@threadbase-sh/streamer 1.29.1 → 1.30.0

package/dist/cli.cjs

@@ -26158,7 +26158,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter6 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join26 } = require("path");
+    var { join: join28 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -26209,7 +26209,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join26(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join28(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -26675,9 +26675,9 @@ var require_transport = __commonJS({
   "node_modules/pino/lib/transport.js"(exports2, module2) {
     "use strict";
     var { createRequire } = require("module");
-    var { existsSync: existsSync12 } = require("fs");
+    var { existsSync: existsSync13 } = require("fs");
     var getCallers = require_caller();
-    var { join: join26, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
+    var { join: join28, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
     var { fileURLToPath: fileURLToPath3 } = require("url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -26749,7 +26749,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute3(path2) && !existsSync12(path2);
+      return isAbsolute3(path2) && !existsSync13(path2);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -26830,7 +26830,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join26(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join28(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -26848,7 +26848,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join26(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join28(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -26871,7 +26871,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join26(__dirname, "..", "file.js");
+          return join28(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -27852,7 +27852,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join26 = ",";
+            let join28 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -27866,7 +27866,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join26 = `,
+                join28 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27874,13 +27874,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join26;
+                res += join28;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join28}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -27901,7 +27901,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join26 = `,
+              join28 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -27915,13 +27915,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join26;
+                separator = join28;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join26;
+              separator = join28;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -27962,7 +27962,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join26 = ",";
+            let join28 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -27975,7 +27975,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join26 = `,
+                join28 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27983,13 +27983,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join26;
+                res += join28;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join28}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -28002,7 +28002,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join26 = `,
+              join28 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -28011,7 +28011,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join26;
+                separator = join28;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -28069,20 +28069,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join27 = `,
+              const join29 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join27;
+                res2 += join29;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join27}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join29}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -28098,16 +28098,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join26 = `,
+            const join28 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join26, maximumBreadth);
+              res += stringifyTypedArray(value, join28, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join26;
+              separator = join28;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -28118,13 +28118,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join26;
+                separator = join28;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join26;
+              separator = join28;
             }
             if (separator !== "") {
               res = `
@@ -35847,17 +35847,17 @@ var require_logger = __commonJS({
        * Some optimizations are performed to avoid creating unnecessary objects and to keep runtime
        * overhead associated with resolving metadata as low as possible.
        */
-      static compose(logger2, metaOrFunc) {
-        if (logger2 instanceof _LoggerWithComposedMetadata) {
-          const contributors = appendToChain(logger2.contributors, metaOrFunc);
+      static compose(logger3, metaOrFunc) {
+        if (logger3 instanceof _LoggerWithComposedMetadata) {
+          const contributors = appendToChain(logger3.contributors, metaOrFunc);
           if (contributors === void 0)
-            return logger2;
-          return new _LoggerWithComposedMetadata(logger2.parentLogger, contributors);
+            return logger3;
+          return new _LoggerWithComposedMetadata(logger3.parentLogger, contributors);
         } else {
           const contributors = appendToChain(void 0, metaOrFunc);
           if (contributors === void 0)
-            return logger2;
-          return new _LoggerWithComposedMetadata(logger2, contributors);
+            return logger3;
+          return new _LoggerWithComposedMetadata(logger3, contributors);
         }
       }
       constructor(parentLogger, contributors) {
@@ -36938,8 +36938,8 @@ var require_logging = __commonJS({
       return _logger;
     };
     exports2.getLogger = getLogger3;
-    var setLogger = (logger2) => {
-      _logger = logger2;
+    var setLogger = (logger3) => {
+      _logger = logger3;
     };
     exports2.setLogger = setLogger;
     var setLoggerVerbosity = (verbosity) => {
@@ -60048,8 +60048,8 @@ var require_src3 = __commonJS({
       throw new Error("Not available in this library. Use @grpc/proto-loader and loadPackageDefinition instead");
     };
     exports2.load = load;
-    var setLogger = (logger2) => {
-      logging.setLogger(logger2);
+    var setLogger = (logger3) => {
+      logging.setLogger(logger3);
     };
     exports2.setLogger = setLogger;
     var setLogVerbosity = (verbosity) => {
@@ -100406,11 +100406,11 @@ var require_out = __commonJS({
       async.read(path2, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports2.stat = stat10;
-    function statSync10(path2, optionsOrSettings) {
+    function statSync11(path2, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path2, settings);
     }
-    exports2.statSync = statSync10;
+    exports2.statSync = statSync11;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -123538,8 +123538,8 @@ function darwinPlistPath() {
   return `${process.env.HOME}/Library/LaunchAgents/${resolveLoadedLabel()}.plist`;
 }
 function getLogPaths() {
-  const dir = (0, import_node_path24.join)(installDir(), "logs");
-  return { stdout: (0, import_node_path24.join)(dir, "stdout.log"), stderr: (0, import_node_path24.join)(dir, "stderr.log") };
+  const dir = (0, import_node_path25.join)(installDir(), "logs");
+  return { stdout: (0, import_node_path25.join)(dir, "stdout.log"), stderr: (0, import_node_path25.join)(dir, "stderr.log") };
 }
 function getAgentPid() {
   try {
@@ -123559,12 +123559,12 @@ function getAgentPid() {
     return null;
   }
 }
-var import_node_child_process4, import_node_path24, BREW_LAUNCHD_LABEL2;
+var import_node_child_process4, import_node_path25, BREW_LAUNCHD_LABEL2;
 var init_launchd = __esm({
   "src/lifecycle/launchd.ts"() {
     "use strict";
     import_node_child_process4 = require("child_process");
-    import_node_path24 = require("path");
+    import_node_path25 = require("path");
     init_constants();
     BREW_LAUNCHD_LABEL2 = "homebrew.mxcl.tb-streamer";
   }
@@ -123589,9 +123589,9 @@ var init_marker_schema = __esm({
 
 // src/lifecycle/marker.ts
 function readMarker() {
-  if (!(0, import_node_fs20.existsSync)(markerPath())) return null;
+  if (!(0, import_node_fs21.existsSync)(markerPath())) return null;
   try {
-    const raw2 = (0, import_node_fs20.readFileSync)(markerPath(), "utf8");
+    const raw2 = (0, import_node_fs21.readFileSync)(markerPath(), "utf8");
     const parsed = JSON.parse(raw2);
     return MarkerSchema.parse(parsed);
   } catch (err) {
@@ -123603,21 +123603,21 @@ function readMarker() {
 }
 function writeMarker(marker) {
   MarkerSchema.parse(marker);
-  (0, import_node_fs20.mkdirSync)((0, import_node_path25.dirname)(markerPath()), { recursive: true });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path26.dirname)(markerPath()), { recursive: true });
   const tmp = `${markerPath()}.tmp`;
-  (0, import_node_fs20.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
+  (0, import_node_fs21.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs20.renameSync)(tmp, markerPath());
+  (0, import_node_fs21.renameSync)(tmp, markerPath());
 }
 function clearMarker() {
-  if ((0, import_node_fs20.existsSync)(markerPath())) (0, import_node_fs20.rmSync)(markerPath());
+  if ((0, import_node_fs21.existsSync)(markerPath())) (0, import_node_fs21.rmSync)(markerPath());
 }
-var import_node_fs20, import_node_path25, log3;
+var import_node_fs21, import_node_path26, log3;
 var init_marker = __esm({
   "src/lifecycle/marker.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_path25 = require("path");
+    import_node_fs21 = require("fs");
+    import_node_path26 = require("path");
     init_logger();
     init_constants();
     init_marker_schema();
@@ -123818,9 +123818,9 @@ The supervised prod streamer is already holding port ${prodPort}.
 // src/lifecycle/prefs.ts
 function readPrefs() {
   const path2 = prefsPath();
-  if (!(0, import_node_fs22.existsSync)(path2)) return { repos: {} };
+  if (!(0, import_node_fs23.existsSync)(path2)) return { repos: {} };
   try {
-    return PrefsSchema.parse(JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")));
+    return PrefsSchema.parse(JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8")));
   } catch (err) {
     log5.warn(`prefs at ${path2} are malformed; treating as empty`, {
       error: err instanceof Error ? err.message : String(err)
@@ -123830,11 +123830,11 @@ function readPrefs() {
 }
 function savePrefs(p2) {
   const path2 = prefsPath();
-  (0, import_node_fs22.mkdirSync)((0, import_node_path26.dirname)(path2), { recursive: true });
+  (0, import_node_fs23.mkdirSync)((0, import_node_path27.dirname)(path2), { recursive: true });
   const tmp = `${path2}.tmp`;
-  (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
+  (0, import_node_fs23.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs22.renameSync)(tmp, path2);
+  (0, import_node_fs23.renameSync)(tmp, path2);
 }
 function writePrefForRepo(repoToplevel, choice) {
   const p2 = readPrefs();
@@ -123855,14 +123855,14 @@ function forgetRepo(repoToplevel) {
 }
 function forgetAll() {
   const path2 = prefsPath();
-  if ((0, import_node_fs22.existsSync)(path2)) (0, import_node_fs22.rmSync)(path2);
+  if ((0, import_node_fs23.existsSync)(path2)) (0, import_node_fs23.rmSync)(path2);
 }
-var import_node_fs22, import_node_path26, log5, PrefsSchema;
+var import_node_fs23, import_node_path27, log5, PrefsSchema;
 var init_prefs = __esm({
   "src/lifecycle/prefs.ts"() {
     "use strict";
-    import_node_fs22 = require("fs");
-    import_node_path26 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path27 = require("path");
     init_zod();
     init_logger();
     init_constants();
@@ -130754,9 +130754,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname17 = sysPath.dirname(file2);
+    const dirname18 = sysPath.dirname(file2);
     const basename12 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname17);
+    const parent = this.fsw._getWatchedDir(dirname18);
     let prevStats = stats;
     if (parent.has(basename12))
       return;
@@ -130783,7 +130783,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname17, basename12);
+          this.fsw._remove(dirname18, basename12);
         }
       } else if (parent.has(basename12)) {
         const at2 = newStats.atimeMs;
@@ -134993,11 +134993,11 @@ async function search(query, options, scanner) {
 
 // src/server.ts
 var import_events3 = require("events");
-var import_fs25 = require("fs");
+var import_fs26 = require("fs");
 var import_promises19 = require("fs/promises");
 var import_http = require("http");
-var import_os10 = require("os");
-var import_path22 = require("path");
+var import_os11 = require("os");
+var import_path23 = require("path");
 var import_readline4 = require("readline");
 
 // src/agent/agent-client.ts
@@ -137480,7 +137480,8 @@ function isLocalRequest(remoteAddr) {
   const addr = remoteAddr ?? "";
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var PUBLIC_PATHS = /* @__PURE__ */ new Set(["/healthz"]);
+var PUBLIC_PATHS = /* @__PURE__ */ new Set(["/healthz", "/ws"]);
+var LOCAL_ONLY_PATHS = /* @__PURE__ */ new Set(["/api/logs", "/api/logs/meta"]);
 var PUBLIC_POST_PATHS = /* @__PURE__ */ new Set(["/api/pair/exchange", "/api/__update"]);
 var PUBLIC_POST_PREFIXES = ["/internal/sessions/"];
 var authMiddleware = (deps) => async (c, next) => {
@@ -137491,8 +137492,12 @@ var authMiddleware = (deps) => async (c, next) => {
     await next();
     return;
   }
+  const remoteAddr = c.env.incoming?.socket?.remoteAddress;
+  if (LOCAL_ONLY_PATHS.has(path2) && isLocalRequest(remoteAddr)) {
+    await next();
+    return;
+  }
   if (deps.localNoAuth) {
-    const remoteAddr = c.env.incoming?.socket?.remoteAddress;
     if (isLocalRequest(remoteAddr)) {
       await next();
       return;
@@ -137659,6 +137664,126 @@ var createHealthRoutes = () => {
   return app;
 };
 
+// src/api/routes/logs.routes.ts
+var import_node_fs6 = require("fs");
+var import_node_path9 = require("path");
+init_constants();
+init_logger();
+var logger2 = getLogger("logs-api");
+function resolveLogPath(source) {
+  return (0, import_node_path9.join)(installDir(), "logs", `${source}.log`);
+}
+function pickDefaultSource() {
+  for (const source of ["stdout", "stderr", "dev"]) {
+    const p2 = resolveLogPath(source);
+    if ((0, import_node_fs6.existsSync)(p2) && (0, import_node_fs6.statSync)(p2).size > 0) return source;
+  }
+  return "stdout";
+}
+function readLogLines(filePath, sinceOffset, limit) {
+  if (!(0, import_node_fs6.existsSync)(filePath)) {
+    return { lines: [], offset: 0, total: 0 };
+  }
+  const fd = (0, import_node_fs6.openSync)(filePath, "r");
+  try {
+    const { size } = (0, import_node_fs6.fstatSync)(fd);
+    if (size === 0) return { lines: [], offset: 0, total: 0 };
+    const maxBytes = Math.min(size, 2 * 1024 * 1024);
+    const start = size - maxBytes;
+    const buf = Buffer.alloc(maxBytes);
+    (0, import_node_fs6.readSync)(fd, buf, 0, maxBytes, start);
+    let text = buf.toString("utf8");
+    if (start > 0) {
+      const firstNl = text.indexOf("\n");
+      if (firstNl >= 0) text = text.slice(firstNl + 1);
+    }
+    const allLines = text.split("\n").filter((line) => line.trim() && !line.startsWith("==="));
+    let lines;
+    let newOffset;
+    if (sinceOffset > 0 && sinceOffset < allLines.length) {
+      lines = allLines.slice(sinceOffset, sinceOffset + limit);
+      newOffset = sinceOffset + lines.length;
+    } else if (sinceOffset >= allLines.length && sinceOffset > 0) {
+      lines = [];
+      newOffset = allLines.length;
+    } else {
+      lines = allLines.slice(-limit);
+      newOffset = allLines.length;
+    }
+    return { lines, offset: newOffset, total: allLines.length };
+  } finally {
+    (0, import_node_fs6.closeSync)(fd);
+  }
+}
+function createLogsRoutes() {
+  const app = new Hono2();
+  app.get("/", (c) => {
+    try {
+      const sourceParam = (c.req.query("source") || "").toLowerCase();
+      const source = sourceParam === "stdout" || sourceParam === "stderr" || sourceParam === "dev" ? sourceParam : pickDefaultSource();
+      const logPath = resolveLogPath(source);
+      const sinceOffset = parseInt(c.req.query("since") || "0", 10);
+      const limit = Math.min(parseInt(c.req.query("limit") || "100", 10) || 100, 1e3);
+      if (!(0, import_node_fs6.existsSync)(logPath)) {
+        return c.json({
+          logs: [],
+          message: `No log file found for source=${source}`,
+          offset: 0,
+          total: 0,
+          source
+        });
+      }
+      const { lines, offset, total } = readLogLines(logPath, sinceOffset, limit);
+      const stats = (0, import_node_fs6.statSync)(logPath);
+      return c.json({
+        logs: lines,
+        offset,
+        total,
+        hasMore: offset < total,
+        source,
+        fileSize: stats.size,
+        fileModified: stats.mtime.toISOString()
+      });
+    } catch (error51) {
+      logger2.error("Failed to read logs", { error: String(error51) });
+      return c.json(
+        {
+          error: "Failed to read logs",
+          logs: [],
+          offset: 0,
+          total: 0
+        },
+        500
+      );
+    }
+  });
+  app.get("/meta", (c) => {
+    try {
+      const sources = ["stdout", "stderr", "dev"].map((source) => {
+        const logPath = resolveLogPath(source);
+        if (!(0, import_node_fs6.existsSync)(logPath)) {
+          return { source, exists: false, total: 0, fileSize: 0 };
+        }
+        const stats = (0, import_node_fs6.statSync)(logPath);
+        return {
+          source,
+          exists: true,
+          fileSize: stats.size,
+          fileModified: stats.mtime.toISOString()
+        };
+      });
+      return c.json({
+        defaultSource: pickDefaultSource(),
+        sources
+      });
+    } catch (error51) {
+      logger2.error("Failed to read log metadata", { error: String(error51) });
+      return c.json({ error: "Failed to read log metadata", exists: false }, 500);
+    }
+  });
+  return app;
+}
+
 // src/api/routes/misc.routes.ts
 var import_node_child_process2 = require("child_process");
 var import_node_crypto = require("crypto");
@@ -137810,7 +137935,7 @@ function verifySignature(rawBody, signature, secret) {
   }
 }
 function isWithinSkew(timestampHeader, skewSeconds) {
-  if (!timestampHeader) return true;
+  if (!timestampHeader) return false;
   const t = Number(timestampHeader);
   if (!Number.isFinite(t)) return false;
   const now = Math.floor(Date.now() / 1e3);
@@ -138021,18 +138146,21 @@ var createSessionRoutes = (deps) => {
 };
 
 // src/api/routes/ws.routes.ts
+init_auth();
 var createWsRoutes = (deps, upgradeWebSocket) => {
   const app = new Hono2();
   app.get(
     "/ws",
-    upgradeWebSocket(() => {
+    upgradeWebSocket((c) => {
+      const key = c.req.query("key");
+      const preAuthed = typeof key === "string" && validateApiKey(key, deps.apiKey);
       let openWs = null;
       return {
         onOpen(_evt, ws2) {
           const raw2 = ws2.raw;
           if (!raw2) return;
           openWs = raw2;
-          deps.handleWsOpen(raw2);
+          deps.handleWsOpen(raw2, preAuthed);
         },
         onMessage(evt, _ws) {
           if (openWs) deps.handleWsMessage(openWs, evt.data);
@@ -138077,6 +138205,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
   app.route("/api", createBrowseRoutes(deps));
   app.route("/", createScannerRoutes(deps));
   app.route("/internal", createProgressRoutes(deps));
+  app.route("/api/logs", createLogsRoutes());
   if (upgradeWebSocket) {
     app.route("/", createWsRoutes(deps, upgradeWebSocket));
   }
@@ -139738,13 +139867,13 @@ function handleListProjects(url2, res) {
 }
 
