layout_control = __esm({
       "resize_sidebar",
       "resize_panel",
       "chat_mode",
+      "window_mode",
+      "resize_window",
+      "enter_fullscreen",
+      "exit_fullscreen",
       "show_terminal",
       "hide_terminal",
       "split_session",
@@ -4609,6 +4632,7 @@ var init_layout_control = __esm({
     ];
     LAYOUT_DIRECTIONS = ["right", "down", "left", "up", "into"];
     LAYOUT_CHAT_MODES = ["docked", "floating", "icon"];
+    LAYOUT_WINDOW_MODES = ["mini", "full"];
     LAYOUT_CHAT_POSITIONS = ["top-left", "top", "top-right", "right", "bottom-right", "bottom", "bottom-left", "left"];
   }
 });
@@ -4694,7 +4718,7 @@ var init_host_action_layout_descriptors = __esm({
             },
             width: { type: "integer", minimum: 1, description: LAYOUT_ACT_WIDTH_DESCRIPTION },
             height: { type: "integer", minimum: 1, description: LAYOUT_ACT_HEIGHT_DESCRIPTION },
-            mode: { type: "string", enum: [...LAYOUT_CHAT_MODES], description: LAYOUT_ACT_MODE_DESCRIPTION },
+            mode: { type: "string", enum: [...LAYOUT_CHAT_MODES, ...LAYOUT_WINDOW_MODES], description: LAYOUT_ACT_MODE_DESCRIPTION },
             position: { type: "string", enum: [...LAYOUT_CHAT_POSITIONS], description: LAYOUT_ACT_POSITION_DESCRIPTION }
           },
           required: ["action"],
@@ -11631,6 +11655,22 @@ var init_launch_options = __esm({
   }
 });
 
+// ../../packages/shared/src/window-layout.ts
+var WINDOW_LAYOUT_IPC_CHANNELS;
+var init_window_layout = __esm({
+  "../../packages/shared/src/window-layout.ts"() {
+    "use strict";
+    WINDOW_LAYOUT_IPC_CHANNELS = {
+      GET_FULLSCREEN: "app:get-fullscreen",
+      FULLSCREEN_CHANGED: "app:fullscreen-changed",
+      SET_MIN_WINDOW_SIZE: "app:set-min-window-size",
+      GET_WINDOW_LAYOUT_STATE: "app:get-window-layout-state",
+      RESIZE_WINDOW: "app:resize-window",
+      SET_WINDOW_FULLSCREEN: "app:set-window-fullscreen"
+    };
+  }
+});
+
 // ../../packages/shared/src/agent-types.ts
 function hasOneM(id) {
   return id.endsWith(ONE_M_SUFFIX);
@@ -11658,10 +11698,11 @@ function resolveMappedClaudeModelId(model, env) {
   if (env[BUCKET_ENV_KEYS.opus.id]) return "opus";
   return stripOneM(model);
 }
-var SESSION_AGENT_LAUNCHES_FIELD, SESSION_AGENT_TASK_MAX, DEFAULT_CONTEXT_WINDOW, CODEX_GPT_5_6_CONTEXT_WINDOW, CODEX_PERMISSION_PRESETS, DEFAULT_CODEX_PERMISSION_PRESET, DEFAULT_CODEX_PERMISSION_PROFILE, CLAUDE_ACCOUNT_PROVIDER_PREFIX, CLAUDE_CLI_ACCOUNT_PROVIDER_ID, MODEL_BUCKETS, BUCKET_ENV_KEYS, ONE_M_SUFFIX, MODEL_MAPPING_ENV_IDS;
+var SESSION_AGENT_LAUNCHES_FIELD, SESSION_AGENT_TASK_MAX, DEFAULT_CONTEXT_WINDOW, CODEX_GPT_5_6_CONTEXT_WINDOW, CODEX_PERMISSION_PRESETS, DEFAULT_CODEX_PERMISSION_PRESET, DEFAULT_CODEX_PERMISSION_PROFILE, CLAUDE_ACCOUNT_PROVIDER_PREFIX, CLAUDE_CLI_ACCOUNT_PROVIDER_ID, MODEL_BUCKETS, BUCKET_ENV_KEYS, ONE_M_SUFFIX, MODEL_MAPPING_ENV_IDS, AgentIpcChannels;
 var init_agent_types = __esm({
   "../../packages/shared/src/agent-types.ts"() {
     "use strict";
+    init_window_layout();
     SESSION_AGENT_LAUNCHES_FIELD = "sessionAgentLaunchesJson";
     SESSION_AGENT_TASK_MAX = 1e5;
     DEFAULT_CONTEXT_WINDOW = 2e5;
@@ -11718,6 +11759,772 @@ var init_agent_types = __esm({
     };
     ONE_M_SUFFIX = "[1m]";
     MODEL_MAPPING_ENV_IDS = MODEL_BUCKETS.map((bucket) => BUCKET_ENV_KEYS[bucket].id);
+    AgentIpcChannels = {
+      // App-level channels
+      CONNECT_CLAUDE: "app:connect-claude",
+      CONNECT_CODEX: "app:connect-codex",
+      CONNECT_OPENCODE: "app:connect-opencode",
+      CONNECT_CURSOR: "app:connect-cursor",
+      CONNECT_DEEPSEEK: "app:connect-deepseek",
+      DEEPSEEK_TRAJECTORY: "app:deepseek-trajectory",
+      DEEPSEEK_TRAJECTORY_PAGE: "app:deepseek-trajectory-page",
+      DEEPSEEK_TRAJECTORY_PAYLOAD: "app:deepseek-trajectory-payload",
+      DEEPSEEK_TRAJECTORY_WATCH: "app:deepseek-trajectory-watch",
+      DEEPSEEK_TRAJECTORY_CHANGED: "app:deepseek-trajectory-changed",
+      SAVE_TEXT_AS: "app:save-text-as",
+      DEEPSEEK_PRESETS: "app:deepseek-presets",
+      SET_CURSOR_API_KEY: "app:set-cursor-api-key",
+      GET_CURSOR_AUTH_STATUS: "app:get-cursor-auth-status",
+      CURSOR_LIST_AGENTS: "app:cursor-list-agents",
+      CURSOR_LIST_RUNS: "app:cursor-list-runs",
+      CURSOR_ARCHIVE_AGENT: "app:cursor-archive-agent",
+      CURSOR_UNARCHIVE_AGENT: "app:cursor-unarchive-agent",
+      CURSOR_DELETE_AGENT: "app:cursor-delete-agent",
+      CURSOR_LIST_ARTIFACTS: "app:cursor-list-artifacts",
+      CURSOR_DOWNLOAD_ARTIFACT: "app:cursor-download-artifact",
+      CURSOR_LIST_REPOSITORIES: "app:cursor-list-repositories",
+      CURSOR_UPDATE_BASE_CONFIG: "app:cursor-update-base-config",
+      GET_CURSOR_BASE_CONFIG: "app:get-cursor-base-config",
+      CURSOR_GET_AGENT: "app:cursor-get-agent",
+      CURSOR_LIST_MESSAGES: "app:cursor-list-messages",
+      CURSOR_GET_RUN: "app:cursor-get-run",
+      CURSOR_CANCEL_RUN: "app:cursor-cancel-run",
+      CURSOR_SDK_LOGIN: "app:cursor-sdk-login",
+      CURSOR_SDK_LOGOUT: "app:cursor-sdk-logout",
+      CURSOR_SDK_AUTH_STATUS: "app:cursor-sdk-auth-status",
+      CURSOR_GET_USAGE: "app:cursor-get-usage",
+      CURSOR_LIST_SLASH_ITEMS: "app:cursor-list-slash-items",
+      GET_STARTUP_DATA: "app:get-startup-data",
+      GET_APP_METRICS: "app:get-app-metrics",
+      SELECT_FOLDER: "app:select-folder",
+      GET_RECENT_FOLDERS: "app:get-recent-folders",
+      ADD_RECENT_FOLDER: "app:add-recent-folder",
+      REMOVE_RECENT_FOLDER: "app:remove-recent-folder",
+      GET_PROJECT_ID: "app:get-project-id",
+      OPEN_FOLDER: "app:open-folder",
+      OPEN_TMP_FOLDER: "app:open-tmp-folder",
+      CACHE_IMAGE: "app:cache-image",
+      RESOLVE_FAVICON: "app:resolve-favicon",
+      RESOLVE_SITE_IDENTITY: "app:resolve-site-identity",
+      RESOLVE_LINK_PREVIEW: "app:resolve-link-preview",
+      CACHE_FAVICON: "app:cache-favicon",
+      CLOSE_PROJECT: "app:close-project",
+      SETUP_CHECK_CLAUDE: "app:setup-check-claude",
+      SETUP_INSTALL_CLAUDE: "app:setup-install-claude",
+      SETUP_EVENT: "app:setup-event",
+      CODEX_LIST_MODELS: "codex:list-models",
+      CODEX_GET_AUTH_STATUS: "codex:get-auth-status",
+      CODEX_SET_AUTH: "codex:set-auth",
+      CODEX_GET_ACCOUNT_STATUS: "codex:get-account-status",
+      CODEX_ACCOUNT_LOGIN_START: "codex:account-login-start",
+      CODEX_ACCOUNT_LOGIN_CANCEL: "codex:account-login-cancel",
+      CODEX_ACCOUNT_LOGOUT: "codex:account-logout",
+      CODEX_GET_RATE_LIMITS: "codex:get-rate-limits",
+      CODEX_GET_ACCOUNT_USAGE: "codex:get-account-usage",
+      CODEX_GET_SERVER_DIAGNOSTICS: "codex:get-server-diagnostics",
+      CODEX_GET_CONFIG_REQUIREMENTS: "codex:get-config-requirements",
+      CODEX_CONSUME_RATE_LIMIT_RESET: "codex:consume-rate-limit-reset",
+      CODEX_LIST_REALTIME_VOICES: "codex:list-realtime-voices",
+      CODEX_LIST_REALTIME_VOICE_PREVIEWS: "codex:list-realtime-voice-previews",
+      CODEX_MCP_OAUTH_LOGIN: "codex:mcp-oauth-login",
+      CODEX_EXTERNAL_AGENT_DETECT: "codex:external-agent-detect",
+      CODEX_EXTERNAL_AGENT_IMPORT: "codex:external-agent-import",
+      // Claude channels
+      CLAUDE_GET_RATE_LIMITS: "claude:get-rate-limits",
+      CLAUDE_LIST_ACCOUNTS: "claude:list-accounts",
+      CLAUDE_SIGN_IN_ACCOUNT: "claude:sign-in-account",
+      CLAUDE_SIGN_OUT_ACCOUNT: "claude:sign-out-account",
+      CLAUDE_SET_DEFAULT_ACCOUNT: "claude:set-default-account",
+      CLAUDE_CANCEL_SIGN_IN: "claude:cancel-sign-in",
+      // Third-party provider usage channels
+      PROVIDER_GET_RATE_LIMITS: "provider:get-rate-limits",
+      ACP_GET_RATE_LIMITS: "acp:get-rate-limits",
+      // Agent channels
+      PREWARM: "agent:prewarm",
+      START_REALTIME_VOICE: "agent:start-realtime-voice",
+      READY_REALTIME_VOICE: "agent:ready-realtime-voice",
+      STOP_REALTIME_VOICE: "agent:stop-realtime-voice",
+      LOAD_REALTIME_TIMELINE: "agent:load-realtime-timeline",
+      GET_REALTIME_TIMELINE: "agent:get-realtime-timeline",
+      SUGGESTED_TASK_LAUNCH_OPTIONS: "agent:suggested-task-launch-options",
+      LAUNCH_SUGGESTED_TASK: "agent:launch-suggested-task",
+      EVENT: "agent:event",
+      SANDBOX_PROBE: "sandbox:probe",
+      LIST_DIRECTORY: "agent:list-directory",
+      LIST_DIRECTORY_FOR_ADD_DIR: "agent:list-directory-for-add-dir",
+      VALIDATE_ADD_DIR: "agent:validate-add-dir",
+      FIND_LINE_NUMBER: "agent:find-line-number",
+      SEARCH_FILES: "agent:search-files",
+      SEARCH_MENTIONS: "agent:search-mentions",
+      PLUGINS_RELOAD: "plugins:reload",
+      // Plugins
+      PLUGINS_LIST: "plugins:list",
+      PLUGINS_READ: "plugins:read",
+      PLUGINS_READ_FILE: "plugins:read-file",
+      PLUGINS_DELETE: "plugins:delete",
+      PLUGINS_SET_ENABLED: "plugins:set-enabled",
+      PLUGINS_REVIEW_MODS: "plugins:review-mods",
+      PLUGINS_READ_CONFIG: "plugins:read-config",
+      PLUGINS_SAVE_CONFIG: "plugins:save-config",
+      PLUGINS_LIST_MARKETPLACE: "plugins:list-marketplace",
+      PLUGINS_INSTALL: "plugins:install",
+      PLUGINS_UPDATE: "plugins:update",
+      PLUGINS_UPDATE_MARKETPLACE: "plugins:update-marketplace",
+      PLUGINS_ADD_MARKETPLACE: "plugins:add-marketplace",
+      PLUGINS_REMOVE_MARKETPLACE: "plugins:remove-marketplace",
+      PLUGINS_READ_MARKETPLACE: "plugins:read-marketplace",
+      PLUGINS_READ_MARKETPLACE_FILE: "plugins:read-marketplace-file",
