@trops/dash-core 0.1.629 → 0.1.631

package/dist/electron/index.js

@@ -1184,7 +1184,7 @@ var secureStoreController$1 = {
   decryptString,
 };
 
-const path$p = require$$1$2;
+const path$q = require$$1$2;
 const {
   readFileSync,
   writeFileSync: writeFileSync$3,
@@ -1202,7 +1202,7 @@ const {
 function ensureDirectoryExistence$1(filePath) {
   try {
     // isDirectory
-    var dirname = path$p.dirname(filePath);
+    var dirname = path$q.dirname(filePath);
     // check if the directory exists...return true
     // if not, we can pass in the dirname as the filepath
     // and check each directory recursively.
@@ -1317,7 +1317,7 @@ function removeFilesFromDirectory(directory, excludeFiles = []) {
 
       for (const file of files) {
         if (!excludeFiles.includes(file)) {
-          unlinkSync(path$p.join(directory, file), (err) => {
+          unlinkSync(path$q.join(directory, file), (err) => {
             if (err) throw err;
           });
         }
@@ -1335,7 +1335,7 @@ var file = {
 };
 
 const { app: app$g } = require$$0$2;
-const path$o = require$$1$2;
+const path$p = require$$1$2;
 const { writeFileSync: writeFileSync$2 } = require$$0$3;
 const { getFileContents: getFileContents$7 } = file;
 
@@ -1382,7 +1382,7 @@ const workspaceController$3 = {
   saveWorkspaceForApplication: (win, appId, workspaceObject) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$o.join(
+      const filename = path$p.join(
         app$g.getPath("userData"),
         appName$7,
         appId,
@@ -1431,7 +1431,7 @@ const workspaceController$3 = {
   saveMenuItemsForApplication: (win, appId, menuItems) => {
     try {
       // filename to the workspaces file
-      const filename = path$o.join(
+      const filename = path$p.join(
         app$g.getPath("userData"),
         appName$7,
         appId,
@@ -1480,7 +1480,7 @@ const workspaceController$3 = {
    */
   deleteWorkspaceForApplication: (win, appId, workspaceId) => {
     try {
-      const filename = path$o.join(
+      const filename = path$p.join(
         app$g.getPath("userData"),
         appName$7,
         appId,
@@ -1514,7 +1514,7 @@ const workspaceController$3 = {
 
   listWorkspacesForApplication: (win, appId) => {
     try {
-      const filename = path$o.join(
+      const filename = path$p.join(
         app$g.getPath("userData"),
         appName$7,
         appId,
@@ -1542,7 +1542,7 @@ const workspaceController$3 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$o.join(
+      const filename = path$p.join(
         app$g.getPath("userData"),
         appName$7,
         appId,
@@ -1587,7 +1587,7 @@ const workspaceController$3 = {
 var workspaceController_1 = workspaceController$3;
 
 const { app: app$f } = require$$0$2;
-const path$n = require$$1$2;
+const path$o = require$$1$2;
 const { writeFileSync: writeFileSync$1 } = require$$0$3;
 const { getFileContents: getFileContents$6 } = file;
 
@@ -1607,7 +1607,7 @@ const themeController$5 = {
   saveThemeForApplication: (win, appId, name, obj) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$n.join(
+      const filename = path$o.join(
         app$f.getPath("userData"),
         appName$6,
         appId,
@@ -1653,7 +1653,7 @@ const themeController$5 = {
    */
   listThemesForApplication: (win, appId) => {
     try {
-      const filename = path$n.join(
+      const filename = path$o.join(
         app$f.getPath("userData"),
         appName$6,
         appId,
@@ -1695,7 +1695,7 @@ const themeController$5 = {
    */
   deleteThemeForApplication: (win, appId, themeKey) => {
     try {
-      const filename = path$n.join(
+      const filename = path$o.join(
         app$f.getPath("userData"),
         appName$6,
         appId,
@@ -1772,7 +1772,7 @@ var themeController_1 = themeController$5;
  *      `/data/`.
  */
 
-const path$m = require$$1$2;
+const path$n = require$$1$2;
 const fs$i = require$$0$3;
 const { app: app$e } = require$$0$2;
 
@@ -1786,7 +1786,7 @@ function getAllowedRoots$2(category) {
   const userData = app$e.getPath("userData");
   switch (category) {
     case "data": {
-      const def = path$m.join(userData, APP_NAME, "data");
+      const def = path$n.join(userData, APP_NAME, "data");
       // The user can configure a custom data directory in
       // Settings → General → Data Directory. If set, that
       // location is ALSO an allowed root. We don't replace the
@@ -1796,11 +1796,11 @@ function getAllowedRoots$2(category) {
       return override ? [def, override] : [def];
     }
     case "themes":
-      return [path$m.join(userData, APP_NAME, "themes")];
+      return [path$n.join(userData, APP_NAME, "themes")];
     case "widgets":
-      return [path$m.join(userData, "widgets")];
+      return [path$n.join(userData, "widgets")];
     case "plugins":
-      return [path$m.join(userData, "plugins")];
+      return [path$n.join(userData, "plugins")];
     case "downloads":
       return [app$e.getPath("downloads")];
     default:
@@ -1817,7 +1817,7 @@ function getAllowedRoots$2(category) {
  */
 function readDataDirectoryFromSettings() {
   try {
-    const settingsPath = path$m.join(
+    const settingsPath = path$n.join(
       app$e.getPath("userData"),
       APP_NAME,
       "settings.json",
@@ -1849,7 +1849,7 @@ function safePath$4(requested, allowedRoots) {
     throw new Error("safePath: allowedRoots must be a non-empty array");
   }
 
-  const resolved = path$m.resolve(requested);
+  const resolved = path$n.resolve(requested);
 
   // Real-path through symlinks. If the file doesn't exist yet (a
   // create-new operation), real-path the parent so a symlink in the
@@ -1859,8 +1859,8 @@ function safePath$4(requested, allowedRoots) {
     real = fs$i.realpathSync(resolved);
   } catch (_e) {
     try {
-      const parent = fs$i.realpathSync(path$m.dirname(resolved));
-      real = path$m.join(parent, path$m.basename(resolved));
+      const parent = fs$i.realpathSync(path$n.dirname(resolved));
+      real = path$n.join(parent, path$n.basename(resolved));
     } catch (_e2) {
       // Parent doesn't exist either. Use the resolved-but-not-
       // real path; the caller's mkdirSync will happen inside the
@@ -1879,7 +1879,7 @@ function safePath$4(requested, allowedRoots) {
     }
     // Exact match OR strictly-inside (with separator to prevent
     // /data-evil/ matching /data/).
-    if (real === realRoot || real.startsWith(realRoot + path$m.sep)) {
+    if (real === realRoot || real.startsWith(realRoot + path$n.sep)) {
       return real;
     }
   }
@@ -1941,7 +1941,7 @@ var safePath_1 = {
  */
 
