@turmind/halo 1.3.4 → 1.4.1

package/dist/index.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// packages/cli/src/server-supervisor.ts
+// src/server-supervisor.ts
 var server_supervisor_exports = {};
 __export(server_supervisor_exports, {
   MAX_RESTARTS: () => MAX_RESTARTS,
@@ -114,7 +114,7 @@ async function superviseServer() {
 }
 var SUPERVISE_ENV, MAX_RESTARTS, RESTART_WINDOW_MS, RESTART_DELAY_MS, INTENTIONAL_SIGNALS;
 var init_server_supervisor = __esm({
-  "packages/cli/src/server-supervisor.ts"() {
+  "src/server-supervisor.ts"() {
     "use strict";
     SUPERVISE_ENV = "HALO_SUPERVISE";
     MAX_RESTARTS = 5;
@@ -124,7 +124,7 @@ var init_server_supervisor = __esm({
   }
 });
 
-// packages/server/dist/prompts/md-vars.js
+// ../server/dist/prompts/md-vars.js
 var md_vars_exports = {};
 __export(md_vars_exports, {
   buildRenderContext: () => buildRenderContext,
@@ -294,7 +294,7 @@ async function buildRenderContext(opts) {
 }
 var PATTERN, ENV_PATTERN, ARG_PATTERN, PARAM_PATH;
 var init_md_vars = __esm({
-  "packages/server/dist/prompts/md-vars.js"() {
+  "../server/dist/prompts/md-vars.js"() {
     "use strict";
     PATTERN = /\{\{\s*([\w-][\w.-]*)\s*\}\}/g;
     ENV_PATTERN = /<<([A-Z_][A-Z0-9_]*)>>/g;
@@ -303,7 +303,7 @@ var init_md_vars = __esm({
   }
 });
 
-// packages/server/dist/prompts/md-loader.js
+// ../server/dist/prompts/md-loader.js
 import fs3 from "node:fs/promises";
 import fsSync from "node:fs";
 import path3 from "node:path";
@@ -448,14 +448,14 @@ function resolveMdFilePath(agentId, fileType, scope, workspaceRoot) {
 }
 var HALO_HOME;
 var init_md_loader = __esm({
-  "packages/server/dist/prompts/md-loader.js"() {
+  "../server/dist/prompts/md-loader.js"() {
     "use strict";
     init_md_vars();
     HALO_HOME = path3.join(homedir3(), ".halo", "global");
   }
 });
 
-// packages/server/dist/settings-schema.js
+// ../server/dist/settings-schema.js
 import fs4 from "node:fs";
 import path4 from "node:path";
 import { homedir as homedir4 } from "node:os";
@@ -513,12 +513,12 @@ function generalSection() {
       { key: "compact.max_summary_input", type: "int", globalOnly: true, description: "Max chars fed into local truncation fallback", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u7684\u603B\u8F93\u5165\u5B57\u7B26\u4E0A\u9650", default: "15000" },
       { key: "compact.max_message_slice", type: "int", globalOnly: true, description: "Max chars kept per old message during local truncation", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u6BCF\u6761\u65E7\u6D88\u606F\u4FDD\u7559\u7684\u6700\u5927\u5B57\u7B26\u6570", default: "800" },
       { key: "compact.summarize_timeout_sec", type: "int", globalOnly: true, description: "LLM summarization timeout (seconds)", description_zh: "LLM \u6458\u8981\u8D85\u65F6\u65F6\u95F4\uFF08\u79D2\uFF09", default: "300" },
-      // sandbox (Linux bwrap only) — global-only: these define the security
+      // sandbox (Linux bwrap / macOS sandbox-exec) — global-only: these define the security
       // boundary agents run inside; a workspace overriding them could lift
       // its own sandbox constraints.
-      { key: "sandbox.hidden_dirs", globalOnly: true, description: "Comma-separated dirs hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 bwrap tmpfs \u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs" },
-      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs bind-mounted read-write inside the bwrap sandbox (Linux only) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u5728 bwrap \u6C99\u7BB1\u5185\u4EE5\u53EF\u5199\u65B9\u5F0F\u6302\u8F7D\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
-      { key: "sandbox.hidden_files", globalOnly: true, description: "Comma-separated files hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 /dev/null bind \u9690\u85CF\u7684\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm,~/.halo/global/runs.db,~/.halo/global/runs.db-wal,~/.halo/global/runs.db-shm" },
+      { key: "sandbox.hidden_dirs", globalOnly: true, description: "Comma-separated dirs hidden from workspace/readonly sessions (Linux bwrap / macOS sandbox-exec)", description_zh: "\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux bwrap / macOS sandbox-exec\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs" },
+      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs writable inside the sandbox besides the workspace (Linux / macOS) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u9664 workspace \u5916\u5728\u6C99\u7BB1\u5185\u53EF\u5199\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
+      { key: "sandbox.hidden_files", globalOnly: true, description: "Comma-separated files hidden from workspace/readonly sessions \u2014 read as empty (Linux / macOS)", description_zh: "\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u6587\u4EF6\uFF0C\u8BFB\u5230\u7684\u662F\u7A7A\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm,~/.halo/global/runs.db,~/.halo/global/runs.db-wal,~/.halo/global/runs.db-shm" },
       // logging
       { key: "logging.level", type: "enum", options: ["debug", "info", "warn", "error"], globalOnly: true, description: "Log level", description_zh: "\u65E5\u5FD7\u7EA7\u522B", default: "warn" },
       // observability (OpenTelemetry). Read once at boot by observability/otel.ts
@@ -718,7 +718,7 @@ function loadSettingsSchema(workspaceRoot) {
 }
 var GLOBAL_MODELS_DIR, GLOBAL_SKILLS_DIR, GLOBAL_AGENTS_DIR, VALID_TYPES;
 var init_settings_schema = __esm({
-  "packages/server/dist/settings-schema.js"() {
+  "../server/dist/settings-schema.js"() {
     "use strict";
     GLOBAL_MODELS_DIR = path4.join(homedir4(), ".halo", "global", "models");
     GLOBAL_SKILLS_DIR = path4.join(homedir4(), ".halo", "global", "skills");
@@ -727,7 +727,7 @@ var init_settings_schema = __esm({
   }
 });
 
-// packages/server/dist/config.js
+// ../server/dist/config.js
 var config_exports = {};
 __export(config_exports, {
   HALO_GLOBAL_DIR: () => HALO_GLOBAL_DIR,
@@ -1033,7 +1033,7 @@ function getModelsRegistry() {
 }
 var HALO_HOME2, HALO_GLOBAL_DIR, HALO_SECRETS_DIR, _modelsRegistryCache, SYSTEM_CONFIG_PATH, _systemConfigCache, SETTINGS_PATH, _settingsCache, _schemaDefaultsCache, ENV_PATTERN2, _wsSettingsCache, config, HIDDEN_DIRS_DEFAULT, HIDDEN_FILES_DEFAULT;
 var init_config = __esm({
-  "packages/server/dist/config.js"() {
+  "../server/dist/config.js"() {
     "use strict";
     init_settings_schema();
     HALO_HOME2 = path5.join(homedir5(), ".halo");
@@ -1259,7 +1259,7 @@ var init_config = __esm({
   }
 });
 
-// packages/server/dist/agents/conversation-repair.js
+// ../server/dist/agents/conversation-repair.js
 function getToolUseId(block) {
   const b = block;
   if (b.type === "tool_use" && typeof b.id === "string")
@@ -1377,12 +1377,12 @@ function repairConversationMessages(raw, label = "[Repair]") {
   return messages2;
 }
 var init_conversation_repair = __esm({
-  "packages/server/dist/agents/conversation-repair.js"() {
+  "../server/dist/agents/conversation-repair.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/agents/model-error.js
+// ../server/dist/agents/model-error.js
 function classifyModelError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   const errName = err instanceof Error ? err.name : "";
@@ -1420,12 +1420,12 @@ function classifyKind(msg, errName, httpStatus) {
   return "fatal";
 }
 var init_model_error = __esm({
-  "packages/server/dist/agents/model-error.js"() {
+  "../server/dist/agents/model-error.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/agents/compact.js
+// ../server/dist/agents/compact.js
 function splitForCompact(messages2) {
   const keepCount = config.compact.keep_messages;
   let cut = Math.max(0, messages2.length - keepCount);
@@ -1472,13 +1472,13 @@ ${summaryText}` }]
   return { compacted: true, messages: [summaryMsg, ...recentMsgs] };
 }
 var init_compact = __esm({
-  "packages/server/dist/agents/compact.js"() {
+  "../server/dist/agents/compact.js"() {
     "use strict";
     init_config();
   }
 });
 
-// packages/server/dist/agents/micro-compact.js
+// ../server/dist/agents/micro-compact.js
 function microCompactMessages(messages2, keepRecent = DEFAULT_KEEP_RECENT) {
   if (!messages2 || messages2.length === 0) {
     return { compacted: false, cleared: 0, messages: messages2 };
@@ -1526,7 +1526,7 @@ function microCompactMessages(messages2, keepRecent = DEFAULT_KEEP_RECENT) {
 }
 var MICRO_COMPACT_PLACEHOLDER, COMPACTABLE_TOOLS, DEFAULT_KEEP_RECENT;
 var init_micro_compact = __esm({
-  "packages/server/dist/agents/micro-compact.js"() {
+  "../server/dist/agents/micro-compact.js"() {
     "use strict";
     MICRO_COMPACT_PLACEHOLDER = "[Old tool result content cleared]";
     COMPACTABLE_TOOLS = /* @__PURE__ */ new Set([
@@ -1543,10 +1543,10 @@ var init_micro_compact = __esm({
   }
 });
 
-// packages/server/dist/agents/agent-loop.js
+// ../server/dist/agents/agent-loop.js
 var TOOL_ERROR_MARKER, TOOL_WARN_MARKER, MODEL_TIMEOUT_ERROR, AgentLoop;
 var init_agent_loop = __esm({
-  "packages/server/dist/agents/agent-loop.js"() {
+  "../server/dist/agents/agent-loop.js"() {
     "use strict";
     init_config();
     TOOL_ERROR_MARKER = "__TOOL_ERROR__";
@@ -1721,7 +1721,7 @@ Error: ${err instanceof Error ? err.message : String(err)}`;
   }
 });
 
-// packages/server/dist/agents/agent-loader.js
+// ../server/dist/agents/agent-loader.js
 import fs6 from "node:fs/promises";
 import fsSync2 from "node:fs";
 import path6 from "node:path";
@@ -2004,7 +2004,7 @@ function isTeamMember(team, targetId) {
 }
 var GLOBAL_AGENTS_DIR2, GLOBAL_SKILLS_DIR2, SKILL_ID_RE, ACCESS_RANK;
 var init_agent_loader = __esm({
-  "packages/server/dist/agents/agent-loader.js"() {
+  "../server/dist/agents/agent-loader.js"() {
     "use strict";
     init_agent_loop();
     GLOBAL_AGENTS_DIR2 = path6.join(homedir6(), ".halo", "global", "agents");
@@ -2019,7 +2019,7 @@ var init_agent_loader = __esm({
   }
 });
 
-// packages/server/dist/ws/broadcast.js
+// ../server/dist/ws/broadcast.js
 import path7 from "node:path";
 function setBroadcastWss(wss2) {
   _wss = wss2;
@@ -2065,14 +2065,14 @@ function broadcastToWorkspace(workspacePath, event) {
 }
 var _wss, _workspaceOfClient;
 var init_broadcast = __esm({
-  "packages/server/dist/ws/broadcast.js"() {
+  "../server/dist/ws/broadcast.js"() {
     "use strict";
     _wss = null;
     _workspaceOfClient = null;
   }
 });
 
-// packages/server/dist/db/schema.js
+// ../server/dist/db/schema.js
 var schema_exports = {};
 __export(schema_exports, {
   agentSessions: () => agentSessions,
@@ -2081,7 +2081,7 @@ __export(schema_exports, {
 import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
 var agentSessions, disabledItems;
 var init_schema = __esm({
-  "packages/server/dist/db/schema.js"() {
+  "../server/dist/db/schema.js"() {
     "use strict";
     agentSessions = sqliteTable("agent_sessions", {
       id: text("id").primaryKey(),
@@ -2122,7 +2122,7 @@ var init_schema = __esm({
   }
 });
 
-// packages/server/dist/init.js
+// ../server/dist/init.js
 var init_exports = {};
 __export(init_exports, {
   TEMPLATES_DIR: () => TEMPLATES_DIR,
@@ -2130,6 +2130,7 @@ __export(init_exports, {
   describeOptionalSkill: () => describeOptionalSkill,
   ensureHaloHome: () => ensureHaloHome,
   ensureWorkspaceHalo: () => ensureWorkspaceHalo,
+  hasWorkspaceHalo: () => hasWorkspaceHalo,
   listOptionalSkillIds: () => listOptionalSkillIds,
   mergeAgentYaml: () => mergeAgentYaml,
   readInstalledOptionalSkills: () => readInstalledOptionalSkills,
@@ -2458,6 +2459,9 @@ function ensureHaloHome(haloHome2) {
   } catch {
   }
 }
+function hasWorkspaceHalo(root) {
+  return fs7.existsSync(path8.join(root, ".halo"));
+}
 function ensureWorkspaceHalo(workspaceRoot) {
   if (!fs7.existsSync(workspaceRoot)) {
     throw new Error(`Workspace root does not exist: ${workspaceRoot}`);
@@ -2489,7 +2493,7 @@ function ensureWorkspaceHalo(workspaceRoot) {
 }
 var __dirname, TEMPLATES_DIR, DOCS_SRC_CANDIDATES, TEMPLATE_VERSION, VERSION_FILE, SKIP_NAMES, BUILTIN_AGENT_IDS, BUILTIN_SKILL_IDS, BUNDLED_DOCS, INSTALLED_OPTIONAL_SKILLS_FILE;
 var init_init = __esm({
-  "packages/server/dist/init.js"() {
+  "../server/dist/init.js"() {
     "use strict";
     __dirname = path8.dirname(fileURLToPath(import.meta.url));
     TEMPLATES_DIR = path8.resolve(__dirname, "..", "templates");
@@ -2497,7 +2501,7 @@ var init_init = __esm({
       path8.resolve(__dirname, "..", "bundled-docs"),
       path8.resolve(__dirname, "..", "..", "..", ".halo", "docs")
     ];
-    TEMPLATE_VERSION = 60;
+    TEMPLATE_VERSION = 66;
     VERSION_FILE = ".template-version";
     SKIP_NAMES = /* @__PURE__ */ new Set([".DS_Store", "schema.sql", "__pycache__", ".pytest_cache"]);
     BUILTIN_AGENT_IDS = /* @__PURE__ */ new Set([
@@ -2552,6 +2556,7 @@ var init_init = __esm({
       "guide/skills.md",
       "guide/testing-agents-and-skills.md",
       "guide/secrets-and-credentials.md",
+      "guide/delegation-and-access.md",
       "dev/tools.md",
       "dev/add-model-provider.md",
       "dev/add-channel.md",
@@ -2562,7 +2567,7 @@ var init_init = __esm({
   }
 });
 
-// packages/server/dist/db/migrate.js
+// ../server/dist/db/migrate.js
 function runMigrations(sqlite, migrations) {
   const current = sqlite.pragma("user_version", { simple: true });
   if (current > migrations.length) {
@@ -2583,12 +2588,12 @@ function addColumnIfMissing(sqlite, table, column, decl) {
   sqlite.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
 }
 var init_migrate = __esm({
-  "packages/server/dist/db/migrate.js"() {
+  "../server/dist/db/migrate.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/db/index.js
+// ../server/dist/db/index.js
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { eq, and } from "drizzle-orm";
@@ -2651,7 +2656,7 @@ function toggleDisabled(db, itemType, itemId, scope) {
 }
 var SCHEMA_SQL_PATH, HALO_MIGRATIONS, dbCache;
 var init_db = __esm({
-  "packages/server/dist/db/index.js"() {
+  "../server/dist/db/index.js"() {
     "use strict";
     init_schema();
     init_init();
@@ -2677,7 +2682,7 @@ var init_db = __esm({
   }
 });
 
-// packages/server/dist/agents/session-tools.js
+// ../server/dist/agents/session-tools.js
 async function callerTeamFor(sm, sessionId) {
   const callerId = sm.sessions.get(sessionId)?.agentId;
   if (!callerId)
@@ -2957,7 +2962,7 @@ function buildContinueTaskTool(sm, sessionId) {
   };
 }
 var init_session_tools = __esm({
-  "packages/server/dist/agents/session-tools.js"() {
+  "../server/dist/agents/session-tools.js"() {
     "use strict";
     init_config();
     init_agent_loader();
@@ -2965,7 +2970,7 @@ var init_session_tools = __esm({
   }
 });
 
-// packages/server/dist/sessions/session-archive.js
+// ../server/dist/sessions/session-archive.js
 import fsSync3 from "node:fs";
 import fs9 from "node:fs/promises";
 import path10 from "node:path";
@@ -3028,13 +3033,13 @@ async function deleteArchiveSegments(dir, seg) {
 }
 var ARCHIVE_SIZE_THRESHOLD;
 var init_session_archive = __esm({
-  "packages/server/dist/sessions/session-archive.js"() {
+  "../server/dist/sessions/session-archive.js"() {
     "use strict";
     ARCHIVE_SIZE_THRESHOLD = 3 * 1024 * 1024;
   }
 });
 
-// packages/server/dist/sessions/session-store.js
+// ../server/dist/sessions/session-store.js
 import fsSync4 from "node:fs";
 import fs10 from "node:fs/promises";
 import path11 from "node:path";
@@ -3278,13 +3283,13 @@ function findAndUpdateSessionTitle(sessionId, title, projectPath) {
   return false;
 }
 var init_session_store = __esm({
-  "packages/server/dist/sessions/session-store.js"() {
+  "../server/dist/sessions/session-store.js"() {
     "use strict";
     init_session_archive();
   }
 });
 
-// packages/server/dist/agents/goal-mode.js
+// ../server/dist/agents/goal-mode.js
 import fs11 from "node:fs";
 import path12 from "node:path";
 import { createHash } from "node:crypto";
@@ -3756,7 +3761,7 @@ function sweepActiveGoals(host) {
 }
 var GOAL_AGENT_ID, DEFAULT_GOAL_CAPS, NO_PROGRESS_LIMIT, DELEGATED_DECISION_CAP, WORKER_RECENT_MAX_MESSAGES, WORKER_RECENT_MSG_CHARS, WORKER_RECENT_TOTAL_CHARS, NEED_INPUT_MARKER;
 var init_goal_mode = __esm({
-  "packages/server/dist/agents/goal-mode.js"() {
+  "../server/dist/agents/goal-mode.js"() {
     "use strict";
     init_schema();
     init_session_store();
@@ -3777,7 +3782,7 @@ var init_goal_mode = __esm({
   }
 });
 
-// packages/server/dist/channels/shared/i18n.js
+// ../server/dist/channels/shared/i18n.js
 function getLang(account) {
   const v = account.language;
   return v === "en" || v === "zh" ? v : "en";
@@ -3796,7 +3801,7 @@ function t(key, lang, params) {
 }
 var messages;
 var init_i18n = __esm({
-  "packages/server/dist/channels/shared/i18n.js"() {
+  "../server/dist/channels/shared/i18n.js"() {
     "use strict";
     messages = {
       // ── /help ──
@@ -3965,10 +3970,10 @@ var init_i18n = __esm({
   }
 });
 
-// packages/server/dist/commands/registry.js
+// ../server/dist/commands/registry.js
 var CommandRegistry;
 var init_registry = __esm({
-  "packages/server/dist/commands/registry.js"() {
+  "../server/dist/commands/registry.js"() {
     "use strict";
     CommandRegistry = class {
       descriptors = /* @__PURE__ */ new Map();
@@ -3982,13 +3987,13 @@ var init_registry = __esm({
   }
 });
 
-// packages/server/dist/commands/index.js
+// ../server/dist/commands/index.js
 function builtinCommandNames() {
   return commandRegistry.listDescriptors().filter((d) => d.source === "builtin").map((d) => d.name);
 }
 var commandRegistry;
 var init_commands = __esm({
-  "packages/server/dist/commands/index.js"() {
+  "../server/dist/commands/index.js"() {
     "use strict";
     init_registry();
     commandRegistry = new CommandRegistry();
@@ -4038,7 +4043,7 @@ var init_commands = __esm({
   }
 });
 
-// packages/server/dist/commands/skill-command.js
+// ../server/dist/commands/skill-command.js
 import fs12 from "node:fs/promises";
 import path13 from "node:path";
 async function scanDir(dir) {
@@ -4181,7 +4186,7 @@ ${body}`;
   return "ok";
 }
 var init_skill_command = __esm({
-  "packages/server/dist/commands/skill-command.js"() {
+  "../server/dist/commands/skill-command.js"() {
     "use strict";
     init_commands();
     init_agent_loader();
@@ -4191,7 +4196,7 @@ var init_skill_command = __esm({
   }
 });
 
