@turmind/halo 1.5.6 → 1.5.7

package/dist/index.js

@@ -3102,6 +3102,7 @@ __export(init_exports, {
   mergeAgentYaml: () => mergeAgentYaml,
   readInstalledOptionalSkills: () => readInstalledOptionalSkills,
   readSeedVersion: () => readSeedVersion,
+  refreshTemplatesIfOutdated: () => refreshTemplatesIfOutdated,
   writeFileAtomic: () => writeFileAtomic,
   writeInstalledOptionalSkills: () => writeInstalledOptionalSkills
 });
@@ -3124,6 +3125,17 @@ function readSeedVersion(haloHome2) {
     return 0;
   }
 }
+function refreshTemplatesIfOutdated(haloHome2, logTag) {
+  const seedVersion = readSeedVersion(haloHome2);
+  if (seedVersion <= 0 || seedVersion >= TEMPLATE_VERSION)
+    return;
+  console.log(`[${logTag}] Templates outdated (v${seedVersion} \u2192 v${TEMPLATE_VERSION}), refreshing ~/.halo/global/`);
+  try {
+    ensureHaloHome(haloHome2);
+  } catch (err) {
+    console.error(`[${logTag}] Template refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 function writeFileAtomic(filePath, content, mode) {
   fs7.mkdirSync(path9.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
@@ -3455,7 +3467,7 @@ var init_init = __esm({
       path9.resolve(__dirname, "..", "bundled-docs"),
       path9.resolve(__dirname, "..", "..", "..", ".halo", "docs")
     ];
-    TEMPLATE_VERSION = 81;
+    TEMPLATE_VERSION = 82;
     VERSION_FILE = ".template-version";
     SKIP_NAMES = /* @__PURE__ */ new Set([".DS_Store", "schema.sql", "__pycache__", ".pytest_cache"]);
     BUILTIN_AGENT_IDS = /* @__PURE__ */ new Set([
@@ -7144,27 +7156,27 @@ var init_workspace = __esm({
       constructor(projectRoot) {
         this.projectRoot = projectRoot;
       }
-      async readFile(path73) {
-        const fullPath = this.validatePath(path73);
+      async readFile(path74) {
+        const fullPath = this.validatePath(path74);
         return readFile(fullPath, "utf-8");
       }
-      async writeFile(path73, content) {
-        const fullPath = this.validatePath(path73);
+      async writeFile(path74, content) {
+        const fullPath = this.validatePath(path74);
         const dir = resolve(fullPath, "..");
         await mkdir(dir, { recursive: true });
         await writeFile(fullPath, content, "utf-8");
       }
-      validatePath(path73) {
-        const fullPath = isAbsolute(path73) ? resolve(path73) : resolve(this.projectRoot, path73);
+      validatePath(path74) {
+        const fullPath = isAbsolute(path74) ? resolve(path74) : resolve(this.projectRoot, path74);
         const root = resolve(this.projectRoot);
         if (fullPath !== root && !fullPath.startsWith(root + sep)) {
-          throw new WorkspaceError(`Path "${path73}" is outside the workspace directory "${this.projectRoot}"`);
+          throw new WorkspaceError(`Path "${path74}" is outside the workspace directory "${this.projectRoot}"`);
         }
         try {
           const real = realpathSync2(fullPath);
           const realRoot = realpathSync2(root);
           if (real !== realRoot && !real.startsWith(realRoot + sep)) {
-            throw new WorkspaceError(`Path "${path73}" is outside the workspace directory "${this.projectRoot}"`);
+            throw new WorkspaceError(`Path "${path74}" is outside the workspace directory "${this.projectRoot}"`);
           }
         } catch (err) {
           if (err instanceof WorkspaceError)
@@ -7351,12 +7363,12 @@ var init_git_manager = __esm({
             const code = parts[0];
             const status = code[0];
             const isRenameOrCopy = status === "R" || status === "C";
-            const path73 = isRenameOrCopy ? parts[2] : parts[1];
-            if (!path73 || seen.has(path73))
+            const path74 = isRenameOrCopy ? parts[2] : parts[1];
+            if (!path74 || seen.has(path74))
               continue;
-            seen.add(path73);
+            seen.add(path74);
             files.push({
-              path: path73,
+              path: path74,
               status,
               from: isRenameOrCopy ? parts[1] : void 0
             });
@@ -7504,9 +7516,9 @@ var init_git_manager = __esm({
        *  empty for an added file or the root commit) and `modified` is the version
        *  at `commit` (empty for a deletion). The working-tree/staged path above is
        *  left entirely untouched (commit === undefined preserves existing behavior). */
-      async getFileDiff(path73, staged, from, commit) {
+      async getFileDiff(path74, staged, from, commit) {
         if (commit) {
-          const parentPath = from || path73;
+          const parentPath = from || path74;
           let original2 = "";
           try {
             original2 = await this.git.show([`${commit}^:${parentPath}`]);
@@ -7515,13 +7527,13 @@ var init_git_manager = __esm({
           }
           let modified2 = "";
           try {
-            modified2 = await this.git.show([`${commit}:${path73}`]);
+            modified2 = await this.git.show([`${commit}:${path74}`]);
           } catch {
             modified2 = "";
           }
           return { original: original2, modified: modified2 };
         }
-        const headPath = from || path73;
+        const headPath = from || path74;
         let original = "";
         try {
           original = await this.git.show([`HEAD:${headPath}`]);
@@ -7531,13 +7543,13 @@ var init_git_manager = __esm({
         let modified = "";
         if (staged) {
           try {
-            modified = await this.git.show([`:${path73}`]);
+            modified = await this.git.show([`:${path74}`]);
           } catch {
             modified = "";
           }
         } else {
           try {
-            modified = await this.workspace.readFile(path73);
+            modified = await this.workspace.readFile(path74);
           } catch {
             modified = "";
           }
@@ -10239,12 +10251,29 @@ var init_anthropic_agent = __esm({
 });
 
 // ../server/dist/agents/model-runtime.js
-function createModelRuntime(providerId, cfg) {
-  switch (providerId) {
-    case "aws-bedrock-claude-invoke":
+import path28 from "node:path";
+function resolveProviderRuntime(providerId) {
+  const yamlPath = path28.join(HALO_GLOBAL_DIR, "models", `${providerId}.yaml`);
+  const providers2 = getModelsRegistry().providers;
+  const entry = providers2.find((p) => p.id === providerId);
+  if (!entry) {
+    throw new Error(`[model-runtime] Unknown provider "${providerId}": no provider yaml with that id (expected ${yamlPath}). Check agent.yaml model.provider, or run \`halo setup\` to install the bundled providers.`);
+  }
+  const runtime = entry.runtime;
+  if (typeof runtime !== "string" || !runtime) {
+    throw new Error(`[model-runtime] Provider "${providerId}" has no \`runtime:\` field in ${yamlPath}. Run \`halo setup\` or restart the Halo server to refresh templates.`);
+  }
+  if (!MODEL_RUNTIME_NAMES.includes(runtime)) {
+    throw new Error(`[model-runtime] Provider "${providerId}" names unknown runtime "${runtime}" in ${yamlPath}. Valid runtimes: ${MODEL_RUNTIME_NAMES.join(", ")}.`);
+  }
+  return runtime;
+}
+function createModelRuntime(runtime, cfg) {
+  switch (runtime) {
+    case "bedrock-invoke":
       return new BedrockAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://bedrock-runtime.us-east-1.amazonaws.com",
+        endpoint: cfg.endpoint,
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
         maxTokens: cfg.maxTokens,
@@ -10257,7 +10286,7 @@ function createModelRuntime(providerId, cfg) {
     case "kimi":
       return new KimiAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://api.moonshot.cn/v1",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10268,7 +10297,7 @@ function createModelRuntime(providerId, cfg) {
     case "deepseek":
       return new DeepSeekAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://api.deepseek.com",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10278,7 +10307,7 @@ function createModelRuntime(providerId, cfg) {
     case "minimax":
       return new MiniMaxAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://api.minimaxi.com/anthropic",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10291,7 +10320,7 @@ function createModelRuntime(providerId, cfg) {
     case "qwen":
       return new QwenAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://dashscope.aliyuncs.com/apps/anthropic",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10303,7 +10332,7 @@ function createModelRuntime(providerId, cfg) {
     case "hunyuan":
       return new HunyuanAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://tokenhub.tencentmaas.com/v1",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10313,7 +10342,7 @@ function createModelRuntime(providerId, cfg) {
     case "doubao":
       return new DoubaoAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://ark.cn-beijing.volces.com/api/v3",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10323,32 +10352,30 @@ function createModelRuntime(providerId, cfg) {
     case "zhipu":
       return new ZhipuAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://open.bigmodel.cn/api/paas/v4",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
         maxTokens: cfg.maxTokens,
         thinking: cfg.thinking
       });
-    case "openai":
+    case "openai-chat":
       return new OpenAIAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://api.openai.com/v1",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
         maxTokens: cfg.maxTokens,
         thinking: cfg.thinking
       });
-    // aws-bedrock-openai is the same OpenAI Responses wire format on the
-    // bedrock-runtime host (/openai/v1, cross-Region profile ids only) —
-    // Grok 4.6 / Kimi K3 live there and not (or not everywhere) on Mantle.
-    // See aws-bedrock-openai.yaml.
-    case "aws-bedrock-mantle":
-    case "aws-bedrock-openai":
+    // OpenAI Responses API on Bedrock — serves both aws-bedrock-mantle
+    // (bedrock-mantle host) and aws-bedrock-openai (bedrock-runtime host,
+    // /openai/v1); the endpoint alone picks the host and SigV4 region.
+    case "bedrock-mantle":
       return new MantleAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? (providerId === "aws-bedrock-openai" ? "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1" : "https://bedrock-mantle.us-east-1.api.aws/openai/v1"),
+        endpoint: cfg.endpoint,
         // No bearer token → MantleAgent falls back to SigV4 IAM auth using
         // these creds (or the SDK default chain when also empty).
         apiKey: cfg.apiKey ?? "",
@@ -10359,22 +10386,10 @@ function createModelRuntime(providerId, cfg) {
         thinking: cfg.thinking,
         verbosity: cfg.verbosity
       });
-    case "anthropic":
+    case "anthropic-messages":
       return new AnthropicAgent({
         modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://api.anthropic.com",
-        apiKey: cfg.apiKey ?? "",
-        systemPrompt: cfg.systemPrompt,
-        tools: cfg.tools,
-        maxTokens: cfg.maxTokens,
-        promptCaching: cfg.promptCaching,
-        thinking: cfg.thinking,
-        thinkingBudgetTokens: cfg.thinkingBudgetTokens
-      });
-    case "mimo-token-plan-china":
-      return new AnthropicAgent({
-        modelId: cfg.modelId,
-        endpoint: cfg.endpoint ?? "https://token-plan-cn.xiaomimimo.com/anthropic",
+        endpoint: cfg.endpoint,
         apiKey: cfg.apiKey ?? "",
         systemPrompt: cfg.systemPrompt,
         tools: cfg.tools,
@@ -10384,9 +10399,10 @@ function createModelRuntime(providerId, cfg) {
         thinkingBudgetTokens: cfg.thinkingBudgetTokens
       });
     default:
-      throw new Error(`[model-runtime] Unknown provider "${providerId}". Check agent.yaml model.provider and <global>/models/*.yaml.`);
+      throw new Error(`[model-runtime] Unknown runtime "${runtime}". Valid runtimes: ${MODEL_RUNTIME_NAMES.join(", ")}.`);
   }
 }
+var MODEL_RUNTIME_NAMES;
 var init_model_runtime = __esm({
   "../server/dist/agents/model-runtime.js"() {
     "use strict";
@@ -10401,17 +10417,31 @@ var init_model_runtime = __esm({
     init_openai_agent();
     init_mantle_agent();
     init_anthropic_agent();
+    init_config();
+    MODEL_RUNTIME_NAMES = [
+      "anthropic-messages",
+      "openai-chat",
+      "bedrock-invoke",
+      "bedrock-mantle",
+      "kimi",
+      "deepseek",
+      "minimax",
+      "qwen",
+      "hunyuan",
+      "doubao",
+      "zhipu"
+    ];
   }
 });
 
 // ../server/dist/tools/workspace-tools.js
 import fs24 from "node:fs/promises";
-import path28 from "node:path";
+import path29 from "node:path";
 import crypto from "node:crypto";
 import { homedir as homedir11 } from "node:os";
 function resolvePath2(filePath, workspaceRoot) {
-  const expanded = filePath.startsWith("~/") ? path28.join(HOME2, filePath.slice(2)) : filePath;
-  return path28.isAbsolute(expanded) ? path28.resolve(expanded) : path28.resolve(workspaceRoot, expanded);
+  const expanded = filePath.startsWith("~/") ? path29.join(HOME2, filePath.slice(2)) : filePath;
+  return path29.isAbsolute(expanded) ? path29.resolve(expanded) : path29.resolve(workspaceRoot, expanded);
 }
 async function* walkDir(dir, signal) {
   if (signal?.aborted)
@@ -10427,7 +10457,7 @@ async function* walkDir(dir, signal) {
       return;
     if (SKIP_DIRS.has(name))
       continue;
-    const fullPath = path28.join(dir, name);
+    const fullPath = path29.join(dir, name);
     let stat;
     try {
       stat = await fs24.lstat(fullPath);
@@ -10435,7 +10465,7 @@ async function* walkDir(dir, signal) {
       continue;
     }
     if (stat.isDirectory()) {
-      if (path28.basename(dir) === ".halo" && SKIP_HALO_SUBDIRS.has(name))
+      if (path29.basename(dir) === ".halo" && SKIP_HALO_SUBDIRS.has(name))
         continue;
       if (process.platform === "win32" && await isReparsePoint(fullPath))
         continue;
@@ -10663,7 +10693,7 @@ function createWorkspaceTools(workspaceRoot, accessLevelOrOpts = "full") {
     callback: async (_input) => {
       const input = _input;
       const fullPath = resolvePath2(input.path, workspaceRoot);
-      const ext = path28.extname(fullPath).toLowerCase();
+      const ext = path29.extname(fullPath).toLowerCase();
       const supportedExts = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp"]);
       if (!supportedExts.has(ext)) {
         return `${TOOL_WARN_MARKER}
@@ -10860,7 +10890,7 @@ Error: old_string appears more than once in ${input.path}. Either expand it with
           const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
           if (entry.isDirectory) {
             results.push(`\u{1F4C1} ${relPath}/`);
-            await walk(path28.join(dir, entry.name), relPath);
+            await walk(path29.join(dir, entry.name), relPath);
           } else {
             results.push(`\u{1F4C4} ${relPath}`);
           }
@@ -10969,7 +10999,7 @@ Error: Invalid regex pattern: ${err.message}`;
       for await (const filePath of files) {
         if (results.length >= maxResults)
           break;
-        if (input.include && !matchInclude(path28.basename(filePath), input.include)) {
+        if (input.include && !matchInclude(path29.basename(filePath), input.include)) {
           continue;
         }
         if (await isBinaryFile(filePath))
@@ -10980,7 +11010,7 @@ Error: Invalid regex pattern: ${err.message}`;
         } catch {
           continue;
         }
-        const relativePath = path28.relative(workspaceRoot, filePath);
+        const relativePath = path29.relative(workspaceRoot, filePath);
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (results.length >= maxResults)
@@ -11025,7 +11055,7 @@ Error: Invalid regex pattern: ${err.message}`;
       for await (const filePath of walkDir(searchDir, signal)) {
         if (results.length >= GLOB_MAX_RESULTS)
           break;
-        const relativePath = path28.relative(workspaceRoot, filePath);
+        const relativePath = path29.relative(workspaceRoot, filePath);
         if (matchGlob(relativePath, input.pattern)) {
           results.push(relativePath);
         }
@@ -11150,7 +11180,7 @@ var init_workspace_tools = __esm({
 
