@turmind/halo 2.0.3 → 2.0.5

package/dist/evo-wrapper.js

@@ -0,0 +1,2810 @@
+// ../server/dist/evolution/evo-wrapper.js
+import fs9 from "node:fs";
+import path12 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+import { homedir as homedir6 } from "node:os";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { parseArgs } from "node:util";
+import { eq, and } from "drizzle-orm";
+import YAML6 from "yaml";
+
+// ../server/dist/db/evo-db.js
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
+import path from "node:path";
+import fs from "node:fs";
+
+// ../server/dist/db/migrate.js
+function runMigrations(sqlite, migrations) {
+  const current = sqlite.pragma("user_version", { simple: true });
+  if (current > migrations.length) {
+    console.warn(`[Db] user_version ${current} is newer than this build knows (${migrations.length}) \u2014 opened by a newer halo; continuing`);
+    return;
+  }
+  for (let i = current; i < migrations.length; i++) {
+    sqlite.transaction(() => {
+      migrations[i](sqlite);
+      sqlite.pragma(`user_version = ${i + 1}`);
+    })();
+  }
+}
+
+// ../server/dist/db/evo-db.js
+var evolutionRuns = sqliteTable("evolution_runs", {
+  id: text("id").primaryKey(),
+  workspacePath: text("workspace_path").notNull(),
+  status: text("status").notNull(),
+  triggerKind: text("trigger_kind").notNull(),
+  sourceSession: text("source_session").notNull(),
+  userHint: text("user_hint"),
+  createdAt: integer("created_at").notNull(),
+  startedAt: integer("started_at"),
+  heartbeatAt: integer("heartbeat_at"),
+  completedAt: integer("completed_at"),
+  appliedAt: integer("applied_at"),
+  failureReason: text("failure_reason"),
+  /** How many times the ticker has tried to spawn a wrapper for this row.
+   *  Bumped on each `pending → running` claim. When it crosses the configured
+   *  retry budget, the ticker stops re-claiming after timeout/failure. */
+  attempts: integer("attempts").notNull().default(0),
+  /** When archive job zipped the artifacts and deleted the run dir. Null
+   *  while the run is active. Rows with archived_at >= 30 days ago are
+   *  candidates for full deletion (zip + db row). */
+  archivedAt: integer("archived_at")
+});
+var evolutionApplies = sqliteTable("evolution_applies", {
+  id: text("id").primaryKey(),
+  workspacePath: text("workspace_path").notNull(),
+  status: text("status").notNull(),
+  /** JSON-encoded array of evolution_runs.id values this apply consolidates. */
+  sourceRunIds: text("source_run_ids").notNull(),
+  reviewerHint: text("reviewer_hint"),
+  createdAt: integer("created_at").notNull(),
+  startedAt: integer("started_at"),
+  heartbeatAt: integer("heartbeat_at"),
+  completedAt: integer("completed_at"),
+  failureReason: text("failure_reason"),
+  attempts: integer("attempts").notNull().default(0),
+  archivedAt: integer("archived_at")
+});
+var CREATE_SQL = `
+CREATE TABLE IF NOT EXISTS evolution_runs (
+  id              TEXT PRIMARY KEY,
+  workspace_path  TEXT NOT NULL,
+  status          TEXT NOT NULL,
+  trigger_kind    TEXT NOT NULL,
+  source_session  TEXT NOT NULL,
+  user_hint       TEXT,
+  created_at      INTEGER NOT NULL,
+  started_at      INTEGER,
+  heartbeat_at    INTEGER,
+  completed_at    INTEGER,
+  applied_at      INTEGER,
+  failure_reason  TEXT,
+  attempts        INTEGER NOT NULL DEFAULT 0,
+  archived_at     INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_evo_runs_status ON evolution_runs(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_evo_runs_ws ON evolution_runs(workspace_path);
+CREATE INDEX IF NOT EXISTS idx_evo_runs_archived ON evolution_runs(archived_at);
+
+CREATE TABLE IF NOT EXISTS evolution_applies (
+  id              TEXT PRIMARY KEY,
+  workspace_path  TEXT NOT NULL,
+  status          TEXT NOT NULL,
+  source_run_ids  TEXT NOT NULL,
+  reviewer_hint   TEXT,
+  created_at      INTEGER NOT NULL,
+  started_at      INTEGER,
+  heartbeat_at    INTEGER,
+  completed_at    INTEGER,
+  failure_reason  TEXT,
+  attempts        INTEGER NOT NULL DEFAULT 0,
+  archived_at     INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_evo_applies_status ON evolution_applies(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_evo_applies_ws ON evolution_applies(workspace_path);
+CREATE INDEX IF NOT EXISTS idx_evo_applies_archived ON evolution_applies(archived_at);
+`;
+function createEvoDb(globalDir2) {
+  fs.mkdirSync(globalDir2, { recursive: true });
+  const dbPath = path.join(globalDir2, "evo.db");
+  const sqlite = new Database(dbPath);
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.exec(CREATE_SQL);
+  runMigrations(sqlite, []);
+  return drizzle(sqlite, { schema: { evolutionRuns, evolutionApplies } });
+}
+var _evoDb = null;
+function setEvoDb(db) {
+  _evoDb = db;
+}
+function getEvoDb() {
+  if (!_evoDb)
+    throw new Error("[evo-db] getEvoDb() called before setEvoDb()");
+  return _evoDb;
+}
+
+// ../server/dist/paths.js
+import path2 from "node:path";
+import { homedir } from "node:os";
+function haloHome() {
+  return path2.join(homedir(), ".halo");
+}
+function globalDir() {
+  return path2.join(haloHome(), "global");
+}
+function secretsDir() {
+  return path2.join(haloHome(), "secrets");
+}
+function wsHaloDir(workspacePath) {
+  return path2.join(workspacePath, ".halo");
+}
+function wsEvoDir(workspacePath) {
+  return path2.join(wsHaloDir(workspacePath), "evo");
+}
+function wsEvoRunDir(workspacePath, runId) {
+  return path2.join(wsEvoDir(workspacePath), "runs", runId);
+}
+function wsEvoApplyDir(workspacePath, applyId) {
+  return path2.join(wsEvoDir(workspacePath), "applies", applyId);
+}
+function wsEvoHistoryDir(workspacePath, applyId) {
+  return path2.join(wsEvoDir(workspacePath), "history", `apply-${applyId}`);
+}
+function evoSandboxDir(artifactDir) {
+  return path2.join(artifactDir, "sandbox");
+}
+function evoSandboxHaloDir(artifactDir) {
+  return path2.join(evoSandboxDir(artifactDir), ".halo");
+}
+function evoRegressDir(applyDir) {
+  return path2.join(applyDir, "regress");
+}
+function evoRegressRunDir(applyDir, runId) {
+  return path2.join(evoRegressDir(applyDir), runId);
+}
+function globalModelsDir() {
+  return path2.join(globalDir(), "models");
+}
+function globalHubModelsDir() {
+  return path2.join(globalDir(), "models.d");
+}
+function globalExtensionsDir() {
+  return path2.join(globalDir(), "extensions");
+}
+function globalLogsDir() {
+  return path2.join(globalDir(), "logs");
+}
+function evoLogsDir() {
+  return path2.join(globalLogsDir(), "evo");
+}
+function evoWrapperLogFile(runId) {
+  return path2.join(evoLogsDir(), `run-${runId}.log`);
+}
+function evoApplyLogFile(applyId) {
+  return path2.join(evoLogsDir(), `apply-${applyId}.log`);
+}
+
+// ../server/dist/config.js
+import fs8 from "node:fs";
+import path11 from "node:path";
+import { homedir as homedir5 } from "node:os";
+import YAML5 from "yaml";
+
+// ../server/dist/settings-schema.js
+import fs7 from "node:fs";
+import path10 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import YAML4 from "yaml";
+
+// ../server/dist/tools/sandbox.js
+import { exec, execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import path3 from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// ../server/dist/child-env.js
+var settingsOtelEnvKeys = /* @__PURE__ */ new Set();
+function cleanChildEnv() {
+  const env = { ...process.env };
+  delete env.HALO_PASSWORD;
+  delete env.HALO_JWT_SECRET;
+  for (const key of settingsOtelEnvKeys)
+    delete env[key];
+  return env;
+}
+
+// ../server/dist/tools/sandbox.js
+var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
+var HOME = homedir2();
+var HALO_HOME = path3.join(HOME, ".halo");
+var EMPTY_MASK_FILE = path3.join(HALO_HOME, ".sandbox-empty");
+var DEFAULT_HIDDEN_DIRS = [
+  "~/.halo/secrets",
+  "~/.aws",
+  "~/.ssh",
+  "~/.gnupg",
+  "~/.docker",
+  "~/.config/gh",
+  // Cross-workspace state under ~/.halo/global — internal-agent session
+  // transcripts and server/cron logs would leak other workspaces' activity
+  // to a workspace/readonly session (global/ is readable by design for
+  // skills/agents/prompts, so the sensitive subtrees are hidden explicitly).
+  "~/.halo/global/internal-sessions",
+  "~/.halo/global/logs"
+];
+var DEFAULT_HIDDEN_FILES = [
+  "~/.npmrc",
+  "~/.bash_history",
+  "~/.gitconfig",
+  // Halo's own git-credential store (git-credentials.ts writes tokens here
+  // in plaintext) — must be hidden like ~/.aws & co.
+  "~/.git-credentials",
+  "~/.netrc",
+  // Global evolution / cron databases (plus sqlite WAL/SHM sidecars) carry
+  // cross-workspace prompts, run history and channel targets — hidden from
+  // workspace/readonly sessions like the dirs above.
+  "~/.halo/global/evo.db",
+  "~/.halo/global/evo.db-wal",
+  "~/.halo/global/evo.db-shm",
+  "~/.halo/global/cron.db",
+  "~/.halo/global/cron.db-wal",
+  "~/.halo/global/cron.db-shm",
+  "~/.halo/global/runs.db",
+  "~/.halo/global/runs.db-wal",
+  "~/.halo/global/runs.db-shm",
+  // A2A tasks / push configs carry peers' webhook tokens.
+  "~/.halo/global/a2a.db",
+  "~/.halo/global/a2a.db-wal",
+  "~/.halo/global/a2a.db-shm"
+];
+
+// ../server/dist/models/registry.js
+import fs2 from "node:fs";
+import path4 from "node:path";
+import YAML from "yaml";
+var MODEL_RUNTIME_NAMES = [
+  "anthropic-messages",
+  "openai-chat",
+  "bedrock-invoke",
+  "bedrock-mantle",
+  "kimi",
+  "deepseek",
+  "minimax",
+  "qwen",
+  "hunyuan",
+  "doubao",
+  "zhipu",
+  "gemini"
+];
+function isKnownRuntime(runtime) {
+  return typeof runtime === "string" && MODEL_RUNTIME_NAMES.includes(runtime);
+}
+function revisionOf(data) {
+  return Number.isInteger(data.revision) ? data.revision : 0;
+}
+var logged = /* @__PURE__ */ new Set();
+function logOnce(msg) {
+  if (logged.has(msg))
+    return;
+  logged.add(msg);
+  console.log(msg);
+}
+function readProviderDir(dir, source) {
+  let names;
+  try {
+    names = fs2.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".yaml")).map((e) => e.name).sort();
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    const file = path4.join(dir, name);
+    try {
+      const parsed = YAML.parse(fs2.readFileSync(file, "utf-8"));
+      if (parsed && typeof parsed === "object" && typeof parsed.id === "string") {
+        out.push({
+          id: parsed.id,
+          source,
+          revision: revisionOf(parsed),
+          runtime: typeof parsed.runtime === "string" ? parsed.runtime : void 0,
+          file,
+          data: parsed
+        });
+      } else {
+        logOnce(`[Config] Skipping ${file}: missing provider id`);
+      }
+    } catch (err) {
+      logOnce(`[Config] Failed to load ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return out;
+}
+function mergeProviders(bundled, hub) {
+  const skipped = [];
+  const winner = /* @__PURE__ */ new Map();
+  for (const copy of bundled) {
+    const cur = winner.get(copy.id);
+    if (!cur || copy.revision > cur.revision)
+      winner.set(copy.id, copy);
+  }
+  for (const copy of hub) {
+    if (!isKnownRuntime(copy.runtime)) {
+      const reason = `unknown runtime "${copy.runtime ?? ""}" \u2014 needs a newer halo`;
+      logOnce(`[Config] Skipping ${copy.file}: ${reason}; the bundled copy stays in effect`);
+      skipped.push({ copy, reason });
+      continue;
+    }
+    const cur = winner.get(copy.id);
+    if (!cur || copy.revision >= cur.revision)
+      winner.set(copy.id, copy);
+  }
+  const order = [...new Set([...bundled, ...hub].map((c) => c.id))];
+  return { effective: order.flatMap((id) => winner.get(id) ?? []), skipped };
+}
+function loadProviders(bundledDir = globalModelsDir(), hubDir = globalHubModelsDir()) {
+  const bundled = readProviderDir(bundledDir, "bundled");
+  const hub = readProviderDir(hubDir, "hub");
+  return { ...mergeProviders(bundled, hub), all: [...bundled, ...hub] };
+}
+
+// ../server/dist/extensions/registry.js
+import fs4 from "node:fs";
+import path7 from "node:path";
+
+// ../server/dist/extensions/state.js
+import fs3 from "node:fs";
+import path6 from "node:path";
+
+// ../server/dist/init.js
+import path5 from "node:path";
+import { fileURLToPath } from "node:url";
+import YAML2 from "yaml";
+var __dirname = path5.dirname(fileURLToPath(import.meta.url));
+var TEMPLATES_DIR = path5.resolve(__dirname, "..", "templates");
+var DOCS_SRC_CANDIDATES = [
+  path5.resolve(__dirname, "..", "bundled-docs"),
+  path5.resolve(__dirname, "..", "..", "..", ".halo", "docs")
+];
+
+// ../server/dist/extensions/state.js
+function extensionStatePath() {
+  return path6.join(globalExtensionsDir(), ".state.json");
+}
+var cache = null;
+function load() {
+  const file = extensionStatePath();
+  let st;
+  try {
+    st = fs3.statSync(file);
+  } catch {
+    return { states: {}, disabled: /* @__PURE__ */ new Set() };
+  }
+  const key = `${file}:${st.ino}:${st.mtimeMs}:${st.size}`;
+  if (cache?.key === key)
+    return cache;
+  let states = null;
+  try {
+    const raw = JSON.parse(fs3.readFileSync(file, "utf-8"));
+    if (typeof raw === "object" && raw !== null && !Array.isArray(raw))
+      states = raw;
+  } catch {
+  }
+  if (!states)
+    console.warn(`[Extensions] ${file} is not a JSON object \u2014 treating every extension as on; fix or delete the file`);
+  const disabled = new Set(Object.entries(states ?? {}).filter(([, s]) => isEntry(s) && s.disabled === true).map(([id]) => id));
+  cache = { key, states, disabled };
+  return cache;
+}
+function isEntry(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function disabledExtensionIds() {
+  return load().disabled;
+}
+
+// ../server/dist/extensions/registry.js
+var MANIFEST_FILE = "halo-extension.json";
+var ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+var VERSION_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+var FILE_EXT_RE = /^\.[a-z0-9]+$/;
+var CAPABILITIES = /* @__PURE__ */ new Set(["save", "media", "transcribe", "fs-read", "stt-local"]);
+var PLATFORMS = /* @__PURE__ */ new Set(["web", "desktop-mac", "desktop-win", "desktop-linux"]);
+var SETTING_KEY_RE = /^[a-z][a-z0-9_]{0,63}$/;
+var SETTING_TYPES = /* @__PURE__ */ new Set(["string", "int", "float", "boolean", "enum"]);
+function parseSettings(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return { error: "settings must be an object" };
+  const s = raw;
+  const seen = /* @__PURE__ */ new Set();
+  const out = {};
+  for (const kind of ["params", "secrets"]) {
+    if (s[kind] === void 0)
+      continue;
+    if (!Array.isArray(s[kind]))
+      return { error: `settings.${kind} must be an array` };
+    const fields = [];
+    for (const item of s[kind]) {
+      if (typeof item !== "object" || item === null || Array.isArray(item))
+        return { error: `settings.${kind} entries must be objects` };
+      const f = item;
+      if (typeof f.key !== "string" || !SETTING_KEY_RE.test(f.key))
+        return { error: `settings key "${String(f.key)}" must match ^[a-z][a-z0-9_]{0,63}$` };
+      if (seen.has(f.key))
+        return { error: `duplicate settings key: ${f.key}` };
+      seen.add(f.key);
+      for (const k of ["description", "description_zh"]) {
+        if (f[k] !== void 0 && typeof f[k] !== "string")
+          return { error: `settings ${f.key}.${k} must be a string` };
+      }
+      if (f.default !== void 0 && !["string", "number", "boolean"].includes(typeof f.default))
+        return { error: `settings ${f.key}.default must be a scalar` };
+      if (f.type !== void 0 && (typeof f.type !== "string" || !SETTING_TYPES.has(f.type)))
+        return { error: `settings ${f.key}.type must be one of string|int|float|boolean|enum` };
+      if (f.options !== void 0 && (!Array.isArray(f.options) || f.options.length === 0 || f.options.some((o) => typeof o !== "string"))) {
+        return { error: `settings ${f.key}.options must be a non-empty string array` };
+      }
+      if (f.type === "enum" && f.options === void 0)
+        return { error: `settings ${f.key}: type enum requires options` };
+      fields.push({
+        key: f.key,
+        ...f.description !== void 0 ? { description: f.description } : {},
+        ...f.description_zh !== void 0 ? { description_zh: f.description_zh } : {},
+        ...f.default !== void 0 ? { default: String(f.default) } : {},
+        ...f.type !== void 0 ? { type: f.type } : {},
+        ...f.options !== void 0 ? { options: f.options } : {}
+      });
+    }
+    if (fields.length > 0)
+      out[kind] = fields;
+  }
+  return out;
+}
+function isExtensionId(id) {
+  return ID_RE.test(id);
+}
+function extensionsRoot() {
+  return globalExtensionsDir();
+}
+function parseManifest(raw, dirName, entryExists) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return { error: "manifest must be a JSON object" };
+  const m = raw;
+  if (typeof m.id !== "string" || !ID_RE.test(m.id))
+    return { error: "id must match ^[a-z0-9][a-z0-9_-]{0,63}$" };
+  if (m.id !== dirName)
+    return { error: `id mismatch: manifest "${m.id}" vs directory "${dirName}"` };
+  if (typeof m.name !== "string" || m.name.trim() === "" || m.name.length > 64)
+    return { error: "name must be a non-empty string (\u2264 64 chars)" };
+  if (typeof m.version !== "string" || !VERSION_RE.test(m.version))
