@symerian/symi 2.6.36 → 2.6.38

package/dist/{status-CwhHbhUv.js → status-D9uWA9pU.js}

@@ -8,8 +8,8 @@ import { n as runExec } from "./exec-CBKBIMpA.js";
 import { c as resolveAgentWorkspaceDir } from "./agent-scope-D-jRCY0d.js";
 import { t as buildWorkspaceSkillStatus } from "./skills-status-DKXJ-tbi.js";
 import { H as VERSION, i as loadConfig, o as readConfigFileSnapshot } from "./config-DHBLS1Hl.js";
-import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-BcE47FtD.js";
-import { En as peekSystemEvents, St as summarizeRestartSentinel, cn as buildChannelAccountSnapshot, in as formatUsageReportLines, ln as formatChannelAllowFrom, nt as sha256HexPrefix, rn as loadProviderUsageSummary, sn as buildChannelSummary, xt as readRestartSentinel } from "./subagent-registry-BXI3DyAX.js";
+import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-DIDhYlsx.js";
+import { En as peekSystemEvents, St as summarizeRestartSentinel, cn as buildChannelAccountSnapshot, in as formatUsageReportLines, ln as formatChannelAllowFrom, nt as sha256HexPrefix, rn as loadProviderUsageSummary, sn as buildChannelSummary, xt as readRestartSentinel } from "./subagent-registry-aZczbtLM.js";
 import { F as resolveMainSessionKey, j as resolveFreshSessionTotalTokens, o as loadSessionStore } from "./sessions-CJXnZVjR.js";
 import { n as listChannelPlugins } from "./plugins-CwSlLxM8.js";
 import { o as getTailnetHostname, s as readTailscaleStatusJson } from "./tailscale-CbbvYNVw.js";
@@ -21,15 +21,15 @@ import { l as resolveSessionModelRef, n as classifySessionKey, r as listAgentsFo
 import { o as getRemoteSkillEligibility } from "./skill-commands-C8BcwE33.js";
 import { r as formatDurationPrecise } from "./format-duration-BOC0O2XQ.js";
 import { n as withProgress } from "./progress-BAHiAaDW.js";
-import { C as normalizeControlUiBasePath, g as resolveControlUiLinks } from "./onboard-helpers-_pit1NZW.js";
+import { C as normalizeControlUiBasePath, g as resolveControlUiLinks } from "./onboard-helpers-DASpwgat.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-cLP5YLeQ.js";
 import { t as collectChannelStatusIssues } from "./channels-status-issues-c7qZbYG5.js";
 import { s as resolveGatewayLogPaths, t as resolveGatewayService } from "./service-Cm9j9WzQ.js";
 import { t as formatRuntimeStatusWithDetails } from "./runtime-status-hFVEC3wO.js";
 import { t as readLastGatewayErrorLine } from "./diagnostics-CS1ov_hH.js";
 import { t as renderTable } from "./table-D01d2GuY.js";
-import { a as resolveGatewayProbeAuth$1, c as probeGateway, t as runSecurityAudit } from "./audit-Byo5jCLN.js";
-import { o as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-BNxdveY8.js";
+import { a as resolveGatewayProbeAuth$1, c as probeGateway, t as runSecurityAudit } from "./audit-Cgd5-Y7W.js";
+import { o as resolveHeartbeatSummaryForAgent, t as formatHealthChannelLines } from "./health-NTpZ8ssG.js";
 import { g as resolveUpdateChannelDisplay, i as formatGitInstallLabel, m as normalizeUpdateChannel, t as checkUpdateStatus } from "./update-check-ZdimP1aU.js";
 import { t as resolveNodeService } from "./node-service-fcZExd22.js";
 import { n as redactSecrets, t as formatGatewayAuthUsed } from "./format-DVLB9DNB.js";

package/dist/{status.update-DtwCUTf-.js → status.update-DP0OFqyb.js}

@@ -1,7 +1,7 @@
 import { t as resolveSymiPackageRoot } from "./symi-root-CrGJbkzf.js";
 import { t as formatCliCommand } from "./command-format-COaS-S7B.js";
 import { H as VERSION } from "./config-CHwyw6l5.js";
-import { n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-CtckACbb.js";
+import { n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-7EzEjSzb.js";
 