 const fs$h = require$$0$3;
-const path$l = require$$1$2;
+const path$m = require$$1$2;
 const { app: app$d } = require$$0$2;
 
 const FILE_NAME = "widgetMcpGrants.json";
@@ -1951,7 +1951,7 @@ const FILE_NAME = "widgetMcpGrants.json";
 let _cache$1 = null;
 
 function grantsFilePath() {
-  return path$l.join(app$d.getPath("userData"), FILE_NAME);
+  return path$m.join(app$d.getPath("userData"), FILE_NAME);
 }
 
 function loadFromDisk() {
@@ -1978,7 +1978,7 @@ function writeToDisk(data) {
   const tmp = p + ".tmp";
   // Ensure parent dir exists (userData should already, but be defensive
   // for first-launch / freshly-cleared profile cases).
-  fs$h.mkdirSync(path$l.dirname(p), { recursive: true });
+  fs$h.mkdirSync(path$m.dirname(p), { recursive: true });
   fs$h.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf8");
   fs$h.renameSync(tmp, p);
 }
@@ -2687,7 +2687,7 @@ function commonjsRequire(path) {
  */
 
 const fs$g = require$$0$3;
-const path$k = require$$1$2;
+const path$l = require$$1$2;
 
 /**
  * Structured error thrown by compileWidget() when the underlying
@@ -2722,7 +2722,7 @@ function getEsbuildDiagnostics() {
 
   try {
     const pkgJsonPath = require.resolve("esbuild/package.json");
-    diagnostics.esbuildPackageDir = path$k.dirname(pkgJsonPath);
+    diagnostics.esbuildPackageDir = path$l.dirname(pkgJsonPath);
     diagnostics.esbuildVersion = commonjsRequire(pkgJsonPath).version;
   } catch (err) {
     diagnostics.esbuildResolveError = err.message;
@@ -2732,13 +2732,13 @@ function getEsbuildDiagnostics() {
     const archPkgJson = require.resolve(
       `${diagnostics.archPackage}/package.json`,
     );
-    const archDir = path$k.dirname(archPkgJson);
+    const archDir = path$l.dirname(archPkgJson);
     // esbuild's native binary on macOS/Linux is bin/esbuild;
     // on Windows it's esbuild.exe at the package root.
     const candidate =
       process.platform === "win32"
-        ? path$k.join(archDir, "esbuild.exe")
-        : path$k.join(archDir, "bin", "esbuild");
+        ? path$l.join(archDir, "esbuild.exe")
+        : path$l.join(archDir, "bin", "esbuild");
     diagnostics.nativeBinaryPath = candidate;
     diagnostics.nativeBinaryExists = fs$g.existsSync(candidate);
   } catch (err) {
@@ -2786,19 +2786,19 @@ async function healthCheck() {
  * @returns {string|null} Path to the widgets/ directory, or null
  */
 function findWidgetsDir$2(widgetPath) {
-  const direct = path$k.join(widgetPath, "widgets");
+  const direct = path$l.join(widgetPath, "widgets");
   if (fs$g.existsSync(direct)) {
     return direct;
   }
 
   // Check configs/widgets/ (packageZip.js nests .dash.js files here)
-  const configsWidgets = path$k.join(widgetPath, "configs", "widgets");
+  const configsWidgets = path$l.join(widgetPath, "configs", "widgets");
   if (fs$g.existsSync(configsWidgets)) {
     return configsWidgets;
   }
 
   // Check configs/ directory (used by packageZip.js for distributed widgets)
-  const configs = path$k.join(widgetPath, "configs");
+  const configs = path$l.join(widgetPath, "configs");
   if (fs$g.existsSync(configs)) {
     return configs;
   }
@@ -2815,7 +2815,7 @@ function findWidgetsDir$2(widgetPath) {
     );
 
     for (const subdir of subdirs) {
-      const nested = path$k.join(widgetPath, subdir.name, "widgets");
+      const nested = path$l.join(widgetPath, subdir.name, "widgets");
       if (fs$g.existsSync(nested)) {
         console.log(`[WidgetCompiler] Found nested widgets/ at ${nested}`);
         return nested;
@@ -2864,14 +2864,14 @@ async function compileWidget$1(widgetPath) {
   // Compute relative path from the entry file (in widgetPath) to widgetsDir,
   // since widgetsDir may be nested (e.g., ./weather-widget/widgets/).
   const relWidgetsDir =
-    "./" + path$k.relative(widgetPath, widgetsDir).split(path$k.sep).join("/");
+    "./" + path$l.relative(widgetPath, widgetsDir).split(path$l.sep).join("/");
   const imports = [];
   const exportParts = [];
 
   for (const dashFile of dashFiles) {
     const componentName = dashFile.replace(".dash.js", "");
     const componentFile = `${componentName}.js`;
-    const componentFilePath = path$k.join(widgetsDir, componentFile);
+    const componentFilePath = path$l.join(widgetsDir, componentFile);
     const hasComponent = fs$g.existsSync(componentFilePath);
 
     // Import the config (always)
@@ -2904,9 +2904,9 @@ async function compileWidget$1(widgetPath) {
   const entryContent = [...imports, "", ...exportParts, ""].join("\n");
 
   // Write temporary entry file in the widget root
-  const entryPath = path$k.join(widgetPath, "__compile_entry.js");
-  const distDir = path$k.join(widgetPath, "dist");
-  const outPath = path$k.join(distDir, "index.cjs.js");
+  const entryPath = path$l.join(widgetPath, "__compile_entry.js");
+  const distDir = path$l.join(widgetPath, "dist");
+  const outPath = path$l.join(distDir, "index.cjs.js");
 
   try {
     // Ensure dist/ directory exists
@@ -9525,7 +9525,7 @@ var dashConfigParser = { parseDashConfig: parseDashConfig$1, DashConfigParseErro
  */
 
 const fs$f = require$$0$3;
-const path$j = require$$1$2;
+const path$k = require$$1$2;
 const { findWidgetsDir: findWidgetsDir$1 } = widgetCompiler$1;
 const { parseDashConfig } = dashConfigParser;
 
@@ -9566,9 +9566,9 @@ class DynamicWidgetLoader {
       );
 
       const widgetsDir =
-        findWidgetsDir$1(widgetPath) || path$j.join(widgetPath, "widgets");
-      const componentPath = path$j.join(widgetsDir, `${componentName}.js`);
-      const configPath = path$j.join(widgetsDir, `${componentName}.dash.js`);
+        findWidgetsDir$1(widgetPath) || path$k.join(widgetPath, "widgets");
+      const componentPath = path$k.join(widgetsDir, `${componentName}.js`);
+      const configPath = path$k.join(widgetsDir, `${componentName}.dash.js`);
 
       if (!fs$f.existsSync(componentPath)) {
         throw new Error(`Component file not found: ${componentPath}`);
@@ -10246,7 +10246,7 @@ var registryAuthController$2 = {
  */
 
 const fs$e = require$$0$3;
-const path$i = require$$1$2;
+const path$j = require$$1$2;
 const os$3 = require$$2;
 const { app: app$c } = require$$0$2;
 
