@vinihcrosa/lumem-os 0.1.0 → 0.3.0

package/dist/server/main.mjs

@@ -7629,41 +7629,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p = new Promise(function(resolve5, reject) {
+        var p = new Promise(function(resolve6, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve5(result);
+            resolve6(result);
           });
         });
         p.catch(noop2);
         return p;
       }
       function unshift(value) {
-        var p = new Promise(function(resolve5, reject) {
+        var p = new Promise(function(resolve6, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve5(result);
+            resolve6(result);
           });
         });
         p.catch(noop2);
         return p;
       }
       function drained() {
-        var p = new Promise(function(resolve5) {
+        var p = new Promise(function(resolve6) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve5();
+              resolve6();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve5();
+                resolve6();
                 queue.drain = previousDrain;
               };
             }
@@ -8006,8 +8006,8 @@ var require_create_promise = __commonJS({
         reject: null,
         promise: null
       };
-      obj.promise = new Promise((resolve5, reject) => {
-        obj.resolve = resolve5;
+      obj.promise = new Promise((resolve6, reject) => {
+        obj.resolve = resolve6;
         obj.reject = reject;
       });
       return obj;
@@ -8276,11 +8276,11 @@ var require_thenify = __commonJS({
         return;
       }
       debug("thenify");
-      return (resolve5, reject) => {
+      return (resolve6, reject) => {
         const p = this._loadRegistered();
         return p.then(() => {
           this[kThenifyDoNotWrap] = true;
-          return resolve5(this._server);
+          return resolve6(this._server);
         }, reject);
       };
     }
@@ -8417,12 +8417,12 @@ var require_avvio = __commonJS({
     inherits(Boot, EE);
     if ("asyncDispose" in Symbol) {
       Boot.prototype[Symbol.asyncDispose] = function() {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this.close((err) => {
             if (err) {
               return reject(err);
             }
-            resolve5();
+            resolve6();
           });
         });
       };
@@ -8569,12 +8569,12 @@ var require_avvio = __commonJS({
           throw new AVV_ERR_CALLBACK_NOT_FN("close", typeof func);
         }
       } else {
-        promise2 = new Promise(function(resolve5, reject) {
+        promise2 = new Promise(function(resolve6, reject) {
           func = function(err) {
             if (err) {
               return reject(err);
             }
-            resolve5();
+            resolve6();
           };
         });
       }
@@ -8594,7 +8594,7 @@ var require_avvio = __commonJS({
         queueMicrotask(this.start.bind(this));
         return;
       }
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         this._readyQ.push(readyPromiseCB);
         this.start();
         const relativeContext = this._current[0].server;
@@ -8602,7 +8602,7 @@ var require_avvio = __commonJS({
           if (err) {
             reject(err);
           } else {
-            resolve5(relativeContext);
+            resolve6(relativeContext);
           }
           process.nextTick(done);
         }
@@ -9982,8 +9982,8 @@ var require_promise = __commonJS({
     var { kTestInternals } = require_symbols2();
     function withResolvers2() {
       let res, rej;
-      const promise2 = new Promise((resolve5, reject) => {
-        res = resolve5;
+      const promise2 = new Promise((resolve6, reject) => {
+        res = resolve6;
         rej = reject;
       });
       return { promise: promise2, resolve: res, reject: rej };
@@ -10082,15 +10082,15 @@ var require_server = __commonJS({
         if (cb === void 0) {
           const listening = listenPromise.call(this, server, listenOptions);
           return listening.then((address) => {
-            const { promise: promise2, resolve: resolve5 } = PonyPromise.withResolvers();
+            const { promise: promise2, resolve: resolve6 } = PonyPromise.withResolvers();
             if (host === "localhost") {
               multipleBindings.call(this, server, httpHandler, options, listenOptions, () => {
                 this[kState].listening = true;
-                resolve5(address);
+                resolve6(address);
                 onListenHookRunner(this);
               });
             } else {
-              resolve5(address);
+              resolve6(address);
               onListenHookRunner(this);
             }
             return promise2;
@@ -10217,7 +10217,7 @@ var require_server = __commonJS({
       }
       return this.ready().then(() => {
         if (this[kState].aborted) return;
-        const { promise: promise2, resolve: resolve5, reject } = PonyPromise.withResolvers();
+        const { promise: promise2, resolve: resolve6, reject } = PonyPromise.withResolvers();
         const errEventHandler = (err) => {
           cleanup();
           this[kState].listening = false;
@@ -10226,7 +10226,7 @@ var require_server = __commonJS({
         const listeningEventHandler = () => {
           cleanup();
           this[kState].listening = true;
-          resolve5(logServerAddress.call(
+          resolve6(logServerAddress.call(
             this,
             server,
             listenOptions.listenTextResolver || defaultResolveServerListeningText
@@ -13993,7 +13993,7 @@ var require_redact = __commonJS({
       } = options;
       validatePaths(paths);
       const pathStructure = buildPathStructure(paths);
-      return function redact(obj) {
+      return function redact2(obj) {
         if (strict && (obj === null || typeof obj !== "object")) {
           if (obj === null || obj === void 0) {
             return serialize ? serialize(obj) : obj;
@@ -15181,7 +15181,7 @@ var require_thread_stream = __commonJS({
     var { version: version3 } = require_package();
     var { EventEmitter: EventEmitter2 } = __require("events");
     var { Worker } = __require("worker_threads");
-    var { join: join20 } = __require("path");
+    var { join: join21 } = __require("path");
     var { pathToFileURL } = __require("url");
     var { wait } = require_wait();
     var {
@@ -15232,7 +15232,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join20(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join21(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -15700,7 +15700,7 @@ var require_transport = __commonJS({
     var { createRequire } = __require("module");
     var { existsSync: existsSync10 } = __require("node:fs");
     var getCallers = require_caller();
-    var { join: join20, isAbsolute: isAbsolute7, sep: sep6 } = __require("node:path");
+    var { join: join21, isAbsolute: isAbsolute8, sep: sep6 } = __require("node:path");
     var { fileURLToPath: fileURLToPath3 } = __require("node:url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -15772,7 +15772,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute7(path) && !existsSync10(path);
+      return isAbsolute8(path) && !existsSync10(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -15853,7 +15853,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join20(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join21(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -15871,7 +15871,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline) {
-        target = bundlerOverrides["pino-worker"] || join20(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join21(__dirname, "worker.js");
         options.pipelines = [pipeline.map((dest) => {
           return {
             ...dest,
@@ -15890,11 +15890,11 @@ var require_transport = __commonJS({
       return buildStream(fixTarget(target), options, worker, sync, name);
       function fixTarget(origin) {
         origin = bundlerOverrides[origin] || origin;
-        if (isAbsolute7(origin) || origin.indexOf("file://") === 0) {
+        if (isAbsolute8(origin) || origin.indexOf("file://") === 0) {
           return origin;
         }
         if (origin === "pino/file") {
-          return join20(__dirname, "..", "file.js");
+          return join21(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -16874,7 +16874,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join20 = ",";
+            let join21 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -16888,7 +16888,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join20 = `,
+                join21 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -16896,13 +16896,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join20;
+                res += join21;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join20}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join21}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -16923,7 +16923,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join20 = `,
+              join21 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -16937,13 +16937,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join20;
+                separator = join21;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join20;
+              separator = join21;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -16984,7 +16984,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join20 = ",";
+            let join21 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -16997,7 +16997,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join20 = `,
+                join21 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -17005,13 +17005,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join20;
+                res += join21;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join20}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join21}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -17024,7 +17024,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join20 = `,
+              join21 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -17033,7 +17033,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join20;
+                separator = join21;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -17091,20 +17091,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join21 = `,
+              const join22 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join21;
+                res2 += join22;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join21}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join22}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -17120,16 +17120,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join20 = `,
+            const join21 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join20, maximumBreadth);
+              res += stringifyTypedArray(value, join21, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join20;
+              separator = join21;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -17140,13 +17140,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join20;
+                separator = join21;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join20;
+              separator = join21;
             }
             if (separator !== "") {
               res = `
@@ -17554,7 +17554,7 @@ var require_pino = __commonJS({
       const { opts, stream } = normalize5(instance, caller(), ...args);
       if (opts.level && typeof opts.level === "string" && DEFAULT_LEVELS[opts.level.toLowerCase()] !== void 0) opts.level = opts.level.toLowerCase();
       const {
-        redact,
+        redact: redact2,
         crlf,
         serializers: serializers2,
         timestamp,
@@ -17588,8 +17588,8 @@ var require_pino = __commonJS({
       const stringifyFn = stringify2.bind({
         [stringifySafeSym]: stringifySafe
       });
-      const stringifiers = redact ? redaction(redact, stringifyFn) : {};
-      const formatOpts = redact ? { stringify: stringifiers[redactFmtSym] } : { stringify: stringifyFn };
+      const stringifiers = redact2 ? redaction(redact2, stringifyFn) : {};
+      const formatOpts = redact2 ? { stringify: stringifiers[redactFmtSym] } : { stringify: stringifyFn };
       const end = "}" + (crlf ? "\r\n" : "\n");
       const coreChindings = asChindings.bind(null, {
         [chindingsSym]: "",
@@ -24203,7 +24203,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve5.call(this, root, ref);
+      let _sch = resolve6.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -24230,7 +24230,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve5(root, ref) {
+    function resolve6(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -24861,7 +24861,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve5(baseURI, relativeURI, options) {
+    function resolve6(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -24872,49 +24872,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse5(serialize(base, options), options);
-        relative4 = parse5(serialize(relative4, options), options);
+        relative5 = parse5(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -24922,7 +24922,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -25145,7 +25145,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize5,
-      resolve: resolve5,
+      resolve: resolve6,
       resolveComponent,
       equal,
       serialize,
@@ -28901,37 +28901,37 @@ var require_parseJson = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.parseJsonString = exports.parseJsonNumber = exports.parseJson = void 0;
     var rxParseJson = /position\s(\d+)(?: \(line \d+ column \d+\))?$/;
-    function parseJson(s, pos) {
+    function parseJson2(s, pos) {
       let endPos;
-      parseJson.message = void 0;
+      parseJson2.message = void 0;
       let matches;
       if (pos)
         s = s.slice(pos);
       try {
-        parseJson.position = pos + s.length;
+        parseJson2.position = pos + s.length;
         return JSON.parse(s);
       } catch (e) {
         matches = rxParseJson.exec(e.message);
         if (!matches) {
-          parseJson.message = "unexpected end";
+          parseJson2.message = "unexpected end";
           return void 0;
         }
         endPos = +matches[1];
         const c = s[endPos];
         s = s.slice(0, endPos);
-        parseJson.position = pos + endPos;
+        parseJson2.position = pos + endPos;
         try {
           return JSON.parse(s);
         } catch (e1) {
-          parseJson.message = `unexpected token ${c}`;
+          parseJson2.message = `unexpected token ${c}`;
           return void 0;
         }
       }
     }
-    exports.parseJson = parseJson;
-    parseJson.message = void 0;
-    parseJson.position = 0;
-    parseJson.code = 'require("ajv/dist/runtime/parseJson").parseJson';
+    exports.parseJson = parseJson2;
+    parseJson2.message = void 0;
+    parseJson2.position = 0;
+    parseJson2.code = 'require("ajv/dist/runtime/parseJson").parseJson';
     function parseJsonNumber(s, pos, maxDigits) {
       let numStr = "";
       let c;
@@ -30145,7 +30145,7 @@ var require_fast_uri2 = __commonJS({
       }
       return uri;
     }
-    function resolve5(baseURI, relativeURI, options) {
+    function resolve6(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -30156,49 +30156,49 @@ var require_fast_uri2 = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse5(serialize(base, options), options);
-        relative4 = parse5(serialize(relative4, options), options);
+        relative5 = parse5(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -30206,7 +30206,7 @@ var require_fast_uri2 = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -30428,7 +30428,7 @@ var require_fast_uri2 = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize5,
-      resolve: resolve5,
+      resolve: resolve6,
       resolveComponent,
       equal,
       serialize,
@@ -42289,9 +42289,9 @@ var require_light_my_request = __commonJS({
         const res = new Response2(req, callback);
         return makeRequest(dispatchFunc, server, req, res);
       } else {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const req = new RequestConstructor(options);
-          const res = new Response2(req, resolve5, reject);
+          const res = new Response2(req, resolve6, reject);
           makeRequest(dispatchFunc, server, req, res);
         });
       }
@@ -49470,7 +49470,7 @@ var require_commonjs4 = __commonJS({
     var EMITTING_END = Symbol("emittingEnd");
     var EMITTED_ERROR = Symbol("emittedError");
     var CLOSED = Symbol("closed");
-    var READ = Symbol("read");
+    var READ2 = Symbol("read");
     var FLUSH = Symbol("flush");
     var FLUSHCHUNK = Symbol("flushChunk");
     var ENCODING = Symbol("encoding");
@@ -49775,11 +49775,11 @@ var require_commonjs4 = __commonJS({
             this[ENCODING] ? this[BUFFER].join("") : Buffer.concat(this[BUFFER], this[BUFFERLENGTH])
           ];
         }
-        const ret = this[READ](n || null, this[BUFFER][0]);
+        const ret = this[READ2](n || null, this[BUFFER][0]);
         this[MAYBE_EMIT_END]();
         return ret;
       }
-      [READ](n, chunk) {
+      [READ2](n, chunk) {
         if (this[OBJECTMODE])
           this[BUFFERSHIFT]();
         else {
@@ -50181,10 +50181,10 @@ var require_commonjs4 = __commonJS({
        * Return a void Promise that resolves once the stream ends.
        */
       async promise() {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this.on(DESTROYED, () => reject(new Error("stream destroyed")));
           this.on("error", (er) => reject(er));
-          this.on("end", () => resolve5());
+          this.on("end", () => resolve6());
         });
       }
       /**
@@ -50208,7 +50208,7 @@ var require_commonjs4 = __commonJS({
             return Promise.resolve({ done: false, value: res });
           if (this[EOF])
             return stop();
-          let resolve5;
+          let resolve6;
           let reject;
           const onerr = (er) => {
             this.off("data", ondata);
@@ -50222,19 +50222,19 @@ var require_commonjs4 = __commonJS({
             this.off("end", onend);
             this.off(DESTROYED, ondestroy);
             this.pause();
-            resolve5({ value, done: !!this[EOF] });
+            resolve6({ value, done: !!this[EOF] });
           };
           const onend = () => {
             this.off("error", onerr);
             this.off("data", ondata);
             this.off(DESTROYED, ondestroy);
             stop();
-            resolve5({ done: true, value: void 0 });
+            resolve6({ done: true, value: void 0 });
           };
           const ondestroy = () => onerr(new Error("stream destroyed"));
           return new Promise((res2, rej) => {
             reject = rej;
-            resolve5 = res2;
+            resolve6 = res2;
             this.once(DESTROYED, ondestroy);
             this.once("error", onerr);
             this.once("end", onend);
@@ -51254,9 +51254,9 @@ var require_commonjs5 = __commonJS({
         if (this.#asyncReaddirInFlight) {
           await this.#asyncReaddirInFlight;
         } else {
-          let resolve5 = () => {
+          let resolve6 = () => {
           };
-          this.#asyncReaddirInFlight = new Promise((res) => resolve5 = res);
+          this.#asyncReaddirInFlight = new Promise((res) => resolve6 = res);
           try {
             for (const e of await this.#fs.promises.readdir(fullpath, {
               withFileTypes: true
@@ -51269,7 +51269,7 @@ var require_commonjs5 = __commonJS({
             children.provisional = 0;
           }
           this.#asyncReaddirInFlight = void 0;
-          resolve5();
+          resolve6();
         }
         return children.slice(0, children.provisional);
       }
@@ -52356,10 +52356,10 @@ var require_ignore = __commonJS({
       ignored(p) {
         const fullpath = p.fullpath();
         const fullpaths = `${fullpath}/`;
-        const relative4 = p.relative() || ".";
-        const relatives = `${relative4}/`;
+        const relative5 = p.relative() || ".";
+        const relatives = `${relative5}/`;
         for (const m of this.relative) {
-          if (m.match(relative4) || m.match(relatives))
+          if (m.match(relative5) || m.match(relatives))
             return true;
         }
         for (const m of this.absolute) {
@@ -52370,9 +52370,9 @@ var require_ignore = __commonJS({
       }
       childrenIgnored(p) {
         const fullpath = p.fullpath() + "/";
-        const relative4 = (p.relative() || ".") + "/";
+        const relative5 = (p.relative() || ".") + "/";
         for (const m of this.relativeChildren) {
-          if (m.match(relative4))
+          if (m.match(relative5))
             return true;
         }
         for (const m of this.absoluteChildren) {
@@ -53741,7 +53741,7 @@ var require_parseTokenList = __commonJS({
 // ../../node_modules/.pnpm/depd@2.0.0/node_modules/depd/index.js
 var require_depd = __commonJS({
   "../../node_modules/.pnpm/depd@2.0.0/node_modules/depd/index.js"(exports, module) {
-    var relative4 = __require("path").relative;
+    var relative5 = __require("path").relative;
     module.exports = depd;
     var basePath = process.cwd();
     function containsNamespace(str, namespace) {
@@ -53933,7 +53933,7 @@ var require_depd = __commonJS({
       return formatted;
     }
     function formatLocation(callSite) {
-      return relative4(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
+      return relative5(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
     }
     function getStack() {
       var limit = Error.stackTraceLimit;
@@ -54466,9 +54466,9 @@ var require_send = __commonJS({
     var { parseTokenList } = require_parseTokenList();
     var { createHttpError } = require_createHttpError();
     var extname = path.extname;
-    var join20 = path.join;
+    var join21 = path.join;
     var normalize5 = path.normalize;
-    var resolve5 = path.resolve;
+    var resolve6 = path.resolve;
     var sep6 = path.sep;
     var Readable2 = stream.Readable;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
@@ -54515,7 +54515,7 @@ var require_send = __commonJS({
       const lastModified = options.lastModified !== void 0 ? Boolean(options.lastModified) : true;
       const maxage = normalizeMaxAge(options.maxAge ?? options.maxage);
       const maxContentRangeChunkSize = options.maxContentRangeChunkSize !== void 0 ? Number(options.maxContentRangeChunkSize) : null;
-      const root = options.root ? resolve5(options.root) : null;
+      const root = options.root ? resolve6(options.root) : null;
       const highWaterMark = Number.isSafeInteger(options.highWaterMark) && options.highWaterMark > 0 ? options.highWaterMark : null;
       return {
         acceptRanges,
@@ -54553,14 +54553,14 @@ var require_send = __commonJS({
           return { statusCode: 403 };
         }
         parts = path2.split(sep6);
-        path2 = normalize5(join20(root, path2));
+        path2 = normalize5(join21(root, path2));
       } else {
         if (UP_PATH_REGEXP.test(path2)) {
           debug('malicious path "%s"', path2);
           return { statusCode: 403 };
         }
         parts = normalize5(path2).split(sep6);
-        path2 = resolve5(path2);
+        path2 = resolve6(path2);
       }
       return { path: path2, parts };
     }
@@ -54656,9 +54656,9 @@ var require_send = __commonJS({
       );
     }
     function tryStat(path2) {
-      return new Promise((resolve6) => {
+      return new Promise((resolve7) => {
         fs2.stat(path2, function onstat(error40, stat3) {
-          resolve6({ error: error40, stat: stat3 });
+          resolve7({ error: error40, stat: stat3 });
         });
       });
     }
@@ -54836,7 +54836,7 @@ var require_send = __commonJS({
       let err;
       for (let i = 0; i < options.index.length; i++) {
         const index2 = options.index[i];
-        const p = join20(path2, index2);
+        const p = join21(path2, index2);
         const { error: error40, stat: stat3 } = await tryStat(p);
         if (error40) {
           err = error40;
@@ -55132,7 +55132,7 @@ var require_content_disposition = __commonJS({
     "use strict";
     module.exports = contentDisposition;
     module.exports.parse = parse5;
-    var basename4 = __require("path").basename;
+    var basename5 = __require("path").basename;
     var Buffer2 = require_safe_buffer().Buffer;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
     var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
@@ -55168,9 +55168,9 @@ var require_content_disposition = __commonJS({
       if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
         throw new TypeError("fallback must be ISO-8859-1 string");
       }
-      var name = basename4(filename);
+      var name = basename5(filename);
       var isQuotedString = TEXT_REGEXP.test(name);
-      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename4(fallback);
+      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename5(fallback);
       var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
       if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) {
         params["filename*"] = name;
@@ -60013,6 +60013,9 @@ var acpPermissionOptionKindSchema = external_exports.enum([
   "reject_once",
   "reject_always"
 ]);
+var lumemModeSchema = external_exports.enum(["ask", "auto", "free"]);
+var lumemModeDefaultSchema = external_exports.enum(["ask", "auto"]);
+var acpModeOwnerSchema = external_exports.enum(["agent", "lumem"]);
 var acpPermissionOptionSchema = external_exports.object({
   optionId: external_exports.string(),
   /** The agent's own label, shown verbatim (A13). */
@@ -60116,13 +60119,40 @@ var acpEventSchema = external_exports.discriminatedUnion("type", [
     title: external_exports.string(),
     command: external_exports.string().nullish(),
     cwd: external_exports.string(),
-    options: external_exports.array(acpPermissionOptionSchema).min(1)
+    options: external_exports.array(acpPermissionOptionSchema).min(1),
+    /**
+     * Why the Lumem policy did not answer this one (`session-mode`, T7).
+     *
+     * Null under `ask`, and under an agent that owns its own modes: there is
+     * nothing to explain when asking *is* the rule. Set when a policy that would
+     * normally answer did not — `auto` facing a write, or an agent that offered
+     * no way to allow (Q6) — because "why am I being asked in auto mode?" is
+     * otherwise a question the screen cannot answer.
+     */
+    policyReason: external_exports.string().nullable().default(null)
   }),
   external_exports.object({
     type: external_exports.literal("permission_resolved"),
     requestId: external_exports.string(),
     /** `"cancelled"` is the agent giving up on the ask, not the user denying. */
-    outcome: external_exports.union([external_exports.literal("cancelled"), external_exports.object({ optionId: external_exports.string() })])
+    outcome: external_exports.union([external_exports.literal("cancelled"), external_exports.object({ optionId: external_exports.string() })]),
+    /**
+     * Who signed it (F1.6).
+     *
+     * `default` and not `optional`, for two reasons that point the same way: a
+     * transcript recorded before this feature has no field and must still open,
+     * and `"user"` is the truthful answer for every one of them — nothing but a
+     * person could answer a permission request back then.
+     */
+    by: external_exports.enum(["user", "lumem"]).default("user"),
+    /**
+     * Why the policy answered, in the words the card shows.
+     *
+     * Only ever set when `by` is `"lumem"`: a person clicking a button is its
+     * own reason, and inventing prose for it would be the daemon narrating the
+     * user's intent.
+     */
+    reason: external_exports.string().nullable().default(null)
   }),
   /**
    * The plan, whole (F2.5).
@@ -60167,7 +60197,24 @@ var acpEventSchema = external_exports.discriminatedUnion("type", [
      * sending this. So the client replaces rather than merging, and there is exactly
      * one place that has to get the merge right.
      */
-    options: external_exports.array(acpConfigOptionSchema)
+    options: external_exports.array(acpConfigOptionSchema),
+    /**
+     * Which of the two authorities is in charge right now (A1).
+     *
+     * Defaults to `"agent"` so a transcript recorded before `session-mode` reads
+     * as what it was: a conversation where only the agent could offer a mode.
+     */
+    modeOwner: acpModeOwnerSchema.default("agent"),
+    /**
+     * The policy value, whoever owns the selector.
+     *
+     * Sent even while the agent owns the mode, and that is on purpose: the value
+     * is *kept*, not erased, so an agent that stops reporting modes hands the
+     * conversation back to the policy it already had (T12).
+     */
+    lumemMode: lumemModeSchema.default("ask"),
+    /** What a new session in this workspace would start at — the menu's footer (Q5). */
+    lumemModeDefault: lumemModeDefaultSchema.default("ask")
   }),
   /** What `/` offers (F2.8). An empty list means the agent offers none. */
   external_exports.object({ type: external_exports.literal("commands"), commands: external_exports.array(acpCommandSchema) }),
@@ -60265,7 +60312,17 @@ var acpClientMessageSchema = external_exports.discriminatedUnion("type", [
     type: external_exports.literal("set_config"),
     optionId: external_exports.string().min(1),
     value: external_exports.string().min(1)
-  })
+  }),
+  /**
+   * Switch the policy Lumem applies when the agent offers no modes (F1.1).
+   *
+   * A message of its own rather than a `set_config` with `optionId: "mode"`,
+   * because it is not the same act: `set_config` forwards a value to the agent
+   * and this one never leaves the daemon. Sharing the message would put two
+   * destinations behind one name, and the first bug would be a policy change
+   * quietly forwarded to an agent that does not have the option.
+   */
+  external_exports.object({ type: external_exports.literal("set_lumem_mode"), mode: lumemModeSchema })
 ]);
 var acpServerMessageSchema = external_exports.discriminatedUnion("type", [
   /**
@@ -60288,6 +60345,23 @@ var acpServerMessageSchema = external_exports.discriminatedUnion("type", [
      * broken for as long as nothing changed.
      */
     configOptions: external_exports.array(acpConfigOptionSchema).default([]),
+    /**
+     * The mode state, on attach, for the same reason `configOptions` is here: a
+     * composer whose mode pill appeared only once something changed would look
+     * broken for as long as nothing did.
+     */
+    modeOwner: acpModeOwnerSchema.default("agent"),
+    lumemMode: lumemModeSchema.default("ask"),
+    lumemModeDefault: lumemModeDefaultSchema.default("ask"),
+    /**
+     * The checkout this conversation runs in.
+     *
+     * Here because the `free` gate has to name what it is opening, and it names
+     * it as a **path on disk** rather than as "the worktree": the path is what
+     * says the size of the damage (Q4). A gate that could not say it would be
+     * asking for a decision without stating its scope.
+     */
+    cwd: external_exports.string().default(""),
     transcript: external_exports.array(acpTranscriptEntrySchema)
   }),
   external_exports.object({
@@ -60330,16 +60404,46 @@ function encodeAcpServerMessage(message) {
   return JSON.stringify(message);
 }
 