-// packages/server/dist/db/evo-db.js
+// ../server/dist/db/evo-db.js
 import Database2 from "better-sqlite3";
 import { drizzle as drizzle2 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable2, text as text2, integer as integer2 } from "drizzle-orm/sqlite-core";
@@ -4216,7 +4221,7 @@ function getEvoDb() {
 }
 var evolutionRuns, evolutionApplies, CREATE_SQL, _evoDb;
 var init_evo_db = __esm({
-  "packages/server/dist/db/evo-db.js"() {
+  "../server/dist/db/evo-db.js"() {
     "use strict";
     init_migrate();
     evolutionRuns = sqliteTable2("evolution_runs", {
@@ -4299,7 +4304,7 @@ CREATE INDEX IF NOT EXISTS idx_evo_applies_archived ON evolution_applies(archive
   }
 });
 
-// packages/server/dist/paths.js
+// ../server/dist/paths.js
 import path15 from "node:path";
 import { homedir as homedir8 } from "node:os";
 function haloHome() {
@@ -4345,12 +4350,12 @@ function evoApplyLogFile(applyId) {
   return path15.join(evoLogsDir(), `apply-${applyId}.log`);
 }
 var init_paths = __esm({
-  "packages/server/dist/paths.js"() {
+  "../server/dist/paths.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/evolution/enqueue.js
+// ../server/dist/evolution/enqueue.js
 import fs14 from "node:fs";
 import path16 from "node:path";
 import { homedir as homedir9 } from "node:os";
@@ -4635,14 +4640,14 @@ function enqueueEvoRun(input) {
   return { ok: true, runId, runDir };
 }
 var init_enqueue = __esm({
-  "packages/server/dist/evolution/enqueue.js"() {
+  "../server/dist/evolution/enqueue.js"() {
     "use strict";
     init_evo_db();
     init_paths();
   }
 });
 
-// packages/server/dist/channels/shared/commands.js
+// ../server/dist/channels/shared/commands.js
 import fs15 from "node:fs";
 import path17 from "node:path";
 import os from "node:os";
@@ -5368,7 +5373,7 @@ function execWsSwitch(ctx, arg) {
 }
 var ALIASES_FILE, aliasCache, CHANNEL_LIST_LIMIT, DISPATCH_COMMANDS, NOT_ROUTED, SUBCOMMAND_ROUTES;
 var init_commands2 = __esm({
-  "packages/server/dist/channels/shared/commands.js"() {
+  "../server/dist/channels/shared/commands.js"() {
     "use strict";
     init_agent_loader();
     init_init();
@@ -5443,7 +5448,7 @@ var init_commands2 = __esm({
   }
 });
 
-// packages/server/dist/agents/relay.js
+// ../server/dist/agents/relay.js
 import fs16 from "node:fs";
 import path18 from "node:path";
 import { and as and3, eq as eq3, isNull as isNull2 } from "drizzle-orm";
@@ -5680,7 +5685,7 @@ ${params.message}`;
 }
 var _registry, WORKSPACE_SESSION_PROPS;
 var init_relay = __esm({
-  "packages/server/dist/agents/relay.js"() {
+  "../server/dist/agents/relay.js"() {
     "use strict";
     init_schema();
     init_config();
@@ -5693,7 +5698,7 @@ var init_relay = __esm({
   }
 });
 
-// packages/server/dist/db/runs-db.js
+// ../server/dist/db/runs-db.js
 import Database3 from "better-sqlite3";
 import { drizzle as drizzle3 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable3, text as text3, integer as integer3, primaryKey } from "drizzle-orm/sqlite-core";
@@ -5735,7 +5740,7 @@ function listRunningWorkspaces() {
 }
 var runningSessions, CREATE_SQL2, _runsDb;
 var init_runs_db = __esm({
-  "packages/server/dist/db/runs-db.js"() {
+  "../server/dist/db/runs-db.js"() {
     "use strict";
     init_migrate();
     runningSessions = sqliteTable3("running_sessions", {
@@ -5757,7 +5762,7 @@ CREATE TABLE IF NOT EXISTS running_sessions (
   }
 });
 
-// packages/server/dist/agents/run-ledger.js
+// ../server/dist/agents/run-ledger.js
 import fs18 from "node:fs";
 import path20 from "node:path";
 import YAML7 from "yaml";
@@ -5798,7 +5803,7 @@ function sweepInterruptedRuns(host) {
   console.log(`[RunLedger] Boot sweep (${host.workspaceRoot}): nudged ${nudged} interrupted root(s)`);
 }
 var init_run_ledger = __esm({
-  "packages/server/dist/agents/run-ledger.js"() {
+  "../server/dist/agents/run-ledger.js"() {
     "use strict";
     init_schema();
     init_runs_db();
@@ -5807,7 +5812,7 @@ var init_run_ledger = __esm({
   }
 });
 
-// packages/server/dist/agents/workspace-runtime-lock.js
+// ../server/dist/agents/workspace-runtime-lock.js
 import fs19 from "node:fs";
 import path21 from "node:path";
 function isPidAlive(pid) {
@@ -5855,19 +5860,19 @@ function claimWorkspaceRuntime(workspaceRoot) {
 }
 var RUNTIME_LOCK_FILE;
 var init_workspace_runtime_lock = __esm({
-  "packages/server/dist/agents/workspace-runtime-lock.js"() {
+  "../server/dist/agents/workspace-runtime-lock.js"() {
     "use strict";
     RUNTIME_LOCK_FILE = "runtime.lock";
   }
 });
 
-// packages/core/dist/workspace/workspace.js
+// ../core/dist/workspace/workspace.js
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { resolve, isAbsolute, sep } from "node:path";
 var WorkspaceError, Workspace;
 var init_workspace = __esm({
-  "packages/core/dist/workspace/workspace.js"() {
+  "../core/dist/workspace/workspace.js"() {
     "use strict";
     WorkspaceError = class extends Error {
       constructor(message) {
@@ -5912,13 +5917,13 @@ var init_workspace = __esm({
   }
 });
 
-// packages/core/dist/workspace/git-manager.js
+// ../core/dist/workspace/git-manager.js
 import path22 from "node:path";
 import { promises as fs20 } from "node:fs";
 import simpleGit from "simple-git";
 var GitManagerError, GitManager;
 var init_git_manager = __esm({
-  "packages/core/dist/workspace/git-manager.js"() {
+  "../core/dist/workspace/git-manager.js"() {
     "use strict";
     GitManagerError = class extends Error {
       constructor(message) {
@@ -6287,7 +6292,7 @@ var init_git_manager = __esm({
   }
 });
 
-// packages/core/dist/media/mime.js
+// ../core/dist/media/mime.js
 function normalizeExt(ext) {
   const lower = ext.toLowerCase();
   return lower.startsWith(".") ? lower : `.${lower}`;
@@ -6300,7 +6305,7 @@ function extFromImageMime(mime) {
 }
 var PHOTO_MIME_BY_EXT, SERVE_ONLY_MIME_BY_EXT, IMAGE_MIME_BY_EXT, EXT_BY_PHOTO_MIME, IMAGE_EXTS;
 var init_mime = __esm({
-  "packages/core/dist/media/mime.js"() {
+  "../core/dist/media/mime.js"() {
     "use strict";
     PHOTO_MIME_BY_EXT = {
       ".png": "image/png",
@@ -6324,9 +6329,9 @@ var init_mime = __esm({
   }
 });
 
-// packages/core/dist/index.js
+// ../core/dist/index.js
 var init_dist = __esm({
-  "packages/core/dist/index.js"() {
+  "../core/dist/index.js"() {
     "use strict";
     init_workspace();
     init_git_manager();
@@ -6334,7 +6339,7 @@ var init_dist = __esm({
   }
 });
 
-// packages/server/dist/channels/shared/media-store.js
+// ../server/dist/channels/shared/media-store.js
 import fs21 from "node:fs/promises";
 import path23 from "node:path";
 import { randomBytes } from "node:crypto";
@@ -6395,7 +6400,7 @@ async function saveInboundMedia(params) {
 }
 var VISION_IMAGE_MIME_TYPES, EXT_BY_AV_MIME;
 var init_media_store = __esm({
-  "packages/server/dist/channels/shared/media-store.js"() {
+  "../server/dist/channels/shared/media-store.js"() {
     "use strict";
     init_dist();
     VISION_IMAGE_MIME_TYPES = ["image/jpeg", "image/png", "image/gif", "image/webp"];
@@ -6413,7 +6418,7 @@ var init_media_store = __esm({
   }
 });
 
-// packages/server/dist/sessions/ui-log-builder.js
+// ../server/dist/sessions/ui-log-builder.js
 import { randomUUID } from "node:crypto";
 function createEmptyUIState() {
   return {
@@ -6817,19 +6822,19 @@ function applyEvent(state, event) {
 }
 var msgCounter;
 var init_ui_log_builder = __esm({
-  "packages/server/dist/sessions/ui-log-builder.js"() {
+  "../server/dist/sessions/ui-log-builder.js"() {
     "use strict";
     msgCounter = 0;
   }
 });
 
-// packages/server/dist/agents/session-ui-store.js
+// ../server/dist/agents/session-ui-store.js
 import fsSync5 from "node:fs";
 import path24 from "node:path";
 import { eq as eq6 } from "drizzle-orm";
 var UI_STATE_IDLE_TTL_MS, UI_STATE_SWEEP_PERIOD_MS, SessionUIStore;
 var init_session_ui_store = __esm({
-  "packages/server/dist/agents/session-ui-store.js"() {
+  "../server/dist/agents/session-ui-store.js"() {
     "use strict";
     init_broadcast();
     init_schema();
@@ -7343,11 +7348,11 @@ var init_session_ui_store = __esm({
   }
 });
 
-// packages/server/dist/agents/session-query-store.js
+// ../server/dist/agents/session-query-store.js
 import { eq as eq7, and as and5, isNull as isNull3, desc, lt, gte, inArray } from "drizzle-orm";
 var SessionQueryStore;
 var init_session_query_store = __esm({
-  "packages/server/dist/agents/session-query-store.js"() {
+  "../server/dist/agents/session-query-store.js"() {
     "use strict";
     init_schema();
     init_session_store();
@@ -7574,7 +7579,7 @@ var init_session_query_store = __esm({
   }
 });
 
-// packages/server/dist/agents/bedrock-agent.js
+// ../server/dist/agents/bedrock-agent.js
 import { BedrockRuntimeClient, InvokeModelCommand } from "@aws-sdk/client-bedrock-runtime";
 function effortToBudget(effort, maxTokens) {
   const table = {
@@ -7596,7 +7601,7 @@ function extractRegionFromEndpoint(endpoint) {
 }
 var BedrockAgent;
 var init_bedrock_agent = __esm({
-  "packages/server/dist/agents/bedrock-agent.js"() {
+  "../server/dist/agents/bedrock-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -7726,7 +7731,7 @@ var init_bedrock_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/deepseek-agent.js
+// ../server/dist/agents/deepseek-agent.js
 function safeParse(json) {
   try {
     return JSON.parse(json || "{}");
@@ -7736,7 +7741,7 @@ function safeParse(json) {
 }
 var DeepSeekAgent;
 var init_deepseek_agent = __esm({
-  "packages/server/dist/agents/deepseek-agent.js"() {
+  "../server/dist/agents/deepseek-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -7931,7 +7936,7 @@ var init_deepseek_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/kimi-agent.js
+// ../server/dist/agents/kimi-agent.js
 function safeParse2(json) {
   try {
     return JSON.parse(json || "{}");
@@ -7941,7 +7946,7 @@ function safeParse2(json) {
 }
 var KimiAgent;
 var init_kimi_agent = __esm({
-  "packages/server/dist/agents/kimi-agent.js"() {
+  "../server/dist/agents/kimi-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8137,7 +8142,7 @@ var init_kimi_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/minimax-agent.js
+// ../server/dist/agents/minimax-agent.js
 function effortToBudget2(effort, maxTokens) {
   const table = {
     low: 2048,
@@ -8154,7 +8159,7 @@ function effortToBudget2(effort, maxTokens) {
 }
 var MiniMaxAgent;
 var init_minimax_agent = __esm({
-  "packages/server/dist/agents/minimax-agent.js"() {
+  "../server/dist/agents/minimax-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8276,7 +8281,7 @@ var init_minimax_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/qwen-agent.js
+// ../server/dist/agents/qwen-agent.js
 function effortToBudget3(effort, maxTokens) {
   const table = {
     low: 2048,
@@ -8293,7 +8298,7 @@ function effortToBudget3(effort, maxTokens) {
 }
 var QwenAgent;
 var init_qwen_agent = __esm({
-  "packages/server/dist/agents/qwen-agent.js"() {
+  "../server/dist/agents/qwen-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8411,7 +8416,7 @@ var init_qwen_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/hunyuan-agent.js
+// ../server/dist/agents/hunyuan-agent.js
 function safeParse3(json) {
   try {
     return JSON.parse(json || "{}");
@@ -8421,7 +8426,7 @@ function safeParse3(json) {
 }
 var HunyuanAgent;
 var init_hunyuan_agent = __esm({
-  "packages/server/dist/agents/hunyuan-agent.js"() {
+  "../server/dist/agents/hunyuan-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8592,7 +8597,7 @@ var init_hunyuan_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/doubao-agent.js
+// ../server/dist/agents/doubao-agent.js
 function safeParse4(json) {
   try {
     return JSON.parse(json || "{}");
@@ -8602,7 +8607,7 @@ function safeParse4(json) {
 }
 var DoubaoAgent;
 var init_doubao_agent = __esm({
-  "packages/server/dist/agents/doubao-agent.js"() {
+  "../server/dist/agents/doubao-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8773,7 +8778,7 @@ var init_doubao_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/openai-agent.js
+// ../server/dist/agents/openai-agent.js
 function safeParse5(json) {
   try {
     return JSON.parse(json || "{}");
@@ -8783,7 +8788,7 @@ function safeParse5(json) {
 }
 var OpenAIAgent;
 var init_openai_agent = __esm({
-  "packages/server/dist/agents/openai-agent.js"() {
+  "../server/dist/agents/openai-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -8955,7 +8960,7 @@ var init_openai_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/mantle-agent.js
+// ../server/dist/agents/mantle-agent.js
 import { SignatureV4 } from "@smithy/signature-v4";
 import { Sha256 } from "@aws-crypto/sha256-js";
 import { defaultProvider } from "@aws-sdk/credential-provider-node";
@@ -8972,7 +8977,7 @@ function safeParse6(json) {
 }
 var MantleAgent;
 var init_mantle_agent = __esm({
-  "packages/server/dist/agents/mantle-agent.js"() {
+  "../server/dist/agents/mantle-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -9191,10 +9196,10 @@ var init_mantle_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/anthropic-agent.js
+// ../server/dist/agents/anthropic-agent.js
 var AnthropicAgent;
 var init_anthropic_agent = __esm({
-  "packages/server/dist/agents/anthropic-agent.js"() {
+  "../server/dist/agents/anthropic-agent.js"() {
     "use strict";
     init_config();
     init_agent_loop();
@@ -9318,7 +9323,7 @@ var init_anthropic_agent = __esm({
   }
 });
 
-// packages/server/dist/agents/model-runtime.js
+// ../server/dist/agents/model-runtime.js
 function createModelRuntime(providerId, cfg) {
   switch (providerId) {
     case "aws-bedrock-claude-invoke":
@@ -9458,7 +9463,7 @@ function createModelRuntime(providerId, cfg) {
   }
 }
 var init_model_runtime = __esm({
-  "packages/server/dist/agents/model-runtime.js"() {
+  "../server/dist/agents/model-runtime.js"() {
     "use strict";
     init_bedrock_agent();
     init_deepseek_agent();
@@ -9473,7 +9478,7 @@ var init_model_runtime = __esm({
   }
 });
 