@@ -10263,7 +10263,7 @@ function expandHome(p) {
   if (typeof p !== "string" || !p) return p;
   if (p === "~") return os$3.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path$i.join(os$3.homedir(), p.slice(2));
+    return path$j.join(os$3.homedir(), p.slice(2));
   }
   return p;
 }
@@ -10373,10 +10373,10 @@ function dottedComponentIdToPackageId(widgetId) {
 function resolveWidgetPackagePath(widgetId) {
   const packageId = dottedComponentIdToPackageId(widgetId);
   if (typeof packageId !== "string" || !packageId) return null;
-  const widgetsRoot = path$i.join(app$c.getPath("userData"), "widgets");
+  const widgetsRoot = path$j.join(app$c.getPath("userData"), "widgets");
   // Split scope from name for "@scope/name" form.
   const parts = packageId.startsWith("@") ? packageId.split("/") : [packageId];
-  return path$i.join(widgetsRoot, ...parts, "package.json");
+  return path$j.join(widgetsRoot, ...parts, "package.json");
 }
 
 /**
@@ -10468,7 +10468,7 @@ var widgetPermissions = {
  */
 
 const fs$d = require$$0$3;
-const path$h = require$$1$2;
+const path$i = require$$1$2;
 
 const SOURCE_EXTENSIONS = new Set([
   ".js",
@@ -10526,13 +10526,13 @@ function readSourceFiles(dir) {
       return;
     }
     for (const entry of entries) {
-      const abs = path$h.join(current, entry.name);
-      const rel = relBase ? path$h.join(relBase, entry.name) : entry.name;
+      const abs = path$i.join(current, entry.name);
+      const rel = relBase ? path$i.join(relBase, entry.name) : entry.name;
       if (entry.isDirectory()) {
         if (skipDirs.has(entry.name)) continue;
         walk(abs, rel);
       } else if (entry.isFile()) {
-        const ext = path$h.extname(entry.name).toLowerCase();
+        const ext = path$i.extname(entry.name).toLowerCase();
         if (!SOURCE_EXTENSIONS.has(ext)) continue;
         if (result.length >= SCAN_FILE_LIMIT) return;
         try {
@@ -10558,7 +10558,7 @@ function scanForMcpUsage(input) {
   let fileList = [];
   if (input.files && typeof input.files === "object") {
     for (const [relPath, source] of Object.entries(input.files)) {
-      const ext = path$h.extname(relPath).toLowerCase();
+      const ext = path$i.extname(relPath).toLowerCase();
       if (!SOURCE_EXTENSIONS.has(ext)) continue;
       if (typeof source !== "string") continue;
       fileList.push({ relPath, source });
@@ -10671,7 +10671,7 @@ var manifestScanner = {
  */
 
 const fs$c = require$$0$3;
-const path$g = require$$1$2;
+const path$h = require$$1$2;
 const { safePath: safePath$3 } = safePath_1;
 
 const NAME_RE = /^@?[a-z0-9][a-z0-9.-]*(\/[a-z0-9][a-z0-9.-]*)?$/i;
@@ -10692,8 +10692,8 @@ function loadWidgetManifest(folderPath) {
     return { ok: false, error: `folder does not exist: ${folderPath}` };
   }
 
-  const dashJsonPath = path$g.join(folderPath, "dash.json");
-  const packageJsonPath = path$g.join(folderPath, "package.json");
+  const dashJsonPath = path$h.join(folderPath, "dash.json");
+  const packageJsonPath = path$h.join(folderPath, "package.json");
 
   let raw;
   let source;
@@ -10764,7 +10764,7 @@ function loadWidgetManifest(folderPath) {
 
   // entry: optional with sensible default. Validate when present.
   let entry = typeof raw.entry === "string" ? raw.entry : "widgets";
-  if (path$g.isAbsolute(entry) || entry.split(/[/\\]/).includes("..")) {
+  if (path$h.isAbsolute(entry) || entry.split(/[/\\]/).includes("..")) {
     return {
       ok: false,
       error: "manifest.entry must be relative and must not contain `..`",
@@ -10775,15 +10775,15 @@ function loadWidgetManifest(folderPath) {
     // folder root after realpath. If the entry doesn't yet exist on
     // disk (common during validate-only flows), fall back to a plain
     // resolve-and-prefix check.
-    const candidate = path$g.join(folderPath, entry);
+    const candidate = path$h.join(folderPath, entry);
     if (fs$c.existsSync(candidate)) {
       safePath$3(candidate, [folderPath]);
     } else {
-      const resolved = path$g.resolve(candidate);
-      const rootResolved = path$g.resolve(folderPath);
+      const resolved = path$h.resolve(candidate);
+      const rootResolved = path$h.resolve(folderPath);
       if (
         resolved !== rootResolved &&
-        !resolved.startsWith(rootResolved + path$g.sep)
+        !resolved.startsWith(rootResolved + path$h.sep)
       ) {
         return {
           ok: false,
@@ -10862,7 +10862,7 @@ function walkSourceContainment(rootPath) {
     const stat = fs$c.lstatSync(current);
     if (stat.isDirectory()) {
       for (const entry of fs$c.readdirSync(current)) {
-        stack.push(path$g.join(current, entry));
+        stack.push(path$h.join(current, entry));
       }
     }
     // Symlinks: lstat gives us the symlink-itself; safePath above
@@ -17464,7 +17464,7 @@ function requireTransform () {
 
 const { app: app$b } = require$$0$2;
 var fs$b = require$$0$3;
-const path$f = require$$1$2;
+const path$g = require$$1$2;
 const events$5 = events$8;
 const { getFileContents: getFileContents$5, writeToFile: writeToFile$2 } = file;
 const { safePath: safePath$2, getAllowedRoots: getAllowedRoots$1 } = safePath_1;
@@ -17481,7 +17481,7 @@ const { readEnforceFlag: readEnforceFlag$2, readJitFlag: readJitFlag$2 } = secur
 // domain-neutral name is a separate slice).
 function _loadFlags$1() {
   try {
-    const settingsPath = path$f.join(
+    const settingsPath = path$g.join(
       app$b.getPath("userData"),
       appName$5,
       "settings.json",
@@ -17567,7 +17567,7 @@ const dataController$1 = {
       // Validate the renderer-supplied filename is contained within
       // the data directory. path.join doesn't reject `..` segments;
       // safePath does.
-      const candidate = path$f.join(
+      const candidate = path$g.join(
         app$b.getPath("userData"),
         appName$5,
         appId,
@@ -17928,7 +17928,7 @@ const dataController$1 = {
       if (data) {
         // Validate filename is contained within the data directory.
         // path.join doesn't reject `..` segments; safePath does.
-        const candidate = path$f.join(
+        const candidate = path$g.join(
           app$b.getPath("userData"),
           appName$5,
           "data",
@@ -18037,7 +18037,7 @@ const dataController$1 = {
     try {
       if (filename) {
         // filename to the pages file (live pages)
-        const fromFilename = path$f.join(
+        const fromFilename = path$g.join(
           app$b.getPath("userData"),
           appName$5,
           "data",
@@ -18275,7 +18275,7 @@ var migrations = {
  */
 