 // ../server/dist/prompts/system-prompts.js
 import fs25 from "node:fs/promises";
-import path29 from "node:path";
+import path30 from "node:path";
 import { homedir as homedir12 } from "node:os";
 async function dirExists(dirPath) {
   try {
@@ -11186,7 +11216,7 @@ async function loadDir(dirPath, fallback) {
   const chunks = [];
   const loaded = [];
   for (const name of mdFiles) {
-    const fullPath = path29.join(dirPath, name);
+    const fullPath = path30.join(dirPath, name);
     try {
       const content = (await fs25.readFile(fullPath, "utf-8")).trim();
       if (content) {
@@ -11203,11 +11233,11 @@ async function loadDir(dirPath, fallback) {
 }
 async function resolvePromptsDir(scope, workspaceRoot) {
   if (workspaceRoot) {
-    const wsDir = path29.join(workspaceRoot, ".halo", "prompts", scope);
+    const wsDir = path30.join(workspaceRoot, ".halo", "prompts", scope);
     if (await dirExists(wsDir))
       return wsDir;
   }
-  return path29.join(GLOBAL_PROMPTS_DIR, scope);
+  return path30.join(GLOBAL_PROMPTS_DIR, scope);
 }
 async function loadSystemPrompts(workspaceRoot) {
   const [bootstrapDir, allDir, rootDir] = await Promise.all([
@@ -11236,12 +11266,12 @@ var GLOBAL_PROMPTS_DIR;
 var init_system_prompts = __esm({
   "../server/dist/prompts/system-prompts.js"() {
     "use strict";
-    GLOBAL_PROMPTS_DIR = path29.join(homedir12(), ".halo", "global", "prompts");
+    GLOBAL_PROMPTS_DIR = path30.join(homedir12(), ".halo", "global", "prompts");
   }
 });
 
 // ../server/dist/agents/session-agent-builder.js
-import path30 from "node:path";
+import path31 from "node:path";
 var SessionAgentBuilder;
 var init_session_agent_builder = __esm({
   "../server/dist/agents/session-agent-builder.js"() {
@@ -11316,7 +11346,7 @@ var init_session_agent_builder = __esm({
        *  (yamlConfig null — read/parse failed, see loadAgentYaml) from "config
        *  genuinely incomplete", so the error is self-diagnosing. */
       validateAgentModelConfig(agentId, yamlConfig) {
-        const yamlPath = path30.join(agentSourceDir(agentId, this.host.workspaceRoot), "agent.yaml");
+        const yamlPath = path31.join(agentSourceDir(agentId, this.host.workspaceRoot), "agent.yaml");
         if (yamlConfig === null) {
           throw new Error(`[SessionManager] Agent "${agentId}": agent.yaml missing or unreadable at ${yamlPath}.`);
         }
@@ -11403,7 +11433,7 @@ var init_session_agent_builder = __esm({
 
 The project workspace is at: ${this.host.workspaceRoot}
 `;
-            if (workingDir && path30.resolve(workingDir) !== path30.resolve(this.host.workspaceRoot)) {
+            if (workingDir && path31.resolve(workingDir) !== path31.resolve(this.host.workspaceRoot)) {
               systemPrompt += `Working directory: ${workingDir}
 `;
             }
@@ -11532,7 +11562,7 @@ ${roster}`;
         const aws = resolveAwsCredentials(providerId, this.host.workspaceRoot);
         const awsCreds = aws.accessKeyId && aws.secretAccessKey ? aws : void 0;
         const apiKey = resolveApiKey(providerId, this.host.workspaceRoot);
-        const agent = createModelRuntime(providerId, {
+        const agent = createModelRuntime(resolveProviderRuntime(providerId), {
           modelId,
           endpoint,
           systemPrompt,
@@ -11587,7 +11617,7 @@ ${roster}`;
           const loaded = systemPrompts.files[scope];
           if (loaded.length > 0) {
             for (const file of loaded) {
-              mdFiles.push({ label: `prompt/${scope}/${path30.basename(file)}`, path: file });
+              mdFiles.push({ label: `prompt/${scope}/${path31.basename(file)}`, path: file });
             }
           } else {
             mdFiles.push({ label: `prompt/${scope} (built-in fallback)`, path: systemPrompts.dirs[scope] });
@@ -11693,7 +11723,7 @@ var init_session_skill_commands = __esm({
 
 // ../server/dist/agents/session-state-store.js
 import fsSync6 from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 var SessionStateStore;
 var init_session_state_store = __esm({
   "../server/dist/agents/session-state-store.js"() {
@@ -11720,7 +11750,7 @@ var init_session_state_store = __esm({
         try {
           const dir = this.sessionDir(session.agentId);
           fsSync6.mkdirSync(dir, { recursive: true });
-          const filePath = path31.join(dir, `${fileSegment(session.id)}.json`);
+          const filePath = path32.join(dir, `${fileSegment(session.id)}.json`);
           let existing = {};
           try {
             existing = JSON.parse(fsSync6.readFileSync(filePath, "utf-8"));
@@ -11749,7 +11779,7 @@ var init_session_state_store = __esm({
       /** Load agent.messages from the delegated log file's rawMessages field */
       loadAgentState(sessionId, agentId) {
         try {
-          const filePath = path31.join(this.sessionDir(agentId), `${fileSegment(sessionId)}.json`);
+          const filePath = path32.join(this.sessionDir(agentId), `${fileSegment(sessionId)}.json`);
           const data = JSON.parse(fsSync6.readFileSync(filePath, "utf-8"));
           return data.rawMessages ?? [];
         } catch {
@@ -11829,7 +11859,7 @@ async function initObservability() {
     return true;
   }
   const { registerSdk: registerSdk2 } = await Promise.resolve().then(() => (init_otel_sdk(), otel_sdk_exports));
-  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.5.6");
+  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.5.7");
   console.log(`[Observability] OTLP export \u2192 ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT} (service.name=${process.env.OTEL_SERVICE_NAME}, capture_content=${config.observability.captureContent})`);
   return true;
 }
@@ -12115,7 +12145,7 @@ var init_genai_spans = __esm({
 
 // ../server/dist/agents/session-manager.js
 import fsSync7 from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 import { eq as eq10, and as and7, isNull as isNull4, isNotNull as isNotNull2 } from "drizzle-orm";
 function simpleHash(str) {
   let h = 0;
@@ -12313,7 +12343,7 @@ var init_session_manager = __esm({
       }
       constructor(workspaceRoot, opts) {
         this.workspaceRoot = workspaceRoot;
-        const haloDir = path32.join(workspaceRoot, ".halo");
+        const haloDir = path33.join(workspaceRoot, ".halo");
         this.db = createDb(haloDir);
         this.uiStore = new SessionUIStore(this);
         this.queryStore = new SessionQueryStore(this);
@@ -12426,9 +12456,9 @@ var init_session_manager = __esm({
        */
       /** @internal */
       async resolveWorkingDir(input) {
-        const resolved = path32.isAbsolute(input) ? path32.resolve(input) : path32.resolve(this.workspaceRoot, input);
-        const wsRoot = path32.resolve(this.workspaceRoot);
-        if (resolved !== wsRoot && !resolved.startsWith(wsRoot + path32.sep)) {
+        const resolved = path33.isAbsolute(input) ? path33.resolve(input) : path33.resolve(this.workspaceRoot, input);
+        const wsRoot = path33.resolve(this.workspaceRoot);
+        if (resolved !== wsRoot && !resolved.startsWith(wsRoot + path33.sep)) {
           throw new Error(`working_dir "${input}" is outside the workspace`);
         }
         try {
@@ -12548,7 +12578,7 @@ var init_session_manager = __esm({
           if (meta.archivedAt)
             throw new Error(`Session ${sessionId} is archived and cannot be resumed`);
           const restoredAccessLevel = meta.accessLevel === "readonly" ? "readonly" : meta.accessLevel === "workspace" ? "workspace" : null;
-          const restoredWorkingDir = meta.workingDir ? path32.resolve(this.workspaceRoot, meta.workingDir) : void 0;
+          const restoredWorkingDir = meta.workingDir ? path33.resolve(this.workspaceRoot, meta.workingDir) : void 0;
           const { agent, yamlConfig: resumedYaml, contextConfig, modelId, systemPrompt, thinkingEffort, meta: agentMeta } = await this.buildAgentInstance(meta.agentId, sessionId, meta.parentId, restoredWorkingDir, restoredAccessLevel);
           const savedMessages = this.loadAgentState(sessionId, meta.agentId);
           if (savedMessages.length > 0) {
@@ -12617,7 +12647,7 @@ var init_session_manager = __esm({
           agentId,
           agentName: resolvedAgentName,
           description,
-          workingDir: workingDir ? path32.relative(this.workspaceRoot, workingDir) : null,
+          workingDir: workingDir ? path33.relative(this.workspaceRoot, workingDir) : null,
           accessLevel,
           createdAt: now,
           updatedAt: now
@@ -12626,7 +12656,7 @@ var init_session_manager = __esm({
           try {
             const dir = this.sessionDir(agentId);
             fsSync7.mkdirSync(dir, { recursive: true });
-            atomicWriteSessionFile(path32.join(dir, `${fileSegment(sessionId)}.json`), JSON.stringify({ id: sessionId, agentId, title, createdAt: new Date(now).toISOString() }));
+            atomicWriteSessionFile(path33.join(dir, `${fileSegment(sessionId)}.json`), JSON.stringify({ id: sessionId, agentId, title, createdAt: new Date(now).toISOString() }));
           } catch (err) {
             console.warn(`[SessionManager] Failed to pre-seed title for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
           }
@@ -12705,7 +12735,7 @@ var init_session_manager = __esm({
         if (row.exchangeCount !== null)
           return row.title || null;
         try {
-          const filePath = path32.join(this.sessionDir(row.agentId), `${fileSegment(sessionId)}.json`);
+          const filePath = path33.join(this.sessionDir(row.agentId), `${fileSegment(sessionId)}.json`);
           const data = JSON.parse(fsSync7.readFileSync(filePath, "utf-8"));
           return data.title || null;
         } catch {
@@ -14195,7 +14225,7 @@ ${result.summary}`, agentName: "user", report: true, taskId });
             live.agent.messages = repaired;
             this.saveAgentState(live);
           } else {
-            const filePath = path32.join(this.sessionDir(info.agentId), `${fileSegment(rootId)}.json`);
+            const filePath = path33.join(this.sessionDir(info.agentId), `${fileSegment(rootId)}.json`);
             let data = {};
             try {
               data = JSON.parse(fsSync7.readFileSync(filePath, "utf-8"));
@@ -14351,7 +14381,7 @@ ${result.summary}`, agentName: "user", report: true, taskId });
           lastActivityAt = session.lastActivityAt;
         } else {
           try {
-            const filePath = path32.join(this.sessionDir(meta.agentId), `${fileSegment(sessionId)}.json`);
+            const filePath = path33.join(this.sessionDir(meta.agentId), `${fileSegment(sessionId)}.json`);
             const data = JSON.parse(fsSync7.readFileSync(filePath, "utf-8"));
             output = typeof data.output === "string" ? data.output : "";
             lastActivityAt = typeof data.lastActivityAt === "string" ? data.lastActivityAt : null;
@@ -14518,7 +14548,7 @@ var init_session_manager_registry = __esm({
 
 // ../server/dist/logger.js
 import fs27 from "node:fs";
-import path33 from "node:path";
+import path34 from "node:path";
 import { homedir as homedir13 } from "node:os";
 import { SeverityNumber } from "@opentelemetry/api-logs";
 function ensureDir() {
@@ -14641,8 +14671,8 @@ var init_logger = __esm({
     init_config();
     init_otel();
     LOG_FILENAME = "server.log";
-    logDir = path33.join(homedir13(), ".halo", "global", "logs");
-    logFile = path33.join(logDir, LOG_FILENAME);
+    logDir = path34.join(homedir13(), ".halo", "global", "logs");
+    logFile = path34.join(logDir, LOG_FILENAME);
     currentSize = -1;
     LEVEL_ORDER = { debug: 0, info: 1, warn: 2, error: 3 };
     OTEL_SEVERITY = {
@@ -14662,17 +14692,18 @@ __export(harness_exports, {
   listAgents: () => listAgents,
   listSessions: () => listSessions
 });
-import path34 from "node:path";
+import path35 from "node:path";
 import fs28 from "node:fs";
 async function initRuntime() {
   console.log = (...args) => process.stderr.write(args.map(String).join(" ") + "\n");
+  refreshTemplatesIfOutdated(HALO_HOME3, "CLI");
   initLogger();
   await initBwrapCheck();
   const { hiddenDirs, hiddenFiles } = resolveSandboxPaths();
   setSandboxHiddenPaths(hiddenDirs, hiddenFiles);
 }
 async function listAgents(workspace) {
-  const absWs = path34.resolve(workspace);
+  const absWs = path35.resolve(workspace);
   ensureWorkspaceHalo(absWs);
   const sm = new SessionManager(absWs);
   const disabledSet = getDisabledSet(sm.getDb(), "agent");
@@ -14680,7 +14711,7 @@ async function listAgents(workspace) {
   return agents.map((a) => ({ id: a.id, description: a.description, scope: a.scope }));
 }
 function listSessions(workspace) {
-  const absWs = path34.resolve(workspace);
+  const absWs = path35.resolve(workspace);
   ensureWorkspaceHalo(absWs);
   const sm = new SessionManager(absWs);
   const { sessions } = sm.listSessions({ limit: 200 });
@@ -14692,7 +14723,7 @@ async function agentSupportsImage(sm, workspace, agentId) {
   return entry ? modelSupportsImage(entry.model) : false;
 }
 async function createHarness(opts) {
-  const initialPath = path34.resolve(opts.workspace);
+  const initialPath = path35.resolve(opts.workspace);
   if (!fs28.existsSync(initialPath)) {
     throw new Error(`Workspace does not exist: ${initialPath}`);
   }
@@ -14864,7 +14895,7 @@ async function createHarness(opts) {
     return Array.from(merged.values()).sort((a, b) => a.slashName.localeCompare(b.slashName));
   }
   async function switchWorkspace(newPath) {
-    const resolved = path34.resolve(newPath);
+    const resolved = path35.resolve(newPath);
     if (resolved === state.workspace) return;
     if (!fs28.existsSync(resolved)) {
       throw new Error(`Workspace does not exist: ${resolved}`);
@@ -14988,7 +15019,7 @@ __export(setup_config_exports, {
   updateConfigLeaves: () => updateConfigLeaves
 });
 import fs29 from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 import { homedir as homedir14 } from "node:os";
 import YAML8 from "yaml";
 function updateConfigLeaves(updates) {
@@ -14999,7 +15030,7 @@ function updateConfigLeaves(updates) {
     parts.push("value");
     doc.setIn(parts, val);
   }
-  fs29.mkdirSync(path35.dirname(CONFIG_PATH), { recursive: true });
+  fs29.mkdirSync(path36.dirname(CONFIG_PATH), { recursive: true });
   fs29.writeFileSync(CONFIG_PATH, doc.toString(), { encoding: "utf-8", mode: 384 });
   try {
     fs29.chmodSync(CONFIG_PATH, 384);
@@ -15023,7 +15054,7 @@ var CONFIG_PATH;
 var init_setup_config = __esm({
   "../server/dist/setup-config.js"() {
     "use strict";
-    CONFIG_PATH = path35.join(homedir14(), ".halo", "secrets", "config.yaml");
+    CONFIG_PATH = path36.join(homedir14(), ".halo", "secrets", "config.yaml");
   }
 });
 