+    return { error: "version must be semver (x.y.z[-pre])" };
+  if (m.description !== void 0 && (typeof m.description !== "string" || m.description.length > 200))
+    return { error: "description must be a string (\u2264 200 chars)" };
+  let activity;
+  if (m.activity !== void 0) {
+    if (typeof m.activity !== "object" || m.activity === null || Array.isArray(m.activity))
+      return { error: "activity must be an object" };
+    const a = m.activity;
+    activity = { order: 100 };
+    if (a.icon !== void 0) {
+      if (typeof a.icon !== "string" || a.icon === "" || a.icon.startsWith("/") || a.icon.split(/[\\/]/).includes("..") || !/\.(svg|png)$/i.test(a.icon)) {
+        return { error: "activity.icon must be a relative .svg or .png path inside the extension directory" };
+      }
+      if (!entryExists(a.icon))
+        return { error: `activity icon not found: ${a.icon}` };
+      activity.icon = a.icon;
+    }
+    for (const k of ["title", "title_zh"]) {
+      const v = a[k];
+      if (v === void 0)
+        continue;
+      if (typeof v !== "string" || v.trim() === "" || v.length > 64)
+        return { error: `activity.${k} must be a non-empty string (\u2264 64 chars)` };
+      activity[k] = v;
+    }
+    for (const k of ["description", "description_zh"]) {
+      const v = a[k];
+      if (v === void 0)
+        continue;
+      if (typeof v !== "string" || v.length > 200)
+        return { error: `activity.${k} must be a string (\u2264 200 chars)` };
+      activity[k] = v;
+    }
+    if (a.order !== void 0) {
+      if (typeof a.order !== "number" || !Number.isInteger(a.order) || a.order < 0 || a.order > 1e3)
+        return { error: "activity.order must be an integer 0\u20131000" };
+      activity.order = a.order;
+    }
+  }
+  let chatbar;
+  if (m.chatbar !== void 0) {
+    if (typeof m.chatbar !== "object" || m.chatbar === null || Array.isArray(m.chatbar))
+      return { error: "chatbar must be an object" };
+    const c = m.chatbar;
+    chatbar = { height: 160, order: 100 };
+    if (c.icon !== void 0) {
+      if (typeof c.icon !== "string" || c.icon === "" || c.icon.startsWith("/") || c.icon.split(/[\\/]/).includes("..") || !/\.(svg|png)$/i.test(c.icon)) {
+        return { error: "chatbar.icon must be a relative .svg or .png path inside the extension directory" };
+      }
+      if (!entryExists(c.icon))
+        return { error: `chatbar icon not found: ${c.icon}` };
+      chatbar.icon = c.icon;
+    }
+    for (const k of ["title", "title_zh"]) {
+      const v = c[k];
+      if (v === void 0)
+        continue;
+      if (typeof v !== "string" || v.trim() === "" || v.length > 64)
+        return { error: `chatbar.${k} must be a non-empty string (\u2264 64 chars)` };
+      chatbar[k] = v;
+    }
+    if (c.height !== void 0) {
+      if (typeof c.height !== "number" || !Number.isInteger(c.height) || c.height < 80 || c.height > 480)
+        return { error: "chatbar.height must be an integer 80\u2013480" };
+      chatbar.height = c.height;
+    }
+    if (c.order !== void 0) {
+      if (typeof c.order !== "number" || !Number.isInteger(c.order) || c.order < 0 || c.order > 1e3)
+        return { error: "chatbar.order must be an integer 0\u20131000" };
+      chatbar.order = c.order;
+    }
+  }
+  if (activity || chatbar) {
+    if (!Array.isArray(m.extensions))
+      return { error: "extensions must be an array (empty is fine with activity or chatbar)" };
+  } else if (!Array.isArray(m.extensions) || m.extensions.length === 0)
+    return { error: "extensions must be a non-empty array" };
+  for (const e of m.extensions) {
+    if (typeof e !== "string" || !FILE_EXT_RE.test(e))
+      return { error: `extensions entry "${String(e)}" must look like ".glb" (lowercase, with dot)` };
+  }
+  if (typeof m.entry !== "string" || m.entry === "" || m.entry.startsWith("/") || m.entry.split(/[\\/]/).includes("..")) {
+    return { error: "entry must be a relative path inside the extension directory" };
+  }
+  if (!entryExists(m.entry))
+    return { error: `entry not found: ${m.entry}` };
+  let priority = "default";
+  if (m.priority !== void 0) {
+    if (m.priority !== "default" && m.priority !== "option")
+      return { error: 'priority must be "default" or "option"' };
+    priority = m.priority;
+  }
+  const capabilities = [];
+  if (m.capabilities !== void 0) {
+    if (!Array.isArray(m.capabilities))
+      return { error: "capabilities must be an array" };
+    for (const cap of m.capabilities) {
+      if (typeof cap !== "string" || !CAPABILITIES.has(cap))
+        return { error: `unknown capability: ${String(cap)}` };
+      if (!capabilities.includes(cap))
+        capabilities.push(cap);
+    }
+  }
+  if (m.bundle !== void 0 && typeof m.bundle !== "boolean")
+    return { error: "bundle must be a boolean" };
+  const bundle = m.bundle === true;
+  if (bundle && capabilities.includes("save"))
+    return { error: "bundle extensions cannot declare save" };
+  let platforms;
+  if (m.platforms !== void 0) {
+    if (!Array.isArray(m.platforms) || m.platforms.length === 0)
+      return { error: "platforms must be a non-empty array" };
+    platforms = [];
+    for (const p of m.platforms) {
+      if (typeof p !== "string" || !PLATFORMS.has(p))
+        return { error: `unknown platform: ${String(p)}` };
+      if (!platforms.includes(p))
+        platforms.push(p);
+    }
+  }
+  let settings;
+  if (m.settings !== void 0) {
+    const parsed = parseSettings(m.settings);
+    if ("error" in parsed)
+      return parsed;
+    if (parsed.params || parsed.secrets)
+      settings = parsed;
+  }
+  if (m.homepage !== void 0 && (typeof m.homepage !== "string" || !/^https?:\/\//.test(m.homepage)))
+    return { error: "homepage must be an http(s) URL" };
+  if (m.license !== void 0 && typeof m.license !== "string")
+    return { error: "license must be a string" };
+  if (m.source !== void 0 && (typeof m.source !== "string" || !/^https:\/\/\S+$/.test(m.source) || !URL.canParse(m.source)))
+    return { error: "source must be an https URL (of the update.json)" };
+  return {
+    id: m.id,
+    name: m.name,
+    version: m.version,
+    ...m.description !== void 0 ? { description: m.description } : {},
+    extensions: m.extensions,
+    entry: m.entry,
+    priority,
+    capabilities,
+    bundle,
+    ...platforms ? { platforms } : {},
+    ...settings ? { settings } : {},
+    ...activity ? { activity } : {},
+    ...chatbar ? { chatbar } : {},
+    ...m.homepage !== void 0 ? { homepage: m.homepage } : {},
+    ...m.license !== void 0 ? { license: m.license } : {},
+    ...m.source !== void 0 ? { source: m.source } : {}
+  };
+}
+function readExtensionDir(dir, id = path7.basename(dir)) {
+  let raw;
+  try {
+    raw = JSON.parse(fs4.readFileSync(path7.join(dir, MANIFEST_FILE), "utf-8"));
+  } catch (err) {
+    const code = err.code;
+    return { id, error: code === "ENOENT" ? `${MANIFEST_FILE} missing` : `${MANIFEST_FILE} unreadable: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const parsed = parseManifest(raw, id, (entry) => {
+    try {
+      return fs4.statSync(path7.join(dir, entry)).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if ("error" in parsed)
+    return { id, error: parsed.error };
+  let installedAt = 0;
+  try {
+    installedAt = Math.round(fs4.statSync(dir).mtimeMs);
+  } catch {
+  }
+  return { ...parsed, installedAt };
+}
+var snapshot = { extensions: [], disabled: [], errors: [] };
+function getSnapshot() {
+  return snapshot;
+}
+
+// ../server/dist/agents/skill-sources.js
+import fs5 from "node:fs";
+import path8 from "node:path";
+import { homedir as homedir3 } from "node:os";
+
+// ../server/dist/routes/mtime-cache.js
+function createMtimeCache() {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    get(filePath, mtimeMs) {
+      const hit = entries.get(filePath);
+      return hit && hit.mtimeMs === mtimeMs ? hit.value : void 0;
+    },
+    set(filePath, mtimeMs, value) {
+      entries.set(filePath, { mtimeMs, value });
+      return value;
+    }
+  };
+}
+
+// ../server/dist/agents/skill-sources.js
+var GLOBAL_SKILLS_DIR = path8.join(homedir3(), ".halo", "global", "skills");
+var SKILL_ID_RE = /^[\w-]+$/;
+function isFile(p) {
+  try {
+    return fs5.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function childDirs(parent) {
+  let names;
+  try {
+    names = fs5.readdirSync(parent);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => {
+    try {
+      return fs5.statSync(path8.join(parent, n)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+function isExtensionSkillId(extId, id) {
+  return SKILL_ID_RE.test(id) && (id === extId || id.startsWith(`${extId}-`));
+}
+var _manifestEntry = createMtimeCache();
+var _warned = /* @__PURE__ */ new Set();
+function extensionSkillDirs() {
+  const root = extensionsRoot();
+  let extIds;
+  try {
+    extIds = fs5.readdirSync(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  const taken = /* @__PURE__ */ new Set();
+  let off;
+  for (const extId of extIds.filter(isExtensionId).sort()) {
+    const extDir = path8.join(root, extId);
+    const ids = childDirs(path8.join(extDir, "skills"));
+    if (ids.length === 0)
+      continue;
+    off ??= disabledExtensionIds();
+    if (off.has(extId))
+      continue;
+    const manifest = path8.join(extDir, MANIFEST_FILE);
+    let mtimeMs;
+    try {
+      mtimeMs = fs5.statSync(manifest).mtimeMs;
+    } catch {
+      continue;
+    }
+    let entry = _manifestEntry.get(manifest, mtimeMs);
+    if (entry === void 0) {
+      const ext = readExtensionDir(extDir);
+      entry = _manifestEntry.set(manifest, mtimeMs, "error" in ext ? null : path8.join(extDir, ext.entry));
+    }
+    if (!entry || !isFile(entry))
+      continue;
+    const ignored = [];
+    for (const id of ids.sort()) {
+      const dir = path8.join(extDir, "skills", id);
+      if (!fs5.existsSync(path8.join(dir, "SKILL.md")))
+        continue;
+      if (!isExtensionSkillId(extId, id) || taken.has(id)) {
+        ignored.push(id);
+        continue;
+      }
+      taken.add(id);
+      out.push({ id, dir, scope: "extension", extId });
+    }
+    const warnKey = `${manifest}@${mtimeMs}`;
+    if (ignored.length > 0 && !_warned.has(warnKey)) {
+      _warned.add(warnKey);
+      console.warn(`[Skills] extension "${extId}": ignoring skills/${ignored.join(", skills/")} \u2014 an extension skill id must be "${extId}" or start with "${extId}-", and be unique across extensions`);
+    }
+  }
+  return out;
+}
+function listSkillDirs(workspaceRoot) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (s) => {
+    out.push({ ...s, overridden: seen.has(s.id) });
+    seen.add(s.id);
+  };
+  if (workspaceRoot) {
+    const wsDir = path8.join(workspaceRoot, ".halo", "skills");
+    for (const id of childDirs(wsDir))
+      add({ id, dir: path8.join(wsDir, id), scope: "workspace" });
+  }
+  for (const id of childDirs(GLOBAL_SKILLS_DIR))
+    add({ id, dir: path8.join(GLOBAL_SKILLS_DIR, id), scope: "global" });
+  for (const s of extensionSkillDirs())
+    add(s);
+  return out;
+}
+
+// ../server/dist/a2a/remotes.js
+import fs6 from "node:fs";
+import path9 from "node:path";
+import YAML3 from "yaml";
+function remotesFile() {
+  return path9.join(secretsDir(), "a2a-remotes.yaml");
+}
+function loadRemotes() {
+  let doc;
+  try {
+    doc = YAML3.parse(fs6.readFileSync(remotesFile(), "utf8")) ?? {};
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const [name, r] of Object.entries(doc.remotes ?? {})) {
+    if (!r?.card)
+      continue;
+    out[name] = { name, card: r.card, auth: r.auth === "sigv4" ? "sigv4" : "bearer", pushBase: r.push_base?.replace(/\/+$/, "") };
+  }
+  return out;
+}
+
+// ../server/dist/settings-schema.js
+var GLOBAL_AGENTS_DIR = path10.join(homedir4(), ".halo", "global", "agents");
+var DEFAULT_A2A_URL_ALLOWLIST = "100.64.0.0/10,*.ts.net";
+var DEFAULT_FILES_SUMMARY = DEFAULT_HIDDEN_FILES.filter((f) => !/-(wal|shm)$/.test(f)).join(", ");
+function generalSection() {
+  return {
+    namespaceId: "general",
+    source: "general",
+    displayName: "General",
+    displayName_zh: "\u5E38\u89C4",
+    description: "Server behavior parameters (session limits, compaction, sandbox, logging).",
+    description_zh: "\u670D\u52A1\u7AEF\u884C\u4E3A\u53C2\u6570\uFF08\u4F1A\u8BDD\u9650\u5236\u3001\u538B\u7F29\u3001\u6C99\u7BB1\u3001\u65E5\u5FD7\uFF09\u3002",
+    // Every general.* field is globalOnly: config.ts reads them via
+    // settingsValue() from the global settings.yaml only. Per-workspace
+    // layering exists solely for namespaced params/secrets (getServerSecret).
+    fields: [
+      // system-wide language preference. Read by internal agents (evo, score)
+      // that don't load INSTRUCTIONS.md, and available to anything else that
+      // wants a language hint without inspecting per-session state.
+      { key: "language", type: "enum", options: ["en-US", "zh-CN"], optionLabels: ["English", "\u4E2D\u6587"], globalOnly: true, description: "System language (BCP-47). Drives the admin UI language and any internal agents (evo / score) that don't load INSTRUCTIONS.md. Single source of truth.", description_zh: "\u7CFB\u7EDF\u8BED\u8A00\uFF08BCP-47 \u533A\u57DF\u7801\uFF09\u3002admin UI \u4E0E\u4E0D\u52A0\u8F7D INSTRUCTIONS.md \u7684\u5185\u90E8 agent\uFF08evo / score\uFF09\u5171\u7528\u3002\u5355\u4E00\u6765\u6E90\u3002", default: "en-US" },
+      // admin UI color theme. Consumed only by the admin frontend (shared/theme);
+      // stored server-side so the choice follows the user across browsers.
+      { key: "theme", type: "enum", options: ["dark", "light", "midnight", "warm"], optionLabels: ["Dark", "Light", "Midnight", "Warm"], globalOnly: true, description: "Admin UI color theme.", description_zh: "Admin \u754C\u9762\u914D\u8272\u4E3B\u9898\u3002", default: "dark" },
+      { key: "agent.max_retries", type: "int", globalOnly: true, restartRequired: true, description: "Max attempts per model call on transient errors (rate limit, 5xx, network). Backoff grows between attempts.", description_zh: "\u5355\u6B21\u6A21\u578B\u8C03\u7528\u9047\u5230\u77AC\u6001\u9519\u8BEF\uFF08\u9650\u6D41\u30015xx\u3001\u7F51\u7EDC\uFF09\u65F6\u7684\u6700\u5927\u5C1D\u8BD5\u6B21\u6570\uFF0C\u91CD\u8BD5\u95F4\u9694\u9012\u589E\u3002", default: "5" },
+      // server — network-facing knobs; global-only since they alter how the
+      // server itself authenticates clients.
+      { key: "server.trust_proxy", type: "boolean", globalOnly: true, description: "Trust the x-forwarded-for header for client IP resolution (brute-force rate limiting). Enable ONLY when a reverse proxy you control sits in front and rewrites the header \u2014 otherwise clients can forge it to bypass lockouts.", description_zh: "\u4FE1\u4EFB x-forwarded-for \u8BF7\u6C42\u5934\u89E3\u6790\u5BA2\u6237\u7AEF IP\uFF08\u66B4\u529B\u7834\u89E3\u9650\u901F\u7528\uFF09\u3002\u4EC5\u5F53\u524D\u9762\u6709\u4F60\u63A7\u5236\u7684\u53CD\u5411\u4EE3\u7406\u5E76\u4F1A\u91CD\u5199\u8BE5\u5934\u65F6\u624D\u5F00\u542F\u2014\u2014\u5426\u5219\u5BA2\u6237\u7AEF\u53EF\u4F2A\u9020\u7ED5\u8FC7\u9501\u5B9A\u3002", default: "false" },
+      // session
+      { key: "session.max_queue_size", type: "int", globalOnly: true, restartRequired: true, description: "Maximum queued messages per session", description_zh: "\u6BCF\u4E2A\u4F1A\u8BDD\u6700\u5927\u6392\u961F\u6D88\u606F\u6570", default: "256" },
+      { key: "session.max_nesting_depth", type: "int", globalOnly: true, restartRequired: true, description: "Maximum session nesting depth for agent delegation", description_zh: "Agent \u59D4\u6D3E\u7684\u6700\u5927\u4F1A\u8BDD\u5D4C\u5957\u6DF1\u5EA6", default: "16" },
+      // compact
+      { key: "compact.compress_at", type: "float", globalOnly: true, description: "Auto-compact threshold as a fraction of max context (e.g. 0.9 = compact when 90% full)", description_zh: "\u81EA\u52A8\u538B\u7F29\u9608\u503C\uFF0C\u6700\u5927\u4E0A\u4E0B\u6587\u7684\u6BD4\u4F8B\uFF08\u5982 0.9 \u8868\u793A\u7528\u6EE1 90% \u65F6\u538B\u7F29\uFF09", default: "0.9" },
+      { key: "compact.keep_messages", type: "int", globalOnly: true, restartRequired: true, description: "Recent messages kept intact during compaction", description_zh: "\u538B\u7F29\u65F6\u4FDD\u7559\u6700\u540E\u591A\u5C11\u6761\u6D88\u606F\u4E0D\u52A8", default: "5" },
+      { key: "compact.max_summary_input", type: "int", globalOnly: true, restartRequired: true, description: "Max chars fed into local truncation fallback", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u7684\u603B\u8F93\u5165\u5B57\u7B26\u4E0A\u9650", default: "15000" },
+      { key: "compact.max_message_slice", type: "int", globalOnly: true, restartRequired: true, description: "Max chars kept per old message during local truncation", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u6BCF\u6761\u65E7\u6D88\u606F\u4FDD\u7559\u7684\u6700\u5927\u5B57\u7B26\u6570", default: "800" },
+      // sandbox (Linux bwrap / macOS sandbox-exec) — global-only: these define the security
+      // boundary agents run inside; a workspace overriding them could lift
+      // its own sandbox constraints.