 const { app: app$a } = require$$0$2;
-const path$e = require$$1$2;
+const path$f = require$$1$2;
 const fs$a = require$$0$3;
 const { getFileContents: getFileContents$4, writeToFile: writeToFile$1 } = file;
 const { migrateSettings, CURRENT_SCHEMA_VERSION: CURRENT_SCHEMA_VERSION$2 } = migrations;
@@ -18291,8 +18291,8 @@ function copyDirectory(source, destination) {
 
   const files = fs$a.readdirSync(source);
   for (const file of files) {
-    const srcPath = path$e.join(source, file);
-    const destPath = path$e.join(destination, file);
+    const srcPath = path$f.join(source, file);
+    const destPath = path$f.join(destination, file);
     const stat = fs$a.lstatSync(srcPath);
 
     // Skip symlinks to prevent following links to sensitive files
@@ -18320,7 +18320,7 @@ const settingsController$4 = {
     try {
       if (data) {
         // <appId>/settings.json
-        const filename = path$e.join(
+        const filename = path$f.join(
           app$a.getPath("userData"),
           appName$4,
           configFilename$3,
@@ -18364,7 +18364,7 @@ const settingsController$4 = {
   getSettingsForApplication: (win) => {
     try {
       // <appId>/settings.json
-      const filename = path$e.join(
+      const filename = path$f.join(
         app$a.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -18412,7 +18412,7 @@ const settingsController$4 = {
    */
   getDataDirectory: (win) => {
     try {
-      const settingsPath = path$e.join(
+      const settingsPath = path$f.join(
         app$a.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -18420,7 +18420,7 @@ const settingsController$4 = {
       const settings = getFileContents$4(settingsPath, {});
       const userDataDir =
         settings.userDataDirectory ||
-        path$e.join(app$a.getPath("userData"), appName$4);
+        path$f.join(app$a.getPath("userData"), appName$4);
 
       console.log("[settingsController] Data directory retrieved successfully");
       // Return the data for ipcMain.handle() - modern promise-based approach
@@ -18457,7 +18457,7 @@ const settingsController$4 = {
       }
 
       // Update settings
-      const settingsPath = path$e.join(
+      const settingsPath = path$f.join(
         app$a.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -18491,11 +18491,11 @@ const settingsController$4 = {
   migrateDataDirectory: (win, oldPath, newPath) => {
     try {
       // Resolve paths to prevent traversal
-      const resolvedOldPath = path$e.resolve(oldPath);
-      const resolvedNewPath = path$e.resolve(newPath);
+      const resolvedOldPath = path$f.resolve(oldPath);
+      const resolvedNewPath = path$f.resolve(newPath);
 
       // Validate oldPath is the current configured data directory
-      const settingsCheckPath = path$e.join(
+      const settingsCheckPath = path$f.join(
         app$a.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -18503,8 +18503,8 @@ const settingsController$4 = {
       const currentSettings = getFileContents$4(settingsCheckPath, {});
       const currentDataDir =
         currentSettings.userDataDirectory ||
-        path$e.join(app$a.getPath("userData"), appName$4);
-      if (resolvedOldPath !== path$e.resolve(currentDataDir)) {
+        path$f.join(app$a.getPath("userData"), appName$4);
+      if (resolvedOldPath !== path$f.resolve(currentDataDir)) {
         throw new Error("Source path must be the current data directory");
       }
 
@@ -18540,7 +18540,7 @@ const settingsController$4 = {
       copyDirectory(resolvedOldPath, resolvedNewPath);
 
       // Update settings to use new path
-      const settingsPath = path$e.join(
+      const settingsPath = path$f.join(
         app$a.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -19294,7 +19294,7 @@ function requireProviderController () {
 }
 
 const { app: app$9 } = require$$0$2;
-const path$d = require$$1$2;
+const path$e = require$$1$2;
 const events$4 = events$8;
 const { getFileContents: getFileContents$3 } = file;
 
@@ -19310,7 +19310,7 @@ const layoutController$1 = {
    */
   listLayoutsForApplication: (win, appId) => {
     try {
-      const filename = path$d.join(
+      const filename = path$e.join(
         app$9.getPath("userData"),
         appName$3,
         appId,
@@ -37571,7 +37571,7 @@ const {
 const {
   StreamableHTTPClientTransport,
 } = streamableHttp$1;
-const path$c = require$$1$2;
+const path$d = require$$1$2;
 const fs$9 = require$$0$3;
 const os$2 = require$$2;
 const responseCache$2 = responseCache_1;
@@ -37588,7 +37588,7 @@ const { app: app$8 } = require$$0$2;
  */
 function loadSettingsForFlags() {
   try {
-    const settingsPath = path$c.join(
+    const settingsPath = path$d.join(
       app$8.getPath("userData"),
       "Dashboard",
       "settings.json",
@@ -38234,7 +38234,7 @@ const mcpController$3 = {
           }
 
           // Interpolate {{MCP_DIR}} in args to resolve local MCP server scripts
-          const mcpDir = path$c.join(__dirname, "..", "mcp");
+          const mcpDir = path$d.join(__dirname, "..", "mcp");
           for (let i = 0; i < args.length; i++) {
             if (
               typeof args[i] === "string" &&
@@ -38779,7 +38779,7 @@ const mcpController$3 = {
    */
   getCatalog: (win) => {
     try {
-      const catalogPath = path$c.join(
+      const catalogPath = path$d.join(
         __dirname,
         "..",
         "mcp",
@@ -38820,7 +38820,7 @@ const mcpController$3 = {
    */
   getKnownExternalCatalog: () => {
     try {
-      const catalogPath = path$c.join(
+      const catalogPath = path$d.join(
         __dirname,
         "..",
         "mcp",
@@ -38933,7 +38933,7 @@ const mcpController$3 = {
     }
 
     // Interpolate {{MCP_DIR}} in authCommand args (same as startServer)
-    const mcpDir = path$c.join(__dirname, "..", "mcp");
+    const mcpDir = path$d.join(__dirname, "..", "mcp");
     const resolvedArgs = (authCommand.args || []).map((arg) =>
       typeof arg === "string" && arg.includes("{{MCP_DIR}}")
         ? arg.replace(/\{\{MCP_DIR\}\}/g, mcpDir)
@@ -39065,7 +39065,7 @@ var mcpControllerExports = mcpController$4.exports;
  * - Support two-level browsing: packages (bundles) and widgets within packages
  */
 