@@ -15036,7 +15067,7 @@ __export(setup_settings_exports, {
   writeSettings: () => writeSettings
 });
 import fs30 from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 import { homedir as homedir15 } from "node:os";
 import YAML9 from "yaml";
 function loadDoc() {
@@ -15048,7 +15079,7 @@ function loadDoc() {
   return YAML9.parseDocument(raw);
 }
 function saveDoc(doc) {
-  fs30.mkdirSync(path36.dirname(SETTINGS_PATH2), { recursive: true });
+  fs30.mkdirSync(path37.dirname(SETTINGS_PATH2), { recursive: true });
   fs30.writeFileSync(SETTINGS_PATH2, doc.toString({ lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
   try {
     fs30.chmodSync(SETTINGS_PATH2, 384);
@@ -15108,7 +15139,7 @@ var SETTINGS_PATH2;
 var init_setup_settings = __esm({
   "../server/dist/setup-settings.js"() {
     "use strict";
-    SETTINGS_PATH2 = path36.join(homedir15(), ".halo", "secrets", "settings.yaml");
+    SETTINGS_PATH2 = path37.join(homedir15(), ".halo", "secrets", "settings.yaml");
   }
 });
 
@@ -15125,7 +15156,7 @@ __export(setup_providers_exports, {
   readDefaultAgentProvider: () => readDefaultAgentProvider
 });
 import fs31 from "node:fs";
-import path37 from "node:path";
+import path38 from "node:path";
 import { homedir as homedir16 } from "node:os";
 import YAML10 from "yaml";
 function readYamlFile2(filePath) {
@@ -15155,14 +15186,14 @@ function parseFields(raw) {
   })).filter((f) => f.key.length > 0);
 }
 function listModelProviders() {
-  const dir = path37.join(TEMPLATES_DIR, "models");
+  const dir = path38.join(TEMPLATES_DIR, "models");
   if (!fs31.existsSync(dir))
     return [];
   const out = [];
   for (const f of fs31.readdirSync(dir)) {
     if (!f.endsWith(".yaml"))
       continue;
-    const data = readYamlFile2(path37.join(dir, f));
+    const data = readYamlFile2(path38.join(dir, f));
     if (!data || typeof data !== "object")
       continue;
     const id = typeof data.id === "string" ? data.id : f.replace(/\.yaml$/, "");
@@ -15177,15 +15208,15 @@ function listModelProviders() {
   return out.sort((a, b) => a.id.localeCompare(b.id));
 }
 function listOptionalSkills() {
-  const dir = path37.join(TEMPLATES_DIR, "optional-skills");
+  const dir = path38.join(TEMPLATES_DIR, "optional-skills");
   if (!fs31.existsSync(dir))
     return [];
   const out = [];
   for (const id of fs31.readdirSync(dir)) {
-    const skillDir = path37.join(dir, id);
+    const skillDir = path38.join(dir, id);
     if (!fs31.statSync(skillDir).isDirectory())
       continue;
-    const skillMd = path37.join(skillDir, "SKILL.md");
+    const skillMd = path38.join(skillDir, "SKILL.md");
     if (!fs31.existsSync(skillMd))
       continue;
     const text6 = fs31.readFileSync(skillMd, "utf-8");
@@ -15204,7 +15235,7 @@ function listOptionalSkills() {
       } catch {
       }
     }
-    const cfg = readYamlFile2(path37.join(skillDir, "config.yaml"));
+    const cfg = readYamlFile2(path38.join(skillDir, "config.yaml"));
     out.push({
       id,
       name,
@@ -15226,7 +15257,7 @@ function listConfiguredSwitchableProviders() {
   });
 }
 function readDefaultAgentProvider() {
-  const data = readYamlFile2(path37.join(GLOBAL_AGENTS_DIR3, "default", "agent.yaml"));
+  const data = readYamlFile2(path38.join(GLOBAL_AGENTS_DIR3, "default", "agent.yaml"));
   const provider = data?.model && typeof data.model === "object" ? data.model.provider : void 0;
   return typeof provider === "string" && provider.length > 0 ? provider : void 0;
 }
@@ -15256,7 +15287,7 @@ function modelBlockFromProvider(providerId, data) {
   return block;
 }
 function buildTemplateModelBlock(providerId) {
-  const data = readYamlFile2(path37.join(TEMPLATES_DIR, "models", `${providerId}.yaml`));
+  const data = readYamlFile2(path38.join(TEMPLATES_DIR, "models", `${providerId}.yaml`));
   if (!data || typeof data !== "object")
     return null;
   return modelBlockFromProvider(providerId, data);
@@ -15267,7 +15298,7 @@ function bindBuiltinAgentsToProvider(providerId) {
     return null;
   const agents = [];
   for (const id of REBIND_BUILTIN_AGENT_IDS) {
-    const yamlPath = path37.join(GLOBAL_AGENTS_DIR3, id, "agent.yaml");
+    const yamlPath = path38.join(GLOBAL_AGENTS_DIR3, id, "agent.yaml");
     if (!fs31.existsSync(yamlPath))
       continue;
     try {
@@ -15281,22 +15312,22 @@ function bindBuiltinAgentsToProvider(providerId) {
   return { modelId: typeof block.id === "string" ? block.id : void 0, agents };
 }
 function listRequiredSkillsWithSecrets() {
-  const dir = path37.join(TEMPLATES_DIR, "skills");
+  const dir = path38.join(TEMPLATES_DIR, "skills");
   if (!fs31.existsSync(dir))
     return [];
   const out = [];
   for (const id of fs31.readdirSync(dir)) {
-    const skillDir = path37.join(dir, id);
+    const skillDir = path38.join(dir, id);
     if (!fs31.statSync(skillDir).isDirectory())
       continue;
-    const cfgPath = path37.join(skillDir, "config.yaml");
+    const cfgPath = path38.join(skillDir, "config.yaml");
     if (!fs31.existsSync(cfgPath))
       continue;
     const cfg = readYamlFile2(cfgPath);
     const fields = parseFields(cfg?.params).filter((f) => f.secret);
     if (fields.length === 0)
       continue;
-    const skillMd = path37.join(skillDir, "SKILL.md");
+    const skillMd = path38.join(skillDir, "SKILL.md");
     let name = id;
     let description = "";
     if (fs31.existsSync(skillMd)) {
@@ -15327,7 +15358,7 @@ var init_setup_providers = __esm({
     init_setup_settings();
     AWS_CREDENTIAL_CHAIN_PROVIDER = "aws-bedrock-claude-invoke";
     REBIND_BUILTIN_AGENT_IDS = ["default", "executor", "deep-executor"];
-    GLOBAL_AGENTS_DIR3 = path37.join(homedir16(), ".halo", "global", "agents");
+    GLOBAL_AGENTS_DIR3 = path38.join(homedir16(), ".halo", "global", "agents");
   }
 });
 
@@ -15645,13 +15676,13 @@ __export(upgrade_verify_exports, {
   NATIVE_MODULE_SMOKES: () => NATIVE_MODULE_SMOKES,
   verifyNativeModules: () => verifyNativeModules
 });
-import path38 from "node:path";
+import path39 from "node:path";
 import fs32 from "node:fs";
 import { spawnSync } from "node:child_process";
 function verifyNativeModules(pkgRoot) {
   const broken = [];
   for (const { name, smoke } of NATIVE_MODULE_SMOKES) {
-    const modDir = path38.join(pkgRoot, "node_modules", name);
+    const modDir = path39.join(pkgRoot, "node_modules", name);
     if (!fs32.existsSync(modDir)) {
       broken.push(name);
       continue;
@@ -15690,7 +15721,7 @@ var init_render_md = __esm({
 
 // src/resolve-refs.ts
 import fs33 from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 function resolveRefs(input, workspace) {
   const images = [];
   const attachments = [];
@@ -15703,8 +15734,8 @@ function resolveRefs(input, workspace) {
     lastIdx = match.index + match[0].length;
     const kind = match[1];
     const rawPath = match[2] ?? match[3];
-    const resolved = path39.isAbsolute(rawPath) ? rawPath : path39.resolve(workspace, rawPath);
-    const ext = path39.extname(resolved).toLowerCase();
+    const resolved = path40.isAbsolute(rawPath) ? rawPath : path40.resolve(workspace, rawPath);
+    const ext = path40.extname(resolved).toLowerCase();
     let stat = null;
     try {
       stat = fs33.statSync(resolved);
@@ -15728,7 +15759,7 @@ function resolveRefs(input, workspace) {
         const data = fs33.readFileSync(resolved).toString("base64");
         images.push({ data, mimeType: imageMimeFromExt(ext) ?? "application/octet-stream" });
       } else {
-        const relPath = path39.relative(workspace, resolved);
+        const relPath = path40.relative(workspace, resolved);
         if (stat.size > MAX_FILE_BYTES) {
           const buf = Buffer.alloc(MAX_FILE_BYTES);
           const fd = fs33.openSync(resolved, "r");
@@ -16020,7 +16051,7 @@ var init_streaming = __esm({
 
 // src/tui/history.ts
 import fs34 from "node:fs";
-import path40 from "node:path";
+import path41 from "node:path";
 import os2 from "node:os";
 function loadHistory() {
   try {
@@ -16037,7 +16068,7 @@ function appendHistory(entry) {
     const arr = loadHistory();
     if (arr[arr.length - 1] === entry) return;
     arr.push(entry);
-    fs34.mkdirSync(path40.dirname(HISTORY_FILE), { recursive: true });
+    fs34.mkdirSync(path41.dirname(HISTORY_FILE), { recursive: true });
     fs34.writeFileSync(HISTORY_FILE, JSON.stringify(arr.slice(-MAX_ENTRIES)));
   } catch {
   }
@@ -16046,7 +16077,7 @@ var HISTORY_FILE, MAX_ENTRIES;
 var init_history = __esm({
   "src/tui/history.ts"() {
     "use strict";
-    HISTORY_FILE = path40.join(os2.homedir(), ".halo", "global", "tui-history.json");
+    HISTORY_FILE = path41.join(os2.homedir(), ".halo", "global", "tui-history.json");
     MAX_ENTRIES = 100;
   }
 });
@@ -16151,7 +16182,7 @@ var init_path_suggest = __esm({
 
 // src/tui/path-suggest-engine.ts
 import fs35 from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 function detectActiveRef(value) {
   const reExplicit = /@(file|image|scope)\s+(?:"([^"]*)|(\S*))$/;
   const mExplicit = value.match(reExplicit);
@@ -16180,13 +16211,13 @@ function resolveDirAndPrefix(partial, workspace) {
   if (partial === "") {
     return { absDir: workspace, displayDir: ".", prefix: "" };
   }
-  const absBase = path41.isAbsolute(partial) ? partial : path41.join(workspace, partial);
+  const absBase = path42.isAbsolute(partial) ? partial : path42.join(workspace, partial);
   if (partial.endsWith("/")) {
     return { absDir: absBase, displayDir: partial.replace(/\/$/, "") || "/", prefix: "" };
   }
-  const dirAbs = path41.dirname(absBase);
-  const prefix = path41.basename(absBase);
-  const dirRel = path41.dirname(partial);
+  const dirAbs = path42.dirname(absBase);
+  const prefix = path42.basename(absBase);
+  const dirRel = path42.dirname(partial);
   return { absDir: dirAbs, displayDir: dirRel === "." ? "." : dirRel, prefix };
 }
 function scanCandidates(partial, workspace, kind) {
@@ -16202,17 +16233,17 @@ function scanCandidates(partial, workspace, kind) {
     if (e.name.startsWith(".")) continue;
     if (prefix && !e.name.toLowerCase().startsWith(prefix.toLowerCase())) continue;
     const isDir = e.isDirectory();
-    const ext = path41.extname(e.name).toLowerCase();
+    const ext = path42.extname(e.name).toLowerCase();
     const isImage = IMAGE_EXTS.has(ext);
     if (kind === "image" && !isDir && !isImage) continue;
     if (kind === "scope" && !isDir) continue;
     let insertPath;
-    if (path41.isAbsolute(partial)) {
-      insertPath = path41.join(absDir, e.name);
+    if (path42.isAbsolute(partial)) {
+      insertPath = path42.join(absDir, e.name);
     } else if (partial.endsWith("/") || partial === "") {
       insertPath = partial + e.name;
     } else {
-      const dirRel = path41.dirname(partial);
+      const dirRel = path42.dirname(partial);
       insertPath = (dirRel === "." ? "" : dirRel + "/") + e.name;
     }
     items.push({ name: e.name, insertPath, isDir, isImage });
@@ -16231,8 +16262,8 @@ function applyPathPick(value, ref, pick) {
   const before = value.slice(0, markerStart);
   const kind = ref.kind === "scope" ? "scope" : ref.kind === "image" ? "image" : pick.isImage ? "image" : "file";
   const needsQuote = pick.insertPath.includes(" ");
-  const path73 = pick.isDir ? needsQuote ? `"${pick.insertPath}/` : `${pick.insertPath}/` : needsQuote ? `"${pick.insertPath}" ` : `${pick.insertPath} `;
-  return `${before}@${kind} ${path73}`;
+  const path74 = pick.isDir ? needsQuote ? `"${pick.insertPath}/` : `${pick.insertPath}/` : needsQuote ? `"${pick.insertPath}" ` : `${pick.insertPath} `;
+  return `${before}@${kind} ${path74}`;
 }
 var init_path_suggest_engine = __esm({
   "src/tui/path-suggest-engine.ts"() {
@@ -17713,15 +17744,15 @@ var init_cli = __esm({
 });
 