+      { key: "sandbox.hidden_dirs", globalOnly: true, description: `Extra comma-separated dirs to hide from workspace/readonly sessions (Linux bwrap / macOS sandbox-exec). Applies only to those sessions \u2014 Full sessions, the admin file explorer and the terminal are not affected. Added to the built-in list, which is always included and can't be removed here: ${DEFAULT_HIDDEN_DIRS.join(", ")}.`, description_zh: `\u989D\u5916\u8981\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux bwrap / macOS sandbox-exec\uFF09\u3002\u53EA\u5BF9\u8FD9\u4E24\u7C7B\u4F1A\u8BDD\u751F\u6548\uFF0CFull \u4F1A\u8BDD\u3001\u6587\u4EF6\u6D4F\u89C8\u5668\u3001\u7EC8\u7AEF\u4E0D\u53D7\u5F71\u54CD\u3002\u4F1A\u8FFD\u52A0\u5230\u5185\u7F6E\u5217\u8868\u4E4B\u540E\uFF0C\u5185\u7F6E\u9879\u59CB\u7EC8\u5728\u5217\u8868\u4E2D\u3001\u4E0D\u80FD\u5728\u8FD9\u91CC\u79FB\u9664\uFF1A${DEFAULT_HIDDEN_DIRS.join("\u3001")}\u3002`, default: "" },
+      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs writable inside the sandbox besides the workspace (Linux / macOS) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u9664 workspace \u5916\u5728\u6C99\u7BB1\u5185\u53EF\u5199\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
+      { key: "sandbox.hidden_files", globalOnly: true, description: `Extra comma-separated files to hide from workspace/readonly sessions \u2014 read as empty (Linux / macOS). Applies only to those sessions \u2014 Full sessions, the admin file explorer and the terminal are not affected. Added to the built-in list, which is always included and can't be removed here: ${DEFAULT_FILES_SUMMARY} (plus their -wal / -shm sidecars).`, description_zh: `\u989D\u5916\u8981\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u6587\u4EF6\uFF0C\u8BFB\u5230\u7684\u662F\u7A7A\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09\u3002\u53EA\u5BF9\u8FD9\u4E24\u7C7B\u4F1A\u8BDD\u751F\u6548\uFF0CFull \u4F1A\u8BDD\u3001\u6587\u4EF6\u6D4F\u89C8\u5668\u3001\u7EC8\u7AEF\u4E0D\u53D7\u5F71\u54CD\u3002\u4F1A\u8FFD\u52A0\u5230\u5185\u7F6E\u5217\u8868\u4E4B\u540E\uFF0C\u5185\u7F6E\u9879\u59CB\u7EC8\u5728\u5217\u8868\u4E2D\u3001\u4E0D\u80FD\u5728\u8FD9\u91CC\u79FB\u9664\uFF1A${DEFAULT_FILES_SUMMARY}\uFF08\u53CA\u5176 -wal / -shm \u9644\u5C5E\u6587\u4EF6\uFF09\u3002`, default: "" },
+      // logging
+      { key: "logging.level", type: "enum", options: ["debug", "info", "warn", "error"], globalOnly: true, restartRequired: true, description: "Log level", description_zh: "\u65E5\u5FD7\u7EA7\u522B", default: "warn" },
+      // observability (OpenTelemetry). Read once at boot by observability/otel.ts
+      // and mapped onto the standard OTEL_* env vars — hence "takes effect on
+      // restart" everywhere below. Children don't inherit those settings-derived
+      // vars (child-env.ts), so each cron / evo cli run re-reads settings.
+      { key: "observability.endpoint", type: "string", globalOnly: true, restartRequired: true, description: "OTLP base URL of an OpenTelemetry collector (e.g. http://localhost:4318). Traces, metrics and logs are all exported there over OTLP http/protobuf \u2014 http:// or https://, on the collector's OTLP/HTTP port (4318 by default); gRPC (4317) is not supported. Empty = observability off. Takes effect on server restart; cron / evolution runs use the new value on their next run.", description_zh: "OpenTelemetry collector \u7684 OTLP \u57FA\u7840\u5730\u5740\uFF08\u5982 http://localhost:4318\uFF09\uFF0Ctrace / metrics / \u65E5\u5FD7\u4E09\u7C7B\u4FE1\u53F7\u90FD\u4EE5 OTLP http/protobuf \u53D1\u5230\u8FD9\u91CC\u3002http:// \u6216 https:// \u5747\u53EF\uFF0C\u7AEF\u53E3\u987B\u662F collector \u7684 OTLP/HTTP \u7AEF\u53E3\uFF08\u9ED8\u8BA4 4318\uFF09\uFF0C\u4E0D\u652F\u6301 gRPC\uFF084317\uFF09\u3002\u7559\u7A7A = \u5173\u95ED\u3002\u91CD\u542F\u670D\u52A1\u540E\u751F\u6548\uFF1Bcron / evolution \u4EFB\u52A1\u4E0B\u6B21\u8FD0\u884C\u5373\u7528\u65B0\u503C\u3002", default: "" },
+      { key: "observability.service_name", type: "string", globalOnly: true, restartRequired: true, description: "OTel resource service.name reported for this server. Takes effect on server restart; cron / evolution runs use the new value on their next run.", description_zh: "\u672C\u670D\u52A1\u5728 OTel \u4E2D\u4E0A\u62A5\u7684 service.name\u3002\u91CD\u542F\u670D\u52A1\u540E\u751F\u6548\uFF1Bcron / evolution \u4EFB\u52A1\u4E0B\u6B21\u8FD0\u884C\u5373\u7528\u65B0\u503C\u3002", default: "halo" },
+      { key: "observability.headers", type: "string", secret: true, globalOnly: true, restartRequired: true, description: "Extra headers for every OTLP request, comma-separated k=v (e.g. authorization=Bearer \u2026). Takes effect on server restart; cron / evolution runs use the new value on their next run.", description_zh: "\u9644\u52A0\u5230\u6BCF\u4E2A OTLP \u8BF7\u6C42\u7684 header\uFF0C\u9017\u53F7\u5206\u9694\u7684 k=v\uFF08\u5982 authorization=Bearer \u2026\uFF09\u3002\u91CD\u542F\u670D\u52A1\u540E\u751F\u6548\uFF1Bcron / evolution \u4EFB\u52A1\u4E0B\u6B21\u8FD0\u884C\u5373\u7528\u65B0\u503C\u3002", default: "" },
+      { key: "observability.capture_content", type: "boolean", globalOnly: true, restartRequired: true, description: "Put prompt / completion / tool argument and result text on spans (gen_ai.*.messages etc.). Off = only metadata (model, tokens, latency, tool names). Env OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT (true / false) overrides. Takes effect on server restart; cron / evolution runs use the new value on their next run.", description_zh: "\u662F\u5426\u628A\u63D0\u793A\u8BCD / \u6A21\u578B\u8F93\u51FA / \u5DE5\u5177\u53C2\u6570\u4E0E\u7ED3\u679C\u6B63\u6587\u5199\u5230 span \u4E0A\uFF08gen_ai.*.messages \u7B49\uFF09\u3002\u5173 = \u53EA\u4E0A\u62A5\u5143\u6570\u636E\uFF08\u6A21\u578B\u3001token\u3001\u8017\u65F6\u3001\u5DE5\u5177\u540D\uFF09\u3002\u73AF\u5883\u53D8\u91CF OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT\uFF08true / false\uFF09\u4F18\u5148\u3002\u91CD\u542F\u670D\u52A1\u540E\u751F\u6548\uFF1Bcron / evolution \u4EFB\u52A1\u4E0B\u6B21\u8FD0\u884C\u5373\u7528\u65B0\u503C\u3002", default: "false" },
+      // Notebook kernels (jupyter/manager.ts). Global-only: kernels run
+      // unsandboxed as the service user, like the terminal. Read per spawn.
+      { key: "jupyter.enabled", type: "boolean", globalOnly: true, description: "Allow notebook execution: the ipynb viewer can start kernels through a local Jupyter server (runs as the Halo service user, unsandboxed, like the terminal).", description_zh: "\u5141\u8BB8\u8FD0\u884C notebook\uFF1Aipynb \u67E5\u770B\u5668\u53EF\u901A\u8FC7\u672C\u673A Jupyter server \u542F\u52A8\u5185\u6838\uFF08\u4EE5 Halo \u670D\u52A1\u7528\u6237\u8EAB\u4EFD\u8FD0\u884C\u3001\u4E0D\u8FDB\u6C99\u7BB1\uFF0C\u4E0E\u7EC8\u7AEF\u76F8\u540C\uFF09\u3002", default: "true" },
+      { key: "jupyter.path", type: "string", globalOnly: true, description: "Full path to the `jupyter` executable (e.g. /home/me/.venvs/jupyter/bin/jupyter). Empty = find `jupyter` on PATH. Needs jupyter_server + ipykernel (pip install jupyter_server ipykernel). Applies the next time the Jupyter server starts.", description_zh: "`jupyter` \u53EF\u6267\u884C\u6587\u4EF6\u7684\u5B8C\u6574\u8DEF\u5F84\uFF08\u5982 /home/me/.venvs/jupyter/bin/jupyter\uFF09\u3002\u7559\u7A7A = \u5728 PATH \u4E0A\u67E5\u627E `jupyter`\u3002\u9700\u8981 jupyter_server + ipykernel\uFF08pip install jupyter_server ipykernel\uFF09\u3002\u4E0B\u6B21\u542F\u52A8 Jupyter server \u65F6\u751F\u6548\u3002", default: "" },
+      // A2A (plans/a2a.md). Global-only: the URL allowlist is an egress boundary
+      // a workspace must not widen; public_url names this server to peers.
+      { key: "a2a.public_url", type: "string", globalOnly: true, description: "Origin peers use to reach this server for A2A (e.g. http://myhost.tailnet.ts.net:9527): the agent card's interface URL and the webhook URL given to remotes. Empty = derived from the request Host. Env HALO_A2A_PUBLIC_URL overrides.", description_zh: "\u5BF9\u7AEF\u8BBF\u95EE\u672C\u670D\u52A1\u7684 A2A \u6E90\u5730\u5740\uFF08\u5982 http://myhost.tailnet.ts.net:9527\uFF09\uFF1A\u7528\u4E8E agent card \u7684\u63A5\u53E3 URL \u548C\u4EA4\u7ED9\u8FDC\u7AEF\u7684 webhook URL\u3002\u7559\u7A7A\u5219\u6309\u8BF7\u6C42 Host \u63A8\u5BFC\u3002\u73AF\u5883\u53D8\u91CF HALO_A2A_PUBLIC_URL \u4F18\u5148\u3002", default: "" },
+      { key: "a2a.url_allowlist", type: "string", globalOnly: true, description: "Comma-separated CIDRs / host patterns A2A may reach besides public https (push webhooks, remote cards and RPC). Private / loopback ranges are refused unless listed; plain http is allowed only to listed hosts / ranges. Link-local (169.254.0.0/16, fe80::/10) is always refused.", description_zh: "A2A \u9664\u516C\u7F51 https \u4E4B\u5916\u5141\u8BB8\u8BBF\u95EE\u7684 CIDR / \u4E3B\u673A\u6A21\u5F0F\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u7528\u4E8E push webhook\u3001\u8FDC\u7AEF card \u548C RPC\uFF09\u3002\u79C1\u7F51 / \u56DE\u73AF\u5730\u5740\u5FC5\u987B\u5217\u51FA\u624D\u5141\u8BB8\uFF1B\u660E\u6587 http \u53EA\u5141\u8BB8\u5217\u51FA\u7684\u4E3B\u673A / \u7F51\u6BB5\u3002\u94FE\u8DEF\u672C\u5730\u5730\u5740\uFF08169.254.0.0/16\u3001fe80::/10\uFF09\u59CB\u7EC8\u62D2\u7EDD\u3002", default: DEFAULT_A2A_URL_ALLOWLIST },
+      // self-evolution (see plans/self-evolution.md). All evo settings are
+      // global-only — the worker / ticker live in the server process and
+      // would have to reload mid-flight if a workspace could override them.
+      { key: "evolution.level", type: "enum", options: ["L0", "L1"], globalOnly: true, description: "Self-evolution capability ladder. L0: manual only \u2014 drafts via /evo, manual approve/reject. L1: L0 plus automatic drafting on pre-compact. (Queued runs always execute regardless of level; the level only gates how they get enqueued.)", description_zh: "\u81EA\u6211\u8FDB\u5316\u7B49\u7EA7\u3002L0\uFF1A\u4EC5\u624B\u52A8\u2014\u2014\u901A\u8FC7 /evo \u8D77\u8349\uFF0C\u624B\u52A8 approve/reject\u3002L1\uFF1A\u5728 L0 \u57FA\u7840\u4E0A\uFF0C\u538B\u7F29\u524D\uFF08pre-compact\uFF09\u81EA\u52A8\u8D77\u8349\u3002\uFF08\u5DF2\u6392\u961F\u7684 run \u59CB\u7EC8\u6267\u884C\uFF0Clevel \u53EA\u51B3\u5B9A\u5982\u4F55\u5165\u961F\u3002\uFF09", default: "L0" },
+      { key: "evolution.max_concurrent_run", type: "int", globalOnly: true, description: "Max concurrent evo run wrappers (drafting patches).", description_zh: "\u540C\u65F6\u8FD0\u884C\u7684 evo run wrapper \u4E0A\u9650\uFF08\u8D77\u8349 patch\uFF09\u3002", default: "1" },
+      { key: "evolution.max_concurrent_apply", type: "int", globalOnly: true, description: "Max concurrent evo apply wrappers (merging patches).", description_zh: "\u540C\u65F6\u8FD0\u884C\u7684 evo apply wrapper \u4E0A\u9650\uFF08\u5408\u5E76 patch\uFF09\u3002", default: "1" },
+      { key: "evolution.run_timeout_minutes", type: "int", globalOnly: true, description: "Heartbeat timeout for run wrappers. The wrapper writes a heartbeat every 60s for as long as it lives, so exceeding this means the wrapper process died \u2014 the row is requeued (or marked timeout past max_attempts). This is dead-wrapper detection latency, NOT a budget for slow models; the per-phase model budget is the wrapper-internal cap (draft 60min, other phases 45min).", description_zh: "run wrapper \u5FC3\u8DF3\u8D85\u65F6\uFF08\u5206\u949F\uFF09\u3002wrapper \u5B58\u6D3B\u671F\u95F4\u6BCF 60 \u79D2\u5199\u4E00\u6B21\u5FC3\u8DF3\uFF0C\u8D85\u65F6\u5373\u89C6\u4E3A wrapper \u8FDB\u7A0B\u5DF2\u6B7B\uFF0C\u4EFB\u52A1\u91CD\u6392\uFF08\u8D85\u8FC7 max_attempts \u5219\u6807 timeout\uFF09\u3002\u8FD9\u662F\u6B7B wrapper \u7684\u68C0\u6D4B\u5EF6\u8FDF\uFF0C\u4E0D\u662F\u6162\u6A21\u578B\u7684\u8FD0\u884C\u9884\u7B97\u2014\u2014\u5355\u9636\u6BB5\u6A21\u578B\u9884\u7B97\u662F wrapper \u5185\u90E8\u7684\u4E0A\u9650\uFF08\u8D77\u8349 60 \u5206\u949F\uFF0C\u5176\u4F59\u9636\u6BB5 45 \u5206\u949F\uFF09\u3002", default: "12" },
+      { key: "evolution.apply_timeout_minutes", type: "int", globalOnly: true, description: "Heartbeat timeout for apply wrappers.", description_zh: "apply wrapper \u5FC3\u8DF3\u8D85\u65F6\uFF08\u5206\u949F\uFF09\u3002", default: "5" },
+      { key: "evolution.max_attempts", type: "int", globalOnly: true, description: "How many times the ticker may try to spawn a wrapper for a single row before giving up. Stops infinite retry loops on permanently broken tasks.", description_zh: "ticker \u4E3A\u5355\u6761\u4EFB\u52A1\u5C1D\u8BD5\u62C9\u8D77 wrapper \u7684\u6700\u5927\u6B21\u6570\uFF0C\u8D85\u8FC7\u540E\u653E\u5F03\u3002\u907F\u514D\u574F\u4EFB\u52A1\u65E0\u9650\u91CD\u8BD5\u3002", default: "3" },
+      { key: "evolution.triggers.pre_compact", type: "boolean", globalOnly: true, description: "Snapshot the session right before compaction so evo can analyze it. /evo is always available regardless of this setting.", description_zh: "\u5728 compact \u524D\u5FEB\u7167\u4F1A\u8BDD\u4F9B evo \u5206\u6790\u3002/evo \u603B\u662F\u53EF\u7528\uFF0C\u4E0E\u6B64\u5F00\u5173\u65E0\u5173\u3002", default: "true" },
+      // limits — runtime caps that protect against runaway tool output / UI
+      // freezes. All read live from settings.yaml so changes take effect on
+      // the next tool call without a server restart.
