@turmind/halo 2.0.2 → 2.0.3

package/dist/index.js

@@ -1921,7 +1921,7 @@ var init_init = __esm({
       path8.resolve(__dirname, "..", "bundled-docs"),
       path8.resolve(__dirname, "..", "..", "..", ".halo", "docs")
     ];
-    TEMPLATE_VERSION = 108;
+    TEMPLATE_VERSION = 109;
     VERSION_FILE = ".template-version";
     SKIP_NAMES = /* @__PURE__ */ new Set([".DS_Store", "schema.sql", "__pycache__", ".pytest_cache"]);
     BUILTIN_AGENT_IDS = /* @__PURE__ */ new Set([
@@ -2542,11 +2542,40 @@ var init_skill_sources = __esm({
   }
 });
 
-// ../server/dist/settings-schema.js
+// ../server/dist/a2a/remotes.js
 import fs10 from "node:fs";
 import path12 from "node:path";
-import { homedir as homedir7 } from "node:os";
 import YAML4 from "yaml";
+function remotesFile() {
+  return path12.join(secretsDir(), "a2a-remotes.yaml");
+}
+function loadRemotes() {
+  let doc;
+  try {
+    doc = YAML4.parse(fs10.readFileSync(remotesFile(), "utf8")) ?? {};
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const [name, r] of Object.entries(doc.remotes ?? {})) {
+    if (!r?.card)
+      continue;
+    out[name] = { name, card: r.card, auth: r.auth === "sigv4" ? "sigv4" : "bearer", pushBase: r.push_base?.replace(/\/+$/, "") };
+  }
+  return out;
+}
+var init_remotes = __esm({
+  "../server/dist/a2a/remotes.js"() {
+    "use strict";
+    init_paths();
+  }
+});
+
+// ../server/dist/settings-schema.js
+import fs11 from "node:fs";
+import path13 from "node:path";
+import { homedir as homedir7 } from "node:os";
+import YAML5 from "yaml";
 function generalSection() {
   return {
     namespaceId: "general",
@@ -2633,11 +2662,11 @@ function generalSection() {
 }
 function readYamlFile(p) {
   try {
-    const { mtimeMs } = fs10.statSync(p);
+    const { mtimeMs } = fs11.statSync(p);
     const hit = _yamlCache.get(p, mtimeMs);
     if (hit !== void 0)
       return hit;
-    const parsed = YAML4.parse(fs10.readFileSync(p, "utf-8"));
+    const parsed = YAML5.parse(fs11.readFileSync(p, "utf-8"));
     return _yamlCache.set(p, mtimeMs, parsed && typeof parsed === "object" ? parsed : null);
   } catch {
     return null;
@@ -2691,8 +2720,8 @@ function providerSections() {
   return sections;
 }
 function buildSkillSection(skillsDir, skillId) {
-  const configPath = path12.join(skillsDir, skillId, "config.yaml");
-  if (!fs10.existsSync(configPath))
+  const configPath = path13.join(skillsDir, skillId, "config.yaml");
+  if (!fs11.existsSync(configPath))
     return null;
   const parsed = readYamlFile(configPath);
   if (!parsed)
@@ -2703,11 +2732,11 @@ function buildSkillSection(skillsDir, skillId) {
     return null;
   let displayName = skillId;
   try {
-    const mdPath = path12.join(skillsDir, skillId, "SKILL.md");
-    const { mtimeMs } = fs10.statSync(mdPath);
+    const mdPath = path13.join(skillsDir, skillId, "SKILL.md");
+    const { mtimeMs } = fs11.statSync(mdPath);
     let name = _skillNameCache.get(mdPath, mtimeMs);
     if (name === void 0) {
-      const m = fs10.readFileSync(mdPath, "utf-8").match(/^---\s*\n([\s\S]*?)\n---/);
+      const m = fs11.readFileSync(mdPath, "utf-8").match(/^---\s*\n([\s\S]*?)\n---/);
       const nameMatch = m?.[1].match(/^name:\s*(.+)$/m);
       name = _skillNameCache.set(mdPath, mtimeMs, nameMatch ? nameMatch[1].trim() : null);
     }
@@ -2728,7 +2757,7 @@ function buildSkillSection(skillsDir, skillId) {
 function skillSections(workspaceRoot) {
   const byId = /* @__PURE__ */ new Map();
   for (const { id, dir } of listSkillDirs(workspaceRoot).reverse()) {
-    const section = buildSkillSection(path12.dirname(dir), id);
+    const section = buildSkillSection(path13.dirname(dir), id);
     if (section)
       byId.set(section.namespaceId, section);
   }
@@ -2738,7 +2767,7 @@ function agentSections() {
   const sections = [];
   let entries = [];
   try {
-    entries = fs10.readdirSync(GLOBAL_AGENTS_DIR, { withFileTypes: true });
+    entries = fs11.readdirSync(GLOBAL_AGENTS_DIR, { withFileTypes: true });
   } catch {
     return sections;
   }
@@ -2746,8 +2775,8 @@ function agentSections() {
     if (!entry.isDirectory())
       continue;
     const agentId = entry.name;
-    const configPath = path12.join(GLOBAL_AGENTS_DIR, agentId, "agent-config.yaml");
-    if (!fs10.existsSync(configPath))
+    const configPath = path13.join(GLOBAL_AGENTS_DIR, agentId, "agent-config.yaml");
+    if (!fs11.existsSync(configPath))
       continue;
     const parsed = readYamlFile(configPath);
     if (!parsed)
@@ -2758,7 +2787,7 @@ function agentSections() {
       continue;
     let displayName = agentId;
     try {
-      const ay = readYamlFile(path12.join(GLOBAL_AGENTS_DIR, agentId, "agent.yaml"));
+      const ay = readYamlFile(path13.join(GLOBAL_AGENTS_DIR, agentId, "agent.yaml"));
       if (ay && typeof ay.name === "string")
         displayName = ay.name;
     } catch {
@@ -2776,7 +2805,27 @@ function agentSections() {
   return sections;
 }
 function loadSettingsSchema(workspaceRoot) {
-  return [generalSection(), ...providerSections(), ...skillSections(workspaceRoot), ...agentSections(), ...extensionSections()];
+  return [generalSection(), ...a2aSections(), ...providerSections(), ...skillSections(workspaceRoot), ...agentSections(), ...extensionSections()];
+}
+function a2aSections() {
+  const fields = Object.values(loadRemotes()).filter((r) => r.auth === "bearer").map((r) => ({
+    key: r.name,
+    kind: "secret",
+    secret: true,
+    description: `Bearer token for the A2A remote "${r.name}" (card: ${r.card}).`,
+    description_zh: `A2A \u8FDC\u7A0B "${r.name}" \u7684 bearer token\uFF08card\uFF1A${r.card}\uFF09\u3002`
+  }));
+  if (fields.length === 0)
+    return [];
+  return [{
+    namespaceId: "a2a",
+    source: "general",
+    displayName: "A2A remotes",
+    displayName_zh: "A2A \u8FDC\u7A0B",
+    description: "Tokens for the bearer remotes in ~/.halo/secrets/a2a-remotes.yaml. Prefer global: non-full sessions can read the workspace settings.yaml.",
+    description_zh: "~/.halo/secrets/a2a-remotes.yaml \u4E2D bearer \u8FDC\u7A0B\u7684 token\u3002\u5EFA\u8BAE\u8BBE\u5728\u5168\u5C40\uFF1A\u975E full \u4F1A\u8BDD\u53EF\u4EE5\u8BFB\u53D6\u5DE5\u4F5C\u533A\u7684 settings.yaml\u3002",
+    fields
+  }];
 }
 function extensionSections() {
   const sections = [];
@@ -2812,7 +2861,8 @@ var init_settings_schema = __esm({
     init_registry2();
     init_skill_sources();
     init_mtime_cache();
-    GLOBAL_AGENTS_DIR = path12.join(homedir7(), ".halo", "global", "agents");
+    init_remotes();
+    GLOBAL_AGENTS_DIR = path13.join(homedir7(), ".halo", "global", "agents");
     DEFAULT_A2A_URL_ALLOWLIST = "100.64.0.0/10,*.ts.net";
     DEFAULT_FILES_SUMMARY = DEFAULT_HIDDEN_FILES.filter((f) => !/-(wal|shm)$/.test(f)).join(", ");
     _yamlCache = createMtimeCache();
@@ -2847,14 +2897,14 @@ __export(config_exports, {
   resolveThinkingMode: () => resolveThinkingMode,
   resolveVerbosity: () => resolveVerbosity
 });
-import fs11 from "node:fs";
-import path13 from "node:path";
+import fs12 from "node:fs";
+import path14 from "node:path";
 import { homedir as homedir8 } from "node:os";
-import YAML5 from "yaml";
+import YAML6 from "yaml";
 function loadYamlFile(filePath) {
   try {
-    const raw = fs11.readFileSync(filePath, "utf-8");
-    return YAML5.parse(raw) ?? {};
+    const raw = fs12.readFileSync(filePath, "utf-8");
+    return YAML6.parse(raw) ?? {};
   } catch {
     return {};
   }
@@ -2873,7 +2923,7 @@ function invalidateModelsRegistry() {
 function getSystemConfig() {
   let mtimeMs = 0;
   try {
-    mtimeMs = fs11.statSync(SYSTEM_CONFIG_PATH).mtimeMs;
+    mtimeMs = fs12.statSync(SYSTEM_CONFIG_PATH).mtimeMs;
   } catch {
   }
   if (!_systemConfigCache || _systemConfigCache.mtimeMs !== mtimeMs) {
@@ -2884,7 +2934,7 @@ function getSystemConfig() {
 function getSettings() {
   let mtimeMs = 0;
   try {
-    mtimeMs = fs11.statSync(SETTINGS_PATH).mtimeMs;
+    mtimeMs = fs12.statSync(SETTINGS_PATH).mtimeMs;
   } catch {
   }
   if (!_settingsCache || _settingsCache.mtimeMs !== mtimeMs) {
@@ -3026,10 +3076,10 @@ function missingEnvRefs(raw) {
   return [...new Set([...raw.matchAll(ENV_PATTERN2)].map((m) => m[1]))].filter((name) => process.env[name] === void 0);
 }
 function getWorkspaceSettings(workspaceRoot) {
-  const p = path13.join(workspaceRoot, ".halo", "settings.yaml");
+  const p = path14.join(workspaceRoot, ".halo", "settings.yaml");
   let mtimeMs = 0;
   try {
-    mtimeMs = fs11.statSync(p).mtimeMs;
+    mtimeMs = fs12.statSync(p).mtimeMs;
   } catch {
   }
   const hit = _wsSettingsCache.get(workspaceRoot);
@@ -3143,13 +3193,13 @@ var init_config = __esm({
     init_settings_schema();
     init_sandbox();
     init_registry();
-    HALO_HOME3 = path13.join(homedir8(), ".halo");
-    HALO_GLOBAL_DIR = path13.join(HALO_HOME3, "global");
-    HALO_SECRETS_DIR = path13.join(HALO_HOME3, "secrets");
+    HALO_HOME3 = path14.join(homedir8(), ".halo");
+    HALO_GLOBAL_DIR = path14.join(HALO_HOME3, "global");
+    HALO_SECRETS_DIR = path14.join(HALO_HOME3, "secrets");
     _modelsRegistryCache = null;
-    SYSTEM_CONFIG_PATH = path13.join(HALO_SECRETS_DIR, "config.yaml");
+    SYSTEM_CONFIG_PATH = path14.join(HALO_SECRETS_DIR, "config.yaml");
     _systemConfigCache = null;
-    SETTINGS_PATH = path13.join(HALO_SECRETS_DIR, "settings.yaml");
+    SETTINGS_PATH = path14.join(HALO_SECRETS_DIR, "settings.yaml");
     _settingsCache = null;
     _schemaDefaultsCache = null;
     ENV_PATTERN2 = /<<([A-Z_][A-Z0-9_]*)>>/g;
@@ -4017,31 +4067,31 @@ Error: tool "${tu.name}" was not run \u2014 the turn was interrupted before this
 });
 
 // ../server/dist/agents/agent-loader.js
-import fs12 from "node:fs/promises";
+import fs13 from "node:fs/promises";
 import fsSync2 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 import { homedir as homedir9 } from "node:os";
-import YAML6 from "yaml";
+import YAML7 from "yaml";
 function canDelegate(yaml) {
   return !yaml?.internal && (yaml?.team?.length ?? 0) > 0;
 }
 function agentSourceDir(agentId, workspaceRoot) {
   if (workspaceRoot) {
-    const wsDir = path14.join(workspaceRoot, ".halo", "agents", agentId);
+    const wsDir = path15.join(workspaceRoot, ".halo", "agents", agentId);
     if (fsSync2.existsSync(wsDir))
       return wsDir;
   }
-  return path14.join(GLOBAL_AGENTS_DIR2, agentId);
+  return path15.join(GLOBAL_AGENTS_DIR2, agentId);
 }
 function isAgentDisabled(agentId, workspaceRoot, disabledSet) {
-  const scope = workspaceRoot && fsSync2.existsSync(path14.join(workspaceRoot, ".halo", "agents", agentId)) ? "workspace" : "global";
+  const scope = workspaceRoot && fsSync2.existsSync(path15.join(workspaceRoot, ".halo", "agents", agentId)) ? "workspace" : "global";
   return disabledSet.has(`${scope}:${agentId}`);
 }
 async function loadAgentYaml(agentId, workspaceRoot) {
-  const yamlPath = path14.join(agentSourceDir(agentId, workspaceRoot), "agent.yaml");
+  const yamlPath = path15.join(agentSourceDir(agentId, workspaceRoot), "agent.yaml");
   try {
-    const content = await fs12.readFile(yamlPath, "utf-8");
-    const parsed = YAML6.parse(content);
+    const content = await fs13.readFile(yamlPath, "utf-8");
+    const parsed = YAML7.parse(content);
     if (parsed === null || typeof parsed !== "object") {
       console.warn(`[AgentLoader] Failed to parse ${yamlPath}: empty or non-object YAML`);
       return null;
@@ -4070,7 +4120,7 @@ function parseSkillFrontmatter(raw) {
   let doc = {};
   const parseYaml = (block) => {
     try {
-      const parsed = YAML6.parse(block);
+      const parsed = YAML7.parse(block);
       if (parsed && typeof parsed === "object")
         doc = parsed;
       return true;
@@ -4110,7 +4160,7 @@ function resolveSkillPath(skillId, workspaceRoot) {
   const dir = skillSourceDir(skillId, workspaceRoot);
   if (!dir)
     return null;
-  const p = path14.join(dir, "SKILL.md");
+  const p = path15.join(dir, "SKILL.md");
   try {
     fsSync2.accessSync(p);
     return p;
@@ -4128,7 +4178,7 @@ async function loadSkillMetadata(skillIds, workspaceRoot, disabledSet, accessLev
     if (!mdPath)
       continue;
     try {
-      const raw = await fs12.readFile(mdPath, "utf-8");
+      const raw = await fs13.readFile(mdPath, "utf-8");
       const { name, description, command, requiresAccess, disableModelInvocation } = parseSkillFrontmatter(raw);
       if (requiresAccess && ACCESS_RANK[requiresAccess] > sessionRank)
         continue;
@@ -4187,9 +4237,9 @@ function createSkillTool(skills, ctx = {}) {
         return `${TOOL_WARN_MARKER}
 Error: skill "${skill_id}" not found. Available: ${skills.map((s) => s.id).join(", ")}`;
       try {
-        const raw = await fs12.readFile(meta.path, "utf-8");
+        const raw = await fs13.readFile(meta.path, "utf-8");
         const { body } = parseSkillFrontmatter(raw);
-        const skillDir = path14.dirname(meta.path);
+        const skillDir = path15.dirname(meta.path);
         const qualifiedBody = body.replace(/\{\{\s*params\.([\w-][\w.-]*)\s*\}\}/g, (_m, key) => `{{${skill_id}.params.${key}}}`);
         const { buildRenderContext: buildRenderContext2, renderMdBody: renderMdBody2 } = await Promise.resolve().then(() => (init_md_vars(), md_vars_exports));
         const renderCtx = await buildRenderContext2({
@@ -4202,9 +4252,9 @@ Error: skill "${skill_id}" not found. Available: ${skills.map((s) => s.id).join(
         const renderedBody = renderMdBody2(qualifiedBody, renderCtx);
         let resources = "";
         try {
-          const entries = await fs12.readdir(skillDir, { recursive: true, withFileTypes: true });
+          const entries = await fs13.readdir(skillDir, { recursive: true, withFileTypes: true });
           const files = entries.filter((e) => e.isFile() && e.name !== "SKILL.md").map((e) => {
-            const rel = e.parentPath ? path14.relative(skillDir, path14.join(e.parentPath, e.name)) : e.name;
+            const rel = e.parentPath ? path15.relative(skillDir, path15.join(e.parentPath, e.name)) : e.name;
             return rel;
           });
           if (files.length > 0)
@@ -4226,12 +4276,12 @@ ${renderedBody}${resources}`;
 async function scanAvailableAgents(workspaceRoot, disabledSet) {
   const agents = [];
   try {
-    const globalNames = await fs12.readdir(GLOBAL_AGENTS_DIR2);
+    const globalNames = await fs13.readdir(GLOBAL_AGENTS_DIR2);
     for (const name of globalNames) {
-      const yamlPath = path14.join(GLOBAL_AGENTS_DIR2, name, "agent.yaml");
+      const yamlPath = path15.join(GLOBAL_AGENTS_DIR2, name, "agent.yaml");
       try {
-        const content = await fs12.readFile(yamlPath, "utf-8");
-        const cfg = YAML6.parse(content);
+        const content = await fs13.readFile(yamlPath, "utf-8");
+        const cfg = YAML7.parse(content);
         agents.push({
           id: name,
           name: cfg.name ?? name,
@@ -4250,14 +4300,14 @@ async function scanAvailableAgents(workspaceRoot, disabledSet) {
   } catch {
   }
   if (workspaceRoot) {
-    const wsAgentsDir = path14.join(workspaceRoot, ".halo", "agents");
+    const wsAgentsDir = path15.join(workspaceRoot, ".halo", "agents");
     try {
-      const wsNames = await fs12.readdir(wsAgentsDir);
+      const wsNames = await fs13.readdir(wsAgentsDir);
       for (const name of wsNames) {
-        const yamlPath = path14.join(wsAgentsDir, name, "agent.yaml");
+        const yamlPath = path15.join(wsAgentsDir, name, "agent.yaml");
         try {
-          const content = await fs12.readFile(yamlPath, "utf-8");
-          const cfg = YAML6.parse(content);
+          const content = await fs13.readFile(yamlPath, "utf-8");
+          const cfg = YAML7.parse(content);
           agents.push({
             id: name,
             name: cfg.name ?? name,
@@ -4294,7 +4344,7 @@ var init_agent_loader = __esm({
     init_agent_loop();
     init_skill_sources();
     init_skill_sources();
-    GLOBAL_AGENTS_DIR2 = path14.join(homedir9(), ".halo", "global", "agents");
+    GLOBAL_AGENTS_DIR2 = path15.join(homedir9(), ".halo", "global", "agents");
     ACCESS_RANK = {
       readonly: 0,
       observer: 0,
@@ -4305,7 +4355,7 @@ var init_agent_loader = __esm({
 });
 
 // ../server/dist/ws/broadcast.js
-import path15 from "node:path";
+import path16 from "node:path";
 function setBroadcastWss(wss2) {
   _wss = wss2;
 }
@@ -4332,14 +4382,14 @@ function broadcastToWorkspace(workspacePath, event) {
     return;
   if (!_workspaceOfClient)
     return broadcast(event);
-  const target = path15.resolve(workspacePath);
+  const target = path16.resolve(workspacePath);
   const payload = JSON.stringify(event);
   for (const client of _wss.clients) {
     const ws = client;
     if (ws.readyState !== ws.OPEN)
       continue;
     const bound = _workspaceOfClient(ws);
-    if (!bound || path15.resolve(bound) !== target)
+    if (!bound || path16.resolve(bound) !== target)
       continue;
     try {
       ws.send(payload);
@@ -4438,12 +4488,12 @@ var init_migrate = __esm({
 });
 
 // ../server/dist/db/durability.js
-import path16 from "node:path";
+import path17 from "node:path";
 function setDurableDbDir(dir) {
-  durableDir = dir === null ? null : path16.resolve(dir);
+  durableDir = dir === null ? null : path17.resolve(dir);
 }
 function applyCommitDurability(sqlite, dataDir) {
-  if (durableDir !== null && path16.resolve(dataDir) === durableDir)
+  if (durableDir !== null && path17.resolve(dataDir) === durableDir)
     sqlite.pragma("synchronous = FULL");
 }
 var durableDir;
@@ -4458,17 +4508,17 @@ var init_durability = __esm({
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { eq, and, sql } from "drizzle-orm";
-import path17 from "node:path";
-import fs13 from "node:fs";
+import path18 from "node:path";
+import fs14 from "node:fs";
 function createDb(dataDir) {
-  fs13.mkdirSync(dataDir, { recursive: true });
-  const dbPath = path17.join(dataDir, "halo.db");
+  fs14.mkdirSync(dataDir, { recursive: true });
+  const dbPath = path18.join(dataDir, "halo.db");
   const sqlite = new Database(dbPath);
   sqlite.pragma("journal_mode = WAL");
   applyCommitDurability(sqlite, dataDir);
   sqlite.pragma("foreign_keys = ON");
   const db4 = drizzle(sqlite, { schema: schema_exports });
-  const schemaSql = fs13.readFileSync(SCHEMA_SQL_PATH, "utf-8");
+  const schemaSql = fs14.readFileSync(SCHEMA_SQL_PATH, "utf-8");
   sqlite.exec(schemaSql);
   runMigrations(sqlite, HALO_MIGRATIONS);
   return db4;
@@ -4499,7 +4549,7 @@ function updateSessionOutput(db4, sessionId, output, lastActivityAt) {
   db4.update(agentSessions).set({ output, lastActivityAt }).where(and(eq(agentSessions.id, sessionId), sql`(${agentSessions.output} IS NOT ${output} OR ${agentSessions.lastActivityAt} IS NOT ${lastActivityAt})`)).run();
 }
 function openHaloDb(dataDir) {
-  const key = path17.resolve(dataDir);
+  const key = path18.resolve(dataDir);
   let db4 = haloDbCache.get(key);
   if (!db4) {
     db4 = createDb(key);
@@ -4511,11 +4561,11 @@ function internalSessionsDb() {
   return openHaloDb(globalInternalSessionsDir());
 }
 function getWorkspaceDb(workspacePath) {
-  const resolved = fs13.realpathSync(workspacePath);
+  const resolved = fs14.realpathSync(workspacePath);
   ensureWorkspaceHalo(resolved);
   let db4 = dbCache.get(resolved);
   if (!db4) {
-    const haloDir = path17.join(resolved, ".halo");
+    const haloDir = path18.join(resolved, ".halo");
     db4 = createDb(haloDir);
     dbCache.set(resolved, db4);
   }
@@ -4544,7 +4594,7 @@ var init_db = __esm({
     init_paths();
     init_migrate();
     init_durability();
-    SCHEMA_SQL_PATH = path17.join(TEMPLATES_DIR, "schema.sql");
+    SCHEMA_SQL_PATH = path18.join(TEMPLATES_DIR, "schema.sql");
     HALO_MIGRATIONS = [
       // v1: everything that used to be an ad-hoc boot-time ALTER / CREATE INDEX.
       (s) => {
@@ -4895,7 +4945,7 @@ var init_session_tools = __esm({
 