-// packages/server/dist/child-env.js
+// ../server/dist/child-env.js
 function cleanChildEnv() {
   const env = { ...process.env };
   delete env.HALO_PASSWORD;
@@ -9481,17 +9486,17 @@ function cleanChildEnv() {
   return env;
 }
 var init_child_env = __esm({
-  "packages/server/dist/child-env.js"() {
+  "../server/dist/child-env.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/tools/sandbox.js
+// ../server/dist/tools/sandbox.js
 import { exec, execFile, spawn as spawn2 } from "node:child_process";
 import { promisify } from "node:util";
 import path25 from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { existsSync, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, realpathSync as realpathSync2, rmSync, writeFileSync } from "node:fs";
 function decodeWinOutput(buf) {
   try {
     return new TextDecoder("utf-8", { fatal: true }).decode(buf);
@@ -9525,7 +9530,7 @@ async function bwrapExec(args, opts) {
 }
 function spawnGroupExec(command, opts) {
   return new Promise((resolve2, reject) => {
-    const child = spawn2(command, { shell: true, detached: true, cwd: opts.cwd, env: cleanChildEnv() });
+    const child = opts.argv ? spawn2(opts.argv[0], opts.argv.slice(1), { detached: true, cwd: opts.cwd, env: opts.env ?? cleanChildEnv() }) : spawn2(command, { shell: true, detached: true, cwd: opts.cwd, env: cleanChildEnv() });
     let stdout = "";
     let stderr = "";
     let killReason = null;
@@ -9637,12 +9642,68 @@ async function isBwrapAvailable() {
     return false;
   }
 }
-function isBwrapCached() {
-  return _bwrapAvailable === true;
+async function isSeatbeltAvailable() {
+  if (process.platform !== "darwin")
+    return false;
+  if (_seatbeltAvailable !== null)
+    return _seatbeltAvailable;
+  try {
+    await execFileAsync(SANDBOX_EXEC, ["-p", "(version 1)(allow default)", "/usr/bin/true"], { timeout: 5e3 });
+    _seatbeltAvailable = true;
+  } catch (err) {
+    console.warn(`[Sandbox] sandbox-exec probe failed (${String(err.message).split("\n")[0]}) \u2014 non-full shell_exec unavailable`);
+    _seatbeltAvailable = false;
+  }
+  return _seatbeltAvailable;
+}
+function getSandboxBackend() {
+  if (_bwrapAvailable === true)
+    return "bwrap";
+  if (_seatbeltAvailable === true)
+    return "seatbelt";
+  return null;
+}
+async function loadGitIdentity() {
+  const read = async (key) => {
+    try {
+      return String((await execFileAsync("git", ["config", "--global", key], { timeout: 3e3 })).stdout).trim();
+    } catch {
+      return "";
+    }
+  };
+  const [name, email] = await Promise.all([read("user.name"), read("user.email")]);
+  _gitIdentity = { name, email };
+}
+function gitIdentityEnv() {
+  const env = {};
+  if (_gitIdentity.name) {
+    env.GIT_AUTHOR_NAME = _gitIdentity.name;
+    env.GIT_COMMITTER_NAME = _gitIdentity.name;
+  }
+  if (_gitIdentity.email) {
+    env.GIT_AUTHOR_EMAIL = _gitIdentity.email;
+    env.GIT_COMMITTER_EMAIL = _gitIdentity.email;
+  }
+  return env;
 }
 async function initBwrapCheck() {
+  await loadGitIdentity();
+  if (process.platform === "darwin")
+    return isSeatbeltAvailable();
   return isBwrapAvailable();
 }
+function ensureEmptyMaskFile() {
+  try {
+    const st = lstatSync(EMPTY_MASK_FILE);
+    if (st.isFile() && st.size === 0)
+      return EMPTY_MASK_FILE;
+    rmSync(EMPTY_MASK_FILE, { recursive: true, force: true });
+  } catch {
+  }
+  mkdirSync(HALO_HOME3, { recursive: true });
+  writeFileSync(EMPTY_MASK_FILE, "");
+  return EMPTY_MASK_FILE;
+}
 function expandTilde(p) {
   return p.startsWith("~/") ? path25.join(HOME, p.slice(2)) : p;
 }
@@ -9650,6 +9711,20 @@ function setSandboxHiddenPaths(dirs, files, writableDirs = []) {
   _hiddenDirs = dirs;
   _hiddenFiles = files;
   _writableDirs = writableDirs;
+  _resolvedLists = null;
+}
+function resolvedLists() {
+  if (_resolvedLists)
+    return _resolvedLists;
+  const both = (raws) => [...new Set(raws.flatMap((raw) => {
+    const p = path25.resolve(expandTilde(raw));
+    return [p, realpathBounded(p)];
+  }))];
+  _resolvedLists = { hiddenDirs: both(_hiddenDirs), hiddenFiles: both(_hiddenFiles), writableDirs: both(_writableDirs) };
+  return _resolvedLists;
+}
+function isUnder(p, dir) {
+  return p === dir || p.startsWith(dir.endsWith("/") ? dir : dir + "/");
 }
 function buildBwrapArgs(opts) {
   const args = [];
@@ -9660,10 +9735,11 @@ function buildBwrapArgs(opts) {
     if (existsSync(dir))
       args.push("--tmpfs", dir);
   }
+  const emptyFile = ensureEmptyMaskFile();
   for (const raw of _hiddenFiles) {
     const file = expandTilde(raw);
     if (existsSync(file))
-      args.push("--ro-bind", "/dev/null", file);
+      args.push("--ro-bind", emptyFile, file);
   }
   if (opts.accessLevel !== "readonly") {
     args.push("--bind", opts.workspaceRoot, opts.workspaceRoot);
@@ -9683,7 +9759,7 @@ function buildBwrapArgs(opts) {
   for (const rel of WORKSPACE_HIDDEN_FILES) {
     const file = path25.join(opts.workspaceRoot, rel);
     if (existsSync(file))
-      args.push("--ro-bind", "/dev/null", file);
+      args.push("--ro-bind", emptyFile, file);
   }
   args.push("--proc", "/proc");
   args.push("--dev", "/dev");
@@ -9691,6 +9767,8 @@ function buildBwrapArgs(opts) {
   args.push("--setenv", "PATH", `${HOME}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`);
   args.push("--setenv", "HOME", HOME);
   args.push("--setenv", "TERM", "xterm-256color");
+  for (const [k, v] of Object.entries(gitIdentityEnv()))
+    args.push("--setenv", k, v);
   args.push("--die-with-parent");
   return args;
 }
@@ -9718,31 +9796,57 @@ function assertPathAllowed(filePath, opts, write = false) {
     return path25.resolve(filePath);
   const resolved = realpathBounded(filePath);
   const wsRoot = realpathBounded(opts.workspaceRoot);
-  if (resolved === wsRoot || resolved.startsWith(wsRoot + "/")) {
-    if (isHiddenWorkspacePath(resolved, wsRoot)) {
-      throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
-    }
-    if (write && opts.accessLevel === "readonly") {
-      throw new Error(`Access denied: readonly session cannot write to "${filePath}"`);
-    }
-    return resolved;
+  const inWorkspace = isUnder(resolved, wsRoot);
+  if (inWorkspace && isHiddenWorkspacePath(resolved, wsRoot) || isHiddenHostPath(resolved)) {
+    throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
   }
-  if (!write && (resolved === GLOBAL_DIR || resolved.startsWith(GLOBAL_DIR + "/")) && !isHiddenGlobalPath(resolved)) {
+  if (!write)
     return resolved;
+  if (opts.accessLevel === "readonly") {
+    throw new Error(`Access denied: readonly session cannot write to "${filePath}"`);
   }
+  if (inWorkspace || resolvedLists().writableDirs.some((d) => isUnder(resolved, d)))
+    return resolved;
   throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
 }
-function isHiddenGlobalPath(resolved) {
-  for (const raw of _hiddenFiles) {
-    if (resolved === expandTilde(raw))
-      return true;
-  }
-  for (const raw of _hiddenDirs) {
-    const dir = expandTilde(raw);
-    if (resolved === dir || resolved.startsWith(dir + "/"))
-      return true;
+function isHiddenHostPath(resolved) {
+  const { hiddenDirs, hiddenFiles } = resolvedLists();
+  return hiddenFiles.includes(resolved) || hiddenDirs.some((d) => isUnder(resolved, d));
+}
+function buildSeatbeltProfile(opts) {
+  const q = (p) => `"${p.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  const wsRoot = realpathBounded(opts.workspaceRoot);
+  const lists = resolvedLists();
+  const writable = ["/private/tmp", "/private/var/folders", "/dev"];
+  if (opts.accessLevel !== "readonly")
+    writable.unshift(wsRoot, ...lists.writableDirs);
+  const hiddenDirs = [...lists.hiddenDirs, ...WORKSPACE_HIDDEN_DIRS.map((rel) => path25.join(wsRoot, rel))];
+  const hiddenFiles = [...lists.hiddenFiles, ...WORKSPACE_HIDDEN_FILES.map((rel) => path25.join(wsRoot, rel))];
+  return [
+    "(version 1)",
+    "(allow default)",
+    "(deny file-write*)",
+    `(allow file-write* ${writable.map((p) => `(subpath ${q(p)})`).join(" ")})`,
+    `(deny file-read* file-write* ${[
+      ...hiddenDirs.map((p) => `(subpath ${q(p)})`),
+      ...hiddenFiles.map((p) => `(literal ${q(p)})`)
+    ].join(" ")})`
+  ].join("\n");
+}
+function seatbeltEnv() {
+  const env = {
+    PATH: `${HOME}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin`,
+    HOME,
+    TERM: "xterm-256color",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    NPM_CONFIG_USERCONFIG: "/dev/null",
+    ...gitIdentityEnv()
+  };
+  for (const k of ["TMPDIR", "USER", "LOGNAME", "LANG", "LC_ALL"]) {
+    if (process.env[k])
+      env[k] = process.env[k];
   }
-  return false;
+  return env;
 }
 function isHiddenWorkspacePath(resolved, wsRoot) {
   for (const rel of WORKSPACE_HIDDEN_FILES) {
@@ -9766,8 +9870,173 @@ function buildWriteScriptArgs(filePath, content) {
 function buildReaddirScriptArgs(dirPath) {
   return ["bash", "-c", 'ls -1ap "$1"', "bash", dirPath];
 }
+function shellSegments(command) {
+  const segments = [];
+  let words = [];
+  let cur = "";
+  let inWord = false;
+  let quote = null;
+  const heredocs = [];
+  const endWord = () => {
+    if (inWord)
+      words.push(cur);
+    cur = "";
+    inWord = false;
+  };
+  const endSegment = () => {
+    endWord();
+    if (words.length)
+      segments.push(words);
+    words = [];
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      if (c === quote)
+        quote = null;
+      else if (c === "\\" && quote === '"' && i + 1 < command.length)
+        cur += command[++i];
+      else
+        cur += c;
+      continue;
+    }
+    if (c === "<" && command[i + 1] === "<" && command[i + 2] !== "<") {
+      const m = /^<<(-?)\s*(['"]?)([A-Za-z0-9_.-]+)\2/.exec(command.slice(i));
+      if (m) {
+        endWord();
+        heredocs.push({ delim: m[3], dash: m[1] === "-" });
+        i += m[0].length - 1;
+        continue;
+      }
+    }
+    if (c === "\n" && heredocs.length) {
+      endSegment();
+      let pos = i + 1;
+      for (const h of heredocs.splice(0)) {
+        while (pos < command.length) {
+          const eol = command.indexOf("\n", pos);
+          const line = command.slice(pos, eol === -1 ? command.length : eol);
+          pos = eol === -1 ? command.length : eol + 1;
+          if ((h.dash ? line.replace(/^\t+/, "") : line) === h.delim)
+            break;
+        }
+      }
+      i = pos - 1;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      inWord = true;
+    } else if (c === "\\" && command[i + 1] === "\n")
+      i++;
+    else if (c === "\\" && i + 1 < command.length) {
+      cur += command[++i];
+      inWord = true;
+    } else if (c === ";" || c === "&" || c === "|" || c === "\n")
+      endSegment();
+    else if (c === " " || c === "	" || c === "\r")
+      endWord();
+    else {
+      cur += c;
+      inWord = true;
+    }
+  }
+  endSegment();
+  return segments;
+}
+function expandRmWord(word, cwd) {
+  return word.replace(/^~(?=\/|$)/, HOME).replace(/\$\{HOME\}|\$HOME\b/g, HOME).replace(/\$\{PWD\}|\$PWD\b|\$\(pwd\)|`pwd`/g, cwd).replace(/\$\{[^}]*\}|\$\([^)]*\)|`[^`]*`|\$[A-Za-z_][A-Za-z0-9_]*|\$\d/g, "");
+}
+function stripSubshellClose(word) {
+  let w = word;
+  while (w.endsWith(")") && (w.match(/\(/g)?.length ?? 0) < (w.match(/\)/g)?.length ?? 0))
+    w = w.slice(0, -1);
+  return w;
+}
+function rmProtectedReason(target, wsRoot) {
+  if (target === "/")
+    return "the filesystem root";
+  if (isUnder(HOME, target))
+    return "the home directory or a parent of it";
+  if (isUnder(HALO_HOME3, target))
+    return "~/.halo or a parent of it";
+  if (isUnder(wsRoot, target))
+    return "the workspace root or a parent of it";
+  if (RM_EXACT_DIRS.includes(target))
+    return "a system directory";
+  for (const d of RM_SYSTEM_DIRS) {
+    if (target === d || path25.dirname(target) === d)
+      return "a system directory";
+  }
+  return null;
+}
+function assertRmSafe(command, workspaceRoot) {
+  const wsRoot = path25.resolve(workspaceRoot);
+  let cwd = wsRoot;
+  for (const words of shellSegments(command)) {
+    let i = 0;
+    let cmd = "";
+    for (; i < words.length; i++) {
+      cmd = words[i].replace(/^[({!]+/, "");
+      if (!cmd || /^[A-Za-z_][A-Za-z0-9_]*=/.test(cmd))
+        continue;
+      if (RM_WRAPPERS.has(path25.basename(cmd))) {
+        while (i + 1 < words.length && words[i + 1].startsWith("-"))
+          i++;
+        continue;
+      }
+      break;
+    }
+    if (i >= words.length)
+      continue;
+    if (cmd === "cd") {
+      const dest = words[i + 1];
+      if (dest === void 0)
+        cwd = HOME;
+      else if (dest !== "-")
+        cwd = path25.resolve(cwd, expandRmWord(stripSubshellClose(dest), cwd) || ".");
+      continue;
+    }
+    const base = path25.basename(cmd);
+    if (base !== "rm" && base !== "rmdir")
+      continue;
+    let optionsDone = false;
+    for (let j = i + 1; j < words.length; j++) {
+      const raw = words[j];
+      if (!optionsDone && raw === "--") {
+        optionsDone = true;
+        continue;
+      }
+      if (!optionsDone && raw.startsWith("-"))
+        continue;
+      if (/^(\d*|&)?[<>]/.test(raw)) {
+        if (/^(\d*|&)?[<>]+&?$/.test(raw))
+          j++;
+        continue;
+      }
+      const word = expandRmWord(stripSubshellClose(raw), cwd);
+      if (!word)
+        continue;
+      const abs = path25.resolve(cwd, word);
+      const parts = abs.split("/");
+      const globAt = parts.findIndex((p) => /[*?[]/.test(p));
+      let target = abs;
+      if (globAt !== -1) {
+        if (!/^[.*?]+$/.test(parts[globAt]))
+          continue;
+        target = parts.slice(0, globAt).join("/") || "/";
+      }
+      const reason = rmProtectedReason(target, wsRoot);
+      if (reason) {
+        throw new Error(`[Sandbox] rm blocked: "${raw}" resolves to ${target}, which is ${reason}. Name the specific files or subdirectories to delete instead.`);
+      }
+    }
+  }
+}
 async function sandboxExec(command, opts) {
   opts = normalizeOptsForPlatform(opts);
+  if (process.platform !== "win32")
+    assertRmSafe(command, opts.workspaceRoot);
   if (opts.accessLevel === "full") {
     if (process.platform === "win32") {
       const result = await execAsync(`chcp 65001 >nul 2>&1 & ${command}`, {
@@ -9789,10 +10058,21 @@ async function sandboxExec(command, opts) {
       signal: opts.signal
     });
   }
-  const bwrapOk = await isBwrapAvailable();
-  if (!bwrapOk) {
-    throw new Error("Access denied: shell_exec requires bubblewrap (bwrap) for non-full access levels. Install with: apt install bubblewrap");
+  if (process.platform === "darwin") {
+    if (!await isSeatbeltAvailable())
+      throw new Error(NO_SANDBOX_MSG);
+    return spawnGroupExec(command, {
+      cwd: opts.workspaceRoot,
+      timeout: opts.timeout,
+      maxBuffer: opts.maxBuffer,
+      signal: opts.signal,
+      argv: [SANDBOX_EXEC, "-p", buildSeatbeltProfile(opts), ...buildExecScriptArgs(opts.workspaceRoot, command)],
+      env: seatbeltEnv()
+    });
   }
+  const bwrapOk = await isBwrapAvailable();
+  if (!bwrapOk)
+    throw new Error(NO_SANDBOX_MSG);
   const bwrapArgs = buildBwrapArgs(opts);
   return bwrapExec([...bwrapArgs, "--", ...buildExecScriptArgs(opts.workspaceRoot, command)], {
     timeout: opts.timeout,
@@ -9959,18 +10239,21 @@ async function sandboxReaddir(dirPath, opts) {
     return { name: isDir ? name.slice(0, -1) : name, isDirectory: isDir };
   });
 }
-var execAsync, execFileAsync, HOME, HALO_HOME3, GLOBAL_DIR, KILL_GRACE_MS, _bwrapAvailable, DEFAULT_HIDDEN_DIRS, DEFAULT_HIDDEN_FILES, WORKSPACE_HIDDEN_DIRS, WORKSPACE_HIDDEN_FILES, _hiddenDirs, _hiddenFiles, _writableDirs;
+var execAsync, execFileAsync, HOME, HALO_HOME3, KILL_GRACE_MS, _bwrapAvailable, SANDBOX_EXEC, _seatbeltAvailable, _gitIdentity, EMPTY_MASK_FILE, DEFAULT_HIDDEN_DIRS, DEFAULT_HIDDEN_FILES, WORKSPACE_HIDDEN_DIRS, WORKSPACE_HIDDEN_FILES, _hiddenDirs, _hiddenFiles, _writableDirs, _resolvedLists, RM_SYSTEM_DIRS, RM_EXACT_DIRS, RM_WRAPPERS, NO_SANDBOX_MSG;
 var init_sandbox = __esm({
-  "packages/server/dist/tools/sandbox.js"() {
+  "../server/dist/tools/sandbox.js"() {
     "use strict";
     init_child_env();
     execAsync = promisify(exec);
     execFileAsync = promisify(execFile);
     HOME = homedir10();
     HALO_HOME3 = path25.join(HOME, ".halo");
-    GLOBAL_DIR = path25.join(HALO_HOME3, "global");
     KILL_GRACE_MS = 2e3;
     _bwrapAvailable = null;
+    SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+    _seatbeltAvailable = null;
+    _gitIdentity = { name: "", email: "" };
+    EMPTY_MASK_FILE = path25.join(HALO_HOME3, ".sandbox-empty");
     DEFAULT_HIDDEN_DIRS = [
       "~/.halo/secrets",
       "~/.aws",
@@ -10011,10 +10294,42 @@ var init_sandbox = __esm({
     _hiddenDirs = DEFAULT_HIDDEN_DIRS;
     _hiddenFiles = DEFAULT_HIDDEN_FILES;
     _writableDirs = [];
+    _resolvedLists = null;
+    RM_SYSTEM_DIRS = [
+      "/bin",
+      "/boot",
+      "/dev",
+      "/etc",
+      "/home",
+      "/lib",
+      "/lib32",
+      "/lib64",
+      "/libx32",
+      "/media",
+      "/mnt",
+      "/opt",
+      "/proc",
+      "/run",
+      "/sbin",
+      "/snap",
+      "/srv",
+      "/sys",
+      "/usr",
+      "/var",
+      "/Applications",
+      "/Library",
+      "/System",
+      "/Users",
+      "/Volumes",
+      "/private"
+    ];
+    RM_EXACT_DIRS = ["/tmp", "/private/tmp", "/root"];
+    RM_WRAPPERS = /* @__PURE__ */ new Set(["sudo", "command", "env", "xargs", "nohup", "time", "exec", "nice", "if", "then", "else", "elif", "do", "while", "until"]);
+    NO_SANDBOX_MSG = "Access denied: shell_exec at workspace/readonly access needs an OS sandbox (bubblewrap on Linux, sandbox-exec on macOS) and none works on this host. Switch the session to Full, or on Linux install bubblewrap (apt install bubblewrap).";
   }
 });
 
-// packages/server/dist/tools/workspace-tools.js
+// ../server/dist/tools/workspace-tools.js
 import fs22 from "node:fs/promises";
 import path26 from "node:path";
 import crypto from "node:crypto";
@@ -10530,10 +10845,13 @@ Error: old_string appears more than once in ${input.path}. Either expand it with
 STDERR: ${stderr}` : "")).trim() || "(no output)");
       } catch (err) {
         const error = err;
-        return mask(`${TOOL_ERROR_MARKER}
-Command failed: ${error.message}
+        const out = `${error.message}
 ${error.stdout ?? ""}
-${error.stderr ?? ""}`);
+${error.stderr ?? ""}`;
+        const hint = accessLevel !== "full" && SANDBOX_DENIED_RE.test(out) ? `
+[Sandbox] This session runs at "${accessLevel}" access: writes are limited to the workspace${accessLevel === "readonly" ? " (readonly: nowhere)" : ""} and /tmp is discarded after each command. If the command needs more, ask the user to switch the access level to Full in the chat input box.` : "";
+        return mask(`${TOOL_ERROR_MARKER}
+Command failed: ${out}${hint}`);
       }
     }
   };
@@ -10698,7 +11016,7 @@ Error: ${error.message}`;
   };
   const visionTools = supportsVision ? [viewImage] : [];
   const allTools = [fileRead, ...visionTools, fileWrite, fileEdit, fileList, shellExec, grepTool, globTool, webFetch];
-  if (accessLevel === "readonly" && !isBwrapCached()) {
+  if (accessLevel === "readonly" && getSandboxBackend() === null) {
     return [fileRead, ...visionTools, fileList, grepTool, globTool];
   }
   return allTools;
@@ -10731,9 +11049,9 @@ function imageDimensions(buf, mediaType) {
   }
   return null;
 }
-var SKIP_DIRS, SKIP_HALO_SUBDIRS, GLOB_MAX_RESULTS, HOME2, PARAMS_PATTERN, ENV_PATTERN3;
+var SKIP_DIRS, SKIP_HALO_SUBDIRS, GLOB_MAX_RESULTS, SANDBOX_DENIED_RE, HOME2, PARAMS_PATTERN, ENV_PATTERN3;
 var init_workspace_tools = __esm({
-  "packages/server/dist/tools/workspace-tools.js"() {
+  "../server/dist/tools/workspace-tools.js"() {
     "use strict";
     init_config();
     init_sandbox();
@@ -10744,13 +11062,14 @@ var init_workspace_tools = __esm({
     SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", "dist"]);
     SKIP_HALO_SUBDIRS = /* @__PURE__ */ new Set(["sessions", "logs", "evo", "tmp", "assets", "canvas"]);
     GLOB_MAX_RESULTS = 5e3;
+    SANDBOX_DENIED_RE = /Read-only file system|Operation not permitted|Permission denied|EROFS|EPERM/;
     HOME2 = homedir11();
     PARAMS_PATTERN = /\{\{\s*([\w-]+)\.params\.([\w-][\w.-]*)\s*\}\}/g;
     ENV_PATTERN3 = /<<([A-Z_][A-Z0-9_]*)>>/g;
   }
 });
 
-// packages/server/dist/tools/draft-tool.js
+// ../server/dist/tools/draft-tool.js
 function createDraftTool() {
   let drafts = 0;
   const tool = {
@@ -10785,7 +11104,7 @@ Error: draft requires non-empty \`content\` \u2014 put your full draft answer th
 }
 var MAX_DRAFTS, REVIEW_CHECKLIST;
 var init_draft_tool = __esm({
-  "packages/server/dist/tools/draft-tool.js"() {
+  "../server/dist/tools/draft-tool.js"() {
     "use strict";
     init_agent_loop();
     MAX_DRAFTS = 3;
@@ -10799,7 +11118,7 @@ If the draft clears all three, write the final answer now. If not, fix it (gathe
   }
 });
 
-// packages/server/dist/prompts/system-prompts.js
+// ../server/dist/prompts/system-prompts.js
 import fs23 from "node:fs/promises";
 import path27 from "node:path";
 import { homedir as homedir12 } from "node:os";
@@ -10885,17 +11204,17 @@ async function loadSystemPrompts(workspaceRoot) {
 }
 var GLOBAL_PROMPTS_DIR;
 var init_system_prompts = __esm({
-  "packages/server/dist/prompts/system-prompts.js"() {
+  "../server/dist/prompts/system-prompts.js"() {
     "use strict";
     GLOBAL_PROMPTS_DIR = path27.join(homedir12(), ".halo", "global", "prompts");
   }
 });
 
-// packages/server/dist/agents/session-agent-builder.js
+// ../server/dist/agents/session-agent-builder.js
 import path28 from "node:path";
 var SessionAgentBuilder;
 var init_session_agent_builder = __esm({
-  "packages/server/dist/agents/session-agent-builder.js"() {
+  "../server/dist/agents/session-agent-builder.js"() {
     "use strict";
     init_model_runtime();
     init_workspace_tools();
@@ -11267,7 +11586,7 @@ ${roster}`;
   }
 });
 