+      { key: "limits.shell_output_bytes", type: "int", globalOnly: true, description: 'Max bytes captured from a single shell_exec call (stdout+stderr combined). Output past this is truncated; the agent sees a "[truncated]" marker.', description_zh: "\u5355\u6B21 shell_exec \u6700\u591A\u4FDD\u7559\u7684\u8F93\u51FA\u5B57\u8282\u6570\uFF08stdout+stderr \u5408\u8BA1\uFF09\u3002\u8D85\u51FA\u90E8\u5206\u622A\u65AD\uFF0Cagent \u4F1A\u770B\u5230 [truncated] \u6807\u8BB0\u3002", default: String(5 * 1024 * 1024) },
+      { key: "limits.web_fetch_bytes", type: "int", globalOnly: true, description: "Max bytes downloaded by a single web_fetch call.", description_zh: "\u5355\u6B21 web_fetch \u6700\u591A\u4E0B\u8F7D\u7684\u5B57\u8282\u6570\u3002", default: String(50 * 1024) },
+      { key: "limits.grep_default_matches", type: "int", globalOnly: true, description: "Default match cap for the grep tool when the call site does not pass an explicit `max`.", description_zh: "grep \u5DE5\u5177\u672A\u663E\u5F0F\u4F20 `max` \u53C2\u6570\u65F6\u7684\u9ED8\u8BA4\u5339\u914D\u4E0A\u9650\u3002", default: "50" },
+      { key: "limits.tool_result_render_chars", type: "int", globalOnly: true, description: 'Per-tool-result cap on the content fed back to the LLM. Larger results are truncated (with a "[Content truncated]" marker telling the model to re-run with narrower scope) to protect the context window and prompt cache. The UI/admin chat panel shows a far larger slice \u2014 see tool_result_ui_chars.', description_zh: "\u6BCF\u6761 tool result \u56DE\u4F20\u7ED9 LLM \u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8D85\u51FA\u90E8\u5206\u4F1A\u88AB\u622A\u65AD\uFF08\u5E76\u9644 [Content truncated] \u6807\u8BB0\u63D0\u793A\u6A21\u578B\u7F29\u5C0F\u8303\u56F4\u91CD\u67E5\uFF09\uFF0C\u4EE5\u4FDD\u62A4\u4E0A\u4E0B\u6587\u7A97\u53E3\u548C\u63D0\u793A\u8BCD\u7F13\u5B58\u3002UI/admin \u804A\u5929\u9762\u677F\u5C55\u793A\u7684\u5185\u5BB9\u4E0A\u9650\u8981\u5927\u5F97\u591A\uFF0C\u89C1 tool_result_ui_chars\u3002", default: "8000" },
+      { key: "limits.tool_result_ui_chars", type: "int", globalOnly: true, description: "Per-tool-result cap on the content stored for UI display (admin/web chat panel). Far larger than the LLM cap so the full output of a normal command stays visible, but bounded so a multi-MB `cat` does not bloat the session file, the WS payload, or the browser render. Output past this is truncated with a marker pointing at file_read for the complete content.", description_zh: "\u6BCF\u6761 tool result \u5B58\u7ED9 UI \u5C55\u793A\uFF08admin/web \u804A\u5929\u9762\u677F\uFF09\u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8FDC\u5927\u4E8E LLM \u4E0A\u9650\uFF0C\u4FDD\u8BC1\u666E\u901A\u547D\u4EE4\u7684\u5B8C\u6574\u8F93\u51FA\u90FD\u80FD\u770B\u5230\uFF1B\u4F46\u4ECD\u6709\u754C\uFF0C\u907F\u514D cat \u4E2A\u51E0 MB \u7684\u6587\u4EF6\u6491\u7206\u4F1A\u8BDD\u6587\u4EF6\u3001WS \u4F20\u8F93\u548C\u6D4F\u89C8\u5668\u6E32\u67D3\u3002\u8D85\u51FA\u90E8\u5206\u622A\u65AD\u5E76\u9644\u6807\u8BB0\uFF0C\u63D0\u793A\u7528 file_read \u770B\u5B8C\u6574\u5185\u5BB9\u3002", default: String(64 * 1024) },
+      { key: "limits.auto_report_chars", type: "int", globalOnly: true, description: "Cap on the auto-report a finished sub-agent delivers to its parent. Longer reports are truncated with a pointer to get_session_output for the full text.", description_zh: "\u5B50\u4F1A\u8BDD\u5B8C\u6210\u540E\u81EA\u52A8\u4E0A\u62A5\u7ED9\u7236\u4F1A\u8BDD\u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8D85\u51FA\u622A\u65AD\uFF0C\u5E76\u63D0\u793A\u7528 get_session_output \u53D6\u5168\u6587\u3002", default: "8192" },
+      { key: "limits.terminal_scrollback_bytes", type: "int", globalOnly: true, description: "Off-screen scrollback bytes retained per persistent terminal while detached.", description_zh: "\u7EC8\u7AEF\u65AD\u5F00\u671F\u95F4\u4FDD\u7559\u7684\u56DE\u6EDA\u7F13\u51B2\u5B57\u8282\u6570\u3002", default: "50000" }
+    ].map((f) => ({
+      ...f,
+      kind: "param",
+      // Only language + theme stay in the open; everything else is folded
+      // under the UI's collapsed "Advanced" area.
+      advanced: f.key !== "language" && f.key !== "theme"
+    }))
+  };
+}
+var _yamlCache = createMtimeCache();
+var _skillNameCache = createMtimeCache();
+function readYamlFile(p) {
+  try {
+    const { mtimeMs } = fs7.statSync(p);
+    const hit = _yamlCache.get(p, mtimeMs);
+    if (hit !== void 0)
+      return hit;
+    const parsed = YAML4.parse(fs7.readFileSync(p, "utf-8"));
+    return _yamlCache.set(p, mtimeMs, parsed && typeof parsed === "object" ? parsed : null);
+  } catch {
+    return null;
+  }
+}
+var VALID_TYPES = /* @__PURE__ */ new Set(["string", "int", "float", "boolean", "enum"]);
+function normalizeFieldList(raw, kind) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object")
+      continue;
+    const r = item;
+    if (typeof r.key !== "string" || !r.key)
+      continue;
+    const type = typeof r.type === "string" && VALID_TYPES.has(r.type) ? r.type : void 0;
+    const options = Array.isArray(r.options) ? r.options.filter((v) => typeof v === "string") : void 0;
+    const optionLabels = Array.isArray(r.optionLabels) && options && r.optionLabels.length === options.length ? r.optionLabels.filter((v) => typeof v === "string") : void 0;
+    const defaultRaw = r.default;
+    const defaultStr = defaultRaw == null ? void 0 : typeof defaultRaw === "string" ? defaultRaw : String(defaultRaw);
+    out.push({
+      key: r.key,
+      kind,
+      type,
+      options,
+      optionLabels,
+      description: typeof r.description === "string" ? r.description : void 0,
+      description_zh: typeof r.description_zh === "string" ? r.description_zh : void 0,
+      default: defaultStr,
+      secret: r.secret === true
+    });
+  }
+  return out;
+}
+function providerSections() {
+  const sections = [];
+  for (const { id, data: parsed } of loadProviders().effective) {
+    const fields = normalizeFieldList(parsed.secrets, "secret");
+    if (fields.length === 0)
+      continue;
+    sections.push({
+      namespaceId: id,
+      source: "provider",
+      displayName: typeof parsed.displayName === "string" ? parsed.displayName : id,
+      displayName_zh: typeof parsed.displayName_zh === "string" ? parsed.displayName_zh : void 0,
+      description: typeof parsed.description === "string" ? parsed.description : void 0,
+      description_zh: typeof parsed.description_zh === "string" ? parsed.description_zh : void 0,
+      fields
+    });
+  }
+  return sections;
+}
+function buildSkillSection(skillsDir, skillId) {
+  const configPath = path10.join(skillsDir, skillId, "config.yaml");
+  if (!fs7.existsSync(configPath))
+    return null;
+  const parsed = readYamlFile(configPath);
+  if (!parsed)
+    return null;
+  const params = normalizeFieldList(parsed.params, "param");
+  const secrets = normalizeFieldList(parsed.secrets, "secret");
+  if (params.length === 0 && secrets.length === 0)
+    return null;
+  let displayName = skillId;
+  try {
+    const mdPath = path10.join(skillsDir, skillId, "SKILL.md");
+    const { mtimeMs } = fs7.statSync(mdPath);
+    let name = _skillNameCache.get(mdPath, mtimeMs);
+    if (name === void 0) {
+      const m = fs7.readFileSync(mdPath, "utf-8").match(/^---\s*\n([\s\S]*?)\n---/);
+      const nameMatch = m?.[1].match(/^name:\s*(.+)$/m);
+      name = _skillNameCache.set(mdPath, mtimeMs, nameMatch ? nameMatch[1].trim() : null);
+    }
+    if (name)
+      displayName = name;
+  } catch {
+  }
+  return {
+    namespaceId: skillId,
+    source: "skill",
+    displayName,
+    displayName_zh: typeof parsed.displayName_zh === "string" ? parsed.displayName_zh : void 0,
+    description: typeof parsed.description === "string" ? parsed.description : void 0,
+    description_zh: typeof parsed.description_zh === "string" ? parsed.description_zh : void 0,
+    fields: [...params, ...secrets]
+  };
+}
+function skillSections(workspaceRoot) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const { id, dir } of listSkillDirs(workspaceRoot).reverse()) {
+    const section = buildSkillSection(path10.dirname(dir), id);
+    if (section)
+      byId.set(section.namespaceId, section);
+  }
+  return [...byId.values()];
+}
+function agentSections() {
+  const sections = [];
+  let entries = [];
+  try {
+    entries = fs7.readdirSync(GLOBAL_AGENTS_DIR, { withFileTypes: true });
+  } catch {
+    return sections;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory())
+      continue;
+    const agentId = entry.name;
+    const configPath = path10.join(GLOBAL_AGENTS_DIR, agentId, "agent-config.yaml");
+    if (!fs7.existsSync(configPath))
+      continue;
+    const parsed = readYamlFile(configPath);
+    if (!parsed)
+      continue;
+    const params = normalizeFieldList(parsed.params, "param");
+    const secrets = normalizeFieldList(parsed.secrets, "secret");
+    if (params.length === 0 && secrets.length === 0)
+      continue;
+    let displayName = agentId;
+    try {
+      const ay = readYamlFile(path10.join(GLOBAL_AGENTS_DIR, agentId, "agent.yaml"));
+      if (ay && typeof ay.name === "string")
+        displayName = ay.name;
+    } catch {
+    }
+    sections.push({
+      namespaceId: agentId,
+      source: "agent",
+      displayName,
+      displayName_zh: typeof parsed.displayName_zh === "string" ? parsed.displayName_zh : void 0,
+      description: typeof parsed.description === "string" ? parsed.description : void 0,
+      description_zh: typeof parsed.description_zh === "string" ? parsed.description_zh : void 0,
+      fields: [...params, ...secrets]
+    });
+  }
+  return sections;
+}
+function loadSettingsSchema(workspaceRoot) {
+  return [generalSection(), ...a2aSections(), ...providerSections(), ...skillSections(workspaceRoot), ...agentSections(), ...extensionSections()];
+}
+function a2aSections() {
+  const fields = Object.values(loadRemotes()).filter((r) => r.auth === "bearer").map((r) => ({
+    key: r.name,
+    kind: "secret",
+    secret: true,
+    description: `Bearer token for the A2A remote "${r.name}" (card: ${r.card}).`,
+    description_zh: `A2A \u8FDC\u7A0B "${r.name}" \u7684 bearer token\uFF08card\uFF1A${r.card}\uFF09\u3002`
+  }));
+  if (fields.length === 0)
+    return [];
+  return [{
+    namespaceId: "a2a",
+    source: "general",
+    displayName: "A2A remotes",
+    displayName_zh: "A2A \u8FDC\u7A0B",
+    description: "Tokens for the bearer remotes in ~/.halo/secrets/a2a-remotes.yaml. Prefer global: non-full sessions can read the workspace settings.yaml.",
+    description_zh: "~/.halo/secrets/a2a-remotes.yaml \u4E2D bearer \u8FDC\u7A0B\u7684 token\u3002\u5EFA\u8BAE\u8BBE\u5728\u5168\u5C40\uFF1A\u975E full \u4F1A\u8BDD\u53EF\u4EE5\u8BFB\u53D6\u5DE5\u4F5C\u533A\u7684 settings.yaml\u3002",
+    fields
+  }];
+}
+function extensionSections() {
+  const sections = [];
+  for (const ext of getSnapshot().extensions) {
+    if (!ext.settings)
+      continue;
+    const fields = [];
+    for (const kind of ["param", "secret"]) {
+      for (const f of ext.settings[`${kind}s`] ?? []) {
+        fields.push({ ...f, kind, globalOnly: true, ...kind === "secret" ? { secret: true } : {} });
+      }
+    }
+    sections.push({
+      namespaceId: `ext-${ext.id}`,
+      source: "extension",
+      displayName: ext.name,
+      ...ext.description !== void 0 ? { description: ext.description } : {},
+      fields
+    });
+  }
+  return sections;
+}
+
+// ../server/dist/config.js
+var HALO_HOME2 = path11.join(homedir5(), ".halo");
+var HALO_GLOBAL_DIR = path11.join(HALO_HOME2, "global");
+var HALO_SECRETS_DIR = path11.join(HALO_HOME2, "secrets");
+function loadYamlFile(filePath) {
+  try {
+    const raw = fs8.readFileSync(filePath, "utf-8");
+    return YAML5.parse(raw) ?? {};
+  } catch {
+    return {};
+  }
+}
+var SYSTEM_CONFIG_PATH = path11.join(HALO_SECRETS_DIR, "config.yaml");
+var _systemConfigCache = null;
+function getSystemConfig() {
+  let mtimeMs = 0;
+  try {
+    mtimeMs = fs8.statSync(SYSTEM_CONFIG_PATH).mtimeMs;
+  } catch {
+  }
+  if (!_systemConfigCache || _systemConfigCache.mtimeMs !== mtimeMs) {
+    _systemConfigCache = { mtimeMs, data: loadYamlFile(SYSTEM_CONFIG_PATH) };
+  }
+  return _systemConfigCache.data;
+}
+var SETTINGS_PATH = path11.join(HALO_SECRETS_DIR, "settings.yaml");
+var _settingsCache = null;
+function getSettings() {
+  let mtimeMs = 0;
+  try {
+    mtimeMs = fs8.statSync(SETTINGS_PATH).mtimeMs;
+  } catch {
+  }
+  if (!_settingsCache || _settingsCache.mtimeMs !== mtimeMs) {
+    _settingsCache = { mtimeMs, data: loadYamlFile(SETTINGS_PATH) };
+  }
+  return _settingsCache.data;
+}
+function readYamlValue(tree, dotPath) {
+  const parts = dotPath.split(".");
+  let cur = tree;
+  for (const p of parts) {
+    if (cur == null || typeof cur !== "object")
+      return void 0;
+    cur = cur[p];
+  }
+  if (cur != null && typeof cur === "object" && !Array.isArray(cur) && "value" in cur) {
+    const obj = cur;
+    const v = obj.value;
+    const isUnset = (x) => x == null || typeof x === "string" && x === "";
+    if (!isUnset(v))
+      return v;
+    const d = obj.default;
+    return isUnset(d) ? void 0 : d;
+  }
+  return cur;
+}
+function settingsValue(dotPath) {
+  const v = readYamlValue(getSettings(), dotPath);
+  return v == null ? void 0 : typeof v === "string" ? v : String(v);
+}
+function explicitCompressAt() {
+  const raw = settingsValue("general.compact.compress_at");
+  if (raw === void 0)
+    return void 0;
+  const n = parseFloat(raw);
+  return Number.isFinite(n) && n > 0 && n <= 1 ? n : void 0;
+}
+function configValue(dotPath) {
+  return readYamlValue(getSystemConfig(), dotPath);
+}
+function envInt(key, fallback) {
+  const v = process.env[key];
+  if (v === void 0)
+    return fallback;
+  const n = parseInt(v, 10);
+  return isNaN(n) ? fallback : n;
+}
+var _schemaDefaultsCache = null;
+function loadSchemaDefaults() {
+  if (_schemaDefaultsCache)
+    return _schemaDefaultsCache;
+  const map = /* @__PURE__ */ new Map();
+  for (const section of loadSettingsSchema()) {
+    if (section.namespaceId !== "general")
+      continue;
+    for (const f of section.fields) {
+      if (f.default !== void 0)
+        map.set(`general.${f.key}`, f.default);
+    }
+  }
+  _schemaDefaultsCache = map;
+  return map;
+}
+function schemaDefault(settingsPath, callsiteFallback) {
+  const fromSchema = loadSchemaDefaults().get(settingsPath);
+  if (fromSchema === void 0)
+    return callsiteFallback;
+  if (fromSchema !== callsiteFallback) {
+    console.warn(`[Config] default mismatch for "${settingsPath}": schema=${JSON.stringify(fromSchema)} callsite=${JSON.stringify(callsiteFallback)}. Using schema value.`);
+  }
+  return fromSchema;
+}
+function settingsInt(settingsPath, fallback) {
+  const sv = settingsValue(settingsPath);
+  if (sv !== void 0) {
+    const n2 = parseInt(sv, 10);
+    if (!isNaN(n2))
+      return n2;
+  }
+  const schemaDef = schemaDefault(settingsPath, String(fallback));
+  const n = parseInt(schemaDef, 10);
+  return isNaN(n) ? fallback : n;
+}
+function settingsStr(settingsPath, fallback) {
+  const sv = settingsValue(settingsPath);
+  if (sv !== void 0)
+    return String(sv);
+  return schemaDefault(settingsPath, fallback);
+}
+function settingsBool(settingsPath, fallback) {
+  const raw = settingsStr(settingsPath, fallback ? "true" : "false").trim().toLowerCase();
+  return raw === "true" || raw === "1";
+}
+function envBool(envKey) {
+  const raw = process.env[envKey]?.trim().toLowerCase();
+  return raw === "true" || raw === "1" ? true : raw === "false" || raw === "0" ? false : void 0;
+}
+function systemInt(envKey, configPath, fallback) {
+  const envVal = process.env[envKey];
+  if (envVal !== void 0) {
+    const n = parseInt(envVal, 10);
+    if (!isNaN(n))
+      return n;
+  }
+  const cv = configValue(configPath);
+  if (typeof cv === "number")
+    return cv;
+  if (typeof cv === "string") {
+    const n = parseInt(cv, 10);
+    if (!isNaN(n))
+      return n;
+  }
+  return fallback;
+}
+function systemStringArray(envKey, configPath, fallback) {
+  const envVal = process.env[envKey];
+  if (envVal !== void 0 && envVal.trim()) {
+    return envVal.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  const cv = configValue(configPath);
+  if (Array.isArray(cv))
+    return cv.map(String);
+  return fallback;
+}
+function systemString(envKey, configPath, fallback) {
+  const envVal = process.env[envKey];
+  if (envVal !== void 0)
+    return envVal;
+  const cv = configValue(configPath);
+  if (typeof cv === "string")
+    return cv;
+  return fallback;
+}
+var config = {
+  // Goal entry points are retired, not the runtime. Internal/global-only, no UI:
+  // set general.goal_mode_enabled in ~/.halo/secrets/settings.yaml, then restart.