 // ../server/dist/sessions/session-archive.js
 import fsSync3 from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 import { createHash } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
 function firstIdHash(id) {
@@ -4937,7 +4987,7 @@ function countArchiveSegments(dir, seg) {
 }
 function readSegmentFile(dir, s) {
   try {
-    const text6 = gunzipSync(fsSync3.readFileSync(path18.join(dir, s.name))).toString("utf-8");
+    const text6 = gunzipSync(fsSync3.readFileSync(path19.join(dir, s.name))).toString("utf-8");
     const out = [];
     for (const line of text6.split("\n"))
       if (line)
@@ -4956,13 +5006,13 @@ function writeArchiveSegment(dir, seg, n, messages2) {
   for (const s of listSegmentFiles(dir, seg)) {
     if (s.n >= n) {
       try {
-        fsSync3.unlinkSync(path18.join(dir, s.name));
+        fsSync3.unlinkSync(path19.join(dir, s.name));
       } catch {
       }
     }
   }
   const body = messages2.map((m) => JSON.stringify(m)).join("\n") + "\n";
-  atomicWriteFileSync(path18.join(dir, `${seg}.ui.arch.${n}.${firstIdHash(messages2[0].id)}.jsonl.gz`), gzipSync(body));
+  atomicWriteFileSync(path19.join(dir, `${seg}.ui.arch.${n}.${firstIdHash(messages2[0].id)}.jsonl.gz`), gzipSync(body));
 }
 function isCompactSummary(m) {
   return m.compactSummary === true || m.content.startsWith("[Conversation Summary \u2014 ");
@@ -4994,17 +5044,17 @@ __export(legacy_migrate_exports, {
   migrateWorkspaceSessions: () => migrateWorkspaceSessions
 });
 import fsSync4 from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 import { gunzipSync as gunzipSync2 } from "node:zlib";
 import { eq as eq2 } from "drizzle-orm";
 function isInternalDir(dir) {
-  return path19.resolve(path19.dirname(dir)) === path19.resolve(globalInternalSessionsDir());
+  return path20.resolve(path20.dirname(dir)) === path20.resolve(globalInternalSessionsDir());
 }
 function legacySegmentPath(dir, seg, n) {
-  return path19.join(dir, `${seg}.arch.${n}.json.gz`);
+  return path20.join(dir, `${seg}.arch.${n}.json.gz`);
 }
 function readLegacy(dir, seg) {
-  const data = JSON.parse(fsSync4.readFileSync(path19.join(dir, `${seg}.json`), "utf-8"));
+  const data = JSON.parse(fsSync4.readFileSync(path20.join(dir, `${seg}.json`), "utf-8"));
   const committed = typeof data.archiveCount === "number" ? data.archiveCount : 0;
   const segs = [];
   const unreadable = [];
@@ -5028,8 +5078,8 @@ function readLegacy(dir, seg) {
 function dbForSessionDir(dir) {
   if (isInternalDir(dir))
     return internalSessionsDb();
-  const haloDir = path19.dirname(path19.dirname(dir));
-  return fsSync4.existsSync(path19.join(haloDir, "halo.db")) ? openHaloDb(haloDir) : null;
+  const haloDir = path20.dirname(path20.dirname(dir));
+  return fsSync4.existsSync(path20.join(haloDir, "halo.db")) ? openHaloDb(haloDir) : null;
 }
 function mainUsers(messages2) {
   let n = 0;
@@ -5054,8 +5104,8 @@ function backfillRow(dir, seg, legacy) {
     db4.insert(agentSessions).values({
       id,
       parentId: data.parentSessionId ?? null,
-      agentId: path19.basename(dir),
-      agentName: data.agentName ?? path19.basename(dir),
+      agentId: path20.basename(dir),
+      agentName: data.agentName ?? path20.basename(dir),
       description: data.description ?? data.title ?? "",
       createdAt: created,
       updatedAt: toMs(data.updatedAt, created)
@@ -5132,16 +5182,16 @@ function deleteLegacyFiles(dir, seg, legacy) {
   for (const name of fsSync4.readdirSync(dir)) {
     const hit = name === `${seg}.json` || name.startsWith(`${seg}.json.tmp.`) || /^\d+\.json\.gz$/.test(name.startsWith(`${seg}.arch.`) ? name.slice(seg.length + 6) : "");
     if (hit && !keep.has(name))
-      fsSync4.rmSync(path19.join(dir, name), { force: true });
+      fsSync4.rmSync(path20.join(dir, name), { force: true });
   }
   if (keep.size > 0)
-    console.warn(`[LegacyMigrate] ${path19.join(dir, seg)}: kept unreadable 1.x segment(s) ${legacy.unreadable.join(", ")}`);
+    console.warn(`[LegacyMigrate] ${path20.join(dir, seg)}: kept unreadable 1.x segment(s) ${legacy.unreadable.join(", ")}`);
 }
 function migrationLockPath(dir, seg) {
-  return path19.join(dir, `${seg}.migrating`);
+  return path20.join(dir, `${seg}.migrating`);
 }
 function conversionPending(dir, seg) {
-  return !fsSync4.existsSync(uiLogPath(dir, seg)) && fsSync4.existsSync(path19.join(dir, `${seg}.json`));
+  return !fsSync4.existsSync(uiLogPath(dir, seg)) && fsSync4.existsSync(path20.join(dir, `${seg}.json`));
 }
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -5201,7 +5251,7 @@ function takeOverLock(lock, deadPid) {
   console.warn(`[LegacyMigrate] ${lock}: took over from dead pid ${deadPid || "(none)"}`);
 }
 function conversionLanded(dir, seg) {
-  return fsSync4.existsSync(uiLogPath(dir, seg)) && !fsSync4.existsSync(path19.join(dir, `${seg}.json`));
+  return fsSync4.existsSync(uiLogPath(dir, seg)) && !fsSync4.existsSync(path20.join(dir, `${seg}.json`));
 }
 function acquireMigrationLock(dir, seg) {
   const lock = migrationLockPath(dir, seg);
@@ -5261,7 +5311,7 @@ function convertLocked(dir, seg) {
   }
   replaceUILog(uiLogPath(dir, seg), legacy.messages);
   const mismatch = verifyConverted(dir, seg, legacy);
-  if (mismatch && (!holdsMigrationLock(dir, seg) || !fsSync4.existsSync(path19.join(dir, `${seg}.json`)))) {
+  if (mismatch && (!holdsMigrationLock(dir, seg) || !fsSync4.existsSync(path20.join(dir, `${seg}.json`)))) {
     throw new Error(`check after conversion failed: ${mismatch}; lost the conversion lock \u2014 nothing undone`);
   }
   if (mismatch) {
@@ -5269,15 +5319,15 @@ function convertLocked(dir, seg) {
     fsSync4.rmSync(rawLogPath(dir, seg), { force: true });
     for (const name of fsSync4.readdirSync(dir)) {
       if (name.startsWith(`${seg}.ui.arch.`))
-        fsSync4.rmSync(path19.join(dir, name), { force: true });
+        fsSync4.rmSync(path20.join(dir, name), { force: true });
     }
     throw new Error(`check after conversion failed: ${mismatch}; 1.x files kept`);
   }
   deleteLegacyFiles(dir, seg, legacy);
-  console.log(`[LegacyMigrate] migrated ${path19.join(dir, seg)} (${legacy.messages.length} UI, ${legacy.raw.length} raw, ${legacy.segs.length} segment(s))`);
+  console.log(`[LegacyMigrate] migrated ${path20.join(dir, seg)} (${legacy.messages.length} UI, ${legacy.raw.length} raw, ${legacy.segs.length} segment(s))`);
 }
 function cleanUpLegacy(dir, seg) {
-  const pending = () => fsSync4.existsSync(uiLogPath(dir, seg)) && fsSync4.existsSync(path19.join(dir, `${seg}.json`));
+  const pending = () => fsSync4.existsSync(uiLogPath(dir, seg)) && fsSync4.existsSync(path20.join(dir, `${seg}.json`));
   return underMigrationLock(dir, seg, pending, () => {
     const legacy = readLegacy(dir, seg);
     const mismatch = verifyPreserved(dir, seg, legacy);
@@ -5287,18 +5337,18 @@ function cleanUpLegacy(dir, seg) {
   });
 }
 function migrateOnMissingLog(filePath) {
-  const m = /^(.*)\.(?:ui|raw)\.jsonl$/.exec(path19.basename(filePath));
+  const m = /^(.*)\.(?:ui|raw)\.jsonl$/.exec(path20.basename(filePath));
   if (!m)
     return false;
-  const dir = path19.dirname(filePath);
+  const dir = path20.dirname(filePath);
   const seg = m[1];
-  if (fsSync4.existsSync(uiLogPath(dir, seg)) || !fsSync4.existsSync(path19.join(dir, `${seg}.json`)))
+  if (fsSync4.existsSync(uiLogPath(dir, seg)) || !fsSync4.existsSync(path20.join(dir, `${seg}.json`)))
     return false;
   try {
     migrateLegacySession(dir, seg);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
-    const key = path19.join(dir, seg);
+    const key = path20.join(dir, seg);
     if (!loggedFailures.has(key)) {
       loggedFailures.add(key);
       console.error(`[LegacyMigrate] ${key}: ${reason}`);
@@ -5318,7 +5368,7 @@ function isPidAlive(pid) {
 function liveRuntimeHolder(root) {
   let pid = 0;
   try {
-    pid = parseInt(fsSync4.readFileSync(path19.join(root, ".halo", "runtime.lock"), "utf-8").trim(), 10) || 0;
+    pid = parseInt(fsSync4.readFileSync(path20.join(root, ".halo", "runtime.lock"), "utf-8").trim(), 10) || 0;
   } catch {
     return null;
   }
@@ -5365,12 +5415,12 @@ function migrateWorkspaceSessions(root) {
     throw new Error(`A server (pid ${holder}) is running on this workspace. Stop it first (\`halo server stop\`, or \`systemctl --user stop halo\` under systemd), migrate, then start it again. Also stop any other server that has this workspace open (e.g. a HALO_BADGE=DEV instance) \u2014 it doesn't hold runtime.lock.`);
   }
   const out = { migrated: 0, cleaned: 0, skipped: 0, failed: [] };
-  const sessions = path19.join(root, ".halo", "sessions");
+  const sessions = path20.join(root, ".halo", "sessions");
   for (const agent of agentDirs(sessions))
-    migrateDir(path19.join(sessions, agent), agent, out);
+    migrateDir(path20.join(sessions, agent), agent, out);
   const internal = globalInternalSessionsDir();
   for (const agent of agentDirs(internal))
-    migrateDir(path19.join(internal, agent), agent, out);
+    migrateDir(path20.join(internal, agent), agent, out);
   return out;
 }
 var MIGRATION_LOCK_WAIT_MS, MIGRATION_LOCK_STEP_MS, LegacyConversionError, loggedFailures;
@@ -5392,12 +5442,12 @@ var init_legacy_migrate = __esm({
 
 // ../server/dist/sessions/session-log.js
 import fsSync5 from "node:fs";
-import path20 from "node:path";
+import path21 from "node:path";
 function uiLogPath(dir, seg) {
-  return path20.join(dir, `${seg}.ui.jsonl`);
+  return path21.join(dir, `${seg}.ui.jsonl`);
 }
 function rawLogPath(dir, seg) {
-  return path20.join(dir, `${seg}.raw.jsonl`);
+  return path21.join(dir, `${seg}.raw.jsonl`);
 }
 function openOrNull(filePath) {
   try {
@@ -5671,7 +5721,7 @@ function writeUILog(filePath, rows, inflight, opts) {
       out2 += inflightLine(inflight, 0, shell);
       inflightCache2 = inflightCacheOf(inflight, JSON.stringify(shell));
     }
-    fsSync5.mkdirSync(path20.dirname(filePath), { recursive: true });
+    fsSync5.mkdirSync(path21.dirname(filePath), { recursive: true });
     const stamp = rewriteAndStamp(filePath, out2);
     uiCaches.set(filePath, uiCacheOf(stamp, rows, usersAfter, inflightCache2));
     return { userDelta: usersAfter - usersBefore, size: stamp.size, foreign };
@@ -5727,7 +5777,7 @@ function writeUILog(filePath, rows, inflight, opts) {
   return { userDelta: usersAfter - usersBefore, size: c.stamp.size, foreign: false };
 }
 function replaceUILog(filePath, rows) {
-  fsSync5.mkdirSync(path20.dirname(filePath), { recursive: true });
+  fsSync5.mkdirSync(path21.dirname(filePath), { recursive: true });
   atomicWriteFileSync(filePath, rows.map(addLine).join(""));
   uiCaches.delete(filePath);
 }
@@ -5810,7 +5860,7 @@ function writeRawLog(filePath, messages2) {
   }
   if (full) {
     const { out: out2, lastStart: lastStart2 } = rawLines(messages2);
-    fsSync5.mkdirSync(path20.dirname(filePath), { recursive: true });
+    fsSync5.mkdirSync(path21.dirname(filePath), { recursive: true });
     rawCaches.set(filePath, rawCacheOf(rewriteAndStamp(filePath, out2), messages2, lastStart2));
     return foreign;
   }
@@ -5849,7 +5899,7 @@ function writeRawLog(filePath, messages2) {
   return false;
 }
 function replaceRawLog(filePath, messages2) {
-  fsSync5.mkdirSync(path20.dirname(filePath), { recursive: true });
+  fsSync5.mkdirSync(path21.dirname(filePath), { recursive: true });
   atomicWriteFileSync(filePath, messages2.map((m) => JSON.stringify(m) + "\n").join(""));
   rawCaches.delete(filePath);
 }
@@ -5881,8 +5931,8 @@ var init_session_log = __esm({
 });
 
 // ../server/dist/sessions/session-store.js
-import fs14 from "node:fs/promises";
-import path21 from "node:path";
+import fs15 from "node:fs/promises";
+import path22 from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { and as and2, eq as eq3, gte, inArray, lt, or } from "drizzle-orm";
 function isInternalAgent(agentId) {
@@ -5893,14 +5943,14 @@ function sessionMetaDb(workspaceDb, agentId) {
 }
 function getSessionDir(agentId, projectPath) {
   if (isInternalAgent(agentId)) {
-    return path21.join(homedir10(), ".halo", "global", "internal-sessions", agentId);
+    return path22.join(homedir10(), ".halo", "global", "internal-sessions", agentId);
   }
-  const base = projectPath ? path21.join(projectPath, ".halo") : path21.join(homedir10(), ".halo");
-  return path21.join(base, "sessions", agentId);
+  const base = projectPath ? path22.join(projectPath, ".halo") : path22.join(homedir10(), ".halo");
+  return path22.join(base, "sessions", agentId);
 }
 function getSessionsBaseDir(projectPath) {
-  const base = projectPath ? path21.join(projectPath, ".halo") : path21.join(homedir10(), ".halo");
-  return path21.join(base, "sessions");
+  const base = projectPath ? path22.join(projectPath, ".halo") : path22.join(homedir10(), ".halo");
+  return path22.join(base, "sessions");
 }
 function fileSegment(sessionId) {
   const parts = sessionId.split(">");
@@ -5956,7 +6006,7 @@ function isSessionFile(name, seg) {
 async function deleteSessionFilesIn(dir, seg) {
   let names;
   try {
-    names = await fs14.readdir(dir);
+    names = await fs15.readdir(dir);
   } catch {
     return false;
   }
@@ -5965,7 +6015,7 @@ async function deleteSessionFilesIn(dir, seg) {
     if (!isSessionFile(name, seg))
       continue;
     try {
-      await fs14.rm(path21.join(dir, name));
+      await fs15.rm(path22.join(dir, name));
       hit = true;
     } catch {
     }
@@ -5975,7 +6025,7 @@ async function deleteSessionFilesIn(dir, seg) {
 }
 async function subdirs(base) {
   try {
-    return (await fs14.readdir(base, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => path21.join(base, d.name));
+    return (await fs15.readdir(base, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => path22.join(base, d.name));
   } catch {
     return [];
   }
@@ -5989,7 +6039,7 @@ async function findAndDeleteSessionFile(sessionId, projectPath) {
   const db4 = internalSessionsDb();
   const tree = db4.select({ id: agentSessions.id, agentId: agentSessions.agentId }).from(agentSessions).where(or(eq3(agentSessions.id, sessionId), and2(gte(agentSessions.id, sessionId + ">"), lt(agentSessions.id, sessionId + ">\uFFFF")))).all();
   for (const r of tree)
-    await deleteSessionFilesIn(path21.join(globalInternalSessionsDir(), r.agentId), fileSegment(r.id));
+    await deleteSessionFilesIn(path22.join(globalInternalSessionsDir(), r.agentId), fileSegment(r.id));
   if (tree.length > 0) {
     db4.delete(agentSessions).where(inArray(agentSessions.id, tree.map((r) => r.id))).run();
     return;
@@ -6012,8 +6062,8 @@ var init_session_store = __esm({
 });
 
 // ../server/dist/agents/goal-mode.js
-import fs15 from "node:fs";
-import path22 from "node:path";
+import fs16 from "node:fs";
+import path23 from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { and as and3, eq as eq4, isNull, isNotNull } from "drizzle-orm";
 function initialGoalState(goalId, workerSessionId) {
@@ -6123,14 +6173,14 @@ function dissolveGoalBindingsFor(db4, ids) {
   }
 }
 function goalDir(workspaceRoot, goalId) {
-  return path22.join(workspaceRoot, ".halo", "goal", goalId);
+  return path23.join(workspaceRoot, ".halo", "goal", goalId);
 }
 function goalSpecPath(workspaceRoot, goalId) {
-  return path22.join(goalDir(workspaceRoot, goalId), "GOAL_SPEC.md");
+  return path23.join(goalDir(workspaceRoot, goalId), "GOAL_SPEC.md");
 }
 function hashFileOrNull(filePath) {
   try {
-    return createHash2("sha256").update(fs15.readFileSync(filePath)).digest("hex");
+    return createHash2("sha256").update(fs16.readFileSync(filePath)).digest("hex");
   } catch {
     return null;
   }
@@ -6362,8 +6412,8 @@ ${params.kickoff}`);
       }
       const n = s.delegatedCount + 1;
       const dir = goalDir(host.workspaceRoot, s.goalId);
-      fs15.mkdirSync(dir, { recursive: true });
-      fs15.writeFileSync(path22.join(dir, `decision-${n}.md`), [
+      fs16.mkdirSync(dir, { recursive: true });
+      fs16.writeFileSync(path23.join(dir, `decision-${n}.md`), [
         `# Delegated decision ${n}/${DELEGATED_DECISION_CAP}`,
         `- at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
         `- round: ${s.round}`,
@@ -6512,16 +6562,16 @@ var init_goal_mode = __esm({
 });
 
 // ../server/dist/agents/working-dir.js
-import path23 from "node:path";
-import fs16 from "node:fs/promises";
+import path24 from "node:path";
+import fs17 from "node:fs/promises";
 async function resolveWorkingDir(workspaceRoot, input) {
-  const resolved = path23.isAbsolute(input) ? path23.resolve(input) : path23.resolve(workspaceRoot, input);
-  const wsRoot = path23.resolve(workspaceRoot);
-  if (resolved !== wsRoot && !resolved.startsWith(wsRoot + path23.sep)) {
+  const resolved = path24.isAbsolute(input) ? path24.resolve(input) : path24.resolve(workspaceRoot, input);
+  const wsRoot = path24.resolve(workspaceRoot);
+  if (resolved !== wsRoot && !resolved.startsWith(wsRoot + path24.sep)) {
     throw new Error(`working_dir "${input}" is outside the workspace`);
   }
   try {
-    const stat = await fs16.stat(resolved);
+    const stat = await fs17.stat(resolved);
     if (!stat.isDirectory())
       throw new Error(`working_dir "${input}" is not a directory`);
   } catch (err) {
@@ -6538,27 +6588,27 @@ var init_working_dir = __esm({
 });
 
 // ../server/dist/ws/skills-changed.js
-import fs17 from "node:fs";
-import path24 from "node:path";
+import fs18 from "node:fs";
+import path25 from "node:path";
 function folderKey(root) {
-  const dir = path24.join(root, ".halo", "skills");
+  const dir = path25.join(root, ".halo", "skills");
   let ids;
   try {
-    ids = fs17.readdirSync(dir).sort();
+    ids = fs18.readdirSync(dir).sort();
   } catch {
     return "";
   }
   return ids.map((id) => {
     let fm = "";
     try {
-      fm = fs17.readFileSync(path24.join(dir, id, "SKILL.md"), "utf-8").match(/^---\s*\n([\s\S]*?)\n---/)?.[1] ?? "";
+      fm = fs18.readFileSync(path25.join(dir, id, "SKILL.md"), "utf-8").match(/^---\s*\n([\s\S]*?)\n---/)?.[1] ?? "";
     } catch {
     }
     return `${id}\0${fm}`;
   }).join("\n");
 }
 function skillFoldersChanged(root) {
-  const resolved = path24.resolve(root);
+  const resolved = path25.resolve(root);
   const key = folderKey(resolved);
   if (folderKeys.get(resolved) === key)
     return false;
@@ -6774,12 +6824,12 @@ var init_i18n = __esm({
 import Database2 from "better-sqlite3";
 import { drizzle as drizzle2 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable2, text as text2, integer as integer2 } from "drizzle-orm/sqlite-core";
-import path25 from "node:path";
-import fs18 from "node:fs";
+import path26 from "node:path";
+import fs19 from "node:fs";
 function createChannelDb(secretsDir2) {
-  const channelsDir = path25.join(secretsDir2, "channels");
-  fs18.mkdirSync(channelsDir, { recursive: true });
-  const dbPath = path25.join(channelsDir, "channels.db");
+  const channelsDir = path26.join(secretsDir2, "channels");
+  fs19.mkdirSync(channelsDir, { recursive: true });
+  const dbPath = path26.join(channelsDir, "channels.db");
   const sqlite = new Database2(dbPath);
   sqlite.pragma("journal_mode = WAL");
   sqlite.exec(CREATE_SQL);
@@ -6831,11 +6881,11 @@ CREATE INDEX IF NOT EXISTS idx_channel_accounts_type ON channel_accounts(channel
 });
 
 // ../server/dist/channels/shared/accounts.js
-import fs19 from "node:fs";
-import path26 from "node:path";
+import fs20 from "node:fs";
+import path27 from "node:path";
 import { eq as eq5, and as and4 } from "drizzle-orm";
 function resolveAccountWorkspace(account) {
-  if (!fs19.existsSync(account.workspacePath))
+  if (!fs20.existsSync(account.workspacePath))
     return null;
   ensureWorkspaceHalo(account.workspacePath);
   return account.workspacePath;
@@ -6851,9 +6901,9 @@ function accessLevelError(value, allowed) {
   return `accessLevel must be one of: ${allowed.join(", ")}`;
 }
 function validateWorkspaceBody(workspacePath) {
-  if (!path26.isAbsolute(workspacePath))
+  if (!path27.isAbsolute(workspacePath))
     return "workspacePath must be absolute";
-  if (!fs19.existsSync(workspacePath))
+  if (!fs20.existsSync(workspacePath))
     return "workspace path not found";
   ensureWorkspaceHalo(workspacePath);
   return null;
@@ -7096,17 +7146,17 @@ var init_commands = __esm({
 });
 
 // ../server/dist/commands/skill-command.js
-import fs20 from "node:fs/promises";
-import path27 from "node:path";
+import fs21 from "node:fs/promises";
+import path28 from "node:path";
 async function readEntries(dirs) {
   const entries = [];
   for (const { id: entryName, dir: skillDir } of dirs) {
-    const skillMdPath = path27.join(skillDir, "SKILL.md");
+    const skillMdPath = path28.join(skillDir, "SKILL.md");
     try {
-      const { mtimeMs } = await fs20.stat(skillMdPath);
+      const { mtimeMs } = await fs21.stat(skillMdPath);
       let fm = _frontmatterCache.get(skillMdPath, mtimeMs);
       if (!fm) {
-        const { name: name2, description: description2, command: command2, requiresAccess: requiresAccess2, verbs: verbs2, userInvocable: userInvocable2 } = parseSkillFrontmatter(await fs20.readFile(skillMdPath, "utf-8"));
+        const { name: name2, description: description2, command: command2, requiresAccess: requiresAccess2, verbs: verbs2, userInvocable: userInvocable2 } = parseSkillFrontmatter(await fs21.readFile(skillMdPath, "utf-8"));
         fm = _frontmatterCache.set(skillMdPath, mtimeMs, { name: name2, description: description2, command: command2, requiresAccess: requiresAccess2, verbs: verbs2, userInvocable: userInvocable2 });
       }
       const { name, description, command, requiresAccess, verbs, userInvocable } = fm;
@@ -7193,7 +7243,7 @@ async function execSkillCommand(slashCommand, args, sm, sessionId, workspaceRoot
   let body = "";
   let freshRequiresAccess;
   try {
-    const raw = await fs20.readFile(entry.skillPath, "utf-8");
+    const raw = await fs21.readFile(entry.skillPath, "utf-8");
     const parsed = parseSkillFrontmatter(raw);
     body = parsed.body;
     freshRequiresAccess = parsed.requiresAccess;
@@ -7239,11 +7289,11 @@ var init_skill_command = __esm({
 import Database3 from "better-sqlite3";
 import { drizzle as drizzle3 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable3, text as text3, integer as integer3 } from "drizzle-orm/sqlite-core";
-import path28 from "node:path";
-import fs21 from "node:fs";
+import path29 from "node:path";
+import fs22 from "node:fs";
 function createEvoDb(globalDir2) {
-  fs21.mkdirSync(globalDir2, { recursive: true });
-  const dbPath = path28.join(globalDir2, "evo.db");
+  fs22.mkdirSync(globalDir2, { recursive: true });
+  const dbPath = path29.join(globalDir2, "evo.db");
   const sqlite = new Database3(dbPath);
   sqlite.pragma("journal_mode = WAL");
   sqlite.exec(CREATE_SQL2);
@@ -7344,23 +7394,23 @@ CREATE INDEX IF NOT EXISTS idx_evo_applies_archived ON evolution_applies(archive
 });
 