+// ../shared/src/adapters.ts
+function adapterInstallCommand(spec) {
+  return spec.package === null ? null : `npm i -g ${spec.package}@${spec.pinnedVersion}`;
+}
+var CLAUDE_ADAPTER = {
+  id: "claude",
+  label: "Claude Code",
+  package: "@agentclientprotocol/claude-agent-acp",
+  // Duas strings porque não são a mesma string, e é exatamente essa a armadilha:
+  // o pacote é escopado e o binário não.
+  command: "claude-agent-acp",
+  pinnedVersion: "0.40.0",
+  cli: { command: "claude", install: null },
+  apiKeyEnv: ["ANTHROPIC_API_KEY"]
+};
+var CODEX_ADAPTER = {
+  id: "codex",
+  label: "Codex",
+  package: "@agentclientprotocol/codex-acp",
+  command: "codex-acp",
+  // Medido na fase 0, em 2026-09-06: é o que ele reportou como
+  // `agentInfo.version`.
+  pinnedVersion: "1.10.0",
+  // Null, e não `{ command: "codex" }` por simetria: ele traz o próprio.
+  cli: null,
+  apiKeyEnv: ["CODEX_API_KEY", "OPENAI_API_KEY"]
+};
+var ADAPTERS = [CLAUDE_ADAPTER, CODEX_ADAPTER];
+var DEFAULT_ADAPTER_ID = CLAUDE_ADAPTER.id;
+function adapterById(id) {
+  return ADAPTERS.find((spec) => spec.id === id) ?? null;
+}
+function adapterByCommand(command) {
+  return ADAPTERS.find((spec) => spec.command === command) ?? null;
+}
+
 // ../shared/src/constants.ts
-var LUMEM_VERSION = "0.1.0";
+var LUMEM_VERSION = "0.3.0";
 var DEFAULT_SERVER_PORT = 4317;
-var ACP_ADAPTER_COMMAND = "claude-agent-acp";
-var ACP_ADAPTER_PACKAGE = "@agentclientprotocol/claude-agent-acp";
-var ACP_ADAPTER_INSTALL = `npm i -g ${ACP_ADAPTER_PACKAGE}`;
-var CLAUDE_CLI_COMMAND = "claude";
-var ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
 var MIN_GIT_VERSION = { major: 2, minor: 30 };
-var ACP_ADAPTER_PINNED_VERSION = "0.40.0";
 var ADAPTERS_DIR_NAME = "adapters";
 var ACP_AUTH_REQUIRED_CODE = -32e3;
 
@@ -60794,6 +60898,32 @@ function createGitService({ exec = execGit } = {}) {
       const [behind, ahead] = stdout.trim().split(/\s+/).map(Number);
       return { ahead: ahead ?? 0, behind: behind ?? 0 };
     },
+    async getRemoteUrl(path) {
+      const { stdout } = await exec(["remote", "get-url", "origin"], { cwd: path }).catch(() => ({
+        stdout: "",
+        stderr: ""
+      }));
+      const url2 = stdout.trim();
+      return url2 === "" ? null : url2;
+    },
+    async getSubject(path) {
+      const { stdout } = await exec(["log", "-1", "--format=%s"], { cwd: path }).catch(() => ({
+        stdout: "",
+        stderr: ""
+      }));
+      const subject = stdout.trim();
+      return subject === "" ? null : subject;
+    },
+    async hasRemoteBranch(path, branch) {
+      const { stdout } = await exec(["for-each-ref", "--format=%(refname)", "refs/remotes/"], {
+        cwd: path
+      }).catch(() => ({ stdout: "", stderr: "" }));
+      return stdout.split("\n").map((line) => line.trim()).filter((line) => line !== "").some((ref) => {
+        const rest = ref.slice("refs/remotes/".length);
+        const slash = rest.indexOf("/");
+        return slash !== -1 && rest.slice(slash + 1) === branch;
+      });
+    },
     async listChanges(path, input) {
       const comparedTo = await resolveComparison(path, input);
       const tracked2 = comparedTo === null ? [] : await trackedChanges(path, comparedTo);
@@ -62026,7 +62156,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str)]);
   }
   sql2.raw = raw;
-  function join20(chunks, separator) {
+  function join21(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== void 0) {
@@ -62036,7 +62166,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join20;
+  sql2.join = join21;
   function identifier(value) {
     return new Name(value);
   }
@@ -64603,7 +64733,7 @@ var SQLiteSelectQueryBuilderBase = class extends TypedQueryBuilder {
       const baseTableName = this.tableName;
       const tableName = getTableLikeName(table);
       for (const item of extractUsedTable(table)) this.usedTables.add(item);
-      if (typeof tableName === "string" && this.config.joins?.some((join20) => join20.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins?.some((join21) => join21.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (!this.isPartialSelect) {
@@ -65462,7 +65592,7 @@ var SQLiteUpdateBase = class extends QueryPromise {
   createJoin(joinType) {
     return (table, on2) => {
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins.some((join20) => join20.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins.some((join21) => join21.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (typeof on2 === "function") {
@@ -66328,11 +66458,26 @@ var timestamps = {
   createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull().default(NOW),
   updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull().default(NOW)
 };
-var workspace = sqliteTable("workspace", {
-  id: text("id").primaryKey(),
-  name: text("name").notNull().unique(),
-  ...timestamps
-});
+var workspace = sqliteTable(
+  "workspace",
+  {
+    id: text("id").primaryKey(),
+    name: text("name").notNull().unique(),
+    /**
+     * O modo do Lumem que uma sessão nova deste workspace herda (`session-mode`, Q5).
+     *
+     * Sem `'free'` no CHECK, e isso é a decisão inteira em uma linha: o portão do
+     * `liberado` é **por sessão**, e um padrão que o atravessasse sozinho o
+     * anularia. Recusar na ESCRITA, e não silenciar na leitura — silenciar é o
+     * modo de falha que ninguém percebe.
+     */
+    defaultLumemMode: text("default_lumem_mode").notNull().default("ask"),
+    ...timestamps
+  },
+  (table) => [
+    check("workspace_default_lumem_mode", sql`${table.defaultLumemMode} IN ('ask', 'auto')`)
+  ]
+);
 var project = sqliteTable(
   "project",
   {
@@ -66479,6 +66624,18 @@ var session = sqliteTable(
     /** Current permission mode and model, as the protocol reports them. */
     mode: text("mode"),
     model: text("model"),
+    /**
+     * A política do Lumem desta conversa (`session-mode`, F1.4).
+     *
+     * Coluna própria, e **não** reaproveitamento do `mode` acima: aquele é o modo
+     * do protocolo, relatado pelo agente, e este é o que o daemon responde a um
+     * pedido de permissão. Guardar os dois no mesmo lugar seria perder a única
+     * informação que separa "o agente tentou" de "o Lumem deixou passar".
+     *
+     * `NOT NULL DEFAULT 'ask'` faz toda sessão gravada antes desta feature
+     * acordar perguntando — nenhuma acorda liberada.
+     */
+    lumemMode: text("lumem_mode").notNull().default("ask"),
     /**
      * The session this one continues (F5.2, D12).
      *
@@ -66539,7 +66696,10 @@ var session = sqliteTable(
       "session_acp_id",
       sql`(${table.transport} = 'acp' AND ${table.acpSessionId} IS NOT NULL)
         OR (${table.transport} = 'pty' AND ${table.acpSessionId} IS NULL)`
-    )
+    ),
+    // Os três valores da política, e o `free` entra aqui — o que o workspace não
+    // pode é *herdar* liberado; uma sessão pode chegar lá pelo portão.
+    check("session_lumem_mode", sql`${table.lumemMode} IN ('ask', 'auto', 'free')`)
   ]
 );
 var checkoutPort = sqliteTable(
@@ -66758,6 +66918,20 @@ var sessionUsage = sqliteTable(
     projectId: text("project_id").notNull(),
     /** A worktree, quando a sessão rodou numa. `''` quando ela é do projeto. */
     worktreeId: text("worktree_id").notNull().default(""),
+    /**
+     * Qual agente gastou (`second-agent`, F5).
+     *
+     * Resolvido na escrita, como o projeto e a worktree, e pela mesma razão: a
+     * pergunta "quanto cada agente custou" não pode depender de um join com a
+     * `session`, que é uma tabela que muda e de onde a linha pode sumir.
+     *
+     * Anulável, e sem chave estrangeira. Anulável porque a sessão de shell e a de
+     * script não têm agente, e porque a linha gravada **antes** desta coluna não
+     * ganha um agente inventado — ela fica de fora do agrupamento, o que é a
+     * verdade. Sem estrangeira porque consumo é histórico: apagar a configuração
+     * de ontem não pode apagar o que ela gastou.
+     */
+    agentConfigId: text("agent_config_id"),
     /** A variação da janela de contexto neste turno. Nunca negativa. */
     tokens: integer("tokens").notNull().default(0),
     /**
@@ -66916,95 +67090,8 @@ async function withConstraints(run3, translations) {
   }
 }
 
-// src/repositories/agentConfig.ts
-var DEFAULT_AGENT_CONFIG = {
-  name: "claude-code",
-  command: "claude",
-  args: [],
-  env: {},
-  transport: "pty"
-};
-function conflicts(name) {
-  return {
-    "unique:agent_config.name": {
-      code: "DUPLICATE",
-      message: `j\xE1 existe uma configura\xE7\xE3o chamada "${name}"`
-    },
-    foreignKey: {
-      code: "IN_USE",
-      message: "a configura\xE7\xE3o ainda est\xE1 em uso por alguma sess\xE3o"
-    },
-    // Without this the CHECK surfaces as a raw SQLite error, which reads as a
-    // daemon defect rather than as the one thing the caller got wrong.
-    "check:agent_config_adapter_version": {
-      code: "INVALID_ARGUMENT",
-      message: "configura\xE7\xE3o ACP precisa de uma vers\xE3o de adaptador fixa, e configura\xE7\xE3o PTY n\xE3o pode ter uma"
-    },
-    "check:agent_config_transport": {
-      code: "INVALID_ARGUMENT",
-      message: "transporte precisa ser pty ou acp"
-    }
-  };
-}
-function createAgentConfigRepository(db) {
-  async function require_(id) {
-    const found = await db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
-    if (!found) throw new DomainError("NOT_FOUND", `configura\xE7\xE3o ${id} n\xE3o existe`);
-    return found;
-  }
-  return {
-    async create({ name, command, args = [], env = {}, transport = "pty", adapterVersion = null }) {
-      const [row] = await withConstraints(
-        () => db.insert(agentConfig).values({ id: newId(), name, command, args, env, transport, adapterVersion }).returning(),
-        conflicts(name)
-      );
-      return row;
-    },
-    list() {
-      return db.select().from(agentConfig).orderBy(asc(agentConfig.name));
-    },
-    findById(id) {
-      return db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
-    },
-    findByName(name) {
-      return db.query.agentConfig.findFirst({ where: eq(agentConfig.name, name) });
-    },
-    async update(id, input) {
-      const current = await require_(id);
-      const [row] = await withConstraints(
-        () => db.update(agentConfig).set({ ...input, updatedAt: /* @__PURE__ */ new Date() }).where(eq(agentConfig.id, id)).returning(),
-        conflicts(input.name ?? current.name)
-      );
-      return row;
-    },
-    async remove(id) {
-      await require_(id);
-      await withConstraints(
-        () => db.delete(agentConfig).where(eq(agentConfig.id, id)).returning(),
-        conflicts("")
-      );
-    },
-    async seedDefaults() {
-      const existing = await db.query.agentConfig.findFirst({
-        where: eq(agentConfig.name, DEFAULT_AGENT_CONFIG.name)
-      });
-      if (existing) return;
-      await db.insert(agentConfig).values({
-        id: newId(),
-        name: DEFAULT_AGENT_CONFIG.name,
-        command: DEFAULT_AGENT_CONFIG.command,
-        args: DEFAULT_AGENT_CONFIG.args ?? [],
-        env: DEFAULT_AGENT_CONFIG.env ?? {},
-        // Still PTY. The default configuration changes transport when the
-        // conversation can render one end to end, not when the column exists.
-        transport: DEFAULT_AGENT_CONFIG.transport ?? "pty"
-      });
-    }
-  };
-}
-
 // src/repositories/project.ts
-function conflicts2(name, path) {
+function conflicts(name, path) {
   return {
     "unique:project.workspace_id,project.name": {
       code: "DUPLICATE",
@@ -67032,7 +67119,7 @@ function createProjectRepository(db) {
     async create(input) {
       const [row] = await withConstraints(
         () => db.insert(project).values({ id: newId(), ...input }).returning(),
-        conflicts2(input.name, input.path)
+        conflicts(input.name, input.path)
       );
       return row;
     },
@@ -67053,7 +67140,7 @@ function createProjectRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(project).set({ name, updatedAt: /* @__PURE__ */ new Date() }).where(eq(project.id, id)).returning(),
-        conflicts2(name)
+        conflicts(name)
       );
       return row;
     },
@@ -67063,11 +67150,9 @@ function createProjectRepository(db) {
     },
     async remove(id) {
       await require_(id);
-      await withConstraints(() => db.delete(project).where(eq(project.id, id)).returning(), {
-        foreignKey: {
-          code: "IN_USE",
-          message: "o projeto ainda tem worktrees registradas; remova-as antes"
-        }
+      db.transaction((tx) => {
+        tx.delete(worktree).where(eq(worktree.projectId, id)).run();
+        tx.delete(project).where(eq(project.id, id)).run();
       });
     }
   };
@@ -67131,6 +67216,10 @@ function createSessionRepository(db) {
       await db.update(session).set({
         ...config2.mode === void 0 ? {} : { mode: config2.mode },
         ...config2.model === void 0 ? {} : { model: config2.model },
+        // A política do Lumem entra pelo mesmo caminho do modo do protocolo,
+        // e em coluna diferente: uma é o que o agente relatou, a outra é o que
+        // o daemon responde. Guardar as duas juntas apagaria a diferença.
+        ...config2.lumemMode === void 0 ? {} : { lumemMode: config2.lumemMode },
         updatedAt: /* @__PURE__ */ new Date()
       }).where(and(eq(session.id, id), eq(session.state, "running")));
     },
@@ -67201,7 +67290,7 @@ function createWorkspaceRepository(db) {
 }
 
 // src/repositories/worktree.ts
-function conflicts3(name) {
+function conflicts2(name) {
   return {
     "unique:worktree.project_id,worktree.name": {
       code: "DUPLICATE",
@@ -67224,7 +67313,7 @@ function createWorktreeRepository(db) {
     async create(input) {
       const [row] = await withConstraints(
         () => db.insert(worktree).values({ id: newId(), ...input }).returning(),
-        conflicts3(input.name)
+        conflicts2(input.name)
       );
       return row;
     },
@@ -67242,7 +67331,7 @@ function createWorktreeRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(worktree).set({ state, updatedAt: /* @__PURE__ */ new Date() }).where(eq(worktree.id, id)).returning(),
-        conflicts3("")
+        conflicts2("")
       );
       return row;
     },
@@ -67250,7 +67339,7 @@ function createWorktreeRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(worktree).set({ path, updatedAt: /* @__PURE__ */ new Date() }).where(eq(worktree.id, id)).returning(),
-        conflicts3("")
+        conflicts2("")
       );
       return row;
     },
@@ -67468,7 +67557,6 @@ async function subdirectories(path) {
   return entries.filter((entry) => entry.isDirectory()).map((entry) => join4(path, entry.name));
 }
 async function reconcileOnBoot(options) {
-  await createAgentConfigRepository(options.db).seedDefaults();
   const layout = await migrateWorktreeLayout(options);
   const clones = await reconcileClones(options).catch(() => 0);
   const worktrees = await reconcileWorktrees(options);
@@ -81018,11 +81106,11 @@ var Connection = class {
     const id = this.nextRequestId++;
     let cancel = () => {
     };
-    const response = new Promise((resolve5, reject) => {
+    const response = new Promise((resolve6, reject) => {
       const pendingResponse = {
         resolve: (value) => {
           try {
-            resolve5(mapResponse ? mapResponse(value) : value);
+            resolve6(mapResponse ? mapResponse(value) : value);
           } catch (error40) {
             reject(error40);
           }
@@ -81079,8 +81167,8 @@ var Connection = class {
     this.stream = stream;
     this.staticHandlers = handlers2;
     this.allowBatches = options?.allowBatches ?? true;
-    this.closedPromise = new Promise((resolve5) => {
-      this.abortController.signal.addEventListener("abort", () => resolve5());
+    this.closedPromise = new Promise((resolve6) => {
+      this.abortController.signal.addEventListener("abort", () => resolve6());
     });
     void this.receive();
   }
@@ -81961,8 +82049,8 @@ var AsyncQueue = class {
     if (this.failed) {
       return Promise.reject(this.failure);
     }
-    return new Promise((resolve5, reject) => {
-      this.waiters.push({ resolve: resolve5, reject });
+    return new Promise((resolve6, reject) => {
+      this.waiters.push({ resolve: resolve6, reject });
     });
   }
 };
@@ -82566,6 +82654,9 @@ var legacyClientNotificationMethods = /* @__PURE__ */ new Set([
   CLIENT_METHODS.elicitation_complete
 ]);
 