 // src/live-session-manager.ts
-var import_path19 = require("path");
+var import_path20 = require("path");
 
 // src/codex-pty-runner.ts
 var import_headless = __toESM(require_xterm_headless(), 1);
 var import_crypto7 = require("crypto");
-var import_fs21 = require("fs");
-var import_path17 = require("path");
+var import_fs22 = require("fs");
+var import_path18 = require("path");
 init_logger();
 
 // src/platform.ts
@@ -139870,6 +139999,69 @@ function resolveCodexExe() {
   return _codexExe;
 }
 
+// src/services/questions/codexGateAnswers.ts
+var import_fs21 = require("fs");
+var import_os9 = require("os");
+var import_path17 = require("path");
+function gateAnswersPath() {
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path17.join)((0, import_os9.homedir)(), ".threadbase");
+  return (0, import_path17.join)(dir, "gate-answers.json");
+}
+function loadGateAnswers() {
+  try {
+    const parsed = JSON.parse((0, import_fs21.readFileSync)(gateAnswersPath(), "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function saveGateAnswer(key, value) {
+  const path2 = gateAnswersPath();
+  (0, import_fs21.mkdirSync)((0, import_path17.dirname)(path2), { recursive: true });
+  (0, import_fs21.writeFileSync)(path2, `${JSON.stringify({ ...loadGateAnswers(), [key]: value }, null, 2)}
+`);
+}
+function rememberedGateDigit(gate) {
+  const answers = loadGateAnswers();
+  if (gate === "hooks") {
+    if (answers.codexHooksGate === "trust_all") return "2";
+    if (answers.codexHooksGate === "continue_untrusted") return "3";
+    return null;
+  }
+  return answers.codexTrustGate === "yes" ? "1" : null;
+}
+
+// src/utils/debounce.ts
+function debounce(fn, waitMs) {
+  let timer = null;
+  let lastArgs = null;
+  const run2 = () => {
+    timer = null;
+    if (lastArgs) {
+      const args = lastArgs;
+      lastArgs = null;
+      fn(...args);
+    }
+  };
+  const debounced = (...args) => {
+    lastArgs = args;
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(run2, waitMs);
+  };
+  debounced.cancel = () => {
+    if (timer) clearTimeout(timer);
+    timer = null;
+    lastArgs = null;
+  };
+  debounced.flush = () => {
+    if (timer) {
+      clearTimeout(timer);
+      run2();
+    }
+  };
+  return debounced;
+}
+
 // src/codex-pty-runner.ts
 var OUTPUT_BUFFER_MAX = 65536;
 var PTY_COLS = 120;
@@ -139877,6 +140069,9 @@ var PTY_ROWS = 40;
 var SCREEN_SCROLLBACK = 1e3;
 var CODEX_PROMPT_READY_TEXT = "Ready";
 var CODEX_TRUST_GATE_REGEX = /trust the contents/i;
+var CODEX_HOOKS_GATE_REGEX = /hooks need review/i;
+var QUIET_DETECT_MS = 500;
+var CODEX_READY_FALLBACK_MS = 8e3;
 var SUBMIT_BYTES = "\r";
 var CODEX_SUBMIT_DELAY_MS = 16;
 function digestBytes(s3) {
@@ -139884,6 +140079,40 @@ function digestBytes(s3) {
   if (escaped.length <= 200) return escaped;
   return `${escaped.slice(0, 100)}\u2026[${escaped.length - 200}B omitted]\u2026${escaped.slice(-100)}`;
 }
+function gateCard(gate, lines) {
+  if (gate === "hooks") {
+    const countLine = lines.find((l) => /new or changed/i.test(l))?.trim();
+    return {
+      prompt: [
+        "Hooks need review",
+        countLine,
+        "Hooks can run outside the sandbox after you trust them."
+      ].filter(Boolean).join(" \u2014 "),
+      options: [
+        { index: 2, label: "Trust all and continue", answerKeys: "2\r" },
+        { index: 3, label: "Continue without trusting (hooks won't run)", answerKeys: "3\r" },
+        {
+          index: 4,
+          label: "Trust all and continue (remember for all projects)",
+          answerKeys: "4\r"
+        },
+        {
+          index: 5,
+          label: "Continue without trusting (remember for all projects)",
+          answerKeys: "5\r"
+        }
+      ]
+    };
+  }
+  return {
+    prompt: lines.find((l) => CODEX_TRUST_GATE_REGEX.test(l))?.trim() ?? "Do you trust the contents of this directory?",
+    options: [
+      { index: 1, label: "Yes, continue", answerKeys: "1\r" },
+      { index: 2, label: "No, quit", answerKeys: "2\r" },
+      { index: 3, label: "Yes, continue (remember for all projects)", answerKeys: "3\r" }
+    ]
+  };
+}
 var pty = null;
 async function loadPty() {
   if (pty) return pty;
@@ -139910,8 +140139,8 @@ var CodexPtyRunner = class {
   onOutput;
   onStatusChange;
   onReady;
-  // Accepted for shape-compatibility with PTYManagerOptions; Codex has no
-  // detected equivalent yet (Phase 0) — never invoked.
+  // Broadcasts Codex's blocking startup gates (directory trust, hooks review)
+  // as question cards; null dismisses the card once the gate leaves the screen.
   onPermissionChange;
   onLiveQuestion;
   onLiveQuestionGone;
@@ -139922,8 +140151,18 @@ var CodexPtyRunner = class {
   // Inputs received via sendInput() while the session was still pendingReady.
   // Flushed in arrival order once Codex reaches Ready.
   queuedInputs = /* @__PURE__ */ new Map();
-  // Per-session debounce so the directory-trust gate's \r is only written once.
-  trustGateAnswered = /* @__PURE__ */ new Set();
+  // Gate currently on a session's screen (card broadcast, unanswered). While
+  // set, queued-input flushes are held — a flushed digit would CONFIRM a
+  // dialog option — and sendKeys() intercepts remember-variant digits.
+  openGate = /* @__PURE__ */ new Map();
+  // `${sessionId}:${gate}` once a gate has been actioned (auto-answered or
+  // card broadcast) — dedupes repaints of the same dialog.
+  gateActioned = /* @__PURE__ */ new Set();
+  // Per-session trailing debounce re-armed on every chunk; on quiet, re-runs
+  // screen detection so a blocked/truncated boot still reaches ready.
+  quietCheckers = /* @__PURE__ */ new Map();
+  // Per-session flat backstop from spawn (CODEX_READY_FALLBACK_MS).
+  readyFallbackTimers = /* @__PURE__ */ new Map();
   // In-flight start()/startFresh() calls keyed by sessionId. A second
   // concurrent resume for the same session (double-tap, client retry) awaits
   // the first call's promise instead of spawning a duplicate PTY (CRITICAL #3).
@@ -139953,7 +140192,7 @@ var CodexPtyRunner = class {
   }
   async doStart(sessionId, options) {
     const nodePty = await loadPty();
-    const projectName = options.projectName ?? (0, import_path17.basename)(options.projectPath);
+    const projectName = options.projectName ?? (0, import_path18.basename)(options.projectPath);
     const proc = nodePty.spawn(
       resolveCodexExe(),
       ["resume", sessionId, "--cd", options.projectPath, "--no-alt-screen"],
@@ -139982,6 +140221,7 @@ var CodexPtyRunner = class {
     };
     this.sessions.set(sessionId, session);
     this.pendingReady.add(sessionId);
+    this.armReadyFallback(sessionId);
     proc.onData((data) => {
       this.handleOutput(sessionId, data);
     });
@@ -139998,7 +140238,7 @@ var CodexPtyRunner = class {
   async startFresh(options) {
     const nodePty = await loadPty();
     const sessionId = (0, import_crypto7.randomUUID)();
-    const projectName = options.projectName ?? (0, import_path17.basename)(options.projectPath);
+    const projectName = options.projectName ?? (0, import_path18.basename)(options.projectPath);
     const args = ["--cd", options.projectPath, "--no-alt-screen"];
     if (options.systemPrompt) {
       args.push(options.systemPrompt);
@@ -140027,6 +140267,7 @@ var CodexPtyRunner = class {
     };
     this.sessions.set(sessionId, session);
     this.pendingReady.add(sessionId);
+    this.armReadyFallback(sessionId);
     proc.onData((data) => {
       this.handleOutput(sessionId, data);
     });
@@ -140036,6 +140277,21 @@ var CodexPtyRunner = class {
     });
     return toPublicSession(session);
   }
+  // Flat backstop: if neither the "Ready" marker nor the quiet-checker settled
+  // the session within CODEX_READY_FALLBACK_MS of spawn, mark it ready anyway
+  // so start requests resolve and mobile can watch the boot live. unref() so a
+  // pending timer never holds the process open.
+  armReadyFallback(sessionId) {
+    const timer = setTimeout(() => {
+      this.readyFallbackTimers.delete(sessionId);
+      const session = this.sessions.get(sessionId);
+      if (session?.status === "running" && this.pendingReady.has(sessionId)) {
+        this.markReady(sessionId, session, "fallback:timeout");
+      }
+    }, CODEX_READY_FALLBACK_MS);
+    timer.unref?.();
+    this.readyFallbackTimers.set(sessionId, timer);
+  }
   // Write raw key bytes directly to the PTY, same as PTYManager.sendKeys.
   sendKeys(sessionId, keys) {
     const session = this.sessions.get(sessionId);
@@ -140047,13 +140303,47 @@ var CodexPtyRunner = class {
       session.status = "running";
       this.onStatusChange?.(toPublicSession(session));
     }
+    const gate = this.openGate.get(sessionId);
+    const digit = gate ? /^([0-9])\r?$/.exec(keys)?.[1] : void 0;
+    const out = gate && digit ? this.resolveGateAnswer(sessionId, gate, digit) : keys;
     this.log.info(
-      `[codex.keys.write] ${sessionId.slice(0, 8)} bytes=${keys.length} digest=${digestBytes(keys)}`,
-      { event: "codex.keys_write", sessionId, byteLen: keys.length }
+      `[codex.keys.write] ${sessionId.slice(0, 8)} bytes=${out.length} digest=${digestBytes(out)}`,
+      { event: "codex.keys_write", sessionId, byteLen: out.length }
     );
-    session.process.write(keys);
+    session.process.write(out);
     session.lastActivityAt = /* @__PURE__ */ new Date();
   }
+  // Map a gate-card digit to the PTY bytes that answer the real dialog,
+  // persisting the choice when the digit was a synthetic "remember for all
+  // projects" option (those numbers don't exist on the actual dialog and must
+  // never reach codex). The trailing \r mobile sends is dropped: a digit alone
+  // selects AND confirms (live-probe verified), and a stray Enter would land
+  // on whatever screen follows.
+  resolveGateAnswer(sessionId, gate, digit) {
+    let real = digit;
+    let remembered = false;
+    if (gate === "hooks" && digit === "4") {
+      saveGateAnswer("codexHooksGate", "trust_all");
+      real = "2";
+      remembered = true;
+    } else if (gate === "hooks" && digit === "5") {
+      saveGateAnswer("codexHooksGate", "continue_untrusted");
+      real = "3";
+      remembered = true;
+    } else if (gate === "trust" && digit === "3") {
+      saveGateAnswer("codexTrustGate", "yes");
+      real = "1";
+      remembered = true;
+    }
+    this.log.info(`[codex.gate_answer] ${sessionId.slice(0, 8)} ${gate} digit=${real}`, {
+      event: "codex.gate_answer",
+      sessionId,
+      gate,
+      digit: real,
+      remembered
+    });
+    return real;
+  }
   sendInput(sessionId, input) {
     const session = this.sessions.get(sessionId);
     if (!session) throw new Error(`Session not found: ${sessionId}`);
@@ -140123,8 +140413,12 @@ var CodexPtyRunner = class {
     }, CODEX_SUBMIT_DELAY_MS);
   }
   // Drain any inputs sent while the session was still pendingReady, writing
-  // them in arrival order now that Codex is Ready.
+  // them in arrival order now that Codex is Ready. No-op while a gate dialog
+  // is open (a flushed digit would confirm a dialog option) or while still
+  // pendingReady (markReady drains it) — the gate-close path re-drives it for
+  // the ready-with-gate-open case.
   flushQueuedInputs(sessionId) {
+    if (this.openGate.has(sessionId) || this.pendingReady.has(sessionId)) return;
     const queue = this.queuedInputs.get(sessionId);
     if (!queue || queue.length === 0) return;
     this.queuedInputs.delete(sessionId);
@@ -140169,7 +140463,7 @@ var CodexPtyRunner = class {
     if (!session) return;
     this.pendingReady.delete(sessionId);
     this.queuedInputs.delete(sessionId);
-    this.trustGateAnswered.delete(sessionId);
+    this.clearSessionDetectors(sessionId);
     try {
       session.process.kill("SIGINT");
     } catch {
@@ -140180,6 +140474,21 @@ var CodexPtyRunner = class {
     this.sessions.delete(sessionId);
     this.onStatusChange?.(toPublicSession(session));
   }
+  // Drop a session's detection state: quiet-checker, ready-fallback timer,
+  // gate bookkeeping — and dismiss a still-open gate card so mobile doesn't
+  // keep rendering a question for a dead PTY.
+  clearSessionDetectors(sessionId) {
+    this.quietCheckers.get(sessionId)?.cancel();
+    this.quietCheckers.delete(sessionId);
+    const timer = this.readyFallbackTimers.get(sessionId);
+    if (timer) clearTimeout(timer);
+    this.readyFallbackTimers.delete(sessionId);
+    if (this.openGate.delete(sessionId)) {
+      this.onPermissionChange?.(sessionId, null);
+    }
+    this.gateActioned.delete(`${sessionId}:hooks`);
+    this.gateActioned.delete(`${sessionId}:trust`);
+  }
   getOutput(sessionId) {
     const session = this.sessions.get(sessionId);
     if (!session) throw new Error(`Session not found: ${sessionId}`);
@@ -140219,10 +140528,19 @@ var CodexPtyRunner = class {
       }
       session.screen.dispose();
     }
+    for (const sessionId of Array.from(this.quietCheckers.keys())) {
+      this.clearSessionDetectors(sessionId);
+    }
+    for (const timer of this.readyFallbackTimers.values()) {
+      clearTimeout(timer);
+    }
     this.sessions.clear();
     this.pendingReady.clear();
     this.queuedInputs.clear();
-    this.trustGateAnswered.clear();
+    this.openGate.clear();
+    this.gateActioned.clear();
+    this.quietCheckers.clear();
+    this.readyFallbackTimers.clear();
   }
   handleOutput(sessionId, data) {
     const session = this.sessions.get(sessionId);
@@ -140237,44 +140555,92 @@ var CodexPtyRunner = class {
     session.screen.write(data);
     session.lastOutput = stripAnsi(data);
     this.onOutput?.(sessionId, data);
-    this.detectReady(sessionId, session).catch((err) => {
+    this.detectScreenState(sessionId, "chunk").catch((err) => {
       this.log.warn("[codex.ready_detect] failed", {
         event: "codex.ready_detect_failed",
         sessionId,
         err
       });
     });
+    let quiet = this.quietCheckers.get(sessionId);
+    if (!quiet) {
+      quiet = debounce(() => {
+        this.detectScreenState(sessionId, "quiet").catch((err) => {
+          this.log.warn("[codex.ready_detect] failed", {
+            event: "codex.ready_detect_failed",
+            sessionId,
+            err
+          });
+        });
+      }, QUIET_DETECT_MS);
+      this.quietCheckers.set(sessionId, quiet);
+    }
+    quiet();
   }
-  // Renders the session's headless screen and checks for the directory-trust
-  // gate (answered once, debounced) and the "Ready" status-bar text. Only
-  // transitions to waiting_input / fires onReady when the rendered status
-  // line literally contains "Ready" — `›` alone (visible during "Starting")
-  // is NOT a valid readiness signal (Phase 0).
-  async detectReady(sessionId, session) {
-    if (session.status !== "running" || !this.pendingReady.has(sessionId)) return;
+  // Renders the session's headless screen and drives both detections:
+  //   - Gates (directory trust, hooks review) — checked on EVERY pass,
+  //     independent of pendingReady, so a gate appearing after ready is still
+  //     surfaced and a gate leaving the screen closes its card.
+  //   - Readiness — the "Ready" status-bar marker while pendingReady, plus the
+  //     quiet path: after QUIET_DETECT_MS of PTY silence a still-pending
+  //     session is marked ready anyway (`›` alone is NOT a marker — Phase 0 —
+  //     but a quiet boot screen is more useful to the user live than a
+  //     spinner, and "Ready" may be truncated off the 120-col status bar).
+  async detectScreenState(sessionId, trigger) {
+    const session = this.sessions.get(sessionId);
+    if (!session || session.status === "idle") return;
     const lines = await this.getOutputLines(sessionId, PTY_ROWS);
     const screenText = lines.join("\n");
-    if (CODEX_TRUST_GATE_REGEX.test(screenText)) {
-      if (!this.trustGateAnswered.has(sessionId)) {
-        this.trustGateAnswered.add(sessionId);
-        this.log.info(`[codex.trust_gate] ${sessionId.slice(0, 8)} auto-answering`, {
-          event: "codex.trust_gate",
-          sessionId
-        });
-        session.process.write("\r");
-      }
-      return;
+    const gate = CODEX_HOOKS_GATE_REGEX.test(screenText) ? "hooks" : CODEX_TRUST_GATE_REGEX.test(screenText) ? "trust" : null;
+    if (gate) {
+      this.handleGate(sessionId, session, gate, lines);
+    } else if (this.openGate.delete(sessionId)) {
+      this.onPermissionChange?.(sessionId, null);
+      this.flushQueuedInputs(sessionId);
     }
+    if (session.status !== "running" || !this.pendingReady.has(sessionId)) return;
     const lastNonBlank2 = [...lines].reverse().find((l) => l.trim() !== "") ?? "";
-    if (!lastNonBlank2.includes(CODEX_PROMPT_READY_TEXT)) return;
-    this.markReady(sessionId, session);
+    if (lastNonBlank2.includes(CODEX_PROMPT_READY_TEXT)) {
+      this.markReady(sessionId, session, `marker:${CODEX_PROMPT_READY_TEXT}`);
+    } else if (trigger === "quiet") {
+      this.markReady(sessionId, session, "quiet:timeout");
+    }
   }
-  markReady(sessionId, session) {
+  // Answer a gate from the persisted remember-store, or surface it as a
+  // question card over the permission transport. Actioned once per session and
+  // gate type — repaints of the same dialog neither re-write nor re-broadcast.
+  handleGate(sessionId, session, gate, lines) {
+    const key = `${sessionId}:${gate}`;
+    if (this.gateActioned.has(key)) return;
+    this.gateActioned.add(key);
+    const remembered = rememberedGateDigit(gate);
+    if (remembered) {
+      this.log.info(`[codex.gate_auto_answer] ${sessionId.slice(0, 8)} ${gate} \u2192 ${remembered}`, {
+        event: "codex.gate_auto_answer",
+        sessionId,
+        gate,
+        digit: remembered
+      });
+      session.process.write(remembered);
+      return;
+    }
+    this.openGate.set(sessionId, gate);
+    const card = gateCard(gate, lines);
+    this.log.info(`[codex.gate_prompt] ${sessionId.slice(0, 8)} ${gate}`, {
+      event: "codex.gate_prompt",
+      sessionId,
+      gate,
+      prompt: card.prompt
+    });
+    this.onPermissionChange?.(sessionId, card);
+  }
+  markReady(sessionId, session, reason) {
     session.lastActivityAt = /* @__PURE__ */ new Date();
     session.status = "waiting_input";
-    this.log.info(`[codex.ready] ${sessionId.slice(0, 8)}`, {
+    this.log.info(`[codex.ready] ${sessionId.slice(0, 8)} ${reason}`, {
       event: "codex.ready",
-      sessionId
+      sessionId,
+      reason
     });
     this.onStatusChange?.(toPublicSession(session));
     if (this.pendingReady.has(sessionId)) {
@@ -140290,7 +140656,7 @@ var CodexPtyRunner = class {
     session.status = "idle";
     const elapsedMs = session.completedAt.getTime() - session.startedAt.getTime();
     if (exitCode !== 0 && elapsedMs < 2e3 && session.lastOutput === "") {
-      if (!(0, import_fs21.existsSync)(session.projectPath)) {
+      if (!(0, import_fs22.existsSync)(session.projectPath)) {
         session.failureReason = `Project directory not found: ${session.projectPath}`;
       } else {
         session.failureReason = `Codex process exited immediately (code ${exitCode}).`;
@@ -140300,7 +140666,7 @@ var CodexPtyRunner = class {
     session.screen.dispose();
     this.sessions.delete(sessionId);
     this.queuedInputs.delete(sessionId);
-    this.trustGateAnswered.delete(sessionId);
+    this.clearSessionDetectors(sessionId);
   }
 };
 function toPublicSession(s3) {
@@ -140327,8 +140693,8 @@ function stripAnsi(str) {
 // src/pty-manager.ts
 var import_headless2 = __toESM(require_xterm_headless(), 1);
 var import_crypto8 = require("crypto");
-var import_fs22 = require("fs");
-var import_path18 = require("path");
+var import_fs23 = require("fs");
+var import_path19 = require("path");
 init_logger();
 