-const path$b = require$$1$2;
+const path$c = require$$1$2;
 const fs$8 = require$$0$3;
 const os$1 = require$$2;
 const { toPackageId } = packageId;
@@ -39091,7 +39091,7 @@ function getCacheKey() {
  * Get the local test registry path for dev mode
  */
 function getTestRegistryPath() {
-  return path$b.join(__dirname, "..", "registry", "test-registry-index.json");
+  return path$c.join(__dirname, "..", "registry", "test-registry-index.json");
 }
 
 /**
@@ -39707,7 +39707,7 @@ async function fetchPackageSource(packageName, componentName = null) {
 
   const zip = new AdmZip(buffer);
   const safeName = (pkg.name || "pkg").replace(/[^a-zA-Z0-9-_]/g, "_");
-  const tempDir = path$b.join(
+  const tempDir = path$c.join(
     os$1.tmpdir(),
     `dash-registry-preview-${safeName}-${Date.now()}`,
   );
@@ -39716,7 +39716,7 @@ async function fetchPackageSource(packageName, componentName = null) {
     validateZipEntries(zip, tempDir);
     zip.extractAllTo(tempDir, true);
 
-    const widgetsDir = path$b.join(tempDir, "widgets");
+    const widgetsDir = path$c.join(tempDir, "widgets");
     let componentCode = "";
     let configCode = "";
     let widgetName = null;
@@ -39744,7 +39744,7 @@ async function fetchPackageSource(packageName, componentName = null) {
       if (!configFile) configFile = dashFiles[0];
 
       if (configFile) {
-        configCode = fs$8.readFileSync(path$b.join(widgetsDir, configFile), "utf8");
+        configCode = fs$8.readFileSync(path$c.join(widgetsDir, configFile), "utf8");
         widgetName = configFile.replace(/\.dash\.js$/, "");
       }
 
@@ -39759,7 +39759,7 @@ async function fetchPackageSource(packageName, componentName = null) {
 
       if (componentFile) {
         componentCode = fs$8.readFileSync(
-          path$b.join(widgetsDir, componentFile),
+          path$c.join(widgetsDir, componentFile),
           "utf8",
         );
         if (!widgetName) widgetName = componentFile.replace(/\.js$/, "");
@@ -39767,13 +39767,13 @@ async function fetchPackageSource(packageName, componentName = null) {
     }
 
     let bundleSource = null;
-    const bundlePath = path$b.join(tempDir, "dist", "index.cjs.js");
+    const bundlePath = path$c.join(tempDir, "dist", "index.cjs.js");
     if (fs$8.existsSync(bundlePath)) {
       bundleSource = fs$8.readFileSync(bundlePath, "utf8");
     }
 
     let dashMeta = {};
-    const dashPath = path$b.join(tempDir, "dash.json");
+    const dashPath = path$c.join(tempDir, "dash.json");
     if (fs$8.existsSync(dashPath)) {
       try {
         dashMeta = JSON.parse(fs$8.readFileSync(dashPath, "utf8"));
@@ -39886,7 +39886,7 @@ async function fetchPackageManifest(packageName) {
 
   const zip = new AdmZip(buffer);
   const safeName = (pkg.name || "pkg").replace(/[^a-zA-Z0-9-_]/g, "_");
-  const tempDir = path$b.join(
+  const tempDir = path$c.join(
     os$1.tmpdir(),
     `dash-registry-manifest-${safeName}-${Date.now()}`,
   );
@@ -39955,7 +39955,7 @@ var registryController$3 = {
 var fs$7 = require$$0$3;
 var JSONStream = require$$4$1;
 const algoliasearch$1 = require$$2$2;
-const path$a = require$$3$2;
+const path$b = require$$3$2;
 const { ensureDirectoryExistence, checkDirectory } = file;
 
 let AlgoliaIndex$1 = class AlgoliaIndex {
@@ -40062,7 +40062,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
           if (err) reject(err);
           if (files) {
             files.forEach((file) => {
-              fs$7.unlinkSync(path$a.join(directoryPath, file));
+              fs$7.unlinkSync(path$b.join(directoryPath, file));
             });
             resolve();
           }
@@ -40085,7 +40085,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
       let results = [];
       for (const fileIndex in files) {
         // for each file lets read the file and then push to algolia
-        const pathToBatch = path$a.join(batchFilepath, files[fileIndex]);
+        const pathToBatch = path$b.join(batchFilepath, files[fileIndex]);
         const fileContents = await this.readFile(pathToBatch);
         if (fileContents) {
           if ("data" in fileContents && "filepath" in fileContents) {
@@ -40623,7 +40623,7 @@ function upsertMenuItem$1(items, menuItem) {
 var upsertMenuItem_1 = { upsertMenuItem: upsertMenuItem$1 };
 
 const { app: app$7 } = require$$0$2;
-const path$9 = require$$1$2;
+const path$a = require$$1$2;
 const { writeFileSync } = require$$0$3;
 const { getFileContents: getFileContents$2 } = file;
 const { upsertMenuItem } = upsertMenuItem_1;
@@ -40634,7 +40634,7 @@ const appName$2 = "Dashboard";
 const menuItemsController$1 = {
   saveMenuItemForApplication: (win, appId, menuItem) => {
     try {
-      const filename = path$9.join(
+      const filename = path$a.join(
         app$7.getPath("userData"),
         appName$2,
         appId,
@@ -40653,7 +40653,7 @@ const menuItemsController$1 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$9.join(
+      const filename = path$a.join(
         app$7.getPath("userData"),
         appName$2,
         appId,
@@ -59028,7 +59028,7 @@ streamableHttp.StreamableHTTPServerTransport = StreamableHTTPServerTransport$1;
  */
 
 const fs$5 = require$$0$3;
-const path$8 = require$$1$2;
+const path$9 = require$$1$2;
 const forge = require$$2$4;
 
 /**
@@ -59037,8 +59037,8 @@ const forge = require$$2$4;
  * @returns {{ cert: string, key: string }} PEM-encoded certificate and private key
  */
 function getOrCreateCert$1(certsDir) {
-  const certPath = path$8.join(certsDir, "cert.pem");
-  const keyPath = path$8.join(certsDir, "key.pem");
+  const certPath = path$9.join(certsDir, "cert.pem");
+  const keyPath = path$9.join(certsDir, "key.pem");
 
   // Return existing cert if valid
   if (fs$5.existsSync(certPath) && fs$5.existsSync(keyPath)) {
@@ -68586,7 +68586,7 @@ var publisherKeyController$1 = {
  */
 
 const fs$4 = require$$0$3;
-const path$7 = require$$1$2;
+const path$8 = require$$1$2;
 const { getStoredToken: getStoredToken$2 } = registryAuthController$2;
 const { signZipBuffer: signZipBuffer$1 } = publisherKeyController$1;
 