+// src/acp/AcpManager.ts
+import { basename as basename3 } from "node:path";
+
 // src/agents/availability.ts
 import { accessSync, constants } from "node:fs";
 import { delimiter, isAbsolute, join as join5 } from "node:path";
@@ -82654,27 +82745,27 @@ function touchesGit(candidate) {
   return candidate.split(sep2).includes(GIT_DIR);
 }
 async function resolveInsideRoot(root, requested) {
-  const relative4 = normalizeRelative(requested);
+  const relative5 = normalizeRelative(requested);
   const realRoot = await realRootOf(root);
-  const target = join6(realRoot, relative4);
+  const target = join6(realRoot, relative5);
   let absolute;
   try {
     absolute = await realpath3(target);
   } catch (error40) {
     const code = error40.code;
     if (code === "EACCES" || code === "EPERM") {
-      throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative4 || "."}`);
+      throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative5 || "."}`);
     }
-    throw new DomainError("NOT_FOUND", `${relative4 || "."} n\xE3o existe no checkout`);
+    throw new DomainError("NOT_FOUND", `${relative5 || "."} n\xE3o existe no checkout`);
   }
   if (!inside(realRoot, absolute)) {
     throw new DomainError(
       "BLOCKED",
-      target === absolute ? `${relative4} est\xE1 fora do checkout` : `${relative4} aponta para fora do checkout`
+      target === absolute ? `${relative5} est\xE1 fora do checkout` : `${relative5} aponta para fora do checkout`
     );
   }
-  const insideGit = touchesGit(relative4) || touchesGit(relativeTo(realRoot, absolute));
-  return { absolute, relative: relative4, insideGit };
+  const insideGit = touchesGit(relative5) || touchesGit(relativeTo(realRoot, absolute));
+  return { absolute, relative: relative5, insideGit };
 }
 function refuseWritingIntoGit(shown, candidate) {
   if (!touchesGit(candidate)) return;
@@ -82690,13 +82781,13 @@ async function diskNameOf(parent, requested) {
   return names.find((name) => name.toLowerCase() === folded) ?? requested;
 }
 async function resolveForWrite(root, requested) {
-  const relative4 = normalizeRelative(requested);
-  if (relative4 === "") {
+  const relative5 = normalizeRelative(requested);
+  if (relative5 === "") {
     throw new DomainError("INVALID_ARGUMENT", "a raiz do checkout n\xE3o aceita escrita");
   }
-  refuseWritingIntoGit(relative4, relative4);
+  refuseWritingIntoGit(relative5, relative5);
   const realRoot = await realRootOf(root);
-  const parentRelative = dirname4(relative4) === "." ? "" : dirname4(relative4);
+  const parentRelative = dirname4(relative5) === "." ? "" : dirname4(relative5);
   const literalParent = join6(realRoot, parentRelative);
   let parent;
   try {
@@ -82717,7 +82808,7 @@ async function resolveForWrite(root, requested) {
       literalParent === parent ? `${parentRelative} est\xE1 fora do checkout` : `${parentRelative} aponta para fora do checkout`
     );
   }
-  const literalTarget = join6(parent, basename(relative4));
+  const literalTarget = join6(parent, basename(relative5));
   let entry = literalTarget;
   let target = literalTarget;
   let targetless = null;
@@ -82728,7 +82819,7 @@ async function resolveForWrite(root, requested) {
       entry = await realpath3(literalTarget);
       target = entry;
     } else {
-      entry = join6(parent, await diskNameOf(parent, basename(relative4)));
+      entry = join6(parent, await diskNameOf(parent, basename(relative5)));
       const destination = await realpath3(literalTarget).catch(() => null);
       if (destination === null) {
         target = null;
@@ -82747,16 +82838,16 @@ async function resolveForWrite(root, requested) {
       throw new DomainError("INVALID_ARGUMENT", `${parentRelative || "."} n\xE3o \xE9 um diret\xF3rio`);
     }
     if (code !== "ENOENT") {
-      throw new DomainError("BLOCKED", `sem acesso a ${relative4}`);
+      throw new DomainError("BLOCKED", `sem acesso a ${relative5}`);
     }
     exists2 = false;
   }
-  refuseWritingIntoGit(relative4, relativeTo(realRoot, entry));
-  if (target !== null) refuseWritingIntoGit(relative4, relativeTo(realRoot, target));
+  refuseWritingIntoGit(relative5, relativeTo(realRoot, entry));
+  if (target !== null) refuseWritingIntoGit(relative5, relativeTo(realRoot, target));
   if (target === realRoot) {
     throw new DomainError("INVALID_ARGUMENT", "a raiz do checkout n\xE3o aceita escrita");
   }
-  return { relative: relative4, entry, target, targetless, exists: exists2 };
+  return { relative: relative5, entry, target, targetless, exists: exists2 };
 }
 
 // src/files/FileService.ts
@@ -82808,11 +82899,11 @@ async function writeAtomically(target, content, mode) {
     throw error40;
   }
 }
-function asCreationFailure(error40, relative4) {
+function asCreationFailure(error40, relative5) {
   const code = error40.code;
-  const parent = dirname5(relative4) === "." ? "." : dirname5(relative4);
+  const parent = dirname5(relative5) === "." ? "." : dirname5(relative5);
   if (code === "EEXIST") {
-    return new DomainError("DUPLICATE", `j\xE1 existe alguma coisa em ${relative4}`);
+    return new DomainError("DUPLICATE", `j\xE1 existe alguma coisa em ${relative5}`);
   }
   if (code === "ENOENT") {
     return new DomainError("NOT_FOUND", `o diret\xF3rio ${parent} n\xE3o existe no checkout`);
@@ -82847,16 +82938,16 @@ function asRenameFailure(error40, from, to) {
   }
   return error40;
 }
-function asRemovalFailure(error40, relative4) {
+function asRemovalFailure(error40, relative5) {
   const code = error40.code;
   if (code === "ENOENT") {
-    return new DomainError("NOT_FOUND", `${relative4} n\xE3o est\xE1 mais no checkout`);
+    return new DomainError("NOT_FOUND", `${relative5} n\xE3o est\xE1 mais no checkout`);
   }
   if (code === "ENOTEMPTY") {
-    return new DomainError("BLOCKED", `${relative4} deixou de estar vazia`);
+    return new DomainError("BLOCKED", `${relative5} deixou de estar vazia`);
   }
   if (code === "EACCES" || code === "EPERM") {
-    return new DomainError("BLOCKED", `sem permiss\xE3o para apagar ${relative4}`);
+    return new DomainError("BLOCKED", `sem permiss\xE3o para apagar ${relative5}`);
   }
   return error40;
 }
@@ -82922,10 +83013,10 @@ function createFileService({
 } = {}) {
   return {
     async listDir(root, path, options = {}) {
-      const { absolute, relative: relative4 } = await resolveInsideRoot(root, path);
+      const { absolute, relative: relative5 } = await resolveInsideRoot(root, path);
       const info = await stat2(absolute);
       if (!info.isDirectory()) {
-        throw new DomainError("INVALID_ARGUMENT", `${relative4} n\xE3o \xE9 um diret\xF3rio`);
+        throw new DomainError("INVALID_ARGUMENT", `${relative5} n\xE3o \xE9 um diret\xF3rio`);
       }
       let dirents;
       try {
@@ -82933,7 +83024,7 @@ function createFileService({
       } catch (error40) {
         const code = error40.code;
         if (code === "EACCES" || code === "EPERM") {
-          throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative4 || "."}`);
+          throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative5 || "."}`);
         }
         throw error40;
       }
@@ -82957,16 +83048,16 @@ function createFileService({
         })
       );
       entries.sort(compareEntries);
-      return { path: relative4, entries, total, truncated: total > kept.length };
+      return { path: relative5, entries, total, truncated: total > kept.length };
     },
     async readFile(root, path) {
-      const { absolute, relative: relative4, insideGit } = await resolveInsideRoot(root, path);
+      const { absolute, relative: relative5, insideGit } = await resolveInsideRoot(root, path);
       const info = await stat2(absolute);
       if (info.isDirectory()) {
-        throw new DomainError("INVALID_ARGUMENT", `${relative4} \xE9 um diret\xF3rio`);
+        throw new DomainError("INVALID_ARGUMENT", `${relative5} \xE9 um diret\xF3rio`);
       }
       if (info.size > maxBytes) {
-        return { kind: "too-large", path: relative4, bytes: info.size, limit: maxBytes };
+        return { kind: "too-large", path: relative5, bytes: info.size, limit: maxBytes };
       }
       let buffer;
       try {
@@ -82974,16 +83065,16 @@ function createFileService({
       } catch (error40) {
         const code = error40.code;
         if (code === "EACCES" || code === "EPERM") {
-          throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative4}`);
+          throw new DomainError("BLOCKED", `sem permiss\xE3o de leitura em ${relative5}`);
         }
         throw error40;
       }
-      if (isBinary(buffer)) return { kind: "binary", path: relative4, bytes: buffer.length };
+      if (isBinary(buffer)) return { kind: "binary", path: relative5, bytes: buffer.length };
       const text2 = buffer.toString("utf8");
       const readOnly = await readOnlyReasonFor(absolute, buffer, text2, insideGit);
       return {
         kind: "text",
-        path: relative4,
+        path: relative5,
         bytes: buffer.length,
         lines: countLines(text2),
         text: text2,
@@ -82992,15 +83083,15 @@ function createFileService({
       };
     },
     async writeFile(root, path, { text: text2, baseRevision }) {
-      const { relative: relative4, target, targetless, exists: exists2 } = await resolveForWrite(root, path);
+      const { relative: relative5, target, targetless, exists: exists2 } = await resolveForWrite(root, path);
       if (target === null) {
         throw new DomainError(
           "BLOCKED",
-          targetless === "outside" ? `escrita recusada em ${relative4}: o link aponta para fora do checkout` : `escrita recusada em ${relative4}: o link est\xE1 pendurado, e nada prova onde a grava\xE7\xE3o cairia`
+          targetless === "outside" ? `escrita recusada em ${relative5}: o link aponta para fora do checkout` : `escrita recusada em ${relative5}: o link est\xE1 pendurado, e nada prova onde a grava\xE7\xE3o cairia`
         );
       }
       if (!exists2) {
-        throw new DomainError("NOT_FOUND", `${relative4} n\xE3o existe no checkout`);
+        throw new DomainError("NOT_FOUND", `${relative5} n\xE3o existe no checkout`);
       }
       const buffer = Buffer.from(text2, "utf8");
       if (buffer.length > maxBytes) {
@@ -83012,22 +83103,22 @@ function createFileService({
       const info = await stat2(target).catch((error40) => {
         throw new DomainError(
           error40.code === "EACCES" || error40.code === "EPERM" ? "BLOCKED" : "NOT_FOUND",
-          `${relative4} n\xE3o est\xE1 mais no checkout`
+          `${relative5} n\xE3o est\xE1 mais no checkout`
         );
       });
       if (info.isDirectory()) {
-        throw new DomainError("INVALID_ARGUMENT", `${relative4} \xE9 um diret\xF3rio`);
+        throw new DomainError("INVALID_ARGUMENT", `${relative5} \xE9 um diret\xF3rio`);
       }
       if (info.size > maxBytes) {
         throw new DomainError(
           "BLOCKED",
-          `${relative4} tem ${info.size} bytes no disco, acima do limite de ${maxBytes}`
+          `${relative5} tem ${info.size} bytes no disco, acima do limite de ${maxBytes}`
         );
       }
       if (!await isWritable(target)) {
         throw new DomainError(
           "BLOCKED",
-          `escrita recusada em ${relative4}: o arquivo \xE9 somente leitura no disco`
+          `escrita recusada em ${relative5}: o arquivo \xE9 somente leitura no disco`
         );
       }
       let current;
@@ -83036,14 +83127,14 @@ function createFileService({
       } catch (error40) {
         const code = error40.code;
         if (code === "EACCES" || code === "EPERM") {
-          throw new DomainError("BLOCKED", `sem permiss\xE3o de escrita em ${relative4}`);
+          throw new DomainError("BLOCKED", `sem permiss\xE3o de escrita em ${relative5}`);
         }
         throw error40;
       }
       if (!survivesUtf8(current, current.toString("utf8"))) {
         throw new DomainError(
           "BLOCKED",
-          `escrita recusada em ${relative4}: o conte\xFAdo no disco n\xE3o sobrevive a uma ida e volta em UTF-8, e gravar destruiria bytes`
+          `escrita recusada em ${relative5}: o conte\xFAdo no disco n\xE3o sobrevive a uma ida e volta em UTF-8, e gravar destruiria bytes`
         );
       }
       const revision = revisionOf(current);
@@ -83055,29 +83146,29 @@ function createFileService({
       } catch (error40) {
         const code = error40.code;
         if (code === "EACCES" || code === "EPERM") {
-          throw new DomainError("BLOCKED", `sem permiss\xE3o de escrita em ${relative4}`);
+          throw new DomainError("BLOCKED", `sem permiss\xE3o de escrita em ${relative5}`);
         }
         throw error40;
       }
       return { ok: true, revision: revisionOf(buffer) };
     },
     async createFile(root, path) {
-      const { relative: relative4, entry } = await resolveForWrite(root, path);
+      const { relative: relative5, entry } = await resolveForWrite(root, path);
       try {
         await writeFile(entry, "", { flag: "wx" });
       } catch (error40) {
-        throw asCreationFailure(error40, relative4);
+        throw asCreationFailure(error40, relative5);
       }
-      return { path: relative4 };
+      return { path: relative5 };
     },
     async createDir(root, path) {
-      const { relative: relative4, entry } = await resolveForWrite(root, path);
+      const { relative: relative5, entry } = await resolveForWrite(root, path);
       try {
         await mkdir3(entry);
       } catch (error40) {
-        throw asCreationFailure(error40, relative4);
+        throw asCreationFailure(error40, relative5);
       }
-      return { path: relative4 };
+      return { path: relative5 };
     },
     async rename(root, from, to) {
       const source = await resolveForWrite(root, from);
@@ -83102,50 +83193,50 @@ function createFileService({
       return { path: destination.relative };
     },
     async remove(root, path, { recursive = false } = {}) {
-      const { relative: relative4, entry, exists: exists2 } = await resolveForWrite(root, path);
+      const { relative: relative5, entry, exists: exists2 } = await resolveForWrite(root, path);
       if (!exists2) {
-        throw new DomainError("NOT_FOUND", `${relative4} n\xE3o existe no checkout`);
+        throw new DomainError("NOT_FOUND", `${relative5} n\xE3o existe no checkout`);
       }
       const info = await lstat3(entry).catch((error40) => {
-        throw asRemovalFailure(error40, relative4);
+        throw asRemovalFailure(error40, relative5);
       });
       if (!info.isDirectory()) {
         await unlink(entry).catch((error40) => {
-          throw asRemovalFailure(error40, relative4);
+          throw asRemovalFailure(error40, relative5);
         });
         return;
       }
       if (recursive) {
         await rm2(entry, { recursive: true }).catch((error40) => {
-          throw asRemovalFailure(error40, relative4);
+          throw asRemovalFailure(error40, relative5);
         });
         return;
       }
-      const inside2 = await readdir4(entry).catch((error40) => {
-        throw asRemovalFailure(error40, relative4);
+      const inside3 = await readdir4(entry).catch((error40) => {
+        throw asRemovalFailure(error40, relative5);
       });
-      if (inside2.length > 0) {
+      if (inside3.length > 0) {
         throw new DomainError(
           "BLOCKED",
-          `a pasta ${relative4} tem ${inside2.length} ${inside2.length === 1 ? "entrada" : "entradas"} dentro; apagar assim mesmo exige recursive`
+          `a pasta ${relative5} tem ${inside3.length} ${inside3.length === 1 ? "entrada" : "entradas"} dentro; apagar assim mesmo exige recursive`
         );
       }
       await rmdir(entry).catch((error40) => {
-        throw asRemovalFailure(error40, relative4);
+        throw asRemovalFailure(error40, relative5);
       });
     },
     async deletePreview(root, path) {
-      const { relative: relative4, entry, exists: exists2 } = await resolveForWrite(root, path);
+      const { relative: relative5, entry, exists: exists2 } = await resolveForWrite(root, path);
       if (!exists2) {
-        throw new DomainError("NOT_FOUND", `${relative4} n\xE3o existe no checkout`);
+        throw new DomainError("NOT_FOUND", `${relative5} n\xE3o existe no checkout`);
       }
       const info = await lstat3(entry).catch((error40) => {
-        throw asRemovalFailure(error40, relative4);
+        throw asRemovalFailure(error40, relative5);
       });
       if (!info.isDirectory()) {
-        return { kind: "file", path: relative4, tracked: await isTracked(entry) };
+        return { kind: "file", path: relative5, tracked: await isTracked(entry) };
       }
-      return { kind: "dir", path: relative4, ...await countTree(entry, maxPreviewEntries) };
+      return { kind: "dir", path: relative5, ...await countTree(entry, maxPreviewEntries) };
     }
   };
 }
@@ -83165,8 +83256,8 @@ function createFsBridge({ files: files2, root }) {
     }
     return candidate;
   }
-  async function ensureParents(relative4) {
-    const parts = relative4.split(sep3).slice(0, -1);
+  async function ensureParents(relative5) {
+    const parts = relative5.split(sep3).slice(0, -1);
     let walked = "";
     for (const part of parts) {
       walked = walked === "" ? part : `${walked}${sep3}${part}`;
@@ -83196,16 +83287,16 @@ function createFsBridge({ files: files2, root }) {
       return sliceWindow(content.text, window2);
     },
     async write(path, content) {
-      const relative4 = toRelative2(path);
-      const existing = await files2.readFile(absoluteRoot, relative4).catch((error40) => {
+      const relative5 = toRelative2(path);
+      const existing = await files2.readFile(absoluteRoot, relative5).catch((error40) => {
         if (error40 instanceof DomainError && error40.code === "NOT_FOUND") return null;
         throw error40;
       });
       let before = existing;
       if (before === null) {
-        await ensureParents(relative4);
-        await files2.createFile(absoluteRoot, relative4);
-        before = await files2.readFile(absoluteRoot, relative4);
+        await ensureParents(relative5);
+        await files2.createFile(absoluteRoot, relative5);
+        before = await files2.readFile(absoluteRoot, relative5);
       }
       if (before.kind !== "text") {
         throw new DomainError(
@@ -83213,7 +83304,7 @@ function createFsBridge({ files: files2, root }) {
           `escrita recusada em ${path}: o conte\xFAdo atual n\xE3o \xE9 texto`
         );
       }
-      const result = await files2.writeFile(absoluteRoot, relative4, {
+      const result = await files2.writeFile(absoluteRoot, relative5, {
         text: content,
         baseRevision: before.revision
       });
@@ -83271,11 +83362,11 @@ function createTerminalBridge({
       const entry = {
         ptySessionId: spawned.id,
         settled: null,
-        exited: new Promise((resolve5) => {
+        exited: new Promise((resolve6) => {
           ptyManager.onExit(spawned.id, ({ exitCode, signal }) => {
             const status = { exitCode, signal: signal === null ? null : String(signal) };
             entry.settled = status;
-            resolve5(status);
+            resolve6(status);
           });
         })
       };
@@ -83322,9 +83413,9 @@ function spawnAcpProcess({ command, args, cwd, env }) {
     env: { ...process.env, ...env },
     stdio: ["pipe", "pipe", "inherit"]
   });
-  const exited = new Promise((resolve5) => {
-    child.once("exit", (exitCode, signal) => resolve5({ exitCode, signal }));
-    child.once("error", () => resolve5({ exitCode: null, signal: null }));
+  const exited = new Promise((resolve6) => {
+    child.once("exit", (exitCode, signal) => resolve6({ exitCode, signal }));
+    child.once("error", () => resolve6({ exitCode: null, signal: null }));
   });
   if (!child.stdin || !child.stdout) {
     throw new DomainError("SPAWN_FAILED", `${command} started without a usable stdio pipe`);
@@ -83339,6 +83430,54 @@ function spawnAcpProcess({ command, args, cwd, env }) {
   };
 }
 