 //#region src/commands/status.update.ts
 async function getUpdateCheckResult(params) {

package/dist/{subagent-registry-BXI3DyAX.js → subagent-registry-aZczbtLM.js}

@@ -8,14 +8,15 @@ import { a as logError, i as logDebug, n as runExec, o as logInfo, r as spawnWit
 import { C as ensureAgentWorkspace, E as loadWorkspaceBootstrapFiles, a as resolveAgentModelFallbacksOverride, c as resolveAgentWorkspaceDir, d as resolveSessionAgentId, f as resolveSessionAgentIds, g as DEFAULT_IDENTITY_FILENAME, h as DEFAULT_BOOTSTRAP_FILENAME, i as resolveAgentDir, l as resolveDefaultAgentId, m as DEFAULT_AGENT_WORKSPACE_DIR, n as listAgentIds, o as resolveAgentModelPrimary, r as resolveAgentConfig, s as resolveAgentSkillsFilter, u as resolveEffectiveModelFallbacks, w as filterBootstrapFilesForSession } from "./agent-scope-D-jRCY0d.js";
 import { a as saveJsonFile, i as loadJsonFile } from "./github-copilot-token-DuFIqfeC.js";
 import { n as recordCommandPoll, r as resetCommandPollCount } from "./command-poll-backoff-anX686I1.js";
+import { t as ensurePiAuthJsonFromAuthProfiles } from "./pi-auth-json-LXkL5WS_.js";
 import { a as buildModelAliasLines, n as resolveModel } from "./model-DiCH8rkE.js";
 import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-Do3xMEtM.js";
 import { r as isPathInsideWithRealpath } from "./scan-paths-ppKrtZ9U.js";
 import { a as resolveSkillsPromptForRun, d as resolveSandboxInputPath, h as applySkillEnvOverridesFromSnapshot, i as loadWorkspaceSkillEntries, l as assertMediaNotDataUrl, m as applySkillEnvOverrides, p as resolveSandboxedMediaSource, r as buildWorkspaceSkillSnapshot, u as assertSandboxPath } from "./skills-hAdgFdrv.js";
 import { a as safeStatSync, c as applyTestPluginDefaults, d as resolveEnableState, f as resolveMemorySlotDecision, h as isDangerousHostEnvVarName, i as isPathInside, n as loadPluginManifestRegistry, r as discoverSymiPlugins, u as normalizePluginsConfig } from "./manifest-registry-Czr39pxG.js";
 import { A as parseConfigPath, B as resolveAgentMaxConcurrent, C as parseDurationMs, D as setConfigOverride, E as resetConfigOverrides, H as VERSION, M as unsetConfigValueAtPath, O as unsetConfigOverride, T as getConfigOverrides, _ as isInboundPathAllowed, b as resolveIMessageRemoteAttachmentRoots, c as resolveConfigSnapshotHash, h as resolveTelegramCustomCommands, i as loadConfig, j as setConfigValueAtPath, k as getConfigValueAtPath, l as writeConfigFile, m as normalizeTelegramCommandName, o as readConfigFileSnapshot, p as TELEGRAM_COMMAND_NAME_PATTERN, u as validateConfigObjectWithPlugins, w as validateJsonSchemaValue, x as normalizeScpRemoteHost, y as resolveIMessageAttachmentRoots, z as DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH } from "./config-DHBLS1Hl.js";
-import { Mt as SESSION_LABEL_MAX_LENGTH, t as GatewayClient } from "./client-DMBZpU6X.js";
-import { a as randomIdempotencyKey, d as resolveLeastPrivilegeOperatorScopesForMethod, n as callGateway, r as callGatewayLeastPrivilege, t as buildGatewayConnectionDetails } from "./call-BcE47FtD.js";
+import { Nt as SESSION_LABEL_MAX_LENGTH, t as GatewayClient } from "./client-T3qcxXru.js";
+import { a as randomIdempotencyKey, d as resolveLeastPrivilegeOperatorScopesForMethod, n as callGateway, r as callGatewayLeastPrivilege, t as buildGatewayConnectionDetails } from "./call-DIDhYlsx.js";
 import { a as isInternalMessageChannel, c as listDeliverableMessageChannels, d as resolveMessageChannel, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, o as isMarkdownCapableMessageChannel, p as GATEWAY_CLIENT_IDS, t as INTERNAL_MESSAGE_CHANNEL, u as resolveGatewayMessageChannel } from "./message-channel-C9dERklz.js";
 import { i as normalizeInputProvenance, n as applyInputProvenanceToUserMessage, r as hasInterSessionUserProvenance } from "./input-provenance-D0lNkCf6.js";
 import { A as DEFAULT_RESET_TRIGGERS, B as resolveGroupSessionKey, D as resolveSessionResetPolicy, E as resolveChannelResetConfig, F as resolveMainSessionKey, G as deliveryContextKey, J as normalizeSessionDeliveryFields, K as mergeDeliveryContext, L as deriveSessionMetaPatch, O as resolveSessionResetType, P as resolveExplicitAgentSessionKey, T as evaluateSessionFreshness, U as resolveSessionLockMaxHoldFromTimeout, V as acquireSessionWriteLock, W as deliveryContextFromSession, Y as normalizeAccountId$3, _ as capArrayByJsonBytes, a as resolveAndPersistSessionFile, c as recordSessionMetaFromInbound, d as updateSessionStore, f as updateSessionStoreEntry, g as archiveSessionTranscripts, j as resolveFreshSessionTotalTokens, k as resolveThreadFlag, m as resolveCacheTtlMs$1, n as parseSessionThreadInfo, o as loadSessionStore, p as isCacheEnabled, q as normalizeDeliveryContext, r as appendAssistantMessageToSessionTranscript, s as readSessionUpdatedAt, t as extractDeliveryInfo, u as updateLastRoute, w as resolveSessionKey } from "./sessions-CJXnZVjR.js";
@@ -66,8 +67,8 @@ import { _ as stripMinimaxToolCallXml, a as decodeDataUrl, b as extractTextFromC