 // ../server/dist/channels/shared/media.js
-import path42 from "node:path";
+import path43 from "node:path";
 import os3 from "node:os";
 function tempDir() {
-  return path42.resolve(os3.tmpdir());
+  return path43.resolve(os3.tmpdir());
 }
 function isInTempDir(filePath) {
-  const resolved = path42.resolve(filePath);
+  const resolved = path43.resolve(filePath);
   const tmp = tempDir();
-  return resolved === tmp || resolved.startsWith(tmp + path42.sep);
+  return resolved === tmp || resolved.startsWith(tmp + path43.sep);
 }
 function extractMediaPaths(text6) {
   const mediaPaths = [];
@@ -17739,9 +17770,9 @@ function extractMediaMessage(text6) {
 function isMediaPathAllowed(filePath, workspacePath, accessLevel) {
   if (accessLevel === "full")
     return true;
-  const resolved = path42.resolve(filePath);
-  const ws = path42.resolve(workspacePath);
-  return resolved === ws || resolved.startsWith(ws + path42.sep) || isInTempDir(resolved);
+  const resolved = path43.resolve(filePath);
+  const ws = path43.resolve(workspacePath);
+  return resolved === ws || resolved.startsWith(ws + path43.sep) || isInTempDir(resolved);
 }
 function assertMediaPathAllowed(filePath, account) {
   if (!isMediaPathAllowed(filePath, account.workspacePath, account.accessLevel)) {
@@ -17756,12 +17787,12 @@ async function sendMediaOrReport(opts) {
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
     console.log(`[${opts.logTag}] sendMedia ${filePath} failed: ${error}`);
-    await opts.reply(t("handler.upload_failed", getLang(account), { name: path42.basename(filePath), error })).catch(() => {
+    await opts.reply(t("handler.upload_failed", getLang(account), { name: path43.basename(filePath), error })).catch(() => {
     });
   }
 }
 function classifyMedia(filePath) {
-  const ext = path42.extname(filePath).toLowerCase();
+  const ext = path43.extname(filePath).toLowerCase();
   if (IMAGE_EXTS.has(ext))
     return "image";
   if (VIDEO_EXTS.has(ext))
@@ -17785,9 +17816,9 @@ var init_media = __esm({
 // ../server/dist/routes/workspace-path.js
 import fs36 from "node:fs/promises";
 import { existsSync as existsSync2, realpathSync as realpathSync3 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 async function resolveProjectPath(projectId) {
-  if (path43.isAbsolute(projectId)) {
+  if (path44.isAbsolute(projectId)) {
     try {
       await fs36.access(projectId);
       return projectId;
@@ -17798,13 +17829,13 @@ async function resolveProjectPath(projectId) {
   return null;
 }
 function realpathBounded2(filePath) {
-  let prefix = path43.resolve(filePath);
+  let prefix = path44.resolve(filePath);
   const tail = [];
   while (!existsSync2(prefix)) {
-    const parent = path43.dirname(prefix);
+    const parent = path44.dirname(prefix);
     if (parent === prefix)
       break;
-    tail.unshift(path43.basename(prefix));
+    tail.unshift(path44.basename(prefix));
     prefix = parent;
   }
   let realPrefix;
@@ -17813,12 +17844,12 @@ function realpathBounded2(filePath) {
   } catch {
     realPrefix = prefix;
   }
-  return tail.length > 0 ? path43.join(realPrefix, ...tail) : realPrefix;
+  return tail.length > 0 ? path44.join(realPrefix, ...tail) : realPrefix;
 }
 function validatePath(filePath, projectPath) {
-  const resolved = realpathBounded2(path43.resolve(projectPath, filePath));
+  const resolved = realpathBounded2(path44.resolve(projectPath, filePath));
   const proj = realpathBounded2(projectPath);
-  return resolved === proj || resolved.startsWith(proj + path43.sep);
+  return resolved === proj || resolved.startsWith(proj + path44.sep);
 }
 function isSafeIdSegment(id) {
   if (id === "." || id === "..")
@@ -17836,7 +17867,7 @@ import { Hono } from "hono";
 import fs37 from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { Readable } from "node:stream";
-import path44 from "node:path";
+import path45 from "node:path";
 import { homedir as homedir17 } from "node:os";
 async function resolveProjectFile(projectId, filePath) {
   const projectPath = await resolveProjectPath(projectId);
@@ -17844,7 +17875,7 @@ async function resolveProjectFile(projectId, filePath) {
     return { error: "Project not found", status: 404 };
   if (!validatePath(filePath, projectPath))
     return { error: "Path traversal not allowed", status: 403 };
-  return { projectPath, absolutePath: path44.resolve(projectPath, filePath) };
+  return { projectPath, absolutePath: path45.resolve(projectPath, filePath) };
 }
 function createFileRoutes() {
   const app2 = new Hono();
@@ -17889,8 +17920,8 @@ function createFileRoutes() {
     for (const entry of sorted) {
       if (isSkippedName(entry.name))
         continue;
-      const fullPath = path44.join(dirPath, entry.name);
-      const relativePath = path44.relative(basePath, fullPath).split(path44.sep).join("/");
+      const fullPath = path45.join(dirPath, entry.name);
+      const relativePath = path45.relative(basePath, fullPath).split(path45.sep).join("/");
       if (entry.isDirectory()) {
         nodes.push({
           name: entry.name,
@@ -17922,7 +17953,7 @@ function createFileRoutes() {
       if (relPath && !validatePath(relPath, projectPath)) {
         return c.json({ error: "Path traversal not allowed" }, 403);
       }
-      const targetPath = relPath ? path44.resolve(projectPath, relPath) : projectPath;
+      const targetPath = relPath ? path45.resolve(projectPath, relPath) : projectPath;
       try {
         const stat = await fs37.stat(targetPath);
         if (!stat.isDirectory()) {
@@ -17934,7 +17965,7 @@ function createFileRoutes() {
       const tree = await listDir(targetPath, projectPath);
       return c.json({
         projectId,
-        root: path44.basename(projectPath),
+        root: path45.basename(projectPath),
         path: relPath,
         tree
       });
@@ -17977,11 +18008,11 @@ function createFileRoutes() {
           if (isSkippedName(entry.name))
             continue;
           scanned++;
-          const fullPath = path44.join(dirPath, entry.name);
+          const fullPath = path45.join(dirPath, entry.name);
           if (entry.isDirectory()) {
             if (dirsOnly) {
               const name = entry.name.toLowerCase();
-              const rel = path44.relative(projectRoot, fullPath);
+              const rel = path45.relative(projectRoot, fullPath);
               if (!q || name.includes(q) || rel.toLowerCase().includes(q)) {
                 matches.push({ name: entry.name, path: rel });
               }
@@ -17989,7 +18020,7 @@ function createFileRoutes() {
             await walk(fullPath);
           } else if (entry.isFile() && !dirsOnly) {
             const name = entry.name.toLowerCase();
-            const rel = path44.relative(projectRoot, fullPath);
+            const rel = path45.relative(projectRoot, fullPath);
             if (!q || name.includes(q) || rel.toLowerCase().includes(q)) {
               matches.push({ name: entry.name, path: rel });
             }
@@ -18033,12 +18064,12 @@ function createFileRoutes() {
       }
       const uploaded = [];
       for (const file of files) {
-        const relPath = targetDir ? path44.join(targetDir, file.name) : file.name;
+        const relPath = targetDir ? path45.join(targetDir, file.name) : file.name;
         if (!validatePath(relPath, projectPath)) {
           continue;
         }
-        const destPath = path44.resolve(projectPath, relPath);
-        const destDir = path44.dirname(destPath);
+        const destPath = path45.resolve(projectPath, relPath);
+        const destDir = path45.dirname(destPath);
         await fs37.mkdir(destDir, { recursive: true });
         const buffer = Buffer.from(await file.arrayBuffer());
         await fs37.writeFile(destPath, buffer);
@@ -18124,7 +18155,7 @@ function createFileRoutes() {
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
       const { absolutePath } = resolved;
-      await fs37.mkdir(path44.dirname(absolutePath), { recursive: true });
+      await fs37.mkdir(path45.dirname(absolutePath), { recursive: true });
       try {
         await fs37.access(absolutePath);
         return c.json({ error: "File already exists" }, 409);
@@ -18170,9 +18201,9 @@ function createFileRoutes() {
       if (!validatePath(oldPath, projectPath) || !validatePath(newPath, projectPath)) {
         return c.json({ error: "Path traversal not allowed" }, 403);
       }
-      const absOld = path44.resolve(projectPath, oldPath);
-      const absNew = path44.resolve(projectPath, newPath);
-      await fs37.mkdir(path44.dirname(absNew), { recursive: true });
+      const absOld = path45.resolve(projectPath, oldPath);
+      const absNew = path45.resolve(projectPath, newPath);
+      await fs37.mkdir(path45.dirname(absNew), { recursive: true });
       await fs37.rename(absOld, absNew);
       return c.json({ ok: true, oldPath, newPath });
     } catch (err) {
@@ -18192,7 +18223,7 @@ function createFileRoutes() {
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
       const { projectPath, absolutePath } = resolved;
-      if (absolutePath === path44.resolve(projectPath)) {
+      if (absolutePath === path45.resolve(projectPath)) {
         return c.json({ error: "Cannot delete project root" }, 403);
       }
       await fs37.rm(absolutePath, { recursive: true, force: true });
@@ -18230,16 +18261,16 @@ function createFileRoutes() {
       if (!projectPath) {
         return c.json({ error: "Project not found" }, 404);
       }
-      const isTmp = path44.isAbsolute(filePath) && isInTempDir(filePath);
+      const isTmp = path45.isAbsolute(filePath) && isInTempDir(filePath);
       if (!isTmp && !validatePath(filePath, projectPath)) {
         return c.json({ error: "Path traversal not allowed" }, 403);
       }
-      const absolutePath = isTmp ? path44.resolve(filePath) : path44.resolve(projectPath, filePath);
+      const absolutePath = isTmp ? path45.resolve(filePath) : path45.resolve(projectPath, filePath);
       const stat = await fs37.stat(absolutePath);
       if (stat.isDirectory()) {
         return c.json({ error: "Cannot download a directory" }, 400);
       }
-      const fileName = path44.basename(filePath);
+      const fileName = path45.basename(filePath);
       const ext = fileName.split(".").pop()?.toLowerCase() ?? "";
       const mime = inline ? imageMimeFromExt(ext) ?? MIME_MAP[ext] ?? "application/octet-stream" : "application/octet-stream";
       const disposition = inline ? `inline; filename="${encodeURIComponent(fileName)}"` : `attachment; filename="${encodeURIComponent(fileName)}"`;
@@ -18351,7 +18382,7 @@ function createFileRoutes() {
     const body = await c.req.json();
     if (!body.path)
       return c.json({ error: "path required" }, 400);
-    const resolved = path44.resolve(body.path);
+    const resolved = path45.resolve(body.path);
     let stat;
     try {
       stat = await fs37.stat(resolved);
@@ -18360,7 +18391,7 @@ function createFileRoutes() {
     }
     if (!stat.isDirectory())
       return c.json({ error: "not a directory" }, 400);
-    if (resolved === path44.parse(resolved).root) {
+    if (resolved === path45.parse(resolved).root) {
       return c.json({ error: "filesystem root cannot be a workspace" }, 400);
     }
     const { ensureWorkspaceHalo: ensureWorkspaceHalo2 } = await Promise.resolve().then(() => (init_init(), init_exports));
@@ -18369,7 +18400,7 @@ function createFileRoutes() {
   });
   app2.get("/fs/exists", async (c) => {
     const target = c.req.query("path");
-    if (!target || !path44.isAbsolute(target))
+    if (!target || !path45.isAbsolute(target))
       return c.json({ exists: false, reason: "absolute path required" });
     try {
       const stat = await fs37.stat(target);
@@ -18380,13 +18411,13 @@ function createFileRoutes() {
   });
   app2.get("/fs/browse", async (c) => {
     const target = c.req.query("path") ?? homedir17();
-    if (!path44.isAbsolute(target))
+    if (!path45.isAbsolute(target))
       return c.json({ error: "absolute path required" }, 400);
     try {
-      const resolved = path44.resolve(target);
+      const resolved = path45.resolve(target);
       const entries = await fs37.readdir(resolved, { withFileTypes: true });
-      const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: path44.join(resolved, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
-      return c.json({ path: resolved, parent: path44.dirname(resolved), entries: dirs });
+      const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: path45.join(resolved, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      return c.json({ path: resolved, parent: path45.dirname(resolved), entries: dirs });
     } catch (err) {
       return c.json({ error: err.message }, 404);
     }
@@ -18406,7 +18437,7 @@ var init_files = __esm({
 import { Hono as Hono2 } from "hono";
 import fs38 from "node:fs/promises";
 import { createReadStream as createReadStream2 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 import Database5 from "better-sqlite3";
 import { asyncBufferFromFile, parquetMetadataAsync, parquetSchema, parquetReadObjects } from "hyparquet";
 import { compressors } from "hyparquet-compressors";
@@ -18521,7 +18552,7 @@ function createDataPreviewRoutes() {
       return { error: "Project not found", status: 404 };
     if (!validatePath(filePath, projectPath))
       return { error: "Path traversal not allowed", status: 403 };
-    const absolutePath = path45.resolve(projectPath, filePath);
+    const absolutePath = path46.resolve(projectPath, filePath);
     try {
       const stat = await fs38.stat(absolutePath);
       if (stat.isDirectory())
@@ -18730,7 +18761,7 @@ var init_data_preview = __esm({
 
 // ../server/dist/git-credentials.js
 import fs39 from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 import { homedir as homedir18 } from "node:os";
 function writeGitCredentialsFile(host, username, token) {
   const line = `https://${encodeURIComponent(username)}:${encodeURIComponent(token)}@${host}`;
@@ -18796,14 +18827,14 @@ var GIT_CREDENTIALS_PATH;
 var init_git_credentials = __esm({
   "../server/dist/git-credentials.js"() {
     "use strict";
-    GIT_CREDENTIALS_PATH = path46.join(homedir18(), ".git-credentials");
+    GIT_CREDENTIALS_PATH = path47.join(homedir18(), ".git-credentials");
   }
 });
 