-// packages/server/dist/agents/session-skill-commands.js
+// ../server/dist/agents/session-skill-commands.js
 import { eq as eq8 } from "drizzle-orm";
 function commandVisibilityGate(d) {
   if (!d.verbs || d.verbs.length === 0)
@@ -11284,7 +11603,7 @@ function commandVisibilityGate(d) {
 }
 var SessionSkillCommands;
 var init_session_skill_commands = __esm({
-  "packages/server/dist/agents/session-skill-commands.js"() {
+  "../server/dist/agents/session-skill-commands.js"() {
     "use strict";
     init_db();
     init_schema();
@@ -11349,12 +11668,12 @@ var init_session_skill_commands = __esm({
   }
 });
 
-// packages/server/dist/agents/session-state-store.js
+// ../server/dist/agents/session-state-store.js
 import fsSync6 from "node:fs";
 import path29 from "node:path";
 var SessionStateStore;
 var init_session_state_store = __esm({
-  "packages/server/dist/agents/session-state-store.js"() {
+  "../server/dist/agents/session-state-store.js"() {
     "use strict";
     init_session_store();
     SessionStateStore = class {
@@ -11418,7 +11737,7 @@ var init_session_state_store = __esm({
   }
 });
 
-// packages/server/dist/observability/otel-sdk.js
+// ../server/dist/observability/otel-sdk.js
 var otel_sdk_exports = {};
 __export(otel_sdk_exports, {
   registerSdk: () => registerSdk
@@ -11457,12 +11776,12 @@ function registerSdk(serviceName, serviceVersion) {
   return [tracerProvider, meterProvider, loggerProvider];
 }
 var init_otel_sdk = __esm({
-  "packages/server/dist/observability/otel-sdk.js"() {
+  "../server/dist/observability/otel-sdk.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/observability/otel.js
+// ../server/dist/observability/otel.js
 import { trace, metrics as metrics2, ProxyTracerProvider } from "@opentelemetry/api";
 import { logs as logs2 } from "@opentelemetry/api-logs";
 function externalSdkRegistered() {
@@ -11487,7 +11806,7 @@ async function initObservability() {
     return true;
   }
   const { registerSdk: registerSdk2 } = await Promise.resolve().then(() => (init_otel_sdk(), otel_sdk_exports));
-  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.3.4");
+  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.4.1");
   console.log(`[Observability] OTLP export \u2192 ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT} (service.name=${process.env.OTEL_SERVICE_NAME}, capture_content=${config.observability.captureContent})`);
   return true;
 }
@@ -11508,7 +11827,7 @@ async function shutdownObservability() {
 }
 var SCOPE, enabled, tracer, getMeter, otelLogger, captureContent, providers;
 var init_otel = __esm({
-  "packages/server/dist/observability/otel.js"() {
+  "../server/dist/observability/otel.js"() {
     "use strict";
     init_config();
     SCOPE = "opentelemetry.instrumentation.halo";
@@ -11521,7 +11840,7 @@ var init_otel = __esm({
   }
 });
 
-// packages/server/dist/observability/genai-spans.js
+// ../server/dist/observability/genai-spans.js
 import { context, trace as trace2, SpanStatusCode } from "@opentelemetry/api";
 function instruments() {
   const meter = getMeter();
@@ -11747,7 +12066,7 @@ function recordRetry(kind) {
 }
 var turns, SYSTEM, PART_CAP, SYSTEM_PROMPT_CAP, ATTR_CAP, cachedInstruments, metricsFor;
 var init_genai_spans = __esm({
-  "packages/server/dist/observability/genai-spans.js"() {
+  "../server/dist/observability/genai-spans.js"() {
     "use strict";
     init_otel();
     turns = /* @__PURE__ */ new Map();
@@ -11760,7 +12079,7 @@ var init_genai_spans = __esm({
   }
 });
 
-// packages/server/dist/agents/session-manager.js
+// ../server/dist/agents/session-manager.js
 import fsSync7 from "node:fs";
 import path30 from "node:path";
 import { eq as eq9, and as and6, isNull as isNull4, isNotNull as isNotNull2 } from "drizzle-orm";
@@ -11863,7 +12182,7 @@ function generateSessionId() {
 }
 var CONTINUE_TASK_KICK, SessionManager;
 var init_session_manager = __esm({
-  "packages/server/dist/agents/session-manager.js"() {
+  "../server/dist/agents/session-manager.js"() {
     "use strict";
     init_md_loader();
     init_config();
@@ -12483,6 +12802,24 @@ var init_session_manager = __esm({
       dropUIState(sessionId) {
         this.uiStore.dropUIState(sessionId);
       }
+      /** Another process (a cron `halo cli` child) just wrote this root session's
+       *  files. Drop the idle in-memory copies — the tree's AgentSessions (raw
+       *  history, loaded by any view via ensureSession and never evicted while
+       *  idle) and the root's UIState — WITHOUT saving, so the next view/message
+       *  re-reads disk instead of overwriting the other writer's turn with this
+       *  process's stale snapshot. Returns false (and drops nothing) while any
+       *  turn/compact in the tree is in flight: live state can't be discarded,
+       *  and the two writers race — the accepted cost of sharing a session. */
+      forgetExternalWrite(rootId) {
+        if (this.hasActiveWorkInTree(rootId))
+          return false;
+        for (const id of [...this.sessions.keys()]) {
+          if (id === rootId || id.startsWith(`${rootId}>`))
+            this.sessions.delete(id);
+        }
+        this.uiStore.dropUIState(rootId);
+        return true;
+      }
       // ── Loop detection ──────────────────────────────────────────────────
       static LOOP_EXEMPT_TOOLS = /* @__PURE__ */ new Set([
         "session_list",
@@ -13614,29 +13951,6 @@ ${result.summary}`, agentName: "user", report: true, taskId });
           opts?.onProgress?.("done");
         }
       }
-      /**
-       * Reset agent instance (destroy + allow rebuild) without destroying sub-sessions.
-       * Used after compact to rebuild with new context.
-       */
-      async resetAgent(sessionId) {
-        const session = this.sessions.get(sessionId);
-        if (!session)
-          return;
-        if (session.abortController) {
-          session.abortController.abort();
-          session.abortController = null;
-        }
-        session.toolCallLog = [];
-        session.warnedToolHashes.clear();
-        session.interruptRequested = false;
-        const savedMessages = session.agent.messages;
-        const { agent, modelId, systemPrompt, draftReset } = await this.buildAgentInstance(session.agentId, sessionId, session.parentId, session.workingDir ?? void 0, session.accessLevel);
-        session.agent = agent;
-        session.agent.messages = savedMessages;
-        session.currentModelId = modelId;
-        session.systemPrompt = systemPrompt;
-        session.draftReset = draftReset;
-      }
       /**
        * Set raw agent messages directly (for compact rebuild).
        */
@@ -13980,11 +14294,11 @@ ${q.text}` : q.text);
   }
 });
 
-// packages/server/dist/agents/session-manager-registry.js
+// ../server/dist/agents/session-manager-registry.js
 import fs24 from "node:fs";
 var SessionManagerRegistry;
 var init_session_manager_registry = __esm({
-  "packages/server/dist/agents/session-manager-registry.js"() {
+  "../server/dist/agents/session-manager-registry.js"() {
     "use strict";
     init_session_manager();
     init_init();
@@ -14039,7 +14353,7 @@ var init_session_manager_registry = __esm({
   }
 });
 
-// packages/server/dist/logger.js
+// ../server/dist/logger.js
 import fs25 from "node:fs";
 import path31 from "node:path";
 import { homedir as homedir13 } from "node:os";
@@ -14159,7 +14473,7 @@ function initLogger() {
 }
 var LOG_FILENAME, logDir, logFile, currentSize, LEVEL_ORDER, OTEL_SEVERITY;
 var init_logger = __esm({
-  "packages/server/dist/logger.js"() {
+  "../server/dist/logger.js"() {
     "use strict";
     init_config();
     init_otel();
@@ -14177,7 +14491,7 @@ var init_logger = __esm({
   }
 });
 
-// packages/cli/src/harness.ts
+// src/harness.ts
 var harness_exports = {};
 __export(harness_exports, {
   createHarness: () => createHarness,
@@ -14418,7 +14732,7 @@ async function createHarness(opts) {
 }
 var SESSION_PREFIX, USER_ID;
 var init_harness = __esm({
-  "packages/cli/src/harness.ts"() {
+  "src/harness.ts"() {
     "use strict";
     init_session_manager();
     init_session_manager_registry();
@@ -14435,7 +14749,7 @@ var init_harness = __esm({
   }
 });
 
-// packages/server/dist/middleware/password-hash.js
+// ../server/dist/middleware/password-hash.js
 var password_hash_exports = {};
 __export(password_hash_exports, {
   generateJwtSecret: () => generateJwtSecret,
@@ -14485,7 +14799,7 @@ function generateJwtSecret() {
 }
 var scryptAsync, COST, KEY_LEN;
 var init_password_hash = __esm({
-  "packages/server/dist/middleware/password-hash.js"() {
+  "../server/dist/middleware/password-hash.js"() {
     "use strict";
     scryptAsync = promisify2(crypto2.scrypt);
     COST = { N: 16384, r: 8, p: 1 };
@@ -14493,7 +14807,7 @@ var init_password_hash = __esm({
   }
 });
 
-// packages/server/dist/setup-config.js
+// ../server/dist/setup-config.js
 var setup_config_exports = {};
 __export(setup_config_exports, {
   configLeafSet: () => configLeafSet,
@@ -14534,13 +14848,13 @@ function configLeafSet(dotPath) {
 }
 var CONFIG_PATH;
 var init_setup_config = __esm({
-  "packages/server/dist/setup-config.js"() {
+  "../server/dist/setup-config.js"() {
     "use strict";
     CONFIG_PATH = path33.join(homedir14(), ".halo", "secrets", "config.yaml");
   }
 });
 
-// packages/server/dist/setup-settings.js
+// ../server/dist/setup-settings.js
 var setup_settings_exports = {};
 __export(setup_settings_exports, {
   maskSecret: () => maskSecret,
@@ -14619,13 +14933,13 @@ function maskSecret(value) {
 }
 var SETTINGS_PATH2;
 var init_setup_settings = __esm({
-  "packages/server/dist/setup-settings.js"() {
+  "../server/dist/setup-settings.js"() {
     "use strict";
     SETTINGS_PATH2 = path34.join(homedir15(), ".halo", "secrets", "settings.yaml");
   }
 });
 
-// packages/server/dist/setup-providers.js
+// ../server/dist/setup-providers.js
 var setup_providers_exports = {};
 __export(setup_providers_exports, {
   AWS_CREDENTIAL_CHAIN_PROVIDER: () => AWS_CREDENTIAL_CHAIN_PROVIDER,
@@ -14831,7 +15145,7 @@ function listRequiredSkillsWithSecrets() {
 }
 var AWS_CREDENTIAL_CHAIN_PROVIDER, REBIND_BUILTIN_AGENT_IDS, GLOBAL_AGENTS_DIR3;
 var init_setup_providers = __esm({
-  "packages/server/dist/setup-providers.js"() {
+  "../server/dist/setup-providers.js"() {
     "use strict";
     init_init();
     init_setup_settings();
@@ -14841,7 +15155,7 @@ var init_setup_providers = __esm({
   }
 });
 
-// packages/cli/src/setup-bind-provider.ts
+// src/setup-bind-provider.ts
 var setup_bind_provider_exports = {};
 __export(setup_bind_provider_exports, {
   AWS_CHAIN_PROVIDER: () => AWS_CHAIN_PROVIDER,
@@ -14881,14 +15195,14 @@ function buildBindProviderPlan(configured, currentProvider, currentProviderHasKe
 }
 var AWS_CHAIN_PROVIDER, KEEP_CURRENT;
 var init_setup_bind_provider = __esm({
-  "packages/cli/src/setup-bind-provider.ts"() {
+  "src/setup-bind-provider.ts"() {
     "use strict";
     AWS_CHAIN_PROVIDER = "aws-bedrock-claude-invoke";
     KEEP_CURRENT = "__keep__";
   }
 });
 
-// packages/cli/src/setup-prompts.ts
+// src/setup-prompts.ts
 var setup_prompts_exports = {};
 __export(setup_prompts_exports, {
   promptMultiSelect: () => promptMultiSelect,
@@ -15174,12 +15488,12 @@ function promptMultiSelectRich(question, options) {
   });
 }
 var init_setup_prompts = __esm({
-  "packages/cli/src/setup-prompts.ts"() {
+  "src/setup-prompts.ts"() {
     "use strict";
   }
 });
 
-// packages/cli/src/upgrade-verify.ts
+// src/upgrade-verify.ts
 var upgrade_verify_exports = {};
 __export(upgrade_verify_exports, {
   ALLOW_SCRIPTS: () => ALLOW_SCRIPTS,
@@ -15204,7 +15518,7 @@ function verifyNativeModules(pkgRoot) {
 }
 var NATIVE_MODULE_SMOKES, ALLOW_SCRIPTS;
 var init_upgrade_verify = __esm({
-  "packages/cli/src/upgrade-verify.ts"() {
+  "src/upgrade-verify.ts"() {
     "use strict";
     NATIVE_MODULE_SMOKES = [
       { name: "better-sqlite3", smoke: "new (require(process.argv[1]))(':memory:')" },
@@ -15214,7 +15528,7 @@ var init_upgrade_verify = __esm({
   }
 });
 
-// packages/cli/src/render-md.ts
+// src/render-md.ts
 import { marked } from "marked";
 import { markedTerminal } from "marked-terminal";
 function renderMarkdown(text6) {
@@ -15222,14 +15536,14 @@ function renderMarkdown(text6) {
   return rendered.replace(/\n{3,}/g, "\n\n").trimEnd();
 }
 var init_render_md = __esm({
-  "packages/cli/src/render-md.ts"() {
+  "src/render-md.ts"() {
     "use strict";
     marked.use(markedTerminal({ reflowText: true, width: Math.min(process.stdout.columns || 80, 120) }));
     marked.use({ breaks: true });
   }
 });
 
-// packages/cli/src/resolve-refs.ts
+// src/resolve-refs.ts
 import fs31 from "node:fs";
 import path37 from "node:path";
 function resolveRefs(input, workspace) {
@@ -15308,7 +15622,7 @@ ${content}
 }
 var MAX_FILE_BYTES, MAX_IMAGE_BYTES, REF_PATTERN;
 var init_resolve_refs = __esm({
-  "packages/cli/src/resolve-refs.ts"() {
+  "src/resolve-refs.ts"() {
     "use strict";
     init_dist();
     MAX_FILE_BYTES = 100 * 1024;
@@ -15317,7 +15631,7 @@ var init_resolve_refs = __esm({
   }
 });
 
-// packages/cli/src/format-usage.ts
+// src/format-usage.ts
 function fmtK(n) {
   return `${(n / 1e3).toFixed(1)}K`;
 }
@@ -15361,7 +15675,7 @@ function formatUsageLine(event) {
 }
 var ANSI;
 var init_format_usage = __esm({
-  "packages/cli/src/format-usage.ts"() {
+  "src/format-usage.ts"() {
     "use strict";
     ANSI = {
       reset: "\x1B[0m",
@@ -15375,7 +15689,7 @@ var init_format_usage = __esm({
   }
 });
 
-// packages/cli/src/tui/components/banner.tsx
+// src/tui/components/banner.tsx
 import { Box, Text } from "ink";
 import { jsx } from "react/jsx-runtime";
 function Banner() {
@@ -15383,7 +15697,7 @@ function Banner() {
 }
 var LINES, COLORS;
 var init_banner = __esm({
-  "packages/cli/src/tui/components/banner.tsx"() {
+  "src/tui/components/banner.tsx"() {
     "use strict";
     LINES = [
       "  \u2588\u2588\u2557  \u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
@@ -15397,7 +15711,7 @@ var init_banner = __esm({
   }
 });
 
-// packages/cli/src/tui/components/messages.tsx
+// src/tui/components/messages.tsx
 import { Box as Box2, Static, Text as Text2 } from "ink";
 import { jsx as jsx2, jsxs } from "react/jsx-runtime";
 function Messages({ blocks }) {
@@ -15455,7 +15769,7 @@ function Block({ block }) {
 }
 var BANNER_ID;
 var init_messages = __esm({
-  "packages/cli/src/tui/components/messages.tsx"() {
+  "src/tui/components/messages.tsx"() {
     "use strict";
     init_format_usage();
     init_banner();
@@ -15463,7 +15777,7 @@ var init_messages = __esm({
   }
 });
 
-// packages/cli/src/tui/terminal-text.ts
+// src/tui/terminal-text.ts
 function sanitizeToolOutput(s) {
   return s.replace(ESCAPE_SEQ_RE, "").replace(/\r\n?/g, "\n").replace(/\t/g, "  ").replace(C0_RE, "");
 }
@@ -15493,14 +15807,14 @@ function tailByRows(text6, cols, maxRows) {
 }
 var ESCAPE_SEQ_RE, C0_RE;
 var init_terminal_text = __esm({
-  "packages/cli/src/tui/terminal-text.ts"() {
+  "src/tui/terminal-text.ts"() {
     "use strict";
     ESCAPE_SEQ_RE = /\x1b\][^\x07\n]*\x07|\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b[@-Z\\-_]/g;
     C0_RE = /[\x00-\x09\x0b-\x1f\x7f]/g;
   }
 });
 
-// packages/cli/src/tui/components/streaming.tsx
+// src/tui/components/streaming.tsx
 import { useEffect, useState } from "react";
 import { Box as Box3, Text as Text3, useStdout } from "ink";
 import Spinner from "ink-spinner";
@@ -15553,13 +15867,13 @@ function Streaming({ spinnerLabel, liveText, liveThinking, activeSubs, turnStart
   ] });
 }
 var init_streaming = __esm({
-  "packages/cli/src/tui/components/streaming.tsx"() {
+  "src/tui/components/streaming.tsx"() {
     "use strict";
     init_terminal_text();
   }
 });
 
-// packages/cli/src/tui/history.ts
+// src/tui/history.ts
 import fs32 from "node:fs";
 import path38 from "node:path";
 import os2 from "node:os";
@@ -15585,14 +15899,14 @@ function appendHistory(entry) {
 }
 var HISTORY_FILE, MAX_ENTRIES;
 var init_history = __esm({
-  "packages/cli/src/tui/history.ts"() {
+  "src/tui/history.ts"() {
     "use strict";
     HISTORY_FILE = path38.join(os2.homedir(), ".halo", "global", "tui-history.json");
     MAX_ENTRIES = 100;
   }
 });
 
-// packages/cli/src/tui/components/status-bar.tsx
+// src/tui/components/status-bar.tsx
 import { Box as Box4, Text as Text4 } from "ink";
 import { Fragment, jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
 function shortModel(modelId) {
@@ -15628,12 +15942,12 @@ function StatusBar({ agentName, modelId, contextPercent, workspace, sessionId, v
   ] });
 }
 var init_status_bar = __esm({
-  "packages/cli/src/tui/components/status-bar.tsx"() {
+  "src/tui/components/status-bar.tsx"() {
     "use strict";
   }
 });
 
-// packages/cli/src/tui/components/slash-suggest.tsx
+// src/tui/components/slash-suggest.tsx
 import { Box as Box5, Text as Text5 } from "ink";
 import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
 function SlashSuggest({ items, selectedIdx, maxWidth = 80 }) {
@@ -15660,12 +15974,12 @@ function SlashSuggest({ items, selectedIdx, maxWidth = 80 }) {
   ] });
 }
 var init_slash_suggest = __esm({
-  "packages/cli/src/tui/components/slash-suggest.tsx"() {
+  "src/tui/components/slash-suggest.tsx"() {
     "use strict";
   }
 });
 
-// packages/cli/src/tui/components/path-suggest.tsx
+// src/tui/components/path-suggest.tsx
 import { Box as Box6, Text as Text6 } from "ink";
 import { jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
 function PathSuggest({ items, selectedIdx, cwdLabel }) {
@@ -15692,12 +16006,12 @@ function PathSuggest({ items, selectedIdx, cwdLabel }) {
   ] });
 }
 var init_path_suggest = __esm({
-  "packages/cli/src/tui/components/path-suggest.tsx"() {
+  "src/tui/components/path-suggest.tsx"() {
     "use strict";
   }
 });
 
-// packages/cli/src/tui/path-suggest-engine.ts
+// src/tui/path-suggest-engine.ts
 import fs33 from "node:fs";
 import path39 from "node:path";
 function detectActiveRef(value) {
@@ -15783,13 +16097,13 @@ function applyPathPick(value, ref, pick) {
   return `${before}@${kind} ${path70}`;
 }
 var init_path_suggest_engine = __esm({
-  "packages/cli/src/tui/path-suggest-engine.ts"() {
+  "src/tui/path-suggest-engine.ts"() {
     "use strict";
     init_dist();
   }
 });
 