+  goalModeEnabled: settingsBool("general.goal_mode_enabled", false),
+  server: {
+    port: systemInt("HALO_PORT", "server.port", 9527),
+    /** scrypt hash stored in `secrets/config.yaml`, set by `halo setup`.
+     *  `null` = not configured. `HALO_PASSWORD` env is *not* a hash —
+     *  it's a plaintext bypass; see `passwordEnvPlaintext` below and the
+     *  branch in `middleware/auth.ts`. */
+    get password() {
+      const cv = configValue("server.password");
+      return typeof cv === "string" ? cv : null;
+    },
+    /** Plaintext password supplied via `HALO_PASSWORD` env. The auth
+     *  middleware compares this directly (no scrypt) since the env's
+     *  whatever-secret-store already protects the value. Lets ops scripts
+     *  set a password without round-tripping through scrypt hashing. */
+    get passwordEnvPlaintext() {
+      const v = process.env.HALO_PASSWORD;
+      return v && v.length > 0 ? v : null;
+    },
+    // Random base64 JWT signing key, set by `halo setup`. Empty = not set up.
+    jwtSecret: systemString("HALO_JWT_SECRET", "server.jwt_secret", null),
+    // Empty allowlist means "reflect any origin" (see CORS setup in index.ts).
+    corsOrigins: systemStringArray("HALO_CORS_ORIGINS", "server.cors_origins", []),
+    /** Trust `x-forwarded-for` for client-IP resolution (brute-force
+     *  buckets). Off by default — the header is client-forgeable unless a
+     *  reverse proxy the operator controls rewrites it. */
+    get trustProxy() {
+      return settingsBool("general.server.trust_proxy", false);
+    },
+    /** Environment badge (`HALO_BADGE=DEV`) surfaced to the admin via
+     *  `GET /auth/check` so parallel dev/prod tabs are tellable apart — the
+     *  admin repaints the favicon with a badge band and prefixes the tab
+     *  title. dev/prod serve the same static build, so this must be a
+     *  runtime signal. Unset/empty → null → admin keeps stock branding. */
+    get badge() {
+      const v = process.env.HALO_BADGE?.trim();
+      return v ? v : null;
+    },
+    /** false on a `HALO_BADGE=DEV` instance: dev and prod serve the same
+     *  workspaces, so prod alone claims `.halo/runtime.lock` and runs the
+     *  boot cleanup (orphan reconcile, goal / run-ledger sweeps). */
+    get ownsWorkspaceRuntimes() {
+      return process.env.HALO_BADGE?.trim().toUpperCase() !== "DEV";
+    },
+    /** `HALO_RUNTIME_MODE=agentcore-a2a` (`halo agentcore`) runs the server
+     *  as an Amazon Bedrock AgentCore Runtime container with the A2A
+     *  protocol: AgentCore verifies the caller's signed request upstream, so
+     *  password/JWT checks, channels, cron/evolution and the instance lock are
+     *  skipped, and /ping + A2A JSON-RPC are mounted at `/` on one fixed
+     *  workspace (see a2a/agentcore.ts). Unset / any other value → normal server. */
+    runtimeMode: process.env.HALO_RUNTIME_MODE ?? null,
+    /** Workspace for agentcore mode. Env `HALO_WORKSPACE`, fallback cwd. */
+    agentcoreWorkspace: process.env.HALO_WORKSPACE ?? process.cwd()
+  },
+  // `model.compressAt` is intentionally a getter — it reads from
+  // settings.yaml (`general.compact.compress_at`) on every access so a
+  // user edit takes effect on the next session without a restart. The
+  // value is a fraction of `maxContextTokens`; auto-compact triggers when
+  // the running context exceeds `maxContextTokens * compressAt`.
+  model: {
+    maxContextTokens: envInt("HALO_MAX_CONTEXT_TOKENS", 272e3),
+    get compressAt() {
+      return explicitCompressAt() ?? 0.9;
+    }
+  },
+  /** System language preference. `general.language` in settings.yaml stores
+   *  a BCP-47 region tag (`en-US` / `zh-CN`). The rest of the codebase still
+   *  uses the simple `'en' | 'zh'` shape — we collapse the region here so
+   *  callers don't have to think about it. Anything starting with `zh-` →
+   *  `'zh'`; everything else → `'en'`. */
+  get language() {
+    const raw = settingsStr("general.language", "en-US").toLowerCase();
+    return raw.startsWith("zh") ? "zh" : "en";
+  },
+  agent: {
+    defaultTools: [
+      "file_read",
+      "file_write",
+      "file_edit",
+      "file_list",
+      "shell_exec",
+      "grep",
+      "glob",
+      "web_fetch"
+    ],
+    maxRetries: settingsInt("general.agent.max_retries", 5)
+  },
+  timeout: {
+    shellExec: systemInt("HALO_SHELL_TIMEOUT", "timeout.shell_exec", 12e4),
+    webFetch: systemInt("HALO_WEB_FETCH_TIMEOUT", "timeout.web_fetch", 1e4),
+    // Per model-call cap. A bare fetch has no default timeout, so a half-open
+    // connection (server accepted but never sends bytes / sends no RST) hangs
+    // the await indefinitely. Bounds each callModel; on expiry the request
+    // aborts and the agent loop's retry takes over. Streaming providers reset
+    // the timer on any data the stream delivers (pings, tool-argument
+    // fragments, SSE comments included), so for them it is an idle timeout — a
+    // long but live stream is never cut off.
+    modelRequest: systemInt("HALO_MODEL_TIMEOUT", "timeout.model_request", 10 * 6e4),
+    sessionGrace: systemInt("HALO_SESSION_GRACE", "timeout.session_grace", 5 * 6e4),
+    terminalGrace: systemInt("HALO_TERMINAL_GRACE", "timeout.terminal_grace", 5 * 6e4)
+  },
+  // Runtime caps — read live from settings.yaml on every access. Getters
+  // (not literals) so a settings reload takes effect on the next tool
+  // call without restarting the server. Schema lives in settings-schema
+  // under the `limits.*` namespace.
+  limits: {
+    get shellOutputBuffer() {
+      return settingsInt("general.limits.shell_output_bytes", 5 * 1024 * 1024);
+    },
+    get webFetchMaxBody() {
+      return settingsInt("general.limits.web_fetch_bytes", 50 * 1024);
+    },
+    get grepDefaultMax() {
+      return settingsInt("general.limits.grep_default_matches", 50);
+    },
+    get toolResultMax() {
+      return settingsInt("general.limits.tool_result_render_chars", 8e3);
+    },
+    get toolResultUiMax() {
+      return settingsInt("general.limits.tool_result_ui_chars", 64 * 1024);
+    },
+    get autoReportMax() {
+      return settingsInt("general.limits.auto_report_chars", 8192);
+    },
+    get terminalOutputBuffer() {
+      return settingsInt("general.limits.terminal_scrollback_bytes", 5e4);
+    }
+  },
+  compact: {
+    keep_messages: settingsInt("general.compact.keep_messages", 5),
+    max_summary_input: settingsInt("general.compact.max_summary_input", 15e3),
+    max_message_slice: settingsInt("general.compact.max_message_slice", 800)
+  },
+  auth: {
+    tokenMaxAge: 14 * 24 * 60 * 60,
+    refreshAfter: 24 * 60 * 60
+  },
+  session: {
+    maxCachedSessions: envInt("HALO_MAX_CACHED_SESSIONS", 50),
+    maxQueueSize: settingsInt("general.session.max_queue_size", 256),
+    maxNestingDepth: settingsInt("general.session.max_nesting_depth", 16)
+  },
+  logging: {
+    // `logging.level` lives under `general.logging.level` in settings.yaml so
+    // it shows up alongside the other general knobs in the settings UI.
+    // `max_file_size` / `max_files` stay in config.yaml — they're operator
+    // dials, not user-tunable preferences.
+    level: process.env.HALO_LOG_LEVEL ?? settingsStr("general.logging.level", "warn"),
+    maxFileSize: systemInt("HALO_LOG_MAX_SIZE", "logging.max_file_size", 10 * 1024 * 1024),
+    // 10MB
+    maxFiles: systemInt("HALO_LOG_MAX_FILES", "logging.max_files", 5)
+  },
+  // OpenTelemetry export. Read once at boot (observability/otel.ts maps these
+  // onto OTEL_* env vars) — changes take effect on restart.
+  observability: {
+    endpoint: settingsStr("general.observability.endpoint", ""),
+    serviceName: settingsStr("general.observability.service_name", "halo"),
+    headers: settingsStr("general.observability.headers", ""),
+    // The OTel GenAI instrumentation's own switch, when exported, beats settings
+    // (endpoint / headers / service_name get the same from otel.ts `??=`).
+    captureContent: envBool("OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT") ?? settingsBool("general.observability.capture_content", false)
+  },
+  // Notebook kernels (jupyter/manager.ts). Getters: read at each spawn.
+  jupyter: {
+    get enabled() {
+      return settingsBool("general.jupyter.enabled", true);
+    },
+    get path() {
+      return settingsStr("general.jupyter.path", "").trim();
+    }
+  },
+  // A2A (see plans/a2a.md). Getters: read live from settings.yaml.
+  a2a: {
+    /** Base dir workspaces are exposed relative to: env HALO_A2A_ROOT, else the user's home. */
+    get root() {
+      return process.env.HALO_A2A_ROOT?.trim() || homedir5();
+    },
+    /** Server origin as peers see it (no trailing slash); '' = derive from the request. */
+    get publicUrl() {
+      return (process.env.HALO_A2A_PUBLIC_URL?.trim() || settingsStr("general.a2a.public_url", "")).replace(/\/+$/, "");
+    },
+    get urlAllowlist() {
+      return settingsStr("general.a2a.url_allowlist", DEFAULT_A2A_URL_ALLOWLIST);
+    }
+  },
+  // Self-evolution (see plans/self-evolution.md). Getter-based so user edits
+  // in settings.yaml take effect on the next ticker run without restart.
+  evolution: {
+    get level() {
+      const raw = settingsStr("general.evolution.level", "L0");
+      return raw === "L1" ? "L1" : "L0";
+    },
+    get maxConcurrentRun() {
+      return settingsInt("general.evolution.max_concurrent_run", 1);
+    },
+    get maxConcurrentApply() {
+      return settingsInt("general.evolution.max_concurrent_apply", 1);
+    },
+    // Heartbeat-loss threshold the ticker uses to decide a wrapper died and
+    // requeue its run. It is not a phase limit: a healthy wrapper heart-beats
+    // every 60s for its whole run, including a phase that burns its full cap
+    // (DRAFT_TIMEOUT_SEC 3600s / PHASE_TIMEOUT_SEC 2700s in evo-wrapper.ts).
+    // 12min tolerates many missed beats before a second wrapper could be
+    // spawned for the same run.
+    get runTimeoutMinutes() {
+      return settingsInt("general.evolution.run_timeout_minutes", 12);
+    },
+    get applyTimeoutMinutes() {
+      return settingsInt("general.evolution.apply_timeout_minutes", 5);
+    },
+    get maxAttempts() {
+      return settingsInt("general.evolution.max_attempts", 3);
+    },
+    triggers: {
+      get preCompact() {
+        return settingsBool("general.evolution.triggers.pre_compact", true);
+      }
+    }
+  }
+};
+
+// ../server/dist/evolution/evo-wrapper.js
+var FIX_BUDGET = 1;
+var DRY_RUN_TIMEOUT_SEC = 2700;
+var PHASE_TIMEOUT_SEC = 2700;
+var DRAFT_TIMEOUT_SEC = 3600;
+var SANDBOX_WHITELIST = ["INSTRUCTIONS.md", "INDEX.md", "USER.md", "agents", "prompts", "skills", "docs"];
+var PUBLISH_WHITELIST = SANDBOX_WHITELIST.filter((e) => e !== "docs");
+function parseCli(argv) {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      mode: { type: "string" },
+      id: { type: "string" }
+    }
+  });
+  if (values.mode !== "run" && values.mode !== "apply") {
+    throw new Error(`--mode must be 'run' or 'apply', got ${JSON.stringify(values.mode)}`);
+  }
+  if (typeof values.id !== "string" || values.id.length === 0) {
+    throw new Error("--id is required");
+  }
+  return { mode: values.mode, id: values.id };
+}
+function loadRunRow(id) {
+  const db = getEvoDb();
+  const row = db.select({
+    id: evolutionRuns.id,
+    workspacePath: evolutionRuns.workspacePath,
+    triggerKind: evolutionRuns.triggerKind,
+    sourceSession: evolutionRuns.sourceSession,
+    userHint: evolutionRuns.userHint
+  }).from(evolutionRuns).where(eq(evolutionRuns.id, id)).get();
+  if (!row)
+    throw new Error(`evolution_runs row not found: ${id}`);
+  return row;
+}
+function resolveHaloCli() {
+  if (process.env.HALO_CLI)
+    return process.env.HALO_CLI;
+  return process.platform === "win32" ? "halo.cmd" : "halo";
+}
+function spawnProc(bin, args, logFd, teePath, stdinInput, timeoutSec) {
+  const loggedArgs = stdinInput === void 0 ? args.slice(0, -1) : args;
+  writeLog(logFd, `[wrapper] $ ${bin} ${loggedArgs.join(" ")}${stdinInput === void 0 ? " <last-arg-omitted>" : " <prompt-on-stdin>"}${timeoutSec ? ` (timeout ${timeoutSec}s)` : ""}
+`);
+  const tee = teePath ? fs9.createWriteStream(teePath, { flags: "a" }) : null;
+  const [spawnBin, spawnArgs] = process.platform === "win32" && bin.endsWith(".cmd") ? ["cmd.exe", ["/c", bin, ...args]] : [bin, args];
+  return new Promise((resolve) => {
+    const child = spawn2(spawnBin, spawnArgs, {
+      // Pipe stdin only when we have input to write — the cli reads a prompt
+      // from stdin when it's not a TTY, which is how long briefs are delivered
+      // (Windows CreateProcess caps the command line at ~32KB → ENAMETOOLONG
+      // if a multi-KB brief rides as an argv element).
+      stdio: [stdinInput === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
+      env: cleanChildEnv(),
+      // Own process group (POSIX) so the timeout can signal the whole tree —
+      // the cli plus every shell_exec grandchild — not just the direct PID.
+      // No-op contract on Windows, where we kill by PID via taskkill /T below.
+      detached: process.platform !== "win32",
+      // Suppress the console window the `cmd.exe /c` wrapper would otherwise
+      // pop up on Windows (CREATE_NO_WINDOW). No-op on macOS/Linux.