 // src/services/questions/detectPermissionGate.ts
@@ -140484,9 +140850,15 @@ function detectShellPrompt(lines) {
       ]
     };
   }
-  if (NUMBERED_RE.test(last.text)) {
+  const lastNumberedIdx = (() => {
+    for (let i = last.idx; i >= 0; i--) {
+      if (NUMBERED_RE.test(lines[i])) return i;
+    }
+    return -1;
+  })();
+  if (lastNumberedIdx >= 0) {
     const options = [];
-    for (let i = 0; i <= last.idx; i++) {
+    for (let i = 0; i <= lastNumberedIdx; i++) {
       const m2 = NUMBERED_RE.exec(lines[i]);
       if (!m2) continue;
       const num = Number.parseInt(m2[1], 10);
@@ -140514,37 +140886,6 @@ function detectShellPrompt(lines) {
   return null;
 }
 
-// src/utils/debounce.ts
-function debounce(fn, waitMs) {
-  let timer = null;
-  let lastArgs = null;
-  const run2 = () => {
-    timer = null;
-    if (lastArgs) {
-      const args = lastArgs;
-      lastArgs = null;
-      fn(...args);
-    }
-  };
-  const debounced = (...args) => {
-    lastArgs = args;
-    if (timer) clearTimeout(timer);
-    timer = setTimeout(run2, waitMs);
-  };
-  debounced.cancel = () => {
-    if (timer) clearTimeout(timer);
-    timer = null;
-    lastArgs = null;
-  };
-  debounced.flush = () => {
-    if (timer) {
-      clearTimeout(timer);
-      run2();
-    }
-  };
-  return debounced;
-}
-
 // src/pty-manager.ts
 var OUTPUT_BUFFER_MAX2 = 65536;
 var PTY_COLS2 = 120;
@@ -140552,7 +140893,7 @@ var PTY_ROWS2 = 40;
 var SCREEN_SCROLLBACK2 = 1e3;
 var CLAUDE_PROMPT_MARKERS = ["\u256D", "\u276F"];
 var PROMPT_MARKER_FALLBACK_MS = 1e4;
-var QUIET_DETECT_MS = 500;
+var QUIET_DETECT_MS2 = 500;
 function buildPasteBytes(input) {
   return `\x1B[200~${input}\x1B[201~`;
 }
@@ -140680,7 +141021,7 @@ var PTYManager = class {
   }
   async doStart(sessionId, options) {
     const nodePty = await loadPty2();
-    const projectName = options.projectName ?? (0, import_path18.basename)(options.projectPath);
+    const projectName = options.projectName ?? (0, import_path19.basename)(options.projectPath);
     const proc = nodePty.spawn(
       resolveClaudeExe(),
       [
@@ -140731,7 +141072,7 @@ var PTYManager = class {
   async startFresh(options) {
     const nodePty = await loadPty2();
     const sessionId = (0, import_crypto8.randomUUID)();
-    const projectName = options.projectName ?? (0, import_path18.basename)(options.projectPath);
+    const projectName = options.projectName ?? (0, import_path19.basename)(options.projectPath);
     const args = [
       "--permission-mode",
       options.permissionMode ?? "acceptEdits",
@@ -141052,7 +141393,7 @@ var PTYManager = class {
     });
     let quiet = this.quietCheckers.get(sessionId);
     if (!quiet) {
-      quiet = debounce(() => this.handleQuiet(sessionId), QUIET_DETECT_MS);
+      quiet = debounce(() => this.handleQuiet(sessionId), QUIET_DETECT_MS2);
       this.quietCheckers.set(sessionId, quiet);
     }
     quiet();
@@ -141175,7 +141516,7 @@ var PTYManager = class {
     session.status = "idle";
     const elapsedMs = session.completedAt.getTime() - session.startedAt.getTime();
     if (exitCode !== 0 && elapsedMs < 2e3 && session.lastOutput === "") {
-      if (!(0, import_fs22.existsSync)(session.projectPath)) {
+      if (!(0, import_fs23.existsSync)(session.projectPath)) {
         session.failureReason = `Project directory not found: ${session.projectPath}`;
       } else {
         session.failureReason = `Process exited immediately (code ${exitCode}). Check that the Claude binary is installed and accessible.`;
@@ -141303,7 +141644,7 @@ var LiveSessionManager = class {
     const runner = this.runners.get(provider);
     if (runner) return runner;
     const err = new Error(
-      `Live ${provider} sessions are not implemented yet for ${(0, import_path19.basename)(projectPath)}`
+      `Live ${provider} sessions are not implemented yet for ${(0, import_path20.basename)(projectPath)}`
     );
     err.statusCode = 501;
     throw err;
@@ -141369,10 +141710,10 @@ var PairTokenStore = class {
 
 // src/process-discovery.ts
 var import_child_process2 = require("child_process");
-var import_os9 = require("os");
-var import_path20 = require("path");
+var import_os10 = require("os");
+var import_path21 = require("path");
 async function discoverClaudeProcesses() {
-  if ((0, import_os9.platform)() === "win32") return discoverWindows();
+  if ((0, import_os10.platform)() === "win32") return discoverWindows();
   return discoverUnix();
 }
 async function discoverUnix() {
@@ -141389,7 +141730,7 @@ async function discoverUnix() {
         return {
           pid,
           projectPath: cwd,
-          projectName: (0, import_path20.basename)(cwd),
+          projectName: (0, import_path21.basename)(cwd),
           branch: await readGitBranch2(cwd),
           conversationId,
           startedAt
@@ -141411,7 +141752,7 @@ async function discoverWindows() {
         return {
           pid,
           projectPath: info.cwd,
-          projectName: (0, import_path20.basename)(info.cwd),
+          projectName: (0, import_path21.basename)(info.cwd),
           branch: await readGitBranch2(info.cwd),
           conversationId: extractResumeId(info.args),
           startedAt: info.startedAt
@@ -141492,7 +141833,7 @@ async function getProcessInfoWindows(pid) {
     const startedAt = /* @__PURE__ */ new Date(`${year}-${month}-${day}T${hour}:${min}:${sec}`);
     if (Number.isNaN(startedAt.getTime())) return null;
     const exePath = parts[3] ?? "";
-    const cwd = exePath ? (0, import_path20.dirname)(exePath) : "";
+    const cwd = exePath ? (0, import_path21.dirname)(exePath) : "";
     return { cwd, args, startedAt };
   } catch {
     return null;
@@ -141533,13 +141874,13 @@ function seal(plaintext, recipientPublicKeyBase64) {
 
 // node_modules/chokidar/index.js
 var import_node_events2 = require("events");
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_promises16 = require("fs/promises");
 var sp2 = __toESM(require("path"), 1);
 
 // node_modules/readdirp/index.js
 var import_promises14 = require("fs/promises");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var import_node_stream2 = require("stream");
 var EntryTypes2 = {
   FILE_TYPE: "files",
@@ -141629,7 +141970,7 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
     this._wantsDir = type ? DIR_TYPES2.has(type) : false;
     this._wantsFile = type ? FILE_TYPES2.has(type) : false;
     this._wantsEverything = type === EntryTypes2.EVERYTHING_TYPE;
-    this._root = (0, import_node_path9.resolve)(root);
+    this._root = (0, import_node_path10.resolve)(root);
     this._isDirent = !opts.alwaysStat;
     this._statsProp = this._isDirent ? "dirent" : "stats";
     this._rdOptions = { encoding: "utf8", withFileTypes: this._isDirent };
@@ -141700,8 +142041,8 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
     let entry;
     const basename12 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = (0, import_node_path9.resolve)((0, import_node_path9.join)(path2, basename12));
-      entry = { path: (0, import_node_path9.relative)(this._root, fullPath), fullPath, basename: basename12 };
+      const fullPath = (0, import_node_path10.resolve)((0, import_node_path10.join)(path2, basename12));
+      entry = { path: (0, import_node_path10.relative)(this._root, fullPath), fullPath, basename: basename12 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
       this._onError(err);
@@ -141735,7 +142076,7 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
         }
         if (entryRealPathStats.isDirectory()) {
           const len = entryRealPath.length;
-          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path9.sep) {
+          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path10.sep) {
             const recursiveError = new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
             recursiveError.code = RECURSIVE_ERROR_CODE2;
             return this._onError(recursiveError);
@@ -141771,7 +142112,7 @@ function readdirp2(root, options = {}) {
 }
 
 // node_modules/chokidar/handler.js
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises15 = require("fs/promises");
 var import_node_os3 = require("os");
 var sp = __toESM(require("path"), 1);
@@ -142109,7 +142450,7 @@ function createFsWatchInstance2(path2, options, listener, errHandler, emitRaw) {
     }
   };
   try {
-    return (0, import_node_fs6.watch)(path2, {
+    return (0, import_node_fs7.watch)(path2, {
       persistent: options.persistent
     }, handleEvent);
   } catch (error51) {
@@ -142192,7 +142533,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
   let cont = FsWatchFileInstances2.get(fullPath);
   const copts = cont && cont.options;
   if (copts && (copts.persistent < options.persistent || copts.interval > options.interval)) {
-    (0, import_node_fs6.unwatchFile)(fullPath);
+    (0, import_node_fs7.unwatchFile)(fullPath);
     cont = void 0;
   }
   if (cont) {
@@ -142203,7 +142544,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
       listeners: listener,
       rawEmitters: rawEmitter,
       options,
-      watcher: (0, import_node_fs6.watchFile)(fullPath, options, (curr, prev) => {
+      watcher: (0, import_node_fs7.watchFile)(fullPath, options, (curr, prev) => {
         foreach2(cont.rawEmitters, (rawEmitter2) => {
           rawEmitter2(EV2.CHANGE, fullPath, { curr, prev });
         });
@@ -142220,7 +142561,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
     delFromSet2(cont, KEY_RAW2, rawEmitter);
     if (isEmptySet2(cont.listeners)) {
       FsWatchFileInstances2.delete(fullPath);
-      (0, import_node_fs6.unwatchFile)(fullPath);
+      (0, import_node_fs7.unwatchFile)(fullPath);
       cont.options = cont.watcher = void 0;
       Object.freeze(cont);
     }
@@ -142276,9 +142617,9 @@ var NodeFsHandler2 = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname17 = sp.dirname(file2);
+    const dirname18 = sp.dirname(file2);
     const basename12 = sp.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname17);
+    const parent = this.fsw._getWatchedDir(dirname18);
     let prevStats = stats;
     if (parent.has(basename12))
       return;
@@ -142305,7 +142646,7 @@ var NodeFsHandler2 = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname17, basename12);
+          this.fsw._remove(dirname18, basename12);
         }
       } else if (parent.has(basename12)) {
         const at2 = newStats.atimeMs;
@@ -143090,7 +143431,7 @@ var FSWatcher2 = class extends import_node_events2.EventEmitter {
     const now = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
-      (0, import_node_fs7.stat)(fullPath, (err, curStat) => {
+      (0, import_node_fs8.stat)(fullPath, (err, curStat) => {
         if (err || !writes.has(path2)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
@@ -143264,7 +143605,7 @@ function watch2(paths, options = {}) {
 var chokidar_default = { watch: watch2, FSWatcher: FSWatcher2 };
 
 // src/services/conversations/conversationWatcher.ts
-var import_fs23 = require("fs");
+var import_fs24 = require("fs");
 var import_promises17 = require("fs/promises");
 var ConversationWatcher = class {
   files = /* @__PURE__ */ new Map();
@@ -143287,7 +143628,7 @@ var ConversationWatcher = class {
     if (this.files.has(filePath)) return;
     let offset;
     try {
-      offset = (0, import_fs23.statSync)(filePath).size;
+      offset = (0, import_fs24.statSync)(filePath).size;
     } catch {
       offset = 0;
     }
@@ -143462,14 +143803,14 @@ function findSearchTarget(messages, query) {
 }
 
 // src/services/conversations/pruneAgentConversations.ts
-var import_fs24 = require("fs");
+var import_fs25 = require("fs");
 function pruneAgentConversations(cache) {
   const db = cache.getDatabase();
   const rows = db.prepare("SELECT id, file_path FROM conversation_meta").all();
   let pruned = 0;
   let missing = 0;
   for (const row of rows) {
-    if (!(0, import_fs24.existsSync)(row.file_path)) {
+    if (!(0, import_fs25.existsSync)(row.file_path)) {
       missing += 1;
       continue;
     }
@@ -143492,6 +143833,13 @@ function deriveProjectChatTitle(input) {
   return `Untitled \xB7 ${input.id.slice(0, 8)}`;
 }
 