+// src/acp/permission-policy.ts
+import { isAbsolute as isAbsolute4, relative, resolve as resolve3 } from "node:path";
+var READ = "read";
+var AUTO_ONLY_READS = true;
+function decidePermission(mode, cwd, call) {
+  if (mode === "ask") {
+    return { approve: false, reason: null };
+  }
+  if (mode === "auto" && !isReadInside(cwd, call)) {
+    return { approve: false, reason: whyNotAuto(cwd, call) };
+  }
+  const allow = call.options.find((option) => option.kind === "allow_once");
+  if (!allow) {
+    return {
+      approve: false,
+      reason: "o modo do Lumem aprovaria isto, mas o agente n\xE3o ofereceu nenhuma op\xE7\xE3o de permitir uma vez"
+    };
+  }
+  return {
+    approve: true,
+    optionId: allow.optionId,
+    reason: mode === "free" ? "Modo Liberado: nada \xE9 perguntado dentro deste checkout." : "Modo Autom\xE1tico: leitura de arquivo, caminho dentro do checkout."
+  };
+}
+function isReadInside(cwd, call) {
+  if (AUTO_ONLY_READS && call.kind !== READ) return false;
+  if (call.locations.length === 0) return false;
+  return call.locations.every((location) => inside2(cwd, location.path));
+}
+function whyNotAuto(cwd, call) {
+  if (call.kind !== READ) {
+    return `O modo Autom\xE1tico do Lumem aprova sozinho s\xF3 leitura de arquivo. Esta chamada \xE9 "${call.kind}".`;
+  }
+  if (call.locations.length === 0) {
+    return "O modo Autom\xE1tico do Lumem precisa saber qual arquivo: esta leitura n\xE3o disse nenhum caminho.";
+  }
+  const outside = call.locations.find((location) => !inside2(cwd, location.path));
+  return `O modo Autom\xE1tico do Lumem aprova sozinho s\xF3 dentro do checkout, e "${outside?.path ?? ""}" est\xE1 fora.`;
+}
+function inside2(root, path) {
+  if (root === "") return false;
+  const from = resolve3(root);
+  const to = resolve3(from, path);
+  if (to === from) return true;
+  const step = relative(from, to);
+  return step !== "" && !step.startsWith("..") && !isAbsolute4(step);
+}
+
 // src/acp/translate.ts
 var TOOL_STATUS = {
   pending: "pending",
@@ -83653,6 +83792,10 @@ function sniffUnknownUpdates(source, { onUnknown }) {
 var ACP_PROTOCOL_VERSION = 1;
 var LUMEM_CLIENT_VERSION = "0.1.0";
 var DEFAULT_HANDSHAKE_TIMEOUT_MS = 15e3;
+function modeOwnerOf(info) {
+  if (info.mode !== "") return "agent";
+  return info.configOptions.some((option) => option.id === MODE_OPTION) ? "agent" : "lumem";
+}
 var AcpManager = class {
   sessions = /* @__PURE__ */ new Map();
   exitWatchers = /* @__PURE__ */ new Set();
@@ -83761,6 +83904,82 @@ var AcpManager = class {
    * the spike measured both at zero: nothing is generated until `session/prompt`,
    * which never happens here.
    */
+  /**
+   * Entrar no agente, pelo método que o próprio agente ofereceu (F2, T10).
+   *
+   * O caminho que a `agent-login` construiu roda um **comando** num PTY, e ele
+   * continua valendo — é o que o `claude-agent-acp` oferece. Medido na fase 0
+   * (§4.2): o `codex-acp` não oferece comando nenhum. Os métodos dele são
+   * `api-key`, `chat-gpt` e `chat-gpt-device-code`, e os três se atravessam por
+   * **uma chamada**.
+   *
+   * Um processo por tentativa, e ele morre no fim. A credencial não fica aqui: é
+   * o adaptador que a escreve na casa dele — `~/.codex`, no caso — e é por isso
+   * que um processo curto basta. O que o Lumem guarda de tudo isto é nada.
+   *
+   * **Sem `withTimeout` no `authenticate`.** Todos os outros passos do protocolo
+   * são conversa entre dois programas e um limite de 15 s é generoso; este espera
+   * uma pessoa autorizar em outro lugar, e um limite aqui seria o daemon
+   * desistindo de alguém que está digitando um código. Quem desiste é quem
+   * clicou: o `signal` mata o processo.
+   */
+  async authenticate(options) {
+    if (options.methodId.trim() === "") {
+      throw new DomainError("INVALID_ARGUMENT", "sem o m\xE9todo n\xE3o h\xE1 como entrar");
+    }
+    const { session: session2, child } = this.launch(options, { probe: true });
+    session2.elicit = options.onElicitation;
+    session2.elicitDone = options.onElicitationDone;
+    const abort = () => child.kill();
+    options.signal?.addEventListener("abort", abort, { once: true });
+    try {
+      const initialize = await this.initialize(session2);
+      if (initialize.protocolVersion !== ACP_PROTOCOL_VERSION) {
+        throw new DomainError(
+          "SPAWN_FAILED",
+          `o adaptador fala a vers\xE3o ${initialize.protocolVersion} do protocolo, e este daemon fala a ${ACP_PROTOCOL_VERSION}`
+        );
+      }
+      const offered = (initialize.authMethods ?? []).some(
+        (method) => method.id === options.methodId
+      );
+      if (!offered) {
+        throw new DomainError(
+          "NOT_FOUND",
+          `o adaptador n\xE3o oferece o m\xE9todo de login "${options.methodId}"`
+        );
+      }
+      await session2.connection.agent.request("authenticate", {
+        methodId: options.methodId,
+        /*
+         * A chave viaja no `_meta` e não fica em lugar nenhum.
+         *
+         * Medido no pacote: `authenticateWithApiKey` lê
+         * `_meta["api-key"].apiKey` e, na falta dele, o ambiente
+         * (`CODEX_API_KEY`, `OPENAI_API_KEY`). O daemon é o carteiro — ele não
+         * grava, não loga e não devolve.
+         */
+        ...options.apiKey === void 0 ? {} : { _meta: { "api-key": { apiKey: options.apiKey } } }
+      });
+      try {
+        await this.withTimeout(
+          session2.connection.agent.request("session/new", { cwd: options.cwd, mcpServers: [] }),
+          "session/new"
+        );
+      } catch (error40) {
+        if (isAuthRequired(error40)) {
+          throw new DomainError(
+            "BLOCKED",
+            "o adaptador aceitou o login e continua pedindo credencial \u2014 a conta n\xE3o serve para esta sess\xE3o"
+          );
+        }
+        throw error40;
+      }
+    } finally {
+      options.signal?.removeEventListener("abort", abort);
+      child.kill();
+    }
+  }
   async probe(options) {
     const startedAt = this.now();
     const { session: session2, child } = this.launch(options, { probe: true });
@@ -83854,10 +84073,22 @@ var AcpManager = class {
         exitCode: null,
         mode: "",
         model: "",
-        configOptions: []
+        configOptions: [],
+        /*
+         * A session is born asking, always (F1.5).
+         *
+         * The workspace default is applied by the caller that knows which
+         * workspace this is — the store — and even that one cannot make a
+         * session start free: the gate for `free` is per session, and a default
+         * that walked through it would annul it (Q5).
+         */
+        lumemMode: options.lumemMode ?? "ask",
+        lumemModeDefault: options.lumemModeDefault ?? "ask"
       },
       process: child,
       connection: void 0,
+      elicit: void 0,
+      elicitDone: void 0,
       listeners: /* @__PURE__ */ new Set(),
       openToolCalls: /* @__PURE__ */ new Set(),
       pendingPermissions: /* @__PURE__ */ new Map(),
@@ -83980,7 +84211,50 @@ var AcpManager = class {
     }
     session2.pendingPermissions.delete(requestId);
     pending.resolve({ outcome: "selected", optionId });
-    this.emit(session2, { type: "permission_resolved", requestId, outcome: { optionId } });
+    this.emit(session2, {
+      type: "permission_resolved",
+      requestId,
+      outcome: { optionId },
+      by: "user",
+      reason: null
+    });
+  }
+  /**
+   * Switch the policy Lumem applies to permission requests (F1.1).
+   *
+   * Synchronous, and that is the whole difference from `setConfig`: nothing
+   * leaves the daemon. `setConfig` forwards a value to the agent and waits for it
+   * to answer; this changes what *we* answer, and the agent never learns a policy
+   * exists.
+   *
+   * Two refusals, and both are named rather than silent:
+   *
+   * - **the agent owns the selector** (A1). Accepting the switch and doing
+   *   nothing with it would leave a stored value that never applies — the tell
+   *   would be a pill that changes and a behaviour that does not.
+   * - **a turn is running** (F1.7). Same reason `setConfig` refuses, and
+   *   deliberately the same message: from where the user stands it is the same
+   *   act, and two wordings for one rule teach that there are two rules.
+   */
+  setLumemMode(id, mode) {
+    const session2 = this.require(id);
+    if (session2.info.state === "exited") {
+      throw new DomainError("SESSION_EXITED", `session ${id} has exited`);
+    }
+    if (modeOwnerOf(session2.info) === "agent") {
+      throw new DomainError(
+        "BLOCKED",
+        "este agente oferece modos pr\xF3prios: troque o modo dele, n\xE3o a pol\xEDtica do Lumem"
+      );
+    }
+    if (session2.promptInFlight) {
+      throw new DomainError(
+        "BLOCKED",
+        "n\xE3o d\xE1 para trocar de modo ou modelo no meio de um turno: interrompa ou espere ele acabar"
+      );
+    }
+    session2.info.lumemMode = mode;
+    this.emitConfig(session2);
   }
   /**
    * Everything an attaching client needs to catch up, in one frame.
@@ -84057,18 +84331,18 @@ var AcpManager = class {
     const running = [...this.sessions.values()].filter((s) => s.info.state === "running");
     await Promise.all(
       running.map(
-        (session2) => new Promise((resolve5) => {
-          const timer = setTimeout(resolve5, timeoutMs);
+        (session2) => new Promise((resolve6) => {
+          const timer = setTimeout(resolve6, timeoutMs);
           timer.unref?.();
           void session2.process.exited.then(() => {
             clearTimeout(timer);
-            resolve5();
+            resolve6();
           });
           try {
             session2.process.kill();
           } catch {
             clearTimeout(timer);
-            resolve5();
+            resolve6();
           }
         })
       )
@@ -84130,8 +84404,33 @@ var AcpManager = class {
     }).onRequest("terminal/release", ({ params }) => {
       this.requireTerminals(session2).release(params.terminalId);
       return {};
+    }).onRequest("elicitation/create", ({ params }) => {
+      const record2 = params;
+      const url2 = record2["url"];
+      if (session2.elicit === void 0 || params.mode !== "url" || typeof url2 !== "string") {
+        return { action: "decline" };
+      }
+      session2.elicit({
+        elicitationId: String(record2["elicitationId"] ?? ""),
+        url: url2,
+        message: params.message,
+        code: codeIn(params.message)
+      });
+      return { action: "accept" };
+    }).onNotification("elicitation/complete", ({ params }) => {
+      session2.elicitDone?.(params.elicitationId);
     }).onRequest("session/request_permission", ({ params }) => {
       const requestId = newId();
+      const options = params.options.map((option) => ({
+        optionId: option.optionId,
+        name: option.name,
+        kind: option.kind
+      }));
+      const decision = modeOwnerOf(session2.info) === "lumem" ? decidePermission(session2.info.lumemMode, session2.info.cwd, {
+        kind: kindOf(params.toolCall),
+        locations: locationsOf(params.toolCall),
+        options
+      }) : { approve: false, reason: null };
       this.emit(session2, {
         type: "permission_request",
         requestId,
@@ -84139,15 +84438,24 @@ var AcpManager = class {
         title: params.toolCall.title ?? params.toolCall.toolCallId,
         command: commandOf(params.toolCall),
         cwd: session2.info.cwd,
-        options: params.options.map((option) => ({
-          optionId: option.optionId,
-          name: option.name,
-          kind: option.kind
-        }))
+        options,
+        policyReason: decision.approve ? null : decision.reason
       });
-      return new Promise((resolve5) => {
+      if (decision.approve) {
+        this.emit(session2, {
+          type: "permission_resolved",
+          requestId,
+          outcome: { optionId: decision.optionId },
+          by: "lumem",
+          reason: decision.reason
+        });
+        return Promise.resolve({
+          outcome: { outcome: "selected", optionId: decision.optionId }
+        });
+      }
+      return new Promise((resolve6) => {
         session2.pendingPermissions.set(requestId, {
-          resolve: (outcome) => resolve5({ outcome })
+          resolve: (outcome) => resolve6({ outcome })
         });
       });
     }).onNotification(
@@ -84262,7 +84570,20 @@ var AcpManager = class {
            * Gated on the `PtyManager` too: the methods it offers are commands, and
            * a client that cannot run one has no business being offered it.
            */
-          ...this.ptyManager ? { auth: { terminal: true } } : {}
+          ...this.ptyManager ? { auth: { terminal: true } } : {},
+          /*
+           * "Eu sei mostrar uma URL", declarado porque os dois métodos existem.
+           *
+           * Medido na fase 0 da `second-agent` (§4.2): sem isto, o `codex-acp`
+           * não oferece `chat-gpt-device-code` — o único método dele que **não**
+           * abre um navegador na máquina do daemon. Declarar é o que faz o
+           * método aparecer, e é por isso que ele não é opcional aqui.
+           *
+           * Não é gatilhado no `ptyManager` como o `auth.terminal`: mostrar uma
+           * URL não precisa de terminal nenhum, e o que responde ao pedido é o
+           * `elicitation/create` acima, que existe sempre.
+           */
+          elicitation: { url: {} }
         },
         ...this.ptyManager ? { _meta: { "terminal-auth": true } } : {},
         clientInfo: { name: "lumem", version: LUMEM_CLIENT_VERSION }
@@ -84362,6 +84683,9 @@ var AcpManager = class {
         modeId: value
       });
       session2.info.mode = value;
+      session2.info.configOptions = session2.info.configOptions.map(
+        (option) => option.id === MODE_OPTION ? { ...option, currentValue: value } : option
+      );
       this.emitConfig(session2);
       return;
     }
@@ -84387,7 +84711,10 @@ var AcpManager = class {
     this.emit(session2, {
       type: "config",
       mode: session2.info.mode,
-      options: [...session2.info.configOptions]
+      options: [...session2.info.configOptions],
+      modeOwner: modeOwnerOf(session2.info),
+      lumemMode: session2.info.lumemMode,
+      lumemModeDefault: session2.info.lumemModeDefault
     });
     for (const watcher of [...this.configWatchers]) {
       try {
@@ -84551,6 +84878,18 @@ function flattenChoices(options) {
     ];
   });
 }
+function kindOf(toolCall) {
+  const parsed = acpToolKindSchema.safeParse(toolCall.kind);
+  return parsed.success ? parsed.data : "other";
+}
+function locationsOf(toolCall) {
+  const locations = toolCall.locations;
+  if (!Array.isArray(locations)) return [];
+  return locations.flatMap((location) => {
+    const path = location.path;
+    return typeof path === "string" ? [{ path, line: null }] : [];
+  });
+}
 function commandOf(toolCall) {
   const raw = toolCall.rawInput;
   if (typeof raw === "object" && raw !== null) {
@@ -84561,7 +84900,8 @@ function commandOf(toolCall) {
 }
 function notInstalled(command, adapterVersion) {
   const pinned = adapterVersion ?? "";
-  const remedy = pinned ? `npm i -g @agentclientprotocol/claude-agent-acp@${pinned}` : `instale o adaptador e deixe "${command}" no PATH`;
+  const spec = adapterByCommand(basename3(command));
+  const remedy = spec !== null && spec.package !== null ? `npm i -g ${spec.package}@${pinned || spec.pinnedVersion}` : `instale o adaptador e deixe "${command}" no PATH`;
   const version3 = pinned ? ` Esta sess\xE3o fixa a vers\xE3o ${pinned}.` : "";
   return new DomainError(
     "SPAWN_FAILED",
@@ -84577,6 +84917,10 @@ function launchFailure(command, adapterVersion, cause) {
     { cause }
   );
 }
+function codeIn(message) {
+  const match = /\b([A-Z0-9]{4}-[A-Z0-9]{4}|[A-Z0-9]{6,12})\b/.exec(message);
+  return match?.[1] ?? null;
+}
 function isAuthRequired(error40) {
   const code = error40.code;
   return code === ACP_AUTH_REQUIRED_CODE;
@@ -84711,7 +85055,7 @@ import { dirname as dirname6, join as join11 } from "node:path";
 // src/memory/catalog.ts
 import { createHash as createHash2 } from "node:crypto";
 import { readdir as readdir5, readFile as readFile3 } from "node:fs/promises";
-import { join as join9, relative, sep as sep4 } from "node:path";
+import { join as join9, relative as relative2, sep as sep4 } from "node:path";
 
 // src/memory/entry.ts
 var import_yaml = __toESM(require_dist(), 1);
@@ -85010,7 +85354,7 @@ async function collectFrom(stateDir, dir, location, items) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
     if (dirent.name === "MEMORY.md") continue;
     const absolute = join9(dir, dirent.name);
-    const path = relative(stateDir, absolute).split(sep4).join("/");
+    const path = relative2(stateDir, absolute).split(sep4).join("/");
     const text2 = await readFile3(absolute, "utf8").catch((error40) => error40);
     if (typeof text2 !== "string") {
       items.push({ path, reason: `n\xE3o foi poss\xEDvel ler: ${text2.message}` });
@@ -85201,7 +85545,7 @@ function listDecisions(db, { path, limit = 50 } = {}) {
 }
 
 // src/memory/paths.ts
-import { join as join10, relative as relative2, sep as sep5 } from "node:path";
+import { join as join10, relative as relative3, sep as sep5 } from "node:path";
 var ID_SEGMENT = "[A-Za-z0-9_-]+";
 function memoryDirFor(stateDir, target) {
   switch (target.scope) {
@@ -85281,7 +85625,7 @@ function slugOf(path, type) {
   return file2.replace(new RegExp(`^${type}_`), "").replace(/\.md$/, "");
 }
 function repoRelative(stateDir, absolutePath) {
-  const rel = relative2(stateDir, absolutePath);
+  const rel = relative3(stateDir, absolutePath);
   if (rel === "" || rel.startsWith("..")) {
     throw new DomainError("INVALID_ARGUMENT", `caminho fora do state dir: ${absolutePath}`);
   }
@@ -86395,8 +86739,72 @@ function parseWrite(requested) {
   throw new DomainError("INVALID_ARGUMENT", `${field} \u2014 ${issue2?.message ?? "inv\xE1lido"}`);
 }
 
+// src/repositories/agentConfig.ts
+function conflicts3(name) {
+  return {
+    "unique:agent_config.name": {
+      code: "DUPLICATE",
+      message: `j\xE1 existe uma configura\xE7\xE3o chamada "${name}"`
+    },
+    foreignKey: {
+      code: "IN_USE",
+      message: "a configura\xE7\xE3o ainda est\xE1 em uso por alguma sess\xE3o"
+    },
+    // Without this the CHECK surfaces as a raw SQLite error, which reads as a
+    // daemon defect rather than as the one thing the caller got wrong.
+    "check:agent_config_adapter_version": {
+      code: "INVALID_ARGUMENT",
+      message: "configura\xE7\xE3o ACP precisa de uma vers\xE3o de adaptador fixa, e configura\xE7\xE3o PTY n\xE3o pode ter uma"
+    },
+    "check:agent_config_transport": {
+      code: "INVALID_ARGUMENT",
+      message: "transporte precisa ser pty ou acp"
+    }
+  };
+}
+function createAgentConfigRepository(db) {
+  async function require_(id) {
+    const found = await db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
+    if (!found) throw new DomainError("NOT_FOUND", `configura\xE7\xE3o ${id} n\xE3o existe`);
+    return found;
+  }
+  return {
+    async create({ name, command, args = [], env = {}, transport = "pty", adapterVersion = null }) {
+      const [row] = await withConstraints(
+        () => db.insert(agentConfig).values({ id: newId(), name, command, args, env, transport, adapterVersion }).returning(),
+        conflicts3(name)
+      );
+      return row;
+    },
+    list() {
+      return db.select().from(agentConfig).orderBy(asc(agentConfig.name));
+    },
+    findById(id) {
+      return db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
+    },
+    findByName(name) {
+      return db.query.agentConfig.findFirst({ where: eq(agentConfig.name, name) });
+    },
+    async update(id, input) {
+      const current = await require_(id);
+      const [row] = await withConstraints(
+        () => db.update(agentConfig).set({ ...input, updatedAt: /* @__PURE__ */ new Date() }).where(eq(agentConfig.id, id)).returning(),
+        conflicts3(input.name ?? current.name)
+      );
+      return row;
+    },
+    async remove(id) {
+      await require_(id);
+      await withConstraints(
+        () => db.delete(agentConfig).where(eq(agentConfig.id, id)).returning(),
+        conflicts3("")
+      );
+    }
+  };
+}
+
 // src/memory/projection.ts
-import { relative as relative3, isAbsolute as isAbsolute4 } from "node:path";
+import { relative as relative4, isAbsolute as isAbsolute5 } from "node:path";
 var MAX_FILES = 12;
 var MAX_COMMANDS = 8;
 function isEmpty(projection) {
@@ -86444,8 +86852,8 @@ function projectSession(entries, { cwd }) {
   };
 }
 function toRelative(path, cwd) {
-  if (!isAbsolute4(path)) return path;
-  const rel = relative3(cwd, path);
+  if (!isAbsolute5(path)) return path;
+  const rel = relative4(cwd, path);
   if (rel === "" || rel.startsWith("..")) return null;
   return rel;
 }
@@ -86884,6 +87292,7 @@ function trackSessionUsage({ db, acpManager, log }) {
         sessionId,
         projectId: scope.projectId,
         worktreeId: scope.worktreeId,
+        agentConfigId: scope.agentConfigId,
         tokens,
         ...cost === null ? {} : { cost: cost.amount, currency: cost.currency }
       }).run();
@@ -86899,10 +87308,95 @@ function trackSessionUsage({ db, acpManager, log }) {
 async function scopeOf(db, sessionId) {
   const row = await createSessionRepository(db).findById(sessionId);
   if (row === void 0) return null;
-  if (row.scopeType === "project") return { projectId: row.scopeId, worktreeId: "" };
+  const agentConfigId = row.agentConfigId ?? null;
+  if (row.scopeType === "project") {
+    return { projectId: row.scopeId, worktreeId: "", agentConfigId };
+  }
   const worktree2 = await createWorktreeRepository(db).findById(row.scopeId);
   if (worktree2 === void 0) return null;
-  return { projectId: worktree2.projectId, worktreeId: worktree2.id };
+  return { projectId: worktree2.projectId, worktreeId: worktree2.id, agentConfigId };
+}
+
+// src/setup/agent-auth.ts
+function redact(message, secret) {
+  if (secret === void 0 || secret === "") return message;
+  return message.split(secret).join("\u2022\u2022\u2022");
+}
+function createAgentAuthService({
+  acpManager
+}) {
+  const attempts = /* @__PURE__ */ new Map();
+  function require_(id) {
+    const attempt = attempts.get(id);
+    if (attempt === void 0) {
+      throw new DomainError("NOT_FOUND", `n\xE3o existe login em andamento com o id ${id}`);
+    }
+    return attempt;
+  }
+  function view({ id, state, elicitation, message }) {
+    return { id, state, elicitation, message };
+  }
+  return {
+    start(options) {
+      const attempt = {
+        id: newId(),
+        state: "running",
+        elicitation: null,
+        message: null,
+        controller: new AbortController()
+      };
+      attempts.set(attempt.id, attempt);
+      void acpManager.authenticate({
+        command: options.command,
+        ...options.args ? { args: options.args } : {},
+        cwd: options.cwd,
+        methodId: options.methodId,
+        ...options.apiKey === void 0 ? {} : { apiKey: options.apiKey },
+        ...options.adapterVersion === void 0 ? {} : { adapterVersion: options.adapterVersion },
+        onElicitation: (elicitation) => {
+          attempt.elicitation = elicitation;
+        },
+        onElicitationDone: (elicitationId) => {
+          if (attempt.elicitation?.elicitationId === elicitationId) {
+            attempt.elicitation = null;
+          }
+        },
+        signal: attempt.controller.signal
+      }).then(() => {
+        if (attempt.state === "running") attempt.state = "ok";
+        attempt.elicitation = null;
+      }).catch((error40) => {
+        if (attempt.state === "cancelled") return;
+        attempt.state = "failed";
+        attempt.elicitation = null;
+        attempt.message = redact(
+          error40 instanceof Error ? error40.message : "o adaptador recusou o login",
+          options.apiKey
+        );
+      });
+      return view(attempt);
+    },
+    status(id) {
+      return view(require_(id));
+    },
+    cancel(id) {
+      const attempt = require_(id);
+      if (attempt.state === "running") {
+        attempt.state = "cancelled";
+        attempt.elicitation = null;
+        attempt.controller.abort();
+      }
+      return view(attempt);
+    },
+    cancelAll() {
+      for (const attempt of attempts.values()) {
+        if (attempt.state === "running") {
+          attempt.state = "cancelled";
+          attempt.controller.abort();
+        }
+      }
+    }
+  };
 }
 