@@ -68648,7 +68648,7 @@ async function publishToRegistry$1(zipPath, manifest) {
     formData.append(
       "file",
       new Blob([zipBuffer], { type: "application/zip" }),
-      path$7.basename(zipPath),
+      path$8.basename(zipPath),
     );
     formData.append("manifest", JSON.stringify(manifest));
     formData.append("signature", signing.signature);
@@ -68935,7 +68935,7 @@ function requireWidgetPublishManifest () {
  * Mirrors dashboardConfigController patterns for ZIP creation, manifest generation,
  * and registry interaction.
  */
-const path$6 = require$$1$2;
+const path$7 = require$$1$2;
 const { app: app$5, dialog: dialog$2 } = require$$0$2;
 const AdmZip$2 = require$$5;
 
@@ -69483,7 +69483,7 @@ async function installThemeFromRegistry$1(win, appId, packageName) {
       // Validate entry path (security: prevent path traversal)
       if (
         themeEntry.entryName.includes("..") ||
-        path$6.isAbsolute(themeEntry.entryName)
+        path$7.isAbsolute(themeEntry.entryName)
       ) {
         return {
           success: false,
@@ -69717,7 +69717,7 @@ var themeRegistryController$1 = {
  */
 
 const { app: app$4, dialog: dialog$1 } = require$$0$2;
-const path$5 = require$$1$2;
+const path$6 = require$$1$2;
 const AdmZip$1 = require$$5;
 const { getFileContents: getFileContents$1 } = file;
 const {
@@ -69766,7 +69766,7 @@ async function exportDashboardConfig$1(
 ) {
   try {
     // 1. Read workspace from workspaces.json
-    const filename = path$5.join(
+    const filename = path$6.join(
       app$4.getPath("userData"),
       appName$1,
       appId,
@@ -69880,7 +69880,7 @@ async function exportDashboardConfig$1(
 
     const { canceled, filePath } = await dialog$1.showSaveDialog(win, {
       title: "Export Dashboard as ZIP",
-      defaultPath: path$5.join(
+      defaultPath: path$6.join(
         app$4.getPath("desktop"),
         `dashboard-${sanitizedName}.zip`,
       ),
@@ -69946,7 +69946,7 @@ async function selectDashboardFile$1(win) {
 
     // Extract and validate
     const zip = new AdmZip$1(zipPath);
-    const tempDir = path$5.join(app$4.getPath("temp"), "dash-import");
+    const tempDir = path$6.join(app$4.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -70056,7 +70056,7 @@ async function importDashboardConfig$1(
     const zip = new AdmZip$1(zipPath);
 
     // Validate ZIP entries for path traversal
-    const tempDir = path$5.join(app$4.getPath("temp"), "dash-import");
+    const tempDir = path$6.join(app$4.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -70696,7 +70696,7 @@ async function installDashboardFromRegistry$1(
     const zip = new AdmZip$1(zipBuffer);
 
     // 3. Validate ZIP entries
-    const tempDir = path$5.join(app$4.getPath("temp"), "dash-registry-import");
+    const tempDir = path$6.join(app$4.getPath("temp"), "dash-registry-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -70832,7 +70832,7 @@ async function collectDashboardDependencies$1(
 ) {
   try {
     // 1. Read workspace
-    const filename = path$5.join(
+    const filename = path$6.join(
       app$4.getPath("userData"),
       appName$1,
       appId,
@@ -71111,7 +71111,7 @@ async function prepareDashboardForPublish$1(
     const { resolveNextVersion } = requireWidgetPublishManifest();
 
     // 1. Read workspace
-    const filename = path$5.join(
+    const filename = path$6.join(
       app$4.getPath("userData"),
       appName$1,
       appId,
@@ -71421,7 +71421,7 @@ async function prepareDashboardForPublish$1(
         );
       });
       if (!match || !match.path) continue;
-      const pkgJsonPath = path$5.join(match.path, "package.json");
+      const pkgJsonPath = path$6.join(match.path, "package.json");
       if (!fs.existsSync(pkgJsonPath)) continue;
       try {
         const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf8"));
@@ -71465,7 +71465,7 @@ async function prepareDashboardForPublish$1(
     const sanitizedName = manifest.name;
     const { canceled, filePath } = await dialog$1.showSaveDialog(win, {
       title: "Save Dashboard Package for Registry",
-      defaultPath: path$5.join(
+      defaultPath: path$6.join(
         app$4.getPath("desktop"),
         `dashboard-${sanitizedName}-v${manifest.version}.zip`,
       ),
@@ -71633,7 +71633,7 @@ async function checkDashboardUpdatesForApp$1(appId) {
   const { fetchRegistryIndex } = registryController$3;
 
   try {
-    const filename = path$5.join(
+    const filename = path$6.join(
       app$4.getPath("userData"),
       appName$1,
       appId,
@@ -71704,7 +71704,7 @@ function getProviderSetupManifest$1(appId, requiredProviders = []) {
  */
 function getDashboardPublishPreview$1(appId, workspaceId, widgetRegistry = null) {
   try {
-    const filename = path$5.join(
+    const filename = path$6.join(
       app$4.getPath("userData"),
       appName$1,
       appId,
@@ -72341,7 +72341,7 @@ var notificationController_1 = notificationController$2;
 
 const { app: app$3 } = require$$0$2;
 const fs$3 = require$$0$3;
-const path$4 = require$$1$2;
+const path$5 = require$$1$2;
 const WebSocket = require$$3$3;
 const {
   gateNetworkCall,
@@ -72351,7 +72351,7 @@ const { readEnforceFlag, readJitFlag } = securityFlags;
 
 function _loadFlags() {
   try {
-    const settingsPath = path$4.join(
+    const settingsPath = path$5.join(
       app$3.getPath("userData"),
       "Dashboard",
       "settings.json",
@@ -73668,7 +73668,7 @@ var widgetMountTokenController$1 = { setupWidgetMountTokenHandlers };
  * the host and the store together.
  */
 
-const path$3 = require$$1$2;
+const path$4 = require$$1$2;
 const { app: app$2 } = require$$0$2;
 const Store = require$$0$5;
 
@@ -73684,7 +73684,7 @@ function createElectronHost$1() {
   const store = new Store({ name: "dash-bots" });
   const budgetStore = new Store({ name: "dash-bot-budgets" });
   const memoryStore = new Store({ name: "dash-bot-memory" });
-  const botsRoot = path$3.join(app$2.getPath("userData"), "bots");
+  const botsRoot = path$4.join(app$2.getPath("userData"), "bots");
 
   return {
     paths: { botsRoot },
@@ -73769,6 +73769,9 @@ function withDefaults$1(def = {}) {
     provider: null,
     model: null,
     modelSelection: { mode: "recommended" },
+    // null → derive the engine from the provider (tool-loop). A bot may pin a
+    // specific engine id here (e.g. "claude-agent").
+    engine: null,
     mcpServers: [],
     allowedTools: [],
     approvalPolicy: "ask",
@@ -73806,6 +73809,13 @@ function validateBotDefinition$1(def) {
       errors.push("provider must be null or a non-empty string");
     }
   }
+  // engine may be null (derive from provider) or a non-empty string (an engine
+  // id). The runner surfaces an unknown id at run time.
+  if (def.engine !== null && def.engine !== undefined) {
+    if (typeof def.engine !== "string" || !def.engine) {
+      errors.push("engine must be null or a non-empty string");
+    }
+  }
   if (!APPROVAL_POLICIES.has(def.approvalPolicy)) {
     errors.push(
       `approvalPolicy must be one of ${[...APPROVAL_POLICIES].join(", ")}`,
@@ -73867,7 +73877,7 @@ var botSchema = {
  */
 
 const fs$2 = require$$0$3;
-const path$2 = require$$1$2;
+const path$3 = require$$1$2;
 const {
   newBotId,
   isValidBotId,
@@ -73917,7 +73927,7 @@ let BotStore$1 = class BotStore {
     if (!isValidBotId(id)) {
       throw new Error(`BotStore: invalid bot id "${id}"`);
     }
-    return path$2.join(this._botsRoot, id, "files");
+    return path$3.join(this._botsRoot, id, "files");
   }
 