-// packages/cli/src/tui/line-editor.ts
+// src/tui/line-editor.ts
 function toGraphemes(s) {
   if (s === "") return [];
   return [...segmenter.segment(s)].map((seg) => seg.segment);
@@ -15843,13 +16157,13 @@ function deleteToEnd(e) {
 }
 var segmenter;
 var init_line_editor = __esm({
-  "packages/cli/src/tui/line-editor.ts"() {
+  "src/tui/line-editor.ts"() {
     "use strict";
     segmenter = new Intl.Segmenter();
   }
 });
 
-// packages/cli/src/tui/components/text-input.tsx
+// src/tui/components/text-input.tsx
 import { Text as Text7 } from "ink";
 import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
 function TextInputView({ value, cursor, placeholder }) {
@@ -15874,13 +16188,13 @@ function TextInputView({ value, cursor, placeholder }) {
   ] });
 }
 var init_text_input = __esm({
-  "packages/cli/src/tui/components/text-input.tsx"() {
+  "src/tui/components/text-input.tsx"() {
     "use strict";
     init_line_editor();
   }
 });
 
-// packages/cli/src/tui/components/input-box.tsx
+// src/tui/components/input-box.tsx
 import { useState as useState2, useEffect as useEffect2, useMemo, useRef } from "react";
 import { Box as Box7, Text as Text8, useInput, usePaste } from "ink";
 import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
@@ -16131,7 +16445,7 @@ function InputBox({ enabled: enabled2, placeholder, history, onSubmit, hint, com
   ] });
 }
 var init_input_box = __esm({
-  "packages/cli/src/tui/components/input-box.tsx"() {
+  "src/tui/components/input-box.tsx"() {
     "use strict";
     init_slash_suggest();
     init_path_suggest();
@@ -16141,7 +16455,7 @@ var init_input_box = __esm({
   }
 });
 
-// packages/cli/src/tui/components/log-navigator.tsx
+// src/tui/components/log-navigator.tsx
 import { useState as useState3, useMemo as useMemo2, useEffect as useEffect3 } from "react";
 import { Box as Box8, Text as Text9, useInput as useInput2 } from "ink";
 import { jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
@@ -16220,12 +16534,12 @@ function LogNavigator({ tree, onPick, onCancel }) {
   ] });
 }
 var init_log_navigator = __esm({
-  "packages/cli/src/tui/components/log-navigator.tsx"() {
+  "src/tui/components/log-navigator.tsx"() {
     "use strict";
   }
 });
 
-// packages/cli/src/tui/components/log-viewer.tsx
+// src/tui/components/log-viewer.tsx
 import { useState as useState4, useMemo as useMemo3, useEffect as useEffect4, useRef as useRef2 } from "react";
 import { Box as Box9, Text as Text10, useInput as useInput3, useStdout as useStdout2 } from "ink";
 import { jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
@@ -16298,12 +16612,12 @@ function LogViewer({ title, lines, live, onClose }) {
   ] });
 }
 var init_log_viewer = __esm({
-  "packages/cli/src/tui/components/log-viewer.tsx"() {
+  "src/tui/components/log-viewer.tsx"() {
     "use strict";
   }
 });
 
-// packages/cli/src/tui/app.tsx
+// src/tui/app.tsx
 import { useEffect as useEffect5, useMemo as useMemo4, useReducer, useState as useState5, useRef as useRef3 } from "react";
 import { Box as Box10, useApp, useInput as useInput4 } from "ink";
 import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
@@ -17013,7 +17327,7 @@ ${lines.join("\n")}` });
 }
 var MAX_CONTEXT_TOKENS_FALLBACK, blockSeq, ANSI2;
 var init_app = __esm({
-  "packages/cli/src/tui/app.tsx"() {
+  "src/tui/app.tsx"() {
     "use strict";
     init_render_md();
     init_resolve_refs();
@@ -17041,7 +17355,7 @@ var init_app = __esm({
   }
 });
 
-// packages/cli/src/tui.tsx
+// src/tui.tsx
 var tui_exports = {};
 __export(tui_exports, {
   runTui: () => runTui
@@ -17056,13 +17370,13 @@ async function runTui(harness, opts = {}) {
   await instance.waitUntilExit();
 }
 var init_tui = __esm({
-  "packages/cli/src/tui.tsx"() {
+  "src/tui.tsx"() {
     "use strict";
     init_app();
   }
 });
 
-// packages/cli/src/cli.ts
+// src/cli.ts
 var cli_exports = {};
 __export(cli_exports, {
   runCli: () => runCli
@@ -17246,7 +17560,7 @@ ${tag}${formatUsageLine(event)}
   return errorText ? 1 : 0;
 }
 var init_cli = __esm({
-  "packages/cli/src/cli.ts"() {
+  "src/cli.ts"() {
     "use strict";
     init_render_md();
     init_resolve_refs();
@@ -17254,7 +17568,7 @@ var init_cli = __esm({
   }
 });
 
-// packages/server/dist/channels/shared/media.js
+// ../server/dist/channels/shared/media.js
 import path40 from "node:path";
 import os3 from "node:os";
 function tempDir() {
@@ -17295,7 +17609,7 @@ function classifyMedia(filePath) {
 }
 var MEDIA_MARKER_RE, VIDEO_EXTS, VOICE_EXTS;
 var init_media = __esm({
-  "packages/server/dist/channels/shared/media.js"() {
+  "../server/dist/channels/shared/media.js"() {
     "use strict";
     init_dist();
     MEDIA_MARKER_RE = /^MEDIA:\s*(\S.*?)\s*$/gm;
@@ -17304,7 +17618,7 @@ var init_media = __esm({
   }
 });
 
-// packages/server/dist/routes/workspace-path.js
+// ../server/dist/routes/workspace-path.js
 import fs34 from "node:fs/promises";
 import { existsSync as existsSync2, realpathSync as realpathSync3 } from "node:fs";
 import path41 from "node:path";
@@ -17348,12 +17662,12 @@ function isSafeIdSegment(id) {
   return /^[\w.:>\u4e00-\u9fff-]+$/.test(id);
 }
 var init_workspace_path = __esm({
-  "packages/server/dist/routes/workspace-path.js"() {
+  "../server/dist/routes/workspace-path.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/routes/files.js
+// ../server/dist/routes/files.js
 import { Hono } from "hono";
 import fs35 from "node:fs/promises";
 import { createReadStream } from "node:fs";
@@ -17893,7 +18207,7 @@ function createFileRoutes() {
   return app2;
 }
 var init_files = __esm({
-  "packages/server/dist/routes/files.js"() {
+  "../server/dist/routes/files.js"() {
     "use strict";
     init_dist();
     init_media();
@@ -17901,7 +18215,7 @@ var init_files = __esm({
   }
 });
 
-// packages/server/dist/routes/data-preview.js
+// ../server/dist/routes/data-preview.js
 import { Hono as Hono2 } from "hono";
 import fs36 from "node:fs/promises";
 import { createReadStream as createReadStream2 } from "node:fs";
@@ -18126,7 +18440,7 @@ function createDataPreviewRoutes() {
 }
 var DEFAULT_LIMIT, MAX_LIMIT, MAX_ROW_CHARS, QUOTE, CR, LF, COMMA, SEMI, TAB, CsvScanner;
 var init_data_preview = __esm({
-  "packages/server/dist/routes/data-preview.js"() {
+  "../server/dist/routes/data-preview.js"() {
     "use strict";
     init_workspace_path();
     DEFAULT_LIMIT = 100;
@@ -18227,7 +18541,7 @@ var init_data_preview = __esm({
   }
 });
 
-// packages/server/dist/git-credentials.js
+// ../server/dist/git-credentials.js
 import fs37 from "node:fs";
 import path44 from "node:path";
 import { homedir as homedir18 } from "node:os";
@@ -18293,13 +18607,13 @@ function deleteGitCredential(host) {
 }
 var GIT_CREDENTIALS_PATH;
 var init_git_credentials = __esm({
-  "packages/server/dist/git-credentials.js"() {
+  "../server/dist/git-credentials.js"() {
     "use strict";
     GIT_CREDENTIALS_PATH = path44.join(homedir18(), ".git-credentials");
   }
 });
 
-// packages/server/dist/git-ssh.js
+// ../server/dist/git-ssh.js
 import fs38 from "node:fs";
 import os4 from "node:os";
 import path45 from "node:path";
@@ -18476,7 +18790,7 @@ function getRemoteProtocol(projectRoot) {
 }
 var SSH_DIR, NON_KEY_NAMES, ownedAgentPid, ASKPASS_SCRIPT;
 var init_git_ssh = __esm({
-  "packages/server/dist/git-ssh.js"() {
+  "../server/dist/git-ssh.js"() {
     "use strict";
     SSH_DIR = path45.join(os4.homedir(), ".ssh");
     NON_KEY_NAMES = /* @__PURE__ */ new Set(["known_hosts", "known_hosts2", "authorized_keys", "config"]);
@@ -18489,7 +18803,7 @@ printf '%s\\n' "$HALO_SSH_PASSPHRASE"
   }
 });
 
-// packages/server/dist/routes/git.js
+// ../server/dist/routes/git.js
 import { Hono as Hono3 } from "hono";
 import os5 from "node:os";
 import path46 from "node:path";
@@ -18855,7 +19169,7 @@ function createGitRoutes() {
   return app2;
 }
 var init_git = __esm({
-  "packages/server/dist/routes/git.js"() {
+  "../server/dist/routes/git.js"() {
     "use strict";
     init_dist();
     init_workspace_path();
@@ -18865,7 +19179,7 @@ var init_git = __esm({
   }
 });
 
-// packages/server/dist/routes/mtime-cache.js
+// ../server/dist/routes/mtime-cache.js
 function createMtimeCache() {
   const entries = /* @__PURE__ */ new Map();
   return {
@@ -18880,12 +19194,12 @@ function createMtimeCache() {
   };
 }
 var init_mtime_cache = __esm({
-  "packages/server/dist/routes/mtime-cache.js"() {
+  "../server/dist/routes/mtime-cache.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/routes/agent-configs.js
+// ../server/dist/routes/agent-configs.js
 import { Hono as Hono4 } from "hono";
 import fs39 from "node:fs/promises";
 import path47 from "node:path";
@@ -19077,7 +19391,7 @@ function createAgentConfigRoutes() {
       if (wsIds.has(a.id))
         a.overridden = true;
     }
-    const disabledSet = projectId ? getDisabledSet(getWorkspaceDb(projectId).db, "agent") : /* @__PURE__ */ new Set();
+    const disabledSet = projectId && hasWorkspaceHalo(projectId) ? getDisabledSet(getWorkspaceDb(projectId).db, "agent") : /* @__PURE__ */ new Set();
     const allAgents = [...globalAgents, ...workspaceAgents];
     for (const a of allAgents) {
       a.disabled = disabledSet.has(`${a.scope}:${a.id}`);
@@ -19419,7 +19733,7 @@ ${body.description ?? ""}
 }
 var _cachedTools, GLOBAL_AGENTS_DIR4, FALLBACK_SCAFFOLD_PROVIDER, _yamlCache;
 var init_agent_configs = __esm({
-  "packages/server/dist/routes/agent-configs.js"() {
+  "../server/dist/routes/agent-configs.js"() {
     "use strict";
     init_workspace_tools();
     init_draft_tool();
@@ -19427,6 +19741,7 @@ var init_agent_configs = __esm({
     init_md_loader();
     init_config();
     init_db();
+    init_init();
     init_workspace_path();
     init_mtime_cache();
     _cachedTools = null;
@@ -19436,7 +19751,7 @@ var init_agent_configs = __esm({
   }
 });
 
-// packages/server/dist/routes/skills.js
+// ../server/dist/routes/skills.js
 import { Hono as Hono5 } from "hono";
 import fs40 from "node:fs/promises";
 import path48 from "node:path";
@@ -19451,7 +19766,7 @@ function defaultSkillSettings() {
         "",
         "global.anthropic.claude-sonnet-4-6",
         "global.anthropic.claude-haiku-4-5-20251001",
-        "global.anthropic.claude-opus-4-6"
+        "global.anthropic.claude-opus-5-5"
       ]
     }
   };
@@ -19631,7 +19946,7 @@ function createSkillRoutes() {
 }
 var GLOBAL_SETTINGS_PATH, _skillMdCache;
 var init_skills = __esm({
-  "packages/server/dist/routes/skills.js"() {
+  "../server/dist/routes/skills.js"() {
     "use strict";
     init_agent_loader();
     init_db();
@@ -19642,7 +19957,7 @@ var init_skills = __esm({
   }
 });
 
-// packages/server/dist/routes/settings.js
+// ../server/dist/routes/settings.js
 import { Hono as Hono6 } from "hono";
 import fs41 from "node:fs/promises";
 import path49 from "node:path";
@@ -19911,7 +20226,7 @@ function createSettingsRoutes() {
 }
 var GLOBAL_SETTINGS_PATH2, _changeListeners;
 var init_settings = __esm({
-  "packages/server/dist/routes/settings.js"() {
+  "../server/dist/routes/settings.js"() {
     "use strict";
     init_settings_schema();
     init_workspace_path();
@@ -19920,7 +20235,7 @@ var init_settings = __esm({
   }
 });
 
-// packages/server/dist/evolution/archive.js
+// ../server/dist/evolution/archive.js
 import fs42 from "node:fs";
 import path50 from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -20087,7 +20402,7 @@ function stopArchiveDaemon() {
 }
 var TERMINAL_RUN_STATUSES, TERMINAL_APPLY_STATUSES, DAY_MS, ARCHIVE_AFTER_MS, PURGE_AFTER_MS, _archiveTimer, _startupTimer;
 var init_archive = __esm({
-  "packages/server/dist/evolution/archive.js"() {
+  "../server/dist/evolution/archive.js"() {
     "use strict";
     init_evo_db();
     init_paths();
@@ -20101,7 +20416,7 @@ var init_archive = __esm({
   }
 });
 
-// packages/server/dist/db/raw-sqlite.js
+// ../server/dist/db/raw-sqlite.js
 function rawSqlite(db) {
   const withClient = db;
   const client = withClient.$client ?? withClient.session?.client;
@@ -20110,12 +20425,12 @@ function rawSqlite(db) {
   return client;
 }
 var init_raw_sqlite = __esm({
-  "packages/server/dist/db/raw-sqlite.js"() {
+  "../server/dist/db/raw-sqlite.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/routes/evolution.js
+// ../server/dist/routes/evolution.js
 import { Hono as Hono7 } from "hono";
 import { eq as eq11, desc as desc2, lt as lt3, and as and8, or, sql } from "drizzle-orm";
 import fs43 from "node:fs/promises";
@@ -20373,7 +20688,7 @@ function extractText(content) {
 }
 var UNDELETABLE_RUN_STATUSES;
 var init_evolution = __esm({
-  "packages/server/dist/routes/evolution.js"() {
+  "../server/dist/routes/evolution.js"() {
     "use strict";
     init_evo_db();
     init_archive();
@@ -20384,7 +20699,7 @@ var init_evolution = __esm({
   }
 });
 
-// packages/server/dist/routes/sessions.js
+// ../server/dist/routes/sessions.js
 import { Hono as Hono8 } from "hono";
 import { and as and9, eq as eq12, gte as gte2, lt as lt4 } from "drizzle-orm";
 function rawId() {
@@ -20498,6 +20813,8 @@ function createSessionRoutes(smRegistry) {
       return c.json({ error: "session manager not initialized" }, 500);
     if (!projectId)
       return c.json({ error: "projectId required" }, 400);
+    if (!hasWorkspaceHalo(projectId))
+      return c.json({ sessions: [], nextCursor: null });
     const sm = smRegistry.getOrCreate(projectId);
     let parentId;
     if (parentIdParam === void 0)
@@ -20639,7 +20956,7 @@ function createSessionRoutes(smRegistry) {
 }
 var msgCounter2;
 var init_sessions = __esm({
-  "packages/server/dist/routes/sessions.js"() {
+  "../server/dist/routes/sessions.js"() {
     "use strict";
     init_db();
     init_schema();
@@ -20647,11 +20964,12 @@ var init_sessions = __esm({
     init_goal_mode();
     init_broadcast();
     init_workspace_path();
+    init_init();
     msgCounter2 = 0;
   }
 });
 
-// packages/server/dist/routes/session-archive.js
+// ../server/dist/routes/session-archive.js
 import { Hono as Hono9 } from "hono";
 function createSessionArchiveRoutes(smRegistry) {
   const app2 = new Hono9();
@@ -20684,7 +21002,7 @@ function createSessionArchiveRoutes(smRegistry) {
   return app2;
 }
 var init_session_archive2 = __esm({
-  "packages/server/dist/routes/session-archive.js"() {
+  "../server/dist/routes/session-archive.js"() {
     "use strict";
     init_db();
     init_session_store();
@@ -20693,7 +21011,7 @@ var init_session_archive2 = __esm({
   }
 });
 
-// packages/server/dist/db/channel-db.js
+// ../server/dist/db/channel-db.js
 import Database5 from "better-sqlite3";
 import { drizzle as drizzle4 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable4, text as text4, integer as integer4 } from "drizzle-orm/sqlite-core";
@@ -20719,7 +21037,7 @@ function getChannelDb() {
 }
 var channelAccounts, CREATE_SQL3, _channelDb;
 var init_channel_db = __esm({
-  "packages/server/dist/db/channel-db.js"() {
+  "../server/dist/db/channel-db.js"() {
     "use strict";
     init_migrate();
     channelAccounts = sqliteTable4("channel_accounts", {
@@ -20753,7 +21071,7 @@ CREATE INDEX IF NOT EXISTS idx_channel_accounts_type ON channel_accounts(channel
   }
 });
 
-// packages/server/dist/channels/shared/accounts.js
+// ../server/dist/channels/shared/accounts.js
 import fs45 from "node:fs";
 import path53 from "node:path";
 import { eq as eq13, and as and10 } from "drizzle-orm";
@@ -20874,7 +21192,7 @@ function deleteAccount(db, accountId) {
 }
 var ACCOUNT_ACCESS_LEVELS, CHAT_ACCESS_LEVELS, _lastActiveChatCache, _wechatContextTokenCache;
 var init_accounts = __esm({
-  "packages/server/dist/channels/shared/accounts.js"() {
+  "../server/dist/channels/shared/accounts.js"() {
     "use strict";
     init_channel_db();
     init_init();
@@ -20885,7 +21203,7 @@ var init_accounts = __esm({
   }
 });
 
-// packages/server/dist/channels/web/accounts.js
+// ../server/dist/channels/web/accounts.js
 function toWeb(a) {
   const c = a.config;
   return {
@@ -20948,14 +21266,14 @@ function deleteAccount2(db, accountId) {
 }
 var CH;
 var init_accounts2 = __esm({
-  "packages/server/dist/channels/web/accounts.js"() {
+  "../server/dist/channels/web/accounts.js"() {
     "use strict";
     init_accounts();
     CH = "web";
   }
 });
 
-// packages/server/dist/middleware/brute-force.js
+// ../server/dist/middleware/brute-force.js
 import { getConnInfo } from "@hono/node-server/conninfo";
 function bucket(name) {
   let b = buckets.get(name);
@@ -21006,7 +21324,7 @@ function clearFailures(bucketName, ip) {
 }
 var MAX_ATTEMPTS, LOCKOUT_MS, buckets;
 var init_brute_force = __esm({
-  "packages/server/dist/middleware/brute-force.js"() {
+  "../server/dist/middleware/brute-force.js"() {
     "use strict";
     init_config();
     MAX_ATTEMPTS = 5;
@@ -21015,7 +21333,7 @@ var init_brute_force = __esm({
   }
 });
 
-// packages/server/dist/middleware/web-token.js
+// ../server/dist/middleware/web-token.js
 function resolveTokenAuth(c, db) {
   const ip = getClientIp(c);
   if (isLockedOut(TOKEN_BUCKET, ip))
@@ -21037,7 +21355,7 @@ function tokenAuthJsonError(c, reason) {
 }
 var TOKEN_BUCKET, TOKEN_AUTH_STATUS, JSON_ERROR;
 var init_web_token = __esm({
-  "packages/server/dist/middleware/web-token.js"() {
+  "../server/dist/middleware/web-token.js"() {
     "use strict";
     init_accounts2();
     init_brute_force();
@@ -21055,17 +21373,17 @@ var init_web_token = __esm({
   }
 });
 
-// packages/server/dist/channels/shared/session-prefix.js
+// ../server/dist/channels/shared/session-prefix.js
 function sessionPrefix(channel, userId) {
   return `${channel}_${userId}_`;
 }
 var init_session_prefix = __esm({
-  "packages/server/dist/channels/shared/session-prefix.js"() {
+  "../server/dist/channels/shared/session-prefix.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/channels/web/handler.js
+// ../server/dist/channels/web/handler.js
 function buildWebSessionPrefix(accountId) {
   return sessionPrefix("web", accountId);
 }
@@ -21482,7 +21800,7 @@ function createMediaBuffer() {
   };
 }
 var init_handler = __esm({
-  "packages/server/dist/channels/web/handler.js"() {
+  "../server/dist/channels/web/handler.js"() {
     "use strict";
     init_ui_log_builder();
     init_accounts2();
@@ -21499,7 +21817,7 @@ var init_handler = __esm({
   }
 });
 