+      PLUGINS_GITHUB_STARS: "plugins:github-stars",
+      /** List/search public (or authenticated) GitHub repos under an owner. */
+      PLUGINS_GITHUB_SEARCH_REPOS: "plugins:github-search-repos",
+      /** Free-text GitHub repository search (add-project name query). */
+      PLUGINS_GITHUB_QUERY_REPOS: "plugins:github-query-repos",
+      /** Authenticated viewer's repos via `gh` (add-project default GitHub list). */
+      PLUGINS_GITHUB_LIST_MY_REPOS: "plugins:github-list-my-repos",
+      // Skills
+      SKILLS_LIST: "skills:list",
+      /** Project slash skills + commands (remote node or local discovery). */
+      SLASH_RESOURCES_LIST: "skills:slash-resources",
+      SKILLS_READ: "skills:read",
+      SKILLS_READ_FILE: "skills:read-file",
+      SKILLS_INSTALL: "skills:install",
+      SKILLS_DELETE: "skills:delete",
+      SKILLS_TOGGLE: "skills:toggle",
+      // Codex skills
+      CODEX_SKILLS_LIST: "codex:skills-list",
+      CODEX_SKILLS_READ: "codex:skills-read",
+      CODEX_SKILLS_READ_FILE: "codex:skills-read-file",
+      CODEX_SKILLS_DELETE: "codex:skills-delete",
+      CODEX_SKILLS_TOGGLE: "codex:skills-toggle",
+      // Codex hooks (read-only)
+      CODEX_HOOKS_LIST: "codex:hooks-list",
+      CODEX_MCP_STATUS: "codex:mcp-status",
+      // Codex skills change notification (push to renderer)
+      CODEX_SKILLS_CHANGED: "codex:skills-changed",
+      // Codex goal
+      // Codex marketplace
+      CODEX_MARKETPLACE_ADD: "codex:marketplace-add",
+      CODEX_MARKETPLACE_REMOVE: "codex:marketplace-remove",
+      CODEX_MARKETPLACE_UPGRADE: "codex:marketplace-upgrade",
+      // Codex plugins
+      CODEX_PLUGINS_LIST: "codex:plugins-list",
+      CODEX_PLUGINS_READ: "codex:plugins-read",
+      CODEX_PLUGINS_READ_FILE: "codex:plugins-read-file",
+      CODEX_PLUGINS_DELETE: "codex:plugins-delete",
+      CODEX_PLUGINS_LIST_MARKETPLACE: "codex:plugins-list-marketplace",
+      CODEX_PLUGINS_INSTALL: "codex:plugins-install",
+      CODEX_PLUGINS_DIRECTORY: "codex:plugins-directory",
+      CODEX_PLUGINS_CATEGORY: "codex:plugins-category",
+      CODEX_PLUGINS_DETAIL: "codex:plugins-detail",
+      CODEX_PLUGINS_SEARCH: "codex:plugins-search",
+      CODEX_PLUGINS_PERSONAL: "codex:plugins-personal",
+      CODEX_PLUGINS_INSTALL_TARGET: "codex:plugins-install-target",
+      // Codex MCP config
+      CODEX_MCP_LIST_CONFIG: "codex:mcp-list-config",
+      CODEX_MCP_SAVE_CONFIG: "codex:mcp-save-config",
+      CODEX_MCP_DELETE_CONFIG: "codex:mcp-delete-config",
+      CODEX_MCP_TOGGLE_CONFIG: "codex:mcp-toggle-config",
+      // dsh MCP config
+      DSH_MCP_LIST_CONFIG: "dsh:mcp-list-config",
+      DSH_MCP_SAVE_CONFIG: "dsh:mcp-save-config",
+      DSH_MCP_DELETE_CONFIG: "dsh:mcp-delete-config",
+      DSH_MCP_TOGGLE_CONFIG: "dsh:mcp-toggle-config",
+      DSH_PLUGIN_LIST: "dsh:plugin-list",
+      DSH_PLUGIN_INSTALL: "dsh:plugin-install",
+      DSH_PLUGIN_SET_DISABLED: "dsh:plugin-set-disabled",
+      DSH_PLUGIN_UNINSTALL: "dsh:plugin-uninstall",
+      // MCP config
+      MCP_LIST_CONFIG: "mcp:list-config",
+      MCP_SAVE_CONFIG: "mcp:save-config",
+      MCP_DELETE_CONFIG: "mcp:delete-config",
+      MCP_TOGGLE_CONFIG: "mcp:toggle-config",
+      MCP_LIST_TOOL_PERMISSIONS: "mcp:list-tool-permissions",
+      MCP_SET_TOOL_PERMISSION: "mcp:set-tool-permission",
+      MCP_CHECK_SERVERS: "mcp:check-servers",
+      MCP_META_CACHE: "mcp:meta-cache",
+      MCP_PROBE_ICONS: "mcp:probe-icons",
+      MCP_OAUTH_AUTHORIZE: "mcp:oauth-authorize",
+      // MCP library
+      MCP_LIST_LIBRARY: "mcp:list-library",
+      MCP_DELETE_LIBRARY_ENTRY: "mcp:delete-library-entry",
+      // MCP bundles (.mcpb)
+      MCPB_PREVIEW: "mcpb:preview",
+      MCPB_INSTALL: "mcpb:install",
+      MCPB_UNINSTALL: "mcpb:uninstall",
+      MCPB_LIST: "mcpb:list",
+      MCPB_REVEAL: "mcpb:reveal",
+      // Hooks config (settings.json#hooks)
+      HOOKS_LIST: "hooks:list",
+      HOOKS_SAVE: "hooks:save",
+      HOOKS_DELETE: "hooks:delete",
+      CLAUDE_PROJECT_PREFERENCES_GET: "claude:project-preferences-get",
+      CLAUDE_PROJECT_PREFERENCES_SAVE: "claude:project-preferences-save",
+      // Agents
+      AGENTS_LIST: "agents:list",
+      AGENTS_READ_FILE: "agents:read-file",
+      // Git
+      GIT_INFO: "app:git-info",
+      GIT_IS_REPO: "app:git-is-repo",
+      GIT_INIT: "app:git-init",
+      GIT_LIST_BRANCHES: "app:git-list-branches",
+      GIT_SWITCH_BRANCH: "app:git-switch-branch",
+      GIT_CREATE_BRANCH: "app:git-create-branch",
+      GIT_WORKTREE_EXISTS: "app:git-worktree-exists",
+      GIT_WORKTREE_INFO: "app:git-worktree-info",
+      GIT_ACTIVATE_WORKTREE: "app:git-activate-worktree",
+      GIT_SWITCH_WORKTREE: "app:git-switch-worktree",
+      GIT_CHECKED_OUT_BRANCHES: "app:git-checked-out-branches",
+      GIT_HANDOFF_TO_LOCAL: "app:git-handoff-to-local",
+      GIT_HANDOFF_PREVIEW: "app:git-handoff-preview",
+      GIT_ASSIGN_BRANCH: "app:git-assign-branch",
+      GIT_STATUS_FILES: "app:git-status-files",
+      GIT_LOG: "app:git-log",
+      GIT_MENTION_REFS: "app:git-mention-refs",
+      GIT_MENTION_CAPABILITIES: "app:git-mention-capabilities",
+      GIT_FILE_TREE: "app:git-file-tree",
+      GIT_LIST_DIR: "app:git-list-dir",
+      FILE_MOVE: "app:file-move",
+      FILE_COPY_IN: "app:file-copy-in",
+      FILE_MOVE_IN: "app:file-move-in",
+      FILE_DELETE: "app:file-delete",
+      FILE_RENAME: "app:file-rename",
+      FILE_CREATE: "app:file-create",
+      FILE_SHOW_IN_FOLDER: "app:file-show-in-folder",
+      SHOW_CONTEXT_MENU: "app:show-context-menu",
+      START_DRAG: "app:start-drag",
+      PATH_STAT: "app:path-stat",
+      MEDIA_SERVER_PORT: "app:media-server-port",
+      CONTENT_ZOOM: "app:content-zoom",
+      BROWSER_ANNOTATE_SHORTCUT: "app:browser-annotate-shortcut",
+      BROWSER_BOOKMARK_SHORTCUT: "app:browser-bookmark-shortcut",
+      BROWSER_NEW_TAB_SHORTCUT: "app:browser-new-tab-shortcut",
+      BROWSER_OPEN_TAB: "app:browser-open-tab",
+      CLOSE_TAB_SHORTCUT: "app:close-tab-shortcut",
+      CLOSE_WINDOW: "app:close-window",
+      ...WINDOW_LAYOUT_IPC_CHANNELS,
+      OPEN_SESSION_WINDOW: "app:open-session-window",
+      /** Turn the *sender's own* window into a mini session window (and back). */
+      CONVERT_WINDOW_TO_MINI: "app:convert-window-to-mini",
+      RESTORE_WINDOW_FROM_MINI: "app:restore-window-from-mini",
+      /** Push + pull of "is this window currently converted, and onto which session". */
+      WINDOW_MINI_MODE_CHANGED: "app:window-mini-mode-changed",
+      GET_WINDOW_MINI_MODE: "app:get-window-mini-mode",
+      DRAG_PREVIEW_START: "app:drag-preview-start",
+      DRAG_PREVIEW_END: "app:drag-preview-end",
+      DRAG_PREVIEW_UPDATE: "app:drag-preview-update",
+      DRAG_PREVIEW_ZONE: "app:drag-preview-zone",
+      SET_WINDOW_ALWAYS_ON_TOP: "app:set-window-always-on-top",
+      SET_WINDOW_CHROME_COLORS: "app:set-window-chrome-colors",
+      GET_THEME: "app:get-theme",
+      SET_THEME: "app:set-theme",
+      THEME_CHANGED: "app:theme-changed",
+      COMPOSER_DRAFTS_GET: "app:composer-drafts-get",
+      COMPOSER_DRAFT_PUBLISH: "app:composer-draft-publish",
+      COMPOSER_DRAFT_CHANGED: "app:composer-draft-changed",
+      RECENT_FOLDERS_CHANGED: "app:recent-folders-changed",
+      OPEN_EXTERNAL_LINK: "app:open-external-link",
+      MOBILE_APP_DOWNLOADS: "app:mobile-app-downloads",
+      CLIPBOARD_READ: "app:clipboard-read",
+      CLIPBOARD_WRITE: "app:clipboard-write",
+      GIT_DIFF_FILE: "app:git-diff-file",
+      SESSION_PROJECT: "app:session-project",
+      READ_PROJECT_FILE: "app:read-project-file",
+      STAT_PREVIEW_FILE: "app:stat-preview-file",
+      COMPOSE_USDZ_PREVIEW: "app:compose-usdz-preview",
+      LIST_DEVICE_MODELS: "app:list-device-models",
+      LOAD_DEVICE_MODEL: "app:load-device-model",
+      SAVE_FILE: "app:save-file",
+      READ_FILE_AS_DATA_URI: "app:read-file-as-data-uri",
+      STAGE_ATTACHMENT_ORIGINAL: "app:stage-attachment-original",
+      ATTACHMENT_ORIGINAL_STATUS: "app:attachment-original-status",
+      RETRY_ATTACHMENT_ORIGINAL: "app:retry-attachment-original",
+      SAVE_FILE_AS: "app:save-file-as",
+      CLIPBOARD_WRITE_IMAGE: "app:clipboard-write-image",
+      BROWSER_FETCH_IMAGE: "app:browser-fetch-image",
+      BROWSER_SAVE_IMAGE: "app:browser-save-image",
+      BROWSER_COPY_IMAGE_AT: "app:browser-copy-image-at",
+      REVEAL_FILE: "app:reveal-file",
+      // Concurrent session management
+      PARK_SESSION: "agent:park-session",
+      ACTIVATE_SESSION: "agent:activate-session",
+      SET_SESSION_FOREGROUND: "agent:set-session-foreground",
+      /** Main → renderer: the user clicked a notification; open this session. */
+      NOTIFICATION_ACTIVATE: "app:notification-activate",
+      // Live session snapshots for renderer resync
+      GET_LIVE_SNAPSHOTS: "agent:get-live-snapshots",
+      // Session history
+      SESSIONS_CHANGED: "sessions:changed",
+      SCHEDULED_SEND_CHANGED: "sessions:scheduled-send-changed",
+      // Additional directories
+      // Settings
+      SET_FAST_MODE: "app:set-fast-mode",
+      APP_SETTINGS_GET: "app:settings-get",
+      APP_SETTINGS_SAVE: "app:settings-save",
+      APP_SETTINGS_CHANGED: "app:settings-changed",
+      /**
+       * Node surface served to controller desktops. It runs while one is paired
+       * or a "Pair New Desktop" QR is open (see `remoteNodeAccessEnabled`).