 // ../server/dist/evolution/enqueue.js
-import fs22 from "node:fs";
-import path29 from "node:path";
+import fs23 from "node:fs";
+import path30 from "node:path";
 import { homedir as homedir11 } from "node:os";
 function listMdFiles(rootDir) {
-  if (!fs22.existsSync(rootDir))
+  if (!fs23.existsSync(rootDir))
     return [];
   const out = [];
   function walk(dir, prefix) {
     let entries;
     try {
-      entries = fs22.readdirSync(dir, { withFileTypes: true });
+      entries = fs23.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       const rel = prefix ? `${prefix}/${e.name}` : e.name;
-      const abs = path29.join(dir, e.name);
+      const abs = path30.join(dir, e.name);
       if (e.isDirectory())
         walk(abs, rel);
       else if (e.isFile() && e.name.endsWith(".md"))
@@ -7372,62 +7422,62 @@ function listMdFiles(rootDir) {
 }
 function readFileOrEmpty(p) {
   try {
-    return fs22.readFileSync(p, "utf-8");
+    return fs23.readFileSync(p, "utf-8");
   } catch {
     return "";
   }
 }
 function snapshotPromptSurface(workspacePath, agentId) {
   const out = [];
-  const wsHalo = path29.join(workspacePath, ".halo");
-  const globalHalo = path29.join(homedir11(), ".halo", "global");
-  if (fs22.existsSync(path29.join(wsHalo, "INSTRUCTIONS.md"))) {
+  const wsHalo = path30.join(workspacePath, ".halo");
+  const globalHalo = path30.join(homedir11(), ".halo", "global");
+  if (fs23.existsSync(path30.join(wsHalo, "INSTRUCTIONS.md"))) {
     out.push({
       scope: "workspace",
       path: "INSTRUCTIONS.md",
-      content: readFileOrEmpty(path29.join(wsHalo, "INSTRUCTIONS.md"))
+      content: readFileOrEmpty(path30.join(wsHalo, "INSTRUCTIONS.md"))
     });
   }
-  if (fs22.existsSync(path29.join(globalHalo, "INSTRUCTIONS.md"))) {
+  if (fs23.existsSync(path30.join(globalHalo, "INSTRUCTIONS.md"))) {
     out.push({
       scope: "global",
       path: "INSTRUCTIONS.md",
-      content: readFileOrEmpty(path29.join(globalHalo, "INSTRUCTIONS.md"))
+      content: readFileOrEmpty(path30.join(globalHalo, "INSTRUCTIONS.md"))
     });
   }
-  if (fs22.existsSync(path29.join(wsHalo, "USER.md"))) {
+  if (fs23.existsSync(path30.join(wsHalo, "USER.md"))) {
     out.push({
       scope: "workspace",
       path: "USER.md",
-      content: readFileOrEmpty(path29.join(wsHalo, "USER.md"))
+      content: readFileOrEmpty(path30.join(wsHalo, "USER.md"))
     });
   }
-  if (fs22.existsSync(path29.join(globalHalo, "USER.md"))) {
+  if (fs23.existsSync(path30.join(globalHalo, "USER.md"))) {
     out.push({
       scope: "global",
       path: "USER.md",
-      content: readFileOrEmpty(path29.join(globalHalo, "USER.md"))
+      content: readFileOrEmpty(path30.join(globalHalo, "USER.md"))
     });
   }
-  if (fs22.existsSync(path29.join(wsHalo, "INDEX.md"))) {
+  if (fs23.existsSync(path30.join(wsHalo, "INDEX.md"))) {
     out.push({
       scope: "workspace",
       path: "INDEX.md",
-      content: readFileOrEmpty(path29.join(wsHalo, "INDEX.md"))
+      content: readFileOrEmpty(path30.join(wsHalo, "INDEX.md"))
     });
   }
   for (const scope of ["workspace", "global"]) {
     const base = scope === "workspace" ? wsHalo : globalHalo;
-    const agentMd = path29.join(base, "agents", agentId, "AGENT.md");
-    const agentYaml = path29.join(base, "agents", agentId, "agent.yaml");
-    if (fs22.existsSync(agentMd)) {
+    const agentMd = path30.join(base, "agents", agentId, "AGENT.md");
+    const agentYaml = path30.join(base, "agents", agentId, "agent.yaml");
+    if (fs23.existsSync(agentMd)) {
       out.push({
         scope,
         path: `agents/${agentId}/AGENT.md`,
         content: readFileOrEmpty(agentMd)
       });
     }
-    if (fs22.existsSync(agentYaml)) {
+    if (fs23.existsSync(agentYaml)) {
       out.push({
         scope,
         path: `agents/${agentId}/agent.yaml`,
@@ -7438,12 +7488,12 @@ function snapshotPromptSurface(workspacePath, agentId) {
   for (const promptScope of ["all", "root"]) {
     for (const fsScope of ["workspace", "global"]) {
       const base = fsScope === "workspace" ? wsHalo : globalHalo;
-      const dir = path29.join(base, "prompts", promptScope);
+      const dir = path30.join(base, "prompts", promptScope);
       for (const rel of listMdFiles(dir)) {
         out.push({
           scope: fsScope,
           path: `prompts/${promptScope}/${rel}`,
-          content: readFileOrEmpty(path29.join(dir, rel))
+          content: readFileOrEmpty(path30.join(dir, rel))
         });
       }
     }
@@ -7452,11 +7502,11 @@ function snapshotPromptSurface(workspacePath, agentId) {
 }
 function listAgentsAndSkills(workspacePath) {
   function listDir(base, kind, scope) {
-    const dir = kind === "agent" ? path29.join(base, "agents") : path29.join(base, "skills");
-    if (!fs22.existsSync(dir))
+    const dir = kind === "agent" ? path30.join(base, "agents") : path30.join(base, "skills");
+    if (!fs23.existsSync(dir))
       return [];
     const yamlName = kind === "agent" ? "agent.yaml" : "SKILL.md";
-    return fs22.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs22.existsSync(path29.join(dir, e.name, yamlName))).map((e) => ({
+    return fs23.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs23.existsSync(path30.join(dir, e.name, yamlName))).map((e) => ({
       id: e.name,
       // Agents whose id is `__xxx__` are platform-internal; surface that
       // distinction so evo knows it can't legitimately propose a patch
@@ -7464,13 +7514,13 @@ function listAgentsAndSkills(workspacePath) {
       scope: e.name.startsWith("__") && e.name.endsWith("__") ? "builtin" : scope
     }));
   }
-  const wsHalo = path29.join(workspacePath, ".halo");
-  const globalHalo = path29.join(homedir11(), ".halo", "global");
+  const wsHalo = path30.join(workspacePath, ".halo");
+  const globalHalo = path30.join(homedir11(), ".halo", "global");
   const agents = [
     ...listDir(wsHalo, "agent", "workspace"),
     ...listDir(globalHalo, "agent", "global")
   ];
-  const skills = listSkillDirs(workspacePath).filter((s) => !s.overridden && s.scope !== "extension" && fs22.existsSync(path29.join(s.dir, "SKILL.md"))).map((s) => ({ id: s.id, scope: s.id.startsWith("__") && s.id.endsWith("__") ? "builtin" : s.scope }));
+  const skills = listSkillDirs(workspacePath).filter((s) => !s.overridden && s.scope !== "extension" && fs23.existsSync(path30.join(s.dir, "SKILL.md"))).map((s) => ({ id: s.id, scope: s.id.startsWith("__") && s.id.endsWith("__") ? "builtin" : s.scope }));
   function dedup(arr) {
     const seen = /* @__PURE__ */ new Set();
     const out = [];
@@ -7583,11 +7633,11 @@ function enqueueEvoRun(input) {
     return { ok: false, reason: "session_missing", error: `session ${sourceSessionId} not found` };
   }
   try {
-    fs22.mkdirSync(runDir, { recursive: true });
+    fs23.mkdirSync(runDir, { recursive: true });
     const rawMessages = sm.getSessionRawMessages(sourceSessionId);
-    fs22.writeFileSync(path29.join(runDir, "source-snapshot.json"), JSON.stringify({ sessionId: sourceSessionId, agentId: info.agentId, capturedAt: ts, rawMessages }, null, 2), "utf-8");
-    fs22.writeFileSync(path29.join(runDir, "tool-flow.md"), renderToolFlow(rawMessages), "utf-8");
-    fs22.writeFileSync(path29.join(runDir, "meta.json"), JSON.stringify({
+    fs23.writeFileSync(path30.join(runDir, "source-snapshot.json"), JSON.stringify({ sessionId: sourceSessionId, agentId: info.agentId, capturedAt: ts, rawMessages }, null, 2), "utf-8");
+    fs23.writeFileSync(path30.join(runDir, "tool-flow.md"), renderToolFlow(rawMessages), "utf-8");
+    fs23.writeFileSync(path30.join(runDir, "meta.json"), JSON.stringify({
       id: runId,
       triggerKind: trigger,
       sourceSession: sourceSessionId,
@@ -7601,7 +7651,7 @@ function enqueueEvoRun(input) {
       promptFiles: snapshotPromptSurface(workspacePath, info.agentId),
       ...listAgentsAndSkills(workspacePath)
     };
-    fs22.writeFileSync(path29.join(runDir, "evo-context.json"), JSON.stringify(evoContext, null, 2), "utf-8");
+    fs23.writeFileSync(path30.join(runDir, "evo-context.json"), JSON.stringify(evoContext, null, 2), "utf-8");
   } catch (err) {
     return { ok: false, reason: "snapshot_failed", error: err instanceof Error ? err.message : String(err) };
   }
@@ -7617,7 +7667,7 @@ function enqueueEvoRun(input) {
     }).run();
   } catch (err) {
     try {
-      fs22.rmSync(runDir, { recursive: true, force: true });
+      fs23.rmSync(runDir, { recursive: true, force: true });
     } catch {
     }
     return { ok: false, reason: "queue_failed", error: err instanceof Error ? err.message : String(err) };
@@ -7634,18 +7684,18 @@ var init_enqueue = __esm({
 });
 
 // ../server/dist/channels/shared/commands.js
-import fs23 from "node:fs";
-import path30 from "node:path";
+import fs24 from "node:fs";
+import path31 from "node:path";
 import os2 from "node:os";
-import YAML7 from "yaml";
+import YAML8 from "yaml";
 function loadAliases() {
   try {
-    const stat = fs23.statSync(ALIASES_FILE);
+    const stat = fs24.statSync(ALIASES_FILE);
     const mtime = stat.mtimeMs;
     if (aliasCache && aliasCache.mtime === mtime)
       return aliasCache;
-    const raw = fs23.readFileSync(ALIASES_FILE, "utf-8");
-    const parsed = YAML7.parse(raw) ?? {};
+    const raw = fs24.readFileSync(ALIASES_FILE, "utf-8");
+    const parsed = YAML8.parse(raw) ?? {};
     aliasCache = { mtime, top: parsed.top ?? {}, verb: parsed.verb ?? {} };
     return aliasCache;
   } catch {
@@ -7986,7 +8036,7 @@ ${formatGoalStatus(active.goalSessionId, active.state, ctx.lang)}` };
   } catch (err) {
     return { text: t("goal.create_failed", ctx.lang, { error: err instanceof Error ? err.message : String(err) }) };
   }
-  fs23.mkdirSync(goalDir(ctx.workspacePath, gId), { recursive: true });
+  fs24.mkdirSync(goalDir(ctx.workspacePath, gId), { recursive: true });
   writeGoalState(ctx.sm.getDb(), gId, initialGoalState(gId, workerId));
   setWorkerBackptr(ctx.sm.getDb(), workerId, gId);
   const hint = arg.trim();
@@ -8197,9 +8247,9 @@ async function execAgentDelete(ctx, arg) {
   const agent = resolveAgent(agents, arg);
   if (!agent)
     return { text: t("agent.not_found", ctx.lang, { name: arg }) };
-  const dir = agent.scope === "workspace" ? path30.join(ctx.workspacePath, ".halo", "agents", agent.id) : path30.join(GLOBAL_AGENTS_DIR2, agent.id);
+  const dir = agent.scope === "workspace" ? path31.join(ctx.workspacePath, ".halo", "agents", agent.id) : path31.join(GLOBAL_AGENTS_DIR2, agent.id);
   try {
-    fs23.rmSync(dir, { recursive: true, force: true });
+    fs24.rmSync(dir, { recursive: true, force: true });
     return { text: t("agent.delete_done", ctx.lang, { name: agent.name, scope: agent.scope }) };
   } catch (err) {
     return { text: t("agent.failed", ctx.lang, { error: err instanceof Error ? err.message : String(err) }) };
@@ -8209,11 +8259,11 @@ function scanSkills(ctx) {
   const disabledSet = getDisabledSet(ctx.sm.getDb(), "skill");
   const out = [];
   for (const { id, dir, scope, extId, overridden } of listSkillDirs(ctx.workspacePath)) {
-    const mdPath = path30.join(dir, "SKILL.md");
-    if (!fs23.existsSync(mdPath))
+    const mdPath = path31.join(dir, "SKILL.md");
+    if (!fs24.existsSync(mdPath))
       continue;
     try {
-      const { name, description } = parseSkillFrontmatter(fs23.readFileSync(mdPath, "utf-8"));
+      const { name, description } = parseSkillFrontmatter(fs24.readFileSync(mdPath, "utf-8"));
       out.push({
         id,
         name: name || id,
@@ -8300,9 +8350,9 @@ function execSkillDelete(ctx, arg) {
     return { text: t("skill.not_found", ctx.lang, { name: arg }) };
   if (skill.scope === "extension")
     return { text: t("skill.delete_extension", ctx.lang, { name: skill.id, ext: skill.extId ?? "" }) };
-  const dir = skill.scope === "workspace" ? path30.join(ctx.workspacePath, ".halo", "skills", skill.id) : path30.join(GLOBAL_SKILLS_DIR, skill.id);
+  const dir = skill.scope === "workspace" ? path31.join(ctx.workspacePath, ".halo", "skills", skill.id) : path31.join(GLOBAL_SKILLS_DIR, skill.id);
   try {
-    fs23.rmSync(dir, { recursive: true, force: true });
+    fs24.rmSync(dir, { recursive: true, force: true });
     notifySkillsChanged(skill.scope === "workspace" ? ctx.workspacePath : null);
     return { text: t("skill.delete_done", ctx.lang, { name: skill.id, scope: skill.scope }) };
   } catch (err) {
@@ -8365,11 +8415,11 @@ function execWsSwitch(ctx, arg) {
     return { text: t("workspace.switch_usage", ctx.lang) };
   let target = arg.trim();
   if (target.startsWith("~/")) {
-    target = path30.join(os2.homedir(), target.slice(2));
+    target = path31.join(os2.homedir(), target.slice(2));
   } else if (!target.startsWith("/")) {
-    target = path30.join(os2.homedir(), target);
+    target = path31.join(os2.homedir(), target);
   }
-  if (!fs23.existsSync(target))
+  if (!fs24.existsSync(target))
     return { text: t("workspace.not_found", ctx.lang, { path: target }) };
   if (target === ctx.workspacePath)
     return { text: t("workspace.same", ctx.lang) };
@@ -8393,7 +8443,7 @@ var init_commands2 = __esm({
     init_config();
     init_enqueue();
     init_goal_mode();
-    ALIASES_FILE = path30.join(os2.homedir(), ".halo", "global", "aliases.yaml");
+    ALIASES_FILE = path31.join(os2.homedir(), ".halo", "global", "aliases.yaml");
     aliasCache = null;
     CHANNEL_LIST_LIMIT = 50;
     DISPATCH_COMMANDS = [
@@ -8461,11 +8511,11 @@ var init_commands2 = __esm({
 
 // ../server/dist/db/a2a-db.js
 import Database4 from "better-sqlite3";
-import path31 from "node:path";
-import fs24 from "node:fs";
+import path32 from "node:path";
+import fs25 from "node:fs";
 function createA2ADb(globalDir2) {
-  fs24.mkdirSync(globalDir2, { recursive: true });
-  const sqlite = new Database4(path31.join(globalDir2, "a2a.db"));
+  fs25.mkdirSync(globalDir2, { recursive: true });
+  const sqlite = new Database4(path32.join(globalDir2, "a2a.db"));
   sqlite.pragma("journal_mode = WAL");
   applyCommitDurability(sqlite, globalDir2);
   sqlite.exec(CREATE_SQL3);
@@ -9029,8 +9079,8 @@ var init_workspace = __esm({
 });
 
 // ../core/dist/workspace/git-manager.js
-import path32 from "node:path";
-import { promises as fs25 } from "node:fs";
+import path33 from "node:path";
+import { promises as fs26 } from "node:fs";
 import simpleGit from "simple-git";
 var GitManagerError, GitManager;
 var init_git_manager = __esm({
@@ -9064,8 +9114,8 @@ var init_git_manager = __esm({
           const top = (await this.git.revparse(["--show-toplevel"])).trim();
           if (!top)
             return false;
-          const here = await fs25.realpath(this.workspace.projectRoot);
-          return path32.resolve(top) === path32.resolve(here);
+          const here = await fs26.realpath(this.workspace.projectRoot);
+          return path33.resolve(top) === path33.resolve(here);
         } catch {
           return false;
         }
@@ -9448,8 +9498,8 @@ var init_dist = __esm({
 });
 
 // ../server/dist/channels/shared/media-store.js
-import fs26 from "node:fs/promises";
-import path33 from "node:path";
+import fs27 from "node:fs/promises";
+import path34 from "node:path";
 import { randomBytes } from "node:crypto";
 function sniffImageMime(buf) {
   if (buf.length >= 4 && buf[0] === 255 && buf[1] === 216)
@@ -9494,8 +9544,8 @@ async function saveInboundMedia(params) {
   const mm = String(date.getMonth() + 1).padStart(2, "0");
   const dd = String(date.getDate()).padStart(2, "0");
   const channel = params.channel ?? "weixin";
-  const dir = path33.join(params.workspacePath, ".halo", "assets", channel, "inbound", params.accountId, `${yyyy}-${mm}-${dd}`);
-  await fs26.mkdir(dir, { recursive: true });
+  const dir = path34.join(params.workspacePath, ".halo", "assets", channel, "inbound", params.accountId, `${yyyy}-${mm}-${dd}`);
+  await fs27.mkdir(dir, { recursive: true });
   const ts = `${date.getHours().toString().padStart(2, "0")}${date.getMinutes().toString().padStart(2, "0")}${date.getSeconds().toString().padStart(2, "0")}`;
   const suffix = randomBytes(3).toString("hex");
   let filename;
@@ -9505,8 +9555,8 @@ async function saveInboundMedia(params) {
     const ext = params.mimeType ? extForMime(params.mimeType) ?? inferExtFromBytes(params.buffer) : inferExtFromBytes(params.buffer);
     filename = `${params.kind}_${ts}_${suffix}${ext}`;
   }
-  const fullPath = path33.join(dir, filename);
-  await fs26.writeFile(fullPath, params.buffer);
+  const fullPath = path34.join(dir, filename);
+  await fs27.writeFile(fullPath, params.buffer);
   return fullPath;
 }
 var VISION_IMAGE_MIME_TYPES, EXT_BY_AV_MIME;
@@ -9530,15 +9580,15 @@ var init_media_store = __esm({
 });
 
 // ../server/dist/channels/shared/media.js
-import path34 from "node:path";
+import path35 from "node:path";
 import os3 from "node:os";
 function tempDir() {
-  return path34.resolve(os3.tmpdir());
+  return path35.resolve(os3.tmpdir());
 }
 function isInTempDir(filePath) {
-  const resolved = path34.resolve(filePath);
+  const resolved = path35.resolve(filePath);
   const tmp = tempDir();
-  return resolved === tmp || resolved.startsWith(tmp + path34.sep);
+  return resolved === tmp || resolved.startsWith(tmp + path35.sep);
 }
 function extractMediaPaths(text6) {
   const mediaPaths = [];
@@ -9556,9 +9606,9 @@ function extractMediaMessage(text6) {
 function isMediaPathAllowed(filePath, workspacePath, accessLevel) {
   if (accessLevel === "full")
     return true;
-  const resolved = path34.resolve(filePath);
-  const ws = path34.resolve(workspacePath);
-  return resolved === ws || resolved.startsWith(ws + path34.sep) || isInTempDir(resolved);
+  const resolved = path35.resolve(filePath);
+  const ws = path35.resolve(workspacePath);
+  return resolved === ws || resolved.startsWith(ws + path35.sep) || isInTempDir(resolved);
 }
 function assertMediaPathAllowed(filePath, account) {
   if (!isMediaPathAllowed(filePath, account.workspacePath, account.accessLevel)) {
@@ -9573,12 +9623,12 @@ async function sendMediaOrReport(opts) {
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);
     console.log(`[${opts.logTag}] sendMedia ${filePath} failed: ${error}`);
-    await opts.reply(t("handler.upload_failed", getLang(account), { name: path34.basename(filePath), error })).catch(() => {
+    await opts.reply(t("handler.upload_failed", getLang(account), { name: path35.basename(filePath), error })).catch(() => {
     });
   }
 }
 function classifyMedia(filePath) {
-  const ext = path34.extname(filePath).toLowerCase();
+  const ext = path35.extname(filePath).toLowerCase();
   if (IMAGE_EXTS.has(ext))
     return "image";
   if (VIDEO_EXTS.has(ext))
@@ -9600,8 +9650,8 @@ var init_media = __esm({
 });
 
 // ../server/dist/a2a/files.js
-import fs27 from "node:fs";
-import path35 from "node:path";
+import fs28 from "node:fs";
+import path36 from "node:path";
 function normalizeMime(v) {
   return typeof v === "string" ? v.split(";", 1)[0].trim().toLowerCase() : "";
 }
@@ -9683,7 +9733,7 @@ async function fetchImageUrls(images) {
   return out;
 }
 function saveImage(workspace, accountId, img) {
-  const keepName = img.filename && imageMimeFromExt(path35.extname(img.filename)) === img.mediaType;
+  const keepName = img.filename && imageMimeFromExt(path36.extname(img.filename)) === img.mediaType;
   return saveInboundMedia({
     workspacePath: workspace,
     accountId,
@@ -9695,12 +9745,12 @@ function saveImage(workspace, accountId, img) {
   });
 }
 function readImageFile(filePath, budget) {
-  const mediaType = imageMimeFromExt(path35.extname(filePath)) ?? "";
+  const mediaType = imageMimeFromExt(path36.extname(filePath)) ?? "";
   if (!isImageMime(mediaType))
     return { reason: `not a supported image (${SUPPORTED})` };
   let st;
   try {
-    st = fs27.statSync(filePath);
+    st = fs28.statSync(filePath);
   } catch {
     return { reason: "file not found" };
   }
@@ -9710,14 +9760,14 @@ function readImageFile(filePath, budget) {
     return { reason: `larger than ${mb(MAX_IMAGE_BYTES)}` };
   if (st.size > budget)
     return { reason: `would exceed the ${mb(MAX_IMAGES_TOTAL_BYTES)} total` };
-  const buf = fs27.readFileSync(filePath);
+  const buf = fs28.readFileSync(filePath);
   const actual = sniffImageMime(buf);
   if (!actual)
     return { reason: `content is not a ${SUPPORTED} image` };
-  return { file: { filename: path35.basename(filePath), mediaType: actual, raw: buf.toString("base64") }, size: buf.length };
+  return { file: { filename: path36.basename(filePath), mediaType: actual, raw: buf.toString("base64") }, size: buf.length };
 }
 function refusedPath(p, workspace, level) {
-  if (!path35.isAbsolute(p))
+  if (!path36.isAbsolute(p))
     return "path is not absolute";
   if (level === "full")
     return null;
@@ -9725,13 +9775,13 @@ function refusedPath(p, workspace, level) {
     return "outside the workspace and the temp dir";
   let real;
   try {
-    real = fs27.realpathSync(p);
+    real = fs28.realpathSync(p);
   } catch {
     return "file not found";
   }
   let realWs = workspace;
   try {
-    realWs = fs27.realpathSync(workspace);
+    realWs = fs28.realpathSync(workspace);
   } catch {
   }
   return isMediaPathAllowed(real, realWs, level) ? null : "links outside the workspace and the temp dir";
@@ -9747,7 +9797,7 @@ function attachResultFiles(text6, workspace, level) {
     const why = refusedPath(p, workspace, level);
     const r = why ? { reason: why } : readImageFile(p, budget);
     if ("reason" in r) {
-      notes.push(`[file not attached: ${path35.basename(p)} \u2014 ${r.reason}]`);
+      notes.push(`[file not attached: ${path36.basename(p)} \u2014 ${r.reason}]`);
       continue;
     }
     files.push(r.file);
@@ -10100,8 +10150,8 @@ var init_agentcore_notify = __esm({
 
 // ../server/dist/a2a/invocations.js
 import crypto2 from "node:crypto";
-import fs28 from "node:fs";
-import path36 from "node:path";
+import fs29 from "node:fs";
+import path37 from "node:path";
 function onInvocationDone(id, fn) {
   let set = listeners2.get(id);
   if (!set) {
@@ -10148,15 +10198,15 @@ function lookupInvocation(key) {
   return getInvocation(key) ?? findInvocation(key);
 }
 function mediaManifest(text6, workspace) {
-  const root = fs28.realpathSync(workspace);
+  const root = fs29.realpathSync(workspace);
   const out = [];
   for (const p of new Set(extractMediaMessage(text6).mediaPaths)) {
-    if (!path36.isAbsolute(p))
+    if (!path37.isAbsolute(p))
       continue;
     try {
-      if (!fs28.realpathSync(p).startsWith(root + path36.sep))
+      if (!fs29.realpathSync(p).startsWith(root + path37.sep))
         continue;
-      const st = fs28.statSync(p);
+      const st = fs29.statSync(p);
       if (st.isFile())
         out.push({ path: p, size: st.size });
     } catch {
@@ -10220,8 +10270,8 @@ var init_invocations = __esm({
 });
 
 // ../server/dist/agents/relay.js
-import fs29 from "node:fs";
-import path37 from "node:path";
+import fs30 from "node:fs";
+import path38 from "node:path";
 import { and as and5, eq as eq6, isNull as isNull2 } from "drizzle-orm";
 function setRelayRegistry(r) {
   _registry = r;
@@ -10380,11 +10430,11 @@ function resolveTarget(workspace) {
     return jsonErr2(RELAY_UNAVAILABLE);
   let wsPath;
   try {
-    wsPath = fs29.realpathSync(workspace);
+    wsPath = fs30.realpathSync(workspace);
   } catch {
     return jsonErr2(`workspace not found: ${workspace}`);
   }
-  if (!fs29.existsSync(path37.join(wsPath, ".halo")))
+  if (!fs30.existsSync(path38.join(wsPath, ".halo")))
     return jsonErr2(`not a halo workspace (no .halo/): ${workspace}`);
   return { wsPath, target: registry2.getOrCreate(wsPath) };
 }
@@ -10563,11 +10613,11 @@ import Database5 from "better-sqlite3";
 import { drizzle as drizzle4 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable4, text as text4, integer as integer4, primaryKey } from "drizzle-orm/sqlite-core";
 import { and as and6, eq as eq7 } from "drizzle-orm";
-import path38 from "node:path";
-import fs30 from "node:fs";
+import path39 from "node:path";
+import fs31 from "node:fs";
 function createRunsDb(globalDir2) {
-  fs30.mkdirSync(globalDir2, { recursive: true });
-  const dbPath = path38.join(globalDir2, "runs.db");
+  fs31.mkdirSync(globalDir2, { recursive: true });
+  const dbPath = path39.join(globalDir2, "runs.db");
   const sqlite = new Database5(dbPath);
   sqlite.pragma("journal_mode = WAL");
   applyCommitDurability(sqlite, globalDir2);
@@ -10625,14 +10675,14 @@ CREATE TABLE IF NOT EXISTS running_sessions (
 });
 
 // ../server/dist/agents/run-ledger.js
-import fs31 from "node:fs";
-import path39 from "node:path";
-import YAML8 from "yaml";
+import fs32 from "node:fs";
+import path40 from "node:path";
+import YAML9 from "yaml";
 import { eq as eq8 } from "drizzle-orm";
 function isInternalAgent2(agentId, workspaceRoot) {
   try {
-    const raw = fs31.readFileSync(path39.join(agentSourceDir(agentId, workspaceRoot), "agent.yaml"), "utf-8");
-    return YAML8.parse(raw)?.internal === true;
+    const raw = fs32.readFileSync(path40.join(agentSourceDir(agentId, workspaceRoot), "agent.yaml"), "utf-8");
+    return YAML9.parse(raw)?.internal === true;
   } catch {
     return false;
   }
@@ -10752,8 +10802,8 @@ var init_shutdown = __esm({
 });
 
 // ../server/dist/agents/workspace-runtime-lock.js
-import fs32 from "node:fs";
-import path40 from "node:path";
+import fs33 from "node:fs";
+import path41 from "node:path";
 function isPidAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -10763,9 +10813,9 @@ function isPidAlive2(pid) {
   }
 }
 function claimWorkspaceRuntime(workspaceRoot) {
-  const lockPath = path40.join(workspaceRoot, ".halo", RUNTIME_LOCK_FILE);
+  const lockPath = path41.join(workspaceRoot, ".halo", RUNTIME_LOCK_FILE);
   try {
-    fs32.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+    fs33.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") {
@@ -10775,7 +10825,7 @@ function claimWorkspaceRuntime(workspaceRoot) {
   }
   let holder = 0;
   try {
-    holder = parseInt(fs32.readFileSync(lockPath, "utf-8").trim(), 10) || 0;
+    holder = parseInt(fs33.readFileSync(lockPath, "utf-8").trim(), 10) || 0;
   } catch {
   }
   if (holder === process.pid)
@@ -10784,13 +10834,13 @@ function claimWorkspaceRuntime(workspaceRoot) {
     return false;
   const tmpPath = `${lockPath}.${process.pid}.tmp`;
   try {
-    fs32.writeFileSync(tmpPath, String(process.pid));
-    fs32.renameSync(tmpPath, lockPath);
+    fs33.writeFileSync(tmpPath, String(process.pid));
+    fs33.renameSync(tmpPath, lockPath);
     console.debug(`[WorkspaceRuntimeLock] took over stale runtime.lock in ${workspaceRoot} (previous holder pid ${holder || "unreadable"})`);
     return true;
   } catch (renameErr) {
     try {
-      fs32.unlinkSync(tmpPath);
+      fs33.unlinkSync(tmpPath);
     } catch {
     }
     console.warn(`[WorkspaceRuntimeLock] stale takeover failed for ${lockPath}: ${renameErr instanceof Error ? renameErr.message : String(renameErr)}`);
@@ -10798,10 +10848,10 @@ function claimWorkspaceRuntime(workspaceRoot) {
   }
 }
 function releaseWorkspaceRuntime(workspaceRoot) {
-  const lockPath = path40.join(workspaceRoot, ".halo", RUNTIME_LOCK_FILE);
+  const lockPath = path41.join(workspaceRoot, ".halo", RUNTIME_LOCK_FILE);
   try {
-    if (parseInt(fs32.readFileSync(lockPath, "utf-8").trim(), 10) === process.pid)
-      fs32.unlinkSync(lockPath);
+    if (parseInt(fs33.readFileSync(lockPath, "utf-8").trim(), 10) === process.pid)
+      fs33.unlinkSync(lockPath);
   } catch {
   }
 }
@@ -13645,9 +13695,9 @@ var init_anthropic_agent = __esm({
 });
 