 import { n as resolveToolDisplay } from "./tool-display-CXwOC-qw.js";
 import { n as formatTimeAgo } from "./format-relative-DX-rh76l.js";
 import { r as normalizeInboundTextNewlines, t as finalizeInboundContext } from "./inbound-context-72dOKfLG.js";
-import { _ as applyTemplate, a as resolveMediaAttachmentLocalRoots, c as resolveAttachmentKind, d as registerUnhandledRejectionHandler, f as resolveConcurrency, g as CLI_OUTPUT_MAX_BUFFER, h as resolveMediaUnderstandingScope, i as resolveAutoImageModel, l as buildRandomTempFilePath, m as normalizeMediaUnderstandingChatType, n as createMediaAttachmentCache, o as runCapability, p as resolveTimeoutMs, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-BORIO-D3.js";
-import { n as loadModelCatalog, r as modelSupportsVision, t as findModelInCatalog } from "./model-catalog-CqCsARJX.js";
+import { _ as applyTemplate, a as resolveMediaAttachmentLocalRoots, c as resolveAttachmentKind, d as registerUnhandledRejectionHandler, f as resolveConcurrency, g as CLI_OUTPUT_MAX_BUFFER, h as resolveMediaUnderstandingScope, i as resolveAutoImageModel, l as buildRandomTempFilePath, m as normalizeMediaUnderstandingChatType, n as createMediaAttachmentCache, o as runCapability, p as resolveTimeoutMs, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-CW9KEL7W.js";
+import { n as loadModelCatalog, r as modelSupportsVision, t as findModelInCatalog } from "./model-catalog-Bn0ffe1O.js";
 import { a as loadCombinedSessionStoreForGateway, u as lookupContextTokens } from "./session-utils-Bka9dR4m.js";
 import { b as ensureSkillsWatcher, i as resolveSkillCommandInvocation, n as listSkillCommandsForAgents, o as getRemoteSkillEligibility, r as listSkillCommandsForWorkspace, t as listReservedChatSlashCommandNames, x as getSkillsSnapshotVersion } from "./skill-commands-C8BcwE33.js";
 import { i as readChannelAllowFromStore, l as listPairingChannels, o as removeChannelAllowFromStoreEntry, s as upsertChannelPairingRequest, t as addChannelAllowFromStoreEntry } from "./pairing-store-vpO8vXVN.js";
@@ -91,7 +92,7 @@ import { n as resolveAgentRoute, t as buildAgentSessionKey } from "./resolve-rou
 import { t as parseTimeoutMs } from "./parse-timeout-zNJBr1fY.js";
 import { t as makeProxyFetch } from "./proxy-DL3MD6-P.js";
 import { a as createReplyReferencePlanner, i as resolveSlackThreadTs, n as deliverReplies$3, t as createSlackReplyDeliveryPlan } from "./replies-DO80zq73.js";
-import { r as detectBinary } from "./onboard-helpers-_pit1NZW.js";
+import { r as detectBinary } from "./onboard-helpers-DASpwgat.js";
 import { t as resolvePairingIdLabel } from "./pairing-labels-D1HDboV2.js";
 import { t as getActiveWebListener } from "./active-listener-De1JhR4W.js";
 import { a as resolveSubagentToolPolicy, i as resolveGroupToolPolicy, n as isToolAllowedByPolicies, r as resolveEffectiveToolPolicy, t as filterToolsByPolicy } from "./pi-tools.policy-De00gPXt.js";
@@ -40565,6 +40566,7 @@ async function runEmbeddedPiAgent(params) {
 		const agentDir = params.agentDir ?? resolveSymiAgentDir();
 		const fallbackConfigured = (params.config?.agents?.defaults?.model?.fallbacks?.length ?? 0) > 0;
 		await ensureSymiModelsJson(params.config, agentDir);
+		await ensurePiAuthJsonFromAuthProfiles(agentDir, { config: params.config });
 		let modelResolveOverride;
 		const hookRunner = getGlobalHookRunner();
 		const hookCtx = {
@@ -49331,7 +49333,7 @@ async function preflightDiscordMessage(params) {
 	let preflightTranscript;
 	const hasAudioAttachment = message.attachments?.some((att) => att.contentType?.startsWith("audio/"));
 	if (!isDirectMessage && shouldRequireMention && hasAudioAttachment && !baseText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-xSDULLAj.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-BuT_gIRW.js");
 		const audioPaths = message.attachments?.filter((att) => att.contentType?.startsWith("audio/")).map((att) => att.url) ?? [];
 		if (audioPaths.length > 0) preflightTranscript = await transcribeFirstAudio({
 			ctx: {
@@ -53114,7 +53116,7 @@ function isVoiceChannelType(type) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-Dr9gUjHz.js");
+			const { sendMessageWhatsApp } = await import("./web-DPki9fDa.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
@@ -66262,7 +66264,7 @@ const buildTelegramMessageContext = async ({ primaryCtx, allMedia, storeAllowFro
 	const hasAudio = allMedia.some((media) => media.contentType?.startsWith("audio/"));
 	let preflightTranscript;
 	if (isGroup && requireMention && hasAudio && !hasUserText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-xSDULLAj.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-BuT_gIRW.js");
 		preflightTranscript = await transcribeFirstAudio({
 			ctx: {
 				MediaPaths: allMedia.length > 0 ? allMedia.map((m) => m.path) : void 0,
@@ -68428,7 +68430,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-Dr9gUjHz.js");
+	webChannelPromise ??= import("./web-DPki9fDa.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {

package/dist/{system-cli-UMsMEurS.js → system-cli-BXewgTZR.js}

@@ -4,129 +4,20 @@ import "./registry-Cja8eT7G.js";
 import { f as defaultRuntime } from "./subsystem-D9vIQve0.js";
 import "./exec-CWkblSrI.js";
 import "./agent-scope-CgUHAtCo.js";
-import { At as ensureAuthProfileStore, l as normalizeProviderId } from "./model-selection-CyFvYcRt.js";
+import "./model-selection-CyFvYcRt.js";
 import "./github-copilot-token-DAu1a6BX.js";
 import "./boolean-BsqeuxE6.js";
 import "./env-DPCHYPeH.js";
 import "./message-channel-aT-I_DTX.js";
 import "./config-CHwyw6l5.js";
 import "./manifest-registry-C4BxOMWX.js";
-import "./client-CQSyCS4M.js";
-import "./call-CJaS1iRF.js";
+import "./client-jI1oE0_k.js";
+import "./call-CFhGTNtt.js";
 import "./pairing-token-CX3NN_qj.js";
 import { t as formatDocsLink } from "./links-3i1eUga4.js";
 import "./progress-jIePzvGA.js";
-import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-BxkKeCZ0.js";
-import path from "node:path";
-import fs from "node:fs/promises";
+import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-DiTk_nOl.js";
 