+      windowsHide: true
+    });
+    if (stdinInput !== void 0 && child.stdin) {
+      child.stdin.on("error", () => {
+      });
+      child.stdin.write(stdinInput);
+      child.stdin.end();
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let sigkillTimer = null;
+    const killTree = (signal) => {
+      if (!child.pid)
+        return;
+      try {
+        if (process.platform === "win32") {
+          const args2 = signal === "SIGKILL" ? ["/PID", String(child.pid), "/T", "/F"] : ["/PID", String(child.pid), "/T"];
+          spawn2("taskkill", args2);
+        } else {
+          process.kill(-child.pid, signal);
+        }
+      } catch {
+      }
+    };
+    const killTimer = timeoutSec ? setTimeout(() => {
+      timedOut = true;
+      writeLog(logFd, `[wrapper] timeout ${timeoutSec}s \u2014 killing process group (SIGTERM)
+`);
+      killTree("SIGTERM");
+      sigkillTimer = setTimeout(() => {
+        writeLog(logFd, `[wrapper] still alive 10s after SIGTERM \u2014 SIGKILL
+`);
+        killTree("SIGKILL");
+      }, 1e4);
+      sigkillTimer.unref?.();
+    }, timeoutSec * 1e3) : null;
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+      tee?.write(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+      tee?.write(chunk);
+    });
+    child.on("exit", (code, signal) => {
+      if (killTimer)
+        clearTimeout(killTimer);
+      if (sigkillTimer)
+        clearTimeout(sigkillTimer);
+      const exitCode = timedOut ? 124 : code ?? 1;
+      writeLog(logFd, `[wrapper] proc exit code=${code} signal=${signal}${timedOut ? " (timed out \u2192 124)" : ""} stdout=${stdout.length}B stderr=${stderr.length}B
+`);
+      tee?.end();
+      resolve({ exitCode, stdout, stderr });
+    });
+    child.on("error", (err) => {
+      if (killTimer)
+        clearTimeout(killTimer);
+      if (sigkillTimer)
+        clearTimeout(sigkillTimer);
+      writeLog(logFd, `[wrapper] spawn error: ${err.message}
+`);
+      tee?.write(`
+[spawn error] ${err.message}
+`);
+      tee?.end();
+      resolve({ exitCode: 1, stdout, stderr: stderr + `
+[spawn error] ${err.message}` });
+    });
+  });
+}
+function subCliLogPath(runDir) {
+  return path12.join(runDir, "sub-cli.log");
+}
+function appendSubCliHeader(runDir, header) {
+  try {
+    fs9.appendFileSync(subCliLogPath(runDir), `
+=== ${(/* @__PURE__ */ new Date()).toISOString()} ${header} ===
+`);
+  } catch {
+  }
+}
+function resolveLangHint() {
+  return config.language === "zh" ? "\u7B80\u4F53\u4E2D\u6587" : "English";
+}
+function buildLanguageClause(langHint, scope) {
+  return [
+    "",
+    `Output language: write ${scope} in ${langHint}. Do NOT code-switch \u2014`,
+    `don't sprinkle English phrases like "blast radius" or "scope" into`,
+    `otherwise-${langHint} prose, and don't mix ${langHint} tokens into`,
+    `otherwise-English prose. Pick the language and stay in it.`,
+    "",
+    `**This rule also applies to prose you draft INTO the patched prompt`,
+    `files**, not just to your own commentary. If you copy a global file`,
+    `(e.g. global INSTRUCTIONS.md, AGENT.md) into a workspace override`,
+    `and the source is in a different language, translate the prose into`,
+    `${langHint} as you go. Don't leave a half-English half-${langHint}`,
+    `Frankenstein file in the sandbox.`,
+    "",
+    `Things that stay in their source form regardless of language:`,
+    `frontmatter / JSON keys, identifier-like values (file paths, agent`,
+    `ids, command names, enum values like 'high'/'medium'/'low',`,
+    `encoding names like 'utf-8-sig', shell binaries like \`printf\`),`,
+    `literal code or CLI snippets you're quoting, and section headings`,
+    `that other tooling might grep for by exact string (when in doubt,`,
+    `keep the heading and translate the body).`
+  ];
+}
+function readPatchFrontmatter(runDir) {
+  const patchPath = path12.join(runDir, "patch.md");
+  let raw;
+  try {
+    raw = fs9.readFileSync(patchPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const m = raw.match(/^---\s*\n([\s\S]*?)\n---/);
+  if (!m)
+    return null;
+  try {
+    const parsed = YAML6.parse(m[1]);
+    return parsed ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractTestScenario(fm) {
+  if (!fm)
+    return null;
+  const ts = fm.testScenario;
+  if (!ts || typeof ts !== "object")
+    return null;
+  const o = ts;
+  if (typeof o.agentId !== "string" || o.agentId.length === 0)
+    return null;
+  const testMessage = typeof o.testMessage === "string" && o.testMessage.length > 0 ? o.testMessage : typeof o.message === "string" && o.message.length > 0 ? o.message : null;
+  if (!testMessage)
+    return null;
+  const originalMessage = typeof o.originalMessage === "string" && o.originalMessage.length > 0 ? o.originalMessage : testMessage;
+  return { agentId: o.agentId, testMessage, originalMessage };
+}
+function readEvoContext(runDir, logFd) {
+  const p = path12.join(runDir, "evo-context.json");
+  if (!fs9.existsSync(p)) {
+    writeLog(logFd, `[brief] evo-context.json missing at ${p}
+`);
+    return null;
+  }
+  try {
+    return JSON.parse(fs9.readFileSync(p, "utf-8"));
+  } catch (err) {
+    writeLog(logFd, `[brief] evo-context.json parse failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    return null;
+  }
+}
+function dumpSnapshotImages(runDir, logFd) {
+  const snapshotPath = path12.join(runDir, "source-snapshot.json");
+  if (!fs9.existsSync(snapshotPath))
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(fs9.readFileSync(snapshotPath, "utf-8"));
+  } catch {
+    writeLog(logFd, `[dumpSnapshotImages] snapshot parse failed
+`);
+    return [];
+  }
+  const messages = Array.isArray(parsed.rawMessages) ? parsed.rawMessages : [];
+  if (messages.length === 0)
+    return [];
+  const imagesDir = path12.join(runDir, "images");
+  fs9.mkdirSync(imagesDir, { recursive: true });
+  const out = [];
+  const extByMime = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/gif": "gif",
+    "image/webp": "webp"
+  };
+  for (let m = 0; m < messages.length; m++) {
+    const msg = messages[m];
+    if (!msg || !Array.isArray(msg.content))
+      continue;
+    const adjacentText = msg.content.filter((b) => b && b.type === "text" && typeof b.text === "string").map((b) => String(b.text)).join(" ").trim().slice(0, 200);
+    for (let b = 0; b < msg.content.length; b++) {
+      const block = msg.content[b];
+      if (!block || typeof block !== "object")
+        continue;
+      const candidates = [];
+      if (block.type === "image") {
+        candidates.push({ block, subBlockIdx: null });
+      } else if (block.type === "tool_result" && Array.isArray(block.content)) {
+        const inner = block.content;
+        for (let i = 0; i < inner.length; i++) {
+          const sub = inner[i];
+          if (sub && sub.type === "image") {
+            candidates.push({ block: sub, subBlockIdx: i });
+          }
+        }
+      }
+      for (const c of candidates) {
+        const source = c.block.source;
+        if (!source || source.type !== "base64")
+          continue;
+        const data = source.data;
+        const mediaType = source.media_type;
+        if (typeof data !== "string" || typeof mediaType !== "string")
+          continue;
+        const ext = extByMime[mediaType] ?? "bin";
+        const fileName = c.subBlockIdx == null ? `${m}-${b}.${ext}` : `${m}-${b}-${c.subBlockIdx}.${ext}`;
+        const fullPath = path12.join(imagesDir, fileName);
+        try {
+          const buf = Buffer.from(data, "base64");
+          fs9.writeFileSync(fullPath, buf);
+          out.push({
+            relPath: `images/${fileName}`,
+            msgIdx: m,
+            blockIdx: b,
+            role: typeof msg.role === "string" ? msg.role : "?",
+            mediaType,
+            sizeBytes: buf.length,
+            contextText: adjacentText
+          });
+        } catch (err) {
+          writeLog(logFd, `[dumpSnapshotImages] decode failed at msg=${m} block=${b}: ${err instanceof Error ? err.message : String(err)}
+`);
+        }
+      }
+    }
+  }
+  if (out.length > 0) {
+    writeLog(logFd, `[dumpSnapshotImages] decoded ${out.length} image(s) to ${imagesDir}
+`);
+  }
+  return out;
+}
+function renderImageManifest(images) {
+  if (images.length === 0)
+    return [];
+  const lines = [];
+  lines.push("=== Images extracted from the source conversation ===");
+  lines.push("");
+  lines.push("(decoded from the snapshot's inline base64 image blocks \u2014 the");
+  lines.push("source conversation is NOT in your message history, so these");
+  lines.push("files are the only way to see the images. `view_image` one when");
+  lines.push("its content is load-bearing for your patch; the per-image context");
+  lines.push("text below is usually enough. The paths also let a patch keep an");
+  lines.push("image as a prompt resource \u2014 e.g. a screenshot inside a skill's");
+  lines.push("reference doc.)");
+  lines.push("");
+  for (const img of images) {
+    const sizeKb = (img.sizeBytes / 1024).toFixed(0);
+    lines.push(`- ${img.relPath}`);
+    lines.push(`  msg ${img.msgIdx} / block ${img.blockIdx}, role=${img.role}, ${img.mediaType}, ${sizeKb} KB`);
+    if (img.contextText)
+      lines.push(`  context: ${img.contextText.replace(/\n/g, " ")}`);
+  }
+  lines.push("");
+  return lines;
+}
+function renderEvoContextSections(ctx) {
+  if (!ctx)
+    return ["(prompt surface unavailable \u2014 evo-context.json missing or invalid)"];
+  const lines = [];
+  lines.push(`Triggering agent id: ${ctx.agentId}`);
+  lines.push("");
+  if (ctx.assembledSystemPrompt) {
+    lines.push("=== Assembled system prompt at trigger time ===");
+    lines.push("(this is what the source agent saw as its `system` field on the");
+    lines.push("Bedrock call \u2014 built from AGENT.md + INSTRUCTIONS.md + USER.md +");
+    lines.push("prompts/all + prompts/root + workspace info, in runtime order)");
+    lines.push("```");
+    lines.push(ctx.assembledSystemPrompt);
+    lines.push("```");
+    lines.push("");
+  }
+  if (ctx.promptFiles.length > 0) {
+    lines.push("=== Source prompt files ===");
+    lines.push("(each entry is a file behind the assembled prompt. Workspace files take");
+    lines.push("precedence over global ones at runtime. The triggering agent's");
+    lines.push("agent.yaml is included here too \u2014 its model / tools / context config is");
+    lines.push("a patch target, not just markdown. SKILL.md bodies are NOT inlined (see");
+    lines.push("the skills listing below; file_read the one you need) \u2014 but a SKILL.md");
+    lines.push("is just as patchable. Only template-version metadata is left out.)");
+    lines.push("");
+    for (const f of ctx.promptFiles) {
+      lines.push(`--- ${f.scope}/${f.path} ---`);
+      lines.push("```");
+      lines.push(f.content);
+      lines.push("```");
+      lines.push("");
+    }
+  }
+  if (ctx.agents.length > 0) {
+    lines.push("=== Agents in this workspace ===");
+    for (const a of ctx.agents)
+      lines.push(`  ${a.id} [${a.scope}]`);
+    lines.push("");
+  }
+  if (ctx.skills.length > 0) {
+    const globalSkillsDir = path12.join(homedir6(), ".halo", "global", "skills");
+    lines.push("=== Skills in this workspace ===");
+    for (const s of ctx.skills)
+      lines.push(`  ${s.id} [${s.scope}]`);
+    lines.push("");
+    lines.push("To read a skill's content, file_read its SKILL.md (you have full");
+    lines.push("file access \u2014 absolute paths resolve):");
+    lines.push(`  [workspace] \u2192 ${path12.join("<workspace>", ".halo", "skills", "<id>", "SKILL.md")}`);
+    lines.push(`  [global] / [builtin] \u2192 ${path12.join(globalSkillsDir, "<id>", "SKILL.md")}`);
+    lines.push("A [global]/[builtin] skill is NOT inside your sandbox \u2014 read it");
+    lines.push(`from ${globalSkillsDir} directly; don't glob the sandbox for it.`);
+    lines.push("Sibling resource files live next to SKILL.md in that same dir.");
+    lines.push("Skills shipped by canvas extensions (~/.halo/global/extensions/*/skills/)");
+    lines.push("are read-only and never a patch target \u2014 they are left out of this list.");
+    lines.push("");
+  }
+  return lines;
+}
+function buildDraftBrief(args) {
+  const lines = [
+    "You are running as the Evolution drafter (mode: DRAFT).",
+    "",
+    `Run id: ${args.runId}`,
+    `Workspace: ${args.workspacePath}`,
+    `Run dir: ${args.runDir}`,
+    "(relative tool paths resolve against the sandbox, not the run dir \u2014",
+    "write run-dir artifacts like patch.md / .skip.md with absolute paths)",
+    `Trigger: ${args.triggerKind}`
+  ];
+  if (args.userHint)
+    lines.push(`Reviewer hint: ${args.userHint}`);
+  lines.push("", "The triggering agent's full message log lives on disk:", `  ${path12.join(args.runDir, "tool-flow.md")}        \u2014 clipped, fast skim`, `  ${path12.join(args.runDir, "source-snapshot.json")}    \u2014 full rawMessages`, "", "Read tool-flow.md first to understand what the user wanted, what the", "agent did, and where it diverged. Each tool_result is clipped to a", "~200-char peek (with the `is_error` flag when the tool failed) \u2014", "enough to see the *shape* of the flow without re-tokenizing large", "grep / shell outputs. Fall back to source-snapshot.json only for", "messages whose full tool result actually matters to your patch.", "", ...renderEvoContextSections(args.evoContext), ...renderImageManifest(args.images), "=== Non-text media note ===", "", "Inline images in source-snapshot.json are base64 \u2014 you can't read them", "directly. The `images/` dump", "(see manifest above) decodes them to disk so you can `view_image` if", "a specific image is load-bearing. Video, audio, and binary documents", "(PDF, etc.) are even more limited: at trigger time the source agent", "worked with them via shell tooling (ffmpeg, pdftotext, etc.), and your", "view is limited to the textual results those tools produced (visible", "inside source-snapshot.json as tool_result text).", "", "When the patch you have in mind requires understanding what's INSIDE", "the media file (a video's visual content, an audio's acoustic", "content, a PDF's layout), the dry-run test scenario can't reliably", "verify it \u2014 skipping the run is the right call. When the patch is", "about the shell-tooling pattern itself (how to call ffmpeg, how to", "grep its output, how to handle credential errors), it can be", "verified at the textual level and the run proceeds normally.", "", "=== Task ===", "", "Decide what change in the prompt surface above would help the next time", "a similar conversation comes up. Three shapes, in order of preference:", "rewrite an existing rule; tighten / reorganize what's there; or, only", "when neither applies, add a new rule.", "", `Sandbox path: ${evoSandboxDir(args.runDir)}`, "", `When you have a change worth making, write ${path12.join(args.runDir, "patch.md")}`, "(frontmatter + body) and one new file at", `${evoSandboxHaloDir(args.runDir)}/<target> with the`, "full new contents. AGENT.md describes the patch.md schema.", "", "When the conversation has no signal worth a patch (rule already covers,", "too short to learn from, agent did fine, depends on media content", `you can't see), write ${path12.join(args.runDir, ".skip.md")} with a`, "one or two sentence reason instead, and skip the rest.", "", ...buildLanguageClause(args.langHint, "all natural-language content (patch.md body, prose drafted into sandbox files, .skip.md body)"));
+  return lines.join("\n");
+}
+function buildFixBrief(args) {
+  let failLogText = "";
+  try {
+    failLogText = fs9.readFileSync(args.failLogPath, "utf-8");
+  } catch {
+    failLogText = `(failed to read ${args.failLogPath})`;
+  }
+  return [
+    "You are running as the Evolution drafter (mode: FIX).",
+    "",
+    `Run id: ${args.runId}`,
+    `Workspace: ${args.workspacePath}`,
+    `Run dir: ${args.runDir}`,
+    "(relative tool paths resolve against the sandbox, not the run dir \u2014",
+    "write run-dir artifacts like patch.md with absolute paths)",
+    `Fix attempt: ${args.attempt}/${args.maxAttempts}`,
+    "",
+    `An earlier draft pass produced patch.md + a sandbox at`,
+    `${path12.join(args.runDir, "patch.md")} and`,
+    `${evoSandboxHaloDir(args.runDir)} respectively.`,
+    "The dry-run failed; the wrapper's failure log:",
+    "",
+    "```",
+    failLogText,
+    "```",
+    "",
+    "Read patch.md (and the affected sandbox file) to see what was tried.",
+    `Read tool-flow.md / source-snapshot.json for the original conversation`,
+    "context if you need to reconsider the patch direction. Then write the",
+    `corrected sandbox target file (<runDir>/sandbox/.halo/<target>) and`,
+    "update patch.md if the fix changes the test scenario. Wrapper reruns",
+    "the dry-run after you exit.",
+    "",
+    ...buildLanguageClause(args.langHint, "all natural-language content (patch.md body, prose drafted into sandbox files)")
+  ].join("\n");
+}
+function buildScoreBrief(args) {
+  function readOrEmpty(p, label) {
+    try {
+      return fs9.readFileSync(p, "utf-8");
+    } catch (err) {
+      writeLog(args.logFd, `[buildScoreBrief] ${label} read failed: ${err instanceof Error ? err.message : String(err)}
+`);
+      return `(${label} unavailable)`;
+    }
+  }
+  const patchMd = readOrEmpty(path12.join(args.runDir, "patch.md"), "patch.md");
+  const dryRun = readOrEmpty(path12.join(args.runDir, "dry-run-output.txt"), "dry-run-output.txt");
+  const meta = readOrEmpty(path12.join(args.runDir, "meta.json"), "meta.json");
+  return [
+    "You are running as the Evolution scorer.",
+    "",
+    `Run id: ${args.runId}`,
+    `Workspace: ${args.workspacePath}`,
+    `Run dir: ${args.runDir}`,
+    "(relative tool paths resolve against the sandbox, not the run dir \u2014",
+    "write score.json with the absolute path given below)",
+    "",
+    `The original conversation lives on disk:`,
+    `  ${path12.join(args.runDir, "tool-flow.md")}    \u2014 clipped, fast skim`,
+    `  ${path12.join(args.runDir, "source-snapshot.json")}  \u2014 full rawMessages, when needed`,
+    "Read tool-flow.md first to find the user turn matching",
+    "`testScenario.originalMessage` and the assistant reply that followed",
+    "it. Fall back to source-snapshot.json only when the full tool result",
+    "matters. The current prompt surface and patch context follow.",
+    "",
+    ...renderEvoContextSections(args.evoContext),
+    "=== patch.md ===",
+    "```",
+    patchMd,
+    "```",
+    "",
+    "=== dry-run-output.txt ===",
+    "(stdout from the wrapper running the patched sandbox against",
+    "`testScenario.testMessage`. Two execution constraints to keep in",
+    "mind when scoring:",
+    "",
+    " 1. Sandbox runs under `--access workspace`. The agent can read/write",
+    "    inside the sandbox but `~/.aws`, `~/.ssh`, `~/.kube`, `~/.docker`,",
+    '    `~/.gnupg`, `~/.halo/secrets` are all masked. A "command not',
+    '    found" or "Unable to locate credentials" failure on cloud or',
+    '    system-credential operations is expected \u2014 interpret it as "we',
+    '    cut the wires for safety", not as the patch breaking real',
+    "    behavior. Score behavior on whether the agent gave the right",
+    "    KIND of response, not on whether external side effects fired.",
+    "",
+    " 2. Media in the source conversation is not directly visible to",
+    "    you \u2014 images live in source-snapshot.json as base64, and video /",
+    "    audio / binary documents (PDF, etc.) were only ever handled by",
+    "    the source agent via shell tooling (ffmpeg, pdftotext, etc.), so",
+    "    your view is limited to the textual results. The dry-run's",
+    "    `testMessage` is also text-only \u2014 patches whose value depends on",
+    "    understanding media internals naturally show low-signal dry-runs",
+    "    and that's correctly reflected in `confidence: low` rather than",
+    "    punished via behavior score.)",
+    "```",
+    dryRun,
+    "```",
+    "",
+    "=== meta.json ===",
+    "```",
+    meta,
+    "```",
+    "",
+    "=== Task ===",
+    "",
+    "From `patch.md` frontmatter, take `testScenario.originalMessage` and",
+    "find the assistant turn that followed it in tool-flow.md (or",
+    "source-snapshot.json) \u2014 that's your baseline. Compare baseline to",
+    "dry-run-output.txt, rate lint / behavior / scope, write",
+    `${path12.join(args.runDir, "score.json")} with the shape AGENT.md describes.`,
+    "",
+    ...buildLanguageClause(args.langHint, 'the score.json "notes" field'),
+    'The numeric fields and "confidence" enum stay in their canonical form.'