 // ../server/dist/agents/model-runtime.js
-import path41 from "node:path";
+import path42 from "node:path";
 function resolveProviderRuntime(providerId) {
-  const yamlPath = path41.join(HALO_GLOBAL_DIR, "models", `${providerId}.yaml`);
+  const yamlPath = path42.join(HALO_GLOBAL_DIR, "models", `${providerId}.yaml`);
   const providers2 = getModelsRegistry().providers;
   const entry = providers2.find((p) => p.id === providerId);
   if (!entry) {
@@ -13828,20 +13878,20 @@ var init_model_runtime = __esm({
 });
 
 // ../server/dist/tools/workspace-tools.js
-import fs33 from "node:fs/promises";
-import path42 from "node:path";
+import fs34 from "node:fs/promises";
+import path43 from "node:path";
 import crypto3 from "node:crypto";
 import { homedir as homedir12 } from "node:os";
 function resolvePath2(filePath, workspaceRoot) {
-  const expanded = filePath.startsWith("~/") ? path42.join(HOME2, filePath.slice(2)) : filePath;
-  return path42.isAbsolute(expanded) ? path42.resolve(expanded) : path42.resolve(workspaceRoot, expanded);
+  const expanded = filePath.startsWith("~/") ? path43.join(HOME2, filePath.slice(2)) : filePath;
+  return path43.isAbsolute(expanded) ? path43.resolve(expanded) : path43.resolve(workspaceRoot, expanded);
 }
 async function* walkDir(dir, signal) {
   if (signal?.aborted)
     return;
   let names;
   try {
-    names = await fs33.readdir(dir);
+    names = await fs34.readdir(dir);
   } catch {
     return;
   }
@@ -13850,15 +13900,15 @@ async function* walkDir(dir, signal) {
       return;
     if (SKIP_DIRS.has(name))
       continue;
-    const fullPath = path42.join(dir, name);
+    const fullPath = path43.join(dir, name);
     let stat;
     try {
-      stat = await fs33.lstat(fullPath);
+      stat = await fs34.lstat(fullPath);
     } catch {
       continue;
     }
     if (stat.isDirectory()) {
-      if (path42.basename(dir) === ".halo" && SKIP_HALO_SUBDIRS.has(name))
+      if (path43.basename(dir) === ".halo" && SKIP_HALO_SUBDIRS.has(name))
         continue;
       if (process.platform === "win32" && await isReparsePoint(fullPath))
         continue;
@@ -13870,7 +13920,7 @@ async function* walkDir(dir, signal) {
 }
 async function isReparsePoint(dir) {
   try {
-    await fs33.readlink(dir);
+    await fs34.readlink(dir);
     return true;
   } catch {
     return false;
@@ -13879,7 +13929,7 @@ async function isReparsePoint(dir) {
 async function isBinaryFile(filePath) {
   let handle = null;
   try {
-    handle = await fs33.open(filePath, "r");
+    handle = await fs34.open(filePath, "r");
     const buf = Buffer.alloc(512);
     const { bytesRead } = await handle.read(buf, 0, 512, 0);
     for (let i = 0; i < bytesRead; i++) {
@@ -14086,7 +14136,7 @@ function createWorkspaceTools(workspaceRoot, accessLevelOrOpts = "full") {
     callback: async (_input) => {
       const input = _input;
       const fullPath = resolvePath2(input.path, workspaceRoot);
-      const ext = path42.extname(fullPath).toLowerCase();
+      const ext = path43.extname(fullPath).toLowerCase();
       const supportedExts = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp"]);
       if (!supportedExts.has(ext)) {
         return `${TOOL_WARN_MARKER}
@@ -14283,7 +14333,7 @@ Error: old_string appears more than once in ${input.path}. Either expand it with
           const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
           if (entry.isDirectory) {
             results.push(`\u{1F4C1} ${relPath}/`);
-            await walk(path42.join(dir, entry.name), relPath);
+            await walk(path43.join(dir, entry.name), relPath);
           } else {
             results.push(`\u{1F4C4} ${relPath}`);
           }
@@ -14397,14 +14447,14 @@ Error: Invalid regex pattern: ${err.message}`;
       const results = [];
       let fileTarget = false;
       try {
-        fileTarget = (await fs33.stat(searchDir)).isFile();
+        fileTarget = (await fs34.stat(searchDir)).isFile();
       } catch {
       }
       const files = fileTarget ? [searchDir] : walkDir(searchDir, signal);
       for await (const filePath of files) {
         if (results.length >= maxResults)
           break;
-        if (input.include && !matchInclude(path42.basename(filePath), input.include)) {
+        if (input.include && !matchInclude(path43.basename(filePath), input.include)) {
           continue;
         }
         if (await isBinaryFile(filePath))
@@ -14415,7 +14465,7 @@ Error: Invalid regex pattern: ${err.message}`;
         } catch {
           continue;
         }
-        const relativePath = path42.relative(workspaceRoot, filePath);
+        const relativePath = path43.relative(workspaceRoot, filePath);
         const lines = content.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (results.length >= maxResults)
@@ -14460,7 +14510,7 @@ Error: Invalid regex pattern: ${err.message}`;
       for await (const filePath of walkDir(searchDir, signal)) {
         if (results.length >= GLOB_MAX_RESULTS)
           break;
-        const relativePath = path42.relative(workspaceRoot, filePath);
+        const relativePath = path43.relative(workspaceRoot, filePath);
         if (matchGlob(relativePath, input.pattern)) {
           results.push(relativePath);
         }
@@ -14586,12 +14636,12 @@ var init_workspace_tools = __esm({
 });
 
 // ../server/dist/prompts/system-prompts.js
-import fs34 from "node:fs/promises";
-import path43 from "node:path";
+import fs35 from "node:fs/promises";
+import path44 from "node:path";
 import { homedir as homedir13 } from "node:os";
 async function dirExists(dirPath) {
   try {
-    const stat = await fs34.stat(dirPath);
+    const stat = await fs35.stat(dirPath);
     return stat.isDirectory();
   } catch {
     return false;
@@ -14610,7 +14660,7 @@ function selectForPlatform(mdFiles) {
 async function loadDir(dirPath, fallback) {
   let entries;
   try {
-    entries = await fs34.readdir(dirPath);
+    entries = await fs35.readdir(dirPath);
   } catch {
     console.log(`[SystemPrompts] Directory missing: ${dirPath} \u2014 using built-in fallback`);
     return { content: fallback, files: [] };
@@ -14623,9 +14673,9 @@ async function loadDir(dirPath, fallback) {
   const chunks = [];
   const loaded = [];
   for (const name of mdFiles) {
-    const fullPath = path43.join(dirPath, name);
+    const fullPath = path44.join(dirPath, name);
     try {
-      const content = (await fs34.readFile(fullPath, "utf-8")).trim();
+      const content = (await fs35.readFile(fullPath, "utf-8")).trim();
       if (content) {
         chunks.push(content);
         loaded.push(fullPath);
@@ -14640,11 +14690,11 @@ async function loadDir(dirPath, fallback) {
 }
 async function resolvePromptsDir(scope, workspaceRoot) {
   if (workspaceRoot) {
-    const wsDir = path43.join(workspaceRoot, ".halo", "prompts", scope);
+    const wsDir = path44.join(workspaceRoot, ".halo", "prompts", scope);
     if (await dirExists(wsDir))
       return wsDir;
   }
-  return path43.join(GLOBAL_PROMPTS_DIR, scope);
+  return path44.join(GLOBAL_PROMPTS_DIR, scope);
 }
 async function loadSystemPrompts(workspaceRoot) {
   const [bootstrapDir, allDir, rootDir] = await Promise.all([
@@ -14673,15 +14723,13 @@ var GLOBAL_PROMPTS_DIR;
 var init_system_prompts = __esm({
   "../server/dist/prompts/system-prompts.js"() {
     "use strict";
-    GLOBAL_PROMPTS_DIR = path43.join(homedir13(), ".halo", "global", "prompts");
+    GLOBAL_PROMPTS_DIR = path44.join(homedir13(), ".halo", "global", "prompts");
   }
 });
 
 // ../server/dist/a2a/outbound.js
-import fs35 from "node:fs";
-import path44 from "node:path";
+import fs36 from "node:fs";
 import crypto4 from "node:crypto";
-import YAML9 from "yaml";
 import { Hono } from "hono";
 import { SignatureV4 as SignatureV42 } from "@smithy/signature-v4";
 import { Sha256 as Sha2562 } from "@aws-crypto/sha256-js";
@@ -14695,28 +14743,10 @@ function jsonErr3(error) {
 function errMsg(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function remotesFile() {
-  return path44.join(secretsDir(), "a2a-remotes.yaml");
-}
-function loadRemotes() {
-  let doc;
-  try {
-    doc = YAML9.parse(fs35.readFileSync(remotesFile(), "utf8")) ?? {};
-  } catch {
-    return {};
-  }
-  const out = {};
-  for (const [name, r] of Object.entries(doc.remotes ?? {})) {
-    if (!r?.card)
-      continue;
-    out[name] = { name, card: r.card, auth: r.auth === "sigv4" ? "sigv4" : "bearer", pushBase: r.push_base?.replace(/\/+$/, "") };
-  }
-  return out;
-}
 function runtimeSessionId(workspace, remoteName) {
   let real = workspace;
   try {
-    real = fs35.realpathSync(workspace);
+    real = fs36.realpathSync(workspace);
   } catch {
   }
   return `halo-${crypto4.createHash("sha256").update(`${real}\0${remoteName}`).digest("hex")}`;
@@ -15124,11 +15154,11 @@ var init_outbound = __esm({
   "../server/dist/a2a/outbound.js"() {
     "use strict";
     init_config();
-    init_paths();
     init_a2a_db();
     init_relay();
     init_http();
     init_wire();
+    init_remotes();
     init_files();
     TIMEOUT_MS2 = 3e4;
     _registry2 = null;
@@ -15827,7 +15857,7 @@ async function initObservability(haloProcess = "server") {
     return true;
   }
   const { registerSdk: registerSdk2 } = await Promise.resolve().then(() => (init_otel_sdk(), otel_sdk_exports));
-  providers = await registerSdk2(process.env.OTEL_SERVICE_NAME, "2.0.2", haloProcess);
+  providers = await registerSdk2(process.env.OTEL_SERVICE_NAME, "2.0.3", haloProcess);
   console.log(`[Observability] OTLP export \u2192 ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT} (service.name=${process.env.OTEL_SERVICE_NAME}, halo.process=${haloProcess}, capture_content=${config.observability.captureContent})`);
   return true;
 }
@@ -18907,7 +18937,7 @@ ${result.summary}`, agentName: "user", report: true, compactSummary: true, taskI
 });
 
 // ../server/dist/agents/session-manager-registry.js
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 var SessionManagerRegistry;
 var init_session_manager_registry = __esm({
   "../server/dist/agents/session-manager-registry.js"() {
@@ -18936,7 +18966,7 @@ var init_session_manager_registry = __esm({
         return this.opts.reconcileOrphansOnBoot === true;
       }
       getOrCreate(workspacePath) {
-        const resolved = fs36.realpathSync(workspacePath);
+        const resolved = fs37.realpathSync(workspacePath);
         const cached2 = this.cache.get(resolved);
         if (cached2)
           return cached2;
@@ -18956,7 +18986,7 @@ var init_session_manager_registry = __esm({
       peek(workspacePath) {
         let resolved;
         try {
-          resolved = fs36.realpathSync(workspacePath);
+          resolved = fs37.realpathSync(workspacePath);
         } catch {
           return void 0;
         }
@@ -18975,16 +19005,16 @@ var init_session_manager_registry = __esm({
 });
 
 // ../server/dist/logger.js
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path47 from "node:path";
 import { homedir as homedir14 } from "node:os";
 import { SeverityNumber } from "@opentelemetry/api-logs";
 function ensureDir() {
-  fs37.mkdirSync(logDir, { recursive: true });
+  fs38.mkdirSync(logDir, { recursive: true });
 }
 function measureSize() {
   try {
-    return fs37.statSync(logFile).size;
+    return fs38.statSync(logFile).size;
   } catch {
     return 0;
   }
@@ -18992,17 +19022,17 @@ function measureSize() {
 function rotate() {
   const maxFiles = config.logging.maxFiles;
   try {
-    fs37.unlinkSync(`${logFile}.${maxFiles}`);
+    fs38.unlinkSync(`${logFile}.${maxFiles}`);
   } catch {
   }
   for (let i = maxFiles - 1; i >= 1; i--) {
     try {
-      fs37.renameSync(`${logFile}.${i}`, `${logFile}.${i + 1}`);
+      fs38.renameSync(`${logFile}.${i}`, `${logFile}.${i + 1}`);
     } catch {
     }
   }
   try {
-    fs37.renameSync(logFile, `${logFile}.1`);
+    fs38.renameSync(logFile, `${logFile}.1`);
   } catch {
   }
   currentSize = 0;
@@ -19014,12 +19044,12 @@ function writeToFile(line) {
     if (currentSize >= config.logging.maxFileSize)
       rotate();
     try {
-      fs37.appendFileSync(logFile, line);
+      fs38.appendFileSync(logFile, line);
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
       ensureDir();
-      fs37.appendFileSync(logFile, line);
+      fs38.appendFileSync(logFile, line);
     }
     currentSize += Buffer.byteLength(line);
   } catch {
@@ -19136,7 +19166,7 @@ __export(harness_exports, {
   listSessions: () => listSessions
 });
 import path48 from "node:path";
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 async function initRuntime(observe) {
   console.log = (...args) => process.stderr.write(args.map(String).join(" ") + "\n");
   refreshTemplatesIfOutdated(HALO_HOME3, "CLI");
@@ -19178,7 +19208,7 @@ async function agentSupportsImage(sm, workspace, agentId) {
 }
 async function createHarness(opts) {
   const initialPath = path48.resolve(opts.workspace);
-  if (!fs38.existsSync(initialPath)) {
+  if (!fs39.existsSync(initialPath)) {
     throw new Error(`Workspace does not exist: ${initialPath}`);
   }
   const registry2 = new SessionManagerRegistry();
@@ -19367,7 +19397,7 @@ async function createHarness(opts) {
   async function switchWorkspace(newPath) {
     const resolved = path48.resolve(newPath);
     if (resolved === state.workspace) return;
-    if (!fs38.existsSync(resolved)) {
+    if (!fs39.existsSync(resolved)) {
       throw new Error(`Workspace does not exist: ${resolved}`);
     }
     state.unsubPersistent();
@@ -19490,29 +19520,29 @@ __export(setup_config_exports, {
   readConfigLeaf: () => readConfigLeaf,
   updateConfigLeaves: () => updateConfigLeaves
 });
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path49 from "node:path";
 import { homedir as homedir15 } from "node:os";
 import YAML10 from "yaml";
 function updateConfigLeaves(updates) {
-  const raw = fs39.existsSync(CONFIG_PATH) ? fs39.readFileSync(CONFIG_PATH, "utf-8") : "";
+  const raw = fs40.existsSync(CONFIG_PATH) ? fs40.readFileSync(CONFIG_PATH, "utf-8") : "";
   const doc = raw ? YAML10.parseDocument(raw) : new YAML10.Document({});
   for (const [dotPath, val] of Object.entries(updates)) {
     const parts = dotPath.split(".");
     parts.push("value");
     doc.setIn(parts, val);
   }
-  fs39.mkdirSync(path49.dirname(CONFIG_PATH), { recursive: true });
-  fs39.writeFileSync(CONFIG_PATH, doc.toString(), { encoding: "utf-8", mode: 384 });
+  fs40.mkdirSync(path49.dirname(CONFIG_PATH), { recursive: true });
+  fs40.writeFileSync(CONFIG_PATH, doc.toString(), { encoding: "utf-8", mode: 384 });
   try {
-    fs39.chmodSync(CONFIG_PATH, 384);
+    fs40.chmodSync(CONFIG_PATH, 384);
   } catch {
   }
 }
 function readConfigLeaf(dotPath) {
-  if (!fs39.existsSync(CONFIG_PATH))
+  if (!fs40.existsSync(CONFIG_PATH))
     return void 0;
-  const raw = fs39.readFileSync(CONFIG_PATH, "utf-8");
+  const raw = fs40.readFileSync(CONFIG_PATH, "utf-8");
   const doc = YAML10.parseDocument(raw);
   const parts = dotPath.split(".");
   parts.push("value");
@@ -19538,23 +19568,23 @@ __export(setup_settings_exports, {
   writeSetting: () => writeSetting,
   writeSettings: () => writeSettings
 });
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 import path50 from "node:path";
 import { homedir as homedir16 } from "node:os";
 import YAML11 from "yaml";
 function loadDoc() {
-  if (!fs40.existsSync(SETTINGS_PATH2))
+  if (!fs41.existsSync(SETTINGS_PATH2))
     return new YAML11.Document({});
-  const raw = fs40.readFileSync(SETTINGS_PATH2, "utf-8");
+  const raw = fs41.readFileSync(SETTINGS_PATH2, "utf-8");
   if (raw.trim().length === 0)
     return new YAML11.Document({});
   return YAML11.parseDocument(raw);
 }
 function saveDoc(doc) {
-  fs40.mkdirSync(path50.dirname(SETTINGS_PATH2), { recursive: true });
-  fs40.writeFileSync(SETTINGS_PATH2, doc.toString({ lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
+  fs41.mkdirSync(path50.dirname(SETTINGS_PATH2), { recursive: true });
+  fs41.writeFileSync(SETTINGS_PATH2, doc.toString({ lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
   try {
-    fs40.chmodSync(SETTINGS_PATH2, 384);
+    fs41.chmodSync(SETTINGS_PATH2, 384);
   } catch {
   }
 }
@@ -19644,15 +19674,15 @@ __export(setup_providers_exports, {
   modelBlockFromProvider: () => modelBlockFromProvider,
   readDefaultAgentProvider: () => readDefaultAgentProvider
 });
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path51 from "node:path";
 import { homedir as homedir17 } from "node:os";
 import YAML12 from "yaml";
 function readYamlFile2(filePath) {
-  if (!fs41.existsSync(filePath))
+  if (!fs42.existsSync(filePath))
     return null;
   try {
-    return YAML12.parse(fs41.readFileSync(filePath, "utf-8"));
+    return YAML12.parse(fs42.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -19692,17 +19722,17 @@ function listModelProviders() {
 }
 function listOptionalSkills() {
   const dir = path51.join(TEMPLATES_DIR, "optional-skills");
-  if (!fs41.existsSync(dir))
+  if (!fs42.existsSync(dir))
     return [];
   const out = [];
-  for (const id of fs41.readdirSync(dir)) {
+  for (const id of fs42.readdirSync(dir)) {
     const skillDir = path51.join(dir, id);
-    if (!fs41.statSync(skillDir).isDirectory())
+    if (!fs42.statSync(skillDir).isDirectory())
       continue;
     const skillMd = path51.join(skillDir, "SKILL.md");
-    if (!fs41.existsSync(skillMd))
+    if (!fs42.existsSync(skillMd))
       continue;
-    const text6 = fs41.readFileSync(skillMd, "utf-8");
+    const text6 = fs42.readFileSync(skillMd, "utf-8");
     const fmMatch = /^---\n([\s\S]*?)\n---/.exec(text6);
     let name = id;
     let description = "";
@@ -19785,12 +19815,12 @@ function bindBuiltinAgentsToProvider(providerId) {
   const agents = [];
   for (const id of REBIND_BUILTIN_AGENT_IDS) {
     const yamlPath = path51.join(GLOBAL_AGENTS_DIR3, id, "agent.yaml");
-    if (!fs41.existsSync(yamlPath))
+    if (!fs42.existsSync(yamlPath))
       continue;
     try {
-      const doc = YAML12.parseDocument(fs41.readFileSync(yamlPath, "utf-8"));
+      const doc = YAML12.parseDocument(fs42.readFileSync(yamlPath, "utf-8"));
       doc.set("model", block);
-      fs41.writeFileSync(yamlPath, doc.toString(), "utf-8");
+      fs42.writeFileSync(yamlPath, doc.toString(), "utf-8");
       agents.push(id);
     } catch {
     }
@@ -19799,15 +19829,15 @@ function bindBuiltinAgentsToProvider(providerId) {
 }
 function listRequiredSkillsWithSecrets() {
   const dir = path51.join(TEMPLATES_DIR, "skills");
-  if (!fs41.existsSync(dir))
+  if (!fs42.existsSync(dir))
     return [];
   const out = [];
-  for (const id of fs41.readdirSync(dir)) {
+  for (const id of fs42.readdirSync(dir)) {
     const skillDir = path51.join(dir, id);
-    if (!fs41.statSync(skillDir).isDirectory())
+    if (!fs42.statSync(skillDir).isDirectory())
       continue;
     const cfgPath = path51.join(skillDir, "config.yaml");
-    if (!fs41.existsSync(cfgPath))
+    if (!fs42.existsSync(cfgPath))
       continue;
     const cfg = readYamlFile2(cfgPath);
     const fields = parseFields(cfg?.params).filter((f) => f.secret);
@@ -19816,8 +19846,8 @@ function listRequiredSkillsWithSecrets() {
     const skillMd = path51.join(skillDir, "SKILL.md");
     let name = id;
     let description = "";
-    if (fs41.existsSync(skillMd)) {
-      const text6 = fs41.readFileSync(skillMd, "utf-8");
+    if (fs42.existsSync(skillMd)) {
+      const text6 = fs42.readFileSync(skillMd, "utf-8");
       const fmMatch = /^---\n([\s\S]*?)\n---/.exec(text6);
       if (fmMatch) {
         try {
@@ -20186,13 +20216,13 @@ __export(upgrade_verify_exports, {
   verifyNativeModules: () => verifyNativeModules
 });
 import path52 from "node:path";
-import fs42 from "node:fs";
+import fs43 from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function verifyNativeModules(pkgRoot) {
   const broken = [];
   for (const { name, smoke } of NATIVE_MODULE_SMOKES) {
     const modDir = path52.join(pkgRoot, "node_modules", name);
-    if (!fs42.existsSync(modDir)) {
+    if (!fs43.existsSync(modDir)) {
       broken.push(name);
       continue;
     }
@@ -20223,7 +20253,7 @@ __export(install_exports, {
   planModelsInstall: () => planModelsInstall,
   summaryLine: () => summaryLine
 });
-import fs43 from "node:fs";
+import fs44 from "node:fs";
 import path53 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import YAML13 from "yaml";
@@ -20311,7 +20341,7 @@ function planModelsInstall(srcDir, dirs = {}) {
   const effective = loadProviders(dirs.bundledDir ?? globalModelsDir(), hubDir).effective;
   let files;
   try {
-    files = fs43.readdirSync(srcDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".yaml")).map((e) => e.name).sort();
+    files = fs44.readdirSync(srcDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".yaml")).map((e) => e.name).sort();
   } catch (err) {
     throw new Error(`cannot read ${srcDir}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -20319,7 +20349,7 @@ function planModelsInstall(srcDir, dirs = {}) {
     throw new Error(`no provider yaml in ${srcDir}`);
   const seen = /* @__PURE__ */ new Set();
   const entries = files.map((file) => {
-    const raw = fs43.readFileSync(path53.join(srcDir, file), "utf-8");
+    const raw = fs44.readFileSync(path53.join(srcDir, file), "utf-8");
     let data;
     try {
       data = YAML13.parse(raw);
@@ -20352,13 +20382,13 @@ function planModelsInstall(srcDir, dirs = {}) {
 }
 function applyModelsInstall(plan) {
   const written = [];
-  fs43.mkdirSync(plan.hubDir, { recursive: true });
+  fs44.mkdirSync(plan.hubDir, { recursive: true });
   for (const e of plan.entries) {
     if (e.action !== "install" || !e.id || e.raw == null)
       continue;
     const tmp = path53.join(plan.hubDir, `.tmp-${e.id}-${process.pid}-${Date.now()}`);
-    fs43.writeFileSync(tmp, e.raw, "utf-8");
-    fs43.renameSync(tmp, path53.join(plan.hubDir, `${e.id}.yaml`));
+    fs44.writeFileSync(tmp, e.raw, "utf-8");
+    fs44.renameSync(tmp, path53.join(plan.hubDir, `${e.id}.yaml`));
     written.push(e.id);
   }
   return written;
@@ -20441,7 +20471,7 @@ var init_render_md = __esm({
 });
 
 // src/resolve-refs.ts
-import fs44 from "node:fs";
+import fs45 from "node:fs";
 import path54 from "node:path";
 function resolveRefs(input, workspace) {
   const images = [];
@@ -20459,7 +20489,7 @@ function resolveRefs(input, workspace) {
     const ext = path54.extname(resolved).toLowerCase();
     let stat = null;
     try {
-      stat = fs44.statSync(resolved);
+      stat = fs45.statSync(resolved);
     } catch {
     }
     if (!stat) {
@@ -20477,18 +20507,18 @@ function resolveRefs(input, workspace) {
           warnings.push(`${rawPath}: image too large (${(stat.size / 1024 / 1024).toFixed(1)}MB, max ${MAX_IMAGE_BYTES2 / 1024 / 1024}MB), skipped`);
           continue;
         }
-        const data = fs44.readFileSync(resolved).toString("base64");
+        const data = fs45.readFileSync(resolved).toString("base64");
         images.push({ data, mimeType: imageMimeFromExt(ext) ?? "application/octet-stream" });
       } else {
         const relPath = path54.relative(workspace, resolved);
         if (stat.size > MAX_FILE_BYTES) {
           const buf = Buffer.alloc(MAX_FILE_BYTES);
-          const fd = fs44.openSync(resolved, "r");
+          const fd = fs45.openSync(resolved, "r");
           let n = 0;
           try {
-            n = fs44.readSync(fd, buf, 0, MAX_FILE_BYTES, 0);
+            n = fs45.readSync(fd, buf, 0, MAX_FILE_BYTES, 0);
           } finally {
-            fs44.closeSync(fd);
+            fs45.closeSync(fd);
           }
           const content = buf.subarray(0, n).toString("utf-8").replace(/\uFFFD+$/, "");
           parts.push(`
@@ -20499,7 +20529,7 @@ ${content}
 `);
           warnings.push(`${rawPath}: truncated (${(stat.size / 1024).toFixed(0)}KB, max ${MAX_FILE_BYTES / 1024}KB)`);
         } else {
-          const content = fs44.readFileSync(resolved, "utf-8");
+          const content = fs45.readFileSync(resolved, "utf-8");
           parts.push(`
 <file path="${relPath}">
 ${content}
@@ -20771,12 +20801,12 @@ var init_streaming = __esm({
 });
 
 // src/tui/history.ts
-import fs45 from "node:fs";
+import fs46 from "node:fs";
 import path55 from "node:path";
 import os4 from "node:os";
 function loadHistory() {
   try {
-    const arr = JSON.parse(fs45.readFileSync(HISTORY_FILE, "utf8"));
+    const arr = JSON.parse(fs46.readFileSync(HISTORY_FILE, "utf8"));
     if (Array.isArray(arr)) {
       return arr.filter((x) => typeof x === "string").slice(-MAX_ENTRIES);
     }
@@ -20789,8 +20819,8 @@ function appendHistory(entry) {
     const arr = loadHistory();
     if (arr[arr.length - 1] === entry) return;
     arr.push(entry);
-    fs45.mkdirSync(path55.dirname(HISTORY_FILE), { recursive: true });
-    fs45.writeFileSync(HISTORY_FILE, JSON.stringify(arr.slice(-MAX_ENTRIES)));
+    fs46.mkdirSync(path55.dirname(HISTORY_FILE), { recursive: true });
+    fs46.writeFileSync(HISTORY_FILE, JSON.stringify(arr.slice(-MAX_ENTRIES)));
   } catch {
   }
 }
@@ -20902,7 +20932,7 @@ var init_path_suggest = __esm({
 });
 