+       */
+      NODE_HOST_STATUS: "nodeHost:status",
+      NODE_HOST_CONTROLLERS: "nodeHost:controllers",
+      NODE_HOST_REMOVE_CONTROLLER: "nodeHost:removeController",
+      NODE_HOST_SET_CONTROLLER_ENABLED: "nodeHost:setControllerEnabled",
+      /** Take a session another desktop started here back from it. */
+      NODE_HOST_RELEASE_SESSION: "nodeHost:releaseSession",
+      /** Push: the controller list or the host status changed. */
+      NODE_HOST_CHANGED: "nodeHost:changed",
+      /** Controller QR shown here; a phone paired with the controller scans it. */
+      NODE_HOST_PAIRING_START: "nodeHost:pairingStart",
+      NODE_HOST_PAIRING_CONFIRM: "nodeHost:pairingConfirm",
+      NODE_HOST_PAIRING_CANCEL: "nodeHost:pairingCancel",
+      /** Push: {@link ControllerPairingEvent}. */
+      NODE_HOST_PAIRING_EVENT: "nodeHost:pairingEvent",
+      /** Development builds: a node pairing code without a phone (`desktop-node-lab`). */
+      NODE_HOST_DEV_MINT_CODE: "nodeHost:devMintCode",
+      /** Resolved OS Downloads folder, shown as the placeholder for an unset download directory. */
+      APP_DEFAULT_DOWNLOAD_DIR: "app:default-download-dir",
+      /** Jev (TypeSafe) API key for the experimental browser fast loop: configured? / replace. */
+      JEV_API_KEY_STATUS: "app:jev-api-key-status",
+      JEV_API_KEY_SET: "app:jev-api-key-set",
+      /** What the session sync zone holds and what a sweep would free; the sweep itself. */
+      SYNC_ZONE_USAGE_GET: "app:sync-zone-usage",
+      SYNC_ZONE_RECLAIM: "app:sync-zone-reclaim",
+      SYNC_ZONE_RETRY_HANDOFFS: "app:sync-zone-retry-handoffs",
+      /** Stable per-installation id used as the analytics distinct id. */
+      APP_INSTALL_ID_GET: "app:install-id-get",
+      /**
+       * Read Computer Use TCC status / open permission float.
+       * false — status only
+       * true | 'guided' — two-step onboarding float
+       * 'accessibility' | 'screenRecording' — single-pane float
+       */
+      COMPUTER_USE_OPEN_PERMISSIONS: "computer-use:open-permissions",
+      /** Restart helper once and re-read TCC / runtime permission status. */
+      COMPUTER_USE_RECHECK_PERMISSIONS: "computer-use:recheck-permissions",
+      /** Dismiss the Computer Use permission drag float. */
+      COMPUTER_USE_CLOSE_PERMISSION_FLOAT: "computer-use:close-permission-float",
+      /** Resize the permission float to match measured content size. */
+      COMPUTER_USE_RESIZE_PERMISSION_FLOAT: "computer-use:resize-permission-float",
+      /** Push live permission status into the drag float. */
+      COMPUTER_USE_PERMISSION_STATUS: "computer-use:permission-status",
+      /** Guided float: continue from Accessibility to Screen Recording. */
+      COMPUTER_USE_CONTINUE_PERMISSION_STEP: "computer-use:continue-permission-step",
+      /** List currently running apps (for Computer Use always-allow picker). */
+      COMPUTER_USE_LIST_RUNNING_APPS: "computer-use:list-running-apps",
+      /** List connected displays that can host Computer Use target windows. */
+      COMPUTER_USE_LIST_DISPLAYS: "computer-use:list-displays",
+      /** Connected display topology changed (add/remove/metrics). */
+      COMPUTER_USE_DISPLAYS_CHANGED: "computer-use:displays-changed",
+      /** Installed desktop apps catalog (mention popup / search). */
+      COMPUTER_USE_LIST_INSTALLED_APPS: "computer-use:list-installed-apps",
+      /** Session-scoped temporary grants from @ desktop-app mentions. */
+      COMPUTER_USE_GRANT_SESSION_APPS: "computer-use:grant-session-apps",
+      /** Best-effort app icon data URI for a bundle id (UI only; cached in main). */
+      COMPUTER_USE_RESOLVE_APP_ICON: "computer-use:resolve-app-icon",
+      /** Main -> renderer: Computer Use target metadata for the session-owned PiP. */
+      COMPUTER_USE_VIEWFINDER_CLAIM: "computer-use:viewfinder-claim",
+      /** Main -> renderer: compressed frame for the current Computer Use target. */
+      COMPUTER_USE_VIEWFINDER_FRAME: "computer-use:viewfinder-frame",
+      /** Renderer -> main: focus the active window behind a Computer Use PiP. */
+      COMPUTER_USE_VIEWFINDER_FOCUS: "computer-use:viewfinder-focus",
+      /** Renderer -> main: stop capture after the Computer Use PiP loses visibility. */
+      COMPUTER_USE_VIEWFINDER_HIDE: "computer-use:viewfinder-hide",
+      /** Renderer -> main: resume a Computer Use PiP explicitly hidden by the user. */
+      COMPUTER_USE_VIEWFINDER_RESTORE: "computer-use:viewfinder-restore",
+      /** Renderer -> main: match Computer Use capture pixels to the visible PiP size. */
+      COMPUTER_USE_VIEWFINDER_RESIZE: "computer-use:viewfinder-resize",
+      BROWSER_HISTORY_RECORD: "app:browser-history-record",
+      BROWSER_HISTORY_SUGGEST: "app:browser-history-suggest",
+      BROWSER_HISTORY_DELETE: "app:browser-history-delete",
+      BROWSER_CERT_ERROR: "app:browser-cert-error",
+      BROWSER_CERT_PROCEED: "app:browser-cert-proceed",
+      /** Main -> renderer: a browser tab started or stopped producing sound. */
+      BROWSER_AUDIO_STATE: "app:browser-audio-state",
+      APP_SYSTEM_LOCALE: "app:system-locale",
+      APP_LOCALE_CHANGED: "app:locale-changed",
+      APP_ICON_PICK_FILE: "app:icon-pick-file",
+      APP_ICON_SET: "app:icon-set",
+      APP_ICON_RESET: "app:icon-reset",
+      // Usage statistics
+      USAGE_QUERY: "app:usage:query",
+      USAGE_COUNTS_QUERY: "app:usage:counts",
+      USAGE_HARNESS_SESSION_RANKS: "app:usage:harness-session-ranks",
+      USAGE_BACKFILL_STATUS: "app:usage:backfill-status",
+      USAGE_BACKFILL_DONE: "app:usage:backfill-done",
+      // Logging
+      GET_LOG_PATH: "app:get-log-path",
+      TRACE: "app:trace",
+      // Updater
+      UPDATER_EVENT: "updater:event",
+      UPDATER_INSTALL: "updater:install",
+      NOTIFICATION_PRIME: "notifications:prime",
+      UPDATER_CHECK: "updater:check",
+      UPDATER_DOWNLOAD: "updater:download",
+      UPDATER_SIMULATE: "updater:simulate",
+      /** Pull the last updater event so a late/reloaded renderer can catch up. */
+      UPDATER_GET_STATE: "updater:getState",
+      /** macOS bundle-id bridge (see UpdateEvent 'identity-migration'). */
+      UPDATER_MIGRATION_DOWNLOAD: "updater:migrationDownload",
+      UPDATER_MIGRATION_OPEN_INSTALLER: "updater:migrationOpenInstaller",
+      UPDATER_MIGRATION_REVEAL: "updater:migrationReveal",
+      // File watcher
+      FILE_WATCH_START: "app:file-watch-start",
+      FILE_WATCH_STOP: "app:file-watch-stop",
+      FILE_CHANGE_EVENT: "app:file-change-event",
+      GIT_HEAD_CHANGE: "app:git-head-change",
+      // Unified AI provider platform (registry + credentials + bindings)
+      PLATFORMS_LIST: "platforms:list",
+      PLATFORMS_CREATE_CUSTOM: "platforms:create-custom",
+      PLATFORMS_UPDATE_CUSTOM: "platforms:update-custom",
+      PLATFORMS_DELETE_CUSTOM: "platforms:delete-custom",
+      CREDENTIALS_LIST: "credentials:list",
+      CREDENTIALS_CREATE: "credentials:create",
+      CREDENTIALS_UPDATE: "credentials:update",
+      CREDENTIALS_DELETE: "credentials:delete",
+      BINDINGS_GET: "bindings:get",
+      BINDINGS_SET: "bindings:set",
+      BINDINGS_CLEAR: "bindings:clear",
+      PROVIDERS_TEST_ENDPOINT: "providers:test-endpoint",
+      PROVIDERS_DISCOVER_MODELS: "providers:discover-models",
+      ACP_LIST_AGENTS: "acp:list-agents",
+      /** Refresh ACP agent model catalogs once per app open (uses cache thereafter). */
+      ACP_REFRESH_MODELS: "acp:refresh-models",
+      /** Report unsaved editor buffer content for ACP fs/read_text_file. */
+      ACP_SET_UNSAVED_BUFFER: "acp:set-unsaved-buffer",
+      /** Observe the sandbox Grok will apply (SuperOne never sets it). Read-only. */
+      ACP_GET_SANDBOX: "acp:get-sandbox",
+      // Media generation providers (read-only status derived from image-serving credentials)
+      MEDIA_GEN_PROVIDERS: "mediaGen:providers",
+      // Model catalog (models.dev, local-cached)
+      MODEL_CATALOG_GET: "modelCatalog:get",
+      MODEL_CATALOG_REFRESH: "modelCatalog:refresh",
+      // Session Providers (new session_providers table)
+      SESSION_PROVIDERS_LIST: "sessionProviders:list",
+      SESSION_PROVIDERS_LIST_BY_HARNESS: "sessionProviders:list-by-harness",
+      SESSION_PROVIDERS_GET: "sessionProviders:get",
+      SESSION_PROVIDERS_GET_BASE: "sessionProviders:get-base",
+      SESSION_PROVIDERS_CREATE: "sessionProviders:create",
+      SESSION_PROVIDERS_UPDATE: "sessionProviders:update",
+      SESSION_PROVIDERS_DELETE: "sessionProviders:delete",
+      /** `@codex` / `@grok` composer list — usable agents only. */
+      SESSION_PROVIDERS_MENTION_TARGETS: "sessionProviders:mention-targets",
+      // Bash output watcher
+      BASH_OUTPUT_WATCH: "app:bash-output-watch",
+      BASH_OUTPUT_UNWATCH: "app:bash-output-unwatch",