-// packages/core/dist/protocol/session-message.js
+// ../core/dist/protocol/session-message.js
 function inferMessageType(msg) {
   if (msg.type)
     return msg.type;
@@ -21518,20 +21836,20 @@ function inferMessageType(msg) {
   return "notification";
 }
 var init_session_message = __esm({
-  "packages/core/dist/protocol/session-message.js"() {
+  "../core/dist/protocol/session-message.js"() {
     "use strict";
   }
 });
 
-// packages/core/dist/protocol/index.js
+// ../core/dist/protocol/index.js
 var init_protocol = __esm({
-  "packages/core/dist/protocol/index.js"() {
+  "../core/dist/protocol/index.js"() {
     "use strict";
     init_session_message();
   }
 });
 
-// packages/server/dist/sessions/session-types.js
+// ../server/dist/sessions/session-types.js
 function messageToolCalls(msg) {
   if (msg.contentBlocks) {
     return msg.contentBlocks.filter((b) => b.type === "tool_call").map((b) => b.toolCall);
@@ -21539,13 +21857,13 @@ function messageToolCalls(msg) {
   return msg.toolCalls ?? [];
 }
 var init_session_types = __esm({
-  "packages/server/dist/sessions/session-types.js"() {
+  "../server/dist/sessions/session-types.js"() {
     "use strict";
     init_protocol();
   }
 });
 
-// packages/server/dist/routes/halo-city.js
+// ../server/dist/routes/halo-city.js
 import { Hono as Hono10 } from "hono";
 import fs46 from "node:fs";
 import path54 from "node:path";
@@ -21932,7 +22250,7 @@ function createShowRoutes(registry2) {
 }
 var SESSIONS_PER_WS, _skillCache, _metaCache, _roReaders, SESSION_LOG_MAX_MSGS, _birthCache;
 var init_halo_city = __esm({
-  "packages/server/dist/routes/halo-city.js"() {
+  "../server/dist/routes/halo-city.js"() {
     "use strict";
     init_channel_db();
     init_web_token();
@@ -21950,7 +22268,7 @@ var init_halo_city = __esm({
   }
 });
 
-// packages/server/dist/routes/metrics.js
+// ../server/dist/routes/metrics.js
 import { Hono as Hono11 } from "hono";
 function family(name, type, help, samples) {
   const lines = [`# HELP ${name} ${help}`, `# TYPE ${name} ${type}`];
@@ -22029,7 +22347,7 @@ function createMetricsRoutes(registry2) {
 }
 var TEXT_ERROR, SESSIONS_PER_WS2;
 var init_metrics = __esm({
-  "packages/server/dist/routes/metrics.js"() {
+  "../server/dist/routes/metrics.js"() {
     "use strict";
     init_channel_db();
     init_web_token();
@@ -22043,7 +22361,7 @@ var init_metrics = __esm({
   }
 });
 
-// packages/server/dist/routes/commands.js
+// ../server/dist/routes/commands.js
 import { Hono as Hono12 } from "hono";
 function createCommandRoutes(registry2, smRegistry) {
   const app2 = new Hono12();
@@ -22068,12 +22386,12 @@ function createCommandRoutes(registry2, smRegistry) {
   return app2;
 }
 var init_commands3 = __esm({
-  "packages/server/dist/routes/commands.js"() {
+  "../server/dist/routes/commands.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/routes/agentcore.js
+// ../server/dist/routes/agentcore.js
 import { Hono as Hono13 } from "hono";
 import path55 from "node:path";
 import fs47 from "node:fs";
@@ -22422,7 +22740,7 @@ ${fullText}`, images.length > 0 ? images : void 0);
 }
 var SESSION_HEADER, MAX_IMAGES_PER_MESSAGE, MAX_IMAGE_BASE64_LENGTH, MAX_PENDING_UPLOADS, MAX_CHUNKS_PER_UPLOAD, activeOverrides;
 var init_agentcore = __esm({
-  "packages/server/dist/routes/agentcore.js"() {
+  "../server/dist/routes/agentcore.js"() {
     "use strict";
     init_commands2();
     init_ui_log_builder();
@@ -22437,7 +22755,7 @@ var init_agentcore = __esm({
   }
 });
 
-// packages/server/dist/ws/file-watcher.js
+// ../server/dist/ws/file-watcher.js
 import fs48 from "node:fs";
 import path56 from "node:path";
 function enqueueNativeOp(op) {
@@ -22459,7 +22777,7 @@ function isUnwatchablePath(absPath) {
 }
 var IGNORED_SEGMENTS, IS_WIN32, IGNORED_SEGMENT_SET, NATIVE_IGNORE, nativeOpChain, WorkspaceWatcher;
 var init_file_watcher = __esm({
-  "packages/server/dist/ws/file-watcher.js"() {
+  "../server/dist/ws/file-watcher.js"() {
     "use strict";
     IGNORED_SEGMENTS = [
       // VCS
@@ -22681,12 +22999,12 @@ var init_file_watcher = __esm({
   }
 });
 
-// packages/server/dist/ws/git-dir-watcher.js
+// ../server/dist/ws/git-dir-watcher.js
 import fs49 from "node:fs";
 import path57 from "node:path";
 var GitDirWatcher;
 var init_git_dir_watcher = __esm({
-  "packages/server/dist/ws/git-dir-watcher.js"() {
+  "../server/dist/ws/git-dir-watcher.js"() {
     "use strict";
     GitDirWatcher = class {
       watcher = null;
@@ -22805,7 +23123,7 @@ var init_git_dir_watcher = __esm({
   }
 });
 
-// packages/server/dist/ws/event-processor.js
+// ../server/dist/ws/event-processor.js
 function sendJson(ws, data) {
   if (ws.readyState === ws.OPEN) {
     try {
@@ -22904,16 +23222,16 @@ function bufferDetachedNotification(event, pendingEvents) {
   }
 }
 var init_event_processor = __esm({
-  "packages/server/dist/ws/event-processor.js"() {
+  "../server/dist/ws/event-processor.js"() {
     "use strict";
     init_ui_log_builder();
   }
 });
 
-// packages/server/dist/ws/watcher-pool.js
+// ../server/dist/ws/watcher-pool.js
 var WatcherPool;
 var init_watcher_pool = __esm({
-  "packages/server/dist/ws/watcher-pool.js"() {
+  "../server/dist/ws/watcher-pool.js"() {
     "use strict";
     init_file_watcher();
     init_git_dir_watcher();
@@ -22971,7 +23289,7 @@ var init_watcher_pool = __esm({
   }
 });
 
-// packages/server/dist/ws/terminal-manager.js
+// ../server/dist/ws/terminal-manager.js
 import { homedir as homedir22 } from "node:os";
 import { basename } from "node:path";
 import { createRequire } from "node:module";
@@ -23002,7 +23320,7 @@ function attachListenersOnce(t2) {
 }
 var requireFromHere, ptyModule, TERMINAL_GRACE_MS, terminals, TerminalManager;
 var init_terminal_manager = __esm({
-  "packages/server/dist/ws/terminal-manager.js"() {
+  "../server/dist/ws/terminal-manager.js"() {
     "use strict";
     init_config();
     init_child_env();
@@ -23150,7 +23468,7 @@ var init_terminal_manager = __esm({
   }
 });
 
-// packages/server/dist/ws/handler.js
+// ../server/dist/ws/handler.js
 import path58 from "node:path";
 function setupWebSocketHandler(deps) {
   const { wss: wss2, registry: registry2 } = deps;
@@ -23618,7 +23936,8 @@ ${msg.message}` : markers.join("\n");
       rememberChat(msg);
       ackChat(msg);
       console.debug(`[WS] Chat: session=${msg.sessionId}, project=${msg.projectId}, agent=${msg.agentId ?? client2.agentId}`);
-      sm.sendUserMessage(sid, msg.message, msg.images).catch((err) => {
+      const accessLevel = msg.accessLevel === void 0 ? void 0 : msg.accessLevel === "full" || getSandboxBackend() === null ? null : msg.accessLevel;
+      sm.sendUserMessage(sid, msg.message, msg.images, accessLevel).catch((err) => {
         console.debug(`[WS] Chat error: ${err instanceof Error ? err.message : String(err)}`);
         sendJson(ws, { type: "error", error: err instanceof Error ? err.message : String(err) });
         saveSession(client2);
@@ -23678,7 +23997,7 @@ ${msg.message}` : markers.join("\n");
         const running = client2.sessionManager.isSessionRunning(client2.sessionId);
         const messages3 = state2 ? running ? [...state2.messageLog] : [...createSaveSnapshot(state2)] : [];
         const detachedSession = client2.sessionManager.getSessionById(client2.sessionId);
-        sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages3, sessionId: msg.sessionId, maxContextTokens: ctxConfig.maxTokens, agentId: detachedSession?.agentId, archiveCount: archiveCountFor(client2, client2.sessionId, detachedSession?.agentId) } });
+        sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages3, sessionId: msg.sessionId, maxContextTokens: ctxConfig.maxTokens, agentId: detachedSession?.agentId, archiveCount: archiveCountFor(client2, client2.sessionId, detachedSession?.agentId), accessLevel: detachedSession?.accessLevel ?? null } });
         if (state2 && state2.contextTokens > 0) {
           sendJson(ws, { type: "chat:usage", contextTokens: state2.contextTokens, outputTokens: state2.outputTokens });
         }
@@ -23722,12 +24041,14 @@ ${msg.message}` : markers.join("\n");
         }
       }
       let agentId;
+      let accessLevel;
       if (msg.sessionId && client2.sessionManager) {
         const existingSession = client2.sessionManager.getSessionById(msg.sessionId);
         if (existingSession) {
           client2.sessionId = msg.sessionId;
           client2.unsubscribeEvents = client2.sessionManager.registerEventListener(msg.sessionId, createEventListener(client2));
           agentId = existingSession.agentId;
+          accessLevel = existingSession.accessLevel ?? null;
         }
       }
       let maxContextTokens = config.model.maxContextTokens;
@@ -23739,7 +24060,7 @@ ${msg.message}` : markers.join("\n");
       }
       const state = getState(client2);
       const messages2 = state ? [...createSaveSnapshot(state)] : [];
-      sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages2, sessionId: msg.sessionId, maxContextTokens, agentId, archiveCount: msg.sessionId ? archiveCountFor(client2, msg.sessionId, agentId) : 0 } });
+      sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages2, sessionId: msg.sessionId, maxContextTokens, agentId, archiveCount: msg.sessionId ? archiveCountFor(client2, msg.sessionId, agentId) : 0, accessLevel } });
       if (state && state.contextTokens > 0) {
         sendJson(ws, { type: "chat:usage", contextTokens: state.contextTokens, outputTokens: state.outputTokens });
       }
@@ -23766,8 +24087,9 @@ ${msg.message}` : markers.join("\n");
 }
 var CLIENT_SILENCE_LIMIT_MS, detachedSessions;
 var init_handler2 = __esm({
-  "packages/server/dist/ws/handler.js"() {
+  "../server/dist/ws/handler.js"() {
     "use strict";
+    init_sandbox();
     init_ui_log_builder();
     init_config();
     init_watcher_pool();
@@ -23784,7 +24106,7 @@ var init_handler2 = __esm({
   }
 });
 
-// packages/server/dist/db/cron-db.js
+// ../server/dist/db/cron-db.js
 import Database7 from "better-sqlite3";
 import { drizzle as drizzle5 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable5, text as text5, integer as integer5 } from "drizzle-orm/sqlite-core";
@@ -23809,7 +24131,7 @@ function getCronDb() {
 }
 var cronJobs, cronRuns, CREATE_SQL4, CRON_MIGRATIONS, _cronDb;
 var init_cron_db = __esm({
-  "packages/server/dist/db/cron-db.js"() {
+  "../server/dist/db/cron-db.js"() {
     "use strict";
     init_migrate();
     cronJobs = sqliteTable5("cron_jobs", {
@@ -23838,6 +24160,10 @@ var init_cron_db = __esm({
        *  it. NULL = default 3600 (runner.ts CLI_TIMEOUT_SEC). Range 60–21600,
        *  enforced at the write points (REST routes / skill helper). */
       timeoutSec: integer5("timeout_sec"),
+      /** Root session id the cli runs in. NULL = the job's own `cron-<jobId>`
+       *  session. When it names an existing session the cli resumes it with that
+       *  session's own agent (`agentId` only applies when the session is new). */
+      sessionId: text5("session_id"),
       /** JSON array of `{channelType, accountId}` records. Cron output (final
        *  assistant text) is dispatched to each one. Empty array = log only. */
       targets: text5("targets").notNull().default("[]"),
@@ -23888,6 +24214,7 @@ CREATE TABLE IF NOT EXISTS cron_jobs (
   run_at          INTEGER,
   timezone        TEXT,
   timeout_sec     INTEGER,
+  session_id      TEXT,
   targets         TEXT NOT NULL DEFAULT '[]',
   enabled         INTEGER NOT NULL DEFAULT 1,
   last_run_status TEXT,
@@ -23923,13 +24250,15 @@ CREATE INDEX IF NOT EXISTS idx_cron_runs_status ON cron_runs(status);
         addColumnIfMissing(s, "cron_jobs", "run_at", "INTEGER");
         addColumnIfMissing(s, "cron_jobs", "timeout_sec", "INTEGER");
         addColumnIfMissing(s, "cron_runs", "pid", "INTEGER");
-      }
+      },
+      // v2: `session_id` — run the job in a chosen root session instead of cron-<jobId>.
+      (s) => addColumnIfMissing(s, "cron_jobs", "session_id", "TEXT")
     ];
     _cronDb = null;
   }
 });
 
-// packages/server/dist/cron/dispatcher.js
+// ../server/dist/cron/dispatcher.js
 function registerCronDispatcher(d) {
   _registry2.set(d.channelType, d);
 }
@@ -23976,14 +24305,14 @@ async function dispatchToTargets(rawText, targets, workspacePath) {
 }
 var _registry2;
 var init_dispatcher = __esm({
-  "packages/server/dist/cron/dispatcher.js"() {
+  "../server/dist/cron/dispatcher.js"() {
     "use strict";
     init_media();
     _registry2 = /* @__PURE__ */ new Map();
   }
 });
 
-// packages/server/dist/cron/runner.js
+// ../server/dist/cron/runner.js
 import { spawn as spawn3, execFileSync } from "node:child_process";
 import fs51 from "node:fs";
 import path60 from "node:path";
@@ -24048,14 +24377,30 @@ function killTreeHard(rootPid) {
     }
   }
 }
-function isCronCliProcess(pid, jobId) {
+function isCronCliProcess(pid, sessionId) {
   try {
     const args = execFileSync("ps", ["-p", String(pid), "-o", "args="], { encoding: "utf-8" });
-    return args.includes(`cron-${jobId}`);
+    return args.trim().split(/\s+/).includes(sessionId);
   } catch {
     return false;
   }
 }
+function effectiveSessionId(job) {
+  return job.sessionId ?? `cron-${job.id}`;
+}
+function sessionKeyFor(workspacePath, sessionId) {
+  let ws;
+  try {
+    ws = fs51.realpathSync(workspacePath);
+  } catch {
+    ws = path60.resolve(workspacePath);
+  }
+  return `${ws}
+${sessionId}`;
+}
+function setCronSessionRegistry(r) {
+  _sessionRegistry = r;
+}
 function logsDir() {
   return path60.join(homedir23(), ".halo", "global", "logs", "cron");
 }
@@ -24072,14 +24417,24 @@ function sweepOrphanRuns(opts) {
   const now = Date.now();
   for (const row of rows) {
     const { id: runId, jobId, pid } = row;
+    const job = db.select().from(cronJobs).where(eq14(cronJobs.id, jobId)).get();
+    const sessionId = effectiveSessionId(job ?? { id: jobId, sessionId: null });
+    const sessionKey = job ? sessionKeyFor(job.workspacePath, sessionId) : null;
     _inflight.add(jobId);
+    if (sessionKey)
+      _inflightSessions.add(sessionKey);
+    const release = () => {
+      _inflight.delete(jobId);
+      if (sessionKey)
+        _inflightSessions.delete(sessionKey);
+    };
     let needsKill = false;
     let disposition;
     if (process.platform === "win32") {
       disposition = pid == null ? "no pid recorded" : `pid ${pid} not killed (Windows: cannot verify process identity)`;
     } else if (pid == null) {
       disposition = "no pid recorded";
-    } else if (!isCronCliProcess(pid, jobId)) {
+    } else if (!isCronCliProcess(pid, sessionId)) {
       disposition = `pid ${pid} already dead (or pid reused by another process); not killed`;
     } else {
       needsKill = true;
@@ -24093,7 +24448,7 @@ function sweepOrphanRuns(opts) {
     broadcast({ type: "cron:run_changed", jobId, runId, status: "failed" });
     console.log(`[Cron] orphan sweep: run ${runId} (job ${jobId}) \u2014 ${disposition}`);
     if (!needsKill || pid == null) {
-      _inflight.delete(jobId);
+      release();
       continue;
     }
     try {
@@ -24101,11 +24456,11 @@ function sweepOrphanRuns(opts) {
     } catch {
     }
     const timer = setTimeout(() => {
-      if (isCronCliProcess(pid, jobId)) {
+      if (isCronCliProcess(pid, sessionId)) {
         console.log(`[Cron] orphan sweep: pid ${pid} (job ${jobId}) survived SIGTERM \u2014 SIGKILL tree`);
         killTreeHard(pid);
       }
-      _inflight.delete(jobId);
+      release();
     }, graceMs);
     timer.unref();
   }
@@ -24269,7 +24624,11 @@ async function runJob(jobId, triggerKind) {
   const startedAt = Date.now();
   const logPath = logPathFor(runId);
   fs51.mkdirSync(logsDir(), { recursive: true });
-  if (_inflight.has(jobId)) {
+  const sessionId = effectiveSessionId(job);
+  const sessionKey = sessionKeyFor(job.workspacePath, sessionId);
+  const host = _sessionRegistry?.peek(job.workspacePath);
+  const skipReason = _inflight.has(jobId) ? "previous run still in progress" : _inflightSessions.has(sessionKey) ? `session ${sessionId} busy: another cron run is in progress` : host?.hasActiveWorkInTree(sessionId) ? `session ${sessionId} busy: a turn is running in it` : null;
+  if (skipReason) {
     db.insert(cronRuns).values({
       id: runId,
       jobId,
@@ -24279,7 +24638,7 @@ async function runJob(jobId, triggerKind) {
       completedAt: startedAt,
       output: null,
       exitCode: null,
-      failureReason: "previous run still in progress",
+      failureReason: skipReason,
       logPath: null,
       dispatchResults: null
     }).run();
@@ -24287,6 +24646,7 @@ async function runJob(jobId, triggerKind) {
     return runId;
   }
   _inflight.add(jobId);
+  _inflightSessions.add(sessionKey);
   try {
     db.insert(cronRuns).values({
       id: runId,
@@ -24314,14 +24674,16 @@ async function runJob(jobId, triggerKind) {
       return runId;
     }
     const cli = resolveHaloCli();
-    const sessionId = `cron-${job.id}`;
     const args = ["cli", "-a", job.agentId, "-s", sessionId, "-w", job.workspacePath];
+    const accessLevel = readSessionAccessLevel(job.workspacePath, sessionId);
+    if (accessLevel)
+      args.push("--access", accessLevel);
     const [spawnBin, spawnArgs] = process.platform === "win32" && cli.endsWith(".cmd") ? ["cmd.exe", ["/c", cli, ...args]] : [cli, args];
     const timeoutSec = job.timeoutSec ?? CLI_TIMEOUT_SEC;
     const teeStream = fs51.createWriteStream(logPath, { flags: "a" });
     teeStream.write(`=== ${(/* @__PURE__ */ new Date()).toISOString()} cron run ${runId} job=${jobId} trigger=${triggerKind} ===
 `);
-    teeStream.write(`agent=${job.agentId} workspace=${job.workspacePath} schedule=${job.schedule}
+    teeStream.write(`agent=${job.agentId} session=${sessionId}${accessLevel ? ` access=${accessLevel}` : ""} workspace=${job.workspacePath} schedule=${job.schedule}
 `);
     teeStream.write(`prompt: ${job.userPrompt}
 