 // src/tui/path-suggest-engine.ts
-import fs46 from "node:fs";
+import fs47 from "node:fs";
 import path56 from "node:path";
 function detectActiveRef(value) {
   const reExplicit = /@(file|image|scope)\s+(?:"([^"]*)|(\S*))$/;
@@ -20945,7 +20975,7 @@ function scanCandidates(partial, workspace, kind) {
   const { absDir, displayDir, prefix } = resolveDirAndPrefix(partial, workspace);
   let entries;
   try {
-    entries = fs46.readdirSync(absDir, { withFileTypes: true });
+    entries = fs47.readdirSync(absDir, { withFileTypes: true });
   } catch {
     return { items: [], cwdLabel: displayDir };
   }
@@ -22515,13 +22545,13 @@ var init_read_stdin_prompt = __esm({
 });
 
 // ../server/dist/routes/workspace-path.js
-import fs47 from "node:fs/promises";
+import fs48 from "node:fs/promises";
 import { existsSync as existsSync2, realpathSync as realpathSync3 } from "node:fs";
 import path57 from "node:path";
 async function resolveProjectPath(projectId) {
   if (path57.isAbsolute(projectId)) {
     try {
-      await fs47.access(projectId);
+      await fs48.access(projectId);
       return projectId;
     } catch {
       return null;
@@ -22564,7 +22594,7 @@ var init_workspace_path = __esm({
 });
 
 // ../server/dist/ws/file-watcher.js
-import fs48 from "node:fs";
+import fs49 from "node:fs";
 import path58 from "node:path";
 function enqueueNativeOp(op) {
   const result = nativeOpChain.then(op);
@@ -22674,7 +22704,7 @@ var init_file_watcher = __esm({
         }
         let root = workspaceRoot;
         try {
-          root = fs48.realpathSync(workspaceRoot);
+          root = fs49.realpathSync(workspaceRoot);
         } catch {
         }
         if (this.subscription && this.workspaceRoot === root)
@@ -22732,7 +22762,7 @@ var init_file_watcher = __esm({
         } else {
           let isDir = false;
           try {
-            isDir = fs48.statSync(absPath).isDirectory();
+            isDir = fs49.statSync(absPath).isDirectory();
           } catch {
           }
           action = isDir ? "addDir" : "add";
@@ -22808,7 +22838,7 @@ var init_file_watcher = __esm({
 });
 
 // ../server/dist/routes/folder-zip.js
-import fs49 from "node:fs/promises";
+import fs50 from "node:fs/promises";
 import { realpathSync as realpathSync4 } from "node:fs";
 import os5 from "node:os";
 import path59 from "node:path";
@@ -22850,7 +22880,7 @@ function isBlockedPath(real, wsReal) {
   return isHiddenWorkspacePath(real, base) || real === path59.join(base, ".halo", "settings.yaml");
 }
 async function planFolderZip(root, projectPath, opts) {
-  const [rootReal, wsReal] = await Promise.all([fs49.realpath(root), fs49.realpath(projectPath)]);
+  const [rootReal, wsReal] = await Promise.all([fs50.realpath(root), fs50.realpath(projectPath)]);
   if (isBlockedPath(rootReal, wsReal))
     throw new FolderZipError(403, "Path is not accessible");
   const { includeIgnored, limits, signal } = opts;
@@ -22870,8 +22900,8 @@ async function planFolderZip(root, projectPath, opts) {
       excluded.add("blocked", rel);
       return false;
     }
-    const real = await fs49.realpath(linkPath).catch(() => null);
-    const st = real ? await fs49.stat(real).catch(() => null) : null;
+    const real = await fs50.realpath(linkPath).catch(() => null);
+    const st = real ? await fs50.stat(real).catch(() => null) : null;
     if (!real || !st?.isFile() || !isUnder2(real, wsReal) || isBlockedPath(real, wsReal) || isEnvName(path59.basename(real))) {
       excluded.add("symlink", st?.isDirectory() ? `${rel}/` : rel);
       return false;
@@ -22882,7 +22912,7 @@ async function planFolderZip(root, projectPath, opts) {
   async function walk(dirReal, rel) {
     let entries;
     try {
-      entries = await fs49.readdir(dirReal, { withFileTypes: true });
+      entries = await fs50.readdir(dirReal, { withFileTypes: true });
     } catch (err) {
       if (!rel)
         throw err;
@@ -22897,7 +22927,7 @@ async function planFolderZip(root, projectPath, opts) {
       if (Date.now() > deadline)
         throw walkTimeout();
       await Promise.all(toStat.slice(i, i + 64).map(async (e) => {
-        fileStats.set(e.name, await fs49.stat(path59.join(dirReal, e.name)).catch((err) => err));
+        fileStats.set(e.name, await fs50.stat(path59.join(dirReal, e.name)).catch((err) => err));
       }));
     }
     let nonEmpty2 = false;
@@ -22922,7 +22952,7 @@ async function planFolderZip(root, projectPath, opts) {
           excluded.ignoredNames[e.name] = (excluded.ignoredNames[e.name] ?? 0) + 1;
         } else {
           if (!await walk(childReal, childRel)) {
-            const st = await fs49.stat(childReal).catch(() => null);
+            const st = await fs50.stat(childReal).catch(() => null);
             plan.items.push({ rel: childRel, mtimeMs: st?.mtimeMs ?? Date.now() });
           }
           nonEmpty2 = true;
@@ -23014,7 +23044,7 @@ function streamFolderZip(plan, folderName, signal) {
       const mtime = new Date(item.mtimeMs);
       let handle;
       try {
-        handle = await fs49.open(item.abs, "r");
+        handle = await fs50.open(item.abs, "r");
       } catch (err) {
         plan.excluded.add("unreadable", `${item.rel} (${err.code ?? "error"})`);
         continue;
@@ -23191,7 +23221,7 @@ var init_folder_zip = __esm({
 
 // ../server/dist/routes/files.js
 import { Hono as Hono2 } from "hono";
-import fs50 from "node:fs/promises";
+import fs51 from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { Readable } from "node:stream";
 import path60 from "node:path";
@@ -23220,7 +23250,7 @@ function createFileRoutes(opts = {}) {
   }
   async function dirHasChildren(dirPath) {
     try {
-      const entries = await fs50.readdir(dirPath, { withFileTypes: true });
+      const entries = await fs51.readdir(dirPath, { withFileTypes: true });
       for (const entry of entries) {
         if (!isSkippedName(entry.name))
           return true;
@@ -23233,7 +23263,7 @@ function createFileRoutes(opts = {}) {
   async function listDir(dirPath, basePath) {
     let entries;
     try {
-      entries = await fs50.readdir(dirPath, { withFileTypes: true });
+      entries = await fs51.readdir(dirPath, { withFileTypes: true });
     } catch {
       return [];
     }
@@ -23283,7 +23313,7 @@ function createFileRoutes(opts = {}) {
       }
       const targetPath = relPath ? path60.resolve(projectPath, relPath) : projectPath;
       try {
-        const stat = await fs50.stat(targetPath);
+        const stat = await fs51.stat(targetPath);
         if (!stat.isDirectory()) {
           return c.json({ error: "Path is not a directory" }, 400);
         }
@@ -23326,7 +23356,7 @@ function createFileRoutes(opts = {}) {
           return;
         let entries;
         try {
-          entries = await fs50.readdir(dirPath, { withFileTypes: true });
+          entries = await fs51.readdir(dirPath, { withFileTypes: true });
         } catch {
           return;
         }
@@ -23398,9 +23428,9 @@ function createFileRoutes(opts = {}) {
         }
         const destPath = path60.resolve(projectPath, relPath);
         const destDir = path60.dirname(destPath);
-        await fs50.mkdir(destDir, { recursive: true });
+        await fs51.mkdir(destDir, { recursive: true });
         const buffer = Buffer.from(await file.arrayBuffer());
-        await fs50.writeFile(destPath, buffer);
+        await fs51.writeFile(destPath, buffer);
         uploaded.push({
           name: file.name,
           path: relPath,
@@ -23425,8 +23455,8 @@ function createFileRoutes(opts = {}) {
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
       const { absolutePath } = resolved;
-      await fs50.writeFile(absolutePath, content, "utf-8");
-      const stat = await fs50.stat(absolutePath);
+      await fs51.writeFile(absolutePath, content, "utf-8");
+      const stat = await fs51.stat(absolutePath);
       return c.json({ ok: true, path: filePath, modifiedAt: stat.mtimeMs });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23459,19 +23489,19 @@ function createFileRoutes(opts = {}) {
           return c.json({ error: rootResolved.error }, rootResolved.status);
         const rel = path60.relative(rootResolved.absolutePath, absolutePath);
         const inside = rel !== "" && !rel.startsWith("..") && !path60.isAbsolute(rel);
-        const rootIsDir = await fs50.stat(rootResolved.absolutePath).then((s) => s.isDirectory(), () => false);
+        const rootIsDir = await fs51.stat(rootResolved.absolutePath).then((s) => s.isDirectory(), () => false);
         if (!inside || !rootIsDir)
           return c.json({ error: "Bundle root not found" }, 404);
       }
       let before;
       try {
-        before = await fs50.stat(absolutePath);
+        before = await fs51.stat(absolutePath);
       } catch (err) {
         if (err.code !== "ENOENT")
           throw err;
         if (!create)
           return c.json({ error: "File not found" }, 404);
-        await fs50.mkdir(path60.dirname(absolutePath), { recursive: true });
+        await fs51.mkdir(path60.dirname(absolutePath), { recursive: true });
       }
       if (before?.isDirectory())
         return c.json({ error: "Cannot write a directory" }, 400);
@@ -23480,10 +23510,10 @@ function createFileRoutes(opts = {}) {
       }
       const bytes = Buffer.from(await c.req.arrayBuffer());
       if (append)
-        await fs50.appendFile(absolutePath, bytes);
+        await fs51.appendFile(absolutePath, bytes);
       else
-        await fs50.writeFile(absolutePath, bytes);
-      const stat = await fs50.stat(absolutePath);
+        await fs51.writeFile(absolutePath, bytes);
+      const stat = await fs51.stat(absolutePath);
       return c.json({ ok: true, path: filePath, mtime: stat.mtimeMs, size: stat.size });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23502,13 +23532,13 @@ function createFileRoutes(opts = {}) {
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
       const { absolutePath } = resolved;
-      await fs50.mkdir(path60.dirname(absolutePath), { recursive: true });
+      await fs51.mkdir(path60.dirname(absolutePath), { recursive: true });
       try {
-        await fs50.access(absolutePath);
+        await fs51.access(absolutePath);
         return c.json({ error: "File already exists" }, 409);
       } catch {
       }
-      await fs50.writeFile(absolutePath, "", "utf-8");
+      await fs51.writeFile(absolutePath, "", "utf-8");
       return c.json({ ok: true, path: filePath });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23526,7 +23556,7 @@ function createFileRoutes(opts = {}) {
       const resolved = await resolveProjectFile(projectId, dirPath);
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
-      await fs50.mkdir(resolved.absolutePath, { recursive: true });
+      await fs51.mkdir(resolved.absolutePath, { recursive: true });
       return c.json({ ok: true, path: dirPath });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23550,8 +23580,8 @@ function createFileRoutes(opts = {}) {
       }
       const absOld = path60.resolve(projectPath, oldPath);
       const absNew = path60.resolve(projectPath, newPath);
-      await fs50.mkdir(path60.dirname(absNew), { recursive: true });
-      await fs50.rename(absOld, absNew);
+      await fs51.mkdir(path60.dirname(absNew), { recursive: true });
+      await fs51.rename(absOld, absNew);
       return c.json({ ok: true, oldPath, newPath });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23573,7 +23603,7 @@ function createFileRoutes(opts = {}) {
       if (absolutePath === path60.resolve(projectPath)) {
         return c.json({ error: "Cannot delete project root" }, 403);
       }
-      await fs50.rm(absolutePath, { recursive: true, force: true });
+      await fs51.rm(absolutePath, { recursive: true, force: true });
       return c.json({ ok: true, path: filePath });
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
@@ -23613,7 +23643,7 @@ function createFileRoutes(opts = {}) {
         return c.json({ error: "Path traversal not allowed" }, 403);
       }
       const absolutePath = isTmp ? path60.resolve(filePath) : path60.resolve(projectPath, filePath);
-      const stat = await fs50.stat(absolutePath);
+      const stat = await fs51.stat(absolutePath);
       if (stat.isDirectory()) {
         return c.json({ error: "Cannot download a directory" }, 400);
       }
@@ -23678,7 +23708,7 @@ function createFileRoutes(opts = {}) {
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
       const { projectPath, absolutePath } = resolved;
-      if (!(await fs50.stat(absolutePath)).isDirectory())
+      if (!(await fs51.stat(absolutePath)).isDirectory())
         return c.json({ error: "Not a directory" }, 400);
       const plan = await planFolderZip(absolutePath, projectPath, {
         includeIgnored: c.req.query("include") === "excluded",
@@ -23725,7 +23755,7 @@ function createFileRoutes(opts = {}) {
       const resolved = await resolveProjectFile(projectId, filePath);
       if ("error" in resolved)
         return c.json({ error: resolved.error }, resolved.status);
-      const stat = await fs50.stat(resolved.absolutePath);
+      const stat = await fs51.stat(resolved.absolutePath);
       return c.json({ path: filePath, modifiedAt: stat.mtimeMs, createdAt: stat.birthtimeMs, size: stat.size });
     } catch (err) {
       if (err.code === "ENOENT")
@@ -23745,7 +23775,7 @@ function createFileRoutes(opts = {}) {
         return c.json({ error: resolved.error }, resolved.status);
       const { absolutePath } = resolved;
       try {
-        const stat = await fs50.stat(absolutePath);
+        const stat = await fs51.stat(absolutePath);
         if (stat.isDirectory()) {
           return c.json({ error: "Path is a directory, use /files/tree instead" }, 400);
         }
@@ -23753,7 +23783,7 @@ function createFileRoutes(opts = {}) {
         if (stat.size > maxSize) {
           return c.json({ error: "File too large (max 10MB)" }, 413);
         }
-        const content = await fs50.readFile(absolutePath, "utf-8");
+        const content = await fs51.readFile(absolutePath, "utf-8");
         return c.json({
           path: filePath,
           content,
@@ -23783,7 +23813,7 @@ function createFileRoutes(opts = {}) {
     const resolved = path60.resolve(body.path);
     let stat;
     try {
-      stat = await fs50.stat(resolved);
+      stat = await fs51.stat(resolved);
     } catch {
       return c.json({ error: "path not found" }, 404);
     }
@@ -23801,7 +23831,7 @@ function createFileRoutes(opts = {}) {
     if (!target || !path60.isAbsolute(target))
       return c.json({ exists: false, reason: "absolute path required" });
     try {
-      const stat = await fs50.stat(target);
+      const stat = await fs51.stat(target);
       return c.json({ exists: true, isDirectory: stat.isDirectory() });
     } catch {
       return c.json({ exists: false });
@@ -23813,9 +23843,9 @@ function createFileRoutes(opts = {}) {
       return c.json({ error: "absolute path required" }, 400);
     try {
       const resolved = path60.resolve(target);
-      const entries = await fs50.readdir(resolved, { withFileTypes: true });
+      const entries = await fs51.readdir(resolved, { withFileTypes: true });
       if (c.req.query("files") === "1") {
-        const realDir = await fs50.realpath(resolved);
+        const realDir = await fs51.realpath(resolved);
         if (isHiddenHostPath(realDir))
           throw hiddenAsMissing("scandir", resolved);
         const withSizes = c.req.query("sizes") === "1";
@@ -23824,15 +23854,15 @@ function createFileRoutes(opts = {}) {
           if (isSkippedName(e.name))
             continue;
           const full = path60.join(resolved, e.name);
-          const st = e.isSymbolicLink() ? await fs50.stat(full).catch(() => null) : null;
+          const st = e.isSymbolicLink() ? await fs51.stat(full).catch(() => null) : null;
           const isDir = st ? st.isDirectory() : e.isDirectory();
           const isFile2 = st ? st.isFile() : e.isFile();
           if (!isDir && !isFile2)
             continue;
-          const real = st ? await fs50.realpath(full).catch(() => full) : path60.join(realDir, e.name);
+          const real = st ? await fs51.realpath(full).catch(() => full) : path60.join(realDir, e.name);
           if (isHiddenHostPath(real))
             continue;
-          const size = isFile2 && withSizes ? (st ?? await fs50.stat(full).catch(() => null))?.size : void 0;
+          const size = isFile2 && withSizes ? (st ?? await fs51.stat(full).catch(() => null))?.size : void 0;
           list.push({ name: e.name, path: full, type: isDir ? "directory" : "file", ...size !== void 0 ? { size } : {} });
         }
         list.sort((a, b) => a.type === b.type ? a.name.localeCompare(b.name) : a.type === "directory" ? -1 : 1);
@@ -23857,7 +23887,7 @@ function createFileRoutes(opts = {}) {
     return Object.assign(new Error(`ENOENT: no such file or directory, ${syscall} '${target}'`), { code: "ENOENT" });
   }
   async function readableRealPath(target) {
-    const real = await fs50.realpath(target);
+    const real = await fs51.realpath(target);
     if (isHiddenHostPath(real))
       throw hiddenAsMissing("realpath", target);
     return real;
@@ -23868,7 +23898,7 @@ function createFileRoutes(opts = {}) {
       return c.json({ error: "absolute path without .. required" }, 400);
     try {
       const realPath = await readableRealPath(target);
-      const stat = await fs50.stat(realPath);
+      const stat = await fs51.stat(realPath);
       return c.json({ path: target, realPath, size: stat.size, modifiedAt: stat.mtimeMs, isDirectory: stat.isDirectory() });
     } catch (err) {
       return c.json({ error: err.message }, fsErrorStatus(err));
@@ -23880,7 +23910,7 @@ function createFileRoutes(opts = {}) {
       return c.json({ error: "absolute path without .. required" }, 400);
     try {
       const real = await readableRealPath(target);
-      const stat = await fs50.stat(real);
+      const stat = await fs51.stat(real);
       if (!stat.isFile())
         return c.json({ error: "not a file" }, 400);
       const nodeStream = stat.size === 0 ? Readable.from([]) : createReadStream(real);
@@ -23907,7 +23937,7 @@ var init_files2 = __esm({
 
 // ../server/dist/routes/data-preview.js
 import { Hono as Hono3 } from "hono";
-import fs51 from "node:fs/promises";
+import fs52 from "node:fs/promises";
 import { createReadStream as createReadStream2 } from "node:fs";
 import path61 from "node:path";
 import Database6 from "better-sqlite3";
@@ -23940,7 +23970,7 @@ function quoteIdent(name) {
   return `"${name.replaceAll('"', '""')}"`;
 }
 async function sniffDelimiter(absolutePath) {
-  const fh = await fs51.open(absolutePath, "r");
+  const fh = await fs52.open(absolutePath, "r");
   let head;
   try {
     const buf = Buffer.alloc(65536);
@@ -24026,7 +24056,7 @@ function createDataPreviewRoutes() {
       return { error: "Path traversal not allowed", status: 403 };
     const absolutePath = path61.resolve(projectPath, filePath);
     try {
-      const stat = await fs51.stat(absolutePath);
+      const stat = await fs52.stat(absolutePath);
       if (stat.isDirectory())
         return { error: "Path is a directory", status: 400 };
     } catch {
@@ -24232,14 +24262,14 @@ var init_data_preview = __esm({
 });
 
 // ../server/dist/git-credentials.js
-import fs52 from "node:fs";
+import fs53 from "node:fs";
 import path62 from "node:path";
 import { homedir as homedir19 } from "node:os";
 function writeGitCredentialsFile(host, username, token) {
   const line = `https://${encodeURIComponent(username)}:${encodeURIComponent(token)}@${host}`;
   let lines = [];
-  if (fs52.existsSync(GIT_CREDENTIALS_PATH)) {
-    lines = fs52.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
+  if (fs53.existsSync(GIT_CREDENTIALS_PATH)) {
+    lines = fs53.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
   }
   const kept = lines.filter((l) => {
     try {
@@ -24249,9 +24279,9 @@ function writeGitCredentialsFile(host, username, token) {
     }
   });
   kept.push(line);
-  fs52.writeFileSync(GIT_CREDENTIALS_PATH, kept.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
+  fs53.writeFileSync(GIT_CREDENTIALS_PATH, kept.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    fs52.chmodSync(GIT_CREDENTIALS_PATH, 384);
+    fs53.chmodSync(GIT_CREDENTIALS_PATH, 384);
   } catch {
   }
 }
@@ -24260,9 +24290,9 @@ function saveGitCredentials({ host, username, token }) {
   console.log(`[GitCredentials] saved for host ${host}`);
 }
 function listGitCredentials() {
-  if (!fs52.existsSync(GIT_CREDENTIALS_PATH))
+  if (!fs53.existsSync(GIT_CREDENTIALS_PATH))
     return [];
-  const lines = fs52.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
+  const lines = fs53.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
   const byHost = /* @__PURE__ */ new Map();
   for (const line of lines) {
     try {
@@ -24276,9 +24306,9 @@ function listGitCredentials() {
   return [...byHost.values()];
 }
 function deleteGitCredential(host) {
-  if (!fs52.existsSync(GIT_CREDENTIALS_PATH))
+  if (!fs53.existsSync(GIT_CREDENTIALS_PATH))
     return;
-  const lines = fs52.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
+  const lines = fs53.readFileSync(GIT_CREDENTIALS_PATH, "utf-8").split("\n").filter((l) => l.trim() !== "");
   const kept = lines.filter((l) => {
     try {
       return new URL(l).host !== host;
@@ -24288,9 +24318,9 @@ function deleteGitCredential(host) {
   });
   if (kept.length === lines.length)
     return;
-  fs52.writeFileSync(GIT_CREDENTIALS_PATH, kept.length ? kept.join("\n") + "\n" : "", { encoding: "utf-8", mode: 384 });
+  fs53.writeFileSync(GIT_CREDENTIALS_PATH, kept.length ? kept.join("\n") + "\n" : "", { encoding: "utf-8", mode: 384 });
   try {
-    fs52.chmodSync(GIT_CREDENTIALS_PATH, 384);
+    fs53.chmodSync(GIT_CREDENTIALS_PATH, 384);
   } catch {
   }
   console.log(`[GitCredentials] removed for host ${host}`);
@@ -24304,7 +24334,7 @@ var init_git_credentials = __esm({
 });
 
 // ../server/dist/git-ssh.js
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import os6 from "node:os";
 import path63 from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -24315,13 +24345,13 @@ function looksLikePrivateKey(name, abs) {
     return false;
   let firstLine = "";
   try {
-    const fd = fs53.openSync(abs, "r");
+    const fd = fs54.openSync(abs, "r");
     try {
       const buf = Buffer.alloc(64);
-      const n = fs53.readSync(fd, buf, 0, 64, 0);
+      const n = fs54.readSync(fd, buf, 0, 64, 0);
       firstLine = buf.toString("utf-8", 0, n).split("\n")[0];
     } finally {
-      fs53.closeSync(fd);
+      fs54.closeSync(fd);
     }
   } catch {
     return false;
@@ -24335,7 +24365,7 @@ function isKeyEncrypted(abs) {
 function listSshKeys() {
   let entries = [];
   try {
-    entries = fs53.readdirSync(SSH_DIR);
+    entries = fs54.readdirSync(SSH_DIR);
   } catch {
     return [];
   }
@@ -24343,7 +24373,7 @@ function listSshKeys() {
   for (const name of entries) {
     const abs = path63.join(SSH_DIR, name);
     try {
-      if (!fs53.statSync(abs).isFile())
+      if (!fs54.statSync(abs).isFile())
         continue;
     } catch {
       continue;
@@ -24368,9 +24398,9 @@ function unlockSshKey(keyPath, passphrase) {
     return { ok: false, error: "ssh-agent is not running" };
   let dir = "";
   try {
-    dir = fs53.mkdtempSync(path63.join(os6.tmpdir(), "halo-askpass-"));
+    dir = fs54.mkdtempSync(path63.join(os6.tmpdir(), "halo-askpass-"));
     const askpass = path63.join(dir, "askpass.sh");
-    fs53.writeFileSync(askpass, ASKPASS_SCRIPT, { mode: 448 });
+    fs54.writeFileSync(askpass, ASKPASS_SCRIPT, { mode: 448 });
     const r = spawnSync3("ssh-add", [keyPath], {
       encoding: "utf-8",
       // stdin from /dev/null so ssh-add can never fall back to a tty prompt and block.
@@ -24399,7 +24429,7 @@ function unlockSshKey(keyPath, passphrase) {
     return { ok: false, error: "Failed to unlock key" };
   } finally {
     if (dir)
-      fs53.rmSync(dir, { recursive: true, force: true });
+      fs54.rmSync(dir, { recursive: true, force: true });
   }
 }
 function ensureSshAgent() {
@@ -24857,7 +24887,7 @@ var init_git = __esm({
 