+// src/services/questions/permissionAnswerKeys.ts
+var ANSWER_KEYS_ALLOWLIST = /^(?:\r|[yn]\r|\x03|\d+\r)$/;
+function sanitizeAnswerKeys(keys) {
+  if (keys === void 0) return void 0;
+  return ANSWER_KEYS_ALLOWLIST.test(keys) ? keys : void 0;
+}
+
 // src/services/questions/detectAskUserQuestion.ts
 function normalizeContent2(raw2) {
   if (Array.isArray(raw2)) return raw2;
@@ -143831,7 +144179,7 @@ function discoveredToResponse(d, conversationId) {
 var import_crypto10 = require("crypto");
 var import_promises18 = require("fs/promises");
 var import_heic_convert = __toESM(require_heic_convert(), 1);
-var import_path21 = require("path");
+var import_path22 = require("path");
 var UPLOAD_DIR_NAME = ".threadbase-uploads";
 var MAX_BYTES = 25 * 1024 * 1024;
 var HEIC_MIMES = /* @__PURE__ */ new Set(["image/heic", "image/heif"]);
@@ -143864,9 +144212,9 @@ async function saveUploadFile(input) {
   }
   const id = `up_${(0, import_crypto10.randomBytes)(8).toString("hex")}`;
   const safeName = sanitizeFilename(originalName) || `file${MIME_TO_EXT[mimeType] ?? ""}`;
-  const dir = (0, import_path21.join)(input.projectPath, UPLOAD_DIR_NAME, input.sessionId);
+  const dir = (0, import_path22.join)(input.projectPath, UPLOAD_DIR_NAME, input.sessionId);
   await (0, import_promises18.mkdir)(dir, { recursive: true });
-  const filePath = (0, import_path21.join)(dir, `${Date.now()}-${id}-${safeName}`);
+  const filePath = (0, import_path22.join)(dir, `${Date.now()}-${id}-${safeName}`);
   await (0, import_promises18.writeFile)(filePath, buffer);
   return {
     id,
@@ -144334,8 +144682,10 @@ var WSHub = class {
 var BROWSE_SYSTEM_PROMPT = (browseRoot) => `You are working within the project boundary: ${browseRoot}. Do not read, write, or execute commands that access files or directories outside this boundary.`;
 var DEFAULT_SYSTEM_PROMPT = "When presenting options or choices to the user, limit the options to at most 3.";
 var DEFAULT_PTY_GRACE_PERIOD_MS = 27e4;
+var DEFAULT_WS_AUTH_TIMEOUT_MS = 5e3;
+var WS_CLOSE_UNAUTHORIZED = 4401;
 var REFRESH_TTL_MS = 2e3;
-var START_READY_TIMEOUT_MS = 15e3;
+var START_READY_TIMEOUT_MS = 1e4;
 function parseIncludeAgentsEnv(raw2) {
   if (raw2 === void 0) return false;
   const v2 = raw2.trim().toLowerCase();
@@ -144424,6 +144774,14 @@ var StreamerServer = class {
   clientIdToWs = /* @__PURE__ */ new Map();
   // Reverse map for cleanup on close
   wsToClientId = /* @__PURE__ */ new Map();
+  // M1 — WS auth. Sockets that have authenticated (via ?key= at upgrade OR a
+  // { type: "auth", token } first message). Only authed sockets are added to
+  // the hub and receive broadcasts.
+  // Plan: https://github.com/RonenMars/threadbase-streamer/blob/a251353bfa417bd48ce3f15086bc336a2c622629/docs/plans/2026-06-24-security-hardening.md#L40
+  wsAuthed = /* @__PURE__ */ new Set();
+  // Keyless sockets awaiting their first-message auth handshake → close timer.
+  wsAuthPending = /* @__PURE__ */ new Map();
+  wsAuthTimeoutMs;
   cache = null;
   projectsRepo = null;
   conversationsRepo = null;
@@ -144461,11 +144819,12 @@ var StreamerServer = class {
     this.disableDb = config2.disableDb ?? false;
     this.scannerPersistenceDisabled = config2.scannerPersistent === false;
     this.scanProfiles = config2.scanProfiles;
-    this.codexRoots = config2.codexRoots ?? [(0, import_path22.join)((0, import_os10.homedir)(), ".codex", "sessions")];
+    this.codexRoots = config2.codexRoots ?? [(0, import_path23.join)((0, import_os11.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config2.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
+    this.wsAuthTimeoutMs = config2.wsAuthTimeoutMs ?? DEFAULT_WS_AUTH_TIMEOUT_MS;
     this.defaultSystemPrompt = config2.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     this.defaultPermissionMode = config2.defaultPermissionMode ?? loadDefaultPermissionMode() ?? "acceptEdits";
-    this.cacheDir = config2.cacheDir ?? loadCacheDir() ?? (0, import_path22.join)((0, import_os10.homedir)(), ".threadbase", "cache");
+    this.cacheDir = config2.cacheDir ?? loadCacheDir() ?? (0, import_path23.join)((0, import_os11.homedir)(), ".threadbase", "cache");
     this.tailSize = config2.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config2.directoryScanDebounceMs ?? 1e3;
     this.markScannerStaleDebounced = debounce(() => {
@@ -144506,7 +144865,7 @@ var StreamerServer = class {
           const seqs = cache.extendMessageIndex(
             filePath,
             spans,
-            (0, import_fs25.statSync)(filePath),
+            (0, import_fs26.statSync)(filePath),
             readFrom,
             endOffset
           );
@@ -144667,7 +145026,7 @@ var StreamerServer = class {
         temporalClient,
         taskQueue: agentConfig.temporal.taskQueue
       });
-      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path22.join)((0, import_path22.dirname)(this.cacheDir), "conversations");
+      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path23.join)((0, import_path23.dirname)(this.cacheDir), "conversations");
       conversationWriter = createConversationWriter({
         baseDir: conversationsBaseDir
       });
@@ -144720,17 +145079,39 @@ var StreamerServer = class {
       handlePairExchange: (req, res) => this.handlePairExchange(req, res),
       handleBrowse: (url2, res) => this.handleBrowse(url2, res),
       handleMkdir: (req, res) => this.handleMkdir(req, res),
-      handleWsOpen: (ws2) => {
-        this.wsHub.addClient(ws2);
-        const sessions = this.sessionStore.list(this.ptyAttachedIds());
-        ws2.send(JSON.stringify({ type: "session_list", sessions }));
-        if (this.cacheReady) {
-          ws2.send(JSON.stringify({ type: "cache_ready" }));
+      handleWsOpen: (ws2, preAuthed) => {
+        if (preAuthed) {
+          this.completeWsAuth(ws2);
+          return;
         }
+        const timer = setTimeout(() => {
+          this.wsAuthPending.delete(ws2);
+          try {
+            ws2.close(WS_CLOSE_UNAUTHORIZED, "auth timeout");
+          } catch {
+          }
+        }, this.wsAuthTimeoutMs);
+        this.wsAuthPending.set(ws2, timer);
       },
       handleWsMessage: async (ws2, raw2) => {
         try {
           const msg = JSON.parse(String(raw2));
+          if (!this.wsAuthed.has(ws2)) {
+            if (msg.type === "auth" && typeof msg.token === "string") {
+              const t = this.wsAuthPending.get(ws2);
+              if (t) clearTimeout(t);
+              this.wsAuthPending.delete(ws2);
+              if (validateApiKey(msg.token, this.apiKey)) {
+                this.completeWsAuth(ws2);
+              } else {
+                try {
+                  ws2.close(WS_CLOSE_UNAUTHORIZED, "unauthorized");
+                } catch {
+                }
+              }
+            }
+            return;
+          }
           if (msg.type === "register" && typeof msg.clientId === "string") {
             const oldClientId = this.wsToClientId.get(ws2);
             if (oldClientId) this.clientIdToWs.delete(oldClientId);
@@ -144743,14 +145124,54 @@ var StreamerServer = class {
               const lines = await this.ptyManager.getOutputLines(msg.sessionId, 200);
               ws2.send(JSON.stringify({ type: "terminal_replay", sessionId: msg.sessionId, lines }));
             }
+            const pendingGate = this.pendingPermission.get(msg.sessionId);
+            if (pendingGate) {
+              this.log.info(`[ws.replay_permission] ${msg.sessionId.slice(0, 8)}`, {
+                event: "ws.replay_permission",
+                sessionId: msg.sessionId
+              });
+              ws2.send(
+                JSON.stringify({
+                  type: "permission",
+                  sessionId: msg.sessionId,
+                  ...pendingGate.prompt ? { prompt: pendingGate.prompt } : {},
+                  ...pendingGate.detail ? { detail: pendingGate.detail } : {},
+                  options: pendingGate.options,
+                  ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {}
+                })
+              );
+            }
+            const pendingQuestion = this.pendingQuestions.get(msg.sessionId);
+            if (pendingQuestion) {
+              this.log.info(`[ws.replay_question] ${msg.sessionId.slice(0, 8)}`, {
+                event: "ws.replay_question",
+                sessionId: msg.sessionId
+              });
+              ws2.send(
+                JSON.stringify({
+                  type: "question",
+                  sessionId: msg.sessionId,
+                  toolUseId: pendingQuestion.toolUseId,
+                  questions: pendingQuestion.questions
+                })
+              );
+            }
           }
           if (msg.type === "hold_session" && typeof msg.sessionId === "string") {
-            this.startGraceTimer(msg.sessionId, 0);
+            if (this.sessionSubscribers.get(msg.sessionId)?.has(ws2)) {
+              this.startGraceTimer(msg.sessionId, 0);
+            }
           }
         } catch {
         }
       },
       handleWsClose: (ws2) => {
+        const pendingTimer = this.wsAuthPending.get(ws2);
+        if (pendingTimer) {
+          clearTimeout(pendingTimer);
+          this.wsAuthPending.delete(ws2);
+        }
+        this.wsAuthed.delete(ws2);
         const clientId = this.wsToClientId.get(ws2);
         if (clientId) {
           this.clientIdToWs.delete(clientId);
@@ -144820,6 +145241,20 @@ var StreamerServer = class {
       this.wsHub.broadcast(payload);
     }
   }
+  // M1: finalize a WebSocket auth (via ?key= at upgrade or a first-message
+  // handshake) — register it with the hub and send the initial snapshot. Only
+  // authed sockets reach this, so no unauthenticated client ever receives a
+  // broadcast.
+  // Plan: https://github.com/RonenMars/threadbase-streamer/blob/a251353bfa417bd48ce3f15086bc336a2c622629/docs/plans/2026-06-24-security-hardening.md#L40
+  completeWsAuth(ws2) {
+    this.wsAuthed.add(ws2);
+    this.wsHub.addClient(ws2);
+    const sessions = this.sessionStore.list(this.ptyAttachedIds());
+    ws2.send(JSON.stringify({ type: "session_list", sessions }));
+    if (this.cacheReady) {
+      ws2.send(JSON.stringify({ type: "cache_ready" }));
+    }
+  }
   addSessionSubscriber(sessionId, ws2) {
     let subs = this.sessionSubscribers.get(sessionId);
     if (!subs) {
@@ -144891,7 +145326,7 @@ var StreamerServer = class {
         });
         try {
           this.cache = ConversationCache.open(
-            (0, import_path22.join)(this.cacheDir, "cache.db"),
+            (0, import_path23.join)(this.cacheDir, "cache.db"),
             this.tailSize,
             void 0,
             {
@@ -144917,11 +145352,11 @@ var StreamerServer = class {
           if (this.scanProfiles && this.scanProfiles.length > 0) {
             for (const profile of this.scanProfiles) {
               if (profile.enabled) {
-                this.fileWatcher.watchDirectory((0, import_path22.join)(profile.configDir, "projects"));
+                this.fileWatcher.watchDirectory((0, import_path23.join)(profile.configDir, "projects"));
               }
             }
           } else {
-            this.fileWatcher.watchDirectory((0, import_path22.join)((0, import_os10.homedir)(), ".claude", "projects"));
+            this.fileWatcher.watchDirectory((0, import_path23.join)((0, import_os11.homedir)(), ".claude", "projects"));
           }
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -145106,6 +145541,9 @@ var StreamerServer = class {
     this.ptyManager.dispose();
     this.fileWatcher.dispose();
     this.wsHub.dispose();
+    for (const timer of this.wsAuthPending.values()) clearTimeout(timer);
+    this.wsAuthPending.clear();
+    this.wsAuthed.clear();
     this.pairTokens.dispose();
     if (this.dbPool) {
       await this.dbPool.end();
@@ -145503,17 +145941,17 @@ var StreamerServer = class {
     return scanner;
   }
   findJsonlPath(uuid3) {
-    const projectsDir = (0, import_path22.join)((0, import_os10.homedir)(), ".claude", "projects");
-    if (!(0, import_fs25.existsSync)(projectsDir)) return null;
+    const projectsDir = (0, import_path23.join)((0, import_os11.homedir)(), ".claude", "projects");
+    if (!(0, import_fs26.existsSync)(projectsDir)) return null;
     const filename = `${uuid3}.jsonl`;
-    for (const dir of (0, import_fs25.readdirSync)(projectsDir)) {
-      const fp = (0, import_path22.join)(projectsDir, dir, filename);
-      if ((0, import_fs25.existsSync)(fp)) return fp;
-      const projectDir = (0, import_path22.join)(projectsDir, dir);
+    for (const dir of (0, import_fs26.readdirSync)(projectsDir)) {
+      const fp = (0, import_path23.join)(projectsDir, dir, filename);
+      if ((0, import_fs26.existsSync)(fp)) return fp;
+      const projectDir = (0, import_path23.join)(projectsDir, dir);
       try {
-        for (const sub of (0, import_fs25.readdirSync)(projectDir)) {
-          const subagentPath = (0, import_path22.join)(projectDir, sub, "subagents", filename);
-          if ((0, import_fs25.existsSync)(subagentPath)) return subagentPath;
+        for (const sub of (0, import_fs26.readdirSync)(projectDir)) {
+          const subagentPath = (0, import_path23.join)(projectDir, sub, "subagents", filename);
+          if ((0, import_fs26.existsSync)(subagentPath)) return subagentPath;
         }
       } catch {
       }
@@ -145522,7 +145960,7 @@ var StreamerServer = class {
   }
   async readCwdFromJsonl(filePath) {
     return new Promise((resolve6) => {
-      const rl = (0, import_readline4.createInterface)({ input: (0, import_fs25.createReadStream)(filePath), crlfDelay: Infinity });
+      const rl = (0, import_readline4.createInterface)({ input: (0, import_fs26.createReadStream)(filePath), crlfDelay: Infinity });
       let found = false;
       rl.on("line", (line) => {
         if (found) return;
@@ -145660,7 +146098,7 @@ var StreamerServer = class {
     if (!conv.filePath) return false;
     let mtimeMs = null;
     try {
-      mtimeMs = (0, import_fs25.statSync)(conv.filePath).mtimeMs;
+      mtimeMs = (0, import_fs26.statSync)(conv.filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -146028,7 +146466,7 @@ var StreamerServer = class {
   handleGetSession(sessionId, res) {
     const session = this.sessionStore.get(sessionId, this.ptyAttachedIds());
     if (session) {
-      if (!(0, import_fs25.existsSync)(session.projectPath)) {
+      if (!(0, import_fs26.existsSync)(session.projectPath)) {
         session.failureReason = `Project directory not found: ${session.projectPath}`;
       }
       json2(res, 200, session);
@@ -146232,12 +146670,21 @@ var StreamerServer = class {
       return;
     }
     this.pendingPermission.set(sessionId, gate);
+    const safeOptions = gate.options.map((o) => {
+      const answerKeys = sanitizeAnswerKeys(o.answerKeys);
+      return answerKeys === void 0 ? { index: o.index, label: o.label } : { ...o, answerKeys };
+    });
+    const subscriberCount = this.sessionSubscribers.get(sessionId)?.size ?? 0;
+    this.log.info(
+      `[ws.broadcast_permission] ${sessionId.slice(0, 8)} subscribers=${subscriberCount}`,
+      { event: "ws.broadcast_permission", sessionId, subscriberCount }
+    );
     this.wsHub.broadcast({
       type: "permission",
       sessionId,
       ...gate.prompt ? { prompt: gate.prompt } : {},
       ...gate.detail ? { detail: gate.detail } : {},
-      options: gate.options,
+      options: safeOptions,
       ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {}
     });
   }
@@ -146424,7 +146871,7 @@ var StreamerServer = class {
         sessionStore: this.sessionStore,
         // biome-ignore lint/style/noNonNullAssertion: agentClient is set when agentConfig.enabled is true
         agentClient: this.agentClient,
-        conversationsDir: this.cacheDir ? (0, import_path22.join)((0, import_path22.dirname)(this.cacheDir), "conversations") : "",
+        conversationsDir: this.cacheDir ? (0, import_path23.join)((0, import_path23.dirname)(this.cacheDir), "conversations") : "",
         agentConfig: this.agentConfig
       });
       json2(res, result.status, result.body);
@@ -146565,9 +147012,9 @@ var StreamerServer = class {
   // was passed to Claude via --session-id so the filename matches from the start.
   watchForJsonl(sessionId, projectPath) {
     const encoded = projectPath.replace(/[/\\:.]/g, "-");
-    const projectsDir = (0, import_path22.join)((0, import_os10.homedir)(), ".claude", "projects", encoded);
+    const projectsDir = (0, import_path23.join)((0, import_os11.homedir)(), ".claude", "projects", encoded);
     const expectedFile = `${sessionId}.jsonl`;
-    const filePath = (0, import_path22.join)(projectsDir, expectedFile);
+    const filePath = (0, import_path23.join)(projectsDir, expectedFile);
     const deadline = Date.now() + 12e4;
     let watcher = null;
     const cleanup = () => {
@@ -146585,12 +147032,12 @@ var StreamerServer = class {
         cleanup();
         return;
       }
-      let resolvedFilePath = (0, import_fs25.existsSync)(filePath) ? filePath : null;
-      if (!resolvedFilePath && (0, import_fs25.existsSync)(projectsDir)) {
+      let resolvedFilePath = (0, import_fs26.existsSync)(filePath) ? filePath : null;
+      if (!resolvedFilePath && (0, import_fs26.existsSync)(projectsDir)) {
         try {
           const now = Date.now();
-          const recent = (0, import_fs25.readdirSync)(projectsDir).filter((f2) => f2.endsWith(".jsonl")).map((f2) => ({ f: f2, mtime: (0, import_fs25.statSync)((0, import_path22.join)(projectsDir, f2)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).sort((a, b2) => b2.mtime - a.mtime)[0];
-          if (recent) resolvedFilePath = (0, import_path22.join)(projectsDir, recent.f);
+          const recent = (0, import_fs26.readdirSync)(projectsDir).filter((f2) => f2.endsWith(".jsonl")).map((f2) => ({ f: f2, mtime: (0, import_fs26.statSync)((0, import_path23.join)(projectsDir, f2)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).sort((a, b2) => b2.mtime - a.mtime)[0];
+          if (recent) resolvedFilePath = (0, import_path23.join)(projectsDir, recent.f);
         } catch {
         }
       }
@@ -146599,7 +147046,7 @@ var StreamerServer = class {
       this.sessionFileMap.set(sessionId, resolvedFilePath);
       this.fileWatcher.watch(resolvedFilePath);
       try {
-        const existing = (0, import_fs25.readFileSync)(resolvedFilePath, "utf8").split("\n").filter(Boolean);
+        const existing = (0, import_fs26.readFileSync)(resolvedFilePath, "utf8").split("\n").filter(Boolean);
         if (existing.length > 0) {
           this.broadcastConversationLines(sessionId, existing);
         }
@@ -146622,7 +147069,7 @@ var StreamerServer = class {
     if (this.sessionFileMap.has(sessionId)) return;
     try {
       require("fs").mkdirSync(projectsDir, { recursive: true });
-      watcher = (0, import_fs25.watch)(projectsDir, tryWire);
+      watcher = (0, import_fs26.watch)(projectsDir, tryWire);
       watcher.on("error", cleanup);
     } catch {
     }
@@ -146638,7 +147085,7 @@ var StreamerServer = class {
   watchForCodexRollout(sessionId, projectPath) {
     const deadline = Date.now() + 12e4;
     const now = /* @__PURE__ */ new Date();
-    const dateDir = (0, import_path22.join)(
+    const dateDir = (0, import_path23.join)(
       String(now.getFullYear()),
       String(now.getMonth() + 1).padStart(2, "0"),
       String(now.getDate()).padStart(2, "0")
@@ -146651,7 +147098,7 @@ var StreamerServer = class {
     };
     const matchesProjectPath = (candidatePath) => {
       try {
-        const firstLine = (0, import_fs25.readFileSync)(candidatePath, "utf8").split("\n", 1)[0];
+        const firstLine = (0, import_fs26.readFileSync)(candidatePath, "utf8").split("\n", 1)[0];
         if (!firstLine) return null;
         const parsed = JSON.parse(firstLine);
         if (parsed?.type !== "session_meta") return null;
@@ -146679,18 +147126,18 @@ var StreamerServer = class {
         this.sessionStore.listManaged().filter((s3) => s3.id !== sessionId && s3.boundConversationId != null).map((s3) => s3.boundConversationId)
       );
       for (const root of this.codexRoots) {
-        const sessionsDir = (0, import_path22.join)(root, dateDir);
-        if (!(0, import_fs25.existsSync)(sessionsDir)) continue;
+        const sessionsDir = (0, import_path23.join)(root, dateDir);
+        if (!(0, import_fs26.existsSync)(sessionsDir)) continue;
         let candidateFiles;
         try {
-          candidateFiles = (0, import_fs25.readdirSync)(sessionsDir).filter((f2) => f2.endsWith(".jsonl"));
+          candidateFiles = (0, import_fs26.readdirSync)(sessionsDir).filter((f2) => f2.endsWith(".jsonl"));
         } catch {
           continue;
         }
         const nowMs = Date.now();
-        const recentCandidates = candidateFiles.map((f2) => ({ f: f2, mtime: (0, import_fs25.statSync)((0, import_path22.join)(sessionsDir, f2)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b2) => b2.mtime - a.mtime);
+        const recentCandidates = candidateFiles.map((f2) => ({ f: f2, mtime: (0, import_fs26.statSync)((0, import_path23.join)(sessionsDir, f2)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b2) => b2.mtime - a.mtime);
         for (const { f: f2 } of recentCandidates) {
-          const candidatePath = (0, import_path22.join)(sessionsDir, f2);
+          const candidatePath = (0, import_path23.join)(sessionsDir, f2);
           const match2 = matchesProjectPath(candidatePath);
           if (!match2) continue;
           if (boundElsewhere.has(match2.id)) continue;
@@ -146700,7 +147147,7 @@ var StreamerServer = class {
           this.sessionFileMap.set(sessionId, candidatePath);
           this.fileWatcher.watch(candidatePath);
           try {
-            const existing = (0, import_fs25.readFileSync)(candidatePath, "utf8").split("\n").filter(Boolean);
+            const existing = (0, import_fs26.readFileSync)(candidatePath, "utf8").split("\n").filter(Boolean);
             if (existing.length > 0) {
               this.broadcastConversationLines(sessionId, existing);
             }
@@ -146822,7 +147269,7 @@ var StreamerServer = class {
 };
 function classifyResumability(cwd) {
   if (!cwd) return { resumable: true };
-  if ((0, import_fs25.existsSync)(cwd)) return { resumable: true };
+  if ((0, import_fs26.existsSync)(cwd)) return { resumable: true };
   const ranInWorktree = /\/\.worktrees\//.test(cwd) || /\/\.claude\/worktrees\//.test(cwd);
   return {
     resumable: false,
@@ -147086,7 +147533,7 @@ async function checkForUpdate(opts) {
 }
 