 // src/memory/skill.ts
@@ -87212,18 +87706,18 @@ var PtyManager = class {
     const running = [...this.sessions.values()].filter((s) => s.info.state === "running");
     await Promise.all(
       running.map(
-        (session2) => new Promise((resolve5) => {
-          const timer = setTimeout(resolve5, timeoutMs);
+        (session2) => new Promise((resolve6) => {
+          const timer = setTimeout(resolve6, timeoutMs);
           timer.unref?.();
           session2.exitListeners.add(() => {
             clearTimeout(timer);
-            resolve5();
+            resolve6();
           });
           try {
             session2.pty.kill();
           } catch {
             clearTimeout(timer);
-            resolve5();
+            resolve6();
           }
         })
       )
@@ -87333,10 +87827,10 @@ async function releasePort(db, scope) {
   );
 }
 function isPortFree(port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const probe = createServer();
-    probe.once("error", () => resolve5(false));
-    probe.once("listening", () => probe.close(() => resolve5(true)));
+    probe.once("error", () => resolve6(false));
+    probe.once("listening", () => probe.close(() => resolve6(true)));
     probe.listen(port, "0.0.0.0");
   });
 }
@@ -87999,7 +88493,7 @@ function parse3(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
 }
 
 // src/memory/project-identity.ts
-import { dirname as dirname7, join as join13, resolve as resolve3 } from "node:path";
+import { dirname as dirname7, join as join13, resolve as resolve4 } from "node:path";
 var PROJECT_FILE = join13(".lumem", "project.toml");
 
 // src/scripts/project-scripts.ts
@@ -88131,7 +88625,7 @@ function createScriptRunner({
   log
 }) {
   const discovered = /* @__PURE__ */ new Map();
-  async function checkoutOf(scope) {
+  async function checkoutOf2(scope) {
     const projects = createProjectRepository(db);
     if (scope.scopeType === "project") {
       const project3 = await projects.findById(scope.scopeId);
@@ -88184,7 +88678,7 @@ function createScriptRunner({
   }
   return {
     async status(scope) {
-      const { project: project2, cwd } = await checkoutOf(scope);
+      const { project: project2, cwd } = await checkoutOf2(scope);
       const scripts = await readProjectScripts(cwd, {
         warn: (message) => log?.warn({ scope, message }, "scripts ignorados")
       });
@@ -88208,7 +88702,7 @@ function createScriptRunner({
       };
     },
     async start(scope, phase) {
-      const { project: project2, worktree: worktree2, cwd } = await checkoutOf(scope);
+      const { project: project2, worktree: worktree2, cwd } = await checkoutOf2(scope);
       const scripts = await readProjectScripts(cwd);
       const command = scripts[phase];
       if (command === null) {
@@ -88274,15 +88768,15 @@ function createScriptRunner({
     },
     async runToCompletion(scope, phase, { timeoutMs = TEARDOWN_TIMEOUT_MS } = {}) {
       const { session: row } = await this.start(scope, phase);
-      return new Promise((resolve5) => {
+      return new Promise((resolve6) => {
         const timer = setTimeout(() => {
           log?.warn({ scope, phase }, "script n\xE3o terminou no tempo \u2014 seguindo sem ele");
           ptyManager.kill(row.id);
-          resolve5(null);
+          resolve6(null);
         }, timeoutMs);
         ptyManager.onExit(row.id, ({ exitCode }) => {
           clearTimeout(timer);
-          resolve5(exitCode);
+          resolve6(exitCode);
         });
       });
     },
@@ -88450,6 +88944,19 @@ function createSessionStore({
       log?.warn({ session: row.id, err: error40 }, "falha ao varrer reverts do checkout");
     }
   }
+  async function inheritedMode(scopeType, scopeId) {
+    try {
+      const projects = createProjectRepository(db);
+      const projectId = scopeType === "project" ? scopeId : (await createWorktreeRepository(db).findById(scopeId))?.projectId;
+      if (!projectId) return "ask";
+      const project2 = await projects.findById(projectId);
+      if (!project2) return "ask";
+      const workspace2 = await createWorkspaceRepository(db).findById(project2.workspaceId);
+      return workspace2?.defaultLumemMode === "auto" ? "auto" : "ask";
+    } catch {
+      return "ask";
+    }
+  }
   return {
     async start(input) {
       const { kind, agentConfigId = null, scopeType, scopeId, cwd, command } = input;
@@ -88462,12 +88969,17 @@ function createSessionStore({
             "esta inst\xE2ncia n\xE3o sabe iniciar sess\xE3o ACP: nenhum AcpManager foi ligado"
           );
         }
+        const inherited = await inheritedMode(scopeType, scopeId);
         const agent = await acpManager.spawn({
           command,
           ...input.args ? { args: input.args } : {},
           cwd,
           ...input.env ? { env: input.env } : {},
-          ...input.adapterVersion ? { adapterVersion: input.adapterVersion } : {}
+          ...input.adapterVersion ? { adapterVersion: input.adapterVersion } : {},
+          // O modo herdado, e ele é o mesmo nos dois campos: uma sessão nova
+          // começa no padrão do workspace, e o menu mostra de onde veio.
+          lumemMode: inherited,
+          lumemModeDefault: inherited
         });
         try {
           return await sessions.create({
@@ -88545,6 +89057,16 @@ function createSessionStore({
         ...config2?.env && Object.keys(config2.env).length > 0 ? { env: config2.env } : {},
         ...config2?.adapterVersion ? { adapterVersion: config2.adapterVersion } : {},
         acpSessionId: row.acpSessionId,
+        /*
+         * A política volta como estava (F1.4).
+         *
+         * `lumemMode` da linha morta, e não o padrão do workspace: retomar é
+         * continuar a mesma conversa, e uma que estava em `auto` voltar
+         * perguntando tudo seria a feature desfazendo a escolha em silêncio.
+         * Inclusive `free` — o portão já foi atravessado por esta conversa.
+         */
+        lumemMode: row.lumemMode,
+        lumemModeDefault: await inheritedMode(row.scopeType, row.scopeId),
         // What makes the new session's transcript self-contained (D15): the old
         // conversation is copied in front of it, and the separator recorded after.
         fromSessionId: row.id
@@ -88597,6 +89119,19 @@ function createSessionStore({
          * interface offering something it cannot do.
          */
         configOptions: [],
+        /*
+         * O modo em que a conversa **esteve** (F1.8).
+         *
+         * A autoria sai de `row.mode`, e não de `configOptions`: aqui a lista é
+         * vazia por construção, e perguntar a ela quem era o dono responderia
+         * "o Lumem" para toda conversa morta — inclusive as que rodaram com um
+         * agente cheio de modos. O que a linha guarda é qual modo estava valendo,
+         * e ter um é a prova de que o agente era o dono.
+         */
+        modeOwner: row.mode ? "agent" : "lumem",
+        lumemMode: row.lumemMode,
+        lumemModeDefault: "ask",
+        cwd: row.cwd,
         transcript: [...acpManager.storedTranscript(row.id)]
       };
     },
@@ -88636,7 +89171,11 @@ function createSessionStore({
       const offPty = ptyManager.watchExits((info) => record2(info.id, info.exitCode));
       const offAcp = acpManager?.watchExits((info) => record2(info.id, info.exitCode));
       const offConfig = acpManager?.watchConfig((info) => {
-        void sessions.setConfig(info.id, { mode: info.mode, model: info.model }).catch((error40) => {
+        void sessions.setConfig(info.id, {
+          mode: info.mode,
+          model: info.model,
+          lumemMode: info.lumemMode
+        }).catch((error40) => {
           log?.warn({ session: info.id, err: error40 }, "falha ao registrar troca de configura\xE7\xE3o");
         });
       });
@@ -89593,8 +90132,8 @@ var Unpromise = class Unpromise2 {
         status: "fulfilled",
         value
       };
-      subscribers === null || subscribers === void 0 || subscribers.forEach(({ resolve: resolve5 }) => {
-        resolve5(value);
+      subscribers === null || subscribers === void 0 || subscribers.forEach(({ resolve: resolve6 }) => {
+        resolve6(value);
       });
     });
     if ("catch" in thenReturn) thenReturn.catch((reason) => {
@@ -89735,15 +90274,15 @@ function resolveSelfTuple(promise2) {
   return Unpromise.proxy(promise2).then(() => [promise2]);
 }
 function withResolvers() {
-  let resolve5;
+  let resolve6;
   let reject;
   const promise2 = new Promise((_resolve, _reject) => {
-    resolve5 = _resolve;
+    resolve6 = _resolve;
     reject = _reject;
   });
   return {
     promise: promise2,
-    resolve: resolve5,
+    resolve: resolve6,
     reject
   };
 }
@@ -89787,8 +90326,8 @@ function timerResource(ms) {
   let timer = null;
   return makeResource({ start() {
     if (timer) throw new Error("Timer already started");
-    const promise2 = new Promise((resolve5) => {
-      timer = setTimeout(() => resolve5(disposablePromiseTimerResult), ms);
+    const promise2 = new Promise((resolve6) => {
+      timer = setTimeout(() => resolve6(disposablePromiseTimerResult), ms);
     });
     return promise2;
   } }, () => {
@@ -89975,15 +90514,15 @@ function _takeWithGrace() {
   return _takeWithGrace.apply(this, arguments);
 }
 function createDeferred() {
-  let resolve5;
+  let resolve6;
   let reject;
   const promise2 = new Promise((res, rej) => {
-    resolve5 = res;
+    resolve6 = res;
     reject = rej;
   });
   return {
     promise: promise2,
-    resolve: resolve5,
+    resolve: resolve6,
     reject
   };
 }
@@ -91558,8 +92097,8 @@ function getWSConnectionHandler(opts) {
           try {
             var _usingCtx = (0, import_usingCtx2.default)();
             const iterator = _usingCtx.a(iteratorResource(iterable));
-            const abortPromise = new Promise((resolve5) => {
-              abortController$1.signal.onabort = () => resolve5("abort");
+            const abortPromise = new Promise((resolve6) => {
+              abortController$1.signal.onabort = () => resolve6("abort");
             });
             let next;
             let result$1;
@@ -92039,8 +92578,8 @@ async function* snapshots(id, current, listeners, signal) {
         yield job;
         if (isTerminal(job.state)) return;
       }
-      await new Promise((resolve5) => {
-        wake = resolve5;
+      await new Promise((resolve6) => {
+        wake = resolve6;
       });
       wake = void 0;
     }
@@ -92051,6 +92590,652 @@ async function* snapshots(id, current, listeners, signal) {
   }
 }
 