+      BASH_OUTPUT_EVENT: "app:bash-output-event",
+      BASH_OUTPUT_READ_MORE: "app:bash-output-read-more",
+      BASH_OUTPUT_READ_FILE: "app:bash-output-read-file",
+      // Workflow subagent transcripts
+      LIST_WORKFLOW_AGENTS: "app:list-workflow-agents",
+      READ_WORKFLOW_OUTPUT: "app:read-workflow-output",
+      READ_WORKFLOW_SCRIPT: "app:read-workflow-script",
+      /** Scan project + user `.grok/workflows/*.rhai` with parsed args. */
+      DISCOVER_GROK_WORKFLOWS: "app:discover-grok-workflows",
+      READ_SUBAGENT_TRANSCRIPT: "app:read-subagent-transcript",
+      // Remote control
+      REMOTE_CLIENT_REGISTERED: "remote:client-registered",
+      REMOTE_LIST_PAIRED: "remote:list-paired",
+      REMOTE_REMOVE_PAIRED: "remote:remove-paired",
+      REMOTE_SET_PAIRED_ENABLED: "remote:set-paired-enabled",
+      REMOTE_DEVICE_STATUS_CHANGED: "remote:device-status-changed",
+      REMOTE_UPLOAD_PROGRESS: "remote:upload-progress",
+      REMOTE_START_PAIRING: "remote:start-pairing",
+      REMOTE_CONFIRM_PAIRING: "remote:confirm-pairing",
+      REMOTE_CANCEL_PAIRING: "remote:cancel-pairing",
+      REMOTE_PAIRING_CODE_RECEIVED: "remote:pairing-code-received",
+      REMOTE_PAIRING_EXPIRED: "remote:pairing-expired",
+      REMOTE_PAIRING_ALREADY_PAIRED: "remote:pairing-already-paired",
+      REMOTE_GET_RELAY_STATUS: "remote:get-relay-status",
+      REMOTE_GET_LAN_STATUS: "remote:get-lan-status",
+      REMOTE_GET_HOSTNAME: "remote:get-hostname",
+      REMOTE_GET_CONFIG: "remote:get-config",
+      REMOTE_SAVE_CONFIG: "remote:save-config",
+      REMOTE_RELAY_STATUS: "remote:relay-status",
+      REMOTE_LAN_STATUS: "remote:lan-status",
+      WIDGET_IFRAME_READY: "widget:iframe-ready",
+      WIDGET_SAVE_TEMPLATE: "widget:save-template",
+      // Mini-App
+      MINIAPP_LIST: "miniapp:list",
+      MINIAPP_OPEN: "miniapp:open",
+      MINIAPP_CLOSE: "miniapp:close",
+      MINIAPP_AUTHORIZE: "miniapp:authorize",
+      MINIAPP_UNAUTHORIZE: "miniapp:unauthorize",
+      BROWSER_AUTOMATION_CALL: "browser:automation-call",
+      BROWSER_AUTOMATION_RESULT: "browser:automation-result",
+      MINIAPP_TOOL_INTERCEPT_OPEN: "miniapp:tool-intercept-open",
+      MINIAPP_TOOL_INTERCEPT_SUBMIT: "miniapp:tool-intercept-submit",
+      MINIAPP_TOOL_INTERCEPT_CANCEL: "miniapp:tool-intercept-cancel",
+      MINIAPP_TOOL_INTERCEPT_CLEAR: "miniapp:tool-intercept-clear",
+      MINIAPP_SHOW_ITEM_IN_FOLDER: "miniapp:show-item-in-folder",
+      MINIAPP_START_DRAG: "miniapp:start-drag",
+      MINIAPP_GET_PRELOAD_PATH: "miniapp:get-preload-path",
+      MINIAPP_HOST_POST_MESSAGE: "miniapp:host-post-message",
+      MINIAPP_HOST_MESSAGE: "miniapp:host-message",
+      /** main → renderer: stdout/stderr and failures of a development MiniApp Host. */
+      MINIAPP_HOST_LOG: "miniapp:host-log",
+      MINIAPP_DEV_SERVER: "miniapp:dev-server",
+      MINIAPP_HOST_LIST: "miniapp:host-list",
+      MINIAPP_HOST_STOP: "miniapp:host-stop",
+      MINIAPP_HOST_STATE: "miniapp:host-state",
+      /** main → renderer: a MiniApp Host asks the renderer to perform a host action. */
+      MINIAPP_HOST_ACTION: "miniapp:host-action",
+      /** renderer → main: result of one MINIAPP_HOST_ACTION. */
+      MINIAPP_HOST_ACTION_RESULT: "miniapp:host-action-result",
+      /** renderer → main: the agent consumed a mini-app's context card. */
+      MINIAPP_CONTEXT_CONSUMED: "miniapp:context-consumed",
+      MINIAPP_DETECT_DEV: "miniapp:detect-dev",
+      MINIAPP_PREVIEW: "miniapp:preview",
+      MINIAPP_CONFIRM_INSTALL: "miniapp:confirm-install",
+      MINIAPP_CANCEL_INSTALL: "miniapp:cancel-install",
+      MINIAPP_UNINSTALL: "miniapp:uninstall",
+      MINIAPP_PACK: "miniapp:pack",
+      MINIAPP_GET_INSTALL_META: "miniapp:get-install-meta",
+      MINIAPP_GET_PREAPPROVED: "miniapp:get-preapproved",
+      MINIAPP_SET_PREAPPROVED: "miniapp:set-preapproved",
+      MINIAPP_DEV_APP_READY: "miniapp:dev-app-ready",
+      MINIAPP_DEV_REGISTRY_LIST: "miniapp:dev-registry:list",
+      MINIAPP_DEV_REGISTRY_ADD: "miniapp:dev-registry:add",
+      MINIAPP_DEV_REGISTRY_REMOVE: "miniapp:dev-registry:remove",
+      MINIAPP_DEV_REGISTRY_INSTALL: "miniapp:dev-registry:install",
+      MINIAPP_DEV_REGISTRY_UNINSTALL: "miniapp:dev-registry:uninstall",
+      MINIAPP_DEV_REGISTRY_SET_ENABLED: "miniapp:dev-registry:set-enabled",
+      MINIAPP_DEV_REGISTRY_REVEAL_SOURCE: "miniapp:dev-registry:reveal-source",
+      // Automations
+      AUTOMATIONS_LIST: "automations:list",
+      AUTOMATIONS_CREATE: "automations:create",
+      AUTOMATIONS_UPDATE: "automations:update",
+      AUTOMATIONS_DELETE: "automations:delete",
+      AUTOMATIONS_RUN_NOW: "automations:run-now",
+      /** Run lifecycle (running/completed/error) for a single automation. */
+      AUTOMATIONS_EVENT: "automations:event",
+      /** List mutation (create/update/delete) — renderer should re-list. Optional projectPath scopes refresh. */
+      AUTOMATIONS_CHANGED: "automations:changed",
+      // Terminal
+      TERMINAL_CREATE: "terminal:create",
+      TERMINAL_LIST: "terminal:list",
+      TERMINAL_SNAPSHOT: "terminal:snapshot",
+      TERMINAL_WRITE: "terminal:write",
+      TERMINAL_RESIZE: "terminal:resize",
+      TERMINAL_KILL: "terminal:kill",
+      TERMINAL_CLAIM: "terminal:claim",
+      TERMINAL_RELEASE: "terminal:release",
+      TERMINAL_EVENT: "terminal:event",
+      /** Stored "always allow in this project" command rules (settings > Terminal). */
+      TERMINAL_COMMAND_RULES_LIST: "terminal:command-rules:list",
+      TERMINAL_COMMAND_RULE_REMOVE: "terminal:command-rules:remove",
+      // Multi-environment / remote node (Main environment host)
+      ENVIRONMENT_SESSION_SOURCE: "environment:sessionSource",
+      ENVIRONMENT_SESSION_LINK_METADATA: "environment:sessionLinkMetadata",
+      ENVIRONMENT_SESSION_LINK_TARGET: "environment:sessionLinkTarget",
+      ENVIRONMENT_LIST: "environment:list",
+      ENVIRONMENT_GET_LOCAL_ID: "environment:getLocalId",
+      ENVIRONMENT_WORKSPACE_LIST_DIR: "environment:workspaceListDir",
+      ENVIRONMENT_WORKSPACE_READ_FILE: "environment:workspaceReadFile",
+      /** Remote tool-output / agent-transcript byte-offset tail watch. */
+      ENVIRONMENT_WORKSPACE_TAIL_WATCH_START: "environment:workspaceTailWatchStart",
+      ENVIRONMENT_WORKSPACE_TAIL_WATCH_POLL: "environment:workspaceTailWatchPoll",
+      ENVIRONMENT_WORKSPACE_TAIL_WATCH_STOP: "environment:workspaceTailWatchStop",
+      ENVIRONMENT_PAIR_REMOTE: "environment:pairRemote",
+      ENVIRONMENT_CONNECT_FAILOVER: "environment:connectWithFailover",
+      /** Dev-only: probe local remote-node lab (`bun run dev:cli:lab`). */
+      ENVIRONMENT_LOCAL_LAB_STATUS: "environment:localLabStatus",
+      /** Dev-only: mint pairing token + pair/connect to local lab. */
+      ENVIRONMENT_PAIR_LOCAL_LAB: "environment:pairLocalLab",
+      // Environment management UI (Settings → Environments)
+      ENVIRONMENT_LIST_ITEMS: "environment:listItems",
+      ENVIRONMENT_ADD_OVER_SSH: "environment:addOverSsh",
+      /** Install this desktop's CLI on an already-paired node and restart it. */
+      ENVIRONMENT_UPGRADE_NODE: "environment:upgradeNode",
+      /** Read local ~/.ssh/config Host aliases for the add-device picker. */
+      ENVIRONMENT_LIST_SSH_CONFIG_HOSTS: "environment:listSshConfigHosts",
+      /** Projects for a host (`local` or remote connectionId) — sidebar project list. */
+      ENVIRONMENT_LIST_PROJECTS: "environment:listProjects",
+      /** Open/register a project path on a host (local disk or remote project.open). */
+      ENVIRONMENT_OPEN_PROJECT: "environment:openProject",
+      /** Unregister a project from a host list (local recents or remote project.remove). */
+      ENVIRONMENT_REMOVE_PROJECT: "environment:removeProject",
+      /** Edit Project: rename and/or set the project's workspace folders. */
+      ENVIRONMENT_UPDATE_PROJECT: "environment:updateProject",
+      /** List sessions for a remote project (local uses sessions:* DB IPC). */
+      ENVIRONMENT_LIST_SESSIONS: "environment:listSessions",
+      /** Cross-project pinned sessions for one environment (sidebar Pinned section). */
+      ENVIRONMENT_LIST_PINNED_SESSIONS: "environment:listPinnedSessions",
+      /** Unsent composer drafts, stored in the environment that owns the project. */
+      ENVIRONMENT_LIST_DRAFTS: "environment:listDrafts",
+      ENVIRONMENT_UPSERT_DRAFT: "environment:upsertDraft",
+      ENVIRONMENT_DELETE_DRAFT: "environment:deleteDraft",
+      ENVIRONMENT_DISCONNECT_DRAFT: "environment:disconnectDraft",
+      ENVIRONMENT_PREPARE_DRAFT_OPEN: "environment:prepareDraftOpen",
+      ENVIRONMENT_DRAFT_OPEN_READY: "environment:draftOpenReady",
+      /** Create a session on a remote project (local uses agent:create-session). */