 // ../server/dist/git-ssh.js
 import fs40 from "node:fs";
 import os4 from "node:os";
-import path47 from "node:path";
+import path48 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function looksLikePrivateKey(name, abs) {
   if (name.endsWith(".pub"))
@@ -18838,7 +18869,7 @@ function listSshKeys() {
   }
   const keys = [];
   for (const name of entries) {
-    const abs = path47.join(SSH_DIR, name);
+    const abs = path48.join(SSH_DIR, name);
     try {
       if (!fs40.statSync(abs).isFile())
         continue;
@@ -18865,8 +18896,8 @@ function unlockSshKey(keyPath, passphrase) {
     return { ok: false, error: "ssh-agent is not running" };
   let dir = "";
   try {
-    dir = fs40.mkdtempSync(path47.join(os4.tmpdir(), "halo-askpass-"));
-    const askpass = path47.join(dir, "askpass.sh");
+    dir = fs40.mkdtempSync(path48.join(os4.tmpdir(), "halo-askpass-"));
+    const askpass = path48.join(dir, "askpass.sh");
     fs40.writeFileSync(askpass, ASKPASS_SCRIPT, { mode: 448 });
     const r = spawnSync2("ssh-add", [keyPath], {
       encoding: "utf-8",
@@ -18883,10 +18914,10 @@ function unlockSshKey(keyPath, passphrase) {
       }
     });
     if (r.status === 0) {
-      console.log(`[GitSsh] unlocked key ${path47.basename(keyPath)}`);
+      console.log(`[GitSsh] unlocked key ${path48.basename(keyPath)}`);
       return { ok: true };
     }
-    console.log(`[GitSsh] unlock failed for ${path47.basename(keyPath)} (exit ${r.status ?? "killed"})`);
+    console.log(`[GitSsh] unlock failed for ${path48.basename(keyPath)} (exit ${r.status ?? "killed"})`);
     if (r.status === 2)
       return { ok: false, error: "ssh-agent is not reachable" };
     return { ok: false, error: "Incorrect passphrase, or the key could not be unlocked" };
@@ -18979,7 +19010,7 @@ var SSH_DIR, NON_KEY_NAMES, ownedAgentPid, ASKPASS_SCRIPT;
 var init_git_ssh = __esm({
   "../server/dist/git-ssh.js"() {
     "use strict";
-    SSH_DIR = path47.join(os4.homedir(), ".ssh");
+    SSH_DIR = path48.join(os4.homedir(), ".ssh");
     NON_KEY_NAMES = /* @__PURE__ */ new Set(["known_hosts", "known_hosts2", "authorized_keys", "config"]);
     ownedAgentPid = null;
     ASKPASS_SCRIPT = `#!/bin/sh
@@ -18993,7 +19024,7 @@ printf '%s\\n' "$HALO_SSH_PASSPHRASE"
 // ../server/dist/routes/git.js
 import { Hono as Hono3 } from "hono";
 import os5 from "node:os";
-import path48 from "node:path";
+import path49 from "node:path";
 function notifyGitChanged(workspacePath) {
   broadcastToWorkspace(workspacePath, { type: "file:changed", path: ".git", action: "change" });
 }
@@ -19296,9 +19327,9 @@ function createGitRoutes() {
       if (!keyPath || typeof passphrase !== "string") {
         return c.json({ error: "keyPath and passphrase are required" }, 400);
       }
-      const sshDir = path48.join(os5.homedir(), ".ssh");
-      const resolved = path48.resolve(keyPath);
-      if (path48.dirname(resolved) !== path48.resolve(sshDir)) {
+      const sshDir = path49.join(os5.homedir(), ".ssh");
+      const resolved = path49.resolve(keyPath);
+      if (path49.dirname(resolved) !== path49.resolve(sshDir)) {
         return c.json({ error: "keyPath must be inside ~/.ssh" }, 400);
       }
       return c.json(unlockSshKey(resolved, passphrase));
@@ -19375,7 +19406,7 @@ var init_mtime_cache = __esm({
 // ../server/dist/routes/agent-configs.js
 import { Hono as Hono4 } from "hono";
 import fs41 from "node:fs/promises";
-import path49 from "node:path";
+import path50 from "node:path";
 import { homedir as homedir19 } from "node:os";
 import YAML11 from "yaml";
 function getAvailableTools() {
@@ -19434,9 +19465,9 @@ function registryModelBlock() {
   return modelBlockFromProvider(provider.id, provider);
 }
 async function scaffoldModelBlock(scope, projectId) {
-  const candidates = [path49.join(GLOBAL_AGENTS_DIR4, "default", "agent.yaml")];
+  const candidates = [path50.join(GLOBAL_AGENTS_DIR4, "default", "agent.yaml")];
   if (scope === "workspace" && projectId)
-    candidates.unshift(path49.join(projectId, ".halo", "agents", "default", "agent.yaml"));
+    candidates.unshift(path50.join(projectId, ".halo", "agents", "default", "agent.yaml"));
   for (const yamlPath of candidates) {
     let content;
     try {
@@ -19490,10 +19521,10 @@ async function ensureDir2(dir) {
 }
 function resolveAgentDir(id, scope, projectId) {
   if (scope === "global")
-    return { agentDir: path49.join(GLOBAL_AGENTS_DIR4, id) };
+    return { agentDir: path50.join(GLOBAL_AGENTS_DIR4, id) };
   if (scope !== "workspace")
     return { error: "Invalid scope" };
-  return projectId ? { agentDir: path49.join(projectId, ".halo", "agents", id) } : { error: "projectId required for workspace agents" };
+  return projectId ? { agentDir: path50.join(projectId, ".halo", "agents", id) } : { error: "projectId required for workspace agents" };
 }
 async function scanAgentsDir(dir, scope) {
   const agents = [];
@@ -19504,7 +19535,7 @@ async function scanAgentsDir(dir, scope) {
     return agents;
   }
   for (const entryName of names) {
-    const agentDir = path49.join(dir, entryName);
+    const agentDir = path50.join(dir, entryName);
     try {
       const stat = await fs41.stat(agentDir);
       if (!stat.isDirectory())
@@ -19512,7 +19543,7 @@ async function scanAgentsDir(dir, scope) {
     } catch {
       continue;
     }
-    const yamlPath = path49.join(agentDir, "agent.yaml");
+    const yamlPath = path50.join(agentDir, "agent.yaml");
     try {
       const yamlStat = await fs41.stat(yamlPath);
       const parsed = _yamlCache.get(yamlPath, yamlStat.mtimeMs) ?? _yamlCache.set(yamlPath, yamlStat.mtimeMs, parseAgentYaml(await fs41.readFile(yamlPath, "utf-8")));
@@ -19536,8 +19567,8 @@ async function scanAgentsDir(dir, scope) {
   return agents;
 }
 async function ensureDefaultAgent(dir) {
-  const defaultDir = path49.join(dir, "default");
-  const yamlPath = path49.join(defaultDir, "agent.yaml");
+  const defaultDir = path50.join(dir, "default");
+  const yamlPath = path50.join(defaultDir, "agent.yaml");
   try {
     await fs41.access(yamlPath);
   } catch {
@@ -19560,7 +19591,7 @@ function createAgentConfigRoutes() {
     const projectId = c.req.query("projectId");
     let workspaceAgents = [];
     if (projectId) {
-      const wsAgentsDir = path49.join(projectId, ".halo", "agents");
+      const wsAgentsDir = path50.join(projectId, ".halo", "agents");
       workspaceAgents = await scanAgentsDir(wsAgentsDir, "workspace");
     }
     const wsIds = new Set(workspaceAgents.map((a) => a.id));
@@ -19594,11 +19625,11 @@ function createAgentConfigRoutes() {
     if (scope === "workspace") {
       if (!body.projectId)
         return c.json({ error: "projectId required for workspace agents" }, 400);
-      baseDir = path49.join(body.projectId, ".halo", "agents");
+      baseDir = path50.join(body.projectId, ".halo", "agents");
     } else {
       baseDir = GLOBAL_AGENTS_DIR4;
     }
-    const agentDir = path49.join(baseDir, id);
+    const agentDir = path50.join(baseDir, id);
     try {
       await fs41.access(agentDir);
       return c.json({ error: "Agent already exists" }, 409);
@@ -19607,21 +19638,21 @@ function createAgentConfigRoutes() {
     let conflictScope = null;
     if (scope === "workspace") {
       try {
-        await fs41.access(path49.join(GLOBAL_AGENTS_DIR4, id));
+        await fs41.access(path50.join(GLOBAL_AGENTS_DIR4, id));
         conflictScope = "global";
       } catch {
       }
     } else if (body.projectId) {
       try {
-        await fs41.access(path49.join(body.projectId, ".halo", "agents", id));
+        await fs41.access(path50.join(body.projectId, ".halo", "agents", id));
         conflictScope = "workspace";
       } catch {
       }
     }
     const scaffoldModel = await scaffoldModelBlock(scope, body.projectId);
     await ensureDir2(agentDir);
-    await fs41.writeFile(path49.join(agentDir, "agent.yaml"), defaultAgentYaml(body.name, body.description ?? "", scaffoldModel), "utf-8");
-    await fs41.writeFile(path49.join(agentDir, "AGENT.md"), `# ${body.name}
+    await fs41.writeFile(path50.join(agentDir, "agent.yaml"), defaultAgentYaml(body.name, body.description ?? "", scaffoldModel), "utf-8");
+    await fs41.writeFile(path50.join(agentDir, "AGENT.md"), `# ${body.name}
 
 ${body.description ?? ""}
 `, "utf-8");
@@ -19638,7 +19669,7 @@ ${body.description ?? ""}
     if ("error" in resolved)
       return c.json({ error: resolved.error }, 400);
     const { agentDir } = resolved;
-    const yamlPath = path49.join(agentDir, "agent.yaml");
+    const yamlPath = path50.join(agentDir, "agent.yaml");
     try {
       const content = await fs41.readFile(yamlPath, "utf-8");
       return c.json({ yaml: content });
@@ -19661,7 +19692,7 @@ ${body.description ?? ""}
     if ("error" in resolved)
       return c.json({ error: resolved.error }, 400);
     const { agentDir } = resolved;
-    const yamlPath = path49.join(agentDir, "agent.yaml");
+    const yamlPath = path50.join(agentDir, "agent.yaml");
     try {
       await fs41.access(agentDir);
     } catch {
@@ -19779,10 +19810,10 @@ ${body.description ?? ""}
   });
   function getSessionsDir(agentId, _source, projectId) {
     if (agentId.startsWith("__") && agentId.endsWith("__")) {
-      return path49.join(homedir19(), ".halo", "global", "internal-sessions", agentId);
+      return path50.join(homedir19(), ".halo", "global", "internal-sessions", agentId);
     }
-    const base = projectId ? path49.join(projectId, ".halo") : path49.join(homedir19(), ".halo");
-    return path49.join(base, "sessions", agentId);
+    const base = projectId ? path50.join(projectId, ".halo") : path50.join(homedir19(), ".halo");
+    return path50.join(base, "sessions", agentId);
   }
   app2.get("/agent-configs/:id/sessions", async (c) => {
     const agentId = c.req.param("id");
@@ -19802,7 +19833,7 @@ ${body.description ?? ""}
       if (!f.endsWith(".json"))
         continue;
       try {
-        const raw = await fs41.readFile(path49.join(dir, f), "utf-8");
+        const raw = await fs41.readFile(path50.join(dir, f), "utf-8");
         const session = JSON.parse(raw);
         sessions.push({
           id: session.id,
@@ -19829,7 +19860,7 @@ ${body.description ?? ""}
       return null;
     const projectId = c.req.query("projectId");
     const source = c.req.query("source") || "test-chat";
-    return path49.join(getSessionsDir(agentId, source, projectId || void 0), `${sessionId}.json`);
+    return path50.join(getSessionsDir(agentId, source, projectId || void 0), `${sessionId}.json`);
   }
   app2.get("/agent-configs/:id/sessions/:sessionId", async (c) => {
     const filePath = sessionFileFromParams(c);
@@ -19855,7 +19886,7 @@ ${body.description ?? ""}
     const dir = getSessionsDir(agentId, source, projectId || void 0);
     if (agentId === GOAL_AGENT_ID && !config.goalModeEnabled) {
       try {
-        await fs41.access(path49.join(dir, `${sessionId}.json`));
+        await fs41.access(path50.join(dir, `${sessionId}.json`));
       } catch {
         return c.json({ error: "Goal mode is disabled." }, 403);
       }
@@ -19877,7 +19908,7 @@ ${body.description ?? ""}
       agentSnapshot: body.agentSnapshot ?? {},
       messages: messages2
     };
-    await fs41.writeFile(path49.join(dir, `${sessionId}.json`), JSON.stringify(session, null, 2), "utf-8");
+    await fs41.writeFile(path50.join(dir, `${sessionId}.json`), JSON.stringify(session, null, 2), "utf-8");
     return c.json({ id: sessionId, session: { ...session, messages: void 0 } });
   });
   app2.delete("/agent-configs/:id/sessions", async (c) => {
@@ -19893,7 +19924,7 @@ ${body.description ?? ""}
       for (const f of files) {
         if (!f.endsWith(".json"))
           continue;
-        await fs41.rm(path49.join(dir, f));
+        await fs41.rm(path50.join(dir, f));
         deleted++;
       }
     } catch {
@@ -19928,7 +19959,7 @@ var init_agent_configs = __esm({
     init_workspace_path();
     init_mtime_cache();
     _cachedTools = null;
-    GLOBAL_AGENTS_DIR4 = path49.join(homedir19(), ".halo", "global", "agents");
+    GLOBAL_AGENTS_DIR4 = path50.join(homedir19(), ".halo", "global", "agents");
     FALLBACK_SCAFFOLD_PROVIDER = "aws-bedrock-claude-invoke";
     _yamlCache = createMtimeCache();
   }
@@ -19937,7 +19968,7 @@ var init_agent_configs = __esm({
 // ../server/dist/routes/skills.js
 import { Hono as Hono5 } from "hono";
 import fs42 from "node:fs/promises";
-import path50 from "node:path";
+import path51 from "node:path";
 import { homedir as homedir20 } from "node:os";
 import YAML12 from "yaml";
 function defaultSkillSettings() {
@@ -19968,7 +19999,7 @@ async function readYamlFile3(filePath) {
   }
 }
 async function writeYamlFile(filePath, data) {
-  await fs42.mkdir(path50.dirname(filePath), { recursive: true });
+  await fs42.mkdir(path51.dirname(filePath), { recursive: true });
   await fs42.writeFile(filePath, YAML12.stringify(data, { lineWidth: 120 }), "utf-8");
 }
 async function addSkillSettings(settingsPath, skillId) {
@@ -20014,7 +20045,7 @@ async function scanSkillsDir(dir, scope) {
     return skills;
   }
   for (const entryName of names) {
-    const skillDir = path50.join(dir, entryName);
+    const skillDir = path51.join(dir, entryName);
     try {
       const stat = await fs42.stat(skillDir);
       if (!stat.isDirectory())
@@ -20022,7 +20053,7 @@ async function scanSkillsDir(dir, scope) {
     } catch {
       continue;
     }
-    const skillMdPath = path50.join(skillDir, "SKILL.md");
+    const skillMdPath = path51.join(skillDir, "SKILL.md");
     try {
       const mdStat = await fs42.stat(skillMdPath);
       let meta = _skillMdCache.get(skillMdPath, mdStat.mtimeMs);
@@ -20032,7 +20063,7 @@ async function scanSkillsDir(dir, scope) {
       }
       skills.push({ id: entryName, name: meta.name, description: meta.description, path: skillDir, scope, command: meta.command });
     } catch {
-      const yamlPath = path50.join(skillDir, "skill.yaml");
+      const yamlPath = path51.join(skillDir, "skill.yaml");
       try {
         const yamlContent = await fs42.readFile(yamlPath, "utf-8");
         const m = yamlContent.match(/^name:\s*(.+)$/m);
@@ -20053,7 +20084,7 @@ function createSkillRoutes() {
     const projectId = c.req.query("projectId");
     let workspaceSkills = [];
     if (projectId) {
-      const wsSkillsDir = path50.join(projectId, ".halo", "skills");
+      const wsSkillsDir = path51.join(projectId, ".halo", "skills");
       workspaceSkills = await scanSkillsDir(wsSkillsDir, "workspace");
     }
     const wsIds = new Set(workspaceSkills.map((s) => s.id));
@@ -20076,19 +20107,19 @@ function createSkillRoutes() {
     if (scope === "workspace") {
       if (!body.projectId)
         return c.json({ error: "projectId required for workspace skills" }, 400);
-      baseDir = path50.join(body.projectId, ".halo", "skills");
+      baseDir = path51.join(body.projectId, ".halo", "skills");
     } else {
       baseDir = GLOBAL_SKILLS_DIR2;
     }
-    const skillDir = path50.join(baseDir, id);
+    const skillDir = path51.join(baseDir, id);
     try {
       await fs42.access(skillDir);
       return c.json({ error: "Skill already exists" }, 409);
     } catch {
     }
     await ensureDir3(skillDir);
-    await fs42.writeFile(path50.join(skillDir, "SKILL.md"), toSkillMd(body.name, body.description ?? ""), "utf-8");
-    const settingsPath = scope === "workspace" && body.projectId ? path50.join(body.projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
+    await fs42.writeFile(path51.join(skillDir, "SKILL.md"), toSkillMd(body.name, body.description ?? ""), "utf-8");
+    const settingsPath = scope === "workspace" && body.projectId ? path51.join(body.projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
     await addSkillSettings(settingsPath, id);
     const skill = { id, name: body.name, description: body.description ?? "", path: skillDir, scope };
     return c.json({ skill }, 201);
@@ -20101,9 +20132,9 @@ function createSkillRoutes() {
     const projectId = c.req.query("projectId");
     let skillDir;
     if (scope === "workspace" && projectId) {
-      skillDir = path50.join(projectId, ".halo", "skills", id);
+      skillDir = path51.join(projectId, ".halo", "skills", id);
     } else {
-      skillDir = path50.join(GLOBAL_SKILLS_DIR2, id);
+      skillDir = path51.join(GLOBAL_SKILLS_DIR2, id);
     }
     try {
       await fs42.access(skillDir);
@@ -20111,7 +20142,7 @@ function createSkillRoutes() {
       return c.json({ error: "Skill not found" }, 404);
     }
     await fs42.rm(skillDir, { recursive: true, force: true });
-    const settingsPath = scope === "workspace" && projectId ? path50.join(projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
+    const settingsPath = scope === "workspace" && projectId ? path51.join(projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
     await removeSkillSettings(settingsPath, id);
     return c.json({ ok: true });
   });
@@ -20135,7 +20166,7 @@ var init_skills = __esm({
     init_db();
     init_workspace_path();
     init_mtime_cache();
-    GLOBAL_SETTINGS_PATH = path50.join(homedir20(), ".halo", "secrets", "settings.yaml");
+    GLOBAL_SETTINGS_PATH = path51.join(homedir20(), ".halo", "secrets", "settings.yaml");
     _skillMdCache = createMtimeCache();
   }
 });
@@ -20143,7 +20174,7 @@ var init_skills = __esm({
 // ../server/dist/routes/settings.js
 import { Hono as Hono6 } from "hono";
 import fs43 from "node:fs/promises";
-import path51 from "node:path";
+import path52 from "node:path";
 import { homedir as homedir21 } from "node:os";
 import YAML13 from "yaml";
 async function readSettingsFile(filePath) {
@@ -20155,7 +20186,7 @@ async function readSettingsFile(filePath) {
   }
 }
 async function writeSettingsFile(filePath, data) {
-  await fs43.mkdir(path51.dirname(filePath), { recursive: true });
+  await fs43.mkdir(path52.dirname(filePath), { recursive: true });
   await fs43.writeFile(filePath, YAML13.stringify(data, { lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
   try {
     await fs43.chmod(filePath, 384);
@@ -20274,8 +20305,8 @@ function detectOrphans(tree, declared) {
       if (!block || typeof block !== "object")
         continue;
       for (const k of Object.keys(block)) {
-        const path73 = `${namespaceId}.${kindWord}.${k}`;
-        if (!declaredMap.has(path73)) {
+        const path74 = `${namespaceId}.${kindWord}.${k}`;
+        if (!declaredMap.has(path74)) {
           out.push({ namespaceId, kind: kindWord === "params" ? "param" : "secret", key: k });
         }
       }
@@ -20290,7 +20321,7 @@ function createSettingsRoutes() {
     const globalTree = await readSettingsFile(GLOBAL_SETTINGS_PATH2);
     let workspaceTree = null;
     if (projectId) {
-      workspaceTree = await readSettingsFile(path51.join(projectId, ".halo", "settings.yaml"));
+      workspaceTree = await readSettingsFile(path52.join(projectId, ".halo", "settings.yaml"));
     }
     const declared = loadSettingsSchema(projectId ?? void 0);
     const sections = resolveSections(declared, globalTree, workspaceTree);
@@ -20325,7 +20356,7 @@ function createSettingsRoutes() {
     const projectPath = await resolveProjectPath(projectId);
     if (!projectPath)
       return { error: "Project not found", status: 404 };
-    return { filePath: path51.join(projectPath, ".halo", "settings.yaml") };
+    return { filePath: path52.join(projectPath, ".halo", "settings.yaml") };
   }
   function flattenDotted(tree, prefix = "") {
     const out = [];
@@ -20413,21 +20444,21 @@ var init_settings = __esm({
     "use strict";
     init_settings_schema();
     init_workspace_path();
-    GLOBAL_SETTINGS_PATH2 = path51.join(homedir21(), ".halo", "secrets", "settings.yaml");
+    GLOBAL_SETTINGS_PATH2 = path52.join(homedir21(), ".halo", "secrets", "settings.yaml");
     _changeListeners = [];
   }
 });
 