 // src/updater/install.ts
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 
 // src/updater/active-sessions.ts
 async function countActiveSessions(opts) {
@@ -147139,8 +147586,8 @@ function isBrewInstall(scriptPath = process.argv[1] ?? "") {
 
 // src/updater/download.ts
 var import_node_crypto4 = require("crypto");
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path11 = require("path");
 var import_promises20 = require("stream/promises");
 
 // src/updater/manifest.ts
@@ -147200,13 +147647,13 @@ async function downloadAndVerify(opts) {
       `Manifest references ${artifact.filename} but it is not attached to the release`
     );
   }
-  (0, import_node_fs8.mkdirSync)((0, import_node_path10.dirname)(targetPath), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path11.dirname)(targetPath), { recursive: true });
   const res = await fetch(asset.browserDownloadUrl);
   if (!res.ok || !res.body) {
     throw new Error(`Failed to download ${artifact.filename}: ${res.status} ${res.statusText}`);
   }
   const hash2 = (0, import_node_crypto4.createHash)("sha256");
-  const out = (0, import_node_fs8.createWriteStream)(targetPath);
+  const out = (0, import_node_fs9.createWriteStream)(targetPath);
   let bytes = 0;
   const measured = new TransformStream({
     transform(chunk, controller) {
@@ -147218,19 +147665,19 @@ async function downloadAndVerify(opts) {
   try {
     await (0, import_promises20.pipeline)(res.body.pipeThrough(measured), out);
   } catch (err) {
-    (0, import_node_fs8.rmSync)(targetPath, { force: true });
+    (0, import_node_fs9.rmSync)(targetPath, { force: true });
     throw err;
   }
   const actual = hash2.digest("hex");
   if (actual !== artifact.sha256) {
-    (0, import_node_fs8.rmSync)(targetPath, { force: true });
+    (0, import_node_fs9.rmSync)(targetPath, { force: true });
     throw new Error(
       `sha256 mismatch for ${artifact.filename}: expected ${artifact.sha256}, got ${actual}`
     );
   }
-  const stat10 = (0, import_node_fs8.statSync)(targetPath);
+  const stat10 = (0, import_node_fs9.statSync)(targetPath);
   if (stat10.size !== artifact.size) {
-    (0, import_node_fs8.rmSync)(targetPath, { force: true });
+    (0, import_node_fs9.rmSync)(targetPath, { force: true });
     throw new Error(
       `size mismatch for ${artifact.filename}: expected ${artifact.size}, got ${stat10.size}`
     );
@@ -147240,16 +147687,16 @@ async function downloadAndVerify(opts) {
 
 // src/updater/paths.ts
 var import_node_os4 = require("os");
-var import_node_path11 = require("path");
-var THREADBASE_ROOT = (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".threadbase");
-var RELEASES_DIR = (0, import_node_path11.join)(THREADBASE_ROOT, "releases");
-var CURRENT_SYMLINK = (0, import_node_path11.join)(THREADBASE_ROOT, "current");
-var DOWNLOAD_DIR = (0, import_node_path11.join)(THREADBASE_ROOT, "releases", ".tmp");
+var import_node_path12 = require("path");
+var THREADBASE_ROOT = (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".threadbase");
+var RELEASES_DIR = (0, import_node_path12.join)(THREADBASE_ROOT, "releases");
+var CURRENT_SYMLINK = (0, import_node_path12.join)(THREADBASE_ROOT, "current");
+var DOWNLOAD_DIR = (0, import_node_path12.join)(THREADBASE_ROOT, "releases", ".tmp");
 function releaseDir(version2) {
-  return (0, import_node_path11.join)(RELEASES_DIR, version2);
+  return (0, import_node_path12.join)(RELEASES_DIR, version2);
 }
 function downloadPath(version2, filename) {
-  return (0, import_node_path11.join)(DOWNLOAD_DIR, `${version2}-${filename}`);
+  return (0, import_node_path12.join)(DOWNLOAD_DIR, `${version2}-${filename}`);
 }
 
 // src/updater/restart.ts
@@ -147330,111 +147777,111 @@ async function stopService(opts = {}) {
 }
 
 // src/updater/stamp-version.ts
-var import_node_fs9 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path13 = require("path");
 function stampVersionTxt(destDir, version2) {
-  const distDir = (0, import_node_path12.join)(destDir, "dist");
-  (0, import_node_fs9.mkdirSync)(distDir, { recursive: true });
-  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(distDir, "version.txt"), `${version2}+update
+  const distDir = (0, import_node_path13.join)(destDir, "dist");
+  (0, import_node_fs10.mkdirSync)(distDir, { recursive: true });
+  (0, import_node_fs10.writeFileSync)((0, import_node_path13.join)(distDir, "version.txt"), `${version2}+update
 `);
 }
 
 // src/updater/swap.ts
-var import_node_fs10 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path14 = require("path");
 var import_semver2 = __toESM(require_semver2(), 1);
 var KEEP_LAST_N = 2;
 function swapCurrent(version2) {
   const target = releaseDir(version2);
-  if (!(0, import_node_fs10.existsSync)(target)) {
+  if (!(0, import_node_fs11.existsSync)(target)) {
     throw new Error(`Cannot swap to ${version2}: ${target} does not exist`);
   }
   if (process.platform === "win32") {
     const tmp = `${CURRENT_SYMLINK}.new`;
-    (0, import_node_fs10.rmSync)(tmp, { recursive: true, force: true });
-    (0, import_node_fs10.cpSync)(target, tmp, { recursive: true });
-    if ((0, import_node_fs10.existsSync)(CURRENT_SYMLINK)) {
-      (0, import_node_fs10.rmSync)(CURRENT_SYMLINK, { recursive: true, force: true });
+    (0, import_node_fs11.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs11.cpSync)(target, tmp, { recursive: true });
+    if ((0, import_node_fs11.existsSync)(CURRENT_SYMLINK)) {
+      (0, import_node_fs11.rmSync)(CURRENT_SYMLINK, { recursive: true, force: true });
     }
-    (0, import_node_fs10.renameSync)(tmp, CURRENT_SYMLINK);
-    (0, import_node_fs10.copyFileSync)((0, import_node_path13.join)(CURRENT_SYMLINK, "dist", "cli.cjs"), (0, import_node_path13.join)(THREADBASE_ROOT, "cli.js"));
+    (0, import_node_fs11.renameSync)(tmp, CURRENT_SYMLINK);
+    (0, import_node_fs11.copyFileSync)((0, import_node_path14.join)(CURRENT_SYMLINK, "dist", "cli.cjs"), (0, import_node_path14.join)(THREADBASE_ROOT, "cli.js"));
     return;
   }
   const tmpLink = `${CURRENT_SYMLINK}.new`;
-  if ((0, import_node_fs10.existsSync)(tmpLink) || lstatSafeIsSymlink(tmpLink)) {
-    (0, import_node_fs10.unlinkSync)(tmpLink);
+  if ((0, import_node_fs11.existsSync)(tmpLink) || lstatSafeIsSymlink(tmpLink)) {
+    (0, import_node_fs11.unlinkSync)(tmpLink);
   }
-  (0, import_node_fs10.symlinkSync)(target, tmpLink);
-  (0, import_node_fs10.renameSync)(tmpLink, CURRENT_SYMLINK);
-  const cliJs = (0, import_node_path13.join)(THREADBASE_ROOT, "cli.js");
+  (0, import_node_fs11.symlinkSync)(target, tmpLink);
+  (0, import_node_fs11.renameSync)(tmpLink, CURRENT_SYMLINK);
+  const cliJs = (0, import_node_path14.join)(THREADBASE_ROOT, "cli.js");
   const tmpCliJs = `${cliJs}.new`;
-  if ((0, import_node_fs10.existsSync)(tmpCliJs) || lstatSafeIsSymlink(tmpCliJs)) (0, import_node_fs10.unlinkSync)(tmpCliJs);
-  (0, import_node_fs10.symlinkSync)((0, import_node_path13.join)(target, "dist", "cli.cjs"), tmpCliJs);
-  (0, import_node_fs10.renameSync)(tmpCliJs, cliJs);
+  if ((0, import_node_fs11.existsSync)(tmpCliJs) || lstatSafeIsSymlink(tmpCliJs)) (0, import_node_fs11.unlinkSync)(tmpCliJs);
+  (0, import_node_fs11.symlinkSync)((0, import_node_path14.join)(target, "dist", "cli.cjs"), tmpCliJs);
+  (0, import_node_fs11.renameSync)(tmpCliJs, cliJs);
 }
 function lstatSafeIsSymlink(path2) {
   try {
-    return (0, import_node_fs10.lstatSync)(path2).isSymbolicLink();
+    return (0, import_node_fs11.lstatSync)(path2).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function pruneOldReleases(activeVersion, keep = KEEP_LAST_N) {
-  if (!(0, import_node_fs10.existsSync)(RELEASES_DIR)) return [];
-  const entries = (0, import_node_fs10.readdirSync)(RELEASES_DIR, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).filter((name) => import_semver2.default.valid(name) !== null);
+  if (!(0, import_node_fs11.existsSync)(RELEASES_DIR)) return [];
+  const entries = (0, import_node_fs11.readdirSync)(RELEASES_DIR, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).filter((name) => import_semver2.default.valid(name) !== null);
   const sorted = entries.sort((a, b2) => import_semver2.default.rcompare(a, b2));
   const toKeep = new Set(sorted.slice(0, keep));
   toKeep.add(activeVersion);
   const removed = [];
   for (const name of sorted) {
     if (toKeep.has(name)) continue;
-    (0, import_node_fs10.rmSync)(releaseDir(name), { recursive: true, force: true });
+    (0, import_node_fs11.rmSync)(releaseDir(name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
 }
 function ensureReleasesDir() {
-  (0, import_node_fs10.mkdirSync)(RELEASES_DIR, { recursive: true });
+  (0, import_node_fs11.mkdirSync)(RELEASES_DIR, { recursive: true });
 }
 
 // src/updater/unpack.ts
-var import_node_fs17 = require("fs");
+var import_node_fs18 = require("fs");
 