+      ENVIRONMENT_CREATE_SESSION: "environment:createSession",
+      ENVIRONMENT_GET_SESSION: "environment:getSession",
+      ENVIRONMENT_SEND_SESSION_MESSAGE: "environment:sendSessionMessage",
+      /** Open a remote session in the chat at a node snapshot (`session.load`) and follow it. */
+      ENVIRONMENT_OPEN_REMOTE_SESSION: "environment:openRemoteSession",
+      ENVIRONMENT_SUBSCRIBE_DETAIL: "environment:subscribeDetail",
+      ENVIRONMENT_UNSUBSCRIBE_DETAIL: "environment:unsubscribeDetail",
+      ENVIRONMENT_INTERRUPT_SESSION: "environment:interruptSession",
+      /** Change a session's durable settings (modes, model, effort, provider), local or remote. */
+      ENVIRONMENT_PATCH_SESSION_SETTINGS: "environment:patchSessionSettings",
+      ENVIRONMENT_CALL_SESSION: "environment:callSession",
+      ENVIRONMENT_DISCONNECT_SESSION_CONTROLLER: "environment:disconnectSessionController",
+      ENVIRONMENT_CALL_COMPOSER: "environment:callComposer",
+      ENVIRONMENT_CALL_SESSION_LIST: "environment:callSessionList",
+      /** Take control of a remote session back after its host released it (Reconnect). */
+      ENVIRONMENT_RECLAIM_SESSION_CONTROL: "environment:reclaimSessionControl",
+      /** One op on a session's mod surface (`@superone/shared/mod-ui`), local or remote. */
+      ENVIRONMENT_MOD_UI: "environment:modUi",
+      ENVIRONMENT_RENAME_SESSION: "environment:renameSession",
+      ENVIRONMENT_REMOVE_SESSION: "environment:removeSession",
+      ENVIRONMENT_SET_SESSION_UI_FLAGS: "environment:setSessionUiFlags",
+      ENVIRONMENT_FORK_SESSION: "environment:forkSession",
+      ENVIRONMENT_RESPOND_SESSION_PERMISSION: "environment:respondSessionPermission",
+      ENVIRONMENT_RESPOND_SESSION_QUESTION: "environment:respondSessionQuestion",
+      ENVIRONMENT_RESPOND_SESSION_PLAN: "environment:respondSessionPlan",
+      ENVIRONMENT_RESUME_REMOTE_SESSION_EVENTS: "environment:resumeRemoteSessionEvents",
+      /** List directories at an absolute path for the add-project browser. */
+      ENVIRONMENT_BROWSE_PATH: "environment:browsePath",
+      /** Clone a git repository onto a host and register it as a project. */
+      ENVIRONMENT_CLONE_REPOSITORY: "environment:cloneRepository",
+      /** Main → requesting renderer clone download percent (local host only). */
+      ENVIRONMENT_CLONE_PROGRESS: "environment:cloneProgress",
+      ENVIRONMENT_CONNECT: "environment:connect",
+      ENVIRONMENT_DISCONNECT: "environment:disconnect",
+      ENVIRONMENT_FORGET: "environment:forget",
+      /** Explicit transient retry (does not unblock auth). */
+      ENVIRONMENT_RETRY_NOW: "environment:retryNow",
+      /** Re-pair existing connectionId with a new pairing token (identity-safe). */
+      ENVIRONMENT_REPAIR_PAIRING: "environment:repairPairing",
+      /** Re-pair over the stored SSH endpoint; the desktop mints the token itself. */
+      ENVIRONMENT_REPAIR_PAIRING_SSH: "environment:repairPairingOverSsh",
+      /** Node QR shown here; a phone paired with the node scans it. */
+      ENVIRONMENT_NODE_PAIRING_START: "environment:nodePairingStart",
+      ENVIRONMENT_NODE_PAIRING_CANCEL: "environment:nodePairingCancel",
+      /** Main → renderer push: {@link NodePairingEvent}. */
+      ENVIRONMENT_NODE_PAIRING_EVENT: "environment:nodePairingEvent",
+      /** Development builds: pair a node code without a phone (`desktop-node-lab`). */
+      ENVIRONMENT_DEV_PAIR_NODE_CODE: "environment:devPairNodeCode",
+      /** Main → renderer supervisor state push. */
+      ENVIRONMENT_STATUS_EVENT: "environment:statusEvent",
+      /** A remote session the chat must read again (`EnvironmentHost.onRemoteSessionResync`). */
+      ENVIRONMENT_SESSION_RESYNC_EVENT: "environment:sessionResyncEvent",
+      /** A paired machine's project list changed (`EnvironmentHost.onProjectListChanged`). */
+      ENVIRONMENT_PROJECTS_CHANGED_EVENT: "environment:projectsChangedEvent",
+      /** Main → renderer SSH probe/install progress push. */
+      ENVIRONMENT_INSTALL_PROGRESS: "environment:installProgress",
+      /** Node-local AI provider credentials (masked). */
+      ENVIRONMENT_PROVIDER_LIST_CREDENTIALS: "environment:providerListCredentials",
+      ENVIRONMENT_PROVIDER_CREATE_CREDENTIAL: "environment:providerCreateCredential",
+      ENVIRONMENT_PROVIDER_UPDATE_CREDENTIAL: "environment:providerUpdateCredential",
+      ENVIRONMENT_PROVIDER_DELETE_CREDENTIAL: "environment:providerDeleteCredential",
+      ENVIRONMENT_PROVIDER_LIST_BINDINGS: "environment:providerListBindings",
+      ENVIRONMENT_PROVIDER_SET_BINDING: "environment:providerSetBinding",
+      ENVIRONMENT_PROVIDER_CLEAR_BINDING: "environment:providerClearBinding",
+      ENVIRONMENT_PROVIDER_LIST_CUSTOM_PLATFORMS: "environment:providerListCustomPlatforms",
+      ENVIRONMENT_PROVIDER_UPSERT_CUSTOM_PLATFORM: "environment:providerUpsertCustomPlatform",
+      ENVIRONMENT_PROVIDER_DELETE_CUSTOM_PLATFORM: "environment:providerDeleteCustomPlatform",
+      /** Push desktop credentials → node (Main builds plaintext bundle; renderer never sees secrets). */
+      ENVIRONMENT_PROVIDER_PUSH_LOCAL: "environment:providerPushLocal",
+      /** Pull node credentials → desktop (admin). */
+      ENVIRONMENT_PROVIDER_PULL_REMOTE: "environment:providerPullRemote",
+      ENVIRONMENT_PROVIDER_LIST_MODELS: "environment:providerListModels",
+      /** Remote node harness catalog (node:admin). */
+      // The four things only the iOS Simulator has: whether this machine has a usable
+      // Xcode, which runtimes it installed, Apple's DeviceKit artwork, and making a new
+      // simulator. Android has no counterpart to any of them, so they are NOT part of
+      // the neutral set below and never will be.
+      ENVIRONMENT_IOS_SIMULATOR_STATUS: "environment:iosSimulatorStatus",
+      ENVIRONMENT_IOS_SIMULATOR_RUNTIMES: "environment:iosSimulatorRuntimes",
+      ENVIRONMENT_IOS_SIMULATOR_CHROME: "environment:iosSimulatorChrome",
+      ENVIRONMENT_IOS_SIMULATOR_CREATE: "environment:iosSimulatorCreate",
+      // Devices of any platform — simulators, emulators and phones through one set of
+      // channels. Everything the panel does to a device it already has is here; the
+      // platform is carried in the device id, and `device/ipc.ts` routes on it.
+      // What this machine could still be given. Neutral on purpose: the menu that offers
+      // "add a device" offers every platform's path in one list, and only one of them —
+      // creating an iOS simulator — is something SuperOne finishes itself.
+      ENVIRONMENT_DEVICE_SETUP_OPTIONS: "environment:deviceSetupOptions",
+      ENVIRONMENT_DEVICE_SETUP_OPEN: "environment:deviceSetupOpen",
+      ENVIRONMENT_DEVICE_LIST: "environment:deviceList",
+      ENVIRONMENT_DEVICE_BIND: "environment:deviceBind",
+      ENVIRONMENT_DEVICE_BOOT: "environment:deviceBoot",
+      ENVIRONMENT_DEVICE_DETACH: "environment:deviceDetach",
+      ENVIRONMENT_DEVICE_SHUTDOWN: "environment:deviceShutdown",
+      ENVIRONMENT_DEVICE_RELEASE: "environment:deviceRelease",
+      ENVIRONMENT_DEVICE_INPUT: "environment:deviceInput",
+      ENVIRONMENT_DEVICE_SCREENSHOT: "environment:deviceScreenshot",
+      ENVIRONMENT_DEVICE_RECORD_START: "environment:deviceRecordStart",
+      ENVIRONMENT_DEVICE_RECORD_STOP: "environment:deviceRecordStop",
+      ENVIRONMENT_DEVICE_STREAM_OPEN: "environment:deviceStreamOpen",
+      ENVIRONMENT_DEVICE_STREAM_CLOSE: "environment:deviceStreamClose",
+      ENVIRONMENT_DEVICE_STREAM_PORT: "environment:deviceStreamPort",
+      ENVIRONMENT_DEVICE_STATE: "environment:deviceState",
+      ENVIRONMENT_DEVICE_ENVIRONMENT: "environment:deviceEnvironment",
+      ENVIRONMENT_DEVICE_CONFIGURE: "environment:deviceConfigure",
+      ENVIRONMENT_DEVICE_ENVIRONMENT_CHANGED: "environment:deviceEnvironmentChanged",
+      /** Main -> renderer: the concrete device currently operated by an agent tool. */
+      ENVIRONMENT_DEVICE_VIEWFINDER_CLAIM: "environment:deviceViewfinderClaim",
+      ENVIRONMENT_DEVICE_ROTATE_GESTURE: "environment:deviceRotateGesture",
+      // Local desktop harness installation catalog (Settings → Harnesses)
+      HARNESS_LIST: "harness:list",
+      HARNESS_ENABLE: "harness:enable",
+      HARNESS_DISABLE: "harness:disable",
+      HARNESS_PROBE: "harness:probe",
+      HARNESS_ENSURE: "harness:ensure",
+      /** Main → renderer progress while downloading/extracting a managed runtime. */
+      HARNESS_INSTALL_PROGRESS: "harness:installProgress",
+      /** Onboarding: scan PATH for first-party harness CLIs. */
+      HARNESS_SCAN_CLI: "harness:scanCli",
+      /**
+       * Startup fallback: ensure every enabled managed harness matches the app pin.
+       * Progress via HARNESS_INSTALL_PROGRESS. Happy path pre-fetches during update.