-//#region src/agents/pi-auth-json.ts
-async function readAuthJson(filePath) {
-	try {
-		const raw = await fs.readFile(filePath, "utf8");
-		const parsed = JSON.parse(raw);
-		if (!parsed || typeof parsed !== "object") return {};
-		return parsed;
-	} catch {
-		return {};
-	}
-}
-/**
-* Convert an Symi auth-profiles credential to pi-coding-agent auth.json format.
-* Returns null if the credential cannot be converted.
-*/
-function convertCredential(cred) {
-	if (cred.type === "api_key") {
-		const key = typeof cred.key === "string" ? cred.key.trim() : "";
-		if (!key) return null;
-		return {
-			type: "api_key",
-			key
-		};
-	}
-	if (cred.type === "token") {
-		const token = typeof cred.token === "string" ? cred.token.trim() : "";
-		if (!token) return null;
-		const expires = typeof cred.expires === "number" ? cred.expires : NaN;
-		if (Number.isFinite(expires) && expires > 0 && Date.now() >= expires) return null;
-		return {
-			type: "api_key",
-			key: token
-		};
-	}
-	if (cred.type === "oauth") {
-		const accessRaw = cred.access;
-		const refreshRaw = cred.refresh;
-		const expiresRaw = cred.expires;
-		const access = typeof accessRaw === "string" ? accessRaw.trim() : "";
-		const refresh = typeof refreshRaw === "string" ? refreshRaw.trim() : "";
-		const expires = typeof expiresRaw === "number" ? expiresRaw : NaN;
-		if (!access || !refresh || !Number.isFinite(expires) || expires <= 0) return null;
-		return {
-			type: "oauth",
-			access,
-			refresh,
-			expires
-		};
-	}
-	return null;
-}
-/**
-* Check if two auth.json credentials are equivalent.
-*/
-function credentialsEqual(a, b) {
-	if (!a || typeof a !== "object") return false;
-	if (a.type !== b.type) return false;
-	if (a.type === "api_key" && b.type === "api_key") return a.key === b.key;
-	if (a.type === "oauth" && b.type === "oauth") return a.access === b.access && a.refresh === b.refresh && a.expires === b.expires;
-	return false;
-}
-/**
-* pi-coding-agent's ModelRegistry/AuthStorage expects credentials in auth.json.
-*
-* Symi stores credentials in auth-profiles.json instead. This helper
-* bridges all credentials into agentDir/auth.json so pi-coding-agent can
-* (a) consider providers authenticated and (b) include built-in models in its
-* registry/catalog output.
-*
-* Syncs all credential types: api_key, token (as api_key), and oauth.
-*/
-async function ensurePiAuthJsonFromAuthProfiles(agentDir) {
-	const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
-	const authPath = path.join(agentDir, "auth.json");
-	const providerCredentials = /* @__PURE__ */ new Map();
-	for (const [, cred] of Object.entries(store.profiles)) {
-		const provider = normalizeProviderId(String(cred.provider ?? "")).trim();
-		if (!provider || providerCredentials.has(provider)) continue;
-		const converted = convertCredential(cred);
-		if (converted) providerCredentials.set(provider, converted);
-	}
-	if (providerCredentials.size === 0) return {
-		wrote: false,
-		authPath
-	};
-	const existing = await readAuthJson(authPath);
-	let changed = false;
-	for (const [provider, cred] of providerCredentials) if (!credentialsEqual(existing[provider], cred)) {
-		existing[provider] = cred;
-		changed = true;
-	}
-	if (!changed) return {
-		wrote: false,
-		authPath
-	};
-	await fs.mkdir(agentDir, {
-		recursive: true,
-		mode: 448
-	});
-	await fs.writeFile(authPath, `${JSON.stringify(existing, null, 2)}\n`, { mode: 384 });
-	return {
-		wrote: true,
-		authPath
-	};
-}
-
-//#endregion
 //#region src/cli/system-cli.ts
 const normalizeWakeMode = (raw) => {
 	const mode = typeof raw === "string" ? raw.trim() : "";
@@ -191,4 +82,4 @@ function registerSystemCli(program) {
 }
 
 //#endregion
-export { registerSystemCli, ensurePiAuthJsonFromAuthProfiles as t };
+export { registerSystemCli };

package/dist/{system-cli-D_EIZpBm.js → system-cli-CECNjZdB.js}

@@ -5,13 +5,13 @@ import "./agent-scope-D-jRCY0d.js";
 import "./github-copilot-token-DuFIqfeC.js";
 import "./manifest-registry-Czr39pxG.js";
 import "./config-DHBLS1Hl.js";
-import "./client-DMBZpU6X.js";
-import "./call-BcE47FtD.js";
+import "./client-T3qcxXru.js";
+import "./call-DIDhYlsx.js";
 import "./message-channel-C9dERklz.js";
 import "./pairing-token-Byh6drgn.js";
 import { t as formatDocsLink } from "./links-DlWpl9Yv.js";
 import "./progress-BAHiAaDW.js";
-import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-DfZSz5JF.js";
+import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-BkB6xEaM.js";
 