 // node_modules/tar/dist/esm/index.min.js
 var import_events4 = __toESM(require("events"), 1);
-var import_fs26 = __toESM(require("fs"), 1);
+var import_fs27 = __toESM(require("fs"), 1);
 var import_node_events3 = require("events");
 var import_node_stream3 = __toESM(require("stream"), 1);
 var import_node_string_decoder = require("string_decoder");
-var import_node_path14 = __toESM(require("path"), 1);
-var import_node_fs11 = __toESM(require("fs"), 1);
-var import_path23 = require("path");
+var import_node_path15 = __toESM(require("path"), 1);
+var import_node_fs12 = __toESM(require("fs"), 1);
+var import_path24 = require("path");
 var import_events5 = require("events");
 var import_assert = __toESM(require("assert"), 1);
 var import_buffer2 = require("buffer");
 var Ps = __toESM(require("zlib"), 1);
 var import_zlib = __toESM(require("zlib"), 1);
-var import_node_path15 = require("path");
 var import_node_path16 = require("path");
-var import_fs27 = __toESM(require("fs"), 1);
-var import_fs28 = __toESM(require("fs"), 1);
-var import_path24 = __toESM(require("path"), 1);
 var import_node_path17 = require("path");
+var import_fs28 = __toESM(require("fs"), 1);
+var import_fs29 = __toESM(require("fs"), 1);
 var import_path25 = __toESM(require("path"), 1);
-var import_node_fs12 = __toESM(require("fs"), 1);
+var import_node_path18 = require("path");
+var import_path26 = __toESM(require("path"), 1);
+var import_node_fs13 = __toESM(require("fs"), 1);
 var import_node_assert = __toESM(require("assert"), 1);
 var import_node_crypto5 = require("crypto");
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path18 = __toESM(require("path"), 1);
-var import_fs29 = __toESM(require("fs"), 1);
 var import_node_fs14 = __toESM(require("fs"), 1);
 var import_node_path19 = __toESM(require("path"), 1);
+var import_fs30 = __toESM(require("fs"), 1);
 var import_node_fs15 = __toESM(require("fs"), 1);
-var import_promises21 = __toESM(require("fs/promises"), 1);
 var import_node_path20 = __toESM(require("path"), 1);
-var import_node_path21 = require("path");
 var import_node_fs16 = __toESM(require("fs"), 1);
-var import_node_path22 = __toESM(require("path"), 1);
+var import_promises21 = __toESM(require("fs/promises"), 1);
+var import_node_path21 = __toESM(require("path"), 1);
+var import_node_path22 = require("path");
+var import_node_fs17 = __toESM(require("fs"), 1);
+var import_node_path23 = __toESM(require("path"), 1);
 var zr = Object.defineProperty;
 var Ur = (s3, t) => {
   for (var e in t) zr(s3, e, { get: t[e], enumerable: true });
@@ -147778,7 +148225,7 @@ var A = class extends import_node_events3.EventEmitter {
     return Wr;
   }
 };
-var Jr = import_fs26.default.writev;
+var Jr = import_fs27.default.writev;
 var ht = /* @__PURE__ */ Symbol("_autoClose");
 var H2 = /* @__PURE__ */ Symbol("_close");
 var te = /* @__PURE__ */ Symbol("_ended");
@@ -147833,7 +148280,7 @@ var _t = class extends A {
     throw new TypeError("this is a readable stream");
   }
   [at]() {
-    import_fs26.default.open(this[U], "r", (t, e) => this[Ht](t, e));
+    import_fs27.default.open(this[U], "r", (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
     t ? this[Ut](t) : (this[u] = e, this.emit("open", e), this[zt]());
@@ -147846,7 +148293,7 @@ var _t = class extends A {
       this[j] = true;
       let t = this[vi]();
       if (t.length === 0) return process.nextTick(() => this[Ii](null, 0, t));
-      import_fs26.default.read(this[u], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
+      import_fs27.default.read(this[u], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
     }
   }
   [Ii](t, e, i) {
@@ -147855,7 +148302,7 @@ var _t = class extends A {
   [H2]() {
     if (this[ht] && typeof this[u] == "number") {
       let t = this[u];
-      this[u] = void 0, import_fs26.default.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+      this[u] = void 0, import_fs27.default.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
   [Ut](t) {
@@ -147883,7 +148330,7 @@ var Be = class extends _t {
   [at]() {
     let t = true;
     try {
-      this[Ht](null, import_fs26.default.openSync(this[U], "r")), t = false;
+      this[Ht](null, import_fs27.default.openSync(this[U], "r")), t = false;
     } finally {
       t && this[H2]();
     }
@@ -147894,7 +148341,7 @@ var Be = class extends _t {
       if (!this[j]) {
         this[j] = true;
         do {
-          let e = this[vi](), i = e.length === 0 ? 0 : import_fs26.default.readSync(this[u], e, 0, e.length, null);
+          let e = this[vi](), i = e.length === 0 ? 0 : import_fs27.default.readSync(this[u], e, 0, e.length, null);
           if (!this[ki](i, e)) break;
         } while (true);
         this[j] = false;
@@ -147907,7 +148354,7 @@ var Be = class extends _t {
   [H2]() {
     if (this[ht] && typeof this[u] == "number") {
       let t = this[u];
-      this[u] = void 0, import_fs26.default.closeSync(t), this.emit("close");
+      this[u] = void 0, import_fs27.default.closeSync(t), this.emit("close");
     }
   }
 };
@@ -147949,7 +148396,7 @@ var et = class extends import_events4.default {
     this[H2](), this[gt] = true, this.emit("error", t);
   }
   [at]() {
-    import_fs26.default.open(this[U], this[tt], this[ie], (t, e) => this[Ht](t, e));
+    import_fs27.default.open(this[U], this[tt], this[ie], (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
     this[Me] && this[tt] === "r+" && t && t.code === "ENOENT" ? (this[tt] = "w", this[at]()) : t ? this[Ut](t) : (this[u] = e, this.emit("open", e), this[gt] || this[Ai]());
@@ -147961,7 +148408,7 @@ var et = class extends import_events4.default {
     return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", new Error("write() after end()")), false) : this[u] === void 0 || this[gt] || this[Y2].length ? (this[Y2].push(t), this[ke] = true, false) : (this[gt] = true, this[ve](t), true);
   }
   [ve](t) {
-    import_fs26.default.write(this[u], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
+    import_fs27.default.write(this[u], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
   }
   [Pt](t, e) {
     t ? this[Ut](t) : (this[ot] !== void 0 && typeof e == "number" && (this[ot] += e), this[Y2].length ? this[Ai]() : (this[gt] = false, this[te] && !this[Ni] ? (this[Ni] = true, this[H2](), this.emit("finish")) : this[ke] && (this[ke] = false, this.emit("drain"))));
@@ -147977,7 +148424,7 @@ var et = class extends import_events4.default {
   [H2]() {
     if (this[ht] && typeof this[u] == "number") {
       let t = this[u];
-      this[u] = void 0, import_fs26.default.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+      this[u] = void 0, import_fs27.default.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
 };
@@ -147985,24 +148432,24 @@ var Wt = class extends et {
   [at]() {
     let t;
     if (this[Me] && this[tt] === "r+") try {
-      t = import_fs26.default.openSync(this[U], this[tt], this[ie]);
+      t = import_fs27.default.openSync(this[U], this[tt], this[ie]);
     } catch (e) {
       if (e?.code === "ENOENT") return this[tt] = "w", this[at]();
       throw e;
     }
-    else t = import_fs26.default.openSync(this[U], this[tt], this[ie]);
+    else t = import_fs27.default.openSync(this[U], this[tt], this[ie]);
     this[Ht](null, t);
   }
   [H2]() {
     if (this[ht] && typeof this[u] == "number") {
       let t = this[u];
-      this[u] = void 0, import_fs26.default.closeSync(t), this.emit("close");
+      this[u] = void 0, import_fs27.default.closeSync(t), this.emit("close");
     }
   }
   [ve](t) {
     let e = true;
     try {
-      this[Pt](null, import_fs26.default.writeSync(this[u], t, 0, t.length, this[ot])), e = false;
+      this[Pt](null, import_fs27.default.writeSync(this[u], t, 0, t.length, this[ot])), e = false;
     } finally {
       if (e) try {
         this[H2]();
@@ -148328,12 +148775,12 @@ var F = class {
   }
 };
 var un = (s3, t) => {
-  let i = s3, r = "", n, o = import_node_path15.posix.parse(s3).root || ".";
+  let i = s3, r = "", n, o = import_node_path16.posix.parse(s3).root || ".";
   if (Buffer.byteLength(i) < 100) n = [i, r, false];
   else {
-    r = import_node_path15.posix.dirname(i), i = import_node_path15.posix.basename(i);
+    r = import_node_path16.posix.dirname(i), i = import_node_path16.posix.basename(i);
     do
-      Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t ? n = [i, r, false] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t ? n = [i.slice(0, 99), r, true] : (i = import_node_path15.posix.join(import_node_path15.posix.basename(r), i), r = import_node_path15.posix.dirname(r));
+      Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t ? n = [i, r, false] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t ? n = [i.slice(0, 99), r, true] : (i = import_node_path16.posix.join(import_node_path16.posix.basename(r), i), r = import_node_path16.posix.dirname(r));
     while (r !== o && n === void 0);
     n || (n = [s3.slice(0, 99), "", true]);
   }
@@ -148379,7 +148826,7 @@ var ft = class s {
     if (t === "") return Buffer.allocUnsafe(0);
     let e = Buffer.byteLength(t), i = 512 * Math.ceil(1 + e / 512), r = Buffer.allocUnsafe(i);
     for (let n = 0; n < 512; n++) r[n] = 0;
-    new F({ path: ("PaxHeader/" + (0, import_node_path16.basename)(this.path ?? "")).slice(0, 99), mode: this.mode || 420, uid: this.uid, gid: this.gid, size: e, mtime: this.mtime, type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader", linkpath: "", uname: this.uname || "", gname: this.gname || "", devmaj: 0, devmin: 0, atime: this.atime, ctime: this.ctime }).encode(r), r.write(t, 512, e, "utf8");
+    new F({ path: ("PaxHeader/" + (0, import_node_path17.basename)(this.path ?? "")).slice(0, 99), mode: this.mode || 420, uid: this.uid, gid: this.gid, size: e, mtime: this.mtime, type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader", linkpath: "", uname: this.uname || "", gname: this.gname || "", devmaj: 0, devmin: 0, atime: this.atime, ctime: this.ctime }).encode(r), r.write(t, 512, e, "utf8");
     for (let n = e + 512; n < r.length; n++) r[n] = 0;
     return r;
   }
@@ -148785,11 +149232,11 @@ var vn = (s3) => {
 };
 var Qi = (s3, t) => {
   let e = new Map(t.map((n) => [ut(n), true])), i = s3.filter, r = (n, o = "") => {
-    let h = o || (0, import_path23.parse)(n).root || ".", a;
+    let h = o || (0, import_path24.parse)(n).root || ".", a;
     if (n === h) a = false;
     else {
       let l = e.get(n);
-      a = l !== void 0 ? l : r((0, import_path23.dirname)(n), h);
+      a = l !== void 0 ? l : r((0, import_path24.dirname)(n), h);
     }
     return e.set(n, a), a;
   };
@@ -148798,15 +149245,15 @@ var Qi = (s3, t) => {
 var Mn = (s3) => {
   let t = new rt(s3), e = s3.file, i;
   try {
-    i = import_node_fs11.default.openSync(e, "r");
-    let r = import_node_fs11.default.fstatSync(i), n = s3.maxReadSize || 16 * 1024 * 1024;
+    i = import_node_fs12.default.openSync(e, "r");
+    let r = import_node_fs12.default.fstatSync(i), n = s3.maxReadSize || 16 * 1024 * 1024;
     if (r.size < n) {
-      let o = Buffer.allocUnsafe(r.size), h = import_node_fs11.default.readSync(i, o, 0, r.size, 0);
+      let o = Buffer.allocUnsafe(r.size), h = import_node_fs12.default.readSync(i, o, 0, r.size, 0);
       t.end(h === o.byteLength ? o : o.subarray(0, h));
     } else {
       let o = 0, h = Buffer.allocUnsafe(n);
       for (; o < r.size; ) {
-        let a = import_node_fs11.default.readSync(i, h, 0, n, o);
+        let a = import_node_fs12.default.readSync(i, h, 0, n, o);
         if (a === 0) break;
         o += a, t.write(h.subarray(0, a));
       }
@@ -148814,7 +149261,7 @@ var Mn = (s3) => {
     }
   } finally {
     if (typeof i == "number") try {
-      import_node_fs11.default.closeSync(i);
+      import_node_fs12.default.closeSync(i);
     } catch {
     }
   }
@@ -148822,7 +149269,7 @@ var Mn = (s3) => {
 var Bn = (s3, t) => {
   let e = new rt(s3), i = s3.maxReadSize || 16 * 1024 * 1024, r = s3.file;
   return new Promise((o, h) => {
-    e.on("error", h), e.on("end", o), import_node_fs11.default.stat(r, (a, l) => {
+    e.on("error", h), e.on("end", o), import_node_fs12.default.stat(r, (a, l) => {
       if (a) h(a);
       else {
         let c = new _t(r, { readSize: i, size: l.size });
@@ -148835,7 +149282,7 @@ var Ct = K(Mn, Bn, (s3) => new rt(s3), (s3) => new rt(s3), (s3, t) => {
   t?.length && Qi(s3, t), s3.noResume || vn(s3);
 });
 var Ji = (s3, t, e) => (s3 &= 4095, e && (s3 = (s3 | 384) & -19), t && (s3 & 256 && (s3 |= 64), s3 & 32 && (s3 |= 8), s3 & 4 && (s3 |= 1)), s3);
-var { isAbsolute: zn, parse: qs } = import_node_path17.win32;
+var { isAbsolute: zn, parse: qs } = import_node_path18.win32;
 var ce = (s3) => {
   let t = "", e = qs(s3);
   for (; zn(s3) || e.root; ) {
@@ -148909,7 +149356,7 @@ var de = class extends A {
       let [o, h] = ce(this.path);
       o && typeof h == "string" && (this.path = h, r = o);
     }
-    this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = Qs(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f(i.absolute || import_path24.default.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, { entry: this, path: r + this.path });
+    this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = Qs(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f(i.absolute || import_path25.default.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, { entry: this, path: r + this.path });
     let n = this.statCache.get(this.absolute);
     n ? this[si](n) : this[ss]();
   }
@@ -148920,7 +149367,7 @@ var de = class extends A {
     return t === "error" && (this.#t = true), super.emit(t, ...e);
   }
   [ss]() {
-    import_fs28.default.lstat(this.absolute, (t, e) => {
+    import_fs29.default.lstat(this.absolute, (t, e) => {
       if (t) return this.emit("error", t);
       this[si](e);
     });
@@ -148958,7 +149405,7 @@ var de = class extends A {
     this.path.slice(-1) !== "/" && (this.path += "/"), this.stat.size = 0, this[fe](), this.end();
   }
   [is]() {
-    import_fs28.default.readlink(this.absolute, (t, e) => {
+    import_fs29.default.readlink(this.absolute, (t, e) => {
       if (t) return this.emit("error", t);
       this[ns](e);
     });
@@ -148968,7 +149415,7 @@ var de = class extends A {
   }
   [sr](t) {
     if (!this.stat) throw new Error("cannot create link entry without stat");
-    this.type = "Link", this.linkpath = f(import_path24.default.relative(this.cwd, t)), this.stat.size = 0, this[fe](), this.end();
+    this.type = "Link", this.linkpath = f(import_path25.default.relative(this.cwd, t)), this.stat.size = 0, this[fe](), this.end();
   }
   [er]() {
     if (!this.stat) throw new Error("cannot create file entry without stat");
@@ -148981,7 +149428,7 @@ var de = class extends A {
     this[os]();
   }
   [os]() {
-    import_fs28.default.open(this.absolute, "r", (t, e) => {
+    import_fs29.default.open(this.absolute, "r", (t, e) => {
       if (t) return this.emit("error", t);
       this[hs](e);
     });
@@ -148996,14 +149443,14 @@ var de = class extends A {
   [ii]() {
     let { fd: t, buf: e, offset: i, length: r, pos: n } = this;
     if (t === void 0 || e === void 0) throw new Error("cannot read file without first opening");
-    import_fs28.default.read(t, e, i, r, n, (o, h) => {
+    import_fs29.default.read(t, e, i, r, n, (o, h) => {
       if (o) return this[pt](() => this.emit("error", o));
       this[rs](h);
     });
   }
   [pt](t = () => {
   }) {
-    this.fd !== void 0 && import_fs28.default.close(this.fd, t);
+    this.fd !== void 0 && import_fs29.default.close(this.fd, t);
   }
   [rs](t) {
     if (t <= 0 && this.remain > 0) {
@@ -149038,20 +149485,20 @@ var de = class extends A {
 var ni = class extends de {
   sync = true;
   [ss]() {
-    this[si](import_fs28.default.lstatSync(this.absolute));
+    this[si](import_fs29.default.lstatSync(this.absolute));
   }
   [is]() {
-    this[ns](import_fs28.default.readlinkSync(this.absolute));
+    this[ns](import_fs29.default.readlinkSync(this.absolute));
   }
   [os]() {
-    this[hs](import_fs28.default.openSync(this.absolute, "r"));
+    this[hs](import_fs29.default.openSync(this.absolute, "r"));
   }
   [ii]() {
     let t = true;
     try {
       let { fd: e, buf: i, offset: r, length: n, pos: o } = this;
       if (e === void 0 || i === void 0) throw new Error("fd and buf must be set in READ method");
-      let h = import_fs28.default.readSync(e, i, r, n, o);
+      let h = import_fs29.default.readSync(e, i, r, n, o);
       this[rs](h), t = false;
     } finally {
       if (t) try {
@@ -149066,7 +149513,7 @@ var ni = class extends de {
   }
   [pt](t = () => {
   }) {
-    this.fd !== void 0 && import_fs28.default.closeSync(this.fd), t();
+    this.fd !== void 0 && import_fs29.default.closeSync(this.fd), t();
   }
 };
 var oi = class extends A {
@@ -149382,7 +149829,7 @@ var wt = class extends A {
     return typeof t == "string" ? this[ci](t) : this[or](t), this.flowing;
   }
   [or](t) {
-    let e = f(import_path25.default.resolve(this.cwd, t.path));
+    let e = f(import_path26.default.resolve(this.cwd, t.path));
     if (!this.filter(t.path, t)) t.resume();
     else {
       let i = new pi(t.path, e);
@@ -149391,13 +149838,13 @@ var wt = class extends A {
     this[Ft]();
   }
   [ci](t) {
-    let e = f(import_path25.default.resolve(this.cwd, t));
+    let e = f(import_path26.default.resolve(this.cwd, t));
     this[W2].push(new pi(t, e)), this[Ft]();
   }
   [ds](t) {
     t.pending = true, this[G] += 1;
     let e = this.follow ? "stat" : "lstat";
-    import_fs27.default[e](t.absolute, (i, r) => {
+    import_fs28.default[e](t.absolute, (i, r) => {
       t.pending = false, this[G] -= 1, i ? this.emit("error", i) : this[li](t, r);
     });
   }
@@ -149411,7 +149858,7 @@ var wt = class extends A {
     this[Ft]();
   }
   [ms](t) {
-    t.pending = true, this[G] += 1, import_fs27.default.readdir(t.absolute, (e, i) => {
+    t.pending = true, this[G] += 1, import_fs28.default.readdir(t.absolute, (e, i) => {
       if (t.pending = false, this[G] -= 1, e) return this.emit("error", e);
       this[fi](t, i);
     });
@@ -149512,10 +149959,10 @@ var kt = class extends wt {
   }
   [ds](t) {
     let e = this.follow ? "statSync" : "lstatSync";
-    this[li](t, import_fs27.default[e](t.absolute));
+    this[li](t, import_fs28.default[e](t.absolute));
   }
   [ms](t) {
-    this[fi](t, import_fs27.default.readdirSync(t.absolute));
+    this[fi](t, import_fs28.default.readdirSync(t.absolute));
   }
   [di](t) {
     let e = t.entry, i = this.zip;
@@ -149544,11 +149991,11 @@ var $n = (s3, t) => {
 };
 var fr = (s3, t) => {
   t.forEach((e) => {
-    e.charAt(0) === "@" ? Ct({ file: import_node_path14.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+    e.charAt(0) === "@" ? Ct({ file: import_node_path15.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   }), s3.end();
 };
 var dr = async (s3, t) => {
-  for (let e of t) e.charAt(0) === "@" ? await Ct({ file: import_node_path14.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => {
+  for (let e of t) e.charAt(0) === "@" ? await Ct({ file: import_node_path15.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => {
     s3.add(i);
   } }) : s3.add(e);
   s3.end();
@@ -149566,8 +150013,8 @@ var Qn = K(Vn, $n, Xn, qn, (s3, t) => {
 });
 var Jn = process.env.__FAKE_PLATFORM__ || process.platform;
 var Er = Jn === "win32";
-var { O_CREAT: wr, O_NOFOLLOW: mr, O_TRUNC: Sr, O_WRONLY: yr } = import_fs29.default.constants;
-var Rr = Number(process.env.__FAKE_FS_O_FILENAME__) || import_fs29.default.constants.UV_FS_O_FILEMAP || 0;
+var { O_CREAT: wr, O_NOFOLLOW: mr, O_TRUNC: Sr, O_WRONLY: yr } = import_fs30.default.constants;
+var Rr = Number(process.env.__FAKE_FS_O_FILENAME__) || import_fs30.default.constants.UV_FS_O_FILEMAP || 0;
 var jn = Er && !!Rr;
 var to = 512 * 1024;
 var eo = Rr | Sr | wr | yr;
@@ -149575,29 +150022,29 @@ var ur = !Er && typeof mr == "number" ? mr | Sr | wr | yr : null;
 var us = ur !== null ? () => ur : jn ? (s3) => s3 < to ? eo : "w" : () => "w";
 var ps = (s3, t, e) => {
   try {
-    return import_node_fs14.default.lchownSync(s3, t, e);
+    return import_node_fs15.default.lchownSync(s3, t, e);
   } catch (i) {
     if (i?.code !== "ENOENT") throw i;
   }
 };
 var Ei = (s3, t, e, i) => {
-  import_node_fs14.default.lchown(s3, t, e, (r) => {
+  import_node_fs15.default.lchown(s3, t, e, (r) => {
     i(r && r?.code !== "ENOENT" ? r : null);
   });
 };
 var io = (s3, t, e, i, r) => {
-  if (t.isDirectory()) Es(import_node_path19.default.resolve(s3, t.name), e, i, (n) => {
+  if (t.isDirectory()) Es(import_node_path20.default.resolve(s3, t.name), e, i, (n) => {
     if (n) return r(n);
-    let o = import_node_path19.default.resolve(s3, t.name);
+    let o = import_node_path20.default.resolve(s3, t.name);
     Ei(o, e, i, r);
   });
   else {
-    let n = import_node_path19.default.resolve(s3, t.name);
+    let n = import_node_path20.default.resolve(s3, t.name);
     Ei(n, e, i, r);
   }
 };
 var Es = (s3, t, e, i) => {
-  import_node_fs14.default.readdir(s3, { withFileTypes: true }, (r, n) => {
+  import_node_fs15.default.readdir(s3, { withFileTypes: true }, (r, n) => {
     if (r) {
       if (r.code === "ENOENT") return i();
       if (r.code !== "ENOTDIR" && r.code !== "ENOTSUP") return i(r);
@@ -149613,12 +150060,12 @@ var Es = (s3, t, e, i) => {
   });
 };
 var so = (s3, t, e, i) => {
-  t.isDirectory() && ws(import_node_path19.default.resolve(s3, t.name), e, i), ps(import_node_path19.default.resolve(s3, t.name), e, i);
+  t.isDirectory() && ws(import_node_path20.default.resolve(s3, t.name), e, i), ps(import_node_path20.default.resolve(s3, t.name), e, i);
 };
 var ws = (s3, t, e) => {
   let i;
   try {
-    i = import_node_fs14.default.readdirSync(s3, { withFileTypes: true });
+    i = import_node_fs15.default.readdirSync(s3, { withFileTypes: true });
   } catch (r) {
     let n = r;
     if (n?.code === "ENOENT") return;
@@ -149652,32 +150099,32 @@ var St = class extends Error {
   }
 };
 var no = (s3, t) => {
-  import_node_fs15.default.stat(s3, (e, i) => {
+  import_node_fs16.default.stat(s3, (e, i) => {
     (e || !i.isDirectory()) && (e = new Se(s3, e?.code || "ENOTDIR")), t(e);
   });
 };
 var gr = (s3, t, e) => {
   s3 = f(s3);
   let i = t.umask ?? 18, r = t.mode | 448, n = (r & i) !== 0, o = t.uid, h = t.gid, a = typeof o == "number" && typeof h == "number" && (o !== t.processUid || h !== t.processGid), l = t.preserve, c = t.unlink, d = f(t.cwd), S2 = (E, x) => {
-    E ? e(E) : x && a ? Es(x, o, h, (Le) => S2(Le)) : n ? import_node_fs15.default.chmod(s3, r, e) : e();
+    E ? e(E) : x && a ? Es(x, o, h, (Le) => S2(Le)) : n ? import_node_fs16.default.chmod(s3, r, e) : e();
   };
   if (s3 === d) return no(s3, S2);
   if (l) return import_promises21.default.mkdir(s3, { mode: r, recursive: true }).then((E) => S2(null, E ?? void 0), S2);
-  let D = f(import_node_path20.default.relative(d, s3)).split("/");
+  let D = f(import_node_path21.default.relative(d, s3)).split("/");
   Ss(d, D, r, c, d, void 0, S2);
 };
 var Ss = (s3, t, e, i, r, n, o) => {
   if (t.length === 0) return o(null, n);
-  let h = t.shift(), a = f(import_node_path20.default.resolve(s3 + "/" + h));
-  import_node_fs15.default.mkdir(a, e, br(a, t, e, i, r, n, o));
+  let h = t.shift(), a = f(import_node_path21.default.resolve(s3 + "/" + h));
+  import_node_fs16.default.mkdir(a, e, br(a, t, e, i, r, n, o));
 };
 var br = (s3, t, e, i, r, n, o) => (h) => {
-  h ? import_node_fs15.default.lstat(s3, (a, l) => {
+  h ? import_node_fs16.default.lstat(s3, (a, l) => {
     if (a) a.path = a.path && f(a.path), o(a);
     else if (l.isDirectory()) Ss(s3, t, e, i, r, n, o);
-    else if (i) import_node_fs15.default.unlink(s3, (c) => {
+    else if (i) import_node_fs16.default.unlink(s3, (c) => {
       if (c) return o(c);
-      import_node_fs15.default.mkdir(s3, e, br(s3, t, e, i, r, n, o));
+      import_node_fs16.default.mkdir(s3, e, br(s3, t, e, i, r, n, o));
     });
     else {
       if (l.isSymbolicLink()) return o(new St(s3, s3 + "/" + t.join("/")));
@@ -149688,7 +150135,7 @@ var br = (s3, t, e, i, r, n, o) => (h) => {
 var oo = (s3) => {
   let t = false, e;
   try {
-    t = import_node_fs15.default.statSync(s3).isDirectory();
+    t = import_node_fs16.default.statSync(s3).isDirectory();
   } catch (i) {
     e = i?.code;
   } finally {
@@ -149698,20 +150145,20 @@ var oo = (s3) => {
 var _r = (s3, t) => {
   s3 = f(s3);
   let e = t.umask ?? 18, i = t.mode | 448, r = (i & e) !== 0, n = t.uid, o = t.gid, h = typeof n == "number" && typeof o == "number" && (n !== t.processUid || o !== t.processGid), a = t.preserve, l = t.unlink, c = f(t.cwd), d = (E) => {
-    E && h && ws(E, n, o), r && import_node_fs15.default.chmodSync(s3, i);
+    E && h && ws(E, n, o), r && import_node_fs16.default.chmodSync(s3, i);
   };
   if (s3 === c) return oo(c), d();
-  if (a) return d(import_node_fs15.default.mkdirSync(s3, { mode: i, recursive: true }) ?? void 0);
-  let T2 = f(import_node_path20.default.relative(c, s3)).split("/"), D;
+  if (a) return d(import_node_fs16.default.mkdirSync(s3, { mode: i, recursive: true }) ?? void 0);
+  let T2 = f(import_node_path21.default.relative(c, s3)).split("/"), D;
   for (let E = T2.shift(), x = c; E && (x += "/" + E); E = T2.shift()) {
-    x = f(import_node_path20.default.resolve(x));
+    x = f(import_node_path21.default.resolve(x));
     try {
-      import_node_fs15.default.mkdirSync(x, i), D = D || x;
+      import_node_fs16.default.mkdirSync(x, i), D = D || x;
     } catch {
-      let Le = import_node_fs15.default.lstatSync(x);
+      let Le = import_node_fs16.default.lstatSync(x);
       if (Le.isDirectory()) continue;
       if (l) {
-        import_node_fs15.default.unlinkSync(x), import_node_fs15.default.mkdirSync(x, i), D = D || x;
+        import_node_fs16.default.unlinkSync(x), import_node_fs16.default.mkdirSync(x, i), D = D || x;
         continue;
       } else if (Le.isSymbolicLink()) return new St(x, x + "/" + T2.join("/"));
     }
@@ -149733,14 +150180,14 @@ var ho = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 var ao = ho === "win32";
 var lo = (s3) => s3.split("/").slice(0, -1).reduce((e, i) => {
   let r = e.at(-1);
-  return r !== void 0 && (i = (0, import_node_path21.join)(r, i)), e.push(i || "/"), e;
+  return r !== void 0 && (i = (0, import_node_path22.join)(r, i)), e.push(i || "/"), e;
 }, []);
 var yi = class {
   #t = /* @__PURE__ */ new Map();
   #i = /* @__PURE__ */ new Map();
   #s = /* @__PURE__ */ new Set();
   reserve(t, e) {
-    t = ao ? ["win32 parallelization disabled"] : t.map((r) => ut((0, import_node_path21.join)(Tr(r))));
+    t = ao ? ["win32 parallelization disabled"] : t.map((r) => ut((0, import_node_path22.join)(Tr(r))));
     let i = new Set(t.map((r) => lo(r)).reduce((r, n) => r.concat(n)));
     this.#i.set(e, { dirs: i, paths: t });
     for (let r of t) {
@@ -149830,17 +150277,17 @@ var fo = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 var Te = fo === "win32";
 var mo = 1024;
 var uo = (s3, t) => {
-  if (!Te) return import_node_fs13.default.unlink(s3, t);
+  if (!Te) return import_node_fs14.default.unlink(s3, t);
   let e = s3 + ".DELETE." + (0, import_node_crypto5.randomBytes)(16).toString("hex");
-  import_node_fs13.default.rename(s3, e, (i) => {
+  import_node_fs14.default.rename(s3, e, (i) => {
     if (i) return t(i);
-    import_node_fs13.default.unlink(e, t);
+    import_node_fs14.default.unlink(e, t);
   });
 };
 var po = (s3) => {
-  if (!Te) return import_node_fs13.default.unlinkSync(s3);
+  if (!Te) return import_node_fs14.default.unlinkSync(s3);
   let t = s3 + ".DELETE." + (0, import_node_crypto5.randomBytes)(16).toString("hex");
-  import_node_fs13.default.renameSync(s3, t), import_node_fs13.default.unlinkSync(t);
+  import_node_fs14.default.renameSync(s3, t), import_node_fs14.default.unlinkSync(t);
 };
 var vr = (s3, t, e) => s3 !== void 0 && s3 === s3 >>> 0 ? s3 : t !== void 0 && t === t >>> 0 ? t : e;
 var Xt = class extends rt {
@@ -149880,7 +150327,7 @@ var Xt = class extends rt {
       if (t.preserveOwner) throw new TypeError("cannot preserve owner in archive and also set owner explicitly");
       this.uid = t.uid, this.gid = t.gid, this.setOwner = true;
     } else this.uid = void 0, this.gid = void 0, this.setOwner = false;
-    this.preserveOwner = t.preserveOwner === void 0 && typeof t.uid != "number" ? process.getuid?.() === 0 : !!t.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t.maxDepth == "number" ? t.maxDepth : mo, this.forceChown = t.forceChown === true, this.win32 = !!t.win32 || Te, this.newer = !!t.newer, this.keep = !!t.keep, this.noMtime = !!t.noMtime, this.preservePaths = !!t.preservePaths, this.unlink = !!t.unlink, this.cwd = f(import_node_path18.default.resolve(t.cwd || process.cwd())), this.strip = Number(t.strip) || 0, this.processUmask = this.chmod ? typeof t.processUmask == "number" ? t.processUmask : Lr() : 0, this.umask = typeof t.umask == "number" ? t.umask : this.processUmask, this.dmode = t.dmode || 511 & ~this.umask, this.fmode = t.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Dr](e));
+    this.preserveOwner = t.preserveOwner === void 0 && typeof t.uid != "number" ? process.getuid?.() === 0 : !!t.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t.maxDepth == "number" ? t.maxDepth : mo, this.forceChown = t.forceChown === true, this.win32 = !!t.win32 || Te, this.newer = !!t.newer, this.keep = !!t.keep, this.noMtime = !!t.noMtime, this.preservePaths = !!t.preservePaths, this.unlink = !!t.unlink, this.cwd = f(import_node_path19.default.resolve(t.cwd || process.cwd())), this.strip = Number(t.strip) || 0, this.processUmask = this.chmod ? typeof t.processUmask == "number" ? t.processUmask : Lr() : 0, this.umask = typeof t.umask == "number" ? t.umask : this.processUmask, this.dmode = t.dmode || 511 & ~this.umask, this.fmode = t.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Dr](e));
   }
   warn(t, e, i = {}) {
     return (t === "TAR_BAD_ARCHIVE" || t === "TAR_ABORT") && (i.recoverable = false), super.warn(t, e, i);
@@ -149894,7 +150341,7 @@ var Xt = class extends rt {
     let [n, o] = ce(i), h = o.replaceAll(/\\/g, "/").split("/");
     if (h.includes("..") || Te && /^[a-z]:\.\.$/i.test(h[0] ?? "")) {
       if (e === "path" || r === "Link") return this.warn("TAR_ENTRY_ERROR", `${e} contains '..'`, { entry: t, [e]: i }), false;
-      let a = import_node_path18.default.posix.dirname(t.path), l = import_node_path18.default.posix.normalize(import_node_path18.default.posix.join(a, h.join("/")));
+      let a = import_node_path19.default.posix.dirname(t.path), l = import_node_path19.default.posix.normalize(import_node_path19.default.posix.join(a, h.join("/")));
       if (l.startsWith("../") || l === "..") return this.warn("TAR_ENTRY_ERROR", `${e} escapes extraction directory`, { entry: t, [e]: i }), false;
     }
     return n && (t[e] = String(o), this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute ${e}`, { entry: t, [e]: i })), true;
@@ -149912,12 +150359,12 @@ var Xt = class extends rt {
     }
     if (isFinite(this.maxDepth) && i.length > this.maxDepth) return this.warn("TAR_ENTRY_ERROR", "path excessively deep", { entry: t, path: e, depth: i.length, maxDepth: this.maxDepth }), false;
     if (!this[Rs](t, "path") || !this[Rs](t, "linkpath")) return false;
-    if (t.absolute = import_node_path18.default.isAbsolute(t.path) ? f(import_node_path18.default.resolve(t.path)) : f(import_node_path18.default.resolve(this.cwd, t.path)), !this.preservePaths && typeof t.absolute == "string" && t.absolute.indexOf(this.cwd + "/") !== 0 && t.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", { entry: t, path: f(t.path), resolvedPath: t.absolute, cwd: this.cwd }), false;
+    if (t.absolute = import_node_path19.default.isAbsolute(t.path) ? f(import_node_path19.default.resolve(t.path)) : f(import_node_path19.default.resolve(this.cwd, t.path)), !this.preservePaths && typeof t.absolute == "string" && t.absolute.indexOf(this.cwd + "/") !== 0 && t.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", { entry: t, path: f(t.path), resolvedPath: t.absolute, cwd: this.cwd }), false;
     if (t.absolute === this.cwd && t.type !== "Directory" && t.type !== "GNUDumpDir") return false;
     if (this.win32) {
-      let { root: r } = import_node_path18.default.win32.parse(String(t.absolute));
+      let { root: r } = import_node_path19.default.win32.parse(String(t.absolute));
       t.absolute = r + ts(String(t.absolute).slice(r.length));
-      let { root: n } = import_node_path18.default.win32.parse(t.path);
+      let { root: n } = import_node_path19.default.win32.parse(t.path);
       t.path = n + ts(t.path.slice(n.length));
     }
     return true;
@@ -149956,16 +150403,16 @@ var Xt = class extends rt {
   [Ts](t, e) {
     let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = new et(String(t.absolute), { flags: us(t.size), mode: i, autoClose: false });
     r.on("error", (a) => {
-      r.fd && import_node_fs13.default.close(r.fd, () => {
+      r.fd && import_node_fs14.default.close(r.fd, () => {
       }), r.write = () => true, this[O](a, t), e();
     });
     let n = 1, o = (a) => {
       if (a) {
-        r.fd && import_node_fs13.default.close(r.fd, () => {
+        r.fd && import_node_fs14.default.close(r.fd, () => {
         }), this[O](a, t), e();
         return;
       }
-      --n === 0 && r.fd !== void 0 && import_node_fs13.default.close(r.fd, (l) => {
+      --n === 0 && r.fd !== void 0 && import_node_fs14.default.close(r.fd, (l) => {
         l ? this[O](l, t) : this[$t](), e();
       });
     };
@@ -149974,12 +150421,12 @@ var Xt = class extends rt {
       if (typeof l == "number" && t.mtime && !this.noMtime) {
         n++;
         let c = t.atime || /* @__PURE__ */ new Date(), d = t.mtime;
-        import_node_fs13.default.futimes(l, c, d, (S2) => S2 ? import_node_fs13.default.utimes(a, c, d, (T2) => o(T2 && S2)) : o());
+        import_node_fs14.default.futimes(l, c, d, (S2) => S2 ? import_node_fs14.default.utimes(a, c, d, (T2) => o(T2 && S2)) : o());
       }
       if (typeof l == "number" && this[ge](t)) {
         n++;
         let c = this[be](t), d = this[_e](t);
-        typeof c == "number" && typeof d == "number" && import_node_fs13.default.fchown(l, c, d, (S2) => S2 ? import_node_fs13.default.chown(a, c, d, (T2) => o(T2 && S2)) : o());
+        typeof c == "number" && typeof d == "number" && import_node_fs14.default.fchown(l, c, d, (S2) => S2 ? import_node_fs14.default.chown(a, c, d, (T2) => o(T2 && S2)) : o());
       }
       o();
     });
@@ -149998,20 +150445,20 @@ var Xt = class extends rt {
       let n = 1, o = () => {
         --n === 0 && (e(), this[$t](), t.resume());
       };
-      t.mtime && !this.noMtime && (n++, import_node_fs13.default.utimes(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime, o)), this[ge](t) && (n++, import_node_fs13.default.chown(String(t.absolute), Number(this[be](t)), Number(this[_e](t)), o)), o();
+      t.mtime && !this.noMtime && (n++, import_node_fs14.default.utimes(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime, o)), this[ge](t) && (n++, import_node_fs14.default.chown(String(t.absolute), Number(this[be](t)), Number(this[_e](t)), o)), o();
     });
   }
   [Cr](t) {
     t.unsupported = true, this.warn("TAR_ENTRY_UNSUPPORTED", `unsupported entry type: ${t.type}`, { entry: t }), t.resume();
   }
   [Ar](t, e) {
-    let i = f(import_node_path18.default.relative(this.cwd, import_node_path18.default.resolve(import_node_path18.default.dirname(String(t.absolute)), String(t.linkpath)))).split("/");
+    let i = f(import_node_path19.default.relative(this.cwd, import_node_path19.default.resolve(import_node_path19.default.dirname(String(t.absolute)), String(t.linkpath)))).split("/");
     this[Re](t, this.cwd, i, () => this[gi](t, String(t.linkpath), "symlink", e), (r) => {
       this[O](r, t), e();
     });
   }
   [Ir](t, e) {
-    let i = f(import_node_path18.default.resolve(this.cwd, String(t.linkpath))), r = f(String(t.linkpath)).split("/");
+    let i = f(import_node_path19.default.resolve(this.cwd, String(t.linkpath))), r = f(String(t.linkpath)).split("/");
     this[Re](t, this.cwd, r, () => this[gi](t, i, "link", e), (n) => {
       this[O](n, t), e();
     });
@@ -150019,10 +150466,10 @@ var Xt = class extends rt {
   [Re](t, e, i, r, n) {
     let o = i.shift();
     if (this.preservePaths || o === void 0) return r();
-    let h = import_node_path18.default.resolve(e, o);
-    import_node_fs13.default.lstat(h, (a, l) => {
+    let h = import_node_path19.default.resolve(e, o);
+    import_node_fs14.default.lstat(h, (a, l) => {
       if (a) return r();
-      if (l?.isSymbolicLink()) return n(new St(h, import_node_path18.default.resolve(h, i.join("/"))));
+      if (l?.isSymbolicLink()) return n(new St(h, import_node_path19.default.resolve(h, i.join("/"))));
       this[Re](t, h, i, r, n);
     });
   }
@@ -150056,7 +150503,7 @@ var Xt = class extends rt {
       });
     }, n = () => {
       if (t.absolute !== this.cwd) {
-        let h = f(import_node_path18.default.dirname(String(t.absolute)));
+        let h = f(import_node_path19.default.dirname(String(t.absolute)));
         if (h !== this.cwd) return this[yt](h, this.dmode, (a) => {
           if (a) {
             this[O](a, t), i();
@@ -150067,7 +150514,7 @@ var Xt = class extends rt {
       }
       o();
     }, o = () => {
-      import_node_fs13.default.lstat(String(t.absolute), (h, a) => {
+      import_node_fs14.default.lstat(String(t.absolute), (h, a) => {
         if (a && (this.keep || this.newer && a.mtime > (t.mtime ?? a.mtime))) {
           this[Ls](t), i();
           return;
@@ -150076,9 +150523,9 @@ var Xt = class extends rt {
         if (a.isDirectory()) {
           if (t.type === "Directory") {
             let l = this.chmod && t.mode && (a.mode & 4095) !== t.mode, c = (d) => this[P](d ?? null, t, i);
-            return l ? import_node_fs13.default.chmod(String(t.absolute), Number(t.mode), c) : c();
+            return l ? import_node_fs14.default.chmod(String(t.absolute), Number(t.mode), c) : c();
           }
-          if (t.absolute !== this.cwd) return import_node_fs13.default.rmdir(String(t.absolute), (l) => this[P](l ?? null, t, i));
+          if (t.absolute !== this.cwd) return import_node_fs14.default.rmdir(String(t.absolute), (l) => this[P](l ?? null, t, i));
         }
         if (t.absolute === this.cwd) return this[P](null, t, i);
         uo(String(t.absolute), (l) => this[P](l ?? null, t, i));
@@ -150106,7 +150553,7 @@ var Xt = class extends rt {
     }
   }
   [gi](t, e, i, r) {
-    import_node_fs13.default[i](e, String(t.absolute), (n) => {
+    import_node_fs14.default[i](e, String(t.absolute), (n) => {
       n ? this[O](n, t) : (this[$t](), t.resume()), r();
     });
   }
@@ -150131,23 +150578,23 @@ var xe = class extends Xt {
       this[Oe] = true;
     }
     if (t.absolute !== this.cwd) {
-      let n = f(import_node_path18.default.dirname(String(t.absolute)));
+      let n = f(import_node_path19.default.dirname(String(t.absolute)));
       if (n !== this.cwd) {
         let o = this[yt](n, this.dmode);
         if (o) return this[O](o, t);
       }
     }
-    let [e, i] = ye(() => import_node_fs13.default.lstatSync(String(t.absolute)));
+    let [e, i] = ye(() => import_node_fs14.default.lstatSync(String(t.absolute)));
     if (i && (this.keep || this.newer && i.mtime > (t.mtime ?? i.mtime))) return this[Ls](t);
     if (e || this[Os](t, i)) return this[P](null, t);
     if (i.isDirectory()) {
       if (t.type === "Directory") {
         let o = this.chmod && t.mode && (i.mode & 4095) !== t.mode, [h] = o ? ye(() => {
-          import_node_fs13.default.chmodSync(String(t.absolute), Number(t.mode));
+          import_node_fs14.default.chmodSync(String(t.absolute), Number(t.mode));
         }) : [];
         return this[P](h, t);
       }
-      let [n] = ye(() => import_node_fs13.default.rmdirSync(String(t.absolute)));
+      let [n] = ye(() => import_node_fs14.default.rmdirSync(String(t.absolute)));
       this[P](n, t);
     }
     let [r] = t.absolute === this.cwd ? [] : ye(() => po(String(t.absolute)));
@@ -150157,21 +150604,21 @@ var xe = class extends Xt {
     let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = (h) => {
       let a;
       try {
-        import_node_fs13.default.closeSync(n);
+        import_node_fs14.default.closeSync(n);
       } catch (l) {
         a = l;
       }
       (h || a) && this[O](h || a, t), e();
     }, n;
     try {
-      n = import_node_fs13.default.openSync(String(t.absolute), us(t.size), i);
+      n = import_node_fs14.default.openSync(String(t.absolute), us(t.size), i);
     } catch (h) {
       return r(h);
     }
     let o = this.transform && this.transform(t) || t;
     o !== t && (o.on("error", (h) => this[O](h, t)), t.pipe(o)), o.on("data", (h) => {
       try {
-        import_node_fs13.default.writeSync(n, h, 0, h.length);
+        import_node_fs14.default.writeSync(n, h, 0, h.length);
       } catch (a) {
         r(a);
       }
@@ -150180,10 +150627,10 @@ var xe = class extends Xt {
       if (t.mtime && !this.noMtime) {
         let a = t.atime || /* @__PURE__ */ new Date(), l = t.mtime;
         try {
-          import_node_fs13.default.futimesSync(n, a, l);
+          import_node_fs14.default.futimesSync(n, a, l);
         } catch (c) {
           try {
-            import_node_fs13.default.utimesSync(String(t.absolute), a, l);
+            import_node_fs14.default.utimesSync(String(t.absolute), a, l);
           } catch {
             h = c;
           }
@@ -150192,10 +150639,10 @@ var xe = class extends Xt {
       if (this[ge](t)) {
         let a = this[be](t), l = this[_e](t);
         try {
-          import_node_fs13.default.fchownSync(n, Number(a), Number(l));
+          import_node_fs14.default.fchownSync(n, Number(a), Number(l));
         } catch (c) {
           try {
-            import_node_fs13.default.chownSync(String(t.absolute), Number(a), Number(l));
+            import_node_fs14.default.chownSync(String(t.absolute), Number(a), Number(l));
           } catch {
             h = h || c;
           }
@@ -150211,11 +150658,11 @@ var xe = class extends Xt {
       return;
     }
     if (t.mtime && !this.noMtime) try {
-      import_node_fs13.default.utimesSync(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime);
+      import_node_fs14.default.utimesSync(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime);
     } catch {
     }
     if (this[ge](t)) try {
-      import_node_fs13.default.chownSync(String(t.absolute), Number(this[be](t)), Number(this[_e](t)));
+      import_node_fs14.default.chownSync(String(t.absolute), Number(this[be](t)), Number(this[_e](t)));
     } catch {
     }
     e(), t.resume();
@@ -150231,30 +150678,30 @@ var xe = class extends Xt {
     if (this.preservePaths || i.length === 0) return r();
     let o = e;
     for (let h of i) {
-      o = import_node_path18.default.resolve(o, h);
-      let [a, l] = ye(() => import_node_fs13.default.lstatSync(o));
+      o = import_node_path19.default.resolve(o, h);
+      let [a, l] = ye(() => import_node_fs14.default.lstatSync(o));
       if (a) return r();
-      if (l.isSymbolicLink()) return n(new St(o, import_node_path18.default.resolve(e, i.join("/"))));
+      if (l.isSymbolicLink()) return n(new St(o, import_node_path19.default.resolve(e, i.join("/"))));
     }
     r();
   }
   [gi](t, e, i, r) {
     let n = `${i}Sync`;
     try {
-      import_node_fs13.default[n](e, String(t.absolute)), r(), t.resume();
+      import_node_fs14.default[n](e, String(t.absolute)), r(), t.resume();
     } catch (o) {
       return this[O](o, t);
     }
   }
 };
 var Eo = (s3) => {
-  let t = new xe(s3), e = s3.file, i = import_node_fs12.default.statSync(e), r = s3.maxReadSize || 16 * 1024 * 1024;
+  let t = new xe(s3), e = s3.file, i = import_node_fs13.default.statSync(e), r = s3.maxReadSize || 16 * 1024 * 1024;
   new Be(e, { readSize: r, size: i.size }).pipe(t);
 };
 var wo = (s3, t) => {
   let e = new Xt(s3), i = s3.maxReadSize || 16 * 1024 * 1024, r = s3.file;
   return new Promise((o, h) => {
-    e.on("error", h), e.on("close", o), import_node_fs12.default.stat(r, (a, l) => {
+    e.on("error", h), e.on("close", o), import_node_fs13.default.stat(r, (a, l) => {
       if (a) h(a);
       else {
         let c = new _t(r, { readSize: i, size: l.size });
@@ -150270,15 +150717,15 @@ var yo = (s3, t) => {
   let e = new kt(s3), i = true, r, n;
   try {
     try {
-      r = import_node_fs16.default.openSync(s3.file, "r+");
+      r = import_node_fs17.default.openSync(s3.file, "r+");
     } catch (a) {
-      if (a?.code === "ENOENT") r = import_node_fs16.default.openSync(s3.file, "w+");
+      if (a?.code === "ENOENT") r = import_node_fs17.default.openSync(s3.file, "w+");
       else throw a;
     }
-    let o = import_node_fs16.default.fstatSync(r), h = Buffer.alloc(512);
+    let o = import_node_fs17.default.fstatSync(r), h = Buffer.alloc(512);
     t: for (n = 0; n < o.size; n += 512) {
       for (let c = 0, d = 0; c < 512; c += d) {
-        if (d = import_node_fs16.default.readSync(r, h, c, h.length - c, n + c), n === 0 && h[0] === 31 && h[1] === 139) throw new Error("cannot append to compressed archives");
+        if (d = import_node_fs17.default.readSync(r, h, c, h.length - c, n + c), n === 0 && h[0] === 31 && h[1] === 139) throw new Error("cannot append to compressed archives");
         if (!d) break t;
       }
       let a = new F(h);
@@ -150290,7 +150737,7 @@ var yo = (s3, t) => {
     i = false, Ro(s3, e, n, r, t);
   } finally {
     if (i) try {
-      import_node_fs16.default.closeSync(r);
+      import_node_fs17.default.closeSync(r);
     } catch {
     }
   }
@@ -150303,29 +150750,29 @@ var go = (s3, t) => {
   t = Array.from(t);
   let e = new wt(s3), i = (n, o, h) => {
     let a = (T2, D) => {
-      T2 ? import_node_fs16.default.close(n, (E) => h(T2)) : h(null, D);
+      T2 ? import_node_fs17.default.close(n, (E) => h(T2)) : h(null, D);
     }, l = 0;
     if (o === 0) return a(null, 0);
     let c = 0, d = Buffer.alloc(512), S2 = (T2, D) => {
       if (T2 || D === void 0) return a(T2);
-      if (c += D, c < 512 && D) return import_node_fs16.default.read(n, d, c, d.length - c, l + c, S2);
+      if (c += D, c < 512 && D) return import_node_fs17.default.read(n, d, c, d.length - c, l + c, S2);
       if (l === 0 && d[0] === 31 && d[1] === 139) return a(new Error("cannot append to compressed archives"));
       if (c < 512) return a(null, l);
       let E = new F(d);
       if (!E.cksumValid) return a(null, l);
       let x = 512 * Math.ceil((E.size ?? 0) / 512);
       if (l + x + 512 > o || (l += x + 512, l >= o)) return a(null, l);
-      s3.mtimeCache && E.mtime && s3.mtimeCache.set(String(E.path), E.mtime), c = 0, import_node_fs16.default.read(n, d, 0, 512, l, S2);
+      s3.mtimeCache && E.mtime && s3.mtimeCache.set(String(E.path), E.mtime), c = 0, import_node_fs17.default.read(n, d, 0, 512, l, S2);
     };
-    import_node_fs16.default.read(n, d, 0, 512, l, S2);
+    import_node_fs17.default.read(n, d, 0, 512, l, S2);
   };
   return new Promise((n, o) => {
     e.on("error", o);
     let h = "r+", a = (l, c) => {
-      if (l && l.code === "ENOENT" && h === "r+") return h = "w+", import_node_fs16.default.open(s3.file, h, a);
+      if (l && l.code === "ENOENT" && h === "r+") return h = "w+", import_node_fs17.default.open(s3.file, h, a);
       if (l || !c) return o(l);
-      import_node_fs16.default.fstat(c, (d, S2) => {
-        if (d) return import_node_fs16.default.close(c, () => o(d));
+      import_node_fs17.default.fstat(c, (d, S2) => {
+        if (d) return import_node_fs17.default.close(c, () => o(d));
         i(c, S2.size, (T2, D) => {
           if (T2) return o(T2);
           let E = new et(s3.file, { fd: c, start: D });
@@ -150333,16 +150780,16 @@ var go = (s3, t) => {
         });
       });
     };
-    import_node_fs16.default.open(s3.file, h, a);
+    import_node_fs17.default.open(s3.file, h, a);
   });
 };
 var bo = (s3, t) => {
   t.forEach((e) => {
-    e.charAt(0) === "@" ? Ct({ file: import_node_path22.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+    e.charAt(0) === "@" ? Ct({ file: import_node_path23.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   }), s3.end();
 };
 var _o = async (s3, t) => {
-  for (let e of t) e.charAt(0) === "@" ? await Ct({ file: import_node_path22.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+  for (let e of t) e.charAt(0) === "@" ? await Ct({ file: import_node_path23.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   s3.end();
 };
 var vt = K(yo, go, () => {
@@ -150365,19 +150812,19 @@ var To = (s3) => {
 // src/updater/unpack.ts
 async function unpackTarball(opts) {
   const { tarballPath, destDir } = opts;
-  (0, import_node_fs17.rmSync)(destDir, { recursive: true, force: true });
-  (0, import_node_fs17.mkdirSync)(destDir, { recursive: true });
+  (0, import_node_fs18.rmSync)(destDir, { recursive: true, force: true });
+  (0, import_node_fs18.mkdirSync)(destDir, { recursive: true });
   await So({ file: tarballPath, cwd: destDir });
 }
 