 // ../server/dist/evolution/archive.js
 import fs44 from "node:fs";
-import path52 from "node:path";
+import path53 from "node:path";
 import { pipeline } from "node:stream/promises";
 import JSZip from "jszip";
 import { eq as eq11, and as and8, isNull as isNull5, lte, isNotNull as isNotNull3, lt as lt2 } from "drizzle-orm";
 async function zipDir(srcDir, outZip) {
   if (!fs44.existsSync(srcDir))
     return false;
-  fs44.mkdirSync(path52.dirname(outZip), { recursive: true });
+  fs44.mkdirSync(path53.dirname(outZip), { recursive: true });
   const zip = new JSZip();
   const walk = (dir, rel) => {
     const entries = fs44.readdirSync(dir, { withFileTypes: true });
@@ -20436,7 +20467,7 @@ async function zipDir(srcDir, outZip) {
       return;
     }
     for (const e of entries) {
-      const abs = path52.join(dir, e.name);
+      const abs = path53.join(dir, e.name);
       const childRel = rel ? `${rel}/${e.name}` : e.name;
       if (e.isDirectory()) {
         walk(abs, childRel);
@@ -20617,7 +20648,7 @@ var init_raw_sqlite = __esm({
 import { Hono as Hono7 } from "hono";
 import { eq as eq12, desc as desc2, lt as lt3, and as and9, or, sql } from "drizzle-orm";
 import fs45 from "node:fs/promises";
-import path53 from "node:path";
+import path54 from "node:path";
 function createEvolutionRoutes() {
   const router = new Hono7();
   router.get("/evolution/runs", async (c) => {
@@ -20682,12 +20713,12 @@ function createEvolutionRoutes() {
     const dir = wsEvoRunDir(row.workspacePath, id);
     let patchMd = null;
     try {
-      patchMd = await fs45.readFile(path53.join(dir, "patch.md"), "utf-8");
+      patchMd = await fs45.readFile(path54.join(dir, "patch.md"), "utf-8");
     } catch {
     }
     let scoreJson = null;
     try {
-      const raw = await fs45.readFile(path53.join(dir, "score.json"), "utf-8");
+      const raw = await fs45.readFile(path54.join(dir, "score.json"), "utf-8");
       scoreJson = JSON.parse(raw);
     } catch {
     }
@@ -20698,17 +20729,17 @@ function createEvolutionRoutes() {
     }
     let subCliLog = null;
     try {
-      subCliLog = await fs45.readFile(path53.join(dir, "sub-cli.log"), "utf-8");
+      subCliLog = await fs45.readFile(path54.join(dir, "sub-cli.log"), "utf-8");
     } catch {
     }
     let skipReasonMd = null;
     try {
-      skipReasonMd = await fs45.readFile(path53.join(dir, ".skip.md"), "utf-8");
+      skipReasonMd = await fs45.readFile(path54.join(dir, ".skip.md"), "utf-8");
     } catch {
     }
     let snapshotSummary = null;
     try {
-      const raw = await fs45.readFile(path53.join(dir, "source-snapshot.json"), "utf-8");
+      const raw = await fs45.readFile(path54.join(dir, "source-snapshot.json"), "utf-8");
       const parsed = JSON.parse(raw);
       const msgs = parsed.rawMessages ?? [];
       const firstUser = msgs.find((m) => m.role === "user");
@@ -21370,14 +21401,14 @@ function createWebChannel(deps) {
     return findActiveSessionId(sm, accountId, prefix, activeOverrides2, "full") ?? void 0;
   }
   function resolveWorkspace(account, override) {
-    let path73 = account.workspacePath;
+    let path74 = account.workspacePath;
     if (override && override !== account.workspacePath) {
       if (account.accessLevel !== "full") {
         return { ok: false, error: "workspace override requires a full-access token" };
       }
-      path73 = override;
+      path74 = override;
     }
-    const resolved = resolveAccountWorkspace({ ...account, workspacePath: path73 });
+    const resolved = resolveAccountWorkspace({ ...account, workspacePath: path74 });
     if (!resolved)
       return { ok: false, error: "workspace not found" };
     return { ok: true, path: resolved };
@@ -21777,7 +21808,7 @@ var init_session_types = __esm({
 // ../server/dist/routes/halo-city.js
 import { Hono as Hono10 } from "hono";
 import fs46 from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 import Database6 from "better-sqlite3";
 function scanSkills2(dir) {
   let names;
@@ -21788,7 +21819,7 @@ function scanSkills2(dir) {
   }
   const out = [];
   for (const entry of names) {
-    const skillMd = path54.join(dir, entry, "SKILL.md");
+    const skillMd = path55.join(dir, entry, "SKILL.md");
     let stat;
     try {
       stat = fs46.statSync(skillMd);
@@ -21886,10 +21917,10 @@ function snapshotWorkspace(sm, wsPath, label) {
       messageCount: meta.messageCount
     };
   });
-  const wsSkills = scanSkills2(path54.join(wsPath, ".halo", "skills"));
+  const wsSkills = scanSkills2(path55.join(wsPath, ".halo", "skills"));
   return {
     path: wsPath,
-    key: path54.basename(wsPath) || wsPath,
+    key: path55.basename(wsPath) || wsPath,
     label,
     sessions,
     counts,
@@ -21907,7 +21938,7 @@ function roReader(rawPath) {
   const cached = _roReaders.get(wsPath);
   if (cached)
     return cached;
-  const dbPath = path54.join(wsPath, ".halo", "halo.db");
+  const dbPath = path55.join(wsPath, ".halo", "halo.db");
   if (!fs46.existsSync(dbPath))
     return null;
   try {
@@ -21984,12 +22015,12 @@ function snapshotWorkspaceReadonly(wsPath, label) {
   });
   return {
     path: wsPath,
-    key: path54.basename(wsPath) || wsPath,
+    key: path55.basename(wsPath) || wsPath,
     label,
     sessions,
     counts,
     totalSessions: counts.total,
-    skills: scanSkills2(path54.join(wsPath, ".halo", "skills"))
+    skills: scanSkills2(path55.join(wsPath, ".halo", "skills"))
   };
 }
 function readonlySessionCounts(wsPath, limit) {
@@ -22052,11 +22083,11 @@ function discoverWorkspaces(registry2) {
     }
   };
   for (const { workspacePath } of registry2.list())
-    add(workspacePath, path54.basename(workspacePath));
+    add(workspacePath, path55.basename(workspacePath));
   try {
     const rows = getChannelDb().select().from(channelAccounts).all();
     for (const row of rows)
-      add(row.workspacePath, path54.basename(row.workspacePath));
+      add(row.workspacePath, path55.basename(row.workspacePath));
   } catch {
   }
   return out;
@@ -22075,7 +22106,7 @@ function createShowRoutes(registry2) {
       return a.response;
     const { account } = a;
     const globalView = account.accessLevel === "full" || account.accessLevel === "observer";
-    const targets = globalView ? discoverWorkspaces(registry2) : /* @__PURE__ */ new Map([[account.workspacePath, path54.basename(account.workspacePath)]]);
+    const targets = globalView ? discoverWorkspaces(registry2) : /* @__PURE__ */ new Map([[account.workspacePath, path55.basename(account.workspacePath)]]);
     const workspaces = [];
     for (const [wsPath, label] of targets) {
       try {
@@ -22304,7 +22335,7 @@ var init_commands3 = __esm({
 
 // ../server/dist/routes/agentcore.js
 import { Hono as Hono13 } from "hono";
-import path55 from "node:path";
+import path56 from "node:path";
 import fs47 from "node:fs";
 function sanitizeRuntimeId(runtimeSessionId) {
   return runtimeSessionId.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 80);
@@ -22313,7 +22344,7 @@ function haloSessionId(runtimeSessionId) {
   return `agentcore_${sanitizeRuntimeId(runtimeSessionId)}`;
 }
 function userWorkspace(base, runtimeSessionId) {
-  const dir = path55.join(base, "users", sanitizeRuntimeId(runtimeSessionId));
+  const dir = path56.join(base, "users", sanitizeRuntimeId(runtimeSessionId));
   fs47.mkdirSync(dir, { recursive: true });
   return dir;
 }
@@ -22668,7 +22699,7 @@ var init_agentcore = __esm({
 
 // ../server/dist/ws/file-watcher.js
 import fs48 from "node:fs";
-import path56 from "node:path";
+import path57 from "node:path";
 function enqueueNativeOp(op) {
   const result = nativeOpChain.then(op);
   nativeOpChain = result.catch(() => {
@@ -22676,12 +22707,12 @@ function enqueueNativeOp(op) {
   return result;
 }
 function isUnwatchablePath(absPath) {
-  const norm = path56.resolve(absPath);
-  if (norm === "/" || norm === path56.parse(norm).root)
+  const norm = path57.resolve(absPath);
+  if (norm === "/" || norm === path57.parse(norm).root)
     return "filesystem root";
   const banned = ["/System", "/Library", "/private", "/usr", "/bin", "/sbin", "/etc"];
   for (const b of banned) {
-    if (norm === b || norm.startsWith(b + path56.sep))
+    if (norm === b || norm.startsWith(b + path57.sep))
       return `system path ${b}`;
   }
   return null;
@@ -22821,10 +22852,10 @@ var init_file_watcher = __esm({
         const root = this.workspaceRoot;
         if (!root)
           return;
-        const raw = path56.relative(root, absPath);
+        const raw = path57.relative(root, absPath);
         if (!raw || raw.startsWith(".."))
           return;
-        const rel = raw.split(path56.sep).join("/");
+        const rel = raw.split(path57.sep).join("/");
         if (IS_WIN32 && rel.split("/").some((seg) => IGNORED_SEGMENT_SET.has(seg)))
           return;
         let action;
@@ -22912,7 +22943,7 @@ var init_file_watcher = __esm({
 
 // ../server/dist/ws/git-dir-watcher.js
 import fs49 from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 var GitDirWatcher;
 var init_git_dir_watcher = __esm({
   "../server/dist/ws/git-dir-watcher.js"() {
@@ -22936,7 +22967,7 @@ var init_git_dir_watcher = __esm({
           return;
         this.stop();
         this.workspaceRoot = workspaceRoot;
-        const gitDir = path57.join(workspaceRoot, ".git");
+        const gitDir = path58.join(workspaceRoot, ".git");
         if (fs49.existsSync(gitDir)) {
           this.watchGitDir(gitDir);
         } else {
@@ -23001,7 +23032,7 @@ var init_git_dir_watcher = __esm({
         const root = this.workspaceRoot;
         if (!root)
           return;
-        const gitDir = path57.join(root, ".git");
+        const gitDir = path58.join(root, ".git");
         if (!fs49.existsSync(gitDir))
           return;
         this.closeWatcher();
@@ -23399,7 +23430,7 @@ var init_terminal_manager = __esm({
 });
 
 // ../server/dist/ws/handler.js
-import path58 from "node:path";
+import path59 from "node:path";
 function setupWebSocketHandler(deps) {
   const { wss: wss2, registry: registry2 } = deps;
   const clients = /* @__PURE__ */ new Set();
@@ -23422,7 +23453,7 @@ function setupWebSocketHandler(deps) {
     ackedChatIds.add(id);
   }
   function resolveProjectPath2(projectId) {
-    if (path58.isAbsolute(projectId))
+    if (path59.isAbsolute(projectId))
       return projectId;
     return null;
   }
@@ -24023,11 +24054,11 @@ var init_handler2 = __esm({
 import Database7 from "better-sqlite3";
 import { drizzle as drizzle5 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable5, text as text5, integer as integer5 } from "drizzle-orm/sqlite-core";
-import path59 from "node:path";
+import path60 from "node:path";
 import fs50 from "node:fs";
 function createCronDb(globalDir2) {
   fs50.mkdirSync(globalDir2, { recursive: true });
-  const dbPath = path59.join(globalDir2, "cron.db");
+  const dbPath = path60.join(globalDir2, "cron.db");
   const sqlite = new Database7(dbPath);
   sqlite.pragma("journal_mode = WAL");
   sqlite.exec(CREATE_SQL4);
@@ -24228,7 +24259,7 @@ var init_dispatcher = __esm({
 // ../server/dist/cron/runner.js
 import { spawn as spawn3, execFileSync } from "node:child_process";
 import fs51 from "node:fs";
-import path60 from "node:path";
+import path61 from "node:path";
 import { homedir as homedir23 } from "node:os";
 import { Cron } from "croner";
 import { eq as eq14, lt as lt5 } from "drizzle-orm";
@@ -24306,7 +24337,7 @@ function sessionKeyFor(workspacePath, sessionId) {
   try {
     ws = fs51.realpathSync(workspacePath);
   } catch {
-    ws = path60.resolve(workspacePath);
+    ws = path61.resolve(workspacePath);
   }
   return `${ws}
 ${sessionId}`;
@@ -24315,10 +24346,10 @@ function setCronSessionRegistry(r) {
   _sessionRegistry = r;
 }
 function logsDir() {
-  return path60.join(homedir23(), ".halo", "global", "logs", "cron");
+  return path61.join(homedir23(), ".halo", "global", "logs", "cron");
 }
 function logPathFor(runId) {
-  return path60.join(logsDir(), `${runId}.log`);
+  return path61.join(logsDir(), `${runId}.log`);
 }
 function newRunId() {
   return `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}`;
@@ -24786,7 +24817,7 @@ function pruneOldLogs() {
     return;
   const cutoff = Date.now() - LOG_RETENTION_DAYS * DAY_MS2;
   for (const name of fs51.readdirSync(dir)) {
-    const p = path60.join(dir, name);
+    const p = path61.join(dir, name);
     try {
       const stat = fs51.statSync(p);
       if (stat.mtimeMs < cutoff)
@@ -25133,7 +25164,7 @@ var init_cron = __esm({
 