   /** @returns {object[]} all bot definitions */
@@ -73988,7 +73998,7 @@ let BotStore$1 = class BotStore {
     this._save(data);
 
     if (isValidBotId(id)) {
-      fs$2.rmSync(path$2.join(this._botsRoot, id), {
+      fs$2.rmSync(path$3.join(this._botsRoot, id), {
         recursive: true,
         force: true,
       });
@@ -74202,6 +74212,11 @@ var approvalsExports = approvals.exports;
  *           Gate every tool call routes through before executing.
  * @property {(toolName: string, input: any) => Promise<{text: string, isError?: boolean}>} executeTool
  *           Execute an approved tool call (wraps mcpController in production).
+ * @property {string}   [botId]          The running bot's id.
+ * @property {string}   [workingDir]     Sandbox dir for engines with native file/shell tools.
+ * @property {string}   [approvalPolicy] "ask" | "allow" — for engines that run their own tool loop.
+ * @property {(request: object) => {id: string, promise: Promise<any>}} [createApproval]
+ *           Create a pending approval + await the decision (for engine-native tools).
  *
  * BotEvent — the normalized stream every engine yields:
  *   { type: "text", text }
@@ -74277,7 +74292,7 @@ var toolLoopEngine$2 = {exports: {}};
  *   [Symbol.asyncIterator]: () => AsyncIterator<any>
  * }}
  */
-function createEventStream$1() {
+function createEventStream$2() {
   /** @type {any[]} */
   const queue = [];
   /** @type {Array<{ resolve: (r: IteratorResult<any>) => void }>} */
@@ -74318,7 +74333,7 @@ function createEventStream$1() {
   };
 }
 
-var eventStream = { createEventStream: createEventStream$1 };
+var eventStream = { createEventStream: createEventStream$2 };
 
 /**
  * anthropicAdapter.js
@@ -74596,7 +74611,7 @@ var openAICompatibleAdapter_1 = openAICompatibleAdapter$1;
  * runner to persist, and read back from ctx.session on the next run.
  */
 
-const { createEventStream } = eventStream;
+const { createEventStream: createEventStream$1 } = eventStream;
 const anthropicAdapter = anthropicAdapter_1;
 const openAICompatibleAdapter = openAICompatibleAdapter_1;
 
@@ -74730,7 +74745,7 @@ const toolLoopEngine$1 = {
   capabilities: { builtInTools: false, skills: false, nativeSessions: false },
 
   run(ctx) {
-    const stream = createEventStream();
+    const stream = createEventStream$1();
     (async () => {
       try {
         await runLoop(ctx, stream);
@@ -74753,21 +74768,224 @@ toolLoopEngine$2.exports.ADAPTERS = ADAPTERS;
 
 var toolLoopEngineExports = toolLoopEngine$2.exports;
 