+       */
+      HARNESS_ALIGN_ENABLED: "harness:alignEnabled",
+      /** True when any enabled managed harness is not pin-aligned (skip gate UI if false). */
+      HARNESS_NEEDS_ALIGN: "harness:needsAlign",
+      /** Retry harness pre-fetch after a failed atomic update package. */
+      UPDATER_RETRY_HARNESS: "updater:retryHarness",
+      /** Remote Skills / MCP via node `skills.*` / `mcp.*` (EnvironmentHost). */
+      ENVIRONMENT_LIST_REMOTE_SKILLS: "environment:listRemoteSkills",
+      ENVIRONMENT_GET_REMOTE_SKILL: "environment:getRemoteSkill",
+      ENVIRONMENT_READ_REMOTE_SKILL_FILE: "environment:readRemoteSkillFile",
+      ENVIRONMENT_DELETE_REMOTE_SKILL: "environment:deleteRemoteSkill",
+      ENVIRONMENT_INSTALL_REMOTE_SKILL: "environment:installRemoteSkill",
+      ENVIRONMENT_LIST_REMOTE_MCP_CONFIGS: "environment:listRemoteMcpConfigs",
+      ENVIRONMENT_SAVE_REMOTE_MCP_CONFIG: "environment:saveRemoteMcpConfig",
+      ENVIRONMENT_TOGGLE_REMOTE_MCP_CONFIG: "environment:toggleRemoteMcpConfig",
+      ENVIRONMENT_DELETE_REMOTE_MCP_CONFIG: "environment:deleteRemoteMcpConfig",
+      /** Node harness.resources aggregate (models + skills/commands/agents/prompts). */
+      ENVIRONMENT_MCP_APPS_PROVIDER: "environment:mcpApps.provider",
+      MCP_APP_HOST_REQUEST: "environment:mcpApps.hostRequest",
+      MCP_APP_REGISTER_DOCUMENT: "environment:mcpApps.registerDocument",
+      MCP_APP_RELEASE_DOCUMENT: "environment:mcpApps.releaseDocument",
+      MCP_APP_CANCEL_REQUEST: "environment:mcpApps.cancelRequest",
+      /** File entrypoints: which Apps open a file, open it in one, close it. */
+      MCP_APP_FILE_HANDLERS: "environment:mcpApps.fileHandlers",
+      MCP_APP_OPEN_FILE: "environment:mcpApps.openFile",
+      MCP_APP_CLOSE_FILE: "environment:mcpApps.closeFile",
+      /** Composer @-mentions from servers that declare `mentions/search`. */
+      MCP_APP_MENTION_SEARCH: "environment:mcpApps.mentionSearch",
+      MCP_APP_MENTION_READ: "environment:mcpApps.mentionRead",
+      MCP_FORM_PICK_RESOURCES: "environment:mcpForm.pickResources",
+      MCP_FORM_PREVIEW_RESOURCE: "environment:mcpForm.previewResource",
+      /** Sign a View's MCP server in through its harness (browser + optional loopback relay). */
+      ENVIRONMENT_MCP_APPS_AUTHENTICATE: "environment:mcpApps.authenticate",
+      ENVIRONMENT_HARNESS_RESOURCES: "environment:harnessResources",
+      /** Node session_providers CRUD. */
+      /** Node-side collaboration agent profiles — authoritative agentIds for @-mentions on a remote session. */
+      ENVIRONMENT_COLLAB_LIST_PROFILES: "environment:collabListProfiles",
+      /** Agent profiles a remote collaboration child can run on an environmentId (RemoteAgentProfiles). */
+      ENVIRONMENT_REMOTE_AGENT_PROFILES: "environment:remoteAgentProfiles",
+      ENVIRONMENT_SESSION_PROVIDERS_LIST: "environment:sessionProvidersList",
+      ENVIRONMENT_SESSION_PROVIDERS_GET: "environment:sessionProvidersGet",
+      ENVIRONMENT_SESSION_PROVIDERS_GET_BASE: "environment:sessionProvidersGetBase",
+      ENVIRONMENT_SESSION_PROVIDERS_CREATE: "environment:sessionProvidersCreate",
+      ENVIRONMENT_SESSION_PROVIDERS_UPDATE: "environment:sessionProvidersUpdate",
+      ENVIRONMENT_SESSION_PROVIDERS_DELETE: "environment:sessionProvidersDelete"
+    };
   }
 });
 
@@ -18419,7 +19226,7 @@ var init_suggested_task_launch = __esm({
 function record5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function isSuggestTool(toolName) {
+function isSuggestTaskTool(toolName) {
   if (typeof toolName !== "string") return false;
   const mcp = parseMcpToolName(toolName);
   return mcp?.serverName === "superone" && mcp.mcpToolName === SUGGEST_TASK_TOOL_NAME;
@@ -18447,7 +19254,7 @@ function contentOf(message) {
 function locateToolUse(messages, toolUseId) {
   for (let messageIndex = messages.length - 1; messageIndex >= 0; messageIndex--) {
     const use = contentOf(messages[messageIndex]).find((row2) => row2.type === "tool_use" && row2.toolUseId === toolUseId);
-    if (use) return isSuggestTool(use.toolName) ? { messageIndex, rowId: String(use.toolUseId), row: use } : null;
+    if (use) return isSuggestTaskTool(use.toolName) ? { messageIndex, rowId: String(use.toolUseId), row: use } : null;
   }
   return null;
 }
@@ -21730,6 +22537,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "harness",
         modUi: true,
         supportsShortWidgetResult: true,
+        supportsCuratedPluginDirectory: false,
+        supportsMcpToolPermissionRules: true,
         // `ultrathink` adds a deeper-reasoning reminder to the turn (effort is
         // untouched); `ultracode` opts it into the Workflow tool, on messages stamped
         // human — see `claudeMessageOrigin`.
@@ -21760,6 +22569,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "harness",
         modUi: false,
         supportsShortWidgetResult: true,
+        supportsCuratedPluginDirectory: true,
+        supportsMcpToolPermissionRules: false,
         promptKeywords: [],
         displayName: "Codex"
       },
@@ -21798,6 +22609,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "harness",
         modUi: false,
         supportsShortWidgetResult: false,
+        supportsCuratedPluginDirectory: false,
+        supportsMcpToolPermissionRules: false,
         promptKeywords: [],
         displayName: "Others"
       },
@@ -21820,6 +22633,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "harness",
         modUi: false,
         supportsShortWidgetResult: false,
+        supportsCuratedPluginDirectory: false,
+        supportsMcpToolPermissionRules: false,
         promptKeywords: [],
         displayName: "OpenCode"
       },
@@ -21844,6 +22659,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "executor",
         modUi: false,
         supportsShortWidgetResult: false,
+        supportsCuratedPluginDirectory: false,
+        supportsMcpToolPermissionRules: false,
         promptKeywords: [],
         displayName: "Cursor"
       },
@@ -21881,6 +22698,8 @@ var init_harness_capabilities = __esm({
         terminalCommandApproval: "harness",
         modUi: false,
         supportsShortWidgetResult: false,
+        supportsCuratedPluginDirectory: false,
+        supportsMcpToolPermissionRules: false,
         promptKeywords: [],
         displayName: "DeepSeek"
       }
@@ -32200,36 +33019,12 @@ var init_fuzzy = __esm({
   }
 });
 
-// ../../packages/runtime/src/fs/plugins-manage.ts
-import { execFile as execFile3, execFileSync as execFileSync2 } from "node:child_process";
-import {
-  cpSync,
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync9,
-  readdirSync as readdirSync6,
-  readFileSync as readFileSync11,
-  statSync as statSync5,
-  writeFileSync as writeFileSync8
-} from "node:fs";
-import { dirname as dirname10, join as join18, resolve as resolve9 } from "node:path";
+// ../../packages/runtime/src/fs/claude-settings-files.ts
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname10, join as join18 } from "node:path";
 import { homedir as osHomedir7 } from "node:os";
-function homeOf6(opts) {
-  return opts?.homeDir ?? osHomedir7();
-}
-function pluginsDir(opts) {
-  return join18(homeOf6(opts), ".claude", "plugins");
-}
-function installedFile(opts) {
-  return join18(pluginsDir(opts), "installed_plugins.json");
-}
-function marketplacesFile(opts) {
-  return join18(pluginsDir(opts), "known_marketplaces.json");
-}
-function installCountsFile(opts) {
-  return join18(pluginsDir(opts), "install-counts-cache.json");
-}
 function getUserSettingsPath(opts) {
-  return join18(homeOf6(opts), ".claude", "settings.json");
+  return join18(opts?.homeDir ?? osHomedir7(), ".claude", "settings.json");
 }
 function getProjectSettingsPath2(cwd) {
   return join18(cwd, ".claude", "settings.json");
@@ -32237,6 +33032,9 @@ function getProjectSettingsPath2(cwd) {
 function getLocalSettingsPath(cwd) {
   return join18(cwd, ".claude", "settings.local.json");
 }
+function settingsLayers(cwd, opts) {
+  return cwd ? [getUserSettingsPath(opts), getProjectSettingsPath2(cwd), getLocalSettingsPath(cwd)] : [getUserSettingsPath(opts)];
+}
 function readJsonObject(filePath) {
   if (!existsSync17(filePath)) return {};
   try {
@@ -32246,6 +33044,44 @@ function readJsonObject(filePath) {
     return {};
   }
 }
+function writeSettingsJson(filePath, data) {
+  mkdirSync9(dirname10(filePath), { recursive: true });
+  writeFileSync8(filePath, JSON.stringify(data, null, 2) + "\n");
+}
+var init_claude_settings_files = __esm({
+  "../../packages/runtime/src/fs/claude-settings-files.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/runtime/src/fs/plugins-manage.ts
+import { execFile as execFile3, execFileSync as execFileSync2 } from "node:child_process";
+import {
+  cpSync,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync10,
+  readdirSync as readdirSync6,
+  readFileSync as readFileSync12,
+  statSync as statSync5,
+  writeFileSync as writeFileSync9
+} from "node:fs";
+import { join as join19, resolve as resolve9 } from "node:path";
+import { homedir as osHomedir8 } from "node:os";
+function homeOf6(opts) {
+  return opts?.homeDir ?? osHomedir8();
+}
+function pluginsDir(opts) {
+  return join19(homeOf6(opts), ".claude", "plugins");
+}
+function installedFile(opts) {
+  return join19(pluginsDir(opts), "installed_plugins.json");
+}
+function marketplacesFile(opts) {
+  return join19(pluginsDir(opts), "known_marketplaces.json");
+}
+function installCountsFile(opts) {
+  return join19(pluginsDir(opts), "install-counts-cache.json");
+}
 function readExtraKnownMarketplaces(filePath) {
   const data = readJsonObject(filePath);
   const ek = data.extraKnownMarketplaces;
@@ -32267,12 +33103,8 @@ function getMarketplaceScopeMap(cwd, opts) {
   }
   return map2;
 }
-function writeSettingsJson(filePath, data) {
-  mkdirSync9(dirname10(filePath), { recursive: true });
-  writeFileSync8(filePath, JSON.stringify(data, null, 2) + "\n");
-}
 function removeMarketplaceFromSettings(filePath, name) {
-  if (!existsSync17(filePath)) return false;
+  if (!existsSync18(filePath)) return false;
   const data = readJsonObject(filePath);
   const ek = data.extraKnownMarketplaces;
   if (!ek || typeof ek !== "object" || Array.isArray(ek)) return false;
@@ -32286,18 +33118,18 @@ function removeMarketplaceFromSettings(filePath, name) {
   return true;
 }
 function readMarketplaceManifestPlugins(mpDir) {
-  const manifest = readJson2(join18(mpDir, ".claude-plugin", "marketplace.json"));
+  const manifest = readJson2(join19(mpDir, ".claude-plugin", "marketplace.json"));
   return Array.isArray(manifest?.plugins) ? manifest.plugins.filter((p3) => p3 && typeof p3.name === "string") : [];
 }
 function resolvePluginSourceDir(mpDir, name, source) {