 // ../server/dist/routes/agent-configs.js
 import { Hono as Hono5 } from "hono";
-import fs54 from "node:fs/promises";
+import fs55 from "node:fs/promises";
 import path65 from "node:path";
 import { homedir as homedir20 } from "node:os";
 import YAML14 from "yaml";
@@ -24884,12 +24914,12 @@ ${a2a[0].description}`
 }
 async function writeFileAtomic2(filePath, content) {
   const tmpPath = `${filePath}.tmp`;
-  await fs54.writeFile(tmpPath, content, "utf-8");
+  await fs55.writeFile(tmpPath, content, "utf-8");
   try {
-    await fs54.rename(tmpPath, filePath);
+    await fs55.rename(tmpPath, filePath);
   } catch {
-    await fs54.writeFile(filePath, content, "utf-8");
-    await fs54.rm(tmpPath, { force: true }).catch(() => {
+    await fs55.writeFile(filePath, content, "utf-8");
+    await fs55.rm(tmpPath, { force: true }).catch(() => {
     });
   }
 }
@@ -24927,7 +24957,7 @@ async function scaffoldModelBlock(scope, projectId) {
   for (const yamlPath of candidates) {
     let content;
     try {
-      content = await fs54.readFile(yamlPath, "utf-8");
+      content = await fs55.readFile(yamlPath, "utf-8");
     } catch {
       continue;
     }
@@ -24974,7 +25004,7 @@ function defaultAgentYamlTemplate() {
   }, { lineWidth: 120 });
 }
 async function ensureDir2(dir) {
-  await fs54.mkdir(dir, { recursive: true });
+  await fs55.mkdir(dir, { recursive: true });
 }
 function resolveAgentDir(id, scope, projectId) {
   if (scope === "global")
@@ -24987,14 +25017,14 @@ async function scanAgentsDir(dir, scope) {
   const agents = [];
   let names;
   try {
-    names = await fs54.readdir(dir);
+    names = await fs55.readdir(dir);
   } catch {
     return agents;
   }
   for (const entryName of names) {
     const agentDir = path65.join(dir, entryName);
     try {
-      const stat = await fs54.stat(agentDir);
+      const stat = await fs55.stat(agentDir);
       if (!stat.isDirectory())
         continue;
     } catch {
@@ -25002,8 +25032,8 @@ async function scanAgentsDir(dir, scope) {
     }
     const yamlPath = path65.join(agentDir, "agent.yaml");
     try {
-      const yamlStat = await fs54.stat(yamlPath);
-      const parsed = _yamlCache2.get(yamlPath, yamlStat.mtimeMs) ?? _yamlCache2.set(yamlPath, yamlStat.mtimeMs, parseAgentYaml(await fs54.readFile(yamlPath, "utf-8")));
+      const yamlStat = await fs55.stat(yamlPath);
+      const parsed = _yamlCache2.get(yamlPath, yamlStat.mtimeMs) ?? _yamlCache2.set(yamlPath, yamlStat.mtimeMs, parseAgentYaml(await fs55.readFile(yamlPath, "utf-8")));
       const { name, description, model, priority, tools, skills, internal } = parsed;
       agents.push({
         id: entryName,
@@ -25027,10 +25057,10 @@ async function ensureDefaultAgent(dir) {
   const defaultDir = path65.join(dir, "default");
   const yamlPath = path65.join(defaultDir, "agent.yaml");
   try {
-    await fs54.access(yamlPath);
+    await fs55.access(yamlPath);
   } catch {
     await ensureDir2(defaultDir);
-    await fs54.writeFile(yamlPath, defaultAgentYamlTemplate(), "utf-8");
+    await fs55.writeFile(yamlPath, defaultAgentYamlTemplate(), "utf-8");
   }
 }
 function createAgentConfigRoutes() {
@@ -25088,28 +25118,28 @@ function createAgentConfigRoutes() {
     }
     const agentDir = path65.join(baseDir, id);
     try {
-      await fs54.access(agentDir);
+      await fs55.access(agentDir);
       return c.json({ error: "Agent already exists" }, 409);
     } catch {
     }
     let conflictScope = null;
     if (scope === "workspace") {
       try {
-        await fs54.access(path65.join(GLOBAL_AGENTS_DIR4, id));
+        await fs55.access(path65.join(GLOBAL_AGENTS_DIR4, id));
         conflictScope = "global";
       } catch {
       }
     } else if (body.projectId) {
       try {
-        await fs54.access(path65.join(body.projectId, ".halo", "agents", id));
+        await fs55.access(path65.join(body.projectId, ".halo", "agents", id));
         conflictScope = "workspace";
       } catch {
       }
     }
     const scaffoldModel = await scaffoldModelBlock(scope, body.projectId);
     await ensureDir2(agentDir);
-    await fs54.writeFile(path65.join(agentDir, "agent.yaml"), defaultAgentYaml(body.name, body.description ?? "", scaffoldModel), "utf-8");
-    await fs54.writeFile(path65.join(agentDir, "AGENT.md"), `# ${body.name}
+    await fs55.writeFile(path65.join(agentDir, "agent.yaml"), defaultAgentYaml(body.name, body.description ?? "", scaffoldModel), "utf-8");
+    await fs55.writeFile(path65.join(agentDir, "AGENT.md"), `# ${body.name}
 
 ${body.description ?? ""}
 `, "utf-8");
@@ -25128,7 +25158,7 @@ ${body.description ?? ""}
     const { agentDir } = resolved;
     const yamlPath = path65.join(agentDir, "agent.yaml");
     try {
-      const content = await fs54.readFile(yamlPath, "utf-8");
+      const content = await fs55.readFile(yamlPath, "utf-8");
       return c.json({ yaml: content });
     } catch {
       return c.json({ error: "Agent not found" }, 404);
@@ -25152,7 +25182,7 @@ ${body.description ?? ""}
     const { agentDir } = resolved;
     const yamlPath = path65.join(agentDir, "agent.yaml");
     try {
-      await fs54.access(agentDir);
+      await fs55.access(agentDir);
     } catch {
       return c.json({ error: "Agent not found" }, 404);
     }
@@ -25165,7 +25195,7 @@ ${body.description ?? ""}
     if (typeof next.maxTokens === "number" && modelMax !== void 0 && next.maxTokens > modelMax) {
       let prev;
       try {
-        prev = ctxKey(YAML14.parse(await fs54.readFile(yamlPath, "utf-8")));
+        prev = ctxKey(YAML14.parse(await fs55.readFile(yamlPath, "utf-8")));
       } catch {
         prev = void 0;
       }
@@ -25188,7 +25218,7 @@ ${body.description ?? ""}
       return c.json({ error: resolved.error }, 400);
     const { agentDir } = resolved;
     try {
-      await fs54.access(agentDir);
+      await fs55.access(agentDir);
     } catch {
       return c.json({ error: "Agent not found" }, 404);
     }
@@ -25198,7 +25228,7 @@ ${body.description ?? ""}
         return c.json({ error: "Cannot delete the last global agent. At least one global agent must remain." }, 400);
       }
     }
-    await fs54.rm(agentDir, { recursive: true, force: true });
+    await fs55.rm(agentDir, { recursive: true, force: true });
     return c.json({ ok: true });
   });
   app2.patch("/agent-configs/:id/toggle", async (c) => {
@@ -25234,7 +25264,7 @@ ${body.description ?? ""}
     if (!filePath)
       return c.json({ content: "", exists: false, readOnly: !isMdWritable(fileType) });
     try {
-      const content = await fs54.readFile(filePath, "utf-8");
+      const content = await fs55.readFile(filePath, "utf-8");
       return c.json({ content, exists: true, path: filePath, readOnly: !isMdWritable(fileType) });
     } catch {
       return c.json({ content: "", exists: false, path: filePath, readOnly: !isMdWritable(fileType) });
@@ -25275,7 +25305,7 @@ ${body.description ?? ""}
         continue;
       }
       try {
-        const content = await fs54.readFile(filePath, "utf-8");
+        const content = await fs55.readFile(filePath, "utf-8");
         result[ft] = { content, exists: true, path: filePath, readOnly: !isMdWritable(ft) };
       } catch {
         result[ft] = { content: "", exists: false, path: filePath, readOnly: !isMdWritable(ft) };
@@ -25299,7 +25329,7 @@ ${body.description ?? ""}
     const dir = getSessionsDir(agentId, source, projectId || void 0);
     let files;
     try {
-      files = await fs54.readdir(dir);
+      files = await fs55.readdir(dir);
     } catch {
       return c.json({ sessions: [] });
     }
@@ -25308,7 +25338,7 @@ ${body.description ?? ""}
       if (!f.endsWith(".json"))
         continue;
       try {
-        const raw = await fs54.readFile(path65.join(dir, f), "utf-8");
+        const raw = await fs55.readFile(path65.join(dir, f), "utf-8");
         const session = JSON.parse(raw);
         sessions.push({
           id: session.id,
@@ -25342,7 +25372,7 @@ ${body.description ?? ""}
     if (!filePath)
       return c.json({ error: "Invalid id" }, 400);
     try {
-      const raw = await fs54.readFile(filePath, "utf-8");
+      const raw = await fs55.readFile(filePath, "utf-8");
       return c.json({ session: JSON.parse(raw) });
     } catch {
       return c.json({ error: "Session not found" }, 404);
@@ -25361,7 +25391,7 @@ ${body.description ?? ""}
     const dir = getSessionsDir(agentId, source, projectId || void 0);
     if (agentId === GOAL_AGENT_ID && !config.goalModeEnabled) {
       try {
-        await fs54.access(path65.join(dir, `${sessionId}.json`));
+        await fs55.access(path65.join(dir, `${sessionId}.json`));
       } catch {
         return c.json({ error: "Goal mode is disabled." }, 403);
       }
@@ -25383,7 +25413,7 @@ ${body.description ?? ""}
       agentSnapshot: body.agentSnapshot ?? {},
       messages: messages2
     };
-    await fs54.writeFile(path65.join(dir, `${sessionId}.json`), JSON.stringify(session, null, 2), "utf-8");
+    await fs55.writeFile(path65.join(dir, `${sessionId}.json`), JSON.stringify(session, null, 2), "utf-8");
     return c.json({ id: sessionId, session: { ...session, messages: void 0 } });
   });
   app2.delete("/agent-configs/:id/sessions", async (c) => {
@@ -25395,11 +25425,11 @@ ${body.description ?? ""}
     const dir = getSessionsDir(agentId, source, projectId || void 0);
     let deleted = 0;
     try {
-      const files = await fs54.readdir(dir);
+      const files = await fs55.readdir(dir);
       for (const f of files) {
         if (!f.endsWith(".json"))
           continue;
-        await fs54.rm(path65.join(dir, f));
+        await fs55.rm(path65.join(dir, f));
         deleted++;
       }
     } catch {
@@ -25411,7 +25441,7 @@ ${body.description ?? ""}
     if (!filePath)
       return c.json({ error: "Invalid id" }, 400);
     try {
-      await fs54.rm(filePath);
+      await fs55.rm(filePath);
       return c.json({ ok: true });
     } catch {
       return c.json({ error: "Session not found" }, 404);
@@ -25443,7 +25473,7 @@ var init_agent_configs = __esm({
 
 // ../server/dist/routes/skills.js
 import { Hono as Hono6 } from "hono";
-import fs55 from "node:fs/promises";
+import fs56 from "node:fs/promises";
 import path66 from "node:path";
 import { homedir as homedir21 } from "node:os";
 import YAML15 from "yaml";
@@ -25463,20 +25493,20 @@ function defaultSkillSettings() {
 }
 async function readYamlFile3(filePath) {
   try {
-    const content = await fs55.readFile(filePath, "utf-8");
+    const content = await fs56.readFile(filePath, "utf-8");
     return YAML15.parse(content) ?? {};
   } catch {
     try {
       const jsonPath = filePath.replace(/\.yaml$/, ".json");
-      return JSON.parse(await fs55.readFile(jsonPath, "utf-8"));
+      return JSON.parse(await fs56.readFile(jsonPath, "utf-8"));
     } catch {
       return {};
     }
   }
 }
 async function writeYamlFile(filePath, data) {
-  await fs55.mkdir(path66.dirname(filePath), { recursive: true });
-  await fs55.writeFile(filePath, YAML15.stringify(data, { lineWidth: 120 }), "utf-8");
+  await fs56.mkdir(path66.dirname(filePath), { recursive: true });
+  await fs56.writeFile(filePath, YAML15.stringify(data, { lineWidth: 120 }), "utf-8");
 }
 async function addSkillSettings(settingsPath, skillId) {
   const settings = await readYamlFile3(settingsPath);
@@ -25499,7 +25529,7 @@ async function removeSkillSettings(settingsPath, skillId) {
   }
 }
 async function ensureDir3(dir) {
-  await fs55.mkdir(dir, { recursive: true });
+  await fs56.mkdir(dir, { recursive: true });
 }
 function toSkillMd(name, description) {
   return `---
@@ -25518,17 +25548,17 @@ async function readSkillMetas(dirs) {
     const base = { path: skillDir, scope, ...extId ? { extId } : {}, ...overridden ? { overridden } : {} };
     const skillMdPath = path66.join(skillDir, "SKILL.md");
     try {
-      const mdStat = await fs55.stat(skillMdPath);
+      const mdStat = await fs56.stat(skillMdPath);
       let meta = _skillMdCache.get(skillMdPath, mdStat.mtimeMs);
       if (!meta) {
-        const { name, description, command } = parseSkillFrontmatter(await fs55.readFile(skillMdPath, "utf-8"));
+        const { name, description, command } = parseSkillFrontmatter(await fs56.readFile(skillMdPath, "utf-8"));
         meta = _skillMdCache.set(skillMdPath, mdStat.mtimeMs, { name: name || entryName, description: description ?? "", command });
       }
       skills.push({ id: entryName, name: meta.name, description: meta.description, ...base, command: meta.command });
     } catch {
       const yamlPath = path66.join(skillDir, "skill.yaml");
       try {
-        const yamlContent = await fs55.readFile(yamlPath, "utf-8");
+        const yamlContent = await fs56.readFile(yamlPath, "utf-8");
         const m = yamlContent.match(/^name:\s*(.+)$/m);
         const d = yamlContent.match(/^description:\s*(.+)$/m);
         skills.push({ id: entryName, name: m?.[1]?.trim() || entryName, description: d?.[1]?.trim() || "", ...base });
@@ -25570,12 +25600,12 @@ function createSkillRoutes() {
     }
     const skillDir = path66.join(baseDir, id);
     try {
-      await fs55.access(skillDir);
+      await fs56.access(skillDir);
       return c.json({ error: "Skill already exists" }, 409);
     } catch {
     }
     await ensureDir3(skillDir);
-    await fs55.writeFile(path66.join(skillDir, "SKILL.md"), toSkillMd(body.name, body.description ?? ""), "utf-8");
+    await fs56.writeFile(path66.join(skillDir, "SKILL.md"), toSkillMd(body.name, body.description ?? ""), "utf-8");
     const settingsPath = scope === "workspace" && body.projectId ? path66.join(body.projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
     await addSkillSettings(settingsPath, id);
     notifySkillsChanged(scope === "workspace" ? body.projectId : null);
@@ -25597,11 +25627,11 @@ function createSkillRoutes() {
       skillDir = path66.join(GLOBAL_SKILLS_DIR, id);
     }
     try {
-      await fs55.access(skillDir);
+      await fs56.access(skillDir);
     } catch {
       return c.json({ error: "Skill not found" }, 404);
     }
-    await fs55.rm(skillDir, { recursive: true, force: true });
+    await fs56.rm(skillDir, { recursive: true, force: true });
     const settingsPath = scope === "workspace" && projectId ? path66.join(projectId, ".halo", "settings.yaml") : GLOBAL_SETTINGS_PATH;
     await removeSkillSettings(settingsPath, id);
     notifySkillsChanged(scope === "workspace" && projectId ? projectId : null);
@@ -25638,23 +25668,23 @@ var init_skills = __esm({
 
 // ../server/dist/routes/settings.js
 import { Hono as Hono7 } from "hono";
-import fs56 from "node:fs/promises";
+import fs57 from "node:fs/promises";
 import path67 from "node:path";
 import { homedir as homedir22 } from "node:os";
 import YAML16 from "yaml";
 async function readSettingsFile(filePath) {
   try {
-    const content = await fs56.readFile(filePath, "utf-8");
+    const content = await fs57.readFile(filePath, "utf-8");
     return YAML16.parse(content) ?? {};
   } catch {
     return {};
   }
 }
 async function writeSettingsFile(filePath, data) {
-  await fs56.mkdir(path67.dirname(filePath), { recursive: true });
-  await fs56.writeFile(filePath, YAML16.stringify(data, { lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
+  await fs57.mkdir(path67.dirname(filePath), { recursive: true });
+  await fs57.writeFile(filePath, YAML16.stringify(data, { lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
   try {
-    await fs56.chmod(filePath, 384);
+    await fs57.chmod(filePath, 384);
   } catch {
   }
 }
@@ -25917,18 +25947,18 @@ var init_settings = __esm({
 });
 
 // ../server/dist/evolution/archive.js
-import fs57 from "node:fs";
+import fs58 from "node:fs";
 import path68 from "node:path";
 import { pipeline } from "node:stream/promises";
 import JSZip from "jszip";
 import { eq as eq13, and as and9, isNull as isNull5, lte, isNotNull as isNotNull3, lt as lt3 } from "drizzle-orm";
 async function zipDir(srcDir, outZip) {
-  if (!fs57.existsSync(srcDir))
+  if (!fs58.existsSync(srcDir))
     return false;
-  fs57.mkdirSync(path68.dirname(outZip), { recursive: true });
+  fs58.mkdirSync(path68.dirname(outZip), { recursive: true });
   const zip = new JSZip();
   const walk = (dir, rel) => {
-    const entries = fs57.readdirSync(dir, { withFileTypes: true });
+    const entries = fs58.readdirSync(dir, { withFileTypes: true });
     if (entries.length === 0 && rel) {
       zip.folder(rel);
       return;
@@ -25939,11 +25969,11 @@ async function zipDir(srcDir, outZip) {
       if (e.isDirectory()) {
         walk(abs, childRel);
       } else if (e.isFile()) {
-        zip.file(childRel, fs57.readFileSync(abs), { date: fs57.statSync(abs).mtime });
+        zip.file(childRel, fs58.readFileSync(abs), { date: fs58.statSync(abs).mtime });
       } else if (e.isSymbolicLink()) {
         try {
-          if (fs57.statSync(abs).isFile())
-            zip.file(childRel, fs57.readFileSync(abs));
+          if (fs58.statSync(abs).isFile())
+            zip.file(childRel, fs58.readFileSync(abs));
         } catch {
         }
       }
@@ -25951,7 +25981,7 @@ async function zipDir(srcDir, outZip) {
   };
   try {
     walk(srcDir, "");
-    await pipeline(zip.generateNodeStream({ type: "nodebuffer", streamFiles: true, compression: "DEFLATE" }), fs57.createWriteStream(outZip));
+    await pipeline(zip.generateNodeStream({ type: "nodebuffer", streamFiles: true, compression: "DEFLATE" }), fs58.createWriteStream(outZip));
     return true;
   } catch (err) {
     rmFile(outZip);
@@ -25961,20 +25991,20 @@ async function zipDir(srcDir, outZip) {
 }
 function rmDir(dir) {
   try {
-    fs57.rmSync(dir, { recursive: true, force: true });
+    fs58.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
 function rmFile(p) {
   try {
-    fs57.rmSync(p, { force: true });
+    fs58.rmSync(p, { force: true });
   } catch {
   }
 }
 async function archiveRun(workspacePath, runId, errors) {
   const runDir = wsEvoRunDir(workspacePath, runId);
   const outZip = wsEvoArchivedRunZip(workspacePath, runId);
-  if (!fs57.existsSync(runDir)) {
+  if (!fs58.existsSync(runDir)) {
     return true;
   }
   if (!await zipDir(runDir, outZip)) {
@@ -25987,7 +26017,7 @@ async function archiveRun(workspacePath, runId, errors) {
 async function archiveApply(workspacePath, applyId, errors) {
   const applyDir = wsEvoApplyDir(workspacePath, applyId);
   const outZip = wsEvoArchivedApplyZip(workspacePath, applyId);
-  if (!fs57.existsSync(applyDir))
+  if (!fs58.existsSync(applyDir))
     return true;
   if (!await zipDir(applyDir, outZip)) {
     errors.push(`zip failed for apply ${applyId}`);
@@ -26114,7 +26144,7 @@ var init_raw_sqlite = __esm({
 // ../server/dist/routes/evolution.js
 import { Hono as Hono8 } from "hono";
 import { eq as eq14, desc as desc2, lt as lt4, and as and10, or as or2, sql as sql2 } from "drizzle-orm";
-import fs58 from "node:fs/promises";
+import fs59 from "node:fs/promises";
 import path69 from "node:path";
 function createEvolutionRoutes() {
   const router = new Hono8();
@@ -26180,33 +26210,33 @@ function createEvolutionRoutes() {
     const dir = wsEvoRunDir(row.workspacePath, id);
     let patchMd = null;
     try {
-      patchMd = await fs58.readFile(path69.join(dir, "patch.md"), "utf-8");
+      patchMd = await fs59.readFile(path69.join(dir, "patch.md"), "utf-8");
     } catch {
     }
     let scoreJson = null;
     try {
-      const raw = await fs58.readFile(path69.join(dir, "score.json"), "utf-8");
+      const raw = await fs59.readFile(path69.join(dir, "score.json"), "utf-8");
       scoreJson = JSON.parse(raw);
     } catch {
     }
     let wrapperLog = null;
     try {
-      wrapperLog = await fs58.readFile(evoWrapperLogFile(id), "utf-8");
+      wrapperLog = await fs59.readFile(evoWrapperLogFile(id), "utf-8");
     } catch {
     }
     let subCliLog = null;
     try {
-      subCliLog = await fs58.readFile(path69.join(dir, "sub-cli.log"), "utf-8");
+      subCliLog = await fs59.readFile(path69.join(dir, "sub-cli.log"), "utf-8");
     } catch {
     }
     let skipReasonMd = null;
     try {
-      skipReasonMd = await fs58.readFile(path69.join(dir, ".skip.md"), "utf-8");
+      skipReasonMd = await fs59.readFile(path69.join(dir, ".skip.md"), "utf-8");
     } catch {
     }
     let snapshotSummary = null;
     try {
-      const raw = await fs58.readFile(path69.join(dir, "source-snapshot.json"), "utf-8");
+      const raw = await fs59.readFile(path69.join(dir, "source-snapshot.json"), "utf-8");
       const parsed = JSON.parse(raw);
       const msgs = parsed.rawMessages ?? [];
       const firstUser = msgs.find((m) => m.role === "user");
@@ -27099,7 +27129,7 @@ var init_auth = __esm({
 });
 
 // ../server/dist/channels/web/handler.js
-import fs59 from "node:fs";
+import fs60 from "node:fs";
 function buildWebSessionPrefix(accountId) {
   return sessionPrefix("web", accountId);
 }
@@ -27127,7 +27157,7 @@ function createWebChannel(deps) {
       }
       path94 = override;
     }
-    const resolved = scaffold ? resolveAccountWorkspace({ ...account, workspacePath: path94 }) : fs59.existsSync(path94) ? path94 : null;
+    const resolved = scaffold ? resolveAccountWorkspace({ ...account, workspacePath: path94 }) : fs60.existsSync(path94) ? path94 : null;
     if (!resolved)
       return { ok: false, error: "workspace not found" };
     return { ok: true, path: resolved };
@@ -27554,14 +27584,14 @@ var init_etag = __esm({
 
 // ../server/dist/routes/halo-city.js
 import { Hono as Hono12 } from "hono";
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path70 from "node:path";
 import crypto7 from "node:crypto";
 import Database7 from "better-sqlite3";
 function scanSkills2(dir) {
   let names;
   try {
-    names = fs60.readdirSync(dir);
+    names = fs61.readdirSync(dir);
   } catch {
     return [];
   }
@@ -27570,7 +27600,7 @@ function scanSkills2(dir) {
     const skillMd = path70.join(dir, entry, "SKILL.md");
     let stat;
     try {
-      stat = fs60.statSync(skillMd);
+      stat = fs61.statSync(skillMd);
       if (!stat.isFile())
         continue;
     } catch {
@@ -27579,7 +27609,7 @@ function scanSkills2(dir) {
     let meta = _skillCache.get(skillMd, stat.mtimeMs);
     if (!meta) {
       try {
-        const { name, description, command } = parseSkillFrontmatter(fs60.readFileSync(skillMd, "utf-8"));
+        const { name, description, command } = parseSkillFrontmatter(fs61.readFileSync(skillMd, "utf-8"));
         meta = _skillCache.set(skillMd, stat.mtimeMs, { id: entry, name: name || entry, description: description ?? "", command });
       } catch {
         continue;
@@ -27664,7 +27694,7 @@ function snapshotWorkspace(sm, wsPath, label) {
 function roReader(rawPath) {
   let wsPath;
   try {
-    wsPath = fs60.realpathSync(rawPath);
+    wsPath = fs61.realpathSync(rawPath);
   } catch {
     return null;
   }
@@ -27672,7 +27702,7 @@ function roReader(rawPath) {
   if (cached2)
     return cached2;
   const dbPath = path70.join(wsPath, ".halo", "halo.db");
-  if (!fs60.existsSync(dbPath))
+  if (!fs61.existsSync(dbPath))
     return null;
   try {
     const db4 = new Database7(dbPath, { readonly: true, fileMustExist: true });
@@ -27701,7 +27731,7 @@ function dropRoReader(rawPath) {
     return;
   let wsPath = rawPath;
   try {
-    wsPath = fs60.realpathSync(rawPath);
+    wsPath = fs61.realpathSync(rawPath);
   } catch {
   }
   const r = _roReaders.get(wsPath);
@@ -27797,7 +27827,7 @@ function workspaceBirth(wsPath) {
   let b = _birthCache.get(wsPath);
   if (b === void 0) {
     try {
-      b = fs60.statSync(wsPath).birthtimeMs || fs60.statSync(wsPath).ctimeMs;
+      b = fs61.statSync(wsPath).birthtimeMs || fs61.statSync(wsPath).ctimeMs;
     } catch {
       b = 0;
     }
@@ -27809,7 +27839,7 @@ function discoverWorkspaces(registry2) {
   const out = /* @__PURE__ */ new Map();
   const add = (p, label) => {
     try {
-      const resolved = fs60.realpathSync(p);
+      const resolved = fs61.realpathSync(p);
       if (!out.has(resolved))
         out.set(resolved, label);
     } catch {
@@ -27888,7 +27918,7 @@ function createShowRoutes(registry2) {
     if (scoped) {
       let allowed = false;
       try {
-        allowed = fs60.realpathSync(wsPath) === fs60.realpathSync(scoped.workspacePath);
+        allowed = fs61.realpathSync(wsPath) === fs61.realpathSync(scoped.workspacePath);
       } catch {
       }
       if (!allowed || !canAddressSession(scoped, id))
@@ -27916,7 +27946,7 @@ function createShowRoutes(registry2) {
       const row = reader.getById.get(id);
       if (!row)
         return c.json({ error: "session not found" }, 404);
-      if (!fs60.existsSync(uiLogPath(getSessionDir(row.agent_id, wsPath), fileSegment(id))))
+      if (!fs61.existsSync(uiLogPath(getSessionDir(row.agent_id, wsPath), fileSegment(id))))
         return c.json({ error: "session not found" }, 404);
       const data = loadSessionView(id, row.agent_id, wsPath);
       if (!data)
@@ -28300,7 +28330,7 @@ var init_transcribe_ws = __esm({
 