 // src/updater/update-log.ts
-var import_node_fs18 = require("fs");
-var import_node_path23 = require("path");
-var LOG_PATH = (0, import_node_path23.join)(THREADBASE_ROOT, "update.log");
+var import_node_fs19 = require("fs");
+var import_node_path24 = require("path");
+var LOG_PATH = (0, import_node_path24.join)(THREADBASE_ROOT, "update.log");
 function appendUpdateLog(line) {
   try {
-    (0, import_node_fs18.mkdirSync)(THREADBASE_ROOT, { recursive: true });
-    (0, import_node_fs18.appendFileSync)(LOG_PATH, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs19.mkdirSync)(THREADBASE_ROOT, { recursive: true });
+    (0, import_node_fs19.appendFileSync)(LOG_PATH, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `, "utf8");
   } catch {
   }
@@ -150448,7 +150895,7 @@ async function runInstall(opts) {
     }
   }
   ensureReleasesDir();
-  (0, import_node_fs19.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
+  (0, import_node_fs20.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
   const tarballPath = downloadPath(targetVersion, artifact.filename);
   await downloadAndVerify({ manifest, assets: target.assets, targetPath: tarballPath });
   const destDir = releaseDir(targetVersion);
@@ -150482,7 +150929,7 @@ async function runInstall(opts) {
 