 // ../server/dist/extensions/registry.js
 import fs53 from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 function isExtensionId(id) {
   return ID_RE.test(id);
 }
@@ -25199,17 +25230,17 @@ function parseManifest(raw, dirName, entryExists) {
     ...m.license !== void 0 ? { license: m.license } : {}
   };
 }
-function readExtensionDir(dir, id = path61.basename(dir)) {
+function readExtensionDir(dir, id = path62.basename(dir)) {
   let raw;
   try {
-    raw = JSON.parse(fs53.readFileSync(path61.join(dir, MANIFEST_FILE), "utf-8"));
+    raw = JSON.parse(fs53.readFileSync(path62.join(dir, MANIFEST_FILE), "utf-8"));
   } catch (err) {
     const code = err.code;
     return { id, error: code === "ENOENT" ? `${MANIFEST_FILE} missing` : `${MANIFEST_FILE} unreadable: ${err instanceof Error ? err.message : String(err)}` };
   }
   const parsed = parseManifest(raw, id, (entry) => {
     try {
-      return fs53.statSync(path61.join(dir, entry)).isFile();
+      return fs53.statSync(path62.join(dir, entry)).isFile();
     } catch {
       return false;
     }
@@ -25239,7 +25270,7 @@ function scanExtensions() {
       errors.push({ id: entry.name, error: "directory name is not a valid extension id" });
       continue;
     }
-    const result = readExtensionDir(path61.join(root, entry.name));
+    const result = readExtensionDir(path62.join(root, entry.name));
     if ("error" in result)
       errors.push(result);
     else
@@ -25278,7 +25309,7 @@ var init_registry2 = __esm({
 
 // ../server/dist/extensions/install.js
 import fs54 from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import JSZip2 from "jszip";
 function safeEntryPath(name) {
@@ -25309,26 +25340,26 @@ async function unpackZip(zipBuf, dest) {
     const perm = entry.unixPermissions;
     if (typeof perm === "number" && (perm & S_IFMT) === S_IFLNK)
       throw new ExtensionInstallError(`zip entry is a symlink: ${entry.name}`);
-    const abs = path62.join(dest, rel);
+    const abs = path63.join(dest, rel);
     if (entry.dir) {
       fs54.mkdirSync(abs, { recursive: true });
       continue;
     }
-    fs54.mkdirSync(path62.dirname(abs), { recursive: true });
+    fs54.mkdirSync(path63.dirname(abs), { recursive: true });
     fs54.writeFileSync(abs, await entry.async("nodebuffer"));
   }
 }
 function stripWrapperDir(dir) {
-  if (fs54.existsSync(path62.join(dir, MANIFEST_FILE)))
+  if (fs54.existsSync(path63.join(dir, MANIFEST_FILE)))
     return;
   const children = fs54.readdirSync(dir, { withFileTypes: true });
   if (children.length !== 1 || !children[0].isDirectory())
     return;
-  const inner = path62.join(dir, children[0].name);
-  if (!fs54.existsSync(path62.join(inner, MANIFEST_FILE)))
+  const inner = path63.join(dir, children[0].name);
+  if (!fs54.existsSync(path63.join(inner, MANIFEST_FILE)))
     return;
   for (const name of fs54.readdirSync(inner)) {
-    fs54.renameSync(path62.join(inner, name), path62.join(dir, name));
+    fs54.renameSync(path63.join(inner, name), path63.join(dir, name));
   }
   fs54.rmdirSync(inner);
 }
@@ -25338,14 +25369,14 @@ function rand() {
 async function installExtensionZip(zipBuf, expectId) {
   const root = extensionsRoot();
   fs54.mkdirSync(root, { recursive: true });
-  const stage = path62.join(root, `.tmp-unpack-${rand()}`);
+  const stage = path63.join(root, `.tmp-unpack-${rand()}`);
   fs54.mkdirSync(stage);
   try {
     await unpackZip(zipBuf, stage);
     stripWrapperDir(stage);
     let manifestId;
     try {
-      const raw = JSON.parse(fs54.readFileSync(path62.join(stage, MANIFEST_FILE), "utf-8"));
+      const raw = JSON.parse(fs54.readFileSync(path63.join(stage, MANIFEST_FILE), "utf-8"));
       manifestId = typeof raw.id === "string" ? raw.id : "";
     } catch (err) {
       throw new ExtensionInstallError(`${MANIFEST_FILE} missing or unreadable at the zip root: ${err instanceof Error ? err.message : String(err)}`);
@@ -25357,8 +25388,8 @@ async function installExtensionZip(zipBuf, expectId) {
     const verdict = readExtensionDir(stage, manifestId);
     if ("error" in verdict)
       throw new ExtensionInstallError(`invalid extension: ${verdict.error}`);
-    const target = path62.join(root, manifestId);
-    const old = path62.join(root, `.old-${manifestId}-${rand()}`);
+    const target = path63.join(root, manifestId);
+    const old = path63.join(root, `.old-${manifestId}-${rand()}`);
     const hadOld = fs54.existsSync(target);
     if (hadOld)
       fs54.renameSync(target, old);
@@ -25383,7 +25414,7 @@ async function installExtensionZip(zipBuf, expectId) {
 function uninstallExtension(id) {
   if (!isExtensionId(id))
     throw new ExtensionInstallError(`"${id}" is not a valid extension id`);
-  const dir = path62.join(extensionsRoot(), id);
+  const dir = path63.join(extensionsRoot(), id);
   if (!fs54.existsSync(dir))
     return false;
   fs54.rmSync(dir, { recursive: true, force: true });
@@ -25666,17 +25697,17 @@ function passwordStrengthError(pw) {
 }
 function authMiddleware() {
   return async (c, next) => {
-    const path73 = c.req.path;
-    if (PUBLIC_PATHS.some((p) => path73 === p || path73.startsWith(p + "?"))) {
+    const path74 = c.req.path;
+    if (PUBLIC_PATHS.some((p) => path74 === p || path74.startsWith(p + "?"))) {
       return next();
     }
-    if (EXTENSION_ASSET_PATH.test(path73)) {
+    if (EXTENSION_ASSET_PATH.test(path74)) {
       return next();
     }
     const token = getCookie(c, COOKIE_NAME);
     const payload = validateToken(token);
     if (!payload) {
-      if (!path73.startsWith("/api/")) {
+      if (!path74.startsWith("/api/")) {
         return next();
       }
       return c.json({ error: "Unauthorized" }, 401);
@@ -25711,7 +25742,7 @@ var init_auth = __esm({
 // ../server/dist/routes/extensions.js
 import { Hono as Hono16 } from "hono";
 import fs56 from "node:fs";
-import path63 from "node:path";
+import path64 from "node:path";
 import { Readable as Readable2 } from "node:stream";
 function assetMime(fileName) {
   const ext = fileName.split(".").pop()?.toLowerCase() ?? "";
@@ -25729,12 +25760,12 @@ function resolveAsset(id, version, rest) {
   let dir;
   let real;
   try {
-    dir = fs56.realpathSync(path63.join(extensionsRoot(), id));
-    real = fs56.realpathSync(path63.join(dir, ...segments));
+    dir = fs56.realpathSync(path64.join(extensionsRoot(), id));
+    real = fs56.realpathSync(path64.join(dir, ...segments));
   } catch {
     return null;
   }
-  if (real !== dir && !real.startsWith(dir + path63.sep))
+  if (real !== dir && !real.startsWith(dir + path64.sep))
     return null;
   try {
     if (!fs56.statSync(real).isFile())
@@ -26096,7 +26127,7 @@ var init_ticker = __esm({
 });
 
 // ../server/dist/evolution/spawn.js
-import path64 from "node:path";
+import path65 from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var __dirname2, WRAPPER_PATH, realEvoSpawner;
@@ -26104,8 +26135,8 @@ var init_spawn = __esm({
   "../server/dist/evolution/spawn.js"() {
     "use strict";
     init_child_env();
-    __dirname2 = path64.dirname(fileURLToPath2(import.meta.url));
-    WRAPPER_PATH = path64.resolve(__dirname2, "evo-wrapper.js");
+    __dirname2 = path65.dirname(fileURLToPath2(import.meta.url));
+    WRAPPER_PATH = path65.resolve(__dirname2, "evo-wrapper.js");
     realEvoSpawner = (mode, id) => {
       const child = spawn4(process.execPath, [WRAPPER_PATH, `--mode=${mode}`, `--id=${id}`], {
         detached: true,
@@ -27584,7 +27615,7 @@ var init_cdn = __esm({
 
 // ../server/dist/channels/wechat/send-media.js
 import fs58 from "node:fs/promises";
-import path65 from "node:path";
+import path66 from "node:path";
 function inferKind(filePath) {
   const cls = classifyMedia(filePath);
   if (cls === "image")
@@ -27634,7 +27665,7 @@ async function sendMediaFile(params) {
     aesKeyBase64,
     fileSizeCiphertext: prep.filesize,
     fileSize: prep.rawsize,
-    fileName: path65.basename(filePath)
+    fileName: path66.basename(filePath)
   });
   const clientId = `halo-media-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const body = {
@@ -27798,7 +27829,7 @@ var init_login = __esm({
 
 // ../server/dist/channels/wechat/handler.js
 import fs59 from "node:fs";
-import path66 from "node:path";
+import path67 from "node:path";
 import QRCode from "qrcode";
 function wxRoute(fromUserId, contextToken, contextTokenAt) {
   return (prev) => {
@@ -28219,7 +28250,7 @@ async function handleSlashCommand(args) {
         await reply(login.message);
         return true;
       }
-      const tmpPath = path66.join(tempDir(), `halo-qr-${login.sessionKey}.png`);
+      const tmpPath = path67.join(tempDir(), `halo-qr-${login.sessionKey}.png`);
       await QRCode.toFile(tmpPath, login.qrcodeUrl, { width: 256, margin: 2 });
       await sendMediaFile({
         baseUrl: account.baseUrl,
@@ -28308,7 +28339,7 @@ var init_handler4 = __esm({
 
 // ../server/dist/routes/wechat.js
 import { Hono as Hono18 } from "hono";
-import path67 from "node:path";
+import path68 from "node:path";
 import fs60 from "node:fs";
 function createWechatRoutes(deps) {
   const { db, channel } = deps;
@@ -28334,7 +28365,7 @@ function createWechatRoutes(deps) {
       return c.json({ error: "sessionKey required" }, 400);
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path67.isAbsolute(body.workspacePath))
+    if (!path68.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
     const levelError = accessLevelError(body.accessLevel, CHAT_ACCESS_LEVELS);
     if (levelError)
@@ -28712,10 +28743,10 @@ function createWebRoutes(deps) {
     const filePath = c.req.query("path");
     if (!filePath)
       return c.json({ error: "path required" }, 400);
-    const path73 = await import("node:path");
-    const resolved = path73.default.resolve(account.workspacePath, filePath);
-    const root = path73.default.resolve(account.workspacePath);
-    if (resolved !== root && !resolved.startsWith(root + path73.default.sep)) {
+    const path74 = await import("node:path");
+    const resolved = path74.default.resolve(account.workspacePath, filePath);
+    const root = path74.default.resolve(account.workspacePath);
+    if (resolved !== root && !resolved.startsWith(root + path74.default.sep)) {
       return c.json({ error: "path traversal not allowed" }, 403);
     }
     let real;
@@ -28726,7 +28757,7 @@ function createWebRoutes(deps) {
     } catch {
       return c.json({ error: "file not found" }, 404);
     }
-    if (real !== realRoot && !real.startsWith(realRoot + path73.default.sep)) {
+    if (real !== realRoot && !real.startsWith(realRoot + path74.default.sep)) {
       return c.json({ error: "path traversal not allowed" }, 403);
     }
     if (isHiddenWorkspacePath(real, realRoot)) {
@@ -28735,7 +28766,7 @@ function createWebRoutes(deps) {
     const stat = fs61.statSync(real);
     if (stat.isDirectory())
       return c.json({ error: "cannot serve directory" }, 400);
-    const ext = path73.default.extname(real).toLowerCase();
+    const ext = path74.default.extname(real).toLowerCase();
     const nonImageMimes = {
       ".mp4": "video/mp4",
       ".webm": "video/webm",
@@ -28743,7 +28774,7 @@ function createWebRoutes(deps) {
       ".txt": "text/plain"
     };
     const contentType = imageMimeFromExt(ext) || nonImageMimes[ext] || "application/octet-stream";
-    const fileName = path73.default.basename(resolved);
+    const fileName = path74.default.basename(resolved);
     const data = fs61.readFileSync(real);
     c.header("content-type", contentType);
     c.header("content-disposition", `inline; filename="${fileName}"`);
@@ -28965,8 +28996,8 @@ async function authTest(botToken) {
 }
 async function uploadFile(args) {
   const fs65 = await import("node:fs");
-  const path73 = await import("node:path");
-  const filename = args.filename ?? path73.basename(args.filePath);
+  const path74 = await import("node:path");
+  const filename = args.filename ?? path74.basename(args.filePath);
   const stat = fs65.statSync(args.filePath);
   if (!stat.isFile())
     throw new Error(`[slack:uploadFile] not a regular file: ${args.filePath}`);
@@ -29130,7 +29161,7 @@ var init_api2 = __esm({
 });
 
 // ../server/dist/channels/slack/handler.js
-import path68 from "node:path";
+import path69 from "node:path";
 import { WebSocket } from "ws";
 function slashToBang(text6, commandNames) {
   if (commandNames.length === 0)
@@ -29261,7 +29292,7 @@ function startSlackChannel(deps) {
             const route = bridge.getRoute(sessionId);
             if (!account || !route)
               return;
-            const resolved = path68.resolve(filePath);
+            const resolved = path69.resolve(filePath);
             await sendMediaOrReport({
               filePath,
               account,
@@ -29904,9 +29935,9 @@ async function replyMessage(args) {
 }
 async function uploadImage(args) {
   const fs65 = await import("node:fs");
-  const path73 = await import("node:path");
+  const path74 = await import("node:path");
   const buf = fs65.readFileSync(args.filePath);
-  const filename = path73.basename(args.filePath);
+  const filename = path74.basename(args.filePath);
   const send = async (token) => {
     const form = new FormData();
     form.append("image_type", "message");
@@ -29923,9 +29954,9 @@ async function uploadImage(args) {
 }
 async function uploadFile2(args) {
   const fs65 = await import("node:fs");
-  const path73 = await import("node:path");
+  const path74 = await import("node:path");
   const buf = fs65.readFileSync(args.filePath);
-  const filename = args.filename ?? path73.basename(args.filePath);
+  const filename = args.filename ?? path74.basename(args.filePath);
   const send = async (token) => {
     const form = new FormData();
     form.append("file_type", args.fileType);
@@ -29992,7 +30023,7 @@ var init_api3 = __esm({
 });
 