+var claudeAgentEngine$2 = {exports: {}};
+
+/**
+ * claudeAgentEngine.js
+ *
+ * A BotEngine backed by the Claude Agent SDK (`@anthropic-ai/claude-agent-sdk`),
+ * giving bots native file/shell/code tools and SDK-managed sessions (PRD FR-007).
+ * The provider-neutral tool-loop engine stays the default; a bot opts into this
+ * engine via its `engine` field.
+ *
+ * Design (P1 MVP — built-in tools first):
+ *  - The SDK is ESM-only, so it's loaded via dynamic import() at run time (a test
+ *    seam lets tests inject a fake `query`). The module itself loads clean under
+ *    plain Node (NFR-006) — nothing vendor-specific is required at load.
+ *  - Tool permission routes through `canUseTool`, gated by the bot's
+ *    approvalPolicy: "allow" runs tools without prompting; "ask" creates a
+ *    pending approval via the same registry the Activity panel reads, and awaits.
+ *  - The SDK's working directory is confined to the bot's sandbox (ctx.workingDir)
+ *    so file ops default there. Bridging the bot's *configured MCP servers* into
+ *    the SDK is deferred; this MVP uses the SDK's built-in tools.
+ */
+
+const { createEventStream } = eventStream;
+
+// Test seam: injected fake `query` implementation (see __setQueryForTest).
+let _queryImpl = null;
+
+/** @param {Function|null} fn */
+function __setQueryForTest(fn) {
+  _queryImpl = fn;
+}
+
+async function _loadQuery() {
+  if (_queryImpl) return _queryImpl;
+  const mod = await import('@anthropic-ai/claude-agent-sdk');
+  return mod.query;
+}
+
+/** Extract normalized events from one SDK assistant message's content blocks. */
+function* _fromAssistant(message) {
+  const blocks = (message && message.content) || [];
+  for (const b of blocks) {
+    if (!b) continue;
+    if (b.type === "text" && b.text) {
+      yield { type: "text", text: b.text };
+    } else if (b.type === "tool_use") {
+      yield { type: "tool_call", id: b.id, name: b.name, input: b.input };
+    }
+  }
+}
+
+/** Extract tool_result events from one SDK user message's content blocks. */
+function* _fromUser(message) {
+  const blocks = (message && message.content) || [];
+  for (const b of blocks) {
+    if (!b || b.type !== "tool_result") continue;
+    let text = "";
+    if (typeof b.content === "string") text = b.content;
+    else if (Array.isArray(b.content)) {
+      text = b.content
+        .filter((c) => c && c.type === "text")
+        .map((c) => c.text)
+        .join("\n");
+    }
+    yield {
+      type: "tool_result",
+      id: b.tool_use_id,
+      output: text,
+      isError: !!b.is_error,
+    };
+  }
+}
+
+/** Build the SDK canUseTool hook from the run context. */
+function _makeCanUseTool(ctx) {
+  return async function canUseTool(toolName, input) {
+    if (ctx.signal && ctx.signal.aborted) {
+      return { behavior: "deny", message: "run aborted" };
+    }
+    // Trusted bot → run tools without prompting.
+    if (ctx.approvalPolicy === "allow") {
+      return { behavior: "allow", updatedInput: input };
+    }
+    // Otherwise gate through the approval queue (shown in the Activity panel).
+    if (typeof ctx.createApproval !== "function") {
+      return { behavior: "deny", message: "no approval channel available" };
+    }
+    const { promise } = ctx.createApproval({
+      botId: ctx.botId,
+      workspaceId: ctx.workspaceId,
+      toolName,
+      input,
+      engine: "claude-agent",
+    });
+    const decision = await promise;
+    return decision && decision.allow
+      ? { behavior: "allow", updatedInput: input }
+      : {
+          behavior: "deny",
+          message: (decision && decision.reason) || "approval denied",
+        };
+  };
+}
+
+async function _runAgent(ctx, stream) {
+  const query = await _loadQuery();
+
+  // Auth: prefer the Claude Code CLI session (zero-config); fall back to the
+  // bot's Anthropic API key. NOTE: this sets a process-global env var — fine for
+  // the common single-key case; per-run isolation is a follow-up.
+  if (ctx.credentials && ctx.credentials.apiKey) {
+    process.env.ANTHROPIC_API_KEY = ctx.credentials.apiKey;
+  }
+
+  const options = {
+    model: ctx.model,
+    systemPrompt: ctx.systemPrompt || { type: "preset", preset: "claude_code" },
+    permissionMode: "default",
+    canUseTool: _makeCanUseTool(ctx),
+  };
+  if (ctx.maxTurns) options.maxTurns = ctx.maxTurns;
+  if (ctx.workingDir) options.cwd = ctx.workingDir;
+  if (ctx.session && ctx.session.id) options.resume = ctx.session.id;
+
+  const q = query({ prompt: ctx.prompt || "", options });
+
+  // Cooperative cancellation → SDK interrupt.
+  if (ctx.signal) {
+    ctx.signal.addEventListener("abort", () => {
+      try {
+        if (typeof q.interrupt === "function") q.interrupt();
+      } catch (_e) {
+        /* best effort */
+      }
+    });
+  }
+
+  let sessionId = null;
+  let usage = null;
+  let stopReason = "end";
+  try {
+    for await (const msg of q) {
+      if (msg && msg.session_id) sessionId = msg.session_id;
+      if (!msg) continue;
+      if (msg.type === "assistant") {
+        for (const ev of _fromAssistant(msg.message)) stream.push(ev);
+      } else if (msg.type === "user") {
+        for (const ev of _fromUser(msg.message)) stream.push(ev);
+      } else if (msg.type === "result") {
+        stopReason = msg.subtype || "end";
+        const u = msg.usage || {};
+        usage = {
+          inputTokens: u.input_tokens || 0,
+          outputTokens: u.output_tokens || 0,
+        };
+      }
+      if (ctx.signal && ctx.signal.aborted) break;
+    }
+  } finally {
+    if (typeof q.close === "function") {
+      try {
+        q.close();
+      } catch (_e) {
+        /* best effort */
+      }
+    }
+  }
+
+  if (sessionId) stream.push({ type: "session", session: { id: sessionId } });
+  stream.push({ type: "done", stopReason, usage });
+}
+
+/** @type {import("./BotEngine").BotEngine} */
+const claudeAgentEngine$1 = {
+  id: "claude-agent",
+  capabilities: { builtInTools: true, skills: true, nativeSessions: true },
+
+  run(ctx) {
+    const stream = createEventStream();
+    (async () => {
+      try {
+        await _runAgent(ctx, stream);
+      } catch (err) {
+        stream.push({
+          type: "error",
+          message: (err && err.message) || "Claude Agent engine error",
+          code: (err && err.code) || "CLAUDE_AGENT_ERROR",
+        });
+      } finally {
+        stream.end();
+      }
+    })();
+    return stream;
+  },
+};
+
+claudeAgentEngine$2.exports = claudeAgentEngine$1;
+claudeAgentEngine$2.exports.__setQueryForTest = __setQueryForTest;
+
+var claudeAgentEngineExports = claudeAgentEngine$2.exports;
+
 /**
  * engines/index.js
  *
  * Builds the Bot Factory engine registry. Requiring this module registers the
  * built-in engines; consumers resolve them via getEngine(id).
  *
- * At launch only the provider-neutral tool-loop engine is registered (covers
- * Anthropic + OpenAI + xAI via adapters). The Claude Agent SDK engine is a
- * later addition and will register here too.
+ * The provider-neutral tool-loop engine (covers Anthropic + OpenAI + xAI via
+ * adapters) is the default. The Claude Agent SDK engine adds native file/shell
+ * tools + SDK sessions for bots that opt in via their `engine` field.
  */
 
 const { registerEngine, getEngine, listEngines } = BotEngine;
 const toolLoopEngine = toolLoopEngineExports;
+const claudeAgentEngine = claudeAgentEngineExports;
 
 registerEngine(toolLoopEngine);
+registerEngine(claudeAgentEngine);
 
 var engines$1 = { getEngine, listEngines, registerEngine };
 
@@ -75093,6 +75311,7 @@ let BotRunner$1 = class BotRunner {
           : null;
 
       const ctx = {
+        botId,
         prompt: opts.prompt,
         model: profile.model,
         credentials: profile.credentials,
@@ -75106,6 +75325,11 @@ let BotRunner$1 = class BotRunner {
         requestPermission,
         executeTool,
         workspaceId: bot.workspaceId,
+        // For engines with their own agent loop + native tools (claude-agent):
+        // a sandbox dir, the approval policy, and a direct approval channel.
+        workingDir: profile.workingDir,
+        approvalPolicy: bot.approvalPolicy,
+        createApproval: (request) => this._approvals.create(request),
       };
 
       for await (const event of engine.run(ctx)) {
@@ -75897,6 +76121,7 @@ var mcpResult = { normalizeMcpResult: normalizeMcpResult$1 };
  * injected/portable modules; this file is the boundary.
  */
 
+const path$2 = require$$1$2;
 const { Cron } = require$$1$3;
 const { createElectronHost } = host;
 const BotStore = BotStoreExports;
@@ -75982,6 +76207,7 @@ const botController$1 = {
     this._appId = appId;
 
     const host = createElectronHost();
+    this._botsRoot = host.paths && host.paths.botsRoot;
     this._store = new BotStore({
       persistence: host.persistence,
       paths: host.paths,
@@ -76254,11 +76480,17 @@ const botController$1 = {
 
     return {
       providerId,
-      engineId: provider.engine,
+      // A bot may pin an engine (e.g. "claude-agent"); otherwise derive it from
+      // the provider (tool-loop for anthropic/openai/xai).
+      engineId: bot.engine || provider.engine,
       adapterId: provider.adapter,
       baseURL: provider.baseURL,
       model,
       credentials,
+      // Sandbox dir for engines with native file/shell tools (claude-agent).
+      workingDir: this._botsRoot
+        ? path$2.join(this._botsRoot, bot.id, "files")
+        : undefined,
     };
   },