+  ].join("\n");
+}
+async function phaseDraft(args) {
+  writeLog(args.logFd, `
+=== Phase A: draft ===
+`);
+  const evoContext = readEvoContext(args.runDir, args.logFd);
+  const images = dumpSnapshotImages(args.runDir, args.logFd);
+  buildEvoSandbox(args.workspacePath, args.runDir, args.logFd);
+  const sandboxWs = evoSandboxDir(args.runDir);
+  const brief = buildDraftBrief({
+    runId: args.runId,
+    workspacePath: args.workspacePath,
+    runDir: args.runDir,
+    triggerKind: args.triggerKind,
+    userHint: args.userHint,
+    langHint: args.langHint,
+    evoContext,
+    images
+  });
+  const cliArgs = ["cli", "-a", "__evo_agent__", "-n", "-w", sandboxWs];
+  appendSubCliHeader(args.runDir, "Phase A: __evo_agent__ draft");
+  const result = await spawnProc(resolveHaloCli(), cliArgs, args.logFd, subCliLogPath(args.runDir), brief, DRAFT_TIMEOUT_SEC);
+  if (result.exitCode !== 0) {
+    writeLog(args.logFd, `[phaseDraft] evo cli exited ${result.exitCode}
+`);
+    if (result.stderr)
+      writeLog(args.logFd, `[phaseDraft] stderr: ${result.stderr.slice(-2e3)}
+`);
+    if (result.stdout)
+      writeLog(args.logFd, `[phaseDraft] stdout (last 1KB): ${result.stdout.slice(-1e3)}
+`);
+  }
+  const { outcome, why } = judgeDraft(args.runDir, args.workspacePath, result.exitCode);
+  writeLog(args.logFd, `[phaseDraft] outcome=${outcome} \u2014 ${why}
+`);
+  return outcome;
+}
+function judgeDraft(runDir, workspacePath, exitCode) {
+  if (fs9.existsSync(path12.join(runDir, ".skip.md"))) {
+    return { outcome: "skipped", why: ".skip.md present \u2014 evo declared skip" };
+  }
+  if (exitCode !== 0) {
+    const timeout = exitCode === 124 ? " (timeout)" : "";
+    return { outcome: "failed", why: `drafter exited ${exitCode}${timeout} \u2014 draft interrupted, not trusted` };
+  }
+  if (!fs9.existsSync(path12.join(runDir, "patch.md"))) {
+    return { outcome: "failed", why: "patch.md missing" };
+  }
+  const target = readPatchFrontmatter(runDir)?.target;
+  if (typeof target !== "string") {
+    return { outcome: "drafted", why: "patch.md present, no target in frontmatter \u2014 target file not checked" };
+  }
+  const sandboxDir = evoSandboxDir(runDir);
+  const rel = path12.relative(sandboxDir, path12.resolve(sandboxDir, target));
+  if (!rel.startsWith(".halo" + path12.sep)) {
+    return { outcome: "failed", why: `target ${JSON.stringify(target)} does not resolve under sandbox/.halo/` };
+  }
+  const sandboxFile = path12.join(sandboxDir, rel);
+  if (!fs9.statSync(sandboxFile, { throwIfNoEntry: false })?.isFile()) {
+    return { outcome: "failed", why: `target not written to sandbox: ${target}` };
+  }
+  const wsFile = path12.join(workspacePath, rel);
+  if (fs9.statSync(wsFile, { throwIfNoEntry: false })?.isFile() && fs9.readFileSync(wsFile).equals(fs9.readFileSync(sandboxFile))) {
+    return { outcome: "failed", why: `target unchanged from workspace: ${target}` };
+  }
+  return { outcome: "drafted", why: `patch.md + target ${target} present` };
+}
+async function phaseDryRun(args) {
+  writeLog(args.logFd, `
+=== Phase B: dry-run ===
+`);
+  const first = await tryDryRun(args, 0);
+  if (first.kind === "ok")
+    return true;
+  const fixed = await runFix(args, first.failLogPath, 1);
+  if (!fixed) {
+    writeLog(args.logFd, `[phaseDryRun] fix pass exited non-zero; aborting
+`);
+    return false;
+  }
+  const second = await tryDryRun(args, 1);
+  if (second.kind === "ok")
+    return true;
+  writeLog(args.logFd, `[phaseDryRun] dry-run still failing after fix pass; aborting
+`);
+  return false;
+}
+async function tryDryRun(args, attemptIndex) {
+  const sandboxDir = evoSandboxDir(args.runDir);
+  const outputPath = path12.join(args.runDir, "dry-run-output.txt");
+  const failLogPath = path12.join(args.runDir, `dry-run-fail-${attemptIndex}.log`);
+  const cli = resolveHaloCli();
+  const fm = readPatchFrontmatter(args.runDir);
+  const scenario = extractTestScenario(fm);
+  if (!scenario) {
+    writeLog(args.logFd, `[tryDryRun:${attemptIndex}] patch.md frontmatter missing testScenario.{agentId, testMessage}
+`);
+    fs9.writeFileSync(failLogPath, "patch.md frontmatter missing testScenario.{agentId, testMessage} \u2014 wrapper cannot run dry-run without it.\n", "utf-8");
+    return { kind: "no-scenario", failLogPath };
+  }
+  writeLog(args.logFd, `[tryDryRun:${attemptIndex}] agent=${scenario.agentId} testMessage=${JSON.stringify(scenario.testMessage).slice(0, 200)}
+`);
+  appendSubCliHeader(args.runDir, `Phase B: dry-run #${attemptIndex} (${scenario.agentId})`);
+  const result = await spawnProc(
+    cli,
+    ["cli", "-a", scenario.agentId, "-n", "-w", sandboxDir, "--access", "workspace"],
+    args.logFd,
+    subCliLogPath(args.runDir),
+    scenario.testMessage,
+    // stdin, not argv
+    DRY_RUN_TIMEOUT_SEC
+  );
+  const timedOut = result.exitCode === 124;
+  const ok = result.exitCode === 0 && result.stdout.trim().length > 0;
+  if (ok) {
+    fs9.writeFileSync(outputPath, result.stdout, "utf-8");
+    writeLog(args.logFd, `[tryDryRun:${attemptIndex}] success: wrote ${outputPath} (${result.stdout.length}B)
+`);
+    return { kind: "ok" };
+  }
+  const stdoutTail = result.stdout.length > 4e3 ? "\u2026" + result.stdout.slice(-4e3) : result.stdout;
+  const stderrTail = result.stderr.length > 4e3 ? "\u2026" + result.stderr.slice(-4e3) : result.stderr;
+  fs9.writeFileSync(failLogPath, [
+    `Wrapper command:  halo cli -a ${scenario.agentId} -n -w ${sandboxDir} <testMessage>`,
+    `Test message:     ${scenario.testMessage}`,
+    `Exit code:        ${result.exitCode}${timedOut ? " (timeout)" : ""}`,
+    `Stdout (tail):`,
+    stdoutTail || "(empty)",
+    ``,
+    `Stderr (tail):`,
+    stderrTail || "(empty)"
+  ].join("\n"), "utf-8");
+  writeLog(args.logFd, `[tryDryRun:${attemptIndex}] failed (exit=${result.exitCode}, timedOut=${timedOut}); wrote ${failLogPath}
+`);
+  return { kind: "failed", failLogPath };
+}
+async function runFix(args, failLogPath, attempt) {
+  writeLog(args.logFd, `
+--- fix attempt ${attempt}/${FIX_BUDGET} ---
+`);
+  const brief = buildFixBrief({
+    runId: args.runId,
+    workspacePath: args.workspacePath,
+    runDir: args.runDir,
+    failLogPath,
+    attempt,
+    maxAttempts: FIX_BUDGET,
+    langHint: args.langHint
+  });
+  appendSubCliHeader(args.runDir, `Phase B: __evo_agent__ fix attempt ${attempt}`);
+  const sandboxWs = evoSandboxDir(args.runDir);
+  const result = await spawnProc(
+    resolveHaloCli(),
+    ["cli", "-a", "__evo_agent__", "-n", "-w", sandboxWs],
+    args.logFd,
+    subCliLogPath(args.runDir),
+    brief,
+    // stdin, not argv — see spawnProc / draft
+    DRAFT_TIMEOUT_SEC
+  );
+  return result.exitCode === 0;
+}
+async function phaseScore(args) {
+  writeLog(args.logFd, `
+=== Phase C: score ===
+`);
+  const evoContext = readEvoContext(args.runDir, args.logFd);
+  const brief = buildScoreBrief({
+    runId: args.runId,
+    workspacePath: args.workspacePath,
+    runDir: args.runDir,
+    langHint: args.langHint,
+    evoContext,
+    logFd: args.logFd
+  });
+  const sandboxWs = evoSandboxDir(args.runDir);
+  buildEvoSandbox(args.workspacePath, args.runDir, args.logFd);
+  const cliArgs = ["cli", "-a", "__score__", "-n", "-w", sandboxWs];
+  appendSubCliHeader(args.runDir, "Phase C: __score__");
+  const result = await spawnProc(
+    resolveHaloCli(),
+    cliArgs,
+    args.logFd,
+    subCliLogPath(args.runDir),
+    brief,
+    // stdin, not argv — see spawnProc / draft
+    PHASE_TIMEOUT_SEC
+  );
+  if (result.exitCode !== 0) {
+    writeLog(args.logFd, `[phaseScore] scorer cli exited ${result.exitCode}
+`);
+    if (result.stderr)
+      writeLog(args.logFd, `[phaseScore] stderr: ${result.stderr.slice(-2e3)}
+`);
+    if (result.stdout)
+      writeLog(args.logFd, `[phaseScore] stdout (last 1KB): ${result.stdout.slice(-1e3)}
+`);
+  }
+  const hasScore = fs9.existsSync(path12.join(args.runDir, "score.json"));
+  writeLog(args.logFd, `[phaseScore] score.json=${hasScore}
+`);
+  return hasScore;
+}
+var RUN_INPUT_FILES = /* @__PURE__ */ new Set([
+  "source-snapshot.json",
+  "tool-flow.md",
+  "meta.json",
+  "evo-context.json"
+]);
+function resetRunArtifacts(runDir, logFd) {
+  let entries;
+  try {
+    entries = fs9.readdirSync(runDir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (RUN_INPUT_FILES.has(entry))
+      continue;
+    try {
+      fs9.rmSync(path12.join(runDir, entry), { recursive: true, force: true });
+    } catch (err) {
+      writeLog(logFd, `[resetRunArtifacts] failed to remove ${entry}: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }
+}
+async function runMode(id, logFd) {
+  const row = loadRunRow(id);
+  const runDir = wsEvoRunDir(row.workspacePath, id);
+  fs9.mkdirSync(runDir, { recursive: true });
+  resetRunArtifacts(runDir, logFd);
+  const hb = setInterval(() => {
+    try {
+      getEvoDb().update(evolutionRuns).set({ heartbeatAt: Date.now() }).where(eq(evolutionRuns.id, id)).run();
+    } catch (err) {
+      writeLog(logFd, `[wrapper] heartbeat failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }, 6e4);
+  const langHint = resolveLangHint();
+  writeLog(logFd, `[wrapper] resolved langHint=${langHint}
+`);
+  const ctx = {
+    runId: id,
+    workspacePath: row.workspacePath,
+    runDir,
+    triggerKind: row.triggerKind,
+    userHint: row.userHint ?? null,
+    langHint,
+    logFd
+  };
+  try {
+    const outcome = await phaseDraft(ctx);
+    if (outcome === "failed") {
+      finalize(id, "failed", "phase A: draft incomplete (drafter exited non-zero, or patch.md / target file missing or unchanged) \u2014 see run log", logFd);
+      return;
+    }
+    if (outcome === "skipped") {
+      finalize(id, "skipped", null, logFd);
+      return;
+    }
+    const dryRunOk = await phaseDryRun(ctx);
+    if (!dryRunOk) {
+      finalize(id, "failed", "phase B: dry-run failed (fix budget exhausted)", logFd);
+      return;
+    }
+    const scored = await phaseScore(ctx);
+    if (!scored) {
+      finalize(id, "failed", "phase C: scorer did not produce score.json", logFd);
+      return;
+    }
+    finalize(id, "awaiting_review", null, logFd);
+  } finally {
+    clearInterval(hb);
+  }
+}
+function finalize(id, status, failureReason, logFd) {
+  const now = Date.now();
+  getEvoDb().update(evolutionRuns).set({ status, failureReason, completedAt: now }).where(eq(evolutionRuns.id, id)).run();
+  writeLog(logFd, `[wrapper] finalize: status=${status}${failureReason ? ` reason=${failureReason}` : ""}
+`);
+}
+var APPLY_REGRESSION_FLOOR = 50;
+function loadApplyRow(id) {
+  const db = getEvoDb();
+  const row = db.select({
+    id: evolutionApplies.id,
+    workspacePath: evolutionApplies.workspacePath,
+    sourceRunIds: evolutionApplies.sourceRunIds,
+    reviewerHint: evolutionApplies.reviewerHint,
+    status: evolutionApplies.status
+  }).from(evolutionApplies).where(eq(evolutionApplies.id, id)).get();
+  if (!row)
+    throw new Error(`evolution_applies row not found: ${id}`);
+  let sourceRunIds;
+  try {
+    sourceRunIds = JSON.parse(row.sourceRunIds);
+  } catch {
+    throw new Error(`evolution_applies.${id}.source_run_ids is not valid JSON: ${row.sourceRunIds}`);
+  }
+  if (!Array.isArray(sourceRunIds) || sourceRunIds.length === 0) {
+    throw new Error(`evolution_applies.${id}.source_run_ids must be a non-empty array`);
+  }
+  return {
+    id: row.id,
+    workspacePath: row.workspacePath,
+    sourceRunIds,
+    reviewerHint: row.reviewerHint,
+    status: row.status
+  };
+}
+function buildEvoSandbox(workspacePath, sandboxParent, logFd) {
+  const srcWs = wsHaloDir(workspacePath);
+  const dstWs = evoSandboxHaloDir(sandboxParent);
+  fs9.mkdirSync(dstWs, { recursive: true });
+  const whitelist = SANDBOX_WHITELIST;
+  for (const entry of whitelist) {
+    const srcEntry = path12.join(srcWs, entry);
+    if (!fs9.existsSync(srcEntry))
+      continue;
+    const dstEntry = path12.join(dstWs, entry);
+    if (fs9.existsSync(dstEntry))
+      continue;
+    copyDereferenced(srcEntry, dstEntry);
+  }
+  writeLog(logFd, `[buildEvoSandbox] cp from ${srcWs} \u2192 ${dstWs} (whitelist: ${whitelist.join(", ")})
+`);
+}
+function copyDereferenced(src, dst) {
+  if (fs9.statSync(src).isDirectory()) {
+    fs9.mkdirSync(dst, { recursive: true });
+    for (const entry of fs9.readdirSync(src))
+      copyDereferenced(path12.join(src, entry), path12.join(dst, entry));
+    return;
+  }
+  fs9.copyFileSync(src, dst);
+}
+function buildApplySandbox(workspacePath, applyDir, logFd) {
+  buildEvoSandbox(workspacePath, applyDir, logFd);
+}
+function buildApplyMergeBrief(args) {
+  return [
+    "You are running as the Apply agent (phase A: MERGE).",
+    "",
+    `Apply id: ${args.applyId}`,
+    `Workspace: ${args.workspacePath}`,
+    `Apply dir: ${args.applyDir}`,
+    "(relative tool paths resolve against the sandbox, not the apply dir \u2014",
+    "write apply-dir artifacts like apply.log with absolute paths)",
+    `source_run_ids: [${args.sourceRunIds.join(", ")}]`,
+    `Reviewer hint: ${args.reviewerHint ?? "(none)"}`,
+    "",
+    "The wrapper has already built the sandbox at",
+    `${evoSandboxHaloDir(args.applyDir)} by whitelist-cp from`,
+    "the current main workspace. Read each source_run_id's patch.md",
+    "(latest version!) and merge their changes into the sandbox.",
+    "",
+    "Follow the procedure in your AGENT.md. Pay close attention to the",
+    "platform override matrix \u2014 workspace-replaces-global rules differ",
+    "per file type, and the prompts/ directory replacement trap is real.",
+    "",
+    "Hard rules: only edit files under sandbox/.halo/ \u2014 main workspace",
+    "and ~/.halo/global/ are off-limits. Do NOT spawn halo cli. Do NOT",
+    `write score.json. Write ${path12.join(args.applyDir, "apply.log")}`,
+    "with a summary of what you did.",
+    "",
+    "If the merge cannot proceed (irreconcilable patch conflicts, malformed",
+    `input, missing sandbox), write ${path12.join(args.applyDir, "ABORT.md")}`,
+    'with the diagnosis \u2014 the wrapper treats its presence as "abort this',
+    'apply" and fails the apply instead of publishing. You cannot signal',
+    "abort via exit code; ABORT.md is the only abort channel.",
+    ...buildLanguageClause(args.langHint, "apply.log and any natural-language commentary")
+  ].join("\n");
+}
+function buildApplyScoreBrief(args) {
+  return [
+    "You are running as the Evolution scorer in APPLY REGRESSION mode.",
+    "",
+    `Apply id: ${args.applyId}`,
+    `Source run id: ${args.runId}`,
+    `Workspace: ${args.workspacePath}`,
+    `Regress dir: ${args.regressDir}`,
+    "(relative tool paths resolve against the sandbox \u2014 use the absolute",
+    "paths below)",
+    "",
+    "The apply agent has merged this patch (and possibly others) into",
+    "an apply sandbox. The wrapper just ran the patch's testScenario",
+    "against the merged sandbox; stdout is in",
+    `${path12.join(args.regressDir, "dry-run-output.txt")}.`,
+    "An empty dry-run-output.txt means the dry-run against the merged",
+    "sandbox failed \u2014 score lint 0 (that is the regression signal the",
+    `wrapper acts on); the failure detail is in`,
+    `${path12.join(args.regressDir, "dry-run-fail.log")} when present.`,
+    "",
+    "Follow your AGENT.md procedure. Read:",
+    `  patch.md      \u2192 ${args.patchMdPath}`,
+    `  tool-flow.md  \u2192 ${path12.join(path12.dirname(args.patchMdPath), "tool-flow.md")} (baseline conversation)`,
+    `  source-snapshot.json \u2192 ${args.snapshotPath}`,
+    `  dry-run output  \u2192 ${path12.join(args.regressDir, "dry-run-output.txt")}`,
+    "",
+    `Write ${path12.join(args.regressDir, "score.json")} \u2014 NOT the source`,
+    "run's score.json. Same format as run mode.",
+    "Do not modify any other file.",
+    ...buildLanguageClause(args.langHint, 'the score.json "notes" field'),
+    'The numeric fields and "confidence" enum stay as-is.'