+// src/pr/GhHost.ts
+import { mkdtemp, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join15 } from "node:path";
+
+// src/git/git-url.ts
+var ALLOWED = /* @__PURE__ */ new Set(["https", "http", "ssh", "file"]);
+var HELPER = /^([A-Za-z][A-Za-z0-9+.-]*)::/;
+var SCHEME = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function refuse(rule, message) {
+  return { ok: false, rule, message };
+}
+function refuseScheme(scheme) {
+  if (scheme === "git") {
+    return refuse(
+      "scheme",
+      "o transporte git:// n\xE3o \xE9 aceito: ele n\xE3o autentica nem verifica integridade \u2014 use a URL https ou ssh do mesmo reposit\xF3rio"
+    );
+  }
+  return refuse(
+    "scheme",
+    `o transporte "${scheme}" n\xE3o est\xE1 na lista de transportes aceitos (https, http, ssh, file)`
+  );
+}
+function parseGitUrl(input) {
+  const raw = input.trim();
+  if (raw === "") return refuse("empty", "informe a URL do reposit\xF3rio");
+  if (CONTROL.test(raw)) {
+    return refuse("control-chars", "a URL tem caracteres de controle");
+  }
+  if (raw.startsWith("-")) {
+    return refuse("leading-dash", "a URL n\xE3o pode come\xE7ar com '-'");
+  }
+  const helper = HELPER.exec(raw);
+  if (helper) return refuseScheme(helper[1].toLowerCase());
+  const scheme = SCHEME.exec(raw);
+  if (scheme) return parseWithScheme(raw, scheme[1].toLowerCase());
+  if (isScp(raw)) return parseScp(raw);
+  return refuse(
+    "scheme",
+    "n\xE3o reconheci isto como URL git: use https://, ssh://, file:// ou a forma git@host:org/repo.git"
+  );
+}
+function scpColon(raw) {
+  const at = raw.indexOf("@");
+  return raw.indexOf(":", at === -1 ? 0 : at + 1);
+}
+function isScp(raw) {
+  const colon = scpColon(raw);
+  if (colon <= 0) return false;
+  const slash = raw.indexOf("/");
+  return slash === -1 || colon < slash;
+}
+function parseWithScheme(raw, scheme) {
+  if (!ALLOWED.has(scheme)) return refuseScheme(scheme);
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return refuse("host", `n\xE3o consegui ler ${raw} como URL`);
+  }
+  if (scheme === "file") return parseFile(raw, parsed);
+  if (parsed.hostname === "" || raw.slice(scheme.length + "://".length).startsWith("/")) {
+    return refuse("host", "a URL n\xE3o tem host");
+  }
+  const path = parsed.pathname.replace(/^\/+/, "");
+  if (path === "") {
+    return refuse("path", "a URL n\xE3o diz qual reposit\xF3rio");
+  }
+  const sanitized = new URL(raw);
+  sanitized.username = "";
+  sanitized.password = "";
+  return {
+    ok: true,
+    raw,
+    url: {
+      scheme,
+      href: sanitized.href,
+      host: parsed.host,
+      path,
+      insecure: scheme === "http",
+      scp: false
+    }
+  };
+}
+function parseFile(raw, parsed) {
+  if (parsed.hostname !== "" && parsed.hostname !== "localhost") {
+    return refuse("host", "file:// com host n\xE3o \xE9 aceito; use file:///caminho/absoluto");
+  }
+  const path = decodeURIComponent(parsed.pathname);
+  if (!path.startsWith("/")) {
+    return refuse("path", "o caminho de um file:// precisa ser absoluto");
+  }
+  return {
+    ok: true,
+    raw,
+    url: { scheme: "file", href: `file://${parsed.pathname}`, host: "", path, insecure: false, scp: false }
+  };
+}
+function parseScp(raw) {
+  const colon = scpColon(raw);
+  const authority = raw.slice(0, colon);
+  const path = raw.slice(colon + 1);
+  const at = authority.lastIndexOf("@");
+  const user = at === -1 ? "" : authority.slice(0, at);
+  const host = authority.slice(at + 1);
+  if (host === "") return refuse("host", "a URL n\xE3o tem host");
+  if (path === "") return refuse("path", "a URL n\xE3o diz qual reposit\xF3rio");
+  const cleanUser = user.includes(":") ? user.slice(0, user.indexOf(":")) : user;
+  const prefix = cleanUser === "" ? "" : `${cleanUser}@`;
+  return {
+    ok: true,
+    raw,
+    url: {
+      scheme: "ssh",
+      href: `${prefix}${host}:${path}`,
+      host,
+      path: path.replace(/^\/+/, ""),
+      insecure: false,
+      scp: true
+    }
+  };
+}
+function repoNameOf(url2) {
+  const segments = url2.path.split("/").filter((segment) => segment !== "");
+  const last = segments.at(-1) ?? "";
+  return last.endsWith(".git") ? last.slice(0, -".git".length) : last;
+}
+
+// src/pr/exec.ts
+import { execFile as execFile2 } from "node:child_process";
+var DEFAULT_GH_TIMEOUT_MS = 2e4;
+var GH_MAX_BUFFER = 8 * 1024 * 1024;
+var execGh = (args, { cwd, timeoutMs = DEFAULT_GH_TIMEOUT_MS, bin = "gh" }) => new Promise((resolve6) => {
+  execFile2(
+    bin,
+    [...args],
+    {
+      cwd,
+      timeout: timeoutMs,
+      maxBuffer: GH_MAX_BUFFER,
+      env: {
+        ...process.env,
+        // Cor no meio de um JSON é o tipo de coisa que só quebra na máquina de
+        // outra pessoa, que tem `GH_FORCE_TTY` no perfil.
+        NO_COLOR: "1",
+        GH_NO_UPDATE_NOTIFIER: "1",
+        // O `gh` chama o `git`, e o `git` pode pedir credencial. Sem isto, um
+        // remote mal configurado trava o daemon até o timeout.
+        GIT_TERMINAL_PROMPT: "0"
+      }
+    },
+    (error40, stdout, stderr) => {
+      const failure = error40;
+      resolve6({
+        stdout,
+        stderr,
+        code: failure === null ? 0 : typeof failure.code === "number" ? failure.code : null,
+        spawnError: typeof failure?.code === "string" ? failure.code : null,
+        timedOut: failure?.killed === true
+      });
+    }
+  );
+});
+var EXIT_AUTH_REQUIRED = 4;
+var OFFLINE = [
+  "dial tcp",
+  "no such host",
+  "connection refused",
+  "network is unreachable",
+  "i/o timeout",
+  "tls: ",
+  "proxyconnect",
+  "eof"
+];
+function classify(result) {
+  if (result.spawnError === "ENOENT") {
+    return {
+      kind: "no-binary",
+      message: "o gh n\xE3o est\xE1 instalado ou n\xE3o est\xE1 no PATH"
+    };
+  }
+  if (result.timedOut) {
+    return { kind: "timeout", message: "o gh n\xE3o respondeu a tempo" };
+  }
+  if (result.spawnError !== null) {
+    return { kind: "failed", message: "n\xE3o deu para executar o gh" };
+  }
+  if (result.code === 0) return null;
+  const stderr = result.stderr.toLowerCase();
+  if (result.code === EXIT_AUTH_REQUIRED || stderr.includes("gh auth login")) {
+    if (stderr.includes("known github host")) {
+      return {
+        kind: "unsupported-host",
+        message: "nenhum remote deste reposit\xF3rio aponta para um host GitHub conhecido"
+      };
+    }
+    return { kind: "no-auth", message: "o gh n\xE3o est\xE1 autenticado" };
+  }
+  if (stderr.includes("rate limit")) {
+    return {
+      kind: "rate-limit",
+      message: "o limite de consultas do GitHub foi atingido",
+      retryAt: parseRetryAt(result.stderr)
+    };
+  }
+  if (stderr.includes("not a git repository")) {
+    return { kind: "not-a-repo", message: "este diret\xF3rio n\xE3o \xE9 um reposit\xF3rio git" };
+  }
+  if (OFFLINE.some((needle) => stderr.includes(needle))) {
+    return { kind: "offline", message: "n\xE3o deu para falar com o GitHub" };
+  }
+  return { kind: "failed", message: "o gh recusou a consulta" };
+}
+function parseRetryAt(stderr) {
+  const iso = /(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z)/.exec(stderr);
+  if (iso) return iso[1];
+  const seconds = /retry after (\d+) seconds?/i.exec(stderr);
+  if (seconds) return new Date(Date.now() + Number(seconds[1]) * 1e3).toISOString();
+  return null;
+}
+
+// src/pr/url.ts
+function safeUrl(candidate, host) {
+  if (candidate === null || candidate === void 0 || candidate.trim() === "") return null;
+  if (host === null || host === "") return null;
+  let parsed;
+  try {
+    parsed = new URL(candidate.trim());
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:") return null;
+  if (parsed.username !== "" || parsed.password !== "") return null;
+  if (parsed.hostname.toLowerCase() !== host.toLowerCase()) return null;
+  return parsed.href;
+}
+var NAME_WITH_OWNER = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function compareUrl(input) {
+  const { host, repo, base, head } = input;
+  if (host === null || host === "" || base === "" || head === "") return null;
+  if (!NAME_WITH_OWNER.test(repo)) return null;
+  if (base === head) return null;
+  const url2 = `https://${host}/${repo}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}?expand=1`;
+  return safeUrl(url2, host);
+}
+
+// src/pr/GhHost.ts
+var DEFAULT_LIMIT = 50;
+var FIELDS = [
+  "number",
+  "url",
+  "title",
+  "state",
+  "isDraft",
+  "mergeable",
+  "mergeStateStatus",
+  "reviewDecision",
+  "latestReviews",
+  "headRefName",
+  "baseRefName",
+  "updatedAt",
+  "mergedAt",
+  "closedAt",
+  "author",
+  "statusCheckRollup"
+].join(",");
+var PROJECTION = [
+  "map({number, url, title, state, isDraft, mergeable, mergeStateStatus, reviewDecision,",
+  "headRefName, baseRefName, updatedAt, mergedAt, closedAt,",
+  'author: (.author.login // ""),',
+  'reviews: [.latestReviews[]? | {author: (.author.login // ""), state: .state}],',
+  "checks: [.statusCheckRollup[]? | {",
+  'name: (.name // .context // ""), app: (.workflowName // .context // ""),',
+  'status: (.status // "COMPLETED"), conclusion: (.conclusion // .state // ""),',
+  'url: (.detailsUrl // .targetUrl // ""),',
+  "startedAt: (.startedAt // null), completedAt: (.completedAt // null)}]})"
+].join(" ");
+var REPO_FIELDS = [
+  "nameWithOwner",
+  "mergeCommitAllowed",
+  "squashMergeAllowed",
+  "rebaseMergeAllowed",
+  "deleteBranchOnMerge"
+].join(",");
+var CONTROL2 = /[\u0000-\u001f\u007f]/;
+function createGhHost({ exec = execGh, limit = DEFAULT_LIMIT } = {}) {
+  function hostOf(remoteUrl) {
+    if (remoteUrl === null || remoteUrl.trim() === "") return null;
+    const parsed = parseGitUrl(remoteUrl);
+    if (!parsed.ok) return null;
+    const host = parsed.url.host.split(":")[0] ?? "";
+    return host === "" ? null : host.toLowerCase();
+  }
+  function isGitHub(host) {
+    if (host === null) return false;
+    return host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.");
+  }
+  async function run3(args, cwd) {
+    const result = await exec(args, { cwd });
+    const failure = classify(result);
+    return failure === null ? { ok: true, stdout: result.stdout } : { ok: false, failure };
+  }
+  function unsupported(host) {
+    return {
+      kind: "unsupported-host",
+      message: host === null ? "este reposit\xF3rio n\xE3o tem um remote conhecido" : `o Lumem ainda n\xE3o fala com ${host}`
+    };
+  }
+  function flag(name, value) {
+    return `--${name}=${value}`;
+  }
+  function refuseControl(value, what) {
+    return CONTROL2.test(value) ? { kind: "failed", message: `o ${what} tem caracteres de controle` } : null;
+  }
+  return {
+    name: "GitHub",
+    supports(remoteUrl) {
+      return isGitHub(hostOf(remoteUrl));
+    },
+    async read({ repoPath, remoteUrl }) {
+      const host = hostOf(remoteUrl);
+      if (!isGitHub(host)) return { ok: false, failure: unsupported(host) };
+      const [pulls, repo] = await Promise.all([
+        run3(
+          [
+            "pr",
+            "list",
+            "--state",
+            "all",
+            "--limit",
+            String(limit),
+            "--json",
+            FIELDS,
+            "--jq",
+            PROJECTION
+          ],
+          repoPath
+        ),
+        run3(["repo", "view", "--json", REPO_FIELDS], repoPath)
+      ]);
+      if (!pulls.ok) return pulls;
+      if (!repo.ok) return repo;
+      const parsed = parseJson(pulls.stdout, []);
+      const settings = parseJson(repo.stdout, {});
+      if (parsed === null || settings === null) {
+        return {
+          ok: false,
+          failure: { kind: "failed", message: "o gh respondeu algo que n\xE3o \xE9 JSON" }
+        };
+      }
+      return {
+        ok: true,
+        snapshot: {
+          host: host ?? "",
+          repo: typeof settings.nameWithOwner === "string" ? settings.nameWithOwner : "",
+          pulls: parsed,
+          merge: mergeOptionsOf(settings),
+          readAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      };
+    },
+    async create(input) {
+      const host = hostOf(input.remoteUrl);
+      if (!isGitHub(host)) return { ok: false, failure: unsupported(host) };
+      const bad = refuseControl(input.title, "t\xEDtulo") ?? refuseControl(input.base, "nome da base") ?? refuseControl(input.head, "nome da branch");
+      if (bad !== null) return { ok: false, failure: bad };
+      if (input.title.trim() === "") {
+        return { ok: false, failure: { kind: "failed", message: "a PR precisa de um t\xEDtulo" } };
+      }
+      const dir = await mkdtemp(join15(tmpdir(), "lumem-pr-"));
+      const bodyFile = join15(dir, "body.md");
+      try {
+        await writeFile4(bodyFile, input.body, "utf8");
+        const args = [
+          "pr",
+          "create",
+          flag("base", input.base),
+          flag("head", input.head),
+          flag("title", input.title),
+          flag("body-file", bodyFile)
+        ];
+        if (input.draft) args.push("--draft");
+        const result = await run3(args, input.repoPath);
+        if (!result.ok) return { ok: false, failure: createFailure(result.failure) };
+        const printed = result.stdout.trim().split("\n").at(-1)?.trim() ?? "";
+        return { ok: true, url: safeUrl(printed, host) ?? "" };
+      } finally {
+        await rm4(dir, { recursive: true, force: true });
+      }
+    },
+    async merge(input) {
+      const host = hostOf(input.remoteUrl);
+      if (!isGitHub(host)) return { ok: false, failure: unsupported(host) };
+      if (!Number.isInteger(input.number) || input.number <= 0) {
+        return { ok: false, failure: { kind: "failed", message: "n\xFAmero de PR inv\xE1lido" } };
+      }
+      const args = ["pr", "merge", String(input.number), `--${input.strategy}`];
+      if (input.deleteBranch) args.push("--delete-branch");
+      const result = await run3(args, input.repoPath);
+      if (!result.ok) return { ok: false, failure: mergeFailure(result.failure) };
+      return { ok: true, url: "" };
+    }
+  };
+}
+function createFailure(failure) {
+  if (failure.kind !== "failed") return failure;
+  return { kind: "failed", message: "o GitHub recusou criar a pull request" };
+}
+function mergeFailure(failure) {
+  if (failure.kind !== "failed") return failure;
+  return { kind: "failed", message: "o GitHub recusou o merge" };
+}
+function mergeOptionsOf(settings) {
+  const flagOf = (key) => settings[key] === true;
+  const options = {
+    merge: flagOf("mergeCommitAllowed"),
+    squash: flagOf("squashMergeAllowed"),
+    rebase: flagOf("rebaseMergeAllowed"),
+    deleteBranchOnMerge: flagOf("deleteBranchOnMerge")
+  };
+  if (!options.merge && !options.squash && !options.rebase) {
+    return { ...options, merge: true };
+  }
+  return options;
+}
+function parseJson(stdout, whenEmpty) {
+  const text2 = stdout.trim();
+  if (text2 === "") return whenEmpty;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return null;
+  }
+}
+
+// src/pr/verdict.ts
+var PASSED = /* @__PURE__ */ new Set(["SUCCESS", "NEUTRAL"]);
+var SKIPPED = /* @__PURE__ */ new Set(["SKIPPED", "STALE"]);
+var FAILED = /* @__PURE__ */ new Set([
+  "FAILURE",
+  "TIMED_OUT",
+  "CANCELLED",
+  "ACTION_REQUIRED",
+  "STARTUP_FAILURE",
+  "ERROR"
+]);
+function groupOf(check3) {
+  const status = check3.status.toUpperCase();
+  if (status !== "COMPLETED" && status !== "SUCCESS" && status !== "FAILURE") {
+    return "running";
+  }
+  const conclusion = check3.conclusion.toUpperCase();
+  if (PASSED.has(conclusion)) return "passed";
+  if (SKIPPED.has(conclusion)) return "skipped";
+  if (FAILED.has(conclusion)) return "failed";
+  return "running";
+}
+function countChecks(checks) {
+  const counts = { failed: 0, running: 0, passed: 0, skipped: 0 };
+  for (const check3 of checks) counts[groupOf(check3)] += 1;
+  return counts;
+}
+function queuedCount(checks) {
+  return checks.filter((check3) => {
+    const status = check3.status.toUpperCase();
+    return status === "QUEUED" || status === "WAITING" || status === "REQUESTED";
+  }).length;
+}
+function namesOf(checks, group) {
+  return checks.filter((check3) => groupOf(check3) === group).map((check3) => check3.name);
+}
+function changesRequestedBy(reviews) {
+  return reviews.filter((review) => review.state.toUpperCase() === "CHANGES_REQUESTED").map((review) => review.author);
+}
+function approvedBy(reviews) {
+  return reviews.filter((review) => review.state.toUpperCase() === "APPROVED").map((review) => review.author);
+}
+function decide2(pr) {
+  const state = pr.state.toUpperCase();
+  if (state === "MERGED") {
+    return { verdict: "merged", reason: { kind: "merged", base: pr.baseRefName } };
+  }
+  if (state === "CLOSED") {
+    return { verdict: "closed", reason: { kind: "closed" } };
+  }
+  const counts = countChecks(pr.checks);
+  if (pr.isDraft) {
+    return { verdict: "draft", reason: { kind: "draft", passed: counts.passed } };
+  }
+  const mergeable = pr.mergeable.toUpperCase();
+  const mergeState = pr.mergeStateStatus.toUpperCase();
+  if (mergeable === "CONFLICTING" || mergeState === "DIRTY") {
+    return { verdict: "blocked", reason: { kind: "conflict", base: pr.baseRefName } };
+  }
+  if (counts.failed > 0) {
+    return {
+      verdict: "blocked",
+      reason: { kind: "checks-failed", names: namesOf(pr.checks, "failed") }
+    };
+  }
+  const requested = changesRequestedBy(pr.reviews);
+  if (pr.reviewDecision.toUpperCase() === "CHANGES_REQUESTED" || requested.length > 0) {
+    return { verdict: "blocked", reason: { kind: "changes-requested", by: requested } };
+  }
+  if (pr.reviewDecision.toUpperCase() === "REVIEW_REQUIRED") {
+    return { verdict: "blocked", reason: { kind: "review-required" } };
+  }
+  if (mergeState === "BEHIND") {
+    return { verdict: "blocked", reason: { kind: "behind", base: pr.baseRefName } };
+  }
+  if (counts.running > 0) {
+    return {
+      verdict: "pending",
+      reason: {
+        kind: "checks-running",
+        names: namesOf(pr.checks, "running"),
+        running: counts.running - queuedCount(pr.checks),
+        queued: queuedCount(pr.checks)
+      }
+    };
+  }
+  if (mergeState === "BLOCKED") {
+    return { verdict: "blocked", reason: { kind: "blocked-by-host" } };
+  }
+  if (mergeable !== "MERGEABLE") {
+    return { verdict: "pending", reason: { kind: "mergeability-unknown" } };
+  }
+  if (mergeState !== "CLEAN" && mergeState !== "UNSTABLE" && mergeState !== "HAS_HOOKS") {
+    return { verdict: "pending", reason: { kind: "mergeability-unknown" } };
+  }
+  return {
+    verdict: "ready",
+    reason: { kind: "ready", passed: counts.passed, approvedBy: approvedBy(pr.reviews) }
+  };
+}
+
+// src/pr/PrCache.ts
+var TTL_BUSY_MS = 15e3;
+var TTL_IDLE_MS = 6e4;
+var BACKOFF_START_MS = TTL_IDLE_MS;
+var BACKOFF_MAX_MS = 6e5;
+function createPrCache({
+  host,
+  now = () => Date.now(),
+  onChange
+}) {
+  const slots = /* @__PURE__ */ new Map();
+  let reads = 0;
+  function slotOf(projectId) {
+    const existing = slots.get(projectId);
+    if (existing) return existing;
+    const fresh = {
+      snapshot: null,
+      failure: null,
+      readAt: null,
+      freshUntil: 0,
+      failures: 0,
+      inFlight: null,
+      want: 0,
+      served: 0
+    };
+    slots.set(projectId, fresh);
+    return fresh;
+  }
+  function viewOf2(slot) {
+    return { snapshot: slot.snapshot, failure: slot.failure, readAt: slot.readAt };
+  }
+  function ttlOf(slot) {
+    if (slot.failures > 0) {
+      return Math.min(BACKOFF_START_MS * 2 ** (slot.failures - 1), BACKOFF_MAX_MS);
+    }
+    const pulls = slot.snapshot?.pulls ?? [];
+    const busy = pulls.some(
+      (pull) => pull.state.toUpperCase() === "OPEN" && countChecks(pull.checks).running > 0
+    );
+    return busy ? TTL_BUSY_MS : TTL_IDLE_MS;
+  }
+  async function fetch(project2, slot, want) {
+    reads += 1;
+    try {
+      const read = await host.read({ repoPath: project2.path, remoteUrl: project2.remoteUrl });
+      if (read.ok) {
+        const changed = digestOf(slot.snapshot) !== digestOf(read.snapshot);
+        slot.snapshot = read.snapshot;
+        slot.failure = null;
+        slot.readAt = read.snapshot.readAt;
+        slot.failures = 0;
+        if (changed) onChange?.(project2.id);
+      } else {
+        slot.failure = read.failure;
+        slot.failures += 1;
+      }
+    } catch {
+      slot.failure = { kind: "failed", message: "n\xE3o deu para consultar o host" };
+      slot.failures += 1;
+    } finally {
+      slot.freshUntil = now() + ttlOf(slot);
+      slot.served = Math.max(slot.served, want);
+    }
+    return viewOf2(slot);
+  }
+  function start(project2, slot) {
+    const current = slot.inFlight;
+    if (current !== null) {
+      if (current.want >= slot.want) return current.promise;
+      return current.promise.then(() => start(project2, slot));
+    }
+    const holder = { want: slot.want, promise: Promise.resolve(viewOf2(slot)) };
+    holder.promise = fetch(project2, slot, holder.want).finally(() => {
+      if (slot.inFlight === holder) slot.inFlight = null;
+    });
+    slot.inFlight = holder;
+    return holder.promise;
+  }
+  return {
+    get(project2) {
+      const slot = slotOf(project2.id);
+      const known = slot.snapshot !== null || slot.failure !== null;
+      if (!known || slot.want > slot.served) return start(project2, slot);
+      if (now() < slot.freshUntil) return Promise.resolve(viewOf2(slot));
+      void start(project2, slot).catch(() => void 0);
+      return Promise.resolve(viewOf2(slot));
+    },
+    invalidate(projectId) {
+      const slot = slots.get(projectId);
+      if (!slot) return;
+      slot.freshUntil = 0;
+      slot.want += 1;
+      slot.failures = 0;
+    },
+    forget(projectId) {
+      slots.delete(projectId);
+    },
+    get reads() {
+      return reads;
+    }
+  };
+}
+function digestOf(snapshot) {
+  if (snapshot === null) return "";
+  const { readAt: _ignored, ...rest } = snapshot;
+  return JSON.stringify(rest);
+}
+
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
 var import_stream2 = __toESM(require_stream(), 1);
 var import_extension = __toESM(require_extension(), 1);
@@ -92143,6 +93328,13 @@ function registerAcpWebSocket({
       // with empty dropdowns until the agent happened to mention something would
       // look broken for as long as nothing did.
       configOptions: [...info.configOptions],
+      // Who owns the mode selector, and what the policy is set to — on attach for
+      // the same reason `configOptions` is: a composer whose mode pill appeared
+      // only once something changed would look broken for as long as nothing did.
+      modeOwner: modeOwnerOf(info),
+      lumemMode: info.lumemMode,
+      lumemModeDefault: info.lumemModeDefault,
+      cwd: info.cwd,
       transcript: [...acpManager.transcript(sessionId)]
     });
     const offEvent = acpManager.onEvent(
@@ -92177,6 +93369,10 @@ function registerAcpWebSocket({
           });
           return;
         }
+        if (message.type === "set_lumem_mode") {
+          acpManager.setLumemMode(sessionId, message.mode);
+          return;
+        }
         acpManager.respondToPermission(sessionId, message.requestId, message.optionId);
       } catch (error40) {
         reportFailure(error40, message.type);
@@ -92205,8 +93401,8 @@ function registerAcpWebSocket({
   });
   app.addHook("onClose", async () => {
     for (const client2 of wss.clients) client2.close(CLOSE_GOING_AWAY, "daemon shutting down");
-    await new Promise((resolve5) => {
-      wss.close(() => resolve5());
+    await new Promise((resolve6) => {
+      wss.close(() => resolve6());
     });
   });
 }
@@ -92599,8 +93795,8 @@ function registerPtyWebSocket({
   });
   app.addHook("onClose", async () => {
     for (const client2 of wss.clients) client2.close(CLOSE_GOING_AWAY2, "daemon shutting down");
-    await new Promise((resolve5) => {
-      wss.close(() => resolve5());
+    await new Promise((resolve6) => {
+      wss.close(() => resolve6());
     });
   });
 }
@@ -92608,12 +93804,12 @@ function registerPtyWebSocket({
 // src/web/static.ts
 var import_static = __toESM(require_static(), 1);
 import { existsSync as existsSync4 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var DAEMON_PREFIXES = ["/trpc", "/pty", "/acp", "/memory"];
 function resolveWebRoot(override = null) {
   const candidate = override ?? fileURLToPath2(new URL("../web/", import.meta.url));
-  return existsSync4(join15(candidate, "index.html")) ? candidate : null;
+  return existsSync4(join16(candidate, "index.html")) ? candidate : null;
 }
 var IMMUTABLE = "public, max-age=31536000, immutable";
 var REVALIDATE = "no-cache";
@@ -93276,14 +94472,305 @@ var memoryRouter = router({
   )
 });
 