 // ../server/dist/channels/feishu/handler.js
-import path69 from "node:path";
+import path70 from "node:path";
 import * as Lark from "@larksuiteoapi/node-sdk";
 function buildSessionPrefixForThread2(chatId, rootId) {
   return sessionPrefix("feishu", `${chatId}:${rootId}`);
@@ -30195,7 +30226,7 @@ function startFeishuChannel(deps) {
             const route = bridge.getRoute(sessionId);
             if (!account || !route)
               return;
-            const resolved = path69.resolve(filePath);
+            const resolved = path70.resolve(filePath);
             await sendMediaOrReport({
               filePath,
               account,
@@ -30362,7 +30393,7 @@ async function replyToInbound(args) {
 async function sendFeishuMedia(args) {
   const { account, inboundMessageId, isP2P, chatId, filePath } = args;
   const cls = classifyMedia(filePath);
-  const ext = path69.extname(filePath).toLowerCase();
+  const ext = path70.extname(filePath).toLowerCase();
   if (cls === "image") {
     const { imageKey } = await uploadImage({ appId: account.appId, appSecret: account.appSecret, filePath });
     await replyToInboundRaw({
@@ -30751,7 +30782,7 @@ var init_event_adapter5 = __esm({
 });
 
 // ../server/dist/channels/wecom/handler.js
-import path70 from "node:path";
+import path71 from "node:path";
 import fs62 from "node:fs/promises";
 import { WSClient as WSClient2, generateReqId } from "@wecom/aibot-node-sdk";
 function pickConversation(body) {
@@ -30882,13 +30913,13 @@ async function replyText(wsClient, route, text6) {
 }
 async function sendWecomMedia(args) {
   const { wsClient, route, filePath } = args;
-  const ext = path70.extname(filePath).toLowerCase();
+  const ext = path71.extname(filePath).toLowerCase();
   const cls = classifyMedia(filePath);
   const type = cls === "image" && [".png", ".jpg", ".jpeg", ".gif"].includes(ext) ? "image" : cls === "video" && ext === ".mp4" ? "video" : "file";
   const buf = await fs62.readFile(filePath);
   if (buf.length > MAX_WECOM_DOWNLOAD_BYTES)
     throw new Error("file exceeds 20MB");
-  const { media_id: mediaId } = await wsClient.uploadMedia(buf, { type, filename: path70.basename(filePath) });
+  const { media_id: mediaId } = await wsClient.uploadMedia(buf, { type, filename: path71.basename(filePath) });
   if (route.reqId)
     await wsClient.replyMedia({ headers: { req_id: route.reqId } }, type, mediaId);
   else
@@ -30933,7 +30964,7 @@ function startWecomChannel(deps) {
             const wsClient = states.get(accountId)?.wsClient;
             if (!account || !route || !wsClient)
               return;
-            const resolved = path70.resolve(filePath);
+            const resolved = path71.resolve(filePath);
             await sendMediaOrReport({
               filePath,
               account,
@@ -31342,7 +31373,7 @@ import { compress } from "hono/compress";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { WebSocketServer } from "ws";
-import path71 from "node:path";
+import path72 from "node:path";
 import fs63 from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { homedir as homedir24 } from "node:os";
@@ -31350,9 +31381,9 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 function findProjectRoot() {
   let dir = process.cwd();
   for (let i = 0; i < 32; i++) {
-    if (fs63.existsSync(path71.join(dir, "pnpm-workspace.yaml")))
+    if (fs63.existsSync(path72.join(dir, "pnpm-workspace.yaml")))
       return dir;
-    const parent = path71.dirname(dir);
+    const parent = path72.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -31361,7 +31392,7 @@ function findProjectRoot() {
   return process.cwd();
 }
 function acquireSingleInstanceLock(lockFile) {
-  fs63.mkdirSync(path71.dirname(lockFile), { recursive: true });
+  fs63.mkdirSync(path72.dirname(lockFile), { recursive: true });
   const fd = fs63.openSync(lockFile, fs63.constants.O_RDWR | fs63.constants.O_CREAT, 420);
   const result = spawnSync3("flock", ["-n", "3"], {
     stdio: ["ignore", "ignore", "ignore", fd]
@@ -31418,7 +31449,7 @@ function isProcessAlive(pid) {
   }
 }
 function readGitSha() {
-  if (!fs63.existsSync(path71.join(PROJECT_ROOT, "pnpm-workspace.yaml")) || !fs63.existsSync(path71.join(PROJECT_ROOT, ".git")))
+  if (!fs63.existsSync(path72.join(PROJECT_ROOT, "pnpm-workspace.yaml")) || !fs63.existsSync(path72.join(PROJECT_ROOT, ".git")))
     return null;
   try {
     const rev = spawnSync3("git", ["rev-parse", "--short", "HEAD"], { cwd: PROJECT_ROOT, encoding: "utf-8" });
@@ -31439,14 +31470,14 @@ function applySandboxPaths() {
 }
 function resolveFrontendDir() {
   if (process.env.HALO_FRONTEND_DIR)
-    return path71.resolve(process.env.HALO_FRONTEND_DIR);
-  const bundled = path71.resolve(__dirname3, "..", "admin-out");
-  if (fs63.existsSync(path71.join(bundled, "index.html")))
+    return path72.resolve(process.env.HALO_FRONTEND_DIR);
+  const bundled = path72.resolve(__dirname3, "..", "admin-out");
+  if (fs63.existsSync(path72.join(bundled, "index.html")))
     return bundled;
-  const sibling = path71.resolve(__dirname3, "..", "..", "admin", "out");
-  if (fs63.existsSync(path71.join(sibling, "index.html")))
+  const sibling = path72.resolve(__dirname3, "..", "..", "admin", "out");
+  if (fs63.existsSync(path72.join(sibling, "index.html")))
     return sibling;
-  return path71.resolve(PROJECT_ROOT, "packages", "admin", "out");
+  return path72.resolve(PROJECT_ROOT, "packages", "admin", "out");
 }
 async function gracefulShutdown(signal) {
   console.log(`[Server] Received ${signal}, shutting down gracefully...`);
@@ -31518,34 +31549,24 @@ var init_dist2 = __esm({
     init_sandbox();
     init_init();
     init_git_ssh();
-    __dirname3 = path71.dirname(fileURLToPath3(import.meta.url));
+    __dirname3 = path72.dirname(fileURLToPath3(import.meta.url));
     PORT = config.server.port;
-    HALO_VERSION = "1.5.6";
+    HALO_VERSION = "1.5.7";
     PROJECT_ROOT = findProjectRoot();
-    HALO_HOME4 = path71.join(homedir24(), ".halo");
+    HALO_HOME4 = path72.join(homedir24(), ".halo");
     GIT_SHA = readGitSha();
-    if (!fs63.existsSync(path71.join(HALO_HOME4, "global", ".template-version"))) {
+    if (!fs63.existsSync(path72.join(HALO_HOME4, "global", ".template-version"))) {
       process.stderr.write("\x1B[31m[Server] ~/.halo/global/ not initialized. Run `halo setup` first.\x1B[0m\n");
       process.exit(1);
     }
-    {
-      const seedVersion = readSeedVersion(HALO_HOME4);
-      if (seedVersion > 0 && seedVersion < TEMPLATE_VERSION) {
-        console.log(`[Server] Templates outdated (v${seedVersion} \u2192 v${TEMPLATE_VERSION}), refreshing ~/.halo/global/`);
-        try {
-          ensureHaloHome(HALO_HOME4);
-        } catch (err) {
-          console.error(`[Server] Template refresh failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-    }
+    refreshTemplatesIfOutdated(HALO_HOME4, "Server");
     AGENTCORE = config.server.runtimeMode === "agentcore";
     if (!AGENTCORE && (!config.server.password && !config.server.passwordEnvPlaintext || !config.server.jwtSecret)) {
       process.stderr.write("\x1B[31m[Server] admin password not configured. Run `halo setup` to set one, or set the HALO_PASSWORD env.\x1B[0m\n");
       process.exit(1);
     }
     if (!AGENTCORE)
-      acquireSingleInstanceLock(path71.join(HALO_HOME4, "global", "server.lock"));
+      acquireSingleInstanceLock(path72.join(HALO_HOME4, "global", "server.lock"));
     commandRegistry.assertDispatchCommands(DISPATCH_COMMANDS);
     await initObservability();
     initLogger();
@@ -31607,11 +31628,11 @@ var init_dist2 = __esm({
     app.route("/api", extensionRoutes);
     if (!AGENTCORE)
       start();
-    channelDb = createChannelDb(path71.join(HALO_HOME4, "secrets"));
+    channelDb = createChannelDb(path72.join(HALO_HOME4, "secrets"));
     setChannelDb(channelDb);
-    setEvoDb(createEvoDb(path71.join(HALO_HOME4, "global")));
-    setCronDb(createCronDb(path71.join(HALO_HOME4, "global")));
-    setRunsDb(createRunsDb(path71.join(HALO_HOME4, "global")));
+    setEvoDb(createEvoDb(path72.join(HALO_HOME4, "global")));
+    setCronDb(createCronDb(path72.join(HALO_HOME4, "global")));
+    setRunsDb(createRunsDb(path72.join(HALO_HOME4, "global")));
     setEvoSpawner(realEvoSpawner);
     if (!AGENTCORE) {
       startEvoTicker();
@@ -31626,7 +31647,7 @@ var init_dist2 = __esm({
     setCronSessionRegistry(registry);
     if (OWNS_RUNTIMES) {
       for (const ws of listRunningWorkspaces()) {
-        if (!fs63.existsSync(path71.join(ws, ".halo")))
+        if (!fs63.existsSync(path72.join(ws, ".halo")))
           continue;
         if (!claimWorkspaceRuntime(ws))
           continue;
@@ -31656,9 +31677,9 @@ var init_dist2 = __esm({
       console.log(`[Server] AgentCore runtime mode \u2014 workspace: ${config.server.agentcoreWorkspace}`);
     }
     FRONTEND_DIR = resolveFrontendDir();
-    app.use("/*", serveStatic({ root: path71.relative(process.cwd(), FRONTEND_DIR) }));
+    app.use("/*", serveStatic({ root: path72.relative(process.cwd(), FRONTEND_DIR) }));
     app.get("/*", (c) => {
-      const indexPath = path71.join(FRONTEND_DIR, "index.html");
+      const indexPath = path72.join(FRONTEND_DIR, "index.html");
       try {
         const html = fs63.readFileSync(indexPath, "utf-8");
         return c.html(html);
@@ -32450,11 +32471,11 @@ process.emitWarning = (warning, ...args) => {
 
 // src/index.ts
 init_server_supervisor();
-import path72 from "node:path";
+import path73 from "node:path";
 import fs64 from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { parseArgs as parseArgs2 } from "node:util";
-var VERSION = "1.5.6";
+var VERSION = "1.5.7";
 var HELP_TOP = `Usage: halo <command> [options]
 
 Commands:
@@ -32713,8 +32734,8 @@ async function cmdSetup(argv = []) {
   const { buildBindProviderPlan: buildBindProviderPlan2, KEEP_CURRENT: KEEP_CURRENT2, AWS_CHAIN_PROVIDER: AWS_CHAIN_PROVIDER2 } = await Promise.resolve().then(() => (init_setup_bind_provider(), setup_bind_provider_exports));
   const { promptText: promptText2, promptPassword: promptPassword2, promptSelect: promptSelect2, promptMultiSelect: promptMultiSelect2 } = await Promise.resolve().then(() => (init_setup_prompts(), setup_prompts_exports));
   const nonInteractive = argv.includes("--non-interactive") || argv.includes("-y");
-  const haloHome2 = path72.join(homedir25(), ".halo");
-  const globalDir2 = path72.join(haloHome2, "global");
+  const haloHome2 = path73.join(homedir25(), ".halo");
+  const globalDir2 = path73.join(haloHome2, "global");
   ensureHaloHome2(haloHome2);
   process.stderr.write(`[setup] ${haloHome2}/ ready
 `);
@@ -33057,7 +33078,7 @@ async function cmdUpgrade() {
 `);
       process.exit(1);
     }
-    const broken = verifyNativeModules2(path72.join(rootDir, PKG));
+    const broken = verifyNativeModules2(path73.join(rootDir, PKG));
     if (broken.length > 0) {
       process.stderr.write(
         `
@@ -33088,7 +33109,7 @@ halo: upgrade failed (npm exited ${install.status}). ${hint}
 async function cmdAgents(flags) {
   const { initRuntime: initRuntime2, listAgents: listAgents2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
   await initRuntime2();
-  const workspace = path72.resolve(flags.workspace ?? process.cwd());
+  const workspace = path73.resolve(flags.workspace ?? process.cwd());
   const agents = await listAgents2(workspace);
   if (agents.length === 0) {
     process.stderr.write("No agents found.\n");
@@ -33104,7 +33125,7 @@ async function cmdAgents(flags) {
 async function cmdSessions(flags) {
   const { initRuntime: initRuntime2, listSessions: listSessions2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
   await initRuntime2();
-  const workspace = path72.resolve(flags.workspace ?? process.cwd());
+  const workspace = path73.resolve(flags.workspace ?? process.cwd());
   const sessions = listSessions2(workspace);
   if (sessions.length === 0) {
     process.stderr.write("No sessions found.\n");
@@ -33217,8 +33238,8 @@ ${stdinContent}` : stdinContent;
     harness.destroy();
   }
 }
-var SERVER_LOCK_PATH = path72.join(homedir25(), ".halo", "global", "server.lock");
-var SERVER_LOG_PATH = path72.join(homedir25(), ".halo", "logs", "server.log");
+var SERVER_LOCK_PATH = path73.join(homedir25(), ".halo", "global", "server.lock");
+var SERVER_LOG_PATH = path73.join(homedir25(), ".halo", "logs", "server.log");
 function readServerPid() {
   try {
     const txt = fs64.readFileSync(SERVER_LOCK_PATH, "utf-8").trim();
@@ -33308,7 +33329,7 @@ async function cmdServerStart(argv, _unused) {
     return;
   }
   const { spawn: spawn5 } = await import("node:child_process");
-  fs64.mkdirSync(path72.dirname(SERVER_LOG_PATH), { recursive: true });
+  fs64.mkdirSync(path73.dirname(SERVER_LOG_PATH), { recursive: true });
   const out = fs64.openSync(SERVER_LOG_PATH, "a");
   const child = spawn5(process.argv[0], [process.argv[1], "server", "start"], {
     detached: true,
@@ -33428,7 +33449,7 @@ function exitMissingSetup() {
   process.exit(1);
 }
 function isHaloHomeReady() {
-  return fs64.existsSync(path72.join(homedir25(), ".halo", "global", ".template-version"));
+  return fs64.existsSync(path73.join(homedir25(), ".halo", "global", ".template-version"));
 }
 async function main2() {
   const argv = process.argv.slice(2);