   if (typeof source === "string" && source.trim()) {
     const rel = source.replace(/^\.\/?/, "");
-    const resolved = rel ? join18(mpDir, rel) : mpDir;
-    if (existsSync17(resolved)) return resolved;
+    const resolved = rel ? join19(mpDir, rel) : mpDir;
+    if (existsSync18(resolved)) return resolved;
   }
   for (const subDir of ["plugins", "external_plugins"]) {
-    const candidate = join18(mpDir, subDir, name);
-    if (existsSync17(candidate)) return candidate;
+    const candidate = join19(mpDir, subDir, name);
+    if (existsSync18(candidate)) return candidate;
   }
   return mpDir;
 }
@@ -32319,8 +33151,8 @@ function resolveMarketplaceScope(mpName, mpInfo, scopeMap) {
 }
 function readJson2(filePath) {
   try {
-    if (!existsSync17(filePath)) return null;
-    return JSON.parse(readFileSync11(filePath, "utf-8"));
+    if (!existsSync18(filePath)) return null;
+    return JSON.parse(readFileSync12(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -32328,16 +33160,16 @@ function readJson2(filePath) {
 function scanDir2(dirPath) {
   try {
     return readdirSync6(dirPath, { withFileTypes: true }).filter((e) => !e.name.startsWith(".")).sort((a, b3) => {
-      const aDir = a.isDirectory() || a.isSymbolicLink() && statSync5(join18(dirPath, a.name)).isDirectory();
-      const bDir = b3.isDirectory() || b3.isSymbolicLink() && statSync5(join18(dirPath, b3.name)).isDirectory();
+      const aDir = a.isDirectory() || a.isSymbolicLink() && statSync5(join19(dirPath, a.name)).isDirectory();
+      const bDir = b3.isDirectory() || b3.isSymbolicLink() && statSync5(join19(dirPath, b3.name)).isDirectory();
       if (aDir !== bDir) return aDir ? -1 : 1;
       return a.name.localeCompare(b3.name);
     }).map((e) => {
-      const isDir = e.isDirectory() || e.isSymbolicLink() && statSync5(join18(dirPath, e.name)).isDirectory();
+      const isDir = e.isDirectory() || e.isSymbolicLink() && statSync5(join19(dirPath, e.name)).isDirectory();
       return {
         name: e.name,
         isDirectory: isDir,
-        ...isDir ? { children: scanDir2(join18(dirPath, e.name)) } : {}
+        ...isDir ? { children: scanDir2(join19(dirPath, e.name)) } : {}
       };
     });
   } catch {
@@ -32345,25 +33177,25 @@ function scanDir2(dirPath) {
   }
 }
 function readPluginManifest(installPath) {
-  return readJson2(join18(installPath, ".claude-plugin", "plugin.json"));
+  return readJson2(join19(installPath, ".claude-plugin", "plugin.json"));
 }
 function detectPluginContents(installPath) {
   const modules = readHooksJson(installPath)?.modules;
   return {
-    hasCommands: existsSync17(join18(installPath, "commands")),
-    hasAgents: existsSync17(join18(installPath, "agents")),
-    hasSkills: existsSync17(join18(installPath, "skills")),
-    hasHooks: existsSync17(join18(installPath, "hooks")),
+    hasCommands: existsSync18(join19(installPath, "commands")),
+    hasAgents: existsSync18(join19(installPath, "agents")),
+    hasSkills: existsSync18(join19(installPath, "skills")),
+    hasHooks: existsSync18(join19(installPath, "hooks")),
     hasMod: Array.isArray(modules) && modules.length > 0,
-    hasMcpServers: existsSync17(join18(installPath, ".mcp.json"))
+    hasMcpServers: existsSync18(join19(installPath, ".mcp.json"))
   };
 }
 function readHooksJson(installPath) {
-  const candidates = [join18(installPath, "hooks", "hooks.json"), join18(installPath, "hooks.json")];
+  const candidates = [join19(installPath, "hooks", "hooks.json"), join19(installPath, "hooks.json")];
   for (const p3 of candidates) {
-    if (!existsSync17(p3)) continue;
+    if (!existsSync18(p3)) continue;
     try {
-      const raw = JSON.parse(readFileSync11(p3, "utf-8"));
+      const raw = JSON.parse(readFileSync12(p3, "utf-8"));
       if (raw && typeof raw === "object" && !Array.isArray(raw)) return raw;
     } catch {
     }
@@ -32376,10 +33208,10 @@ function readHookEvents(installPath) {
   return events;
 }
 function readMcpServersMap(installPath) {
-  const mcpPath = join18(installPath, ".mcp.json");
-  if (!existsSync17(mcpPath)) return {};
+  const mcpPath = join19(installPath, ".mcp.json");
+  if (!existsSync18(mcpPath)) return {};
   try {
-    const raw = JSON.parse(readFileSync11(mcpPath, "utf-8"));
+    const raw = JSON.parse(readFileSync12(mcpPath, "utf-8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
     const root = raw;
     const wrapped = root.mcpServers;
@@ -32400,7 +33232,7 @@ function getMarketplaceLocations(opts) {
   const marketplaces = readJson2(marketplacesFile(opts));
   if (!marketplaces) return locations2;
   for (const [name, info] of Object.entries(marketplaces)) {
-    if (!info.installLocation || !existsSync17(join18(info.installLocation, ".git"))) continue;
+    if (!info.installLocation || !existsSync18(join19(info.installLocation, ".git"))) continue;
     locations2.set(name, info.installLocation);
   }
   return locations2;
@@ -32419,13 +33251,13 @@ function getPluginLatestCommitSha(marketplaceDir, pluginName) {
   }
 }
 function getPluginNewVersion(mpDir, pluginName) {
-  const mpManifest = readJson2(join18(mpDir, ".claude-plugin", "marketplace.json"));
+  const mpManifest = readJson2(join19(mpDir, ".claude-plugin", "marketplace.json"));
   const mpEntry = mpManifest?.plugins?.find((p3) => p3.name === pluginName);
   if (mpEntry?.version) return mpEntry.version;
   const sourceDir = findPluginSourceDir(mpDir, pluginName);
   if (sourceDir) {
     const pluginManifest = readJson2(
-      join18(sourceDir, ".claude-plugin", "plugin.json")
+      join19(sourceDir, ".claude-plugin", "plugin.json")
     );
     if (pluginManifest?.version) return pluginManifest.version;
   }
@@ -32439,32 +33271,29 @@ function findPluginSourceDir(mpDir, pluginName) {
   const entry3 = readMarketplaceManifestPlugins(mpDir).find((p3) => p3.name === pluginName);
   if (entry3 && typeof entry3.source === "string" && entry3.source.trim()) {
     const rel = entry3.source.replace(/^\.\/?/, "");
-    const resolved = rel ? join18(mpDir, rel) : mpDir;
-    if (existsSync17(resolved)) return resolved;
+    const resolved = rel ? join19(mpDir, rel) : mpDir;
+    if (existsSync18(resolved)) return resolved;
   }
   for (const subDir of ["plugins", "external_plugins"]) {
-    const candidate = join18(mpDir, subDir, pluginName);
-    if (existsSync17(candidate)) return candidate;
+    const candidate = join19(mpDir, subDir, pluginName);
+    if (existsSync18(candidate)) return candidate;
   }
   return null;
 }
-function enabledPluginsSources(cwd, opts) {
-  return cwd ? [getUserSettingsPath(opts), getProjectSettingsPath2(cwd), getLocalSettingsPath(cwd)] : [getUserSettingsPath(opts)];
-}
 function enabledPluginsEntry(filePath, key) {
   const map2 = readJsonObject(filePath).enabledPlugins;
   return map2 && typeof map2 === "object" && !Array.isArray(map2) ? map2[key] : void 0;
 }
 function isPluginEnabled(cwd, key, defaultEnabled, opts) {
   let value;
-  for (const file2 of enabledPluginsSources(cwd, opts)) {
+  for (const file2 of settingsLayers(cwd, opts)) {
     const entry3 = enabledPluginsEntry(file2, key);
     if (entry3 !== void 0) value = entry3;
   }
   return value === void 0 ? defaultEnabled !== false : value === true || Array.isArray(value);
 }
 function setPluginEnabled(cwd, key, scope, enabled, opts) {
-  const sources = enabledPluginsSources(cwd, opts);
+  const sources = settingsLayers(cwd, opts);
   const deciding = [...sources].reverse().find((file2) => enabledPluginsEntry(file2, key) !== void 0);
   const target2 = deciding ?? (scope === "user" || !cwd ? getUserSettingsPath(opts) : getProjectSettingsPath2(cwd));
   const data = readJsonObject(target2);
@@ -32559,9 +33388,9 @@ function readPluginFile(cwd, pluginKey, relativePath, opts) {
     if (!isUser && !isProject) continue;
     const resolved = resolve9(entry3.installPath, relativePath);
     if (!isPathAtOrWithinAllowed(resolved, [entry3.installPath])) return null;
-    if (!existsSync17(resolved) || statSync5(resolved).isDirectory()) return null;
+    if (!existsSync18(resolved) || statSync5(resolved).isDirectory()) return null;
     try {
-      return readFileSync11(resolved, "utf-8");
+      return readFileSync12(resolved, "utf-8");
     } catch {
       return null;
     }
@@ -32578,7 +33407,7 @@ function deletePlugin(key, scope, cwd, opts) {
   if (data.plugins[key].length === 0) {
     delete data.plugins[key];
   }
-  writeFileSync8(installedFile(opts), JSON.stringify(data, null, 2), "utf-8");
+  writeFileSync9(installedFile(opts), JSON.stringify(data, null, 2), "utf-8");
 }
 function listMarketplacePlugins(cwd, opts) {
   const marketplaces = readJson2(marketplacesFile(opts));
@@ -32610,7 +33439,7 @@ function listMarketplacePlugins(cwd, opts) {
   const plugins = [];
   for (const [mpName, mpInfo] of Object.entries(marketplaces)) {
     const mpDir = mpInfo.installLocation;
-    if (!mpDir || !existsSync17(mpDir)) continue;
+    if (!mpDir || !existsSync18(mpDir)) continue;
     const marketplaceSource = marketplaceSourceLabel(mpInfo);
     const pushPlugin = (name, sourceDir, manifestEntry) => {
       const ownManifest = readPluginManifest(sourceDir);
@@ -32641,12 +33470,12 @@ function listMarketplacePlugins(cwd, opts) {
       continue;
     }
     for (const subDir of ["plugins", "external_plugins"]) {
-      const pluginsDirPath = join18(mpDir, subDir);
-      if (!existsSync17(pluginsDirPath)) continue;
+      const pluginsDirPath = join19(mpDir, subDir);
+      if (!existsSync18(pluginsDirPath)) continue;
       try {
         for (const entry3 of readdirSync6(pluginsDirPath, { withFileTypes: true })) {
           if (!entry3.isDirectory() && !entry3.isSymbolicLink()) continue;
-          const pluginDir = join18(pluginsDirPath, entry3.name);
+          const pluginDir = join19(pluginsDirPath, entry3.name);
           if (!readPluginManifest(pluginDir)) continue;
           pushPlugin(entry3.name, pluginDir);
         }
@@ -32700,9 +33529,9 @@ function updatePlugin(key, scope, cwd, opts) {
   if (!sourceDir) return;
   const newVersion = getPluginNewVersion(mpDir, name);
   if (!newVersion) return;
-  const cacheDir = join18(pluginsDir(opts), "cache", marketplace, name, newVersion);
-  if (!existsSync17(cacheDir)) {
-    mkdirSync9(cacheDir, { recursive: true });
+  const cacheDir = join19(pluginsDir(opts), "cache", marketplace, name, newVersion);
+  if (!existsSync18(cacheDir)) {
+    mkdirSync10(cacheDir, { recursive: true });
     cpSync(sourceDir, cacheDir, { recursive: true });
   }
   const latestSha = getPluginLatestCommitSha(mpDir, name);
@@ -32714,7 +33543,7 @@ function updatePlugin(key, scope, cwd, opts) {
     entry3.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