+// src/pr/view.ts
+var GROUP_ORDER = { failed: 0, running: 1, passed: 2, skipped: 3 };
+function durationOf(check3) {
+  if (check3.startedAt === null) return null;
+  const start = Date.parse(check3.startedAt);
+  const end = check3.completedAt === null ? Date.now() : Date.parse(check3.completedAt);
+  if (Number.isNaN(start) || Number.isNaN(end)) return null;
+  return Math.max(0, end - start);
+}
+function checkViewOf(check3, host) {
+  return {
+    name: check3.name,
+    app: check3.app,
+    group: groupOf(check3),
+    url: safeUrl(check3.url, host),
+    durationMs: durationOf(check3)
+  };
+}
+function viewOf({ pull, host, alsoOpen }) {
+  const { verdict, reason } = decide2(pull);
+  const checks = pull.checks.map((check3) => checkViewOf(check3, host)).sort((a, b) => GROUP_ORDER[a.group] - GROUP_ORDER[b.group]);
+  return {
+    number: pull.number,
+    url: safeUrl(pull.url, host),
+    title: pull.title,
+    verdict,
+    reason,
+    counts: countChecks(pull.checks),
+    checks,
+    base: pull.baseRefName,
+    head: pull.headRefName,
+    updatedAt: pull.updatedAt,
+    author: pull.author,
+    alsoOpen
+  };
+}
+var CLOSED_PR_MAX_AGE_DAYS = 30;
+function pickForBranch(pulls, branch, now = Date.now()) {
+  const mine = pulls.filter((pull) => pull.headRefName === branch);
+  if (mine.length === 0) return null;
+  const open = mine.filter((pull) => pull.state.toUpperCase() === "OPEN");
+  const recent = (pull) => {
+    const at = Date.parse(pull.updatedAt);
+    if (Number.isNaN(at)) return false;
+    return now - at <= CLOSED_PR_MAX_AGE_DAYS * 24 * 60 * 60 * 1e3;
+  };
+  const byUpdated = (a, b) => Date.parse(b.updatedAt) - Date.parse(a.updatedAt);
+  if (open.length > 0) {
+    const [first2] = [...open].sort(byUpdated);
+    return { pull: first2, alsoOpen: open.length - 1 };
+  }
+  const closed = mine.filter(recent).sort(byUpdated);
+  const [first] = closed;
+  return first === void 0 ? null : { pull: first, alsoOpen: 0 };
+}
+
+// src/routers/pr.ts
+var worktreeInput = external_exports.object({ worktreeId: external_exports.string().min(1) });
+var projectInput = external_exports.object({ projectId: external_exports.string().min(1) });
+var strategySchema = external_exports.enum(["merge", "squash", "rebase"]);
+async function remoteOf(ctx, project2) {
+  return project2.remoteUrl ?? await ctx.git.getRemoteUrl(project2.path);
+}
+async function checkoutOf(ctx, worktreeId) {
+  const worktree2 = await createWorktreeRepository(ctx.db).findById(worktreeId);
+  if (!worktree2) throw new DomainError("NOT_FOUND", `worktree ${worktreeId} n\xE3o existe`);
+  if (worktree2.state === "missing") {
+    throw new DomainError("BLOCKED", `a worktree "${worktree2.name}" n\xE3o est\xE1 no disco`);
+  }
+  const project2 = await createProjectRepository(ctx.db).findById(worktree2.projectId);
+  if (!project2) {
+    throw new DomainError("NOT_FOUND", `projeto ${worktree2.projectId} n\xE3o existe`);
+  }
+  return {
+    project: { id: project2.id, path: project2.path, remoteUrl: await remoteOf(ctx, project2) },
+    branch: worktree2.branch,
+    base: project2.defaultBranch,
+    cwd: worktree2.path
+  };
+}
+function failureViewOf(entry) {
+  if (entry.failure === null) return null;
+  return {
+    kind: entry.failure.kind,
+    message: entry.failure.message,
+    retryAt: entry.failure.retryAt ?? null
+  };
+}
+var NO_MERGE_OPTIONS = {
+  merge: false,
+  squash: false,
+  rebase: false,
+  deleteBranchOnMerge: false
+};
+var prRouter = router({
+  /**
+   * A barra, inteira, numa leitura só.
+   *
+   * Ela precisa de sete coisas que vêm de três lugares — o host, o git local e
+   * o banco —, e pedi-las em três chamadas daria três respostas de instantes
+   * diferentes na mesma barra.
+   */
+  getByWorktree: publicProcedure.input(worktreeInput).query(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const checkout = await checkoutOf(ctx, input.worktreeId);
+      const [entry, published] = await Promise.all([
+        ctx.pr.get(checkout.project),
+        // Barato e local: lê a referência de rastreamento do disco. É o que
+        // separa "sem pull request" de "branch não publicada" — as duas neutras,
+        // e dizer a errada manda a pessoa procurar uma PR que não podia existir.
+        ctx.git.hasRemoteBranch(checkout.cwd, checkout.branch)
+      ]);
+      const snapshot = entry.snapshot;
+      const host = snapshot?.host ?? null;
+      const picked = snapshot === null ? null : pickForBranch(snapshot.pulls, checkout.branch);
+      return {
+        pull: picked === null ? null : viewOf({ pull: picked.pull, host, alsoOpen: picked.alsoOpen }),
+        failure: failureViewOf(entry),
+        readAt: entry.readAt,
+        host,
+        branch: checkout.branch,
+        base: checkout.base,
+        published,
+        compareUrl: snapshot === null ? null : compareUrl({
+          host,
+          repo: snapshot.repo,
+          base: checkout.base,
+          head: checkout.branch
+        }),
+        merge: snapshot?.merge ?? NO_MERGE_OPTIONS
+      };
+    })
+  ),
+  /**
+   * Os marcadores da sidebar, num pedido só.
+   *
+   * F3.1 e F3.3: N worktrees não fazem N consultas, e a cor sai do **mesmo**
+   * veredito da barra. Worktree sem PR não entra na lista — marcador cinza em
+   * cinco linhas ensina o olho a ignorar a coluna inteira (Q9).
+   */
+  listByProject: publicProcedure.input(projectInput).query(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const project2 = await createProjectRepository(ctx.db).findById(input.projectId);
+      if (!project2) throw new DomainError("NOT_FOUND", `projeto ${input.projectId} n\xE3o existe`);
+      const entry = await ctx.pr.get({
+        id: project2.id,
+        path: project2.path,
+        remoteUrl: await remoteOf(ctx, project2)
+      });
+      const snapshot = entry.snapshot;
+      if (snapshot === null) return [];
+      const worktrees = await createWorktreeRepository(ctx.db).listByProject(project2.id);
+      return worktrees.flatMap((worktree2) => {
+        const picked = pickForBranch(snapshot.pulls, worktree2.branch);
+        if (picked === null) return [];
+        const view = viewOf({ pull: picked.pull, host: snapshot.host, alsoOpen: picked.alsoOpen });
+        return [{ worktreeId: worktree2.id, number: view.number, verdict: view.verdict }];
+      });
+    })
+  ),
+  /**
+   * F7 — mesclar.
+   *
+   * O portão é o veredito, e ele é **relido aqui** (F7.2). Recusar só na tela
+   * seria conforto: quem garante é a procedure, e o teste que a prova chama
+   * daqui, sem passar pelo botão.
+   */
+  merge: publicProcedure.input(worktreeInput.extend({ strategy: strategySchema, deleteBranch: external_exports.boolean() })).mutation(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const checkout = await checkoutOf(ctx, input.worktreeId);
+      ctx.pr.invalidate(checkout.project.id);
+      const entry = await ctx.pr.get(checkout.project);
+      const snapshot = entry.snapshot;
+      if (entry.failure !== null) {
+        throw new DomainError(
+          "BLOCKED",
+          `n\xE3o deu para confirmar o estado da pull request: ${entry.failure.message}`
+        );
+      }
+      if (snapshot === null) {
+        throw new DomainError("BLOCKED", "n\xE3o deu para ler o estado da pull request");
+      }
+      const picked = pickForBranch(snapshot.pulls, checkout.branch);
+      if (picked === null) {
+        throw new DomainError("NOT_FOUND", "esta worktree n\xE3o tem pull request");
+      }
+      const view = viewOf({ pull: picked.pull, host: snapshot.host, alsoOpen: picked.alsoOpen });
+      if (view.verdict !== "ready") {
+        throw new DomainError(
+          "BLOCKED",
+          `a pull request #${String(view.number)} n\xE3o est\xE1 pronta para merge`
+        );
+      }
+      if (!allows(snapshot.merge, input.strategy)) {
+        throw new DomainError(
+          "BLOCKED",
+          `o reposit\xF3rio n\xE3o permite merge por ${input.strategy}`
+        );
+      }
+      const write = await ctx.prHost.merge({
+        repoPath: checkout.cwd,
+        remoteUrl: checkout.project.remoteUrl,
+        // Do cache do daemon, **nunca** do cliente (§4.2.12 do PRD).
+        number: view.number,
+        strategy: input.strategy,
+        deleteBranch: input.deleteBranch
+      });
+      if (!write.ok) throw new DomainError("GIT_FAILED", write.failure.message);
+      ctx.pr.invalidate(checkout.project.id);
+      ctx.events.emit({ type: "worktree.changed", projectId: checkout.project.id });
+      return { number: view.number };
+    })
+  ),
+  /**
+   * O que o formulário propõe, e por que ele não é um campo do `PrStatus`.
+   *
+   * A [Q4](../../../../docs/prd/pull-request-status/open-questions.md) e a F7.6
+   * pedem título vindo do assunto do último commit. Isso custa um `git log`, e
+   * só interessa quando o formulário abre — dentro do `PrStatus` seria um
+   * processo git a cada ciclo de poll, por worktree aberta.
+   */
+  draft: publicProcedure.input(worktreeInput).query(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const checkout = await checkoutOf(ctx, input.worktreeId);
+      return {
+        title: await ctx.git.getSubject(checkout.cwd) ?? "",
+        base: checkout.base,
+        head: checkout.branch
+      };
+    })
+  ),
+  /**
+   * F7 — criar.
+   *
+   * Título e corpo vêm da tela, que é o que o §4.2 do PRD existe para aguentar.
+   * A base e a head **não** vêm: elas saem do banco e do git local.
+   */
+  create: publicProcedure.input(
+    worktreeInput.extend({
+      title: external_exports.string().min(1).max(256),
+      body: external_exports.string().max(6e4),
+      draft: external_exports.boolean()
+    })
+  ).mutation(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const checkout = await checkoutOf(ctx, input.worktreeId);
+      const published = await ctx.git.hasRemoteBranch(checkout.cwd, checkout.branch);
+      if (!published) {
+        throw new DomainError(
+          "BLOCKED",
+          `a branch "${checkout.branch}" ainda n\xE3o foi publicada`
+        );
+      }
+      const write = await ctx.prHost.create({
+        repoPath: checkout.cwd,
+        remoteUrl: checkout.project.remoteUrl,
+        base: checkout.base,
+        head: checkout.branch,
+        title: input.title,
+        body: input.body,
+        draft: input.draft
+      });
+      if (!write.ok) throw new DomainError("GIT_FAILED", write.failure.message);
+      ctx.pr.invalidate(checkout.project.id);
+      ctx.events.emit({ type: "worktree.changed", projectId: checkout.project.id });
+      return { url: write.url };
+    })
+  ),
+  /**
+   * "Tentar de novo", e o `⟳` da coluna. Não escreve nada; só invalida.
+   *
+   * A entrada é o **escopo**, e não o id do projeto, porque o escopo é o que o
+   * cliente sabe **na hora do clique** — o projeto de uma worktree chega uma
+   * consulta depois. Pedir o projeto fazia o botão não fazer nada quando o
+   * clique vinha cedo, que é exatamente quando alguém clica em recarregar.
+   */
+  refresh: publicProcedure.input(external_exports.object({ scopeType: external_exports.enum(["project", "worktree"]), scopeId: external_exports.string().min(1) })).mutation(
+    ({ ctx, input }) => domainSafeAsync(async () => {
+      const projectId = input.scopeType === "project" ? input.scopeId : (await createWorktreeRepository(ctx.db).findById(input.scopeId))?.projectId ?? null;
+      if (projectId === null) {
+        throw new DomainError("NOT_FOUND", `worktree ${input.scopeId} n\xE3o existe`);
+      }
+      ctx.pr.invalidate(projectId);
+      return { ok: true };
+    })
+  )
+});
+function allows(options, strategy) {
+  return options[strategy];
+}
+
 // src/routers/project.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { rename as rename4, rm as rm6 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname11, isAbsolute as isAbsolute5, normalize as normalize4 } from "node:path";
+import { rename as rename4, rm as rm7 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname11, isAbsolute as isAbsolute6, normalize as normalize4 } from "node:path";
 
 // src/git/clone.ts
 import { spawn as spawn2 } from "node:child_process";
-import { rename as rename3, rm as rm4 } from "node:fs/promises";
+import { rename as rename3, rm as rm5 } from "node:fs/promises";
 var CloneError = class extends DomainError {
   constructor(failure, message, options) {
     super(failure === "internal" ? "BLOCKED" : "GIT_FAILED", message, options);
@@ -93304,7 +94791,7 @@ async function cloneRepository(options) {
     await rename3(tempPath, finalTarget);
     return finalTarget;
   } catch (error40) {
-    await rm4(tempPath, { recursive: true, force: true }).catch(() => {
+    await rm5(tempPath, { recursive: true, force: true }).catch(() => {
     });
     throw error40;
   }
@@ -93348,7 +94835,7 @@ function runClone({
   silenceMs = DEFAULT_SILENCE_MS,
   env
 }) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn2("git", cloneArgs(rawUrl, tempPath), {
       env: cloneEnv(env),
       stdio: ["ignore", "ignore", "pipe"]
@@ -93371,7 +94858,7 @@ function runClone({
       silence.stop();
       signal?.removeEventListener("abort", onAbort);
       if (error40) reject(error40);
-      else resolve5();
+      else resolve6();
     }
     function onAbort() {
       finish(new CloneError("internal", "clone cancelado"));
@@ -93402,7 +94889,7 @@ function runClone({
       if (killTimer) clearTimeout(killTimer);
       if (code === 0) return finish();
       const stderr = errors.text();
-      finish(new CloneError(classify(stderr), lastMeaningfulLine(stderr) || `git saiu com ${code}`));
+      finish(new CloneError(classify2(stderr), lastMeaningfulLine(stderr) || `git saiu com ${code}`));
     });
   });
 }
@@ -93410,7 +94897,7 @@ async function rewriteOrigin({ rawUrl, url: url2, tempPath }) {
   if (rawUrl === url2) return;
   await execGit(["remote", "set-url", "origin", url2], { cwd: tempPath });
 }
-function classify(stderr) {
+function classify2(stderr) {
   if (/authentication failed|could not read username|could not read password|invalid username or password|permission denied \(publickey|terminal prompts disabled|host key verification failed/i.test(
     stderr
   )) {
@@ -93509,134 +94996,7 @@ var SilenceTimer = class {
 
 // src/git/clone-plan.ts
 import { homedir } from "node:os";
-import { dirname as dirname9, join as join16, normalize as normalize3 } from "node:path";
-
-// src/git/git-url.ts
-var ALLOWED = /* @__PURE__ */ new Set(["https", "http", "ssh", "file"]);
-var HELPER = /^([A-Za-z][A-Za-z0-9+.-]*)::/;
-var SCHEME = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//;
-var CONTROL = /[\u0000-\u001f\u007f]/;
-function refuse(rule, message) {
-  return { ok: false, rule, message };
-}
-function refuseScheme(scheme) {
-  if (scheme === "git") {
-    return refuse(
-      "scheme",
-      "o transporte git:// n\xE3o \xE9 aceito: ele n\xE3o autentica nem verifica integridade \u2014 use a URL https ou ssh do mesmo reposit\xF3rio"
-    );
-  }
-  return refuse(
-    "scheme",
-    `o transporte "${scheme}" n\xE3o est\xE1 na lista de transportes aceitos (https, http, ssh, file)`
-  );
-}
-function parseGitUrl(input) {
-  const raw = input.trim();
-  if (raw === "") return refuse("empty", "informe a URL do reposit\xF3rio");
-  if (CONTROL.test(raw)) {
-    return refuse("control-chars", "a URL tem caracteres de controle");
-  }
-  if (raw.startsWith("-")) {
-    return refuse("leading-dash", "a URL n\xE3o pode come\xE7ar com '-'");
-  }
-  const helper = HELPER.exec(raw);
-  if (helper) return refuseScheme(helper[1].toLowerCase());
-  const scheme = SCHEME.exec(raw);
-  if (scheme) return parseWithScheme(raw, scheme[1].toLowerCase());
-  if (isScp(raw)) return parseScp(raw);
-  return refuse(
-    "scheme",
-    "n\xE3o reconheci isto como URL git: use https://, ssh://, file:// ou a forma git@host:org/repo.git"
-  );
-}
-function scpColon(raw) {
-  const at = raw.indexOf("@");
-  return raw.indexOf(":", at === -1 ? 0 : at + 1);
-}
-function isScp(raw) {
-  const colon = scpColon(raw);
-  if (colon <= 0) return false;
-  const slash = raw.indexOf("/");
-  return slash === -1 || colon < slash;
-}
-function parseWithScheme(raw, scheme) {
-  if (!ALLOWED.has(scheme)) return refuseScheme(scheme);
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return refuse("host", `n\xE3o consegui ler ${raw} como URL`);
-  }
-  if (scheme === "file") return parseFile(raw, parsed);
-  if (parsed.hostname === "" || raw.slice(scheme.length + "://".length).startsWith("/")) {
-    return refuse("host", "a URL n\xE3o tem host");
-  }
-  const path = parsed.pathname.replace(/^\/+/, "");
-  if (path === "") {
-    return refuse("path", "a URL n\xE3o diz qual reposit\xF3rio");
-  }
-  const sanitized = new URL(raw);
-  sanitized.username = "";
-  sanitized.password = "";
-  return {
-    ok: true,
-    raw,
-    url: {
-      scheme,
-      href: sanitized.href,
-      host: parsed.host,
-      path,
-      insecure: scheme === "http",
-      scp: false
-    }
-  };
-}
-function parseFile(raw, parsed) {
-  if (parsed.hostname !== "" && parsed.hostname !== "localhost") {
-    return refuse("host", "file:// com host n\xE3o \xE9 aceito; use file:///caminho/absoluto");
-  }
-  const path = decodeURIComponent(parsed.pathname);
-  if (!path.startsWith("/")) {
-    return refuse("path", "o caminho de um file:// precisa ser absoluto");
-  }
-  return {
-    ok: true,
-    raw,
-    url: { scheme: "file", href: `file://${parsed.pathname}`, host: "", path, insecure: false, scp: false }
-  };
-}
-function parseScp(raw) {
-  const colon = scpColon(raw);
-  const authority = raw.slice(0, colon);
-  const path = raw.slice(colon + 1);
-  const at = authority.lastIndexOf("@");
-  const user = at === -1 ? "" : authority.slice(0, at);
-  const host = authority.slice(at + 1);
-  if (host === "") return refuse("host", "a URL n\xE3o tem host");
-  if (path === "") return refuse("path", "a URL n\xE3o diz qual reposit\xF3rio");
-  const cleanUser = user.includes(":") ? user.slice(0, user.indexOf(":")) : user;
-  const prefix = cleanUser === "" ? "" : `${cleanUser}@`;
-  return {
-    ok: true,
-    raw,
-    url: {
-      scheme: "ssh",
-      href: `${prefix}${host}:${path}`,
-      host,
-      path: path.replace(/^\/+/, ""),
-      insecure: false,
-      scp: true
-    }
-  };
-}
-function repoNameOf(url2) {
-  const segments = url2.path.split("/").filter((segment) => segment !== "");
-  const last = segments.at(-1) ?? "";
-  return last.endsWith(".git") ? last.slice(0, -".git".length) : last;
-}
-
-// src/git/clone-plan.ts
+import { dirname as dirname9, join as join17, normalize as normalize3 } from "node:path";
 function planClone({
   source,
   workspacesDir,
@@ -93667,11 +95027,11 @@ function rawUrlOf(source) {
   return parsed.ok ? parsed.raw : null;
 }
 function tempCloneDir(target, jobId) {
-  return join16(dirname9(target), `.lumem-clone-${jobId}`);
+  return join17(dirname9(target), `.lumem-clone-${jobId}`);
 }
 
 // src/git/managed-dir.ts
-import { lstat as lstat4, readdir as readdir6, realpath as realpath5, rm as rm5, rmdir as rmdir2 } from "node:fs/promises";
+import { lstat as lstat4, readdir as readdir6, realpath as realpath5, rm as rm6, rmdir as rmdir2 } from "node:fs/promises";
 import { dirname as dirname10 } from "node:path";
 async function deleteManagedRepo({ path, workspacesDir }) {
   let info;
@@ -93688,7 +95048,7 @@ async function deleteManagedRepo({ path, workspacesDir }) {
     );
   }
   await requireInsideTree(path, workspacesDir);
-  await rm5(path, { recursive: true, force: true });
+  await rm6(path, { recursive: true, force: true });
 }
 async function collectEmptyProjectHome(home, workspacesDir) {
   await requireInsideTree(home, workspacesDir).catch(() => {
@@ -93752,7 +95112,7 @@ async function resolveAvailableName(ctx, workspaceId, desired) {
     if (!taken.has(candidate)) return candidate;
   }
 }
-var pathSchema = external_exports.string().trim().min(1, "informe o caminho do reposit\xF3rio").refine((value) => isAbsolute5(value), "o caminho precisa ser absoluto").transform((value) => normalize4(value));
+var pathSchema = external_exports.string().trim().min(1, "informe o caminho do reposit\xF3rio").refine((value) => isAbsolute6(value), "o caminho precisa ser absoluto").transform((value) => normalize4(value));
 var projectRouter = router({
   listByWorkspace: publicProcedure.input(external_exports.object({ workspaceId: external_exports.string().min(1) })).query(async ({ ctx, input }) => {
     const rows = await createProjectRepository(ctx.db).listByWorkspace(input.workspaceId);
@@ -93813,7 +95173,7 @@ var projectRouter = router({
         registerProject(ctx, {
           workspaceId: input.workspaceId,
           path: input.path,
-          name: input.name ?? basename3(input.path)
+          name: input.name ?? basename4(input.path)
         })
       )
     )
@@ -93827,23 +95187,27 @@ var projectRouter = router({
   ),
   remove: publicProcedure.input(external_exports.object({ id: external_exports.string().min(1) })).mutation(
     ({ ctx, input }) => domainSafeAsync(async () => {
-      const running = await ctx.sessionStore.listRunningInScope("project", input.id);
-      if (running.length > 0) {
+      const projects = createProjectRepository(ctx.db);
+      const worktrees = createWorktreeRepository(ctx.db);
+      const row = await projects.findById(input.id);
+      const owned = await worktrees.listByProject(input.id);
+      const vanishing = row?.managed === true ? [] : owned;
+      const runningLists = await Promise.all([
+        ctx.sessionStore.listRunningInScope("project", input.id),
+        ...vanishing.map((wt) => ctx.sessionStore.listRunningInScope("worktree", wt.id))
+      ]);
+      const running = runningLists.reduce((total, list) => total + list.length, 0);
+      if (running > 0) {
         throw new DomainError(
           "BLOCKED",
-          `o projeto tem ${running.length} sess\xE3o(\xF5es) rodando; encerre-as antes de remover`
+          `o projeto tem ${running} sess\xE3o(\xF5es) rodando; encerre-as antes de remover`
         );
       }
-      const projects = createProjectRepository(ctx.db);
-      const row = await projects.findById(input.id);
-      if (row) {
-        const worktrees = await createWorktreeRepository(ctx.db).listByProject(row.id);
-        if (worktrees.length > 0) {
-          throw new DomainError(
-            "IN_USE",
-            `o projeto ainda tem worktrees registradas (${worktrees.length}); remova-as antes`
-          );
-        }
+      if (row?.managed && owned.length > 0) {
+        throw new DomainError(
+          "IN_USE",
+          `o projeto ainda tem worktrees registradas (${owned.length}); remova-as antes`
+        );
       }
       if (row) {
         if (row.managed) {
@@ -93855,7 +95219,11 @@ var projectRouter = router({
         ).catch(() => false);
       }
       await projects.remove(input.id);
-      if (row) ctx.events.emit({ type: "project.changed", workspaceId: row.workspaceId });
+      if (row) {
+        ctx.events.emit({ type: "project.changed", workspaceId: row.workspaceId });
+        if (vanishing.length > 0)
+          ctx.events.emit({ type: "worktree.changed", projectId: input.id });
+      }
       return { ok: true };
     })
   ),
@@ -93983,7 +95351,7 @@ async function runCloneJob(ctx, job, { rawUrl, url: url2, name }) {
       finalName === name ? void 0 : `o nome ${name} j\xE1 existia; registrado como ${finalName}`
     );
   } catch (error40) {
-    if (landed !== null) await rm6(landed, { recursive: true, force: true }).catch(() => {
+    if (landed !== null) await rm7(landed, { recursive: true, force: true }).catch(() => {
     });
     await sweep();
     if (ctx.clones.get(job.id)?.state === "cancelled") return;
@@ -94248,24 +95616,24 @@ var sessionRouter = router({
 