 //#region src/cli/system-cli.ts
 const normalizeWakeMode = (raw) => {

package/dist/system-run-command-B_qw8CXP.js

@@ -0,0 +1,93 @@
+import path from "node:path";
+
+//#region src/infra/system-run-command.ts
+function basenameLower(token) {
+	const win = path.win32.basename(token);
+	const posix = path.posix.basename(token);
+	return (win.length < posix.length ? win : posix).trim().toLowerCase();
+}
+function formatExecCommand(argv) {
+	return argv.map((arg) => {
+		const trimmed = arg.trim();
+		if (!trimmed) return "\"\"";
+		if (!/\s|"/.test(trimmed)) return trimmed;
+		return `"${trimmed.replace(/"/g, "\\\"")}"`;
+	}).join(" ");
+}
+function extractShellCommandFromArgv(argv) {
+	const token0 = argv[0]?.trim();
+	if (!token0) return null;
+	const base0 = basenameLower(token0);
+	if (base0 === "sh" || base0 === "bash" || base0 === "zsh" || base0 === "dash" || base0 === "ksh") {
+		const flag = argv[1]?.trim();
+		if (flag !== "-lc" && flag !== "-c") return null;
+		const cmd = argv[2];
+		return typeof cmd === "string" ? cmd : null;
+	}
+	if (base0 === "cmd.exe" || base0 === "cmd") {
+		const idx = argv.findIndex((item) => String(item).trim().toLowerCase() === "/c");
+		if (idx === -1) return null;
+		const tail = argv.slice(idx + 1).map((item) => String(item));
+		if (tail.length === 0) return null;
+		const cmd = tail.join(" ").trim();
+		return cmd.length > 0 ? cmd : null;
+	}
+	return null;
+}
+function validateSystemRunCommandConsistency(params) {
+	const raw = typeof params.rawCommand === "string" && params.rawCommand.trim().length > 0 ? params.rawCommand.trim() : null;
+	const shellCommand = extractShellCommandFromArgv(params.argv);
+	const inferred = shellCommand !== null ? shellCommand.trim() : formatExecCommand(params.argv);
+	if (raw && raw !== inferred) return {
+		ok: false,
+		message: "INVALID_REQUEST: rawCommand does not match command",
+		details: {
+			code: "RAW_COMMAND_MISMATCH",
+			rawCommand: raw,
+			inferred
+		}
+	};
+	return {
+		ok: true,
+		shellCommand: shellCommand !== null ? raw ?? shellCommand : null,
+		cmdText: raw ?? shellCommand ?? inferred
+	};
+}
+function resolveSystemRunCommand(params) {
+	const raw = typeof params.rawCommand === "string" && params.rawCommand.trim().length > 0 ? params.rawCommand.trim() : null;
+	const command = Array.isArray(params.command) ? params.command : [];
+	if (command.length === 0) {
+		if (raw) return {
+			ok: false,
+			message: "rawCommand requires params.command",
+			details: { code: "MISSING_COMMAND" }
+		};
+		return {
+			ok: true,
+			argv: [],
+			rawCommand: null,
+			shellCommand: null,
+			cmdText: ""
+		};
+	}
+	const argv = command.map((v) => String(v));
+	const validation = validateSystemRunCommandConsistency({
+		argv,
+		rawCommand: raw
+	});
+	if (!validation.ok) return {
+		ok: false,
+		message: validation.message,
+		details: validation.details ?? { code: "RAW_COMMAND_MISMATCH" }
+	};
+	return {
+		ok: true,
+		argv,
+		rawCommand: raw,
+		shellCommand: validation.shellCommand,
+		cmdText: validation.cmdText
+	};
+}
+
+//#endregion
+export { resolveSystemRunCommand as t };

package/dist/{systemd-riq8uNJQ.js → systemd-DT6SbCim.js}

@@ -1,6 +1,6 @@
 import { B as theme, R as colorize, z as isRich } from "./utils-B-0b9bGM.js";
 import { n as runExec, t as runCommandWithTimeout } from "./exec-CWkblSrI.js";
-import { d as resolveGatewaySystemdServiceName, l as resolveGatewayProfileSuffix, u as resolveGatewayServiceDescription } from "./constants-C8_BLnaW.js";
+import { d as resolveGatewaySystemdServiceName, l as resolveGatewayProfileSuffix, u as resolveGatewayServiceDescription } from "./constants-CafH8-8D.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/{systemd-hints-BR6gChwm.js → systemd-hints-DZH9qY5W.js}