 // ../server/dist/stt/models.js
 import { createHash as createHash3 } from "node:crypto";
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 import fsp from "node:fs/promises";
 import http2 from "node:http";
 import https2 from "node:https";
@@ -28341,7 +28371,7 @@ function createSttModelManager(opts = {}) {
   let closed = false;
   const fileReady = (f) => {
     try {
-      return fs61.statSync(filePath(f.path)).size === f.size;
+      return fs62.statSync(filePath(f.path)).size === f.size;
     } catch {
       return false;
     }
@@ -28364,26 +28394,26 @@ function createSttModelManager(opts = {}) {
   async function fetchFile(f, url, base) {
     const final = filePath(f.path);
     const part = `${final}.part`;
-    fs61.mkdirSync(path71.dirname(final), { recursive: true });
+    fs62.mkdirSync(path71.dirname(final), { recursive: true });
     let have = 0;
     try {
-      have = fs61.statSync(part).size;
+      have = fs62.statSync(part).size;
     } catch {
     }
     if (have > f.size) {
-      fs61.rmSync(part, { force: true });
+      fs62.rmSync(part, { force: true });
       have = 0;
     }
     received = base + have;
     if (have === f.size) {
       const hash = createHash3("sha256");
-      for await (const chunk of fs61.createReadStream(part))
+      for await (const chunk of fs62.createReadStream(part))
         hash.update(chunk);
       if (hash.digest("hex") === f.sha256) {
-        fs61.renameSync(part, final);
+        fs62.renameSync(part, final);
         return;
       }
-      fs61.rmSync(part, { force: true });
+      fs62.rmSync(part, { force: true });
       have = 0;
     }
     const ac = new AbortController();
@@ -28402,7 +28432,7 @@ function createSttModelManager(opts = {}) {
     try {
       const res = await httpGet(url, have > 0 ? { Range: `bytes=${have}-` } : {}, ac.signal);
       if (res.statusCode === 416) {
-        fs61.rmSync(part, { force: true });
+        fs62.rmSync(part, { force: true });
         throw new Error("HTTP 416");
       }
       if (res.statusCode !== 200 && res.statusCode !== 206)
@@ -28416,7 +28446,7 @@ function createSttModelManager(opts = {}) {
       const hash = createHash3("sha256");
       let got = 0;
       if (resume) {
-        for await (const chunk of fs61.createReadStream(part))
+        for await (const chunk of fs62.createReadStream(part))
           hash.update(chunk);
         got = have;
       }
@@ -28439,10 +28469,10 @@ function createSttModelManager(opts = {}) {
       if (got < f.size)
         throw new Error(`truncated (${got} of ${f.size} bytes)`);
       if (got > f.size || hash.digest("hex") !== f.sha256) {
-        fs61.rmSync(part, { force: true });
+        fs62.rmSync(part, { force: true });
         throw new Error(got > f.size ? `size mismatch (more than ${f.size} bytes)` : "sha256 mismatch");
       }
-      fs61.renameSync(part, final);
+      fs62.renameSync(part, final);
     } catch (err) {
       if (reason)
         throw new Error(reason);
@@ -28970,7 +29000,7 @@ var init_stt_ws = __esm({
 // ../server/dist/jupyter/manager.js
 import { spawn as nodeSpawn } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import fs62 from "node:fs";
+import fs63 from "node:fs";
 import net from "node:net";
 import os9 from "node:os";
 import path72 from "node:path";
@@ -28978,8 +29008,8 @@ import { WebSocket } from "ws";
 function resolveExecutable(configured) {
   const isExe = (p) => {
     try {
-      fs62.accessSync(p, fs62.constants.X_OK);
-      return fs62.statSync(p).isFile();
+      fs63.accessSync(p, fs63.constants.X_OK);
+      return fs63.statSync(p).isFile();
     } catch {
       return false;
     }
@@ -29314,7 +29344,7 @@ var init_manager = __esm({
 });
 
 // ../server/dist/routes/jupyter.js
-import fs63 from "node:fs/promises";
+import fs64 from "node:fs/promises";
 import path73 from "node:path";
 import { Hono as Hono15 } from "hono";
 import { WebSocketServer as WebSocketServer3 } from "ws";
@@ -29346,8 +29376,8 @@ function createJupyterRoutes(jm) {
       return c.json({ error: "Project not found" }, 400);
     if (!validatePath(nbPath, projectPath))
       return c.json({ error: "Path outside the workspace" }, 400);
-    const cwd = await fs63.realpath(path73.dirname(path73.resolve(projectPath, nbPath))).catch(() => null);
-    if (!cwd || !(await fs63.stat(cwd)).isDirectory())
+    const cwd = await fs64.realpath(path73.dirname(path73.resolve(projectPath, nbPath))).catch(() => null);
+    if (!cwd || !(await fs64.stat(cwd)).isDirectory())
       return c.json({ error: "Notebook directory not found" }, 400);
     try {
       return c.json(await jm.startKernel(name, cwd));
@@ -29518,7 +29548,7 @@ var init_upgrade_router = __esm({
 });
 
 // ../server/dist/ws/git-dir-watcher.js
-import fs64 from "node:fs";
+import fs65 from "node:fs";
 import path74 from "node:path";
 var GitDirWatcher;
 var init_git_dir_watcher = __esm({
@@ -29544,7 +29574,7 @@ var init_git_dir_watcher = __esm({
         this.stop();
         this.workspaceRoot = workspaceRoot;
         const gitDir = path74.join(workspaceRoot, ".git");
-        if (fs64.existsSync(gitDir)) {
+        if (fs65.existsSync(gitDir)) {
           this.watchGitDir(gitDir);
         } else {
           this.watchParentForGit(workspaceRoot);
@@ -29553,7 +29583,7 @@ var init_git_dir_watcher = __esm({
       /** Watch the `.git` dir for index/HEAD changes (steady state). */
       watchGitDir(gitDir) {
         try {
-          this.watcher = fs64.watch(gitDir, { persistent: true, recursive: false }, (_eventType, filename) => {
+          this.watcher = fs65.watch(gitDir, { persistent: true, recursive: false }, (_eventType, filename) => {
             this.handleGitEvent(filename);
           });
           this.watcher.on("error", (err) => {
@@ -29572,7 +29602,7 @@ var init_git_dir_watcher = __esm({
        *  Exists solely during the non-repo window; upgraded away on first `.git`. */
       watchParentForGit(workspaceRoot) {
         try {
-          this.watcher = fs64.watch(workspaceRoot, { persistent: true, recursive: false }, (_eventType, filename) => {
+          this.watcher = fs65.watch(workspaceRoot, { persistent: true, recursive: false }, (_eventType, filename) => {
             this.handleParentEvent(filename);
           });
           this.watcher.on("error", (err) => {
@@ -29609,7 +29639,7 @@ var init_git_dir_watcher = __esm({
         if (!root)
           return;
         const gitDir = path74.join(root, ".git");
-        if (!fs64.existsSync(gitDir))
+        if (!fs65.existsSync(gitDir))
           return;
         this.closeWatcher();
         this.watchGitDir(gitDir);
@@ -30650,9 +30680,9 @@ import Database8 from "better-sqlite3";
 import { drizzle as drizzle5 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable5, text as text5, integer as integer5 } from "drizzle-orm/sqlite-core";
 import path76 from "node:path";
-import fs65 from "node:fs";
+import fs66 from "node:fs";
 function createCronDb(globalDir2) {
-  fs65.mkdirSync(globalDir2, { recursive: true });
+  fs66.mkdirSync(globalDir2, { recursive: true });
   const dbPath = path76.join(globalDir2, "cron.db");
   const sqlite = new Database8(dbPath);
   sqlite.pragma("journal_mode = WAL");
@@ -30868,7 +30898,7 @@ CREATE INDEX IF NOT EXISTS idx_cron_runs_status ON cron_runs(status);
 });
 
 // ../server/dist/a2a/exposure.js
-import fs66 from "node:fs";
+import fs67 from "node:fs";
 import path77 from "node:path";
 import crypto8 from "node:crypto";
 function samePath(a, b, platform = process.platform) {
@@ -30882,7 +30912,7 @@ function realBase() {
   if (baseCache?.raw !== raw) {
     let real = null;
     try {
-      real = fs66.realpathSync(raw);
+      real = fs67.realpathSync(raw);
     } catch {
       console.warn(`[A2A] base dir ${raw} not found \u2014 nothing is exposed`);
     }
@@ -30907,14 +30937,14 @@ function resolveExposedWorkspace(base, rel) {
   }
   let real;
   try {
-    real = fs66.realpathSync(path77.join(base, ...segs));
+    real = fs67.realpathSync(path77.join(base, ...segs));
   } catch {
     return null;
   }
   if (!real.startsWith(base.endsWith(path77.sep) ? base : base + path77.sep))
     return null;
   try {
-    if (!fs66.statSync(path77.join(real, CARD_FILE)).isFile())
+    if (!fs67.statSync(path77.join(real, CARD_FILE)).isFile())
       return null;
   } catch {
     return null;
@@ -30929,14 +30959,14 @@ function publicOrigin(c) {
   return `${proto}://${c.req.header("host") ?? url.host}`;
 }
 function buildCard(workspace, interfaceUrl, caps) {
-  const raw = JSON.parse(fs66.readFileSync(path77.join(workspace, CARD_FILE), "utf8"));
+  const raw = JSON.parse(fs67.readFileSync(path77.join(workspace, CARD_FILE), "utf8"));
   if (typeof raw.name !== "string" || typeof raw.description !== "string" || !Array.isArray(raw.skills)) {
     throw new Error('agent-card.json needs string "name", string "description" and array "skills"');
   }
   return {
     name: raw.name,
     description: raw.description,
-    version: typeof raw.version === "string" ? raw.version : "2.0.2",
+    version: typeof raw.version === "string" ? raw.version : "2.0.3",
     supportedInterfaces: [{ url: interfaceUrl, protocolBinding: "JSONRPC", protocolVersion: A2A_VERSION }],
     capabilities: { streaming: caps.streaming, pushNotifications: true, extendedAgentCard: false },
     ...caps.tokenAuth === false ? {} : {
@@ -30977,7 +31007,7 @@ var init_exposure = __esm({
           return { ok: false, status: 404 };
         let bound;
         try {
-          bound = fs66.realpathSync(auth.account.workspacePath);
+          bound = fs67.realpathSync(auth.account.workspacePath);
         } catch {
           return { ok: false, status: 404 };
         }
@@ -31429,7 +31459,7 @@ var init_session_id = __esm({
 });
 
 // ../server/dist/a2a/agentcore.js
-import fs67 from "node:fs";
+import fs68 from "node:fs";
 import os10 from "node:os";
 import path78 from "node:path";
 import crypto10 from "node:crypto";
@@ -31440,17 +31470,17 @@ function readLease(file) {
   let mtimeMs;
   let fd;
   try {
-    fd = fs67.openSync(file, "r");
+    fd = fs68.openSync(file, "r");
   } catch (err) {
     if (err.code === "ENOENT")
       return null;
     throw err;
   }
   try {
-    mtimeMs = fs67.fstatSync(fd).mtimeMs;
-    raw = fs67.readFileSync(fd, "utf8");
+    mtimeMs = fs68.fstatSync(fd).mtimeMs;
+    raw = fs68.readFileSync(fd, "utf8");
   } finally {
-    fs67.closeSync(fd);
+    fs68.closeSync(fd);
   }
   try {
     const b = JSON.parse(raw);
@@ -31464,12 +31494,12 @@ function leaseJson(owner, now) {
 }
 function writeLease(file, owner, now) {
   const tmp = `${file}.${owner}.tmp`;
-  fs67.writeFileSync(tmp, leaseJson(owner, now));
-  fs67.renameSync(tmp, file);
+  fs68.writeFileSync(tmp, leaseJson(owner, now));
+  fs68.renameSync(tmp, file);
 }
 function tryAcquireLease(file, owner, now = Date.now()) {
   try {
-    fs67.writeFileSync(file, leaseJson(owner, now), { flag: "wx" });
+    fs68.writeFileSync(file, leaseJson(owner, now), { flag: "wx" });
     return "held";
   } catch (err) {
     if (err.code !== "EEXIST")
@@ -31497,7 +31527,7 @@ function heartbeatLease(file, owner, now = Date.now()) {
 function releaseLease(file, owner) {
   try {
     if (readLease(file)?.body?.owner === owner)
-      fs67.unlinkSync(file);
+      fs68.unlinkSync(file);
   } catch {
   }
 }
@@ -31519,7 +31549,7 @@ function upstreamStrategies(workspace, accessLevel) {
 function seedAgentCard(workspace) {
   const card = { name: "Halo", description: "Halo multi-agent workspace on Amazon Bedrock AgentCore. Send a task as plain text.", skills: [] };
   try {
-    fs67.writeFileSync(path78.join(workspace, CARD_FILE), `${JSON.stringify(card, null, 2)}
+    fs68.writeFileSync(path78.join(workspace, CARD_FILE), `${JSON.stringify(card, null, 2)}
 `, { flag: "wx" });
     return true;
   } catch (err) {
@@ -31581,18 +31611,18 @@ function parseInvocation(raw) {
 function readPromptFile(workspace, rel) {
   let real;
   try {
-    real = fs67.realpathSync(path78.resolve(workspace, rel));
+    real = fs68.realpathSync(path78.resolve(workspace, rel));
   } catch {
     return { error: `promptFile not found: ${rel}` };
   }
   if (!real.startsWith(workspace + path78.sep) || isHiddenWorkspacePath(real, workspace))
     return { error: `promptFile must be a file inside the workspace: ${rel}` };
-  const st = fs67.statSync(real);
+  const st = fs68.statSync(real);
   if (!st.isFile())
     return { error: `promptFile is not a regular file: ${rel}` };
   if (st.size > MAX_PROMPT_FILE)
     return { error: `promptFile is larger than ${MAX_PROMPT_FILE} bytes: ${rel}` };
-  const text6 = fs67.readFileSync(real, "utf8");
+  const text6 = fs68.readFileSync(real, "utf8");
   return text6.trim() ? text6 : { error: `promptFile is empty: ${rel}` };
 }
 async function startInvocation(sm, workspace, accessLevel, req) {
@@ -31792,7 +31822,7 @@ function createAgentCoreA2ARoutes(deps) {
   return app2;
 }
 function createAgentCoreA2A(registry2, rawWorkspace, onLost) {
-  const workspace = fs67.realpathSync(rawWorkspace);
+  const workspace = fs68.realpathSync(rawWorkspace);
   const haloDir = path78.join(workspace, ".halo");
   setDurableDbDir(haloDir);
   if (!config.a2a.publicUrl)
@@ -31807,7 +31837,7 @@ function createAgentCoreA2A(registry2, rawWorkspace, onLost) {
         setA2ADb(a2a);
         runs = createRunsDb(haloDir);
         setRunsDb(runs);
-        fs67.rmSync(path78.join(haloDir, RUNTIME_LOCK_FILE), { force: true });
+        fs68.rmSync(path78.join(haloDir, RUNTIME_LOCK_FILE), { force: true });
         registry2.getOrCreate(workspace);
       } catch (err) {
         setA2ADb(null);
@@ -31835,7 +31865,7 @@ function createAgentCoreA2A(registry2, rawWorkspace, onLost) {
   const activate = () => {
     if (active)
       return;
-    fs67.mkdirSync(haloDir, { recursive: true });
+    fs68.mkdirSync(haloDir, { recursive: true });
     if (seedAgentCard(workspace))
       console.log(`[AgentCoreA2A] seeded ${path78.join(workspace, CARD_FILE)}`);
     active = true;
@@ -32022,7 +32052,7 @@ var init_dispatcher = __esm({
 
 // ../server/dist/cron/runner.js
 import { spawn as spawn4, execFileSync } from "node:child_process";
-import fs68 from "node:fs";
+import fs69 from "node:fs";
 import path79 from "node:path";
 import { homedir as homedir24 } from "node:os";
 import { Cron } from "croner";
@@ -32128,7 +32158,7 @@ function jobChangedFields(job) {
 function sessionKeyFor(workspacePath, sessionId) {
   let ws;
   try {
-    ws = fs68.realpathSync(workspacePath);
+    ws = fs69.realpathSync(workspacePath);
   } catch {
     ws = path79.resolve(workspacePath);
   }
@@ -32207,7 +32237,7 @@ function sweepOrphanRuns(opts) {
   }
 }
 function startCronDaemon() {
-  fs68.mkdirSync(logsDir(), { recursive: true });
+  fs69.mkdirSync(logsDir(), { recursive: true });
   sweepOrphanRuns();
   reloadAll();
   _daemonTimers.push(setInterval(() => {
@@ -32410,7 +32440,7 @@ async function runJob(jobId, triggerKind) {
   const runId = newRunId();
   const startedAt = Date.now();
   const logPath = logPathFor(runId);
-  fs68.mkdirSync(logsDir(), { recursive: true });
+  fs69.mkdirSync(logsDir(), { recursive: true });
   const sessionId = job.stateless ? perRunSessionId(job, startedAt) : effectiveSessionId(job);
   const sessionKey = sessionKeyFor(job.workspacePath, sessionId);
   const host = _sessionRegistry?.peek(job.workspacePath);
@@ -32453,7 +32483,7 @@ async function runJob(jobId, triggerKind) {
     }).run();
     broadcast({ type: "cron:run_changed", jobId, runId, status: "running" });
     const targets = parseTargets(job.targets);
-    if (!fs68.existsSync(job.workspacePath)) {
+    if (!fs69.existsSync(job.workspacePath)) {
       finalize(runId, jobId, {
         status: "failed",
         output: null,
@@ -32496,7 +32526,7 @@ async function runJob(jobId, triggerKind) {
       args.push("--access", accessLevel);
     const [spawnBin, spawnArgs] = process.platform === "win32" && cli.endsWith(".cmd") ? ["cmd.exe", ["/c", cli, ...args]] : [cli, args];
     const timeoutSec = job.timeoutSec ?? CLI_TIMEOUT_SEC;
-    const teeStream = fs68.createWriteStream(logPath, { flags: "a" });
+    const teeStream = fs69.createWriteStream(logPath, { flags: "a" });
     teeStream.write(`=== ${(/* @__PURE__ */ new Date()).toISOString()} cron run ${runId} job=${jobId} trigger=${triggerKind} ===
 `);
     teeStream.write(`agent=${job.agentId} session=${sessionId}${job.stateless ? " (stateless)" : ""}${accessLevel ? ` access=${accessLevel}` : ""} workspace=${job.workspacePath} dir=${job.workingDir ?? "."} schedule=${job.schedule}
@@ -32623,7 +32653,7 @@ function readSessionRow(workspacePath, sessionId) {
     let entry = _sessionRows.get(workspacePath);
     if (!entry) {
       const file = path79.join(workspacePath, ".halo", "halo.db");
-      if (!fs68.existsSync(file))
+      if (!fs69.existsSync(file))
         return null;
       entry = { db: new Database9(file, { readonly: true, fileMustExist: true }), version: -1, rows: /* @__PURE__ */ new Map() };
       _sessionRows.set(workspacePath, entry);
@@ -32728,7 +32758,7 @@ async function deleteRuns(runs) {
   const openWorkspace = (workspacePath) => {
     let ws = workspaceOf.get(workspacePath);
     if (ws === void 0) {
-      ws = fs68.existsSync(path79.join(workspacePath, ".halo", "halo.db")) ? { workspacePath, db: getWorkspaceDb(workspacePath).db } : null;
+      ws = fs69.existsSync(path79.join(workspacePath, ".halo", "halo.db")) ? { workspacePath, db: getWorkspaceDb(workspacePath).db } : null;
       workspaceOf.set(workspacePath, ws);
     }
     return ws;
@@ -32785,15 +32815,15 @@ async function deleteRunSession({ workspacePath, db: db4 }, run) {
 }
 async function pruneOldLogs() {
   const dir = logsDir();
-  if (!fs68.existsSync(dir))
+  if (!fs69.existsSync(dir))
     return;
   const cutoff = Date.now() - LOG_RETENTION_DAYS * DAY_MS2;
-  for (const name of fs68.readdirSync(dir)) {
+  for (const name of fs69.readdirSync(dir)) {
     const p = path79.join(dir, name);
     try {
-      const stat = fs68.statSync(p);
+      const stat = fs69.statSync(p);
       if (stat.mtimeMs < cutoff)
-        fs68.rmSync(p, { force: true });
+        fs69.rmSync(p, { force: true });
     } catch {
     }
   }
@@ -32846,7 +32876,7 @@ var init_runner = __esm({
 // ../server/dist/routes/cron.js
 import { Hono as Hono18 } from "hono";
 import { eq as eq17, desc as desc3, lt as lt7, and as and13 } from "drizzle-orm";
-import fs69 from "node:fs/promises";
+import fs70 from "node:fs/promises";
 import path80 from "node:path";
 import { Cron as Cron2 } from "croner";
 function newJobId() {
@@ -33215,7 +33245,7 @@ function createCronRoutes() {
       return c.json({ log: null });
     let log2 = null;
     try {
-      log2 = await fs69.readFile(row.logPath, "utf-8");
+      log2 = await fs70.readFile(row.logPath, "utf-8");
     } catch {
     }
     return c.json({ log: log2 });
@@ -33281,7 +33311,7 @@ var init_cron = __esm({
 });
 
 // ../server/dist/extensions/install.js
-import fs70 from "node:fs";
+import fs71 from "node:fs";
 import path81 from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import JSZip2 from "jszip";
@@ -33315,42 +33345,42 @@ async function unpackZip(zipBuf, dest) {
       throw new ExtensionInstallError(`zip entry is a symlink: ${entry.name}`);
     const abs = path81.join(dest, rel);
     if (entry.dir) {
-      fs70.mkdirSync(abs, { recursive: true });
+      fs71.mkdirSync(abs, { recursive: true });
       continue;
     }
-    fs70.mkdirSync(path81.dirname(abs), { recursive: true });
-    fs70.writeFileSync(abs, await entry.async("nodebuffer"));
+    fs71.mkdirSync(path81.dirname(abs), { recursive: true });
+    fs71.writeFileSync(abs, await entry.async("nodebuffer"));
   }
 }
 function stripWrapperDir(dir) {
-  if (fs70.existsSync(path81.join(dir, MANIFEST_FILE)))
+  if (fs71.existsSync(path81.join(dir, MANIFEST_FILE)))
     return;
-  const children = fs70.readdirSync(dir, { withFileTypes: true });
+  const children = fs71.readdirSync(dir, { withFileTypes: true });
   if (children.length !== 1 || !children[0].isDirectory())
     return;
   const inner = path81.join(dir, children[0].name);
-  if (!fs70.existsSync(path81.join(inner, MANIFEST_FILE)))
+  if (!fs71.existsSync(path81.join(inner, MANIFEST_FILE)))
     return;
-  for (const name of fs70.readdirSync(inner)) {
-    fs70.renameSync(path81.join(inner, name), path81.join(dir, name));
+  for (const name of fs71.readdirSync(inner)) {
+    fs71.renameSync(path81.join(inner, name), path81.join(dir, name));
   }
-  fs70.rmdirSync(inner);
+  fs71.rmdirSync(inner);
 }
 function rand() {
   return randomBytes3(3).toString("hex");
 }
 async function installExtensionZip(zipBuf, expectId, expectVersion) {
   const root = extensionsRoot();
-  fs70.mkdirSync(root, { recursive: true });
+  fs71.mkdirSync(root, { recursive: true });
   const stage = path81.join(root, `.tmp-unpack-${rand()}`);
-  fs70.mkdirSync(stage);
+  fs71.mkdirSync(stage);
   try {
     await unpackZip(zipBuf, stage);
     stripWrapperDir(stage);
     let manifestId;
     let manifestVersion;
     try {
-      const raw = JSON.parse(fs70.readFileSync(path81.join(stage, MANIFEST_FILE), "utf-8"));
+      const raw = JSON.parse(fs71.readFileSync(path81.join(stage, MANIFEST_FILE), "utf-8"));
       manifestId = typeof raw.id === "string" ? raw.id : "";
       manifestVersion = raw.version;
     } catch (err) {
@@ -33367,21 +33397,21 @@ async function installExtensionZip(zipBuf, expectId, expectVersion) {
       throw new ExtensionInstallError(`invalid extension: ${verdict2.error}`);
     const target = path81.join(root, manifestId);
     const old = path81.join(root, `.old-${manifestId}-${rand()}`);
-    const hadOld = fs70.existsSync(target);
+    const hadOld = fs71.existsSync(target);
     if (!hadOld)
       forgetState(manifestId);
     if (hadOld)
-      fs70.renameSync(target, old);
+      fs71.renameSync(target, old);
     try {
-      fs70.renameSync(stage, target);
+      fs71.renameSync(stage, target);
     } catch (err) {
       if (hadOld)
-        fs70.renameSync(old, target);
+        fs71.renameSync(old, target);
       throw err;
     }
     if (hadOld) {
       try {
-        fs70.rmSync(old, { recursive: true, force: true, maxRetries: 3 });
+        fs71.rmSync(old, { recursive: true, force: true, maxRetries: 3 });
       } catch (err) {
         console.log(`[Extensions] could not remove the previous copy ${old}: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -33392,16 +33422,16 @@ async function installExtensionZip(zipBuf, expectId, expectVersion) {
     console.log(`[Extensions] installed ${info.id}@${info.version}${hadOld ? " (replaced previous)" : ""}`);
     return info;
   } finally {
-    fs70.rmSync(stage, { recursive: true, force: true });
+    fs71.rmSync(stage, { recursive: true, force: true });
   }
 }
 function uninstallExtension(id) {
   if (!isExtensionId(id))
     throw new ExtensionInstallError(`"${id}" is not a valid extension id`);
   const dir = path81.join(extensionsRoot(), id);
-  if (!fs70.existsSync(dir))
+  if (!fs71.existsSync(dir))
     return false;
-  fs70.rmSync(dir, { recursive: true, force: true });
+  fs71.rmSync(dir, { recursive: true, force: true });
   forgetState(id);
   console.log(`[Extensions] removed ${id}`);
   return true;
@@ -33695,7 +33725,7 @@ function createCoreChecker(opts) {
 }
 function getCoreStatus(force) {
   checker ??= createCoreChecker({
-    haloVersion: "2.0.2",
+    haloVersion: "2.0.3",
     fetchLatest: fetchNpmLatest,
     onChange: (status) => broadcast({ type: "updates:changed", scope: "core", status })
   });
@@ -33863,7 +33893,7 @@ function hubBase() {
 }
 function serverChecker() {
   checker2 ??= createExtensionsChecker({
-    haloVersion: "2.0.2",
+    haloVersion: "2.0.3",
     installed: () => {
       const s = getSnapshot();
       return [...s.extensions, ...s.disabled];
@@ -33899,7 +33929,7 @@ var init_extension_check = __esm({
 });
 
 // ../server/dist/extensions/watcher.js
-import fs71 from "node:fs";
+import fs72 from "node:fs";
 function scheduleFlush() {
   if (flushTimer)
     return;
@@ -33927,7 +33957,7 @@ function reconcileSttModels(snap) {
 }
 function openWatcher(root) {
   try {
-    watcher = fs71.watch(root, { persistent: false, recursive: false }, () => scheduleFlush());
+    watcher = fs72.watch(root, { persistent: false, recursive: false }, () => scheduleFlush());
     watcher.on("error", (err) => {
       console.warn(`[Extensions] watch error on ${root}: ${err.message} \u2014 retrying in 1s`);
       closeWatcher();
@@ -33953,7 +33983,7 @@ function start() {
     return;
   const root = extensionsRoot();
   try {
-    fs71.mkdirSync(root, { recursive: true });
+    fs72.mkdirSync(root, { recursive: true });
   } catch (err) {
     console.warn(`[Extensions] cannot create ${root}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -33992,7 +34022,7 @@ var init_watcher = __esm({
 