     if (latestSha) entry3.gitCommitSha = latestSha;
   }
-  writeFileSync8(installedFile(opts), JSON.stringify(data, null, 2), "utf-8");
+  writeFileSync9(installedFile(opts), JSON.stringify(data, null, 2), "utf-8");
 }
 function addMarketplace(source, scope, cwd) {
   return new Promise((resolvePromise, reject) => {
@@ -32757,7 +33586,7 @@ function removeMarketplace(name, scope, cwd, opts) {
 function readMarketplacePluginContent(marketplace, name, opts) {
   const marketplaces = readJson2(marketplacesFile(opts));
   const mpInfo = marketplaces?.[marketplace];
-  if (!mpInfo?.installLocation || !existsSync17(mpInfo.installLocation)) return null;
+  if (!mpInfo?.installLocation || !existsSync18(mpInfo.installLocation)) return null;
   const sourceDir = findPluginSourceDir(mpInfo.installLocation, name);
   if (!sourceDir) return null;
   const manifest = readPluginManifest(sourceDir);
@@ -32814,14 +33643,14 @@ function readMarketplacePluginContent(marketplace, name, opts) {
 function readMarketplacePluginFile(marketplace, name, relativePath, opts) {
   const marketplaces = readJson2(marketplacesFile(opts));
   const mpInfo = marketplaces?.[marketplace];
-  if (!mpInfo?.installLocation || !existsSync17(mpInfo.installLocation)) return null;
+  if (!mpInfo?.installLocation || !existsSync18(mpInfo.installLocation)) return null;
   const sourceDir = findPluginSourceDir(mpInfo.installLocation, name);
   if (!sourceDir) return null;
   const resolved = resolve9(sourceDir, relativePath);
   if (!isPathAtOrWithinAllowed(resolved, [sourceDir])) return null;
-  if (!existsSync17(resolved) || statSync5(resolved).isDirectory()) return null;
+  if (!existsSync18(resolved) || statSync5(resolved).isDirectory()) return null;
   try {
-    return readFileSync11(resolved, "utf-8");
+    return readFileSync12(resolved, "utf-8");
   } catch {
     return null;
   }
@@ -32830,6 +33659,7 @@ var init_plugins_manage = __esm({
   "../../packages/runtime/src/fs/plugins-manage.ts"() {
     "use strict";
     init_path_security();
+    init_claude_settings_files();
   }
 });
 
@@ -32840,38 +33670,20 @@ var init_plugin_review = __esm({
   }
 });
 
+// ../../packages/runtime/src/fs/mcp-tool-permissions-claude.ts
+var init_mcp_tool_permissions_claude = __esm({
+  "../../packages/runtime/src/fs/mcp-tool-permissions-claude.ts"() {
+    "use strict";
+    init_tool_ui();
+    init_claude_settings_files();
+  }
+});
+
 // ../../packages/runtime/src/fs/hooks-config.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname11, join as join19 } from "node:path";
-import { homedir as osHomedir8 } from "node:os";
-function homeOf7(opts) {
-  return opts?.homeDir ?? osHomedir8();
-}
-function getUserSettingsPath2(opts) {
-  return join19(homeOf7(opts), ".claude", "settings.json");
-}
-function getProjectSettingsPath3(cwd) {
-  return join19(cwd, ".claude", "settings.json");
-}
-function getLocalSettingsPath2(cwd) {
-  return join19(cwd, ".claude", "settings.local.json");
-}
 function pathFor(scope, cwd, opts) {
-  if (scope === "user") return getUserSettingsPath2(opts);
-  if (scope === "project") return getProjectSettingsPath3(cwd);
-  return getLocalSettingsPath2(cwd);
-}
-function readJsonFile2(filePath) {
-  if (!existsSync18(filePath)) return {};
-  try {
-    return JSON.parse(readFileSync12(filePath, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function writeJsonFile2(filePath, data) {
-  mkdirSync10(dirname11(filePath), { recursive: true });
-  writeFileSync9(filePath, JSON.stringify(data, null, 2));
+  if (scope === "user") return getUserSettingsPath(opts);
+  if (scope === "project") return getProjectSettingsPath2(cwd);
+  return getLocalSettingsPath(cwd);
 }
 function getHooksMap(data) {
   const h = data.hooks;
@@ -32895,7 +33707,7 @@ function listHooks(cwd, opts) {
   const result3 = [];
   const scopes = ["user", "project", "local"];
   for (const scope of scopes) {
-    const data = readJsonFile2(pathFor(scope, cwd, opts));
+    const data = readJsonObject(pathFor(scope, cwd, opts));
     const hooks = getHooksMap(data);
     for (const event of Object.keys(hooks)) {
       const groups = hooks[event] ?? [];
@@ -32920,7 +33732,7 @@ function saveHook(cwd, payload, replaceId, opts) {
     deleteHook(cwd, replaceId, opts);
   }
   const filePath = pathFor(payload.scope, cwd, opts);
-  const data = readJsonFile2(filePath);
+  const data = readJsonObject(filePath);
   if (!data.hooks || typeof data.hooks !== "object" || Array.isArray(data.hooks)) {
     data.hooks = {};
   }
@@ -32937,14 +33749,14 @@ function saveHook(cwd, payload, replaceId, opts) {
   }
   if (!Array.isArray(group.hooks)) group.hooks = [];
   group.hooks.push(payload.entry);
-  writeJsonFile2(filePath, data);
+  writeSettingsJson(filePath, data);
 }
 function deleteHook(cwd, id, opts) {
   const parsed = parseId(id);
   if (!parsed) return;
   const { scope, event, gIdx, eIdx } = parsed;
   const filePath = pathFor(scope, cwd, opts);
-  const data = readJsonFile2(filePath);
+  const data = readJsonObject(filePath);
   const hooks = getHooksMap(data);
   const groups = hooks[event];
   if (!Array.isArray(groups) || !groups[gIdx]) return;
@@ -32958,11 +33770,12 @@ function deleteHook(cwd, id, opts) {
   } else {
     data.hooks = hooks;
   }
-  writeJsonFile2(filePath, data);
+  writeSettingsJson(filePath, data);
 }
 var init_hooks_config = __esm({
   "../../packages/runtime/src/fs/hooks-config.ts"() {
     "use strict";
+    init_claude_settings_files();
   }
 });
 
@@ -32979,6 +33792,7 @@ var init_fs = __esm({
     init_fuzzy();
     init_plugins_manage();
     init_plugin_review();
+    init_mcp_tool_permissions_claude();
     init_hooks_config();
     init_agents_discover();
   }
@@ -33437,7 +34251,7 @@ function codexKeychainAccount(home) {
   }
   return `cli|${createHash7("sha256").update(canonical).digest("hex").slice(0, 16)}`;
 }
-function readLogin(home) {
+function readCodexLogin(home = codexHome()) {
   const file2 = join25(home, "auth.json");
   if (existsSync23(file2)) {
     const login = loginFrom(readFileSync17(file2, "utf8"));
@@ -33478,7 +34292,7 @@ function parseCodexUsage(body, nowSeconds = Math.floor(Date.now() / 1e3)) {
 }
 async function readCodexRateLimits(opts = {}) {
   const home = opts.home ?? codexHome();
-  const login = readLogin(home);
+  const login = readCodexLogin(home);
   if (!login) return { value: null };
   const fingerprint = createHash7("sha256").update(login.accessToken).digest("hex");
   return throttle2.read(home, fingerprint, opts.force === true, async () => {
@@ -33557,7 +34371,7 @@ function keychainToken() {
     return null;
   }
 }
-function readLogin2(open2, statePath) {
+function readLogin(open2, statePath) {
   if (process.platform !== "darwin") return null;
   const fromApp = existsSync24(statePath) ? stateValue(open2, statePath, "cursorAuth/accessToken") : null;
   const accessToken = fromApp ?? keychainToken();
@@ -33592,7 +34406,7 @@ function parseCursorUsage(body, membership) {
 }
 async function readCursorRateLimits(open2, opts = {}) {
   const statePath = opts.statePath ?? cursorStateDbPath();
-  const login = readLogin2(open2, statePath);
+  const login = readLogin(open2, statePath);
   if (!login) return { value: null };
   const expiresAt = jwtExpiresAtMs(login.accessToken);
   if (expiresAt !== null && expiresAt <= Date.now()) return { value: null, error: "Cursor login expired. Open Cursor or run `cursor-agent login`." };
@@ -36149,6 +36963,20 @@ var init_codex_usage_cache = __esm({
   }
 });
 
+// ../../packages/codex/src/plugin-target.ts
+function buildCodexPluginRequestParams(plugin) {
+  if (plugin.marketplacePath) {
+    return { marketplacePath: plugin.marketplacePath, pluginName: plugin.name };
+  }
+  if (!plugin.remotePluginId) throw new Error(`Missing remote ID for Codex plugin: ${plugin.name}`);
+  return { remoteMarketplaceName: plugin.marketplace, pluginName: plugin.remotePluginId };
+}
+var init_plugin_target = __esm({
+  "../../packages/codex/src/plugin-target.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/codex/src/codex-admin.ts
 import { randomUUID as randomUUID9 } from "node:crypto";
 function normalizeApiKey(value) {
@@ -36476,7 +37304,7 @@ async function listPluginInventory(client3, projectPath) {
     if (!marketplace) continue;
     const marketplaceName = readString5(marketplace.name);
     const marketplacePath = readString5(marketplace.path);
-    if (!marketplaceName || !marketplacePath) continue;
+    if (!marketplaceName) continue;
     const plugins = Array.isArray(marketplace.plugins) ? marketplace.plugins : [];
     for (const rawPlugin of plugins) {
       const plugin = asRecord10(rawPlugin);
@@ -36491,6 +37319,7 @@ async function listPluginInventory(client3, projectPath) {
         name,
         marketplace: marketplaceName,
         marketplacePath,
+        remotePluginId: readString5(plugin.remotePluginId) ?? void 0,
         sourcePath,
         installed: readBoolean2(plugin.installed) ?? false,
         enabled: readBoolean2(plugin.enabled) ?? false
@@ -36499,8 +37328,8 @@ async function listPluginInventory(client3, projectPath) {
   }
   return records2;
 }
-async function installPlugin2(client3, marketplacePath, pluginName) {
-  await client3.request("plugin/install", { marketplacePath, pluginName });
+async function installPlugin2(client3, plugin) {
+  await client3.request("plugin/install", buildCodexPluginRequestParams(plugin));
 }
 async function uninstallPlugin(client3, pluginId) {
   await client3.request("plugin/uninstall", { pluginId });
@@ -36558,6 +37387,7 @@ var init_codex_admin = __esm({
     init_app_server_client();
     init_subscription_usage3();
     init_codex_usage_cache();
+    init_plugin_target();
     rateLimitThrottle = new UsageThrottle(USAGE_POLL_MS);
     accountUsageThrottle = new UsageThrottle(USAGE_POLL_MS);
   }
@@ -45851,7 +46681,7 @@ var init_managed_official = __esm({
   "../../packages/runtime/src/harness/managed-official.ts"() {
     "use strict";
     init_managed_layout();
-    OFFICIAL_CLAUDE_SDK_VERSION = "0.3.300";
+    OFFICIAL_CLAUDE_SDK_VERSION = "0.3.302";
     OFFICIAL_CODEX_NPM_VERSION = "0.163.0";
     OFFICIAL_CODEX_PACKAGE = "@openai/codex";
   }
@@ -88903,7 +89733,7 @@ var init_codex_admin_service = __esm({
           const records2 = await listPluginInventory(client3, path);
           const record12 = records2.find((r) => r.key === key);
           if (!record12) throw new Error(`Unknown Codex plugin: ${key}`);
-          await installPlugin2(client3, record12.marketplacePath, record12.name);
+          await installPlugin2(client3, record12);
         });
       }
       async uninstallPlugin(projectId, key, apiProviderId) {