@@ -1,8 +1,8 @@
 import { t as formatCliCommand } from "./command-format-COaS-S7B.js";
-import { d as isVersionManagedNodePath, h as resolveSystemNodePath, l as getMinimalServicePathPartsFromEnv, u as isSystemNodePath } from "./daemon-runtime-2mwX-jqj.js";
-import { o as resolveSystemdUserUnitPath } from "./systemd-riq8uNJQ.js";
-import { c as resolveLaunchAgentPlistPath } from "./service-Cl74hx8J.js";
-import { t as formatRuntimeStatusWithDetails } from "./runtime-status-CR9445g5.js";
+import { d as isVersionManagedNodePath, h as resolveSystemNodePath, l as getMinimalServicePathPartsFromEnv, u as isSystemNodePath } from "./daemon-runtime-COZ4usfy.js";
+import { o as resolveSystemdUserUnitPath } from "./systemd-DT6SbCim.js";
+import { c as resolveLaunchAgentPlistPath } from "./service-osK70kTZ.js";
+import { t as formatRuntimeStatusWithDetails } from "./runtime-status-D6c3G7my.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 

package/dist/{systemd-linger-aQ75ZlXY.js → systemd-linger-DCskIKcx.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { t as note } from "./note-DeHoW7xO.js";
-import { d as readSystemdUserLingerStatus, r as isSystemdUserServiceAvailable, u as enableSystemdUserLinger } from "./systemd-riq8uNJQ.js";
+import { t as note } from "./note-DQ9BvHF2.js";
+import { d as readSystemdUserLingerStatus, r as isSystemdUserServiceAvailable, u as enableSystemdUserLinger } from "./systemd-DT6SbCim.js";
 
 //#region src/commands/systemd-linger.ts
 var systemd_linger_exports = /* @__PURE__ */ __exportAll({

package/dist/{tables-qMwbq29u.js → tables-BuM4FKR3.js}

@@ -1,5 +1,5 @@
-import { r as markdownToIRWithMeta } from "./ir-CTiz95Vb.js";
-import { t as renderMarkdownWithMarkers } from "./render-CDCvpfhh.js";
+import { r as markdownToIRWithMeta } from "./ir-JAy_3A3B.js";
+import { t as renderMarkdownWithMarkers } from "./render-DwEu-aCr.js";
 
 //#region src/markdown/tables.ts
 const MARKDOWN_STYLE_MARKERS = {

package/dist/{tui-BJB80muc.js → tui-2nWOvxxE.js}

@@ -2,8 +2,8 @@ import { h as visibleWidth, m as stripAnsi } from "./entry.js";
 import { S as parseAgentSessionKey, c as normalizeMainKey, r as buildAgentMainSessionKey, s as normalizeAgentId } from "./session-key-DjZ7Z1hW.js";
 import { l as resolveDefaultAgentId } from "./agent-scope-D-jRCY0d.js";
 import { H as VERSION, i as loadConfig } from "./config-DHBLS1Hl.js";
-import { kt as PROTOCOL_VERSION, t as GatewayClient } from "./client-DMBZpU6X.js";
-import { i as ensureExplicitGatewayAuth, o as resolveExplicitGatewayAuth, t as buildGatewayConnectionDetails } from "./call-BcE47FtD.js";
+import { At as PROTOCOL_VERSION, t as GatewayClient } from "./client-T3qcxXru.js";
+import { i as ensureExplicitGatewayAuth, o as resolveExplicitGatewayAuth, t as buildGatewayConnectionDetails } from "./call-DIDhYlsx.js";
 import { f as GATEWAY_CLIENT_CAPS, h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-C9dERklz.js";
 import { C as stripLeadingInboundMetadata } from "./sessions-CJXnZVjR.js";
 import { _ as formatRawAssistantErrorForUi } from "./pi-embedded-helpers-DE9h5GAu.js";