 // src/routers/setup.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // src/setup/run-command.ts
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 var DEFAULT_VERSION_TIMEOUT_MS = 3e3;
-var runCommand = (command, args, { timeoutMs = DEFAULT_VERSION_TIMEOUT_MS } = {}) => new Promise((resolve5) => {
-  execFile2(
+var runCommand = (command, args, { timeoutMs = DEFAULT_VERSION_TIMEOUT_MS } = {}) => new Promise((resolve6) => {
+  execFile3(
     command,
     [...args],
     { timeout: timeoutMs, maxBuffer: 1024 * 1024 },
     (error40, stdout, stderr) => {
       const output = (stdout.trim() !== "" ? stdout : stderr).trim();
       if (error40 === null) {
-        resolve5({ ok: true, output, failure: null });
+        resolve6({ ok: true, output, failure: null });
         return;
       }
       const killed = error40.killed === true;
-      resolve5({
+      resolve6({
         ok: false,
         output,
         failure: killed ? `n\xE3o respondeu em ${timeoutMs} ms` : error40.message
@@ -94303,42 +95671,86 @@ async function detectAgents({
   path = process.env["PATH"],
   env = process.env,
   run: run3 = runCommand,
+  specs = ADAPTERS,
   installedAt
 } = {}) {
-  const [claude, adapter] = await Promise.all([
-    inspect(CLAUDE_CLI_COMMAND, null, { path, run: run3 }),
-    inspect(ACP_ADAPTER_COMMAND, ACP_ADAPTER_INSTALL, { path, run: run3, preferred: installedAt })
+  const adapters = await Promise.all(
+    specs.map(async (spec) => reportFor(spec, { path, env, run: run3, installedAt }))
+  );
+  return { adapters };
+}
+async function reportFor(spec, {
+  path,
+  env,
+  run: run3,
+  installedAt
+}) {
+  const [adapter, cli] = await Promise.all([
+    inspect(spec.command, adapterInstallCommand(spec), {
+      path,
+      run: run3,
+      ...installedAt === void 0 ? {} : { preferred: installedAt(spec) }
+    }),
+    spec.cli === null ? Promise.resolve(null) : inspect(spec.cli.command, spec.cli.install, { path, run: run3 })
   ]);
-  const key = env[ANTHROPIC_API_KEY_ENV];
-  return { claude, adapter, apiKeyInEnv: key !== void 0 && key.trim() !== "" };
+  return {
+    id: spec.id,
+    label: spec.label,
+    adapter,
+    cli,
+    apiKeyEnv: spec.apiKeyEnv.find((name) => (env[name] ?? "").trim() !== "") ?? null
+  };
 }
 
 // src/setup/install-adapter.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { mkdir as mkdir8 } from "node:fs/promises";
-import { join as join17 } from "node:path";
-function adapterBinaryPath(dir) {
-  return join17(dir, "node_modules", ".bin", ACP_ADAPTER_COMMAND);
+import { join as join18 } from "node:path";
+function adapterDir(dir, spec = CLAUDE_ADAPTER) {
+  return join18(dir, spec.id);
+}
+function adapterBinaryPath(dir, spec = CLAUDE_ADAPTER) {
+  return join18(adapterDir(dir, spec), "node_modules", ".bin", spec.command);
+}
+function legacyAdapterBinaryPath(dir, spec) {
+  return join18(dir, "node_modules", ".bin", spec.command);
 }
 async function installAdapter({
+  spec = CLAUDE_ADAPTER,
   dir,
   run: run3 = runCommand,
-  timeoutMs = 12e4
+  timeoutMs = 12e4,
+  resolve: resolve6 = resolveCommandPath
 }) {
-  const binary = adapterBinaryPath(dir);
+  if (spec.package === null) {
+    const found = resolve6(spec.command);
+    if (found === null) {
+      throw new DomainError(
+        "NOT_FOUND",
+        `${spec.label} n\xE3o tem adaptador para instalar: o bin\xE1rio ${spec.command} tem que estar no PATH, e n\xE3o est\xE1`
+      );
+    }
+    return { path: found, version: spec.pinnedVersion, alreadyInstalled: true };
+  }
+  const target = adapterDir(dir, spec);
+  const binary = adapterBinaryPath(dir, spec);
   if (existsSync6(binary)) {
-    return { path: binary, version: ACP_ADAPTER_PINNED_VERSION, alreadyInstalled: true };
+    return { path: binary, version: spec.pinnedVersion, alreadyInstalled: true };
+  }
+  const legacy = legacyAdapterBinaryPath(dir, spec);
+  if (existsSync6(legacy)) {
+    return { path: legacy, version: spec.pinnedVersion, alreadyInstalled: true };
   }
-  await mkdir8(dir, { recursive: true });
+  await mkdir8(target, { recursive: true });
   const outcome = await run3(
     "npm",
     [
       "install",
       "--prefix",
-      dir,
+      target,
       "--no-fund",
       "--no-audit",
-      `${ACP_ADAPTER_PACKAGE}@${ACP_ADAPTER_PINNED_VERSION}`
+      `${spec.package}@${spec.pinnedVersion}`
     ],
     { timeoutMs }
   );
@@ -94355,10 +95767,10 @@ ${outcome.output}`.trim()
   if (!existsSync6(binary)) {
     throw new DomainError(
       "SPAWN_FAILED",
-      `o npm terminou sem erro mas ${binary} n\xE3o existe \u2014 o pacote ${ACP_ADAPTER_PACKAGE} pode ter mudado de layout`
+      `o npm terminou sem erro mas ${binary} n\xE3o existe \u2014 o pacote ${spec.package} pode ter mudado de layout`
     );
   }
-  return { path: binary, version: ACP_ADAPTER_PINNED_VERSION, alreadyInstalled: false };
+  return { path: binary, version: spec.pinnedVersion, alreadyInstalled: false };
 }
 
 // src/setup/login.ts
@@ -94553,6 +95965,17 @@ function diskCheck(config2, freeBytes) {
 }
 
 // src/routers/setup.ts
+function adaptersDir(stateDir) {
+  return join19(stateDir, ADAPTERS_DIR_NAME);
+}
+function specOf(id) {
+  const spec = adapterById(id ?? DEFAULT_ADAPTER_ID);
+  if (spec === null) {
+    throw new DomainError("INVALID_ARGUMENT", `n\xE3o existe adaptador "${id}" no cat\xE1logo`);
+  }
+  return spec;
+}
+var adapterInput = external_exports.object({ adapterId: external_exports.string().trim().min(1).optional() }).optional();
 var setupRouter = router({
   /** The five checks, each one able to fail without the others. */
   preflight: publicProcedure.query(({ ctx }) => preflight({ config: ctx.config })),
@@ -94564,7 +95987,9 @@ var setupRouter = router({
    * have it globally, and the flow must not ask twice for the same thing.
    */
   agents: publicProcedure.query(
-    ({ ctx }) => detectAgents({ installedAt: adapterBinaryPath(join18(ctx.config.stateDir, ADAPTERS_DIR_NAME)) })
+    ({ ctx }) => detectAgents({
+      installedAt: (spec) => adapterBinaryPath(adaptersDir(ctx.config.stateDir), spec)
+    })
   ),
   /**
    * Installs the adapter into the daemon's own directory, at the pinned version.
@@ -94573,9 +95998,9 @@ var setupRouter = router({
    * costs is named in `install-adapter.ts` — the daemon runs a package manager and
    * then executes what it downloaded.
    */
-  installAdapter: publicProcedure.mutation(
-    ({ ctx }) => domainSafeAsync(
-      () => installAdapter({ dir: join18(ctx.config.stateDir, ADAPTERS_DIR_NAME) })
+  installAdapter: publicProcedure.input(adapterInput).mutation(
+    ({ ctx, input }) => domainSafeAsync(
+      () => installAdapter({ spec: specOf(input?.adapterId), dir: adaptersDir(ctx.config.stateDir) })
     )
   ),
   /**
@@ -94591,6 +96016,8 @@ var setupRouter = router({
       methodId: external_exports.string().trim().min(1),
       /** Which adapter to ask. Defaults to what the flow installed or found. */
       command: external_exports.string().trim().min(1).optional(),
+      /** Which catalogued adapter, when no explicit command is given. */
+      adapterId: external_exports.string().trim().min(1).optional(),
       /**
        * And its arguments, because a command without them is a different program.
        *
@@ -94603,8 +96030,8 @@ var setupRouter = router({
     })
   ).mutation(
     ({ ctx, input }) => domainSafeAsync(async () => {
-      const command = input.command ?? ACP_ADAPTER_COMMAND;
-      const cwd = join18(ctx.config.stateDir, "probe");
+      const command = input.command ?? specOf(input.adapterId).command;
+      const cwd = join19(ctx.config.stateDir, "probe");
       const report = await ctx.acpManager.probe({
         command,
         ...input.args === void 0 ? {} : { args: input.args },
@@ -94633,6 +96060,60 @@ var setupRouter = router({
       });
     })
   ),
+  /**
+   * Entrar no agente, pela chamada que o próprio agente ofereceu (T10, T11).
+   *
+   * Três procedimentos e nenhum bloqueante, porque um deles espera **uma
+   * pessoa**: o `authenticate` de um método de navegador fica pendurado até
+   * alguém autorizar noutro lugar, e o pedido de mostrar uma URL chega no meio
+   * dessa espera. Começar e perguntar é o mesmo desenho do login por comando, que
+   * devolvia um `ptySessionId` para o cliente acompanhar.
+   *
+   * O `command` continua sendo conferido contra o handshake — o cliente manda um
+   * `methodId`, e o que roda é o que o adaptador declarou para aquele id.
+   */
+  authenticate: publicProcedure.input(
+    external_exports.object({
+      methodId: external_exports.string().trim().min(1),
+      /** Qual adaptador, quando não vem um comando explícito. */
+      adapterId: external_exports.string().trim().min(1).optional(),
+      command: external_exports.string().trim().min(1).optional(),
+      args: external_exports.array(external_exports.string()).optional(),
+      /**
+       * A chave, quando o método pede uma.
+       *
+       * Ela entra por aqui, atravessa o daemon e vai para o adaptador. Não é
+       * gravada, não é logada e **não volta** em nenhuma resposta — o que volta
+       * é o estado da tentativa.
+       */
+      apiKey: external_exports.string().min(1).optional()
+    })
+  ).mutation(
+    ({ ctx, input }) => domainSafeAsync(() => {
+      const spec = specOf(input.adapterId);
+      const cwd = join19(ctx.config.stateDir, "probe");
+      mkdirSync4(cwd, { recursive: true });
+      return Promise.resolve(
+        ctx.agentAuth.start({
+          command: input.command ?? spec.command,
+          ...input.args === void 0 ? {} : { args: input.args },
+          cwd,
+          methodId: input.methodId,
+          ...input.apiKey === void 0 ? {} : { apiKey: input.apiKey },
+          adapterVersion: spec.pinnedVersion
+        })
+      );
+    })
+  ),
+  /** O estado de uma tentativa de login. É o que a tela pergunta enquanto espera. */
+  authState: publicProcedure.input(external_exports.object({ loginId: external_exports.string().trim().min(1) })).query(({ ctx, input }) => domainSafe(() => ctx.agentAuth.status(input.loginId))),
+  /**
+   * Desistir: mata o adaptador.
+   *
+   * Não há "cancelar" no protocolo — o `authenticate` está esperando uma pessoa,
+   * e a única forma de parar de esperar é o processo acabar. Ele é do daemon.
+   */
+  cancelAuth: publicProcedure.input(external_exports.object({ loginId: external_exports.string().trim().min(1) })).mutation(({ ctx, input }) => domainSafe(() => ctx.agentAuth.cancel(input.loginId))),
   /**
    * One handshake, then the process dies.
    *
@@ -94644,12 +96125,14 @@ var setupRouter = router({
     external_exports.object({
       /** Defaults to the adapter the flow installs. */
       command: external_exports.string().trim().min(1).optional(),
+      /** Which catalogued adapter, when no explicit command is given. */
+      adapterId: external_exports.string().trim().min(1).optional(),
       args: external_exports.array(external_exports.string()).optional()
     }).optional()
   ).query(
     ({ ctx, input }) => domainSafeAsync(async () => {
-      const command = input?.command ?? ACP_ADAPTER_COMMAND;
-      const cwd = join18(ctx.config.stateDir, "probe");
+      const command = input?.command ?? specOf(input?.adapterId).command;
+      const cwd = join19(ctx.config.stateDir, "probe");
       try {
         mkdirSync4(cwd, { recursive: true });
       } catch (error40) {
@@ -94726,6 +96209,32 @@ function usageByWorktree(db, { projectId, period: period2, now }) {
     and(eq(sessionUsage.worktreeId, worktree.id), gte(sessionUsage.createdAt, since))
   ).where(eq(worktree.projectId, projectId)).groupBy(worktree.id).orderBy(sql`${SUM.tokens} desc`, worktree.name).all();
 }
+function usageByProjectAndAgent(db, { workspaceId, period: period2, now }) {
+  const since = windowStart(period2, now);
+  return db.select({
+    projectId: sessionUsage.projectId,
+    agentConfigId: sessionUsage.agentConfigId,
+    // `max` e não `min`: dá no mesmo dentro de um grupo — o join é por id — e
+    // é o mesmo truque que a moeda já usa para atravessar um `GROUP BY`.
+    name: sql`max(${agentConfig.name})`,
+    tokens: SUM.tokens,
+    cost: SUM.cost,
+    currency: SUM.currency,
+    turns: SUM.turns
+  }).from(sessionUsage).innerJoin(project, eq(project.id, sessionUsage.projectId)).leftJoin(agentConfig, eq(agentConfig.id, sessionUsage.agentConfigId)).where(and(eq(project.workspaceId, workspaceId), gte(sessionUsage.createdAt, since))).groupBy(sessionUsage.projectId, sessionUsage.agentConfigId).orderBy(sql`${SUM.tokens} desc`).all();
+}
+function usageByWorktreeAndAgent(db, { projectId, period: period2, now }) {
+  const since = windowStart(period2, now);
+  return db.select({
+    worktreeId: sessionUsage.worktreeId,
+    agentConfigId: sessionUsage.agentConfigId,
+    name: sql`max(${agentConfig.name})`,
+    tokens: SUM.tokens,
+    cost: SUM.cost,
+    currency: SUM.currency,
+    turns: SUM.turns
+  }).from(sessionUsage).leftJoin(agentConfig, eq(agentConfig.id, sessionUsage.agentConfigId)).where(and(eq(sessionUsage.projectId, projectId), gte(sessionUsage.createdAt, since))).groupBy(sessionUsage.worktreeId, sessionUsage.agentConfigId).orderBy(sql`${SUM.tokens} desc`).all();
+}
 function usageOutsideWorktrees(db, { projectId, period: period2, now }) {
   const since = windowStart(period2, now);
   const [row] = db.select({ tokens: SUM.tokens, cost: SUM.cost, currency: SUM.currency, turns: SUM.turns }).from(sessionUsage).where(
@@ -94762,7 +96271,21 @@ var usageRouter = router({
       projectId: input.projectId,
       period: input.period
     })
-  }))
+  })),
+  /*
+   * O mesmo consumo por agente (`second-agent`, F5).
+   *
+   * Procedimentos separados, e não um `groupBy` nos dois de cima: a resposta
+   * agrupada tem uma linha por par, e enfiá-la na mesma chamada mudaria a forma
+   * do que a tela do workspace já lê. A tela só pede isto quando há **mais de um
+   * agente** — com um, a coluna não existe e a chamada não acontece (C5).
+   */
+  byProjectAndAgent: publicProcedure.input(external_exports.object({ workspaceId: external_exports.string().min(1), period })).query(
+    ({ ctx, input }) => usageByProjectAndAgent(ctx.db, { workspaceId: input.workspaceId, period: input.period })
+  ),
+  byWorktreeAndAgent: publicProcedure.input(external_exports.object({ projectId: external_exports.string().min(1), period })).query(
+    ({ ctx, input }) => usageByWorktreeAndAgent(ctx.db, { projectId: input.projectId, period: input.period })
+  )
 });
 
 // src/routers/workspace.ts
@@ -94959,6 +96482,7 @@ var appRouter = router({
   events: eventsRouter,
   files: filesRouter,
   memory: memoryRouter,
+  pr: prRouter,
   project: projectRouter,
   scripts: scriptsRouter,
   session: sessionRouter,
@@ -94989,6 +96513,14 @@ async function createServer2({
   }),
   git = createGitService(),
   clones = createCloneJobStore(),
+  prHost = createGhHost(),
+  pr = createPrCache({
+    host: prHost,
+    // F6.3: a barra não depende só do relógio dela. É o que faz um merge feito
+    // noutra aba aparecer nesta sem esperar o próximo ciclo.
+    onChange: (projectId) => events.emit({ type: "pr.changed", projectId })
+  }),
+  agentAuth = createAgentAuthService({ acpManager }),
   logger = false
 }) {
   const app = (0, import_fastify2.default)({
@@ -95007,6 +96539,9 @@ async function createServer2({
     scripts,
     git,
     clones,
+    pr,
+    prHost,
+    agentAuth,
     events
   });
   await app.register(fastifyTRPCPlugin, {
@@ -95142,6 +96677,7 @@ async function bootstrap({
       askUrl: `http://${config2.host}:${String(config2.port)}/memory/ask`
     })
   });
+  const agentAuth = createAgentAuthService({ acpManager: acp });
   const sessionStore = createSessionStore({
     db: openedDatabase.db,
     ptyManager,
@@ -95204,6 +96740,7 @@ async function bootstrap({
       }
     }),
     events,
+    agentAuth,
     logger
   });
   bootedApp = app;
@@ -95215,6 +96752,7 @@ async function bootstrap({
       stopUsageTracking();
       await ptyManager.killAll();
       await acp.killAll();
+      agentAuth.cancelAll();
       if (beforeClose) await beforeClose();
       await app.close();
       if (owned) openedDatabase.close();
@@ -95253,7 +96791,7 @@ async function bootstrap({
 
 // src/config.ts
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute as isAbsolute6, join as join19, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join20, resolve as resolve5 } from "node:path";
 function readPort(raw) {
   if (raw === void 0 || raw === "") return DEFAULT_SERVER_PORT;
   const trimmed2 = raw.trim();
@@ -95267,22 +96805,22 @@ function readPort(raw) {
   return parsed;
 }
 function absoluteDir(raw) {
-  const expanded = raw === "~" || raw.startsWith("~/") ? join19(homedir2(), raw.slice(1)) : raw;
-  return isAbsolute6(expanded) ? join19(expanded) : resolve4(expanded);
+  const expanded = raw === "~" || raw.startsWith("~/") ? join20(homedir2(), raw.slice(1)) : raw;
+  return isAbsolute7(expanded) ? join20(expanded) : resolve5(expanded);
 }
 function readBudget(raw) {
   if (raw === void 0 || !/^\d+$/.test(raw.trim())) return 3;
   return Number.parseInt(raw.trim(), 10);
 }
 function loadConfig(env = process.env) {
-  const stateDir = absoluteDir(env.LUMEM_STATE_DIR ?? join19(homedir2(), ".lumem"));
+  const stateDir = absoluteDir(env.LUMEM_STATE_DIR ?? join20(homedir2(), ".lumem"));
   return {
     port: readPort(env.LUMEM_PORT),
     host: env.LUMEM_HOST ?? "127.0.0.1",
     stateDir,
-    databasePath: env.LUMEM_DB_PATH ?? join19(stateDir, "lumem.db"),
-    workspacesDir: join19(stateDir, "workspaces"),
-    transcriptsDir: join19(stateDir, "transcripts"),
+    databasePath: env.LUMEM_DB_PATH ?? join20(stateDir, "lumem.db"),
+    workspacesDir: join20(stateDir, "workspaces"),
+    transcriptsDir: join20(stateDir, "transcripts"),
     // /bin/sh exists on every POSIX system this daemon can run on; SHELL is
     // unset under launchd and in some containers.
     shell: env.SHELL === void 0 || env.SHELL === "" ? "/bin/sh" : env.SHELL,