 // cli/prod.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs21 = require("fs");
+var import_node_fs22 = require("fs");
 init_constants();
 init_launchd();
 init_marker();
@@ -150568,7 +151015,7 @@ async function runProdDoctor(opts) {
   return { findings, repairs };
 }
 var defaultSpawnTail = ({ files, lines, follow }) => {
-  const existing = files.filter((f2) => (0, import_node_fs21.existsSync)(f2));
+  const existing = files.filter((f2) => (0, import_node_fs22.existsSync)(f2));
   if (existing.length === 0) {
     return Promise.resolve({
       ok: false,
@@ -150840,12 +151287,12 @@ program2.command("cache").description("Manage the local SQLite conversation cach
     "Cache directory (default: ~/.threadbase/cache)",
     `${process.env.HOME}/.threadbase/cache`
   ).action((opts) => {
-    const { rmSync: rmSync6, existsSync: existsSync12 } = require("fs");
-    const { join: join26 } = require("path");
-    const dbPath = join26(opts.cacheDir, "cache.db");
+    const { rmSync: rmSync6, existsSync: existsSync13 } = require("fs");
+    const { join: join28 } = require("path");
+    const dbPath = join28(opts.cacheDir, "cache.db");
     for (const suffix of ["", "-shm", "-wal"]) {
       const f2 = dbPath + suffix;
-      if (existsSync12(f2)) {
+      if (existsSync13(f2)) {
         rmSync6(f2);
         log7.info(`Deleted ${f2}`, { path: f2 }, "console");
       }