package/dist/{tui-CriznorL.js → tui-DLaU7tTx.js}

@@ -4,14 +4,14 @@ import { l as stripAnsi, u as visibleWidth } from "./subsystem-D9vIQve0.js";
 import { l as resolveDefaultAgentId } from "./agent-scope-CgUHAtCo.js";
 import { f as GATEWAY_CLIENT_CAPS, h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-aT-I_DTX.js";
 import { H as VERSION, i as loadConfig } from "./config-CHwyw6l5.js";
-import { _ as formatRawAssistantErrorForUi } from "./pi-embedded-helpers-CNPyv_ax.js";
+import { _ as formatRawAssistantErrorForUi } from "./pi-embedded-helpers-BuVSLhG_.js";
 import { k as stripLeadingInboundMetadata } from "./sessions-DgYpBvse.js";
 import { n as resolveToolDisplay, t as formatToolDetail } from "./tool-display-D8N3rsYt.js";
 import { a as listChatCommandsForConfig, i as listChatCommands } from "./commands-registry-BT0-zzs3.js";
-import { kt as PROTOCOL_VERSION, t as GatewayClient } from "./client-CQSyCS4M.js";
-import { i as ensureExplicitGatewayAuth, o as resolveExplicitGatewayAuth, t as buildGatewayConnectionDetails } from "./call-CJaS1iRF.js";
+import { At as PROTOCOL_VERSION, t as GatewayClient } from "./client-jI1oE0_k.js";
+import { i as ensureExplicitGatewayAuth, o as resolveExplicitGatewayAuth, t as buildGatewayConnectionDetails } from "./call-CFhGTNtt.js";
 import { n as formatTimeAgo, t as formatRelativeTimestamp } from "./format-relative-BXoxEQVN.js";
-import { n as formatTokenCount } from "./usage-format-BzKEDn0q.js";
+import { n as formatTokenCount } from "./usage-format-BgUx3Bm4.js";
 import chalk from "chalk";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";

package/dist/{tui-cli-C7Q9lK8Q.js → tui-cli-B-Nl_8uj.js}

@@ -7,8 +7,8 @@ import "./frontmatter-B8duUx_6.js";
 import "./skills-hAdgFdrv.js";
 import "./manifest-registry-Czr39pxG.js";
 import "./config-DHBLS1Hl.js";
-import "./client-DMBZpU6X.js";
-import "./call-BcE47FtD.js";
+import "./client-T3qcxXru.js";
+import "./call-DIDhYlsx.js";
 import "./message-channel-C9dERklz.js";
 import "./pairing-token-Byh6drgn.js";
 import "./sessions-CJXnZVjR.js";
@@ -43,7 +43,7 @@ import "./commands-registry-D1K_inhv.js";
 import "./tool-display-CXwOC-qw.js";
 import { t as parseTimeoutMs } from "./parse-timeout-zNJBr1fY.js";
 import { t as formatDocsLink } from "./links-DlWpl9Yv.js";
-import { t as runTui } from "./tui-BJB80muc.js";
+import { t as runTui } from "./tui-2nWOvxxE.js";
 
 //#region src/cli/tui-cli.ts
 function registerTuiCli(program) {

package/dist/{tui-cli-CSIdfCTR.js → tui-cli-D-PVUsS5.js}

@@ -12,15 +12,15 @@ import "./env-DPCHYPeH.js";
 import "./message-channel-aT-I_DTX.js";
 import "./config-CHwyw6l5.js";
 import "./manifest-registry-C4BxOMWX.js";
-import "./pi-embedded-helpers-CNPyv_ax.js";
-import "./sandbox-C-T6hOMv.js";
+import "./pi-embedded-helpers-BuVSLhG_.js";
+import "./sandbox-DAOxwUQm.js";
 import "./chrome-DtPkPq9T.js";
 import "./tailscale-D5dKabOc.js";
 import "./auth-B741uFtk.js";
-import "./server-context-CEpFjqSk.js";
+import "./server-context-CHYWo_TC.js";
 import "./frontmatter-DWQhtOo7.js";
 import "./skills-6jdJQ5ZL.js";
-import "./routes-Ba9CUQ8M.js";
+import "./routes-B1-BfEDm.js";
 import "./redact-f-Q-hFt_.js";
 import "./errors-BF3TeRH2.js";
 import "./fs-safe-CUjO1ca2.js";
@@ -43,12 +43,12 @@ import "./tool-images-DvUBlqjX.js";
 import "./tool-display-D8N3rsYt.js";
 import "./commands-BNLCWX6e.js";
 import "./commands-registry-BT0-zzs3.js";
-import "./client-CQSyCS4M.js";
-import "./call-CJaS1iRF.js";
+import "./client-jI1oE0_k.js";
+import "./call-CFhGTNtt.js";
 import "./pairing-token-CX3NN_qj.js";
 import { t as formatDocsLink } from "./links-3i1eUga4.js";
-import { t as parseTimeoutMs } from "./parse-timeout-C385GCpE.js";
-import { t as runTui } from "./tui-CriznorL.js";
+import { t as parseTimeoutMs } from "./parse-timeout-2S5vp0-9.js";
+import { t as runTui } from "./tui-DLaU7tTx.js";
 
 //#region src/cli/tui-cli.ts
 function registerTuiCli(program) {