+  ].join("\n");
+}
+async function phaseApplyMerge(ctx) {
+  writeLog(ctx.logFd, `
+=== Phase A': merge ===
+`);
+  buildApplySandbox(ctx.workspacePath, ctx.applyDir, ctx.logFd);
+  const abortPath = path12.join(ctx.applyDir, "ABORT.md");
+  try {
+    fs9.rmSync(abortPath, { force: true });
+  } catch {
+  }
+  const brief = buildApplyMergeBrief(ctx);
+  const sandboxWs = evoSandboxDir(ctx.applyDir);
+  const result = await spawnProc(
+    resolveHaloCli(),
+    ["cli", "-a", "__apply_agent__", "-n", "-w", sandboxWs],
+    ctx.logFd,
+    void 0,
+    brief,
+    // stdin, not argv — see spawnProc / draft
+    PHASE_TIMEOUT_SEC
+  );
+  if (result.exitCode !== 0) {
+    writeLog(ctx.logFd, `[phaseApplyMerge] apply cli exited ${result.exitCode}
+`);
+    return { ok: false, reason: `apply cli exited ${result.exitCode}` };
+  }
+  if (fs9.existsSync(abortPath)) {
+    let abortText = "";
+    try {
+      abortText = fs9.readFileSync(abortPath, "utf-8").trim();
+    } catch {
+    }
+    writeLog(ctx.logFd, `[phaseApplyMerge] ABORT.md present \u2014 agent aborted the merge:
+${abortText}
+`);
+    const firstLine = abortText.split("\n")[0]?.slice(0, 300) ?? "";
+    return { ok: false, reason: `apply agent aborted: ${firstLine || "see ABORT.md in apply dir"}` };
+  }
+  const hasLog = fs9.existsSync(path12.join(ctx.applyDir, "apply.log"));
+  writeLog(ctx.logFd, `[phaseApplyMerge] apply.log=${hasLog}
+`);
+  if (!hasLog)
+    return { ok: false, reason: "apply agent didn't produce apply.log" };
+  return { ok: true };
+}
+async function phaseApplyRegress(ctx) {
+  writeLog(ctx.logFd, `
+=== Phase B': regress ===
+`);
+  const sandboxDir = evoSandboxDir(ctx.applyDir);
+  fs9.mkdirSync(evoRegressDir(ctx.applyDir), { recursive: true });
+  const outcomes = [];
+  for (const runId of ctx.sourceRunIds) {
+    writeLog(ctx.logFd, `
+--- regress for source run ${runId} ---
+`);
+    const regressDir = evoRegressRunDir(ctx.applyDir, runId);
+    fs9.mkdirSync(regressDir, { recursive: true });
+    const runDir = wsEvoRunDir(ctx.workspacePath, runId);
+    const patchMdPath = path12.join(runDir, "patch.md");
+    const snapshotPath = path12.join(runDir, "source-snapshot.json");
+    const fm = readPatchFrontmatter(runDir);
+    const scenario = extractTestScenario(fm);
+    if (!scenario) {
+      writeLog(ctx.logFd, `[phaseApplyRegress:${runId}] missing testScenario in patch.md frontmatter
+`);
+      outcomes.push({
+        runId,
+        scoreAvg: null,
+        lint: null,
+        behavior: null,
+        regressed: true,
+        reason: "patch.md missing testScenario"
+      });
+      continue;
+    }
+    writeLog(ctx.logFd, `[phaseApplyRegress:${runId}] testScenario.testMessage=${JSON.stringify(scenario.testMessage).slice(0, 200)}
+`);
+    const dryRun = await spawnProc(
+      resolveHaloCli(),
+      ["cli", "-a", scenario.agentId, "-n", "-w", sandboxDir, "--access", "workspace"],
+      ctx.logFd,
+      void 0,
+      scenario.testMessage,
+      // stdin, not argv
+      DRY_RUN_TIMEOUT_SEC
+    );
+    const dryRunOut = path12.join(regressDir, "dry-run-output.txt");
+    if (dryRun.exitCode === 0 && dryRun.stdout.trim().length > 0) {
+      fs9.writeFileSync(dryRunOut, dryRun.stdout, "utf-8");
+    } else {
+      const tail = dryRun.stdout.length > 4e3 ? "\u2026" + dryRun.stdout.slice(-4e3) : dryRun.stdout;
+      const errTail = dryRun.stderr.length > 4e3 ? "\u2026" + dryRun.stderr.slice(-4e3) : dryRun.stderr;
+      fs9.writeFileSync(dryRunOut, "", "utf-8");
+      fs9.writeFileSync(path12.join(regressDir, "dry-run-fail.log"), [
+        `Wrapper command:  halo cli -a ${scenario.agentId} -n -w ${sandboxDir} <testMessage>`,
+        `Test message:     ${scenario.testMessage}`,
+        `Exit code:        ${dryRun.exitCode}${dryRun.exitCode === 124 ? " (timeout)" : ""}`,
+        `Stdout (tail):`,
+        tail || "(empty)",
+        "",
+        `Stderr (tail):`,
+        errTail || "(empty)"
+      ].join("\n"), "utf-8");
+    }
+    const scoreBrief = buildApplyScoreBrief({
+      applyId: ctx.applyId,
+      workspacePath: ctx.workspacePath,
+      runId,
+      regressDir,
+      patchMdPath,
+      snapshotPath,
+      langHint: ctx.langHint
+    });
+    const scoreSandboxWs = evoSandboxDir(ctx.applyDir);
+    const scoreRun = await spawnProc(
+      resolveHaloCli(),
+      ["cli", "-a", "__score__", "-n", "-w", scoreSandboxWs],
+      ctx.logFd,
+      void 0,
+      scoreBrief,
+      // stdin, not argv — see spawnProc / draft
+      PHASE_TIMEOUT_SEC
+    );
+    if (scoreRun.exitCode !== 0) {
+      writeLog(ctx.logFd, `[phaseApplyRegress:${runId}] scorer cli exited ${scoreRun.exitCode}
+`);
+    }
+    const scorePath = path12.join(regressDir, "score.json");
+    let scoreJson = null;
+    try {
+      scoreJson = JSON.parse(fs9.readFileSync(scorePath, "utf-8"));
+    } catch {
+    }
+    if (!scoreJson) {
+      writeLog(ctx.logFd, `[phaseApplyRegress:${runId}] missing/malformed score.json \u2014 treating as regression
+`);
+      outcomes.push({
+        runId,
+        scoreAvg: null,
+        lint: null,
+        behavior: null,
+        regressed: true,
+        reason: "scorer did not produce score.json"
+      });
+      continue;
+    }
+    const lint = typeof scoreJson.lint === "number" ? scoreJson.lint : null;
+    const behavior = typeof scoreJson.behavior === "number" ? scoreJson.behavior : null;
+    const avg = typeof scoreJson.avg === "number" ? scoreJson.avg : null;
+    let regressed = false;
+    let reason = null;
+    if (lint != null && lint < APPLY_REGRESSION_FLOOR) {
+      regressed = true;
+      reason = `lint ${lint} < ${APPLY_REGRESSION_FLOOR} (config didn't load cleanly)`;
+    } else if (behavior != null && behavior < APPLY_REGRESSION_FLOOR) {
+      regressed = true;
+      reason = `behavior ${behavior} < ${APPLY_REGRESSION_FLOOR} (worse than baseline)`;
+    }
+    writeLog(ctx.logFd, `[phaseApplyRegress:${runId}] avg=${avg} lint=${lint} behavior=${behavior} regressed=${regressed}${reason ? ` (${reason})` : ""}
+`);
+    outcomes.push({ runId, scoreAvg: avg, lint, behavior, regressed, reason });
+  }
+  const allOk = outcomes.every((o) => !o.regressed);
+  writeLog(ctx.logFd, `
+[phaseApplyRegress] summary: ${outcomes.length} runs, allOk=${allOk}
+`);
+  return { allOk, outcomes };
+}
+function finalizeApply(applyId, status, failureReason, logFd) {
+  const now = Date.now();
+  getEvoDb().update(evolutionApplies).set({ status, failureReason, completedAt: now }).where(eq(evolutionApplies.id, applyId)).run();
+  writeLog(logFd, `[wrapper] finalize apply: status=${status}${failureReason ? ` reason=${failureReason}` : ""}
+`);
+}
+async function applyMode(id, logFd) {
+  const row = loadApplyRow(id);
+  const applyDir = wsEvoApplyDir(row.workspacePath, id);
+  fs9.mkdirSync(applyDir, { recursive: true });
+  fs9.writeFileSync(path12.join(applyDir, "meta.json"), JSON.stringify({
+    id,
+    sourceRunIds: row.sourceRunIds,
+    reviewerHint: row.reviewerHint,
+    workspacePath: row.workspacePath,
+    createdAt: Date.now()
+  }, null, 2), "utf-8");
+  const hb = setInterval(() => {
+    try {
+      getEvoDb().update(evolutionApplies).set({ heartbeatAt: Date.now() }).where(eq(evolutionApplies.id, id)).run();
+    } catch (err) {
+      writeLog(logFd, `[wrapper] heartbeat (apply) failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }, 6e4);
+  const ctx = {
+    applyId: id,
+    workspacePath: row.workspacePath,
+    applyDir,
+    sourceRunIds: row.sourceRunIds,
+    reviewerHint: row.reviewerHint,
+    langHint: resolveLangHint(),
+    logFd
+  };
+  const isResume = row.status === "syncing";
+  if (isResume) {
+    writeLog(logFd, `[wrapper] resume path: row was in 'syncing', skipping phase A'/B' and re-running phase 12 publish only
+`);
+  }
+  try {
+    if (!isResume) {
+      const merged = await phaseApplyMerge(ctx);
+      if (!merged.ok) {
+        finalizeApply(id, "failed", `phase A': ${merged.reason}`, logFd);
+        return;
+      }
+      const { allOk, outcomes } = await phaseApplyRegress(ctx);
+      if (!allOk) {
+        const regressedRuns = outcomes.filter((o) => o.regressed).map((o) => `${o.runId}(${o.reason ?? "?"})`).join("; ");
+        finalizeApply(id, "failed", `phase B': regression in ${regressedRuns}`, logFd);
+        return;
+      }
+    }
+    try {
+      const preflight = await phaseApplyPreflight(ctx);
+      if (!preflight.ok) {
+        finalizeApply(id, "failed", `phase 12 preflight: ${preflight.reason}`, logFd);
+        return;
+      }
+      if (!isResume)
+        markSyncing(id, logFd);
+      await phaseApplyPublish(ctx, preflight.result);
+      for (const runId of ctx.sourceRunIds) {
+        getEvoDb().update(evolutionRuns).set({ status: "applied", appliedAt: Date.now() }).where(eq(evolutionRuns.id, runId)).run();
+      }
+      finalizeApplied(id, logFd);
+      writeLog(logFd, `[wrapper] phase 12: published ${preflight.result.fileCount} files to main; history snapshot at ${preflight.result.historyDir}
+`);
+      writeLog(logFd, `[wrapper] note: no explicit session-release step needed. Halo's SessionManager evicts every session from the in-memory cache as soon as its current message turn finishes (runSession's finally block). The next message \u2014 channel reply, web reload, /new \u2014 runs ensureSession \u2192 buildAgentInstance, which re-reads agent.yaml + INSTRUCTIONS.md + USER.md from disk. So the new prompts kick in on the next turn for free, and currently-running turns finish on the old prompts (which is the right behavior \u2014 we don't want to abort a user mid-conversation).
+`);
+    } catch (err) {
+      const currentStatus = getEvoDb().select({ status: evolutionApplies.status }).from(evolutionApplies).where(eq(evolutionApplies.id, id)).get()?.status;
+      if (currentStatus === "syncing") {
+        writeLog(logFd, `[wrapper] phase 12 publish threw (${err instanceof Error ? err.message : String(err)}); leaving status='syncing' so ticker can resume \u2014 main may be half-applied
+`);
+        getEvoDb().update(evolutionApplies).set({ startedAt: null, heartbeatAt: null }).where(and(eq(evolutionApplies.id, id), eq(evolutionApplies.status, "syncing"))).run();
+      } else {
+        finalizeApply(id, "failed", `phase 12: ${err instanceof Error ? err.message : String(err)}`, logFd);
+      }
+    }
+  } finally {
+    clearInterval(hb);
+  }
+}
+async function phaseApplyPreflight(ctx) {
+  writeLog(ctx.logFd, `
+=== Phase 12 preflight: diff + history backup ===
+`);
+  const sandboxHalo = evoSandboxHaloDir(ctx.applyDir);
+  const mainHalo = wsHaloDir(ctx.workspacePath);
+  if (!fs9.existsSync(sandboxHalo))
+    return { ok: false, reason: "sandbox missing \u2014 phase 11 must run first" };
+  const whitelistTop = new Set(PUBLISH_WHITELIST);
+  const filesToConsider = [];
+  for (const top of fs9.readdirSync(sandboxHalo)) {
+    if (!whitelistTop.has(top))
+      continue;
+    walkInto(path12.join(sandboxHalo, top), top, filesToConsider);
+  }
+  const historyDir = wsEvoHistoryDir(ctx.workspacePath, ctx.applyId);
+  const changed = [];
+  for (const { rel, full } of filesToConsider) {
+    const mainPath = path12.join(mainHalo, rel);
+    let existsInMain = false;
+    try {
+      fs9.accessSync(mainPath);
+      existsInMain = true;
+    } catch {
+    }
+    if (existsInMain) {
+      const sandboxBuf = fs9.readFileSync(full);
+      const mainBuf = fs9.readFileSync(mainPath);
+      if (sandboxBuf.equals(mainBuf))
+        continue;
+    }
+    changed.push({ rel, full, existsInMain });
+  }
+  writeLog(ctx.logFd, `[preflight] ${changed.length} of ${filesToConsider.length} whitelisted files differ from main
+`);
+  if (changed.length === 0) {
+    return { ok: true, result: { changed, historyDir, fileCount: 0 } };
+  }
+  fs9.mkdirSync(historyDir, { recursive: true });
+  const manifestPath = path12.join(historyDir, "MANIFEST.json");
+  const isFirstPreflight = !fs9.existsSync(manifestPath);
+  if (isFirstPreflight) {
+    for (const { rel, existsInMain } of changed) {
+      if (!existsInMain)
+        continue;
+      const mainPath = path12.join(mainHalo, rel);
+      const histPath = path12.join(historyDir, rel);
+      fs9.mkdirSync(path12.dirname(histPath), { recursive: true });
+      fs9.copyFileSync(mainPath, histPath);
+    }
+    fs9.writeFileSync(manifestPath, JSON.stringify({
+      applyId: ctx.applyId,
+      sourceRunIds: ctx.sourceRunIds,
+      capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      files: changed.map((c) => ({ rel: c.rel, kind: c.existsInMain ? "overwrite" : "new" }))
+    }, null, 2), "utf-8");
+  } else {
+    writeLog(ctx.logFd, `[preflight] MANIFEST.json already exists \u2014 resume path, skipping history backup (the pre-apply state is already preserved from the first preflight)
+`);
+  }
+  writeLog(ctx.logFd, `[preflight] history snapshot: ${historyDir} (${changed.filter((c) => c.existsInMain).length} backed up, ${changed.filter((c) => !c.existsInMain).length} new)
+`);
+  return { ok: true, result: { changed, historyDir, fileCount: changed.length } };
+}
+async function phaseApplyPublish(ctx, preflight) {
+  writeLog(ctx.logFd, `
+=== Phase 12 publish: cp sandbox \u2192 main ===
+`);
+  const mainHalo = wsHaloDir(ctx.workspacePath);
+  for (const { rel, full } of preflight.changed) {
+    const mainPath = path12.join(mainHalo, rel);
+    fs9.mkdirSync(path12.dirname(mainPath), { recursive: true });
+    fs9.copyFileSync(full, mainPath);
+  }
+  writeLog(ctx.logFd, `[publish] copied ${preflight.changed.length} files to ${mainHalo}
+`);
+}
+function markSyncing(applyId, logFd) {
+  getEvoDb().update(evolutionApplies).set({ status: "syncing" }).where(eq(evolutionApplies.id, applyId)).run();
+  writeLog(logFd, `[wrapper] checkpoint: status=syncing (publishing main)
+`);
+}
+function walkInto(absPath, relPath, out) {
+  const stat = fs9.statSync(absPath);
+  if (stat.isFile()) {
+    out.push({ rel: relPath, full: absPath });
+    return;
+  }
+  if (!stat.isDirectory())
+    return;
+  for (const entry of fs9.readdirSync(absPath)) {
+    walkInto(path12.join(absPath, entry), path12.join(relPath, entry), out);
+  }
+}
+function finalizeApplied(applyId, logFd) {
+  const now = Date.now();
+  getEvoDb().update(evolutionApplies).set({ status: "applied", completedAt: now }).where(eq(evolutionApplies.id, applyId)).run();
+  writeLog(logFd, `[wrapper] finalize apply: status=applied
+`);
+}
+function writeLog(fd, msg) {
+  try {
+    fs9.writeSync(fd, msg);
+  } catch {
+  }
+}
+function openLogFor(mode, id) {
+  fs9.mkdirSync(evoLogsDir(), { recursive: true });
+  const logPath = mode === "run" ? evoWrapperLogFile(id) : evoApplyLogFile(id);
+  const fd = fs9.openSync(logPath, "a");
+  return { fd, logPath };
+}
+async function main() {
+  const { mode, id } = parseCli(process.argv.slice(2));
+  setEvoDb(createEvoDb(path12.join(homedir6(), ".halo", "global")));
+  const { fd, logPath } = openLogFor(mode, id);
+  writeLog(fd, `
+=== ${(/* @__PURE__ */ new Date()).toISOString()} wrapper start mode=${mode} id=${id} pid=${process.pid} ===
+`);
+  try {
+    if (mode === "run")
+      await runMode(id, fd);
+    else
+      await applyMode(id, fd);
+    writeLog(fd, `[wrapper] done; log: ${logPath}
+`);
+    process.exit(0);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeLog(fd, `[wrapper] fatal: ${msg}
+`);
+    try {
+      const now = Date.now();
+      if (mode === "run") {
+        getEvoDb().update(evolutionRuns).set({ status: "failed", failureReason: `wrapper crash: ${msg}`, completedAt: now }).where(eq(evolutionRuns.id, id)).run();
+      }
+    } catch {
+    }
+    process.exit(1);
+  }
+}
+if (process.argv[1] && path12.resolve(process.argv[1]) === fileURLToPath2(import.meta.url)) {
+  main().catch((err) => {
+    process.stderr.write(`[wrapper] startup error: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  PUBLISH_WHITELIST,
+  SANDBOX_WHITELIST,
+  buildEvoSandbox,
+  extractTestScenario,
+  judgeDraft,
+  phaseApplyPreflight,
+  phaseApplyPublish,
+  readPatchFrontmatter,
+  spawnProc
+};