@@ -24393,6 +24755,10 @@ ${job.userPrompt}`);
         resolve2({ exitCode: 1 });
       });
     });
+    const hostAfter = _sessionRegistry?.peek(job.workspacePath);
+    if (hostAfter && !hostAfter.forgetExternalWrite(sessionId)) {
+      console.warn(`[Cron] ${jobId}: session ${sessionId} had a server-side turn running when the cli exited; one of the two turns may be missing from its history`);
+    }
     const trimmedOut = stdout.trim();
     let status;
     let failureReason = null;
@@ -24427,6 +24793,17 @@ ${job.userPrompt}`);
     return runId;
   } finally {
     _inflight.delete(jobId);
+    _inflightSessions.delete(sessionKey);
+  }
+}
+function readSessionAccessLevel(workspacePath, sessionId) {
+  try {
+    const row = getWorkspaceDb(workspacePath).db.select({ accessLevel: agentSessions.accessLevel }).from(agentSessions).where(eq14(agentSessions.id, sessionId)).get();
+    if (!row)
+      return null;
+    return row.accessLevel === "workspace" || row.accessLevel === "readonly" ? row.accessLevel : "full";
+  } catch {
+    return null;
   }
 }
 function finalize(runId, jobId, a) {
@@ -24508,12 +24885,14 @@ function pruneOldLogs() {
   const dbCutoff = Date.now() - 2 * LOG_RETENTION_DAYS * DAY_MS2;
   db.delete(cronRuns).where(lt5(cronRuns.startedAt, dbCutoff)).run();
 }
-var DAY_MS2, CLI_TIMEOUT_SEC, KILL_GRACE_SEC, UNATTENDED_PREAMBLE, RUNS_PER_JOB_KEEP, LOG_RETENTION_DAYS, _active, _inflight, _fingerprint, _daemonTimers, _lastCronDataVersion;
+var DAY_MS2, CLI_TIMEOUT_SEC, KILL_GRACE_SEC, UNATTENDED_PREAMBLE, RUNS_PER_JOB_KEEP, LOG_RETENTION_DAYS, _sessionRegistry, _active, _inflight, _inflightSessions, _fingerprint, _daemonTimers, _lastCronDataVersion;
 var init_runner = __esm({
-  "packages/server/dist/cron/runner.js"() {
+  "../server/dist/cron/runner.js"() {
     "use strict";
     init_cron_db();
     init_raw_sqlite();
+    init_db();
+    init_schema();
     init_dispatcher();
     init_broadcast();
     init_child_env();
@@ -24523,15 +24902,17 @@ var init_runner = __esm({
     UNATTENDED_PREAMBLE = "[Unattended cron run \u2014 nobody will answer questions. Deliver the result directly; if genuinely blocked, state what's blocked in one line and stop.]";
     RUNS_PER_JOB_KEEP = 100;
     LOG_RETENTION_DAYS = 30;
+    _sessionRegistry = null;
     _active = /* @__PURE__ */ new Map();
     _inflight = /* @__PURE__ */ new Set();
+    _inflightSessions = /* @__PURE__ */ new Set();
     _fingerprint = /* @__PURE__ */ new Map();
     _daemonTimers = [];
     _lastCronDataVersion = null;
   }
 });
 
-// packages/server/dist/routes/cron.js
+// ../server/dist/routes/cron.js
 import { Hono as Hono14 } from "hono";
 import { eq as eq15, desc as desc3, lt as lt6, and as and11 } from "drizzle-orm";
 import fs52 from "node:fs/promises";
@@ -24556,6 +24937,19 @@ function validateTimeoutSec(v) {
   }
   return null;
 }
+function parseSessionId(v) {
+  if (v === void 0 || v === null)
+    return { sessionId: null };
+  if (typeof v !== "string")
+    return { error: "sessionId must be a string or null" };
+  const s = v.trim();
+  if (s.length === 0)
+    return { sessionId: null };
+  if (!SESSION_ID_RE.test(s)) {
+    return { error: 'sessionId must be a root session id (letters, digits, _ : - only; no ">" sub-session path)' };
+  }
+  return { sessionId: s };
+}
 function createCronRoutes() {
   const router = new Hono14();
   router.get("/cron/jobs", async (c) => {
@@ -24604,6 +24998,9 @@ function createCronRoutes() {
       if (err)
         return c.json({ error: err }, 400);
     }
+    const session = parseSessionId(body.sessionId);
+    if ("error" in session)
+      return c.json({ error: session.error }, 400);
     const id = newJobId();
     const now = Date.now();
     getCronDb().insert(cronJobs).values({
@@ -24616,6 +25013,7 @@ function createCronRoutes() {
       runAt: hasRunAt ? body.runAt : null,
       timezone: body.timezone ?? null,
       timeoutSec: body.timeoutSec ?? null,
+      sessionId: session.sessionId,
       targets: JSON.stringify(body.targets ?? []),
       enabled: body.enabled === false ? 0 : 1,
       lastRunStatus: null,
@@ -24657,6 +25055,9 @@ function createCronRoutes() {
       if (err)
         return c.json({ error: err }, 400);
     }
+    const session = parseSessionId(body.sessionId);
+    if ("error" in session)
+      return c.json({ error: session.error }, 400);
     const hasSchedule = typeof body.schedule === "string" && body.schedule.trim().length > 0;
     const hasRunAt = typeof body.runAt === "number";
     if (hasSchedule && hasRunAt) {
@@ -24686,6 +25087,8 @@ function createCronRoutes() {
       patch.timezone = body.timezone || null;
     if (body.timeoutSec !== void 0)
       patch.timeoutSec = body.timeoutSec;
+    if (body.sessionId !== void 0)
+      patch.sessionId = session.sessionId;
     if (body.targets !== void 0)
       patch.targets = JSON.stringify(body.targets);
     if (body.enabled !== void 0)
@@ -24801,9 +25204,9 @@ function computeNextRun(j) {
     return null;
   }
 }
-var TIMEOUT_SEC_MIN, TIMEOUT_SEC_MAX;
+var TIMEOUT_SEC_MIN, TIMEOUT_SEC_MAX, SESSION_ID_RE;
 var init_cron = __esm({
-  "packages/server/dist/routes/cron.js"() {
+  "../server/dist/routes/cron.js"() {
     "use strict";
     init_cron_db();
     init_runner();
@@ -24811,10 +25214,11 @@ var init_cron = __esm({
     init_broadcast();
     TIMEOUT_SEC_MIN = 60;
     TIMEOUT_SEC_MAX = 21600;
+    SESSION_ID_RE = /^[A-Za-z0-9_:-]{1,200}$/;
   }
 });
 
-// packages/server/dist/evolution/ticker.js
+// ../server/dist/evolution/ticker.js
 import { eq as eq16, and as and12, or as or2, asc, isNull as isNull6, sql as sql2 } from "drizzle-orm";
 function setEvoSpawner(fn) {
   _spawner = fn;
@@ -25040,7 +25444,7 @@ function claimApply(id) {
 }
 var _lastRunStatus, _lastApplyStatus, _spawner, TICK_INTERVAL_MS, _interval, _startupTimer2;
 var init_ticker = __esm({
-  "packages/server/dist/evolution/ticker.js"() {
+  "../server/dist/evolution/ticker.js"() {
     "use strict";
     init_config();
     init_evo_db();
@@ -25056,13 +25460,13 @@ var init_ticker = __esm({
   }
 });
 
-// packages/server/dist/evolution/spawn.js
+// ../server/dist/evolution/spawn.js
 import path61 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var __dirname2, WRAPPER_PATH, realEvoSpawner;
 var init_spawn = __esm({
-  "packages/server/dist/evolution/spawn.js"() {
+  "../server/dist/evolution/spawn.js"() {
     "use strict";
     init_child_env();
     __dirname2 = path61.dirname(fileURLToPath2(import.meta.url));
@@ -25084,7 +25488,7 @@ var init_spawn = __esm({
   }
 });
 
-// packages/server/dist/channels/registry.js
+// ../server/dist/channels/registry.js
 function bootChannels(app2, descriptors, deps) {
   for (const d of descriptors) {
     if (d.registerCronDispatcher)
@@ -25109,13 +25513,13 @@ async function shutdownChannels() {
 }
 var _running;
 var init_registry2 = __esm({
-  "packages/server/dist/channels/registry.js"() {
+  "../server/dist/channels/registry.js"() {
     "use strict";
     _running = [];
   }
 });
 
-// packages/server/dist/channels/telegram/accounts.js
+// ../server/dist/channels/telegram/accounts.js
 function toTelegram(a) {
   const c = a.config;
   return {
@@ -25189,14 +25593,14 @@ function deleteAccount3(db, accountId) {
 }
 var CH2;
 var init_accounts3 = __esm({
-  "packages/server/dist/channels/telegram/accounts.js"() {
+  "../server/dist/channels/telegram/accounts.js"() {
     "use strict";
     init_accounts();
     CH2 = "telegram";
   }
 });
 
-// packages/server/dist/channels/shared/chunk.js
+// ../server/dist/channels/shared/chunk.js
 function splitText(text6, limit) {
   const out = [];
   let rest = text6;
@@ -25212,15 +25616,15 @@ function splitText(text6, limit) {
   return out;
 }
 var init_chunk = __esm({
-  "packages/server/dist/channels/shared/chunk.js"() {
+  "../server/dist/channels/shared/chunk.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/channels/telegram/event-adapter.js
+// ../server/dist/channels/telegram/event-adapter.js
 var HARD_CHARS, TelegramResponder;
 var init_event_adapter = __esm({
-  "packages/server/dist/channels/telegram/event-adapter.js"() {
+  "../server/dist/channels/telegram/event-adapter.js"() {
     "use strict";
     init_chunk();
     init_media();
@@ -25303,7 +25707,7 @@ var init_event_adapter = __esm({
   }
 });
 
-// packages/server/dist/channels/shared/busy-hint.js
+// ../server/dist/channels/shared/busy-hint.js
 function busyHint(sm, sessionId, lang) {
   if (sm.isSessionCompacting(sessionId))
     return t("handler.compacting", lang);
@@ -25312,13 +25716,13 @@ function busyHint(sm, sessionId, lang) {
   return null;
 }
 var init_busy_hint = __esm({
-  "packages/server/dist/channels/shared/busy-hint.js"() {
+  "../server/dist/channels/shared/busy-hint.js"() {
     "use strict";
     init_i18n();
   }
 });
 
-// packages/server/dist/channels/shared/inbound.js
+// ../server/dist/channels/shared/inbound.js
 function sessionAccess(accountAccessLevel) {
   return accountAccessLevel === "full" ? null : accountAccessLevel === "workspace" ? "workspace" : "readonly";
 }
@@ -25376,7 +25780,7 @@ async function dispatchChannelCommand(ctx, command, arg, opts) {
 }
 var InboundBridge;
 var init_inbound = __esm({
-  "packages/server/dist/channels/shared/inbound.js"() {
+  "../server/dist/channels/shared/inbound.js"() {
     "use strict";
     init_goal_mode();
     init_accounts();
@@ -25446,7 +25850,7 @@ var init_inbound = __esm({
   }
 });
 
-// packages/server/dist/channels/telegram/handler.js
+// ../server/dist/channels/telegram/handler.js
 import { Bot, InputFile } from "grammy";
 function inferMediaKind(filePath) {
   const cls = classifyMedia(filePath);
@@ -25544,7 +25948,7 @@ function startTelegramChannel(deps) {
           if (!route)
             return;
           if (!isMediaPathAllowed(filePath, account.workspacePath)) {
-            console.log(`[Telegram] sendMedia blocked: ${filePath} not under workspace`);
+            console.warn(`[Telegram] sendMedia blocked: ${filePath} not under workspace`);
             return;
           }
           const kind = inferMediaKind(filePath);
@@ -25833,7 +26237,7 @@ async function handleUserMessage(args) {
 }
 var MAX_TG_DOWNLOAD_BYTES;
 var init_handler3 = __esm({
-  "packages/server/dist/channels/telegram/handler.js"() {
+  "../server/dist/channels/telegram/handler.js"() {
     "use strict";
     init_accounts3();
     init_event_adapter();
@@ -25848,7 +26252,7 @@ var init_handler3 = __esm({
   }
 });
 
-// packages/server/dist/routes/telegram.js
+// ../server/dist/routes/telegram.js
 import { Hono as Hono15 } from "hono";
 import { Bot as Bot2 } from "grammy";
 import fs53 from "node:fs";
@@ -25967,14 +26371,14 @@ function createTelegramRoutes(deps) {
   return app2;
 }
 var init_telegram = __esm({
-  "packages/server/dist/routes/telegram.js"() {
+  "../server/dist/routes/telegram.js"() {
     "use strict";
     init_accounts3();
     init_accounts();
   }
 });
 
-// packages/server/dist/channels/telegram/cron-dispatcher.js
+// ../server/dist/channels/telegram/cron-dispatcher.js
 import { Bot as Bot3 } from "grammy";
 async function dispatch(accountId, text6, explicitChatId) {
   const acct = getAccount3(getChannelDb(), accountId);
@@ -26023,7 +26427,7 @@ function registerTelegramCronDispatcher() {
   registerCronDispatcher({ channelType: "telegram", dispatch, listTargets });
 }
 var init_cron_dispatcher = __esm({
-  "packages/server/dist/channels/telegram/cron-dispatcher.js"() {
+  "../server/dist/channels/telegram/cron-dispatcher.js"() {
     "use strict";
     init_channel_db();
     init_accounts3();
@@ -26031,10 +26435,10 @@ var init_cron_dispatcher = __esm({
   }
 });
 
-// packages/server/dist/channels/telegram/descriptor.js
+// ../server/dist/channels/telegram/descriptor.js
 var telegramDescriptor;
 var init_descriptor = __esm({
-  "packages/server/dist/channels/telegram/descriptor.js"() {
+  "../server/dist/channels/telegram/descriptor.js"() {
     "use strict";
     init_handler3();
     init_telegram();
@@ -26049,7 +26453,7 @@ var init_descriptor = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/api.js
+// ../server/dist/channels/wechat/api.js
 import crypto3 from "node:crypto";
 function buildClientVersion(version) {
   const [ma, mi, pa] = version.split(".").map((p) => parseInt(p, 10));
@@ -26238,7 +26642,7 @@ async function notifyStop(params) {
 }
 var QR_BASE_URL, DEFAULT_BOT_TYPE, CHANNEL_VERSION, ILINK_APP_ID, ILINK_APP_CLIENT_VERSION, DEFAULT_LONG_POLL_TIMEOUT_MS, DEFAULT_API_TIMEOUT_MS;
 var init_api = __esm({
-  "packages/server/dist/channels/wechat/api.js"() {
+  "../server/dist/channels/wechat/api.js"() {
     "use strict";
     QR_BASE_URL = "https://ilinkai.weixin.qq.com";
     DEFAULT_BOT_TYPE = "3";
@@ -26250,10 +26654,10 @@ var init_api = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/types.js
+// ../server/dist/channels/wechat/types.js
 var MessageItemType, MessageType, MessageState, UploadMediaType;
 var init_types = __esm({
-  "packages/server/dist/channels/wechat/types.js"() {
+  "../server/dist/channels/wechat/types.js"() {
     "use strict";
     MessageItemType = {
       NONE: 0,
@@ -26282,7 +26686,7 @@ var init_types = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/accounts.js
+// ../server/dist/channels/wechat/accounts.js
 function toWechat(a) {
   const c = a.config;
   return {
@@ -26364,17 +26768,17 @@ function saveSyncBuf(db, accountId, syncBuf) {
 }
 var CH3;
 var init_accounts4 = __esm({
-  "packages/server/dist/channels/wechat/accounts.js"() {
+  "../server/dist/channels/wechat/accounts.js"() {
     "use strict";
     init_accounts();
     CH3 = "wechat";
   }
 });
 
-// packages/server/dist/channels/wechat/event-adapter.js
+// ../server/dist/channels/wechat/event-adapter.js
 var WECHAT_TEXT_LIMIT, WechatResponder;
 var init_event_adapter2 = __esm({
-  "packages/server/dist/channels/wechat/event-adapter.js"() {
+  "../server/dist/channels/wechat/event-adapter.js"() {
     "use strict";
     init_chunk();
     init_media();
@@ -26478,7 +26882,7 @@ var init_event_adapter2 = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/cdn.js
+// ../server/dist/channels/wechat/cdn.js
 import { createDecipheriv, createCipheriv, randomBytes as randomBytes2, createHash as createHash2 } from "node:crypto";
 function decryptAesEcb(ciphertext, key) {
   const decipher = createDecipheriv("aes-128-ecb", key, null);
@@ -26577,14 +26981,14 @@ async function uploadCiphertext(params) {
 }
 var CDN_BASE_URL, UPLOAD_MAX_RETRIES;
 var init_cdn = __esm({
-  "packages/server/dist/channels/wechat/cdn.js"() {
+  "../server/dist/channels/wechat/cdn.js"() {
     "use strict";
     CDN_BASE_URL = "https://novac2c.cdn.weixin.qq.com/c2c";
     UPLOAD_MAX_RETRIES = 3;
   }
 });
 
-// packages/server/dist/channels/wechat/send-media.js
+// ../server/dist/channels/wechat/send-media.js
 import fs54 from "node:fs/promises";
 import path62 from "node:path";
 function inferKind(filePath) {
@@ -26678,7 +27082,7 @@ function buildMessageItem(args) {
   };
 }
 var init_send_media = __esm({
-  "packages/server/dist/channels/wechat/send-media.js"() {
+  "../server/dist/channels/wechat/send-media.js"() {
     "use strict";
     init_api();
     init_cdn();
@@ -26687,7 +27091,7 @@ var init_send_media = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/login.js
+// ../server/dist/channels/wechat/login.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 function isFresh(l) {
   return Date.now() - l.startedAt < ACTIVE_TTL_MS;
@@ -26789,7 +27193,7 @@ async function waitLogin(params) {
 }
 var ACTIVE_TTL_MS, MAX_QR_REFRESH, activeLogins;
 var init_login = __esm({
-  "packages/server/dist/channels/wechat/login.js"() {
+  "../server/dist/channels/wechat/login.js"() {
     "use strict";
     init_api();
     ACTIVE_TTL_MS = 5 * 6e4;
@@ -26798,7 +27202,7 @@ var init_login = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/handler.js
+// ../server/dist/channels/wechat/handler.js
 import fs55 from "node:fs";
 import path63 from "node:path";
 import QRCode from "qrcode";
@@ -26841,7 +27245,7 @@ function startWechatChannel(deps) {
           if (!route)
             return;
           if (!isMediaPathAllowed(filePath, account.workspacePath)) {
-            console.log(`[WeChat] sendMedia blocked: ${filePath} not under workspace`);
+            console.warn(`[WeChat] sendMedia blocked: ${filePath} not under workspace`);
             return;
           }
           await sendMediaFile({
@@ -27256,7 +27660,7 @@ function sleep2(ms, signal) {
 }
 var MAX_CONSECUTIVE_FAILURES, BACKOFF_DELAY_MS, RETRY_DELAY_MS;
 var init_handler4 = __esm({
-  "packages/server/dist/channels/wechat/handler.js"() {
+  "../server/dist/channels/wechat/handler.js"() {
     "use strict";
     init_api();
     init_types();
@@ -27278,7 +27682,7 @@ var init_handler4 = __esm({
   }
 });
 
-// packages/server/dist/routes/wechat.js
+// ../server/dist/routes/wechat.js
 import { Hono as Hono16 } from "hono";
 import path64 from "node:path";
 import fs56 from "node:fs";
@@ -27393,7 +27797,7 @@ function stripSecrets(acc) {
   return rest;
 }
 var init_wechat = __esm({
-  "packages/server/dist/routes/wechat.js"() {
+  "../server/dist/routes/wechat.js"() {
     "use strict";
     init_login();
     init_accounts4();
@@ -27401,7 +27805,7 @@ var init_wechat = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/cron-dispatcher.js
+// ../server/dist/channels/wechat/cron-dispatcher.js
 function readLastActiveChatId(accountId) {
   const acct = getAccount(getChannelDb(), accountId);
   if (!acct)
@@ -27482,7 +27886,7 @@ function registerWechatCronDispatcher() {
   registerCronDispatcher({ channelType: "wechat", supportsMedia: true, dispatch: dispatch2, listTargets: listTargets2 });
 }
 var init_cron_dispatcher2 = __esm({
-  "packages/server/dist/channels/wechat/cron-dispatcher.js"() {
+  "../server/dist/channels/wechat/cron-dispatcher.js"() {
     "use strict";
     init_channel_db();
     init_accounts();
@@ -27496,10 +27900,10 @@ var init_cron_dispatcher2 = __esm({
   }
 });
 
-// packages/server/dist/channels/wechat/descriptor.js
+// ../server/dist/channels/wechat/descriptor.js
 var wechatDescriptor;
 var init_descriptor2 = __esm({
-  "packages/server/dist/channels/wechat/descriptor.js"() {
+  "../server/dist/channels/wechat/descriptor.js"() {
     "use strict";
     init_handler4();
     init_wechat();
@@ -27514,7 +27918,7 @@ var init_descriptor2 = __esm({
   }
 });
 
-// packages/server/dist/routes/web.js
+// ../server/dist/routes/web.js
 import { Hono as Hono17 } from "hono";
 import { streamSSE } from "hono/streaming";
 import crypto4 from "node:crypto";
@@ -27751,7 +28155,7 @@ function createWebRoutes(deps) {
   return app2;
 }
 var init_web = __esm({
-  "packages/server/dist/routes/web.js"() {
+  "../server/dist/routes/web.js"() {
     "use strict";
     init_dist();
     init_handler();
@@ -27763,10 +28167,10 @@ var init_web = __esm({
   }
 });
 