 // ../server/dist/routes/extensions.js
 import { Hono as Hono19 } from "hono";
-import fs72 from "node:fs";
+import fs73 from "node:fs";
 import path82 from "node:path";
 import { Readable as Readable2 } from "node:stream";
 function assetMime(fileName) {
@@ -34011,15 +34041,15 @@ function resolveAsset(id, version, rest) {
   let dir;
   let real;
   try {
-    dir = fs72.realpathSync(path82.join(extensionsRoot(), id));
-    real = fs72.realpathSync(path82.join(dir, ...segments));
+    dir = fs73.realpathSync(path82.join(extensionsRoot(), id));
+    real = fs73.realpathSync(path82.join(dir, ...segments));
   } catch {
     return null;
   }
   if (real !== dir && !real.startsWith(dir + path82.sep))
     return null;
   try {
-    if (!fs72.statSync(real).isFile())
+    if (!fs73.statSync(real).isFile())
       return null;
   } catch {
     return null;
@@ -34140,8 +34170,8 @@ function createExtensionRoutes() {
     const abs = resolveAsset(c.req.param("id"), c.req.param("version"), c.req.param("rest"));
     if (!abs)
       return c.json({ error: "Not found" }, 404);
-    const stat = fs72.statSync(abs);
-    const nodeStream = fs72.createReadStream(abs);
+    const stat = fs73.statSync(abs);
+    const nodeStream = fs73.createReadStream(abs);
     c.req.raw.signal?.addEventListener("abort", () => nodeStream.destroy(), { once: true });
     return new Response(Readable2.toWeb(nodeStream), {
       headers: {
@@ -34231,7 +34261,7 @@ var init_updates = __esm({
 });
 
 // ../server/dist/models/watcher.js
-import fs73 from "node:fs";
+import fs74 from "node:fs";
 function snapshot2() {
   const { effective } = loadProviders();
   return {
@@ -34259,7 +34289,7 @@ function reloadAndBroadcast() {
 }
 function openWatcher2(root) {
   try {
-    watcher2 = fs73.watch(root, { persistent: false, recursive: false }, () => scheduleFlush2());
+    watcher2 = fs74.watch(root, { persistent: false, recursive: false }, () => scheduleFlush2());
     watcher2.on("error", (err) => {
       console.warn(`[Models] watch error on ${root}: ${err.message} \u2014 retrying in 1s`);
       closeWatcher2();
@@ -34285,7 +34315,7 @@ function start2() {
     return;
   const root = globalHubModelsDir();
   try {
-    fs73.mkdirSync(root, { recursive: true });
+    fs74.mkdirSync(root, { recursive: true });
   } catch (err) {
     console.warn(`[Models] cannot create ${root}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -35402,12 +35432,12 @@ var init_handler3 = __esm({
 });
 
 // ../server/dist/routes/channel-accounts.js
-import fs74 from "node:fs";
+import fs75 from "node:fs";
 function accountListFields(a) {
   return {
     accountId: a.accountId,
     workspacePath: a.workspacePath,
-    workspaceMissing: !fs74.existsSync(a.workspacePath),
+    workspaceMissing: !fs75.existsSync(a.workspacePath),
     label: a.label,
     enabled: a.enabled,
     accessLevel: a.accessLevel,
@@ -36049,7 +36079,7 @@ var init_cdn = __esm({
 });
 
 // ../server/dist/channels/wechat/send-media.js
-import fs75 from "node:fs/promises";
+import fs76 from "node:fs/promises";
 import path84 from "node:path";
 function inferKind(filePath) {
   const cls = classifyMedia(filePath);
@@ -36062,7 +36092,7 @@ function inferKind(filePath) {
 async function sendMediaFile(params) {
   const { baseUrl, token, toUserId, contextToken, contextTokenAt, filePath } = params;
   const kind = params.kind ?? inferKind(filePath);
-  const plaintext = await fs75.readFile(filePath);
+  const plaintext = await fs76.readFile(filePath);
   const prep = prepareUpload(plaintext);
   console.log(`[WeChat] sendMediaFile: path=${filePath} kind=${kind} rawsize=${prep.rawsize} filesize=${prep.filesize}`);
   const mediaType = kind === "image" ? UploadMediaType.IMAGE : kind === "video" ? UploadMediaType.VIDEO : UploadMediaType.FILE;
@@ -36263,7 +36293,7 @@ var init_login = __esm({
 });
 
 // ../server/dist/channels/wechat/handler.js
-import fs76 from "node:fs";
+import fs77 from "node:fs";
 import path85 from "node:path";
 import QRCode from "qrcode";
 function wxRoute(fromUserId, contextToken, contextTokenAt) {
@@ -36694,7 +36724,7 @@ async function handleSlashCommand(args) {
         contextToken,
         filePath: tmpPath
       });
-      await fs76.promises.unlink(tmpPath).catch(() => {
+      await fs77.promises.unlink(tmpPath).catch(() => {
       });
       await reply(t("wechat.qr_sent", lang, { level, path: account.workspacePath }));
       waitLogin({ sessionKey: login.sessionKey }).then(async (result2) => {
@@ -36775,7 +36805,7 @@ var init_handler4 = __esm({
 // ../server/dist/routes/wechat.js
 import { Hono as Hono22 } from "hono";
 import path86 from "node:path";
-import fs77 from "node:fs";
+import fs78 from "node:fs";
 function createWechatRoutes(deps) {
   const { db: db4, channel } = deps;
   const app2 = new Hono22();
@@ -36784,7 +36814,7 @@ function createWechatRoutes(deps) {
       return {
         ...stripSecrets(acc),
         workspacePath: acc.workspacePath,
-        workspaceMissing: !fs77.existsSync(acc.workspacePath)
+        workspaceMissing: !fs78.existsSync(acc.workspacePath)
       };
     });
     return c.json({ accounts });
@@ -37013,7 +37043,7 @@ var init_descriptor2 = __esm({
 import { Hono as Hono23 } from "hono";
 import { streamSSE as streamSSE3 } from "hono/streaming";
 import crypto12 from "node:crypto";
-import fs78 from "node:fs";
+import fs79 from "node:fs";
 function streamWithKeepalive(c, chunks) {
   return streamSSE3(c, async (stream) => {
     const timer2 = setInterval(() => {
@@ -37218,8 +37248,8 @@ function createWebRoutes(deps) {
     let real;
     let realRoot;
     try {
-      real = fs78.realpathSync(resolved);
-      realRoot = fs78.realpathSync(root);
+      real = fs79.realpathSync(resolved);
+      realRoot = fs79.realpathSync(root);
     } catch {
       return c.json({ error: "file not found" }, 404);
     }
@@ -37229,7 +37259,7 @@ function createWebRoutes(deps) {
     if (isHiddenWorkspacePath(real, realRoot)) {
       return c.json({ error: "path is not accessible" }, 403);
     }
-    const stat = fs78.statSync(real);
+    const stat = fs79.statSync(real);
     if (stat.isDirectory())
       return c.json({ error: "cannot serve directory" }, 400);
     const ext = path94.default.extname(real).toLowerCase();
@@ -37241,7 +37271,7 @@ function createWebRoutes(deps) {
     };
     const contentType = imageMimeFromExt(ext) || nonImageMimes[ext] || "application/octet-stream";
     const fileName = path94.default.basename(resolved);
-    const data = fs78.readFileSync(real);
+    const data = fs79.readFileSync(real);
     c.header("content-type", contentType);
     c.header("content-disposition", `inline; filename="${fileName}"`);
     return c.body(data);
@@ -37463,10 +37493,10 @@ async function authTest(botToken) {
   return slackPost("auth.test", botToken, {});
 }
 async function uploadFile(args) {
-  const fs83 = await import("node:fs");
+  const fs84 = await import("node:fs");
   const path94 = await import("node:path");
   const filename = args.filename ?? path94.basename(args.filePath);
-  const stat = fs83.statSync(args.filePath);
+  const stat = fs84.statSync(args.filePath);
   if (!stat.isFile())
     throw new Error(`[slack:uploadFile] not a regular file: ${args.filePath}`);
   const length = stat.size;
@@ -37484,7 +37514,7 @@ async function uploadFile(args) {
   if (step1Parsed.ok === false || !step1Parsed.upload_url || !step1Parsed.file_id) {
     throw new Error(`[slack:files.getUploadURLExternal] ${step1Parsed.error ?? "unknown"}`);
   }
-  const buf = fs83.readFileSync(args.filePath);
+  const buf = fs84.readFileSync(args.filePath);
   const step2 = await fetch(step1Parsed.upload_url, {
     method: "POST",
     body: buf
@@ -38404,9 +38434,9 @@ async function replyMessage(args) {
   return { message_id: parsed.data?.message_id ?? "" };
 }
 async function uploadImage(args) {
-  const fs83 = await import("node:fs");
+  const fs84 = await import("node:fs");
   const path94 = await import("node:path");
-  const buf = fs83.readFileSync(args.filePath);
+  const buf = fs84.readFileSync(args.filePath);
   const filename = path94.basename(args.filePath);
   const send2 = async (token) => {
     const form = new FormData();
@@ -38423,9 +38453,9 @@ async function uploadImage(args) {
   return { imageKey: parsed.data.image_key };
 }
 async function uploadFile2(args) {
-  const fs83 = await import("node:fs");
+  const fs84 = await import("node:fs");
   const path94 = await import("node:path");
-  const buf = fs83.readFileSync(args.filePath);
+  const buf = fs84.readFileSync(args.filePath);
   const filename = args.filename ?? path94.basename(args.filePath);
   const send2 = async (token) => {
     const form = new FormData();
@@ -39259,7 +39289,7 @@ var init_event_adapter5 = __esm({
 
 // ../server/dist/channels/wecom/handler.js
 import path89 from "node:path";
-import fs79 from "node:fs/promises";
+import fs80 from "node:fs/promises";
 import { WSClient as WSClient2, generateReqId } from "@wecom/aibot-node-sdk";
 function pickConversation(body) {
   const userid = body.from?.userid ?? "unknown";
@@ -39385,7 +39415,7 @@ async function sendWecomMedia(args) {
   const ext = path89.extname(filePath).toLowerCase();
   const cls = classifyMedia(filePath);
   const type = cls === "image" && [".png", ".jpg", ".jpeg", ".gif"].includes(ext) ? "image" : cls === "video" && ext === ".mp4" ? "video" : "file";
-  const buf = await fs79.readFile(filePath);
+  const buf = await fs80.readFile(filePath);
   if (buf.length > MAX_WECOM_DOWNLOAD_BYTES)
     throw new Error("file exceeds 20MB");
   const { media_id: mediaId } = await wsClient.uploadMedia(buf, { type, filename: path89.basename(filePath) });
@@ -39922,14 +39952,14 @@ import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { WebSocketServer as WebSocketServer4 } from "ws";
 import path90 from "node:path";
-import fs80 from "node:fs";
+import fs81 from "node:fs";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { homedir as homedir25 } from "node:os";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function findProjectRoot() {
   let dir = process.cwd();
   for (let i = 0; i < 32; i++) {
-    if (fs80.existsSync(path90.join(dir, "pnpm-workspace.yaml")))
+    if (fs81.existsSync(path90.join(dir, "pnpm-workspace.yaml")))
       return dir;
     const parent = path90.dirname(dir);
     if (parent === dir)
@@ -39941,15 +39971,15 @@ function findProjectRoot() {
   return process.cwd();
 }
 function acquireSingleInstanceLock(lockFile) {
-  fs80.mkdirSync(path90.dirname(lockFile), { recursive: true });
-  const fd = fs80.openSync(lockFile, fs80.constants.O_RDWR | fs80.constants.O_CREAT, 420);
+  fs81.mkdirSync(path90.dirname(lockFile), { recursive: true });
+  const fd = fs81.openSync(lockFile, fs81.constants.O_RDWR | fs81.constants.O_CREAT, 420);
   const result = spawnSync4("flock", ["-n", "3"], {
     stdio: ["ignore", "ignore", "ignore", fd]
   });
   if (result.error) {
     const content = readLockPid(fd);
     if (content > 0 && isProcessAlive(content)) {
-      fs80.closeSync(fd);
+      fs81.closeSync(fd);
       console.error(`[Server] another halo server is already running (pid ${content}). kill it first.`);
       process.exit(1);
     }
@@ -39958,19 +39988,19 @@ function acquireSingleInstanceLock(lockFile) {
     if (content > 0 && !isProcessAlive(content)) {
       console.warn(`[Server] removing stale server.lock (pid ${content} not running)`);
     } else {
-      fs80.closeSync(fd);
+      fs81.closeSync(fd);
       console.error(`[Server] another halo server is already running${content > 0 ? ` (pid ${content})` : ""}. kill it first.`);
       process.exit(1);
     }
   }
-  fs80.ftruncateSync(fd);
-  fs80.writeSync(fd, String(process.pid));
-  fs80.fsyncSync(fd);
+  fs81.ftruncateSync(fd);
+  fs81.writeSync(fd, String(process.pid));
+  fs81.fsyncSync(fd);
 }
 function readLockPid(fd) {
   try {
     const buf = Buffer.alloc(32);
-    const n = fs80.readSync(fd, buf, 0, 32, 0);
+    const n = fs81.readSync(fd, buf, 0, 32, 0);
     return parseInt(buf.subarray(0, n).toString("utf-8").trim(), 10) || 0;
   } catch {
     return 0;
@@ -39998,7 +40028,7 @@ function isProcessAlive(pid) {
   }
 }
 function readGitSha() {
-  if (!fs80.existsSync(path90.join(PROJECT_ROOT, "pnpm-workspace.yaml")) || !fs80.existsSync(path90.join(PROJECT_ROOT, ".git")))
+  if (!fs81.existsSync(path90.join(PROJECT_ROOT, "pnpm-workspace.yaml")) || !fs81.existsSync(path90.join(PROJECT_ROOT, ".git")))
     return null;
   try {
     const rev = spawnSync4("git", ["rev-parse", "--short", "HEAD"], { cwd: PROJECT_ROOT, encoding: "utf-8" });
@@ -40021,10 +40051,10 @@ function resolveFrontendDir() {
   if (process.env.HALO_FRONTEND_DIR)
     return path90.resolve(process.env.HALO_FRONTEND_DIR);
   const bundled = path90.resolve(__dirname3, "..", "admin-out");
-  if (fs80.existsSync(path90.join(bundled, "index.html")))
+  if (fs81.existsSync(path90.join(bundled, "index.html")))
     return bundled;
   const sibling = path90.resolve(__dirname3, "..", "..", "admin", "out");
-  if (fs80.existsSync(path90.join(sibling, "index.html")))
+  if (fs81.existsSync(path90.join(sibling, "index.html")))
     return sibling;
   return path90.resolve(PROJECT_ROOT, "packages", "admin", "out");
 }
@@ -40129,11 +40159,11 @@ var init_dist2 = __esm({
     init_git_ssh();
     __dirname3 = path90.dirname(fileURLToPath3(import.meta.url));
     PORT = config.server.port;
-    HALO_VERSION = "2.0.2";
+    HALO_VERSION = "2.0.3";
     PROJECT_ROOT = findProjectRoot();
     HALO_HOME4 = path90.join(homedir25(), ".halo");
     GIT_SHA = readGitSha();
-    if (!fs80.existsSync(path90.join(HALO_HOME4, "global", ".template-version"))) {
+    if (!fs81.existsSync(path90.join(HALO_HOME4, "global", ".template-version"))) {
       process.stderr.write("\x1B[31m[Server] ~/.halo/global/ not initialized. Run `halo setup` first.\x1B[0m\n");
       process.exit(1);
     }
@@ -40235,7 +40265,7 @@ var init_dist2 = __esm({
     setCronSessionRegistry(registry);
     if (OWNS_RUNTIMES && !AGENTCORE) {
       for (const ws of listRunningWorkspaces()) {
-        if (!fs80.existsSync(path90.join(ws, ".halo")))
+        if (!fs81.existsSync(path90.join(ws, ".halo")))
           continue;
         if (!claimWorkspaceRuntime(ws))
           continue;
@@ -40281,7 +40311,7 @@ var init_dist2 = __esm({
       app.get("/*", (c) => {
         const indexPath = path90.join(FRONTEND_DIR, "index.html");
         try {
-          const html = fs80.readFileSync(indexPath, "utf-8");
+          const html = fs81.readFileSync(indexPath, "utf-8");
           return c.html(html);
         } catch {
           return c.text("Frontend not built. Run: cd packages/admin && npx next build", 503);
@@ -40369,7 +40399,7 @@ __export(agentcore_front_exports, {
   workerEnv: () => workerEnv
 });
 import http3 from "node:http";
-import fs81 from "node:fs";
+import fs82 from "node:fs";
 import fsp2 from "node:fs/promises";
 import os11 from "node:os";
 import path91 from "node:path";
@@ -40400,39 +40430,39 @@ function skipTemplateEntry(rel) {
 }
 function chownTree(dir, owner, sid) {
   try {
-    fs81.lchownSync(dir, owner.uid, owner.gid);
-    for (const rel of fs81.readdirSync(dir, { recursive: true }))
-      fs81.lchownSync(path91.join(dir, rel), owner.uid, owner.gid);
+    fs82.lchownSync(dir, owner.uid, owner.gid);
+    for (const rel of fs82.readdirSync(dir, { recursive: true }))
+      fs82.lchownSync(path91.join(dir, rel), owner.uid, owner.gid);
   } catch (err) {
     console.warn(`[AgentCore] front: chown ${sid} to ${owner.uid}:${owner.gid} failed (${err.message}) \u2014 serving it as is`);
   }
 }
 function ensureSessionDir(base, sid, owner) {
   const dir = path91.join(base, sid);
-  if (fs81.existsSync(dir))
+  if (fs82.existsSync(dir))
     return false;
   const tmp = path91.join(base, `.tmp-${crypto13.randomBytes(8).toString("hex")}`);
-  fs81.mkdirSync(tmp, { mode: 448 });
+  fs82.mkdirSync(tmp, { mode: 448 });
   try {
     const template = path91.join(base, TEMPLATE_DIR);
-    if (fs81.statSync(template, { throwIfNoEntry: false })?.isDirectory()) {
-      fs81.cpSync(template, tmp, { recursive: true, verbatimSymlinks: true, filter: (src) => !skipTemplateEntry(path91.relative(template, src)) });
+    if (fs82.statSync(template, { throwIfNoEntry: false })?.isDirectory()) {
+      fs82.cpSync(template, tmp, { recursive: true, verbatimSymlinks: true, filter: (src) => !skipTemplateEntry(path91.relative(template, src)) });
     }
     if (owner)
       chownTree(tmp, owner, sid);
-    if (fs81.readdirSync(tmp).length === 0) {
-      fs81.rmdirSync(tmp);
-      fs81.mkdirSync(dir, { mode: 448 });
+    if (fs82.readdirSync(tmp).length === 0) {
+      fs82.rmdirSync(tmp);
+      fs82.mkdirSync(dir, { mode: 448 });
       if (owner)
         chownTree(dir, owner, sid);
       return true;
     }
-    fs81.renameSync(tmp, dir);
+    fs82.renameSync(tmp, dir);
     return true;
   } catch (err) {
-    fs81.rmSync(tmp, { recursive: true, force: true });
+    fs82.rmSync(tmp, { recursive: true, force: true });
     const code = err.code;
-    if ((code === "EEXIST" || code === "ENOTEMPTY") && fs81.existsSync(dir))
+    if ((code === "EEXIST" || code === "ENOTEMPTY") && fs82.existsSync(dir))
       return false;
     throw err;
   }
@@ -40476,7 +40506,7 @@ async function runViewSetup(base, sessionDir, deps = SYSTEM_SETUP) {
   const left = mountLayers(base, deps.mountinfo());
   if (left > 0)
     throw new Error(`view setup: ${base} still has ${left} mount(s) after ${MAX_UMOUNTS} \xD7 umount -l`);
-  if (fs81.existsSync(sessionDir))
+  if (fs82.existsSync(sessionDir))
     throw new Error(`view setup: ${base} is still visible after umount -l`);
 }
 function workerEnv(src, front) {
@@ -40495,15 +40525,15 @@ async function copyMediaFile(p, root, dest, max = MAX_MEDIA_BYTES) {
     return "not an absolute path";
   let pfd;
   try {
-    pfd = fs81.openSync(p, O_PATH);
+    pfd = fs82.openSync(p, O_PATH);
   } catch (err) {
     return `cannot open (${err.code})`;
   }
   try {
-    const link = fs81.readlinkSync(`/proc/self/fd/${pfd}`);
+    const link = fs82.readlinkSync(`/proc/self/fd/${pfd}`);
     if (!link.startsWith(`${root}/`))
       return `not under ${root}/`;
-    const st = fs81.fstatSync(pfd);
+    const st = fs82.fstatSync(pfd);
     if (!st.isFile())
       return "not a regular file";
     if (st.size > max)
@@ -40530,7 +40560,7 @@ async function copyMediaFile(p, root, dest, max = MAX_MEDIA_BYTES) {
       await src.close();
     }
   } finally {
-    fs81.closeSync(pfd);
+    fs82.closeSync(pfd);
   }
 }
 async function copyMediaLines(text6, root, dir, sid) {
@@ -40543,7 +40573,7 @@ async function copyMediaLines(text6, root, dir, sid) {
       continue;
     }
     const sub = path91.join(dir, String(n++));
-    fs81.mkdirSync(sub);
+    fs82.mkdirSync(sub);
     const name = path91.basename(m[1]).replace(/[\x00-\x1f\x7f]/g, "_").replace(/^\.+/, "") || "file";
     const dest = path91.join(sub, name);
     const why = await copyMediaFile(m[1], root, dest).catch((err) => err.message);
@@ -40551,7 +40581,7 @@ async function copyMediaLines(text6, root, dir, sid) {
       out.push(`MEDIA:${dest}`);
       continue;
     }
-    fs81.rmSync(sub, { recursive: true, force: true });
+    fs82.rmSync(sub, { recursive: true, force: true });
     console.warn(`[AgentCore] notify ${sid}: MEDIA dropped (${why}): ${JSON.stringify(m[1].slice(0, 300))}`);
   }
   return out.join("\n");
@@ -40595,7 +40625,7 @@ function readBody(req, max) {
   });
 }
 async function startAgentCoreFront(o) {
-  const base = fs81.realpathSync(o.base);
+  const base = fs82.realpathSync(o.base);
   const workerPort = o.workerPort ?? WORKER_PORT;
   const token = crypto13.randomBytes(32).toString("hex");
   const isMounted = o.isMounted ?? ((b) => mountLayers(b, readMountinfo()) > 0);
@@ -40657,11 +40687,11 @@ async function startAgentCoreFront(o) {
     preparing++;
     let dir = "";
     const cleanup = () => {
-      fs81.rmSync(dir, { recursive: true, force: true });
+      fs82.rmSync(dir, { recursive: true, force: true });
       settle();
     };
     try {
-      dir = fs81.mkdtempSync(path91.join(os11.tmpdir(), "halo-notify-"));
+      dir = fs82.mkdtempSync(path91.join(os11.tmpdir(), "halo-notify-"));
       const text6 = await copyMediaLines(b.text, viewRoot, dir, b.session);
       runNotify(cmd, text6, { HALO_SESSION_ID: b.session, HALO_RUN_STATUS: b.status, HALO_WORKSPACE: dir }, dir, cleanup);
     } catch (err) {
@@ -40878,7 +40908,7 @@ var init_agentcore_front = __esm({
     MAX_MEDIA_BYTES = 20 * 1024 * 1024;
     O_PATH = 2097152;
     execFileP = promisify3(execFile2);
-    readMountinfo = () => fs81.readFileSync("/proc/self/mountinfo", "utf8");
+    readMountinfo = () => fs82.readFileSync("/proc/self/mountinfo", "utf8");
     SYSTEM_SETUP = {
       mountinfo: readMountinfo,
       exec: (argv) => execFileP(argv[0], argv.slice(1), { timeout: SETUP_TIMEOUT_MS })
@@ -42016,7 +42046,7 @@ process.emitWarning = (warning, ...args) => {
 // src/index.ts
 init_server_supervisor();
 import path93 from "node:path";
-import fs82 from "node:fs";
+import fs83 from "node:fs";
 import { homedir as homedir26, userInfo } from "node:os";
 import { parseArgs as parseArgs2 } from "node:util";
 
@@ -42307,7 +42337,7 @@ function installUserUnit(opts, run = runCommand) {
 }
 
 // src/index.ts
-var VERSION = "2.0.2";
+var VERSION = "2.0.3";
 var HELP_TOP = `Usage: halo <command> [options]
 
 Commands:
@@ -43101,7 +43131,7 @@ ${HELP_SESSIONS}`);
   }
 }
 async function cmdSessionsMigrate(workspace) {
-  if (!fs82.existsSync(path93.join(workspace, ".halo"))) {
+  if (!fs83.existsSync(path93.join(workspace, ".halo"))) {
     process.stderr.write(`Not a Halo workspace (no .halo/): ${workspace}
 `);
     process.exitCode = 1;
@@ -43246,7 +43276,7 @@ var SERVER_LOCK_PATH = path93.join(homedir26(), ".halo", "global", "server.lock"
 var SERVER_LOG_PATH = path93.join(homedir26(), ".halo", "logs", "server.log");
 function readServerPid() {
   try {
-    const txt = fs82.readFileSync(SERVER_LOCK_PATH, "utf-8").trim();
+    const txt = fs83.readFileSync(SERVER_LOCK_PATH, "utf-8").trim();
     const n = parseInt(txt, 10);
     return Number.isFinite(n) && n > 0 ? n : null;
   } catch {
@@ -43353,8 +43383,8 @@ async function cmdServerStart(argv, restart) {
   }
   if (plan.note) writeDim(plan.note);
   const { spawn: spawn7 } = await import("node:child_process");
-  fs82.mkdirSync(path93.dirname(SERVER_LOG_PATH), { recursive: true });
-  const out = fs82.openSync(SERVER_LOG_PATH, "a");
+  fs83.mkdirSync(path93.dirname(SERVER_LOG_PATH), { recursive: true });
+  const out = fs83.openSync(SERVER_LOG_PATH, "a");
   const child = spawn7(process.argv[0], [process.argv[1], "server", "start"], {
     detached: true,
     stdio: ["ignore", out, out],
@@ -43436,7 +43466,7 @@ ${HELP_AGENTCORE}`);
     return;
   }
   const workspace = path93.resolve(raw);
-  if (!fs82.statSync(workspace, { throwIfNoEntry: false })?.isDirectory()) {
+  if (!fs83.statSync(workspace, { throwIfNoEntry: false })?.isDirectory()) {
     process.stderr.write(`Workspace is not a directory: ${workspace}
 `);
     process.exitCode = 1;
@@ -43547,7 +43577,7 @@ async function cmdServerLogs(argv) {
       lines: { type: "string", short: "n" }
     }
   });
-  if (!fs82.existsSync(SERVER_LOG_PATH)) {
+  if (!fs83.existsSync(SERVER_LOG_PATH)) {
     process.stderr.write(`No log file at ${SERVER_LOG_PATH}
 `);
     return;
@@ -43565,7 +43595,7 @@ function exitMissingSetup() {
   process.exit(1);
 }
 function isHaloHomeReady() {
-  return fs82.existsSync(path93.join(homedir26(), ".halo", "global", ".template-version"));
+  return fs83.existsSync(path93.join(homedir26(), ".halo", "global", ".template-version"));
 }
 async function main2() {
   const argv = process.argv.slice(2);