-// packages/server/dist/channels/web/descriptor.js
+// ../server/dist/channels/web/descriptor.js
 var webDescriptor;
 var init_descriptor3 = __esm({
-  "packages/server/dist/channels/web/descriptor.js"() {
+  "../server/dist/channels/web/descriptor.js"() {
     "use strict";
     init_handler();
     init_web();
@@ -27782,7 +28186,7 @@ var init_descriptor3 = __esm({
   }
 });
 
-// packages/server/dist/channels/slack/accounts.js
+// ../server/dist/channels/slack/accounts.js
 function toSlack(a) {
   const c = a.config;
   return {
@@ -27858,14 +28262,14 @@ function deleteAccount5(db, accountId) {
 }
 var CH4;
 var init_accounts5 = __esm({
-  "packages/server/dist/channels/slack/accounts.js"() {
+  "../server/dist/channels/slack/accounts.js"() {
     "use strict";
     init_accounts();
     CH4 = "slack";
   }
 });
 
-// packages/server/dist/channels/shared/markdown.js
+// ../server/dist/channels/shared/markdown.js
 function formatForSlack(input) {
   if (!input)
     return "";
@@ -27944,15 +28348,15 @@ function stripCommonMark(line) {
   return line;
 }
 var init_markdown = __esm({
-  "packages/server/dist/channels/shared/markdown.js"() {
+  "../server/dist/channels/shared/markdown.js"() {
     "use strict";
   }
 });
 
-// packages/server/dist/channels/slack/event-adapter.js
+// ../server/dist/channels/slack/event-adapter.js
 var HARD_CHARS2, SlackResponder;
 var init_event_adapter3 = __esm({
-  "packages/server/dist/channels/slack/event-adapter.js"() {
+  "../server/dist/channels/slack/event-adapter.js"() {
     "use strict";
     init_chunk();
     init_markdown();
@@ -28045,7 +28449,7 @@ var init_event_adapter3 = __esm({
   }
 });
 
-// packages/server/dist/channels/slack/api.js
+// ../server/dist/channels/slack/api.js
 async function slackPost(endpoint, token, body) {
   const isForm = body instanceof FormData;
   const res = await fetch(`${SLACK_API}/${endpoint}`, {
@@ -28233,13 +28637,13 @@ async function downloadFile(botToken, urlPrivate) {
 }
 var SLACK_API;
 var init_api2 = __esm({
-  "packages/server/dist/channels/slack/api.js"() {
+  "../server/dist/channels/slack/api.js"() {
     "use strict";
     SLACK_API = "https://slack.com/api";
   }
 });
 
-// packages/server/dist/channels/slack/handler.js
+// ../server/dist/channels/slack/handler.js
 import path65 from "node:path";
 import { WebSocket } from "ws";
 function slashToBang(text6, commandNames) {
@@ -28347,7 +28751,7 @@ function startSlackChannel(deps) {
               return;
             const resolved = path65.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[Slack] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[Slack] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -28602,7 +29006,7 @@ function buildCmdCtx(args) {
 }
 var SLACK_EXTRA_COMMANDS, SEEN_EVENT_IDS, SEEN_EVENT_IDS_MAX;
 var init_handler5 = __esm({
-  "packages/server/dist/channels/slack/handler.js"() {
+  "../server/dist/channels/slack/handler.js"() {
     "use strict";
     init_accounts5();
     init_event_adapter3();
@@ -28622,7 +29026,7 @@ var init_handler5 = __esm({
   }
 });
 
-// packages/server/dist/routes/slack.js
+// ../server/dist/routes/slack.js
 import { Hono as Hono18 } from "hono";
 import fs58 from "node:fs";
 function createSlackRoutes(deps) {
@@ -28756,7 +29160,7 @@ function createSlackRoutes(deps) {
   return app2;
 }
 var init_slack = __esm({
-  "packages/server/dist/routes/slack.js"() {
+  "../server/dist/routes/slack.js"() {
     "use strict";
     init_accounts5();
     init_accounts();
@@ -28764,7 +29168,7 @@ var init_slack = __esm({
   }
 });
 
-// packages/server/dist/channels/slack/cron-dispatcher.js
+// ../server/dist/channels/slack/cron-dispatcher.js
 function parseChatId(raw) {
   const idx = raw.indexOf(":");
   if (idx < 0)
@@ -28828,7 +29232,7 @@ function registerSlackCronDispatcher() {
   registerCronDispatcher({ channelType: "slack", supportsMedia: true, dispatch: dispatch3, listTargets: listTargets3 });
 }
 var init_cron_dispatcher3 = __esm({
-  "packages/server/dist/channels/slack/cron-dispatcher.js"() {
+  "../server/dist/channels/slack/cron-dispatcher.js"() {
     "use strict";
     init_channel_db();
     init_accounts5();
@@ -28838,10 +29242,10 @@ var init_cron_dispatcher3 = __esm({
   }
 });
 
-// packages/server/dist/channels/slack/descriptor.js
+// ../server/dist/channels/slack/descriptor.js
 var slackDescriptor;
 var init_descriptor4 = __esm({
-  "packages/server/dist/channels/slack/descriptor.js"() {
+  "../server/dist/channels/slack/descriptor.js"() {
     "use strict";
     init_handler5();
     init_slack();
@@ -28856,7 +29260,7 @@ var init_descriptor4 = __esm({
   }
 });
 
-// packages/server/dist/channels/feishu/accounts.js
+// ../server/dist/channels/feishu/accounts.js
 function toFeishu(a) {
   const c = a.config;
   return {
@@ -28934,17 +29338,17 @@ function deleteAccount6(db, accountId) {
 }
 var CH5;
 var init_accounts6 = __esm({
-  "packages/server/dist/channels/feishu/accounts.js"() {
+  "../server/dist/channels/feishu/accounts.js"() {
     "use strict";
     init_accounts();
     CH5 = "feishu";
   }
 });
 
-// packages/server/dist/channels/feishu/event-adapter.js
+// ../server/dist/channels/feishu/event-adapter.js
 var HARD_CHARS3, FeishuResponder;
 var init_event_adapter4 = __esm({
-  "packages/server/dist/channels/feishu/event-adapter.js"() {
+  "../server/dist/channels/feishu/event-adapter.js"() {
     "use strict";
     init_chunk();
     init_markdown();
@@ -29037,7 +29441,7 @@ var init_event_adapter4 = __esm({
   }
 });
 
-// packages/server/dist/channels/feishu/api.js
+// ../server/dist/channels/feishu/api.js
 async function getTenantAccessToken(args) {
   const cached = tokenCache.get(args.appId);
   if (cached && cached.expiresAt - Date.now() > 6e4)
@@ -29301,14 +29705,14 @@ async function searchFeishuTargets(args) {
 }
 var FEISHU_BASE, tokenCache;
 var init_api3 = __esm({
-  "packages/server/dist/channels/feishu/api.js"() {
+  "../server/dist/channels/feishu/api.js"() {
     "use strict";
     FEISHU_BASE = "https://open.feishu.cn";
     tokenCache = /* @__PURE__ */ new Map();
   }
 });
 
-// packages/server/dist/channels/feishu/handler.js
+// ../server/dist/channels/feishu/handler.js
 import path66 from "node:path";
 import * as Lark from "@larksuiteoapi/node-sdk";
 function buildSessionPrefixForThread2(chatId, rootId) {
@@ -29493,7 +29897,7 @@ function startFeishuChannel(deps) {
               return;
             const resolved = path66.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[Feishu] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[Feishu] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -29781,7 +30185,7 @@ function buildCmdCtx2(args) {
 }
 var MAX_FEISHU_DOWNLOAD_BYTES;
 var init_handler6 = __esm({
-  "packages/server/dist/channels/feishu/handler.js"() {
+  "../server/dist/channels/feishu/handler.js"() {
     "use strict";
     init_accounts6();
     init_event_adapter4();
@@ -29797,7 +30201,7 @@ var init_handler6 = __esm({
   }
 });
 
-// packages/server/dist/routes/feishu.js
+// ../server/dist/routes/feishu.js
 import { Hono as Hono19 } from "hono";
 import fs59 from "node:fs";
 function createFeishuRoutes(deps) {
@@ -29934,7 +30338,7 @@ function createFeishuRoutes(deps) {
   return app2;
 }
 var init_feishu = __esm({
-  "packages/server/dist/routes/feishu.js"() {
+  "../server/dist/routes/feishu.js"() {
     "use strict";
     init_accounts6();
     init_accounts();
@@ -29942,7 +30346,7 @@ var init_feishu = __esm({
   }
 });
 
-// packages/server/dist/channels/feishu/cron-dispatcher.js
+// ../server/dist/channels/feishu/cron-dispatcher.js
 function parseChatId2(raw) {
   const idx = raw.indexOf(":");
   return { chatId: idx < 0 ? raw : raw.slice(0, idx) };
@@ -29992,7 +30396,7 @@ function registerFeishuCronDispatcher() {
   registerCronDispatcher({ channelType: "feishu", dispatch: dispatch4, listTargets: listTargets4 });
 }
 var init_cron_dispatcher4 = __esm({
-  "packages/server/dist/channels/feishu/cron-dispatcher.js"() {
+  "../server/dist/channels/feishu/cron-dispatcher.js"() {
     "use strict";
     init_channel_db();
     init_accounts6();
@@ -30001,10 +30405,10 @@ var init_cron_dispatcher4 = __esm({
   }
 });
 
-// packages/server/dist/channels/feishu/descriptor.js
+// ../server/dist/channels/feishu/descriptor.js
 var feishuDescriptor;
 var init_descriptor5 = __esm({
-  "packages/server/dist/channels/feishu/descriptor.js"() {
+  "../server/dist/channels/feishu/descriptor.js"() {
     "use strict";
     init_handler6();
     init_feishu();
@@ -30019,7 +30423,7 @@ var init_descriptor5 = __esm({
   }
 });
 
-// packages/server/dist/channels/wecom/accounts.js
+// ../server/dist/channels/wecom/accounts.js
 function toWecom(a) {
   const c = a.config;
   return {
@@ -30094,17 +30498,17 @@ function deleteAccount7(db, accountId) {
 }
 var CH6;
 var init_accounts7 = __esm({
-  "packages/server/dist/channels/wecom/accounts.js"() {
+  "../server/dist/channels/wecom/accounts.js"() {
     "use strict";
     init_accounts();
     CH6 = "wecom";
   }
 });
 
-// packages/server/dist/channels/wecom/event-adapter.js
+// ../server/dist/channels/wecom/event-adapter.js
 var HARD_CHARS4, WecomResponder;
 var init_event_adapter5 = __esm({
-  "packages/server/dist/channels/wecom/event-adapter.js"() {
+  "../server/dist/channels/wecom/event-adapter.js"() {
     "use strict";
     init_chunk();
     init_media();
@@ -30195,7 +30599,7 @@ var init_event_adapter5 = __esm({
   }
 });
 
-// packages/server/dist/channels/wecom/handler.js
+// ../server/dist/channels/wecom/handler.js
 import path67 from "node:path";
 import fs60 from "node:fs/promises";
 import { WSClient as WSClient2, generateReqId } from "@wecom/aibot-node-sdk";
@@ -30356,7 +30760,7 @@ function startWecomChannel(deps) {
               return;
             const resolved = path67.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[WeCom] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[WeCom] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -30564,7 +30968,7 @@ function buildCmdCtx3(args) {
 }
 var liveClients, DEDUPE_CAP, MAX_WECOM_DOWNLOAD_BYTES;
 var init_handler7 = __esm({
-  "packages/server/dist/channels/wecom/handler.js"() {
+  "../server/dist/channels/wecom/handler.js"() {
     "use strict";
     init_accounts7();
     init_event_adapter5();
@@ -30580,7 +30984,7 @@ var init_handler7 = __esm({
   }
 });
 
-// packages/server/dist/routes/wecom.js
+// ../server/dist/routes/wecom.js
 import { Hono as Hono20 } from "hono";
 import fs61 from "node:fs";
 function createWecomRoutes(deps) {
@@ -30687,14 +31091,14 @@ function createWecomRoutes(deps) {
   return app2;
 }
 var init_wecom = __esm({
-  "packages/server/dist/routes/wecom.js"() {
+  "../server/dist/routes/wecom.js"() {
     "use strict";
     init_accounts7();
     init_accounts();
   }
 });
 
-// packages/server/dist/channels/wecom/cron-dispatcher.js
+// ../server/dist/channels/wecom/cron-dispatcher.js
 async function dispatch5(accountId, text6, explicitChatId) {
   const acct = getAccount7(getChannelDb(), accountId);
   if (!acct)
@@ -30736,7 +31140,7 @@ function registerWecomCronDispatcher() {
   registerCronDispatcher({ channelType: "wecom", dispatch: dispatch5, listTargets: listTargets5 });
 }
 var init_cron_dispatcher5 = __esm({
-  "packages/server/dist/channels/wecom/cron-dispatcher.js"() {
+  "../server/dist/channels/wecom/cron-dispatcher.js"() {
     "use strict";
     init_channel_db();
     init_accounts7();
@@ -30745,10 +31149,10 @@ var init_cron_dispatcher5 = __esm({
   }
 });
 
-// packages/server/dist/channels/wecom/descriptor.js
+// ../server/dist/channels/wecom/descriptor.js
 var wecomDescriptor;
 var init_descriptor6 = __esm({
-  "packages/server/dist/channels/wecom/descriptor.js"() {
+  "../server/dist/channels/wecom/descriptor.js"() {
     "use strict";
     init_handler7();
     init_wecom();
@@ -30763,10 +31167,10 @@ var init_descriptor6 = __esm({
   }
 });
 
-// packages/server/dist/channels/descriptors.js
+// ../server/dist/channels/descriptors.js
 var defaultChannelDescriptors;
 var init_descriptors = __esm({
-  "packages/server/dist/channels/descriptors.js"() {
+  "../server/dist/channels/descriptors.js"() {
     "use strict";
     init_descriptor();
     init_descriptor2();
@@ -30785,7 +31189,7 @@ var init_descriptors = __esm({
   }
 });
 
-// packages/server/dist/middleware/auth.js
+// ../server/dist/middleware/auth.js
 import { Hono as Hono21 } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
 import crypto5 from "node:crypto";
@@ -30978,7 +31382,7 @@ function authMiddleware() {
 }
 var TOKEN_MAX_AGE, REFRESH_AFTER, COOKIE_NAME, ADMIN_LOGIN_BUCKET, isLockedOut2, recordFailure2, clearFailures2, PUBLIC_PATHS;
 var init_auth = __esm({
-  "packages/server/dist/middleware/auth.js"() {
+  "../server/dist/middleware/auth.js"() {
     "use strict";
     init_config();
     init_password_hash();
@@ -30995,7 +31399,7 @@ var init_auth = __esm({
   }
 });
 
-// packages/server/dist/index.js
+// ../server/dist/index.js
 var dist_exports = {};
 import { Hono as Hono22 } from "hono";
 import { cors } from "hono/cors";
@@ -31124,7 +31528,7 @@ async function gracefulShutdown(signal) {
 }
 var __dirname3, PORT, HALO_VERSION, PROJECT_ROOT, HALO_HOME4, GIT_SHA, AGENTCORE, app, allowlist, authRoutes, fileRoutes, dataPreviewRoutes, gitRoutes, agentConfigRoutes, skillRoutes, settingsRoutes, evolutionRoutes, cronRoutes, channelDb, registry, sessionRoutes, sessionArchiveRoutes, showRoutes, metricsRoutes, commandRoutes, FRONTEND_DIR, server, wss;
 var init_dist2 = __esm({
-  async "packages/server/dist/index.js"() {
+  async "../server/dist/index.js"() {
     "use strict";
     init_files();
     init_data_preview();
@@ -31166,7 +31570,7 @@ var init_dist2 = __esm({
     init_git_ssh();
     __dirname3 = path68.dirname(fileURLToPath3(import.meta.url));
     PORT = config.server.port;
-    HALO_VERSION = "1.3.4";
+    HALO_VERSION = "1.4.1";
     PROJECT_ROOT = findProjectRoot();
     HALO_HOME4 = path68.join(homedir24(), ".halo");
     GIT_SHA = readGitSha();
@@ -31213,7 +31617,7 @@ var init_dist2 = __esm({
       const { hiddenDirs, hiddenFiles, writableDirs } = reloadSandboxConfig();
       setSandboxHiddenPaths(hiddenDirs, hiddenFiles, writableDirs);
     });
-    console.log(`[Server] bwrap sandbox: ${isBwrapCached() ? "available" : "NOT available (app-level fallback only)"}`);
+    console.log(`[Server] OS sandbox: ${getSandboxBackend() ?? "NOT available (non-full sessions: no shell_exec, file tools path-checked in-process)"}`);
     ensureSshAgent();
     console.log(`[Server] Halo home: ${HALO_HOME4}`);
     console.log("[Server] Services initialized (ModelRuntime)");
@@ -31242,7 +31646,10 @@ var init_dist2 = __esm({
         uptime: process.uptime(),
         engine: "agent",
         version: HALO_VERSION,
-        gitSha: GIT_SHA
+        gitSha: GIT_SHA,
+        // OS sandbox backing non-full access levels; null → admin locks the
+        // access-level selector to Full.
+        sandbox: getSandboxBackend()
       });
     });
     fileRoutes = createFileRoutes();
@@ -31273,6 +31680,7 @@ var init_dist2 = __esm({
     }
     registry = new SessionManagerRegistry({ reconcileOrphansOnBoot: true });
     setRelayRegistry(registry);
+    setCronSessionRegistry(registry);
     for (const ws of listRunningWorkspaces()) {
       if (!fs62.existsSync(path68.join(ws, ".halo")))
         continue;
@@ -31357,7 +31765,7 @@ var init_dist2 = __esm({
   }
 });
 
-// packages/acp-adapter/dist/halo-client.js
+// ../acp-adapter/dist/halo-client.js
 async function safeText(res) {
   try {
     return (await res.text()).slice(0, 500);
@@ -31400,7 +31808,7 @@ async function* parseSseStream(body) {
 }
 var HaloClient;
 var init_halo_client = __esm({
-  "packages/acp-adapter/dist/halo-client.js"() {
+  "../acp-adapter/dist/halo-client.js"() {
     "use strict";
     HaloClient = class {
       opts;
@@ -31500,7 +31908,7 @@ var init_halo_client = __esm({
   }
 });
 
-// packages/acp-adapter/dist/adapter.js
+// ../acp-adapter/dist/adapter.js
 function newError(message, code = -32603) {
   const e = new Error(message);
   e.code = code;
@@ -31508,7 +31916,7 @@ function newError(message, code = -32603) {
 }
 var AcpAdapter;
 var init_adapter = __esm({
-  "packages/acp-adapter/dist/adapter.js"() {
+  "../acp-adapter/dist/adapter.js"() {
     "use strict";
     init_halo_client();
     AcpAdapter = class {
@@ -31795,10 +32203,10 @@ var init_adapter = __esm({
   }
 });
 
-// packages/acp-adapter/dist/jsonrpc.js
+// ../acp-adapter/dist/jsonrpc.js
 var ERROR_PARSE, ERROR_METHOD_NOT_FOUND, ERROR_INTERNAL, JsonRpcConnection;
 var init_jsonrpc = __esm({
-  "packages/acp-adapter/dist/jsonrpc.js"() {
+  "../acp-adapter/dist/jsonrpc.js"() {
     "use strict";
     ERROR_PARSE = -32700;
     ERROR_METHOD_NOT_FOUND = -32601;
@@ -31931,7 +32339,7 @@ var init_jsonrpc = __esm({
   }
 });
 
-// packages/acp-adapter/dist/index.js
+// ../acp-adapter/dist/index.js
 var dist_exports2 = {};
 __export(dist_exports2, {
   main: () => main
@@ -32047,7 +32455,7 @@ function main(argv = process.argv.slice(2)) {
 }
 var HELP;
 var init_dist3 = __esm({
-  "packages/acp-adapter/dist/index.js"() {
+  "../acp-adapter/dist/index.js"() {
     "use strict";
     init_adapter();
     init_jsonrpc();
@@ -32086,7 +32494,7 @@ Stdio:
   }
 });
 
-// packages/cli/src/silence-warnings.ts
+// src/silence-warnings.ts
 var emit = process.emitWarning.bind(process);
 process.emitWarning = (warning, ...args) => {
   const opt = args[0];
@@ -32095,13 +32503,13 @@ process.emitWarning = (warning, ...args) => {
   return emit(warning, ...args);
 };
 
-// packages/cli/src/index.ts
+// src/index.ts
 init_server_supervisor();
 import path69 from "node:path";
 import fs63 from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { parseArgs as parseArgs2 } from "node:util";
-var VERSION = "1.3.4";
+var VERSION = "1.4.1";
 var HELP_TOP = `Usage: halo <command> [options]
 
 Commands: