@zixt/host 0.0.118 → 0.0.120

package/dist/index.js

@@ -8,27 +8,27 @@ var __export = (target, all) => {
 };
 
 // src/supervisor.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import { fstatSync } from "node:fs";
 import {
   access as access2,
   lstat as lstat5,
-  mkdir as mkdir5,
+  mkdir as mkdir6,
   open as open4,
   readFile as readFile7,
   readlink,
   readdir as readdir4,
   rename as rename3,
-  rm as rm5,
+  rm as rm6,
   symlink
 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute9, join as join8, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute10, join as join10, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
 
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.118",
+  version: "0.0.120",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -22148,10 +22148,10 @@ async function publishTaskFile(input) {
   if (!roots.some((root) => isWithin(file2, root))) {
     return { ok: false, error: "the file is outside this task workspace" };
   }
-  const stat3 = await lstat(file2);
-  if (!stat3.isFile()) return { ok: false, error: "only regular files can be published" };
-  if (stat3.size < 1) return { ok: false, error: "empty files cannot be published" };
-  if (stat3.size > TASK_ARTIFACT_MAX_BYTES) {
+  const stat4 = await lstat(file2);
+  if (!stat4.isFile()) return { ok: false, error: "only regular files can be published" };
+  if (stat4.size < 1) return { ok: false, error: "empty files cannot be published" };
+  if (stat4.size > TASK_ARTIFACT_MAX_BYTES) {
     return {
       ok: false,
       error: `the file is larger than Zixt's ${TASK_ARTIFACT_MAX_BYTES / 1024 / 1024} MB limit`
@@ -22364,13 +22364,299 @@ function isCommandNotFound(text) {
   return /\bENOENT\b|is not recognized|command not found|no such file/i.test(text);
 }
 
+// src/runners/runner-install.ts
+import { spawn as spawn2 } from "node:child_process";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { isAbsolute as isAbsolute3, join as join3 } from "node:path";
+
+// src/runners/installer-env.ts
+import { dirname, join as join2 } from "node:path";
+function npmCommand(platform = process.platform) {
+  return platform === "win32" ? "npm.cmd" : "npm";
+}
+async function resolveInstallerCommand(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const command = npmCommand(platform);
+  if (platform !== "win32") return command;
+  const execPath = options.execPath ?? process.execPath;
+  const resolution = {
+    platform,
+    ...options.searchPath !== void 0 ? { searchPath: options.searchPath } : {}
+  };
+  return (
+    // npm ships beside the `node` running this process, and that copy is the
+    // one matching it. A per-user Scheduled Task may carry no npm on PATH.
+    await resolveTrustedCliCommand(join2(dirname(execPath), command), resolution) ?? await resolveTrustedCliCommand(command, resolution) ?? // Nothing resolved: keep the previous behaviour, so a Machine without npm
+    // fails one install rather than changing how failure is handled.
+    command
+  );
+}
+function windowsInstallerCommandLine(command, args) {
+  return [command, ...args].map(quoteForCmd).join(" ");
+}
+function sanitizedInstallerEnv(inherited) {
+  const allowed = /* @__PURE__ */ new Set([
+    "PATH",
+    "HOME",
+    "USERPROFILE",
+    "SYSTEMROOT",
+    "WINDIR",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "LOCALAPPDATA",
+    "APPDATA",
+    "XDG_CONFIG_HOME",
+    "XDG_CACHE_HOME",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "ALL_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NPM_CONFIG_REGISTRY",
+    "NPM_CONFIG_CACHE",
+    "NPM_CONFIG_USERCONFIG",
+    "NPM_CONFIG_STRICT_SSL"
+  ]);
+  return Object.fromEntries(
+    Object.entries(inherited).filter(
+      ([name, value]) => value !== void 0 && allowed.has(name.toUpperCase())
+    )
+  );
+}
+
+// src/runners/runner-install.ts
+var CLAUDE_INSTALLER_URL_POSIX = "https://claude.ai/install.sh";
+var CLAUDE_INSTALLER_URL_WINDOWS = "https://claude.ai/install.ps1";
+var CODEX_PACKAGE = "@openai/codex";
+var INSTALL_TIMEOUT_MS = 10 * 6e4;
+var FAILURE_COOLDOWN_MS = 10 * 6e4;
+function defaultRunnerToolsRoot() {
+  return join3(homedir(), ".zixt", "tools");
+}
+function runnerCommandCandidates(type, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir();
+  const toolsRoot = options.toolsRoot ?? defaultRunnerToolsRoot();
+  if (type === "claude-code") return [join3(home, ".local", "bin", "claude")];
+  return platform === "win32" ? [join3(toolsRoot, "codex")] : [join3(toolsRoot, "bin", "codex")];
+}
+async function commandRuns(path) {
+  return new Promise((resolve18) => {
+    let child;
+    try {
+      child = spawnCli(path, ["--version"], {
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch {
+      resolve18(false);
+      return;
+    }
+    const timer = setTimeout(() => {
+      child.kill();
+      resolve18(false);
+    }, 1e4);
+    timer.unref?.();
+    child.once("error", () => {
+      clearTimeout(timer);
+      resolve18(false);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      resolve18(code === 0);
+    });
+  });
+}
+async function resolveRunnerCommand(command, type, options = {}) {
+  const candidates = [];
+  if (!options.managedOnly) {
+    const fromPath = await resolveTrustedCliCommand(command, options.resolution ?? {});
+    if (fromPath) candidates.push(fromPath);
+  }
+  if (!command.includes("/") && !command.includes("\\")) {
+    for (const candidate of runnerCommandCandidates(type, options)) {
+      const resolved = await resolveTrustedCliCommand(candidate, options.resolution ?? {});
+      if (resolved && !candidates.includes(resolved)) candidates.push(resolved);
+    }
+  }
+  if (!options.probe) return candidates[0] ?? null;
+  for (const candidate of candidates) {
+    if (await commandRuns(candidate)) return candidate;
+  }
+  return null;
+}
+function windowsPowershell(env) {
+  const root = env.SYSTEMROOT ?? env.WINDIR;
+  if (!root || !isAbsolute3(root)) return null;
+  return join3(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+async function runInstaller(plan, env) {
+  await new Promise((resolveRun, rejectRun) => {
+    const child = plan.shellLine !== void 0 ? spawn2(plan.shellLine, {
+      ...plan.cwd ? { cwd: plan.cwd } : {},
+      env,
+      // stdin stays closed: see the module comment. Output flows to the
+      // ordinary worker console so progress reaches the cloud and the
+      // local console file.
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true,
+      shell: true
+    }) : spawn2(plan.command, plan.args, {
+      ...plan.cwd ? { cwd: plan.cwd } : {},
+      env,
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true
+    });
+    let settled = false;
+    const finish = (error52) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error52) rejectRun(error52);
+      else resolveRun();
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish(new Error("the runner installer did not finish within 10 minutes"));
+    }, INSTALL_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", (error52) => finish(error52));
+    child.once("exit", (code, signal) => {
+      if (code === 0) finish();
+      else {
+        finish(
+          new Error(
+            signal ? `the runner installer stopped with ${signal}` : `the runner installer exited with code ${code ?? "unknown"}`
+          )
+        );
+      }
+    });
+  });
+}
+async function downloadInstallerScript(url3, destination) {
+  const response = await fetch(url3, { signal: AbortSignal.timeout(6e4) });
+  if (!response.ok) {
+    throw new Error(`the installer download answered HTTP ${response.status}`);
+  }
+  const body = await response.text();
+  if (!body || body.length > 5 * 1024 * 1024) {
+    throw new Error("the installer download looked wrong and was not run");
+  }
+  await writeFile(destination, body, { encoding: "utf8", mode: 448 });
+}
+function createRunnerAutoInstaller(options) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir();
+  const toolsRoot = options.toolsRoot ?? defaultRunnerToolsRoot();
+  const now = options.now ?? Date.now;
+  const inFlight = /* @__PURE__ */ new Map();
+  const failedAt = /* @__PURE__ */ new Map();
+  const installClaude = async () => {
+    const script = join3(
+      tmpdir(),
+      `zixt-claude-install-${process.pid}-${crypto.randomUUID()}.${platform === "win32" ? "ps1" : "sh"}`
+    );
+    try {
+      if (platform === "win32") {
+        await downloadInstallerScript(CLAUDE_INSTALLER_URL_WINDOWS, script);
+        const powershell = windowsPowershell(process.env);
+        if (!powershell) throw new Error("Windows PowerShell could not be found");
+        await runInstaller(
+          {
+            command: powershell,
+            args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script]
+          },
+          sanitizedInstallerEnv(process.env)
+        );
+      } else {
+        await downloadInstallerScript(CLAUDE_INSTALLER_URL_POSIX, script);
+        await runInstaller({ command: "bash", args: [script] }, sanitizedInstallerEnv(process.env));
+      }
+    } finally {
+      await rm(script, { force: true }).catch(() => void 0);
+    }
+  };
+  const installCodex = async () => {
+    await mkdir(toolsRoot, { recursive: true, mode: 448 });
+    const npm = await resolveInstallerCommand({ platform });
+    const args = [
+      "install",
+      "-g",
+      "--prefix",
+      toolsRoot,
+      "--no-audit",
+      "--no-fund",
+      "--ignore-scripts",
+      CODEX_PACKAGE
+    ];
+    if (platform === "win32") {
+      await runInstaller(
+        { shellLine: windowsInstallerCommandLine(npm, args), cwd: toolsRoot },
+        sanitizedInstallerEnv(process.env)
+      );
+    } else {
+      await runInstaller(
+        { command: npm, args, cwd: toolsRoot },
+        sanitizedInstallerEnv(process.env)
+      );
+    }
+  };
+  const install = options.install ?? ((type) => type === "claude-code" ? installClaude() : installCodex());
+  return {
+    ensureInstalled(type) {
+      if (inFlight.has(type)) return;
+      const lastFailure = failedAt.get(type);
+      if (lastFailure !== void 0 && now() - lastFailure < FAILURE_COOLDOWN_MS) return;
+      options.onEvent({ runner: type, state: "started" });
+      const attempt = (async () => {
+        try {
+          await install(type);
+          const resolved = await resolveRunnerCommand(
+            type === "claude-code" ? "claude" : "codex",
+            type,
+            {
+              home,
+              toolsRoot,
+              probe: true,
+              managedOnly: true,
+              ...options.resolution ? { resolution: options.resolution } : {}
+            }
+          );
+          if (!resolved) {
+            throw new Error("the installer finished but the runner is still not on this Machine");
+          }
+          failedAt.delete(type);
+          options.onEvent({ runner: type, state: "completed" });
+        } catch (error52) {
+          failedAt.set(type, now());
+          options.onEvent({
+            runner: type,
+            state: "failed",
+            error: error52 instanceof Error ? error52.message : "unknown runner install error"
+          });
+        } finally {
+          inFlight.delete(type);
+        }
+      })();
+      inFlight.set(type, attempt);
+    },
+    async settled() {
+      while (inFlight.size > 0) await Promise.allSettled([...inFlight.values()]);
+    }
+  };
+}
+
 // src/runners/title.ts
 var TITLE_TIMEOUT_MS = 45e3;
 var INSTRUCTIONS_BUDGET = 4e3;
 var CLAUDE_TITLE_MODEL = "haiku";
 async function generateTaskTitle(instructions, runner) {
   if (runner && runner.type !== "claude-code") return null;
-  const command = await resolveTrustedCliCommand("claude");
+  const command = await resolveRunnerCommand("claude", "claude-code");
   if (!command) return null;
   const prompt = [
     "Name this task for a task list. Reply with ONLY the name: at most eight",
@@ -22443,7 +22729,7 @@ function isPlausibleTaskTitle(title) {
 // src/worker-watchdog.ts
 import { randomUUID } from "node:crypto";
 import { writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute4 } from "node:path";
+import { isAbsolute as isAbsolute5 } from "node:path";
 
 // src/worker-ownership.ts
 import {
@@ -22456,8 +22742,8 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
-import { chmod, lstat as lstat2, mkdir, open, readFile as readFile2, readdir, rm, rmdir } from "node:fs/promises";
-import { basename as basename2, dirname, isAbsolute as isAbsolute3, join as join2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { chmod, lstat as lstat2, mkdir as mkdir2, open, readFile as readFile2, readdir, rm as rm2, rmdir } from "node:fs/promises";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute4, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var LAUNCHER_OWNERSHIP_DIR_ENV = "ZIXT_HOST_LAUNCHER_OWNERSHIP_DIR";
 var WORKER_OWNERSHIP_FILE_ENV = "ZIXT_HOST_WORKER_OWNERSHIP_FILE";
 var SUPERVISOR_OWNERSHIP_FILE_ENV = "ZIXT_HOST_SUPERVISOR_OWNERSHIP_FILE";
@@ -22467,8 +22753,8 @@ var MAX_OWNERSHIP_RECORD_BYTES = 4 * 1024;
 var MAX_OWNERSHIP_RECORDS = 32;
 var MAX_OWNERSHIP_GENERATIONS = 32;
 function workerOwnershipFile(directory, nonce) {
-  if (!isAbsolute3(directory) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce)) return null;
-  return join2(directory, `${nonce}.json`);
+  if (!isAbsolute4(directory) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce)) return null;
+  return join4(directory, `${nonce}.json`);
 }
 function workerOwnershipArguments(nonce) {
   return [WORKER_OWNERSHIP_ARGUMENT, nonce];
@@ -22477,7 +22763,7 @@ function consumeWorkerOwnershipArguments(argv, env) {
   const file2 = env[WORKER_OWNERSHIP_FILE_ENV];
   const nonce = env.ZIXT_HOST_WORKER_WATCHDOG_NONCE;
   if (typeof file2 !== "string") return { argv: [...argv], requested: false, valid: true };
-  if (typeof nonce !== "string" || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || !isAbsolute3(file2) || basename2(file2) !== `${nonce}.json`) {
+  if (typeof nonce !== "string" || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || !isAbsolute4(file2) || basename2(file2) !== `${nonce}.json`) {
     return { argv: [...argv], requested: true, valid: false };
   }
   const result = [];
@@ -22504,11 +22790,11 @@ function syncDirectorySync(path) {
   }
 }
 function recordWorkerOwnership(path, nonce, pid = process.pid) {
-  if (!isAbsolute3(path) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || basename2(path) !== `${nonce}.json` || !Number.isSafeInteger(pid) || pid <= 1) {
+  if (!isAbsolute4(path) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || basename2(path) !== `${nonce}.json` || !Number.isSafeInteger(pid) || pid <= 1) {
     return false;
   }
-  const directory = dirname(path);
-  const temporary = join2(directory, `.pending-${crypto.randomUUID()}`);
+  const directory = dirname2(path);
+  const temporary = join4(directory, `.pending-${crypto.randomUUID()}`);
   const existingMatches = () => {
     try {
       const metadata = lstatSync(path);
@@ -22562,16 +22848,16 @@ async function syncDirectory(path) {
   }
 }
 async function ensurePrivateOwnershipRoot(root) {
-  if (!isAbsolute3(root)) throw new Error("launcher ownership root is invalid");
-  const firstCreated = await mkdir(root, { recursive: true, mode: 448 });
+  if (!isAbsolute4(root)) throw new Error("launcher ownership root is invalid");
+  const firstCreated = await mkdir2(root, { recursive: true, mode: 448 });
   if (firstCreated && process.platform !== "win32") {
     const first = resolve3(firstCreated);
     const target = resolve3(root);
-    await syncDirectory(dirname(first));
+    await syncDirectory(dirname2(first));
     let current = first;
     for (const part of relative2(first, target).split(sep2).filter(Boolean)) {
       await syncDirectory(current);
-      current = join2(current, part);
+      current = join4(current, part);
     }
   }
   const metadata = await lstat2(root);
@@ -22584,14 +22870,14 @@ async function createLauncherOwnershipGeneration(root) {
   await ensurePrivateOwnershipRoot(root);
   for (let attempt = 0; attempt < 8; attempt++) {
     const nonce = crypto.randomUUID();
-    const directory = join2(root, nonce);
+    const directory = join4(root, nonce);
     try {
-      await mkdir(directory, { mode: 448 });
+      await mkdir2(directory, { mode: 448 });
       await syncDirectory(root);
       return {
         nonce,
         directory,
-        supervisorOwnershipFile: join2(directory, `${nonce}.json`)
+        supervisorOwnershipFile: join4(directory, `${nonce}.json`)
       };
     } catch (error52) {
       if (error52.code !== "EEXIST") throw error52;
@@ -22610,7 +22896,7 @@ async function readLauncherOwnershipGenerations(root) {
     if (!entry.isDirectory() || entry.isSymbolicLink() || !SAFE_WORKER_OWNERSHIP_NONCE.test(entry.name)) {
       throw new Error("launcher ownership root is malformed");
     }
-    const directory = join2(root, entry.name);
+    const directory = join4(root, entry.name);
     const metadata = await lstat2(directory);
     if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
       throw new Error("launcher ownership generation is not a trusted directory");
@@ -22619,7 +22905,7 @@ async function readLauncherOwnershipGenerations(root) {
     generations.push({
       nonce: entry.name,
       directory,
-      supervisorOwnershipFile: join2(directory, `${entry.name}.json`)
+      supervisorOwnershipFile: join4(directory, `${entry.name}.json`)
     });
   }
   return generations.sort((left, right) => left.nonce.localeCompare(right.nonce));
@@ -22633,7 +22919,7 @@ function parseRecord(value, path, expectedNonce) {
   return { schema: 1, nonce: expectedNonce, pid: record2.pid, path };
 }
 async function readWorkerOwnershipRecords(directory) {
-  if (!isAbsolute3(directory)) throw new Error("worker ownership directory is invalid");
+  if (!isAbsolute4(directory)) throw new Error("worker ownership directory is invalid");
   const entries = await readdir(directory, { withFileTypes: true }).catch(
     (error52) => {
       if (error52.code === "ENOENT") return [];
@@ -22645,9 +22931,9 @@ async function readWorkerOwnershipRecords(directory) {
   }
   const records = [];
   for (const entry of entries) {
-    const path = join2(directory, entry.name);
+    const path = join4(directory, entry.name);
     if (entry.name.startsWith(".pending-")) {
-      await rm(path, { force: true });
+      await rm2(path, { force: true });
       continue;
     }
     const match = /^([A-Za-z0-9_-]{16,200})\.json$/.exec(entry.name);
@@ -22667,15 +22953,15 @@ async function readWorkerOwnershipRecords(directory) {
   return records;
 }
 async function forgetWorkerOwnership(path) {
-  if (!isAbsolute3(path)) throw new Error("worker ownership path is invalid");
-  const directory = dirname(path);
-  await rm(path, { force: true });
+  if (!isAbsolute4(path)) throw new Error("worker ownership path is invalid");
+  const directory = dirname2(path);
+  await rm2(path, { force: true });
   await syncDirectory(directory);
 }
 async function removeWorkerOwnershipDirectory(directory) {
   try {
     await rmdir(directory);
-    await syncDirectory(dirname(directory));
+    await syncDirectory(dirname2(directory));
   } catch (error52) {
     if (error52.code !== "ENOENT") throw error52;
   }
@@ -22765,7 +23051,7 @@ function startWorkerWatchdogHeartbeat(env = process.env, argv = process.argv.sli
   }
   const heartbeatFile = env[WORKER_WATCHDOG_FILE_ENV];
   const ipc = typeof process.send === "function" && process.connected;
-  const file2 = !ipc && typeof heartbeatFile === "string" && isAbsolute4(heartbeatFile) ? heartbeatFile : null;
+  const file2 = !ipc && typeof heartbeatFile === "string" && isAbsolute5(heartbeatFile) ? heartbeatFile : null;
   if (!ipc && !file2) {
     heartbeatActive = false;
     heartbeatUsesIpc = false;
@@ -22928,7 +23214,7 @@ function workerWatchdogIsActive() {
 // src/workspaces.ts
 import { access, stat as stat2 } from "node:fs/promises";
 import { constants } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join5 } from "node:path";
 var PROBE_TIMEOUT_MS = 2e3;
 async function withinBudget(work) {
   let timer;
@@ -22967,7 +23253,7 @@ async function probeWorkspace(workspace) {
     await withinBudget(access(workspace, constants.R_OK | constants.X_OK));
     let error52 = null;
     try {
-      await withinBudget(stat2(join3(workspace, ".git")));
+      await withinBudget(stat2(join5(workspace, ".git")));
     } catch {
       error52 = "Usable, but not a git repository";
     }
@@ -25264,9 +25550,9 @@ function watchForUpdates(options) {
 }
 
 // src/runners/process-tree.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { readFile as readFile3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute5, join as join4 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join6 } from "node:path";
 var windowsProcessTreeModule = process.platform === "win32" ? import("@vscode/windows-process-tree").catch(() => null) : null;
 var PROCESS_TERM_GRACE_MS = 500;
 var PROCESS_EXIT_POLL_MS = 20;
@@ -25351,7 +25637,7 @@ async function observePosixGuardianNonce(pid, nonce) {
     }
   }
   return new Promise((resolve18, reject3) => {
-    const observer = spawn2("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
+    const observer = spawn3("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     let output = "";
@@ -25442,7 +25728,7 @@ function posixProcessRecordsFromPs(output) {
 }
 async function snapshotPosixProcesses() {
   return new Promise((resolve18, reject3) => {
-    const observer = spawn2("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
+    const observer = spawn3("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     let output = "";
@@ -25722,13 +26008,13 @@ async function observePosixGroupIdentity(records, pgid, identity) {
 }
 function defaultTaskkillCommand() {
   const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  if (!windowsRoot || !isAbsolute5(windowsRoot)) {
+  if (!windowsRoot || !isAbsolute6(windowsRoot)) {
     throw new ProcessTreeTerminationError(
       "termination_failed",
       "Windows runner tree termination authority is unavailable"
     );
   }
-  return join4(windowsRoot, "System32", "taskkill.exe");
+  return join6(windowsRoot, "System32", "taskkill.exe");
 }
 function validWindowsPid(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 4294967295;
@@ -25864,7 +26150,7 @@ async function waitForProcessesExit(pids, timeoutMs) {
 async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, independentlyTrackedPids = []) {
   const trustedCommand = command ?? defaultTaskkillCommand();
   const result = await new Promise((resolve18, reject3) => {
-    const killer = spawn2(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
+    const killer = spawn3(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
     });
@@ -26110,14 +26396,14 @@ async function terminateProcessTree(child, childExited, options = {}) {
 }
 
 // src/release-state.ts
-import { lstat as lstat3, mkdir as mkdir2, open as open2, readFile as readFile4, rename, rm as rm2 } from "node:fs/promises";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { lstat as lstat3, mkdir as mkdir3, open as open2, readFile as readFile4, rename, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname3, join as join7 } from "node:path";
 var STATE_FILE = "release-state.json";
 var STATE_SCHEMA = 1;
 var MAX_STATE_BYTES = 4 * 1024;
 var VERSION = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
 function releaseStatePath(root) {
-  return join5(root, STATE_FILE);
+  return join7(root, STATE_FILE);
 }
 function parseState(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -26168,8 +26454,8 @@ function createReleaseStateStore(root) {
     },
     async save(state) {
       const normalized = parseState(state);
-      await mkdir2(root, { recursive: true, mode: 448 });
-      const temporary = join5(root, `.${STATE_FILE}.${process.pid}.${crypto.randomUUID()}.tmp`);
+      await mkdir3(root, { recursive: true, mode: 448 });
+      const temporary = join7(root, `.${STATE_FILE}.${process.pid}.${crypto.randomUUID()}.tmp`);
       const handle = await open2(temporary, "wx", 384);
       try {
         await handle.writeFile(`${JSON.stringify(normalized)}
@@ -26180,7 +26466,7 @@ function createReleaseStateStore(root) {
         await syncDirectory2(root);
       } catch (error52) {
         await handle.close().catch(() => void 0);
-        await rm2(temporary, { force: true }).catch(() => void 0);
+        await rm3(temporary, { force: true }).catch(() => void 0);
         throw error52;
       }
     },
@@ -26193,17 +26479,17 @@ function createReleaseStateStore(root) {
         }
       );
       if (!present) return;
-      await rm2(path);
-      await syncDirectory2(dirname2(path));
+      await rm3(path);
+      await syncDirectory2(dirname3(path));
     }
   };
 }
 
 // src/worker-diagnostics.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir3, readdir as readdir2, readFile as readFile5, rm as rm3, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute as isAbsolute6, join as join6 } from "node:path";
+import { mkdir as mkdir4, readdir as readdir2, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute as isAbsolute7, join as join8 } from "node:path";
 var WORKER_DIAGNOSTICS_DIR_ENV = "ZIXT_HOST_DIAGNOSTICS_DIR";
 var RETAINED_RECORDS = 20;
 var STDERR_TAIL_LINES = 40;
@@ -26211,11 +26497,11 @@ var STDERR_LINE_LIMIT = 800;
 var RECORD_TTL_MS = 7 * 24 * 60 * 6e4;
 var RECORD_FILE = /^[0-9a-f-]{36}\.json$/;
 function defaultWorkerDiagnosticsRoot() {
-  return join6(homedir(), ".zixt", "host-diagnostics");
+  return join8(homedir2(), ".zixt", "host-diagnostics");
 }
 function configuredWorkerDiagnosticsRoot(env = process.env) {
   const configured = env[WORKER_DIAGNOSTICS_DIR_ENV];
-  return typeof configured === "string" && isAbsolute6(configured) ? configured : null;
+  return typeof configured === "string" && isAbsolute7(configured) ? configured : null;
 }
 function boundedStderr(lines) {
   return lines.slice(-STDERR_TAIL_LINES).map(
@@ -26224,13 +26510,13 @@ function boundedStderr(lines) {
 }
 async function recordWorkerExit(root, record2) {
   try {
-    await mkdir3(root, { recursive: true, mode: 448 });
+    await mkdir4(root, { recursive: true, mode: 448 });
     const stored = {
       ...record2,
       schema: 1,
       stderr: boundedStderr(record2.stderr)
     };
-    await writeFile(join6(root, `${randomUUID2()}.json`), JSON.stringify(stored), {
+    await writeFile2(join8(root, `${randomUUID2()}.json`), JSON.stringify(stored), {
       encoding: "utf8",
       mode: 384
     });
@@ -26266,7 +26552,7 @@ async function readWorkerExits(root) {
   const stored = [];
   for (const name of names) {
     if (!RECORD_FILE.test(name)) continue;
-    const file2 = join6(root, name);
+    const file2 = join8(root, name);
     try {
       const record2 = parseRecord2(await readFile5(file2, "utf8"));
       if (record2) stored.push({ file: file2, record: record2 });
@@ -26276,7 +26562,7 @@ async function readWorkerExits(root) {
   return stored.sort((a, b) => Date.parse(a.record.at) - Date.parse(b.record.at));
 }
 async function forgetWorkerExits(files) {
-  await Promise.all(files.map((file2) => rm3(file2, { force: true }).catch(() => {
+  await Promise.all(files.map((file2) => rm4(file2, { force: true }).catch(() => {
   })));
 }
 async function pruneWorkerExits(root, nowMs) {
@@ -26308,26 +26594,26 @@ function describeWorkerExit(record2) {
 }
 
 // src/runners/run-artifacts.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import {
   chmod as chmod2,
   lstat as lstat4,
-  mkdir as mkdir4,
+  mkdir as mkdir5,
   open as open3,
   readdir as readdir3,
   readFile as readFile6,
   realpath as realpath3,
   rename as rename2,
-  rm as rm4,
-  writeFile as writeFile2
+  rm as rm5,
+  writeFile as writeFile3
 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname3, isAbsolute as isAbsolute8, join as join7, relative as relative3, resolve as resolve4, sep as sep3, win32 as win322 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname4, isAbsolute as isAbsolute9, join as join9, relative as relative3, resolve as resolve4, sep as sep3, win32 as win322 } from "node:path";
 
 // src/windows-job.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { isAbsolute as isAbsolute7, win32 } from "node:path";
+import { isAbsolute as isAbsolute8, win32 } from "node:path";
 var WINDOWS_CONTAINMENT_GATE_ENV = "ZIXT_WINDOWS_CONTAINMENT_GATE";
 var WINDOWS_CONTAINMENT_GATE_PREFIX = "__ZIXT_WINDOWS_CONTAINMENT_READY__";
 var WINDOWS_POST_CONTAINMENT_CWD_ENV = "ZIXT_WINDOWS_POST_CONTAINMENT_CWD";
@@ -26640,7 +26926,7 @@ async function createWindowsJobContainment(pid, options) {
   const env = options.env ?? process.env;
   const nonce = randomUUID3();
   const encodedSource = encodedPowershellSource(WINDOWS_JOB_HELPER_SOURCE);
-  const helper = options.spawnHelper ? options.spawnHelper(nonce, encodedSource) : spawn3(
+  const helper = options.spawnHelper ? options.spawnHelper(nonce, encodedSource) : spawn4(
     options.powershellCommand ?? defaultPowershellCommand(env),
     [
       "-NoLogo",
@@ -26823,7 +27109,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       const postContainmentCwd = env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
       delete env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
       if (postContainmentCwd !== void 0) {
-        if (!isAbsolute7(postContainmentCwd)) return finish(false);
+        if (!isAbsolute8(postContainmentCwd)) return finish(false);
         try {
           process.chdir(postContainmentCwd);
         } catch {
@@ -27061,7 +27347,7 @@ foreach ($path in $paths) {
 }
 `;
 function defaultRunArtifactRoot() {
-  return join7(homedir2(), ".zixt", "run-artifacts");
+  return join9(homedir3(), ".zixt", "run-artifacts");
 }
 function requireSafeSegment(value, field) {
   if (!SAFE_SEGMENT.test(value)) {
@@ -27073,7 +27359,7 @@ function isMissing(error52) {
 }
 function assertBelow(parent, child) {
   const path = relative3(parent, child);
-  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute8(path);
+  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute9(path);
   if (escapes) throw new Error("run artifact path escapes its private root");
 }
 async function requireRealDirectory(path, label) {
@@ -27108,7 +27394,7 @@ async function prepareRoot(root) {
   const absolute = resolve4(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve4(homedir2());
+    const profile = resolve4(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath3(profile);
@@ -27117,7 +27403,7 @@ async function prepareRoot(root) {
     await lstat4(absolute);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
-    await mkdir4(absolute, { recursive: true, mode: DIRECTORY_MODE });
+    await mkdir5(absolute, { recursive: true, mode: DIRECTORY_MODE });
   }
   const real = await requireRealDirectory(absolute, "run artifact root");
   if (realProfile) assertWindowsProfileBoundary(realProfile, real);
@@ -27125,14 +27411,14 @@ async function prepareRoot(root) {
   return real;
 }
 async function prepareAgentRoot(root, agentId) {
-  const path = join7(root, agentId);
+  const path = join9(root, agentId);
   assertBelow(root, path);
   try {
     await lstat4(path);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
     try {
-      await mkdir4(path, { mode: DIRECTORY_MODE });
+      await mkdir5(path, { mode: DIRECTORY_MODE });
     } catch (mkdirError) {
       if (mkdirError.code !== "EEXIST") throw mkdirError;
     }
@@ -27148,10 +27434,10 @@ async function lockDownWindowsDirectories(paths) {
   if (!windowsRoot || !win322.isAbsolute(windowsRoot)) {
     throw new Error("private Windows run-artifact ACL authority is unavailable");
   }
-  const powershell = join7(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const powershell = join9(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
   const encoded = Buffer.from(WINDOWS_PRIVATE_DACL_SCRIPT, "utf16le").toString("base64");
   await new Promise((resolvePromise, reject3) => {
-    const helper = spawn4(
+    const helper = spawn5(
       powershell,
       ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded],
       {
@@ -27190,16 +27476,16 @@ async function lockDownWindowsDirectories(paths) {
   });
 }
 async function createPrivateDirectory(parent, name) {
-  const path = join7(parent, name);
+  const path = join9(parent, name);
   assertBelow(parent, path);
-  await mkdir4(path, { mode: DIRECTORY_MODE });
+  await mkdir5(path, { mode: DIRECTORY_MODE });
   await chmod2(path, DIRECTORY_MODE);
   const real = await realpath3(path);
   assertBelow(parent, real);
   return real;
 }
 async function writePrivateFile(path, content) {
-  await writeFile2(path, content, { flag: "wx", mode: FILE_MODE });
+  await writeFile3(path, content, { flag: "wx", mode: FILE_MODE });
   await chmod2(path, FILE_MODE);
 }
 function quotePosix(value) {
@@ -27219,24 +27505,24 @@ async function createRunArtifacts(input) {
   requireSafeSegment(input.agentId, "agentId");
   requireSafeSegment(input.runToken, "runToken");
   const root = await prepareRoot(input.root);
-  const removeTree = input.removeTree ?? ((path) => rm4(path, { recursive: true, force: true }));
+  const removeTree = input.removeTree ?? ((path) => rm5(path, { recursive: true, force: true }));
   const cleanupRetryDelayMs = input.cleanupRetryDelayMs ?? CLEANUP_RETRY_DELAY_MS;
   const agentRoot = await prepareAgentRoot(root, input.agentId);
   await lockDownWindowsDirectories([root, agentRoot]);
-  const runRoot = join7(agentRoot, input.runToken);
+  const runRoot = join9(agentRoot, input.runToken);
   assertBelow(agentRoot, runRoot);
   try {
-    await mkdir4(runRoot, { mode: DIRECTORY_MODE });
+    await mkdir5(runRoot, { mode: DIRECTORY_MODE });
     await chmod2(runRoot, DIRECTORY_MODE);
     const realRunRoot = await realpath3(runRoot);
     assertBelow(agentRoot, realRunRoot);
     const emptyGithubConfigDirectory = await createPrivateDirectory(realRunRoot, "gh-config");
     const emptyGitHooksDirectory = await createPrivateDirectory(realRunRoot, "git-hooks");
     const gitBridgesDirectory = await createPrivateDirectory(realRunRoot, "git-bridges");
-    const denySshScript = join7(realRunRoot, "deny-ssh.cjs");
-    const runnerWrapperScript = join7(realRunRoot, "runner-wrapper.cjs");
-    const systemPromptPath = join7(realRunRoot, "system-prompt.txt");
-    const mcpConfigPath = join7(realRunRoot, "mcp.json");
+    const denySshScript = join9(realRunRoot, "deny-ssh.cjs");
+    const runnerWrapperScript = join9(realRunRoot, "runner-wrapper.cjs");
+    const systemPromptPath = join9(realRunRoot, "system-prompt.txt");
+    const mcpConfigPath = join9(realRunRoot, "mcp.json");
     await writePrivateFile(denySshScript, "process.exitCode = 127;");
     await writePrivateFile(runnerWrapperScript, RUNNER_GUARDIAN);
     return {
@@ -27258,9 +27544,9 @@ async function createRunArtifacts(input) {
       },
       async writePrivateDataFile(name, content) {
         requireSafeSegment(name, "private file name");
-        const path = join7(realRunRoot, name);
+        const path = join9(realRunRoot, name);
         assertBelow(realRunRoot, path);
-        await writeFile2(path, content, { flag: "wx", mode: FILE_MODE });
+        await writeFile3(path, content, { flag: "wx", mode: FILE_MODE });
         await chmod2(path, FILE_MODE);
         return path;
       },
@@ -27289,7 +27575,7 @@ async function sweepOrphanedRunArtifacts(root) {
   const absolute = resolve4(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve4(homedir2());
+    const profile = resolve4(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath3(profile);
@@ -27308,20 +27594,20 @@ async function sweepOrphanedRunArtifacts(root) {
   let removed = 0;
   for (const agent of agents) {
     if (!SAFE_SEGMENT.test(agent.name) || !agent.isDirectory() || agent.isSymbolicLink()) continue;
-    const agentPath = join7(realRoot, agent.name);
+    const agentPath = join9(realRoot, agent.name);
     const runs = await readdir3(agentPath, { withFileTypes: true });
     for (const run3 of runs) {
       if (!SAFE_SEGMENT.test(run3.name) || !run3.isDirectory() || run3.isSymbolicLink()) continue;
-      const runPath = join7(agentPath, run3.name);
+      const runPath = join9(agentPath, run3.name);
       assertBelow(agentPath, runPath);
-      await rm4(runPath, { recursive: true, force: true });
+      await rm5(runPath, { recursive: true, force: true });
       removed++;
     }
   }
   return removed;
 }
 function defaultRunRegistryRoot() {
-  return join7(homedir2(), ".zixt", "run-registry");
+  return join9(homedir3(), ".zixt", "run-registry");
 }
 async function terminateRecordedRunProcesses(registryRoot = defaultRunRegistryRoot(), terminate = terminateRecordedProcessTree) {
   const entries = await readRecordedRunAssignmentEntriesStrict(registryRoot);
@@ -27347,23 +27633,23 @@ async function syncRunRegistryDirectory(path) {
   }
 }
 async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory8) {
-  const firstCreated = await mkdir4(registryRoot, { recursive: true, mode: DIRECTORY_MODE });
+  const firstCreated = await mkdir5(registryRoot, { recursive: true, mode: DIRECTORY_MODE });
   if (firstCreated && process.platform !== "win32") {
     const first = resolve4(firstCreated);
     const target = resolve4(registryRoot);
-    await syncDirectory8(dirname3(first));
+    await syncDirectory8(dirname4(first));
     let current = first;
     for (const part of relative3(first, target).split(sep3).filter(Boolean)) {
       await syncDirectory8(current);
-      current = join7(current, part);
+      current = join9(current, part);
     }
   }
   await chmod2(registryRoot, DIRECTORY_MODE);
 }
 async function recordRunAssignment(runToken, record2, registryRoot = defaultRunRegistryRoot(), options = {}) {
   if (!SAFE_SEGMENT.test(runToken)) return false;
-  const destination = join7(registryRoot, `${runToken}.json`);
-  const temporary = join7(registryRoot, `.${runToken}.${process.pid}.${Date.now()}.tmp`);
+  const destination = join9(registryRoot, `${runToken}.json`);
+  const temporary = join9(registryRoot, `.${runToken}.${process.pid}.${Date.now()}.tmp`);
   let handle;
   try {
     const syncDirectory8 = options.syncDirectory ?? syncRunRegistryDirectory;
@@ -27383,7 +27669,7 @@ async function recordRunAssignment(runToken, record2, registryRoot = defaultRunR
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm4(temporary, { force: true }).catch(() => {
+    await rm5(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -27395,7 +27681,7 @@ async function forgetRunAssignment(runToken, registryRoot = defaultRunRegistryRo
   if (retainingAssignments) return;
   if (!SAFE_SEGMENT.test(runToken)) return;
   try {
-    await rm4(join7(registryRoot, `${runToken}.json`), { force: true });
+    await rm5(join9(registryRoot, `${runToken}.json`), { force: true });
   } catch {
   }
 }
@@ -27440,7 +27726,7 @@ async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistr
     if (!SAFE_SEGMENT.test(runToken)) continue;
     let text;
     try {
-      text = await readFile6(join7(registryRoot, entry.name), "utf8");
+      text = await readFile6(join9(registryRoot, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -27476,7 +27762,7 @@ async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunR
     }
     let text;
     try {
-      text = await readFile6(join7(registryRoot, entry.name), "utf8");
+      text = await readFile6(join9(registryRoot, entry.name), "utf8");
     } catch {
       throw new Error("committed run registry witness could not be read");
     }
@@ -27493,13 +27779,13 @@ async function forgetAcknowledgedRunAssignments(assignments, registryRoot = defa
   );
   const entries = await readRecordedRunAssignmentEntries(registryRoot);
   await Promise.all(
-    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm4(join7(registryRoot, `${runToken}.json`), { force: true }))
+    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm5(join9(registryRoot, `${runToken}.json`), { force: true }))
   );
 }
 async function forgetSupersededRunAssignments(taskId, epoch, registryRoot = defaultRunRegistryRoot()) {
   const entries = await readRecordedRunAssignmentEntries(registryRoot);
   await Promise.all(
-    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm4(join7(registryRoot, `${runToken}.json`), { force: true }))
+    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm5(join9(registryRoot, `${runToken}.json`), { force: true }))
   );
 }
 
@@ -27525,7 +27811,7 @@ function streakBackoffMs(streak) {
 var RELEASE_PROBATION_MS = 5 * 6e4;
 var FAST_UPDATE_EXIT_MS = 1e4;
 var STOP_GRACE_MS = 3e4;
-var INSTALL_TIMEOUT_MS = 5 * 6e4;
+var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var WORKER_WATCHDOG_CHECK_MS = 1e3;
 var WORKER_WATCHDOG_TIMEOUT_MS = 15e3;
 var WORKER_WATCHDOG_STARTUP_MS = 6e4;
@@ -27567,39 +27853,16 @@ function captureWorkerStderr(child) {
   return () => (partial2 ? [...lines, partial2] : [...lines]).slice(-WORKER_STDERR_TAIL_LINES);
 }
 function versionsRoot() {
-  return process.env.ZIXT_HOST_VERSIONS_DIR ?? join8(homedir3(), ".zixt", "host-versions");
-}
-function npmCommand(platform = process.platform) {
-  return platform === "win32" ? "npm.cmd" : "npm";
-}
-async function resolveInstallerCommand(options = {}) {
-  const platform = options.platform ?? process.platform;
-  const command = npmCommand(platform);
-  if (platform !== "win32") return command;
-  const execPath = options.execPath ?? process.execPath;
-  const resolution = {
-    platform,
-    ...options.searchPath !== void 0 ? { searchPath: options.searchPath } : {}
-  };
-  return (
-    // npm ships beside the `node` running this process, and that copy is the
-    // one matching it. A per-user Scheduled Task may carry no npm on PATH.
-    await resolveTrustedCliCommand(join8(dirname4(execPath), command), resolution) ?? await resolveTrustedCliCommand(command, resolution) ?? // Nothing resolved: keep the previous behaviour, so a Machine without npm
-    // fails one install rather than changing how failure is handled.
-    command
-  );
-}
-function windowsInstallerCommandLine(command, args) {
-  return [command, ...args].map(quoteForCmd).join(" ");
+  return process.env.ZIXT_HOST_VERSIONS_DIR ?? join10(homedir4(), ".zixt", "host-versions");
 }
 function installedReleaseEntry(version2, root = versionsRoot()) {
-  return join8(root, version2, "node_modules", PACKAGE_NAME, "dist", "index.js");
+  return join10(root, version2, "node_modules", PACKAGE_NAME, "dist", "index.js");
 }
 function releaseEntryAtPrefix(prefix) {
-  return join8(prefix, "node_modules", PACKAGE_NAME, "dist", "index.js");
+  return join10(prefix, "node_modules", PACKAGE_NAME, "dist", "index.js");
 }
 function releaseManifestAtPrefix(prefix) {
-  return join8(prefix, "node_modules", PACKAGE_NAME, "package.json");
+  return join10(prefix, "node_modules", PACKAGE_NAME, "package.json");
 }
 async function validReleaseAtPrefix(prefix, version2) {
   try {
@@ -27624,9 +27887,9 @@ async function syncDirectory3(path) {
   }
 }
 function installedReleaseVersion(entry, root = versionsRoot()) {
-  if (!isAbsolute9(entry)) return null;
+  if (!isAbsolute10(entry)) return null;
   const relativeEntry = relative4(resolve5(root), resolve5(entry));
-  if (!relativeEntry || relativeEntry.startsWith(`..${sep4}`) || isAbsolute9(relativeEntry)) {
+  if (!relativeEntry || relativeEntry.startsWith(`..${sep4}`) || isAbsolute10(relativeEntry)) {
     return null;
   }
   const version2 = relativeEntry.split(sep4)[0];
@@ -27634,10 +27897,10 @@ function installedReleaseVersion(entry, root = versionsRoot()) {
   return resolve5(entry) === resolve5(installedReleaseEntry(version2, root)) ? version2 : null;
 }
 function currentReleaseEntry(root = versionsRoot(), platform = process.platform) {
-  return join8(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
+  return join10(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
 }
 function windowsReleasePointer(root = versionsRoot()) {
-  return join8(root, WINDOWS_RELEASE_POINTER);
+  return join10(root, WINDOWS_RELEASE_POINTER);
 }
 var WINDOWS_STABLE_LAUNCHER = `${WINDOWS_LAUNCHER_MARKER}
 'use strict';
@@ -27672,9 +27935,9 @@ child.once('error', () => process.exit(1));
 child.once('exit', (code) => process.exit(code == null ? 1 : code));
 `;
 async function replaceDurableFile(path, contents, sync = syncDirectory3) {
-  const parent = dirname4(path);
-  await mkdir5(parent, { recursive: true, mode: 448 });
-  const temporary = join8(parent, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
+  const parent = dirname5(path);
+  await mkdir6(parent, { recursive: true, mode: 448 });
+  const temporary = join10(parent, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
   const handle = await open4(temporary, "wx", 384);
   try {
     await handle.writeFile(contents, "utf8");
@@ -27684,7 +27947,7 @@ async function replaceDurableFile(path, contents, sync = syncDirectory3) {
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm5(temporary, { force: true }).catch(() => void 0);
+    await rm6(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -27694,7 +27957,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
   }
   await access2(entry);
   if (platform === "win32") {
-    await mkdir5(root, { recursive: true, mode: 448 });
+    await mkdir6(root, { recursive: true, mode: 448 });
     const launcher = currentReleaseEntry(root, platform);
     const existingLauncher = await lstat5(launcher).catch((error52) => {
       if (error52.code === "ENOENT") return null;
@@ -27743,7 +28006,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
     return launcher;
   }
   if (platform !== "linux" && platform !== "darwin") return entry;
-  await mkdir5(root, { recursive: true, mode: 448 });
+  await mkdir6(root, { recursive: true, mode: 448 });
   const current = currentReleaseEntry(root, platform);
   const existing = await lstat5(current).catch((error52) => {
     if (error52.code === "ENOENT") return null;
@@ -27752,13 +28015,13 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
   if (existing && !existing.isSymbolicLink()) {
     throw new Error("the Zixt Host current-release entry is not a symbolic link");
   }
-  const temporary = join8(root, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
+  const temporary = join10(root, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
   try {
     await symlink(entry, temporary, "file");
     await rename3(temporary, current);
     await sync(root);
   } catch (error52) {
-    await rm5(temporary, { force: true }).catch(() => void 0);
+    await rm6(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
   return current;
@@ -27779,43 +28042,11 @@ async function activatedReleaseVersion(root = versionsRoot(), platform = process
   try {
     const current = currentReleaseEntry(root, platform);
     const target = await readlink(current);
-    return installedReleaseVersion(resolve5(dirname4(current), target), root);
+    return installedReleaseVersion(resolve5(dirname5(current), target), root);
   } catch {
     return null;
   }
 }
-function sanitizedInstallerEnv(inherited) {
-  const allowed = /* @__PURE__ */ new Set([
-    "PATH",
-    "HOME",
-    "USERPROFILE",
-    "SYSTEMROOT",
-    "WINDIR",
-    "TEMP",
-    "TMP",
-    "TMPDIR",
-    "LOCALAPPDATA",
-    "APPDATA",
-    "XDG_CONFIG_HOME",
-    "XDG_CACHE_HOME",
-    "HTTP_PROXY",
-    "HTTPS_PROXY",
-    "NO_PROXY",
-    "ALL_PROXY",
-    "NODE_EXTRA_CA_CERTS",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "NPM_CONFIG_REGISTRY",
-    "NPM_CONFIG_CACHE",
-    "NPM_CONFIG_USERCONFIG",
-    "NPM_CONFIG_STRICT_SSL"
-  ]);
-  return Object.fromEntries(
-    Object.entries(inherited).filter(
-      ([name, value]) => value !== void 0 && allowed.has(name.toUpperCase())
-    )
-  );
-}
 var WINDOWS_INSTALLER_GUARDIAN = String.raw`
 const { spawn } = require('node:child_process');
 const nonce = process.argv[1];
@@ -27860,7 +28091,13 @@ process.stdin.on('data', (chunk) => {
   const target = spawn(config.commandLine, {
     cwd: config.cwd,
     env: process.env,
-    stdio: 'inherit',
+    // Never share this guardian's stdin with npm. The guardian keeps an
+    // active read pending on that pipe (the config protocol above), and a
+    // Windows child whose inherited stdin pipe has a concurrent reader wedges
+    // inside Node startup until the reader dies - npm sat at zero CPU for the
+    // whole install timeout on a real Machine (live, 2026-08-18). An
+    // unattended install may never depend on stdin anyway.
+    stdio: ['ignore', 'inherit', 'inherit'],
     windowsHide: true,
     // cmd.exe has to resolve npm.cmd, so the shell stays - but the whole line
     // arrives pre-quoted as one string. Node's (command, args, shell) shape is
@@ -27893,15 +28130,15 @@ async function installRelease(version2, options = {}) {
   }
   const platform = options.platform ?? process.platform;
   const root = options.root ?? versionsRoot();
-  const prefix = join8(root, version2);
+  const prefix = join10(root, version2);
   const entry = installedReleaseEntry(version2, root);
   if (await validReleaseAtPrefix(prefix, version2)) return entry;
   if (options.signal?.aborted)
     return fail("cancelled", "this Host was stopping before npm started");
   const installerCommand = options.installerCommand ?? await resolveInstallerCommand({ platform });
-  await mkdir5(root, { recursive: true, mode: 448 });
-  const staging = join8(root, `.install-${version2}-${process.pid}-${crypto.randomUUID()}`);
-  const quarantine = join8(root, `.invalid-${version2}-${process.pid}-${crypto.randomUUID()}`);
+  await mkdir6(root, { recursive: true, mode: 448 });
+  const staging = join10(root, `.install-${version2}-${process.pid}-${crypto.randomUUID()}`);
+  const quarantine = join10(root, `.invalid-${version2}-${process.pid}-${crypto.randomUUID()}`);
   const usesWindowsInstallerGuardian = platform === "win32" && options.spawnInstaller === void 0;
   const installerGateNonce = usesWindowsInstallerGuardian ? crypto.randomUUID() : null;
   const installerArguments = (installPrefix, installVersion) => [
@@ -27916,15 +28153,18 @@ async function installRelease(version2, options = {}) {
   const spawnInstaller = options.spawnInstaller ?? ((installPrefix, installVersion) => {
     const installerArgs = installerArguments(installPrefix, installVersion);
     if (usesWindowsInstallerGuardian) {
-      return spawn5(process.execPath, ["-e", WINDOWS_INSTALLER_GUARDIAN, installerGateNonce], {
+      return spawn6(process.execPath, ["-e", WINDOWS_INSTALLER_GUARDIAN, installerGateNonce], {
         cwd: root,
         stdio: ["pipe", "inherit", "inherit", "ipc"],
         env: sanitizedInstallerEnv(process.env),
         windowsHide: true
       });
     }
-    return spawn5(installerCommand, installerArgs, {
-      stdio: "inherit",
+    return spawn6(installerCommand, installerArgs, {
+      // stdin stays closed for the same reason as the Windows guardian
+      // above: this worker actively reads its own stdin (the supervisor's
+      // stop pipe), and an unattended npm must not share or depend on it.
+      stdio: ["ignore", "inherit", "inherit"],
       env: sanitizedInstallerEnv(process.env),
       detached: true
     });
@@ -27933,7 +28173,7 @@ async function installRelease(version2, options = {}) {
   try {
     child = spawnInstaller(staging, version2);
   } catch (error52) {
-    await rm5(staging, { recursive: true, force: true }).catch(() => void 0);
+    await rm6(staging, { recursive: true, force: true }).catch(() => void 0);
     return fail(
       "installer_unavailable",
       `${installerCommand} could not be started (${error52 instanceof Error ? error52.message : "unknown error"})`
@@ -27959,7 +28199,7 @@ async function installRelease(version2, options = {}) {
     installerContainmentSetupError = error52;
     return null;
   }) : Promise.resolve(null);
-  const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+  const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS2;
   const outcome = { code: null, signal: null, timedOut: false, spawnError: null };
   const installed = await new Promise((resolve18, reject3) => {
     let finished = false;
@@ -28130,8 +28370,8 @@ async function installRelease(version2, options = {}) {
       `${prefix} is not a runnable ${PACKAGE_NAME}@${version2} after installing`
     );
   } finally {
-    await rm5(staging, { recursive: true, force: true }).catch(() => void 0);
-    await rm5(quarantine, { recursive: true, force: true }).catch(() => void 0);
+    await rm6(staging, { recursive: true, force: true }).catch(() => void 0);
+    await rm6(quarantine, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 async function pruneInstalledVersions(keep, root = versionsRoot()) {
@@ -28146,10 +28386,10 @@ async function pruneInstalledVersions(keep, root = versionsRoot()) {
   const removed = [];
   for (const name of entries) {
     if (protectedDirs.has(name) || !VERSION_DIR.test(name)) continue;
-    const dir = join8(root, name);
+    const dir = join10(root, name);
     if (running && running.startsWith(`${dir}${sep4}`)) continue;
     try {
-      await rm5(dir, { recursive: true, force: true });
+      await rm6(dir, { recursive: true, force: true });
       removed.push(name);
     } catch {
     }
@@ -28160,7 +28400,7 @@ function durableState(phase, candidateVersion, fallbackVersion) {
   return { schema: 1, phase, candidateVersion, fallbackVersion };
 }
 async function validInstalledRelease(version2, root = versionsRoot()) {
-  return validReleaseAtPrefix(join8(root, version2), version2);
+  return validReleaseAtPrefix(join10(root, version2), version2);
 }
 async function recoverDurableReleaseState(store, runningVersion, activeBootVersion, activate, log2) {
   const state = await store.load();
@@ -28278,7 +28518,7 @@ function defaultSpawn(command, argv, supervisorVersion, watchdog, compatibilityO
   delete env.ZIXT_HOST_REJECT_VERSION;
   if (command.rejectedVersion) env.ZIXT_HOST_REJECT_VERSION = command.rejectedVersion;
   const entry = compatibilityProxy ? process.argv[1] ?? "" : command.entry ?? process.argv[1] ?? "";
-  const child = spawn5(process.execPath, [entry, ...argv, ...ownership?.argv ?? []], {
+  const child = spawn6(process.execPath, [entry, ...argv, ...ownership?.argv ?? []], {
     // stdin is a pipe this process owns: closing it is how the worker is
     // asked to stop, which works identically on Windows, where there is no
     // real SIGINT to send. stdout stays the person's terminal; stderr is teed
@@ -28286,7 +28526,7 @@ function defaultSpawn(command, argv, supervisorVersion, watchdog, compatibilityO
     stdio: watchdog ? ["pipe", "inherit", "pipe", "ipc"] : ["pipe", "inherit", "pipe"],
     env,
     ...containmentGateNonce ? {
-      cwd: ownership?.ownershipFile ? dirname4(ownership.ownershipFile) : dirname4(entry)
+      cwd: ownership?.ownershipFile ? dirname5(ownership.ownershipFile) : dirname5(entry)
     } : {},
     // The launch nonce is not a user-facing CLI argument. Keeping it as
     // argv[0] gives the stable launcher an exact cross-platform process
@@ -28315,7 +28555,7 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   const ownership = consumeWorkerOwnershipArguments(argv, env);
   const nonce = env[WORKER_WATCHDOG_NONCE_ENV];
   const ownershipFile = env[WORKER_OWNERSHIP_FILE_ENV];
-  if (typeof target !== "string" || !isAbsolute9(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
+  if (typeof target !== "string" || !isAbsolute10(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
     return 1;
   }
   if (!recordWorkerOwnership(ownershipFile, nonce)) return 1;
@@ -28330,7 +28570,9 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   delete workerEnv[WORKER_OWNERSHIP_FILE_ENV];
   delete workerEnv[LAUNCHER_OWNERSHIP_DIR_ENV];
   delete workerEnv[SUPERVISOR_OWNERSHIP_FILE_ENV];
-  const child = spawn5(process.execPath, [target, ...ownership.argv], {
+  delete workerEnv[WINDOWS_CONTAINMENT_GATE_ENV];
+  delete workerEnv[WINDOWS_POST_CONTAINMENT_CWD_ENV];
+  const child = spawn6(process.execPath, [target, ...ownership.argv], {
     stdio: ["pipe", "inherit", "inherit"],
     env: workerEnv,
     // The proxy is already a detached group/session leader on POSIX. The old
@@ -28386,7 +28628,7 @@ async function launchHostSupervisor(options = {}) {
     const generationNonce = ownershipDirectory ? basename3(ownershipDirectory) : null;
     if (ownershipDirectory && generationNonce) {
       env[LAUNCHER_OWNERSHIP_DIR_ENV] = ownershipDirectory;
-      env[SUPERVISOR_OWNERSHIP_FILE_ENV] = join8(ownershipDirectory, `${generationNonce}.json`);
+      env[SUPERVISOR_OWNERSHIP_FILE_ENV] = join10(ownershipDirectory, `${generationNonce}.json`);
     } else {
       delete env[LAUNCHER_OWNERSHIP_DIR_ENV];
     }
@@ -28394,10 +28636,10 @@ async function launchHostSupervisor(options = {}) {
     if (!containmentGateNonce) delete env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
     if (version2) env[SUPERVISOR_VERSION_ENV] = version2;
     else delete env[SUPERVISOR_VERSION_ENV];
-    const child2 = spawn5(process.execPath, [supervisorEntry, ...argv], {
+    const child2 = spawn6(process.execPath, [supervisorEntry, ...argv], {
       stdio: ["pipe", "inherit", "inherit"],
       env,
-      ...containmentGateNonce ? { cwd: ownershipDirectory ?? dirname4(supervisorEntry) } : {},
+      ...containmentGateNonce ? { cwd: ownershipDirectory ?? dirname5(supervisorEntry) } : {},
       detached: platform !== "win32",
       // The new launcher can discover the durable PID record and still has
       // to bind it to this exact process before signalling a recycled PID.
@@ -28409,8 +28651,8 @@ async function launchHostSupervisor(options = {}) {
   });
   const customDelay = options.delay;
   const ownsWorkerBoundary = options.spawnSupervisor === void 0 || options.ownershipRoot !== void 0;
-  const ownershipRoot = options.ownershipRoot ?? join8(versionsRoot(), "launcher-ownership");
-  const runRegistryRoot2 = options.runRegistryRoot ?? (options.ownershipRoot ? join8(dirname4(options.ownershipRoot), "run-registry") : defaultRunRegistryRoot());
+  const ownershipRoot = options.ownershipRoot ?? join10(versionsRoot(), "launcher-ownership");
+  const runRegistryRoot2 = options.runRegistryRoot ?? (options.ownershipRoot ? join10(dirname5(options.ownershipRoot), "run-registry") : defaultRunRegistryRoot());
   const terminateRecordedOwnership = options.terminateRecordedOwnership ?? terminateRecordedProcessTree;
   const createSupervisorContainment = options.createSupervisorContainment ?? (platform === "win32" && options.spawnSupervisor === void 0 ? async (target, identityNonce, signal) => {
     if (!target.pid) throw new Error("supervisor process id is unavailable");
@@ -28519,8 +28761,8 @@ async function launchHostSupervisor(options = {}) {
   let stdinIsPipe = options.parentStdinIsPipe ?? false;
   if (options.parentStdinIsPipe === void 0) {
     try {
-      const stat3 = fstatSync(0);
-      stdinIsPipe = !stat3.isCharacterDevice() && !stat3.isFile() && !process.stdin.isTTY;
+      const stat4 = fstatSync(0);
+      stdinIsPipe = !stat4.isCharacterDevice() && !stat4.isFile() && !process.stdin.isTTY;
     } catch {
     }
   }
@@ -28677,10 +28919,10 @@ async function superviseHost(options = {}) {
   const log2 = options.log ?? ((message) => console.error(message));
   const signalWorker = options.signalWorker ?? signalWorkerGroup;
   const inheritedOwnershipDirectory = process.env[LAUNCHER_OWNERSHIP_DIR_ENV];
-  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute9(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
+  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute10(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
   if (productionLifecycle && isSupervisorRole() && launcherOwnershipDirectory) {
     const generationNonce = basename3(launcherOwnershipDirectory);
-    const expectedOwnershipFile = join8(launcherOwnershipDirectory, `${generationNonce}.json`);
+    const expectedOwnershipFile = join10(launcherOwnershipDirectory, `${generationNonce}.json`);
     const configuredOwnershipFile = process.env[SUPERVISOR_OWNERSHIP_FILE_ENV];
     if (process.argv0 !== generationNonce || configuredOwnershipFile !== expectedOwnershipFile || !recordWorkerOwnership(expectedOwnershipFile, generationNonce)) {
       log2("Zixt Host: supervisor ownership could not be committed; refusing to start a worker");
@@ -29329,9 +29571,9 @@ function beginWorkerShutdown(options) {
 // src/parent-pipe.ts
 import { fstatSync as fstatSync2 } from "node:fs";
 var END_OF_TEXT = 3;
-function stdinIsParentPipe(stat3 = (fd) => fstatSync2(fd), isTTY = process.stdin.isTTY === true) {
+function stdinIsParentPipe(stat4 = (fd) => fstatSync2(fd), isTTY = process.stdin.isTTY === true) {
   try {
-    const stdin = stat3(0);
+    const stdin = stat4(0);
     return !stdin.isCharacterDevice() && !stdin.isFile() && !isTTY;
   } catch {
     return false;
@@ -29359,14 +29601,14 @@ function watchParentPipe(pipe2, onStop) {
 }
 
 // src/index.ts
-import { homedir as homedir14, hostname as hostname3 } from "node:os";
+import { homedir as homedir16, hostname as hostname3 } from "node:os";
 
 // src/hardware.ts
 import { existsSync } from "node:fs";
 import { statfs } from "node:fs/promises";
-import { cpus, freemem, homedir as homedir4, totalmem } from "node:os";
-import { dirname as dirname5, resolve as resolve6 } from "node:path";
-async function machineHardware(workRoot = homedir4()) {
+import { cpus, freemem, homedir as homedir5, totalmem } from "node:os";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
+async function machineHardware(workRoot = homedir5()) {
   return {
     // A container or cgroup can hide processors from this count; it is what
     // this process can see, which is what its Tasks will actually get.
@@ -29394,7 +29636,7 @@ function nearestExistingPath(start) {
   let candidate = resolve6(start);
   for (let depth = 0; depth < 16; depth++) {
     if (existsSync(candidate)) return candidate;
-    const parent = dirname5(candidate);
+    const parent = dirname6(candidate);
     if (parent === candidate) return null;
     candidate = parent;
   }
@@ -29588,17 +29830,17 @@ function createDemoBrowserAdapterFactory() {
 }
 
 // src/browser/manager.ts
-import { lstat as lstat6, mkdir as mkdir6, open as open5, opendir, readFile as readFile8, rename as rename4, rm as rm6 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname6, join as join9, resolve as resolve7 } from "node:path";
+import { lstat as lstat6, mkdir as mkdir7, open as open5, opendir, readFile as readFile8, rename as rename4, rm as rm7 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import { dirname as dirname7, join as join11, resolve as resolve7 } from "node:path";
 var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
 var FRAME_MIN_INTERVAL_MS = 100;
 var IDLE_TIMEOUT_MS = 15 * 6e4;
 var BrowserManager = class {
   constructor(opts) {
     this.opts = opts;
-    this.profileRoot = opts.profileRoot ?? join9(homedir5(), ".zixt", "browser-profiles");
-    this.profileStateRoot = join9(this.profileRoot, ".profile-state");
+    this.profileRoot = opts.profileRoot ?? join11(homedir6(), ".zixt", "browser-profiles");
+    this.profileStateRoot = join11(this.profileRoot, ".profile-state");
     this.viewport = opts.viewport ?? BROWSER_DEFAULT_VIEWPORT;
     this.idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
     this.frameMinIntervalMs = opts.frameMinIntervalMs ?? FRAME_MIN_INTERVAL_MS;
@@ -29695,15 +29937,15 @@ var BrowserManager = class {
   exactChild(root, child) {
     const canonicalRoot = resolve7(root);
     const target = resolve7(canonicalRoot, child);
-    if (dirname6(target) !== canonicalRoot) {
+    if (dirname7(target) !== canonicalRoot) {
       throw new Error("browser profile path escaped its owned root");
     }
     return target;
   }
   async ensureOwnedDirectory(path) {
-    await mkdir6(path, { recursive: true, mode: 448 });
-    const stat3 = await lstat6(path);
-    if (!stat3.isDirectory() || stat3.isSymbolicLink()) {
+    await mkdir7(path, { recursive: true, mode: 448 });
+    const stat4 = await lstat6(path);
+    if (!stat4.isDirectory() || stat4.isSymbolicLink()) {
       throw new Error("browser profile root must be an owned directory, not a symbolic link");
     }
   }
@@ -29767,7 +30009,7 @@ var BrowserManager = class {
       await this.syncDirectory(this.profileStateRoot);
       await this.syncDirectory(this.profileRoot);
     } catch (error52) {
-      await rm6(temporary, { force: true }).catch(() => {
+      await rm7(temporary, { force: true }).catch(() => {
       });
       throw error52;
     }
@@ -29847,7 +30089,7 @@ var BrowserManager = class {
       } catch (error52) {
         if (error52.code !== "ENOENT") throw error52;
       }
-      await mkdir6(profileDir, { recursive: true, mode: 448 });
+      await mkdir7(profileDir, { recursive: true, mode: 448 });
       const adapter = await this.opts.factory.open({
         taskId,
         agentId,
@@ -29935,7 +30177,7 @@ var BrowserManager = class {
       });
       const sessionTaskIds = [...this.sessions.values()].filter((session) => session.agentId === agentId).map((session) => session.taskId);
       for (const taskId of sessionTaskIds) await this.closeLocked(taskId, "stopped");
-      await rm6(this.profilePath(agentId), { recursive: true, force: true, maxRetries: 3 });
+      await rm7(this.profilePath(agentId), { recursive: true, force: true, maxRetries: 3 });
       await this.syncDirectory(this.profileRoot);
     });
   }
@@ -30106,13 +30348,13 @@ var BrowserManager = class {
 };
 
 // src/browser/playwright-adapter.ts
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { access as access3 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { dirname as dirname8, join as join12 } from "node:path";
 var nodeRequire = createRequire(import.meta.url);
 var playwrightCoreManifestPath = nodeRequire.resolve("playwright-core/package.json");
-var playwrightCoreRoot = dirname7(playwrightCoreManifestPath);
+var playwrightCoreRoot = dirname8(playwrightCoreManifestPath);
 var playwrightCoreVersion = nodeRequire(playwrightCoreManifestPath).version;
 if (typeof playwrightCoreVersion !== "string" || !/^\d+\.\d+\.\d+$/.test(playwrightCoreVersion)) {
   throw new Error("playwright-core package version is invalid");
@@ -30129,12 +30371,15 @@ async function loadPlaywright() {
   return import("playwright-core");
 }
 async function installChromium() {
-  const cliPath = join10(playwrightCoreRoot, "cli.js");
+  const cliPath = join12(playwrightCoreRoot, "cli.js");
   await new Promise((resolve18, reject3) => {
-    const child = spawn6(process.execPath, [cliPath, "install", "chromium"], {
+    const child = spawn7(process.execPath, [cliPath, "install", "chromium"], {
       env: process.env,
       stdio: ["ignore", "inherit", "inherit"],
-      windowsHide: false
+      // A service-managed Host has no console; letting Windows allocate one
+      // here would flash a visible window on the signed-in desktop for the
+      // whole download. Progress still flows through the inherited pipes.
+      windowsHide: true
     });
     let settled = false;
     const finish = (error52) => {
@@ -30760,11 +31005,11 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
 }
 
 // src/runners/cli-runner.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { lstat as lstat11, mkdir as mkdir11, realpath as realpath8 } from "node:fs/promises";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute15, join as join16, resolve as resolve10 } from "node:path";
+import { lstat as lstat11, mkdir as mkdir12, realpath as realpath8 } from "node:fs/promises";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname10, isAbsolute as isAbsolute16, join as join18, resolve as resolve10 } from "node:path";
 
 // src/tool-packs/browser/authentication-wall.ts
 var AUTH_PATH_SEGMENT = /(?:^|\/)(?:log[-_]?in|sign[-_]?in|sso|saml|auth|authorize|authenticate|oauth2?|session\/new|checkpoint)(?:\/|$)/i;
@@ -33582,16 +33827,16 @@ function createGithubPushOrchestrator(input) {
 }
 
 // src/tool-packs/github/git-bridge.ts
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat8, mkdir as mkdir7, realpath as realpath5, rm as rm7 } from "node:fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute11, join as join12, relative as relative6 } from "node:path";
+import { chmod as chmod4, lstat as lstat8, mkdir as mkdir8, realpath as realpath5, rm as rm8 } from "node:fs/promises";
+import { dirname as dirname9, isAbsolute as isAbsolute12, join as join14, relative as relative6 } from "node:path";
 
 // src/tool-packs/github/git-credential-broker.ts
 import { createServer } from "node:http";
 import { randomBytes, randomUUID as randomUUID7, timingSafeEqual } from "node:crypto";
-import { chmod as chmod3, lstat as lstat7, realpath as realpath4, writeFile as writeFile3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute10, join as join11, relative as relative5 } from "node:path";
+import { chmod as chmod3, lstat as lstat7, realpath as realpath4, writeFile as writeFile4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute11, join as join13, relative as relative5 } from "node:path";
 var MAX_REQUEST_BYTES = 16 * 1024;
 var FILE_MODE2 = 384;
 var HELPER_SOURCE = String.raw`'use strict';
@@ -33705,7 +33950,7 @@ async function readBoundedBody2(request) {
 }
 function assertChildPath(parent, child) {
   const path = relative5(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute10(path)) {
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute11(path)) {
     throw new Error("Git credential helper path escaped its private run directory");
   }
 }
@@ -33720,9 +33965,9 @@ async function createGithubGitCredentialBroker(input) {
     throw new Error("Git credential broker requires a private real run directory");
   }
   const runRoot = await realpath4(input.runArtifactsRoot);
-  const helperPath = join11(runRoot, `git-credential-${randomUUID7()}.cjs`);
+  const helperPath = join13(runRoot, `git-credential-${randomUUID7()}.cjs`);
   assertChildPath(runRoot, helperPath);
-  await writeFile3(helperPath, HELPER_SOURCE, { flag: "wx", mode: FILE_MODE2 });
+  await writeFile4(helperPath, HELPER_SOURCE, { flag: "wx", mode: FILE_MODE2 });
   await chmod3(helperPath, FILE_MODE2);
   const capability2 = randomBytes(32).toString("base64url");
   const expectedPath = `${input.repositoryFullName}.git`;
@@ -33820,7 +34065,7 @@ ${stderr}`;
 }
 function assertBelow2(parent, child, label) {
   const path = relative6(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute11(path)) {
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute12(path)) {
     throw new GithubGitProcessError("invalid_input");
   }
   void label;
@@ -33835,8 +34080,8 @@ async function requireRealDirectory2(path, label) {
 }
 async function validateTokenlessPaths(command) {
   if (command.kind === "clone-from-bridge") {
-    if (!isAbsolute11(command.destination)) throw new GithubGitProcessError("invalid_input");
-    const parent = await requireRealDirectory2(dirname8(command.destination), "clone parent");
+    if (!isAbsolute12(command.destination)) throw new GithubGitProcessError("invalid_input");
+    const parent = await requireRealDirectory2(dirname9(command.destination), "clone parent");
     assertBelow2(parent, command.destination, "clone destination");
     const destination = await lstat8(command.destination).catch((error52) => {
       if (error52.code === "ENOENT") return null;
@@ -33846,7 +34091,7 @@ async function validateTokenlessPaths(command) {
     return;
   }
   if ("repositoryPath" in command) {
-    if (!isAbsolute11(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+    if (!isAbsolute12(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
     const repositoryPath5 = await requireRealDirectory2(command.repositoryPath, "repository path");
     if (repositoryPath5 !== command.repositoryPath) throw new GithubGitProcessError("invalid_input");
   }
@@ -33926,13 +34171,13 @@ async function runGit(input, args, env) {
   if (input.authoritySignal.aborted || input.cancelledNow()) {
     throw new GithubGitProcessError("cancelled");
   }
-  if (!isAbsolute11(input.executablePath)) throw new GithubGitProcessError("invalid_input");
+  if (!isAbsolute12(input.executablePath)) throw new GithubGitProcessError("invalid_input");
   const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS2) {
     throw new GithubGitProcessError("invalid_input");
   }
   return new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn7(input.executablePath, [...input.commandPrefixArgs ?? [], ...args], {
+    const child = spawn8(input.executablePath, [...input.commandPrefixArgs ?? [], ...args], {
       cwd: input.trustedCwd,
       env,
       shell: false,
@@ -34032,7 +34277,7 @@ function tokenlessArgs(command) {
   switch (command.kind) {
     case "clone-from-bridge":
       assertRef(command.branch);
-      if (!isAbsolute11(command.destination)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute12(command.destination)) throw new GithubGitProcessError("invalid_input");
       return [
         "clone",
         "--no-recurse-submodules",
@@ -34044,7 +34289,7 @@ function tokenlessArgs(command) {
       ];
     case "fetch-from-bridge":
       assertFetchRefspecs(command.refspecs);
-      if (!isAbsolute11(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute12(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -34056,7 +34301,7 @@ function tokenlessArgs(command) {
         ...command.refspecs
       ];
     case "copy-commit-to-bridge":
-      if (!isAbsolute11(command.repositoryPath) || !SHA.test(command.sha)) {
+      if (!isAbsolute12(command.repositoryPath) || !SHA.test(command.sha)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -34068,11 +34313,11 @@ function tokenlessArgs(command) {
         `${command.sha}:refs/zixt/push-source`
       ];
     case "rev-parse":
-      if (!isAbsolute11(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute12(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       assertRef(command.ref);
       return ["-C", command.repositoryPath, "rev-parse", "--verify", `${command.ref}^{commit}`];
     case "remote-configure":
-      if (!isAbsolute11(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
+      if (!isAbsolute12(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -34084,7 +34329,7 @@ function tokenlessArgs(command) {
         `https://github.com/${command.repositoryFullName}.git`
       ];
     case "status":
-      if (!isAbsolute11(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute12(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -34114,7 +34359,7 @@ function createGithubGitBridge(input) {
   })();
   const requireBridge = async (value) => {
     const current = await roots();
-    if (!isAbsolute11(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
+    if (!isAbsolute12(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
     const real = await requireRealDirectory2(value, "git bridge");
     assertBelow2(current.bridges, real, "git bridge");
     if (real !== value) throw new GithubGitProcessError("invalid_input");
@@ -34124,9 +34369,9 @@ function createGithubGitBridge(input) {
     async createPrivateBridge() {
       if (closed) throw new GithubGitProcessError("cancelled");
       const current = await roots();
-      const path = join12(current.bridges, `${randomUUID8()}.git`);
+      const path = join14(current.bridges, `${randomUUID8()}.git`);
       assertBelow2(current.bridges, path, "git bridge");
-      await mkdir7(path, { mode: DIRECTORY_MODE2 });
+      await mkdir8(path, { mode: DIRECTORY_MODE2 });
       await chmod4(path, DIRECTORY_MODE2);
       try {
         await runGit(
@@ -34142,16 +34387,16 @@ function createGithubGitBridge(input) {
         );
         const real = await requireRealDirectory2(path, "git bridge");
         assertBelow2(current.bridges, real, "git bridge");
-        const hooks = join12(real, "hooks");
-        await rm7(hooks, { recursive: true, force: true });
-        await mkdir7(hooks, { mode: DIRECTORY_MODE2 });
+        const hooks = join14(real, "hooks");
+        await rm8(hooks, { recursive: true, force: true });
+        await mkdir8(hooks, { mode: DIRECTORY_MODE2 });
         await chmod4(hooks, DIRECTORY_MODE2);
-        const config2 = join12(real, "config");
+        const config2 = join14(real, "config");
         await chmod4(config2, 384);
         active.add(real);
         return real;
       } catch (error52) {
-        await rm7(path, { recursive: true, force: true }).catch(() => {
+        await rm8(path, { recursive: true, force: true }).catch(() => {
         });
         throw error52;
       }
@@ -34245,7 +34490,7 @@ function createGithubGitBridge(input) {
     },
     async destroyPrivateBridge(path) {
       const bridge = await requireBridge(path);
-      await rm7(bridge, { recursive: true, force: true });
+      await rm8(bridge, { recursive: true, force: true });
       active.delete(bridge);
       credentialed2.delete(bridge);
     },
@@ -34253,7 +34498,7 @@ function createGithubGitBridge(input) {
       if (closed) return;
       closed = true;
       const paths = [...active];
-      await Promise.all(paths.map((path) => rm7(path, { recursive: true, force: true })));
+      await Promise.all(paths.map((path) => rm8(path, { recursive: true, force: true })));
       active.clear();
       credentialed2.clear();
     }
@@ -34594,8 +34839,8 @@ function createRepositoryTools(runtime) {
 
 // src/tool-packs/github/workspace.ts
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat9, mkdir as mkdir8, readFile as readFile9, realpath as realpath6, rename as rename5, rm as rm8, writeFile as writeFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute12, join as join13, relative as relative7, resolve as resolve8 } from "node:path";
+import { chmod as chmod5, lstat as lstat9, mkdir as mkdir9, readFile as readFile9, realpath as realpath6, rename as rename5, rm as rm9, writeFile as writeFile5 } from "node:fs/promises";
+import { isAbsolute as isAbsolute13, join as join15, relative as relative7, resolve as resolve8 } from "node:path";
 var SAFE_LOCAL_ID = /^[A-Za-z0-9_-]{1,200}$/;
 var FULL_NAME2 = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
 var DIRECTORY_MODE3 = 448;
@@ -34613,7 +34858,7 @@ function hasControlCharacter2(value) {
 }
 function assertBelow3(parent, child, label) {
   const path = relative7(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute12(path)) {
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute13(path)) {
     throw new Error(`${label} escaped the task workspace`);
   }
 }
@@ -34632,10 +34877,10 @@ async function requireRealDirectory3(path, label) {
   return real;
 }
 async function createOrRequirePrivateDirectory(parent, name, label) {
-  const path = join13(parent, name);
+  const path = join15(parent, name);
   assertBelow3(parent, path, label);
   try {
-    await mkdir8(path, { mode: DIRECTORY_MODE3 });
+    await mkdir9(path, { mode: DIRECTORY_MODE3 });
   } catch (error52) {
     if (error52.code !== "EEXIST") throw error52;
   }
@@ -34715,8 +34960,8 @@ async function createGithubWorkspaceService(input) {
     if (expectedFullName !== void 0 && repository.fullName !== expectedFullName) {
       throw new Error("GitHub repository name does not match this task grant");
     }
-    const destination = join13(repositoriesRoot, parsed.data);
-    const metadataPath = join13(metadataRoot, `${parsed.data}.json`);
+    const destination = join15(repositoriesRoot, parsed.data);
+    const metadataPath = join15(metadataRoot, `${parsed.data}.json`);
     if (!await pathExists(destination) || !await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace has not been prepared");
     }
@@ -34733,14 +34978,14 @@ async function createGithubWorkspaceService(input) {
     return real;
   };
   const cloneRepository = async (clone2) => {
-    const destination = join13(repositoriesRoot, clone2.repositoryId);
-    const metadataPath = join13(metadataRoot, `${clone2.repositoryId}.json`);
+    const destination = join15(repositoriesRoot, clone2.repositoryId);
+    const metadataPath = join15(metadataRoot, `${clone2.repositoryId}.json`);
     assertBelow3(repositoriesRoot, destination, "repository path");
     assertBelow3(metadataRoot, metadataPath, "repository metadata");
     if (await pathExists(destination) || await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace already exists or is inconsistent");
     }
-    const temporary = join13(repositoriesRoot, `.clone-${randomUUID9()}`);
+    const temporary = join15(repositoriesRoot, `.clone-${randomUUID9()}`);
     assertBelow3(repositoriesRoot, temporary, "temporary clone");
     try {
       await input.git.clone({
@@ -34765,9 +35010,9 @@ async function createGithubWorkspaceService(input) {
         path: destination,
         ...clone2.createIntentId === void 0 ? {} : { createIntentId: clone2.createIntentId }
       };
-      const metadataTemporary = join13(metadataRoot, `.${clone2.repositoryId}-${randomUUID9()}.tmp`);
+      const metadataTemporary = join15(metadataRoot, `.${clone2.repositoryId}-${randomUUID9()}.tmp`);
       assertBelow3(metadataRoot, metadataTemporary, "temporary repository metadata");
-      await writeFile4(metadataTemporary, `${JSON.stringify(metadata)}
+      await writeFile5(metadataTemporary, `${JSON.stringify(metadata)}
 `, {
         flag: "wx",
         mode: FILE_MODE3
@@ -34778,11 +35023,11 @@ async function createGithubWorkspaceService(input) {
         try {
           await rename5(metadataTemporary, metadataPath);
         } catch (error52) {
-          await rm8(destination, { recursive: true, force: true });
+          await rm9(destination, { recursive: true, force: true });
           throw error52;
         }
       } finally {
-        await rm8(metadataTemporary, { force: true }).catch(() => {
+        await rm9(metadataTemporary, { force: true }).catch(() => {
         });
       }
       const path = await requireRealDirectory3(destination, "GitHub repository");
@@ -34794,14 +35039,14 @@ async function createGithubWorkspaceService(input) {
         headSha
       };
     } finally {
-      await rm8(temporary, { recursive: true, force: true }).catch(() => {
+      await rm9(temporary, { recursive: true, force: true }).catch(() => {
       });
     }
   };
   const prepareRepository = async (authority) => {
     const { repository } = authority;
-    const destination = join13(repositoriesRoot, repository.repositoryId);
-    const metadataPath = join13(metadataRoot, `${repository.repositoryId}.json`);
+    const destination = join15(repositoriesRoot, repository.repositoryId);
+    const metadataPath = join15(metadataRoot, `${repository.repositoryId}.json`);
     assertBelow3(repositoriesRoot, destination, "repository path");
     assertBelow3(metadataRoot, metadataPath, "repository metadata");
     return withWorkspaceLock(destination, async () => {
@@ -34966,7 +35211,7 @@ async function createGithubWorkspaceService(input) {
         throw new Error("GitHub created repository is outside this installation");
       }
       parseGitRef(cloneInput.repository.defaultBranch, "default branch");
-      return withWorkspaceLock(join13(repositoriesRoot, repositoryId2), async () => {
+      return withWorkspaceLock(join15(repositoriesRoot, repositoryId2), async () => {
         const prepared = await cloneRepository({
           repositoryId: repositoryId2,
           fullName: cloneInput.repository.fullName,
@@ -37090,8 +37335,8 @@ function createCommsToolPacks(grants, context) {
 }
 
 // src/runners/attachments.ts
-import { mkdir as mkdir9, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { mkdir as mkdir10, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join16 } from "node:path";
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
 function sanitizeAttachmentFileName(name) {
   const base = name.split(/[/\\]/).pop() ?? "";
@@ -37120,10 +37365,10 @@ async function materializeAttachments(task, taskRoot) {
         `attached file "${attachment.name}" arrived incomplete (${bytes.byteLength} of ${attachment.size} bytes)`
       );
     }
-    const directory = join14(taskRoot, ".zixt-attachments", task.taskId, attachment.id);
-    await mkdir9(directory, { recursive: true });
-    const path = join14(directory, sanitizeAttachmentFileName(attachment.name));
-    await writeFile5(path, bytes);
+    const directory = join16(taskRoot, ".zixt-attachments", task.taskId, attachment.id);
+    await mkdir10(directory, { recursive: true });
+    const path = join16(directory, sanitizeAttachmentFileName(attachment.name));
+    await writeFile6(path, bytes);
     materialized.push({
       path,
       name: attachment.name,
@@ -38140,7 +38385,7 @@ function createAskUserServer() {
 }
 
 // src/runners/runner-env.ts
-import { delimiter as delimiter2, isAbsolute as isAbsolute13 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute14 } from "node:path";
 var PROVIDER_AUTHORITY_PREFIXES = ["GH_", "GITHUB_", "GIT_", "SSH_"];
 var HOST_AUTHORITY_PREFIXES = [
   "ZIXT_",
@@ -38199,7 +38444,7 @@ function inheritedValue(env, name) {
 }
 function sanitizeInheritedSearchPath(path) {
   if (!path) return "";
-  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute13(entry)).join(delimiter2);
+  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute14(entry)).join(delimiter2);
 }
 function buildRunnerEnv(input) {
   const env = {};
@@ -38280,9 +38525,9 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod6, lstat as lstat10, mkdir as mkdir10, realpath as realpath7, writeFile as writeFile6 } from "node:fs/promises";
+import { chmod as chmod6, lstat as lstat10, mkdir as mkdir11, realpath as realpath7, writeFile as writeFile7 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { isAbsolute as isAbsolute14, join as join15, relative as relative8 } from "node:path";
+import { isAbsolute as isAbsolute15, join as join17, relative as relative8 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
 var DIRECTORY_MODE4 = 448;
 var PRIVATE_FILE_MODE = 384;
@@ -38488,7 +38733,7 @@ function parseGhInvocation(body) {
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const { args, cwd } = value;
-  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute14(cwd)) {
+  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute15(cwd)) {
     return null;
   }
   return { args, cwd };
@@ -38647,7 +38892,7 @@ function activationCredential(grant, now = Date.now()) {
 }
 function assertChildPath2(parent, child) {
   const path = relative8(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute14(path)) {
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute15(path)) {
     throw new Error("GitHub shell helper path escaped its private run directory");
   }
 }
@@ -38658,7 +38903,7 @@ function quoteForPosixShell(value) {
   return quoteForGitShell2(value);
 }
 async function writePrivate(path, content, executable = false) {
-  await writeFile6(path, content, {
+  await writeFile7(path, content, {
     flag: "wx",
     mode: executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE
   });
@@ -38670,7 +38915,7 @@ async function prepareHelpers(input) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
   const runRoot = await realpath7(input.runRoot);
-  const helperPath = join15(runRoot, "github-shell-git-credential.cjs");
+  const helperPath = join17(runRoot, "github-shell-git-credential.cjs");
   assertChildPath2(runRoot, helperPath);
   await writePrivate(helperPath, GIT_HELPER_SOURCE);
   if (!input.ghExecutablePath) {
@@ -38681,14 +38926,14 @@ async function prepareHelpers(input) {
       wrapperSourcePath: null
     };
   }
-  const shellToolsDirectory = join15(runRoot, "shell-tools");
+  const shellToolsDirectory = join17(runRoot, "shell-tools");
   assertChildPath2(runRoot, shellToolsDirectory);
-  await mkdir10(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
+  await mkdir11(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
   await chmod6(shellToolsDirectory, DIRECTORY_MODE4);
-  const wrapperSourcePath = join15(runRoot, "github-shell-gh-wrapper.cjs");
+  const wrapperSourcePath = join17(runRoot, "github-shell-gh-wrapper.cjs");
   assertChildPath2(runRoot, wrapperSourcePath);
   await writePrivate(wrapperSourcePath, GH_WRAPPER_SOURCE);
-  const wrapperPath = join15(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
+  const wrapperPath = join17(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
   assertChildPath2(runRoot, wrapperPath);
   const launcher = process.platform === "win32" ? `@"${process.execPath.replaceAll('"', '""')}" "${wrapperSourcePath.replaceAll('"', '""')}" %*\r
 ` : `#!/bin/sh
@@ -38911,7 +39156,7 @@ password=${credential.accessToken}
 }
 
 // src/runners/working-context.ts
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 import { resolve as resolve9 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
@@ -39042,7 +39287,7 @@ async function stopWorkingContextCommand(child, childExited, options = {}) {
 function run(command, args, cwd, env, signal) {
   if (signal?.aborted) return Promise.resolve(null);
   return new Promise((resolvePromise) => {
-    const child = spawn8(command, [...args], {
+    const child = spawn9(command, [...args], {
       cwd,
       env: { ...env, GIT_OPTIONAL_LOCKS: "0" },
       detached: process.platform !== "win32",
@@ -39482,7 +39727,7 @@ async function settlesWithin(promise2, timeoutMs) {
   }
 }
 function defaultRunnerWorkspaceRoot() {
-  return join16(homedir6(), ".zixt", "workspaces");
+  return join18(homedir7(), ".zixt", "workspaces");
 }
 function defaultRunnerArtifactRoot() {
   return defaultRunArtifactRoot();
@@ -39531,7 +39776,7 @@ function createCliRunner(adapter, opts = {}) {
   const prefixArgs = opts.commandPrefixArgs ?? [];
   const maxWallTimeMs = opts.maxWallTimeMs;
   const workspaceRoot = opts.workspaceRoot ?? defaultRunnerWorkspaceRoot();
-  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join16(dirname9(workspaceRoot), "run-artifacts"));
+  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join18(dirname10(workspaceRoot), "run-artifacts"));
   const runRegistryRoot2 = opts.runRegistryRoot ?? defaultRunRegistryRoot();
   const createArtifacts = opts.createArtifacts ?? createRunArtifacts;
   const toolPackRegistry2 = opts.toolPackRegistry ?? createDefaultToolPackRegistry();
@@ -39549,7 +39794,7 @@ function createCliRunner(adapter, opts = {}) {
   };
   const askUserServer = createAskUserServer();
   const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join16(windowsRoot, "System32", "cmd.exe") : void 0;
+  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join18(windowsRoot, "System32", "cmd.exe") : void 0;
   let safetyFailure;
   return async (task) => {
     if (safetyFailure) {
@@ -39589,8 +39834,8 @@ function createCliRunner(adapter, opts = {}) {
         usage: { inputTokens: 0, outputTokens: 0 }
       };
     }
-    const taskRoot = join16(workspaceRoot, task.agentId);
-    await mkdir11(taskRoot, { recursive: true });
+    const taskRoot = join18(workspaceRoot, task.agentId);
+    await mkdir12(taskRoot, { recursive: true });
     if (task.cancelledNow()) return cancelledBeforeRun();
     const configuredWorkspace = task.spec.workspace;
     let cwd = taskRoot;
@@ -39656,7 +39901,10 @@ function createCliRunner(adapter, opts = {}) {
     let terminalOutcomeProducedUnderAuthority = false;
     let preparedTerminalOutcome;
     try {
-      const resolvedCommand = await resolveTrustedCliCommand(command, trustedCommandOptions);
+      const resolvedCommand = await resolveRunnerCommand(command, adapter.type, {
+        resolution: trustedCommandOptions,
+        probe: true
+      });
       const resolvedWindowsComspec = windowsComspecCandidate ? await resolveTrustedCliCommand(windowsComspecCandidate, trustedCommandOptions) : null;
       const git = await measuredGit();
       const githubGrant = providerGrants.find(
@@ -39926,8 +40174,8 @@ ${attachmentSection}` : prompt;
         let changed = false;
         for (const path of paths) {
           if (!path || path.length > 4096) continue;
-          const absolutePath = isAbsolute15(path) ? path : resolve10(cwd, path);
-          const directory = dirname9(absolutePath);
+          const absolutePath = isAbsolute16(path) ? path : resolve10(cwd, path);
+          const directory = dirname10(absolutePath);
           observedWorkingDirectories.delete(directory);
           observedWorkingDirectories.add(directory);
           while (observedWorkingDirectories.size > 19) {
@@ -40366,7 +40614,7 @@ function runCliProcess(options) {
   return new Promise((resolve18) => {
     const platform = options.platform ?? process.platform;
     const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID11() : void 0;
-    const child = options.guardian ? spawn9(
+    const child = options.guardian ? spawn10(
       options.guardian.nodeCommand,
       [
         options.guardian.scriptPath,
@@ -40377,7 +40625,7 @@ function runCliProcess(options) {
         // The idle pre-assignment guardian must never load from or depend
         // on an untrusted Task checkout. Only the post-gate target enters
         // the requested working directory from its private release frame.
-        cwd: dirname9(options.guardian.scriptPath),
+        cwd: dirname10(options.guardian.scriptPath),
         env: runnerGuardianEnv(process.env, containmentGateNonce),
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true,
@@ -40658,13 +40906,13 @@ import { randomUUID as randomUUID12 } from "node:crypto";
 
 // src/runners/runtime-observation.ts
 import { open as open6, readdir as readdir5, realpath as realpath9 } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { join as join17 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join19 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
 var CATALOG_TIMEOUT_MS = 15e3;
 var CATALOG_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
 function homeFrom(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir7();
+  return env["HOME"] || env["USERPROFILE"] || homedir8();
 }
 async function readHead(path) {
   let handle;
@@ -40719,9 +40967,9 @@ function displayValue(value, maxLength) {
   return trimmed;
 }
 function claudeTranscriptPath(input) {
-  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join17(homeFrom(input.env), ".claude");
+  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join19(homeFrom(input.env), ".claude");
   const slug = input.resolvedCwd.replace(/[^a-zA-Z0-9]/g, "-");
-  return join17(configDir, "projects", slug, `${input.sessionId}.jsonl`);
+  return join19(configDir, "projects", slug, `${input.sessionId}.jsonl`);
 }
 async function readClaudeSessionEffort(input) {
   const resolvedCwd = await realpath9(input.cwd).catch(() => input.cwd);
@@ -40737,18 +40985,18 @@ async function readClaudeSessionEffort(input) {
 }
 async function newestDirectories(root, limit) {
   const entries = await readdir5(root, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join17(root, name));
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join19(root, name));
 }
 async function findCodexRolloutPath(input) {
-  const codexHome = input.env["CODEX_HOME"] || join17(homeFrom(input.env), ".codex");
-  const sessions = join17(codexHome, "sessions");
+  const codexHome = input.env["CODEX_HOME"] || join19(homeFrom(input.env), ".codex");
+  const sessions = join19(codexHome, "sessions");
   const suffix = `-${input.threadId}.jsonl`;
   for (const year of await newestDirectories(sessions, 2)) {
     for (const month of await newestDirectories(year, 2)) {
       for (const day of await newestDirectories(month, 3)) {
         const files = await readdir5(day).catch(() => []);
         const match = files.find((name) => name.endsWith(suffix));
-        if (match) return join17(day, match);
+        if (match) return join19(day, match);
       }
     }
   }
@@ -41142,18 +41390,18 @@ function improveErrorMessage(error52) {
 }
 
 // src/runners/codex.ts
-import { mkdir as mkdir12, readFile as readFile10, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir13, readFile as readFile10, writeFile as writeFile8 } from "node:fs/promises";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { homedir as homedir8 } from "node:os";
-import { join as join18 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join20 } from "node:path";
 var CODEX_NOT_FOUND_MESSAGE = "The `codex` CLI was not found on this Machine. Install it (npm install -g @openai/codex) and sign in with `codex login`, or switch the agent to API-key auth.";
 function defaultCodexThreadIndexRoot() {
-  return join18(homedir8(), ".zixt", "codex-threads");
+  return join20(homedir9(), ".zixt", "codex-threads");
 }
 var SAFE_SEGMENT3 = /^[A-Za-z0-9_-]{1,200}$/;
 function threadIndexPath(root, agentId, sessionKey) {
   if (!SAFE_SEGMENT3.test(agentId) || !SAFE_SEGMENT3.test(sessionKey)) return null;
-  return join18(root, agentId, `${sessionKey}.json`);
+  return join20(root, agentId, `${sessionKey}.json`);
 }
 async function readThreadId(path) {
   try {
@@ -41257,7 +41505,7 @@ ${value}` : value;
       const recordedThreadId = indexPath ? await readThreadId(indexPath) : null;
       const rememberThread = (threadId) => {
         if (!indexPath) return;
-        void mkdir12(join18(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile7(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
+        void mkdir13(join20(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile8(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
         });
       };
       const observeRuntime = (threadId) => {
@@ -41720,9 +41968,9 @@ function improveCodexErrorMessage(error52) {
 }
 
 // src/runners/git-preflight.ts
-import { spawn as spawn10 } from "node:child_process";
+import { spawn as spawn11 } from "node:child_process";
 import { realpath as realpath10 } from "node:fs/promises";
-import { isAbsolute as isAbsolute16, resolve as resolve11 } from "node:path";
+import { isAbsolute as isAbsolute17, resolve as resolve11 } from "node:path";
 var OUTPUT_LIMIT = 8192;
 var DEFAULT_TIMEOUT_MS4 = 1e4;
 var VERSION_PATTERN = /^git version [^\r\n]{1,108}$/;
@@ -41738,7 +41986,7 @@ function unavailable(error52, checkedAt, executablePath = null) {
 async function preflightGit(options = {}) {
   const checkedAt = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const configured = options.command;
-  if (configured !== void 0 && !isAbsolute16(configured)) {
+  if (configured !== void 0 && !isAbsolute17(configured)) {
     return unavailable("configured git command must be an absolute file", checkedAt);
   }
   const trustedCwd = await realpath10(resolve11(options.trustedCwd ?? process.cwd())).catch(() => null);
@@ -41769,7 +42017,7 @@ async function preflightGit(options = {}) {
 }
 async function runVersionProbe(input) {
   return new Promise((resolvePromise) => {
-    const child = spawn10(input.executablePath, input.args, {
+    const child = spawn11(input.executablePath, input.args, {
       cwd: input.cwd,
       env: {
         ...process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {},
@@ -41838,7 +42086,7 @@ async function preflightClaudeCode(options = {}) {
   const command = options.command ?? "claude";
   const prefixArgs = options.commandPrefixArgs ?? [];
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const trustedCommand = await resolveTrustedCliCommand(command);
+  const trustedCommand = await resolveRunnerCommand(command, "claude-code", { probe: true });
   if (!trustedCommand) {
     return {
       type: "claude-code",
@@ -41889,7 +42137,7 @@ async function preflightCodex(options = {}) {
   const command = options.command ?? "codex";
   const prefixArgs = options.commandPrefixArgs ?? [];
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const trustedCommand = await resolveTrustedCliCommand(command);
+  const trustedCommand = await resolveRunnerCommand(command, "codex", { probe: true });
   if (!trustedCommand) {
     return {
       type: "codex",
@@ -41991,11 +42239,11 @@ function run2(command, args) {
 }
 
 // src/linux-service.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn12 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
-import { access as access4, chmod as chmod7, mkdir as mkdir13, open as open7, rename as rename6, rm as rm9 } from "node:fs/promises";
-import { homedir as homedir9, userInfo } from "node:os";
-import { basename as basename4, dirname as dirname10, join as join19, relative as relative9, resolve as resolve12, sep as sep5 } from "node:path";
+import { access as access4, chmod as chmod7, mkdir as mkdir14, open as open7, rename as rename6, rm as rm10 } from "node:fs/promises";
+import { homedir as homedir10, userInfo } from "node:os";
+import { basename as basename4, dirname as dirname11, join as join21, relative as relative9, resolve as resolve12, sep as sep5 } from "node:path";
 var SERVICE_NAME = "zixt-host.service";
 var SYSTEM_SERVICE_COMMAND_TIMEOUT_MS = 7e4;
 var SERVICE_STABILITY_DELAY_MS = 2e3;
@@ -42024,7 +42272,7 @@ function boundedAppend(current, chunk) {
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
   return new Promise((resolve18) => {
-    const child = spawn11(command, [...args], {
+    const child = spawn12(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
       windowsHide: true
@@ -42096,22 +42344,22 @@ async function defaultSyncDirectory(path) {
   }
 }
 async function ensureDirectory(path, mode, syncDirectory8) {
-  const firstCreated = await mkdir13(path, { recursive: true, mode });
+  const firstCreated = await mkdir14(path, { recursive: true, mode });
   if (!firstCreated) return;
   const first = resolve12(firstCreated);
   const target = resolve12(path);
-  await syncDirectory8(dirname10(first));
+  await syncDirectory8(dirname11(first));
   let current = first;
   const descendants = relative9(first, target);
   for (const part of descendants ? descendants.split(sep5) : []) {
     await syncDirectory8(current);
-    current = join19(current, part);
+    current = join21(current, part);
   }
 }
 async function replacePrivateFile(path, contents, mode, syncDirectory8) {
-  const parent = dirname10(path);
+  const parent = dirname11(path);
   await ensureDirectory(parent, 448, syncDirectory8);
-  const temporary = join19(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join21(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open7(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -42122,7 +42370,7 @@ async function replacePrivateFile(path, contents, mode, syncDirectory8) {
     await syncDirectory8(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm9(temporary, { force: true }).catch(() => void 0);
+    await rm10(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -42155,7 +42403,7 @@ async function installLinuxService(options) {
     throw new Error("Linux automatic startup is available only on Linux.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir9();
+  const home = options.home ?? homedir10();
   const username = oneLine(options.username ?? userInfo().username, "user name");
   const token2 = oneLine(options.token, "pairing code");
   const path = oneLine(
@@ -42163,12 +42411,12 @@ async function installLinuxService(options) {
     "command search path"
   );
   const cloudUrl = options.cloudUrl ? oneLine(options.cloudUrl, "Zixt Cloud address") : void 0;
-  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join19(home, ".config");
-  const configRoot = options.serviceConfigRoot ?? join19(xdgConfigHome, "zixt");
-  const unitRoot = options.userUnitRoot ?? join19(xdgConfigHome, "systemd", "user");
-  const environmentPath = join19(configRoot, "host.env");
-  const unitPath = join19(unitRoot, SERVICE_NAME);
-  const installVersion = options.installVersion ?? installRelease;
+  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join21(home, ".config");
+  const configRoot = options.serviceConfigRoot ?? join21(xdgConfigHome, "zixt");
+  const unitRoot = options.userUnitRoot ?? join21(xdgConfigHome, "systemd", "user");
+  const environmentPath = join21(configRoot, "host.env");
+  const unitPath = join21(unitRoot, SERVICE_NAME);
+  const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : activateInstalledRelease);
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
   const run3 = options.runCommand ?? defaultRunCommand;
@@ -42183,9 +42431,15 @@ async function installLinuxService(options) {
       "This Linux computer does not have the systemd tools Zixt needs to start itself."
     );
   }
-  const releaseEntry = await installVersion(options.hostVersion);
+  const attempt = { failure: null };
+  const releaseEntry = await installVersion(options.hostVersion, (failure2) => {
+    attempt.failure = failure2;
+  });
   if (!releaseEntry) {
-    throw new Error(`Zixt Host ${options.hostVersion} could not be installed for automatic start.`);
+    const failed = attempt.failure;
+    throw new Error(
+      `Zixt Host ${options.hostVersion} could not be installed for automatic start${failed ? ` (${failed.reason}: ${failed.detail})` : ""}.`
+    );
   }
   const currentEntry = await activateVersion(releaseEntry);
   const linger = async () => {
@@ -42207,8 +42461,12 @@ async function installLinuxService(options) {
     ...cloudUrl ? [`ZIXT_CLOUD_URL=${systemdEnvironmentValue(cloudUrl)}`] : [],
     `PATH=${systemdEnvironmentValue(path)}`,
     ...env.ZIXT_HOST_UPDATE ? [`ZIXT_HOST_UPDATE=${systemdEnvironmentValue(env.ZIXT_HOST_UPDATE)}`] : [],
+    ...env.ZIXT_RUNNER_AUTOINSTALL ? [`ZIXT_RUNNER_AUTOINSTALL=${systemdEnvironmentValue(env.ZIXT_RUNNER_AUTOINSTALL)}`] : [],
     ...env.ZIXT_HOST_UPDATE_URL ? [`ZIXT_HOST_UPDATE_URL=${systemdEnvironmentValue(env.ZIXT_HOST_UPDATE_URL)}`] : [],
     ...env.ZIXT_HOST_VERSIONS_DIR ? [`ZIXT_HOST_VERSIONS_DIR=${systemdEnvironmentValue(env.ZIXT_HOST_VERSIONS_DIR)}`] : [],
+    // A Machine on a private registry mirror checks ZIXT_HOST_UPDATE_URL for
+    // releases; its unattended npm installs must follow the same mirror.
+    ...env.NPM_CONFIG_REGISTRY ? [`NPM_CONFIG_REGISTRY=${systemdEnvironmentValue(env.NPM_CONFIG_REGISTRY)}`] : [],
     ""
   ].join("\n");
   await replacePrivateFile(environmentPath, serviceEnvironment, 384, syncDirectory8);
@@ -42284,11 +42542,11 @@ async function installLinuxService(options) {
 }
 
 // src/macos-service.ts
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
-import { access as access5, chmod as chmod8, mkdir as mkdir14, open as open8, rename as rename7, rm as rm10 } from "node:fs/promises";
-import { homedir as homedir10, userInfo as userInfo2 } from "node:os";
-import { basename as basename5, dirname as dirname11, join as join20, relative as relative10, resolve as resolve13, sep as sep6 } from "node:path";
+import { access as access5, chmod as chmod8, mkdir as mkdir15, open as open8, rename as rename7, rm as rm11 } from "node:fs/promises";
+import { homedir as homedir11, userInfo as userInfo2 } from "node:os";
+import { basename as basename5, dirname as dirname12, join as join22, relative as relative10, resolve as resolve13, sep as sep6 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var COMMAND_TIMEOUT_MS2 = 7e4;
@@ -42312,21 +42570,21 @@ async function syncDirectory4(path) {
   }
 }
 async function ensureDirectory2(path, sync) {
-  const firstCreated = await mkdir14(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir15(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
   const first = resolve13(firstCreated);
   const target = resolve13(path);
-  await sync(dirname11(first));
+  await sync(dirname12(first));
   let current = first;
   for (const part of relative10(first, target).split(sep6).filter(Boolean)) {
     await sync(current);
-    current = join20(current, part);
+    current = join22(current, part);
   }
 }
 async function replacePrivateFile2(path, contents, mode, sync) {
-  const parent = dirname11(path);
+  const parent = dirname12(path);
   await ensureDirectory2(parent, sync);
-  const temporary = join20(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join22(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open8(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -42337,7 +42595,7 @@ async function replacePrivateFile2(path, contents, mode, sync) {
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm10(temporary, { force: true }).catch(() => void 0);
+    await rm11(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -42351,7 +42609,7 @@ function commandEnvironment(env) {
 }
 async function defaultRunCommand2(command, args, env) {
   return new Promise((resolveResult) => {
-    const child = spawn12(command, [...args], {
+    const child = spawn13(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment(env)
     });
@@ -42414,7 +42672,7 @@ async function installMacosService(options) {
     throw new Error("macOS automatic startup is available only on macOS.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir10();
+  const home = options.home ?? homedir11();
   const uid = options.uid ?? userInfo2().uid;
   if (!Number.isSafeInteger(uid) || uid < 0) throw new Error("macOS user id is invalid.");
   const token2 = oneLine2(options.token, "pairing code");
@@ -42423,15 +42681,15 @@ async function installMacosService(options) {
     options.path ?? env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin",
     "command search path"
   );
-  const configRoot = options.configRoot ?? join20(home, "Library", "Application Support", "Zixt");
-  const launchAgentsRoot = options.launchAgentsRoot ?? join20(home, "Library", "LaunchAgents");
-  const logRoot = options.logRoot ?? join20(home, "Library", "Logs", "Zixt");
-  const configPath = join20(configRoot, "host.env");
-  const launcherPath = join20(configRoot, "host-launcher.sh");
-  const plistPath = join20(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
-  const stdoutPath = join20(logRoot, "host.log");
-  const stderrPath = join20(logRoot, "host-error.log");
-  const installVersion = options.installVersion ?? installRelease;
+  const configRoot = options.configRoot ?? join22(home, "Library", "Application Support", "Zixt");
+  const launchAgentsRoot = options.launchAgentsRoot ?? join22(home, "Library", "LaunchAgents");
+  const logRoot = options.logRoot ?? join22(home, "Library", "Logs", "Zixt");
+  const configPath = join22(configRoot, "host.env");
+  const launcherPath = join22(configRoot, "host-launcher.sh");
+  const plistPath = join22(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
+  const stdoutPath = join22(logRoot, "host.log");
+  const stderrPath = join22(logRoot, "host-error.log");
+  const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? (async () => defaultResolveCommand2());
   const run3 = options.runCommand ?? ((command, args) => defaultRunCommand2(command, args, env));
@@ -42439,9 +42697,15 @@ async function installMacosService(options) {
   const delay4 = options.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
   const launchctl = await resolveCommand("launchctl");
   if (!launchctl) throw new Error("macOS launchctl could not be found.");
-  const releaseEntry = await installVersion(options.hostVersion);
+  const attempt = { failure: null };
+  const releaseEntry = await installVersion(options.hostVersion, (failure2) => {
+    attempt.failure = failure2;
+  });
   if (!releaseEntry) {
-    throw new Error(`Zixt Host ${options.hostVersion} could not be installed for automatic start.`);
+    const failed = attempt.failure;
+    throw new Error(
+      `Zixt Host ${options.hostVersion} could not be installed for automatic start${failed ? ` (${failed.reason}: ${failed.detail})` : ""}.`
+    );
   }
   const currentEntry = await activateVersion(releaseEntry);
   await ensureDirectory2(configRoot, sync);
@@ -42454,8 +42718,12 @@ async function installMacosService(options) {
     `PATH=${shellValue(path)}`,
     "ZIXT_HOST_SERVICE_MANAGER=launchd",
     ...env.ZIXT_HOST_UPDATE ? [`ZIXT_HOST_UPDATE=${shellValue(env.ZIXT_HOST_UPDATE)}`] : [],
+    ...env.ZIXT_RUNNER_AUTOINSTALL ? [`ZIXT_RUNNER_AUTOINSTALL=${shellValue(env.ZIXT_RUNNER_AUTOINSTALL)}`] : [],
     ...env.ZIXT_HOST_UPDATE_URL ? [`ZIXT_HOST_UPDATE_URL=${shellValue(env.ZIXT_HOST_UPDATE_URL)}`] : [],
     ...env.ZIXT_HOST_VERSIONS_DIR ? [`ZIXT_HOST_VERSIONS_DIR=${shellValue(env.ZIXT_HOST_VERSIONS_DIR)}`] : [],
+    // A Machine on a private registry mirror checks ZIXT_HOST_UPDATE_URL for
+    // releases; its unattended npm installs must follow the same mirror.
+    ...env.NPM_CONFIG_REGISTRY ? [`NPM_CONFIG_REGISTRY=${shellValue(env.NPM_CONFIG_REGISTRY)}`] : [],
     ""
   ].join("\n");
   await replacePrivateFile2(configPath, serviceEnvironment, 384, sync);
@@ -42515,11 +42783,11 @@ async function installMacosService(options) {
 }
 
 // src/windows-service.ts
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn14 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
-import { access as access6, mkdir as mkdir15, open as open9, readFile as readFile11, rename as rename8, rm as rm11 } from "node:fs/promises";
-import { homedir as homedir11 } from "node:os";
-import { basename as basename6, dirname as dirname12, isAbsolute as isAbsolute17, join as join21, relative as relative11, resolve as resolve14, sep as sep7 } from "node:path";
+import { access as access6, mkdir as mkdir16, open as open9, readFile as readFile11, rename as rename8, rm as rm12 } from "node:fs/promises";
+import { homedir as homedir12 } from "node:os";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute18, join as join23, relative as relative11, resolve as resolve14, sep as sep7 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -42545,31 +42813,31 @@ async function syncDirectory5(path) {
   }
 }
 async function ensureDirectory3(path, sync) {
-  const firstCreated = await mkdir15(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir16(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
   const first = resolve14(firstCreated);
   const target = resolve14(path);
-  await sync(dirname12(first));
+  await sync(dirname13(first));
   let current = first;
   for (const part of relative11(first, target).split(sep7).filter(Boolean)) {
     await sync(current);
-    current = join21(current, part);
+    current = join23(current, part);
   }
 }
-async function replacePrivateFile3(path, contents, sync) {
-  const parent = dirname12(path);
+async function replacePrivateFile3(path, contents, sync, encoding = "utf8") {
+  const parent = dirname13(path);
   await ensureDirectory3(parent, sync);
-  const temporary = join21(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join23(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open9(temporary, "wx", 384);
   try {
-    await handle.writeFile(contents, "utf8");
+    await handle.writeFile(encoding === "utf16le" ? `\uFEFF${contents}` : contents, encoding);
     await handle.sync();
     await handle.close();
     await rename8(temporary, path);
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm11(temporary, { force: true }).catch(() => void 0);
+    await rm12(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -42580,7 +42848,7 @@ function commandEnvironment2(env) {
 }
 async function runChild(command, args, env, input) {
   return new Promise((resolveResult) => {
-    const child = spawn13(command, [...args], {
+    const child = spawn14(command, [...args], {
       stdio: [input === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
       env: commandEnvironment2(env),
       windowsHide: true
@@ -42613,8 +42881,8 @@ async function runChild(command, args, env, input) {
 }
 async function defaultResolveCommand3(name, env) {
   const root = env.SYSTEMROOT ?? env.WINDIR;
-  if (!root || !isAbsolute17(root)) return null;
-  const candidate = name === "powershell" ? join21(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join21(root, "System32", `${name}.exe`);
+  if (!root || !isAbsolute18(root)) return null;
+  const candidate = name === "powershell" ? join23(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join23(root, "System32", `${name}.exe`);
   return access6(candidate, constants4.X_OK).then(
     () => candidate,
     () => null
@@ -42664,8 +42932,10 @@ try {
   if ($config.cloudUrl) { $env:ZIXT_CLOUD_URL = $config.cloudUrl } else { Remove-Item Env:ZIXT_CLOUD_URL -ErrorAction SilentlyContinue }
   $env:PATH = $config.path
   if ($config.update) { $env:ZIXT_HOST_UPDATE = $config.update }
+  if ($config.runnerAutoinstall) { $env:ZIXT_RUNNER_AUTOINSTALL = $config.runnerAutoinstall }
   if ($config.updateUrl) { $env:ZIXT_HOST_UPDATE_URL = $config.updateUrl }
   if ($config.versionsRoot) { $env:ZIXT_HOST_VERSIONS_DIR = $config.versionsRoot }
+  if ($config.npmRegistry) { $env:NPM_CONFIG_REGISTRY = $config.npmRegistry }
   Set-Location -LiteralPath $config.cwd
 
   # Task Scheduler does not provide a durable stdin lifetime boundary. Give
@@ -42713,8 +42983,20 @@ async function defaultObserveStatus(path, generation) {
     return null;
   }
 }
+function hiddenLaunchSource(powershell, launcherPath) {
+  const vbsPath = (value) => {
+    if (/[\0\r\n"]/.test(value)) throw new Error("launch path is not a valid one-line value");
+    return value;
+  };
+  return [
+    "Dim q : q = Chr(34)",
+    'Dim shell : Set shell = CreateObject("WScript.Shell")',
+    `WScript.Quit shell.Run(q & "${vbsPath(powershell)}" & q & " -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File " & q & "${vbsPath(launcherPath)}" & q, 0, True)`,
+    ""
+  ].join("\r\n");
+}
 function taskXml(input) {
-  return `<?xml version="1.0" encoding="UTF-8"?>
+  return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml2(input.sid)}</UserId></LogonTrigger></Triggers>
   <Principals><Principal id="ZixtUser"><UserId>${xml2(input.sid)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
@@ -42727,8 +43009,8 @@ function taskXml(input) {
     <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>
   </Settings>
   <Actions Context="ZixtUser"><Exec>
-    <Command>${xml2(input.powershell)}</Command>
-    <Arguments>-NoProfile -NonInteractive -ExecutionPolicy Bypass -File &quot;${xml2(input.launcherPath)}&quot;</Arguments>
+    <Command>${xml2(input.wscript)}</Command>
+    <Arguments>//B //NoLogo &quot;${xml2(input.launchShimPath)}&quot;</Arguments>
     <WorkingDirectory>${xml2(input.home)}</WorkingDirectory>
   </Exec></Actions>
 </Task>
@@ -42743,39 +43025,47 @@ async function installWindowsService(options) {
     throw new Error("Windows automatic startup is available only on Windows.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir11();
+  const home = options.home ?? homedir12();
   const localAppData = options.localAppData ?? env.LOCALAPPDATA;
-  if (!localAppData || !isAbsolute17(localAppData)) {
+  if (!localAppData || !isAbsolute18(localAppData)) {
     throw new Error("Windows local application data path is unavailable.");
   }
   const token2 = oneLine3(options.token, "pairing code");
   const cloudUrl = options.cloudUrl ? oneLine3(options.cloudUrl, "Zixt Cloud address") : void 0;
   const path = oneLine3(options.path ?? env.PATH ?? "", "command search path");
-  const configRoot = options.configRoot ?? join21(localAppData, "Zixt", "Host");
-  const configPath = join21(configRoot, "host.json");
-  const launcherPath = join21(configRoot, "host-launcher.ps1");
-  const taskXmlPath = join21(configRoot, "host-task.xml");
-  const statusPath = join21(configRoot, "host-status.json");
-  const installVersion = options.installVersion ?? installRelease;
+  const configRoot = options.configRoot ?? join23(localAppData, "Zixt", "Host");
+  const configPath = join23(configRoot, "host.json");
+  const launcherPath = join23(configRoot, "host-launcher.ps1");
+  const launchShimPath = join23(configRoot, "host-launch.vbs");
+  const taskXmlPath = join23(configRoot, "host-task.xml");
+  const statusPath = join23(configRoot, "host-status.json");
+  const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? ((name) => defaultResolveCommand3(name, env));
   const run3 = options.runCommand ?? ((command, args) => runChild(command, args, env));
   const sync = options.syncDirectory ?? syncDirectory5;
   const delay4 = options.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
   const observe = options.observeStatus ?? defaultObserveStatus;
-  const [powershell, schtasks, icacls] = await Promise.all([
+  const [powershell, schtasks, icacls, wscript] = await Promise.all([
     resolveCommand("powershell"),
     resolveCommand("schtasks"),
-    resolveCommand("icacls")
+    resolveCommand("icacls"),
+    resolveCommand("wscript")
   ]);
-  if (!powershell || !schtasks || !icacls) {
+  if (!powershell || !schtasks || !icacls || !wscript) {
     throw new Error("Windows Scheduled Task tools could not be found.");
   }
   const sid = options.sid ?? await defaultCurrentSid(powershell, env);
   if (!sid || !SAFE_SID.test(sid)) throw new Error("Windows user identity could not be confirmed.");
-  const releaseEntry = await installVersion(options.hostVersion);
+  const attempt = { failure: null };
+  const releaseEntry = await installVersion(options.hostVersion, (failure2) => {
+    attempt.failure = failure2;
+  });
   if (!releaseEntry) {
-    throw new Error(`Zixt Host ${options.hostVersion} could not be installed for automatic start.`);
+    const failed = attempt.failure;
+    throw new Error(
+      `Zixt Host ${options.hostVersion} could not be installed for automatic start${failed ? ` (${failed.reason}: ${failed.detail})` : ""}.`
+    );
   }
   const currentEntry = await activateVersion(releaseEntry);
   const protectedToken = await (options.protectToken ?? ((value, shell) => defaultProtectToken(value, shell, env)))(token2, powershell);
@@ -42796,15 +43086,25 @@ async function installWindowsService(options) {
       ...cloudUrl ? { cloudUrl } : {},
       path,
       ...env.ZIXT_HOST_UPDATE ? { update: env.ZIXT_HOST_UPDATE } : {},
+      ...env.ZIXT_RUNNER_AUTOINSTALL ? { runnerAutoinstall: env.ZIXT_RUNNER_AUTOINSTALL } : {},
       ...env.ZIXT_HOST_UPDATE_URL ? { updateUrl: env.ZIXT_HOST_UPDATE_URL } : {},
-      ...env.ZIXT_HOST_VERSIONS_DIR ? { versionsRoot: env.ZIXT_HOST_VERSIONS_DIR } : {}
+      ...env.ZIXT_HOST_VERSIONS_DIR ? { versionsRoot: env.ZIXT_HOST_VERSIONS_DIR } : {},
+      // A Machine on a private registry mirror checks updateUrl for releases;
+      // its unattended npm installs must follow the same mirror.
+      ...env.NPM_CONFIG_REGISTRY ? { npmRegistry: env.NPM_CONFIG_REGISTRY } : {}
     })}
 `,
     sync
   );
   await replacePrivateFile3(launcherPath, launcherSource2(configPath, statusPath), sync);
-  await replacePrivateFile3(taskXmlPath, taskXml({ sid, powershell, launcherPath, home }), sync);
-  await rm11(statusPath, { force: true });
+  await replacePrivateFile3(launchShimPath, hiddenLaunchSource(powershell, launcherPath), sync);
+  await replacePrivateFile3(
+    taskXmlPath,
+    taskXml({ sid, wscript, launchShimPath, home }),
+    sync,
+    "utf16le"
+  );
+  await rm12(statusPath, { force: true });
   const acl = await run3(icacls, [
     configRoot,
     "/inheritance:r",
@@ -42814,6 +43114,13 @@ async function installWindowsService(options) {
     "*S-1-5-18:(OI)(CI)F"
   ]);
   if (acl.code !== 0) throw commandFailure3("Protecting Zixt startup files", acl);
+  const sweep = await run3(powershell, [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    `$stopped = 0; Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" | Where-Object { $_.ProcessId -ne $PID -and $_.CommandLine -and $_.CommandLine.Contains(${psLiteral(launcherPath)}) } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue; $stopped++ }; Write-Output $stopped`
+  ]);
+  if (Number.parseInt(sweep.stdout.trim(), 10) > 0) await delay4(1500);
   await run3(schtasks, ["/End", "/TN", TASK_NAME]);
   const create = await run3(schtasks, ["/Create", "/TN", TASK_NAME, "/XML", taskXmlPath, "/F"]);
   if (create.code !== 0) throw commandFailure3("Installing Zixt at sign-in", create);
@@ -42837,6 +43144,7 @@ async function installWindowsService(options) {
     taskXmlPath,
     configPath,
     launcherPath,
+    launchShimPath,
     statusPath,
     releaseEntry,
     currentEntry,
@@ -42856,23 +43164,23 @@ async function installSystemService(options) {
 }
 
 // src/terminal-outcomes.ts
-import { chmod as chmod9, lstat as lstat12, mkdir as mkdir16, open as open10, readdir as readdir6, readFile as readFile12, rename as rename9, rm as rm12 } from "node:fs/promises";
-import { homedir as homedir12 } from "node:os";
-import { dirname as dirname13, join as join22, relative as relative12, resolve as resolve15, sep as sep8 } from "node:path";
+import { chmod as chmod9, lstat as lstat12, mkdir as mkdir17, open as open10, readdir as readdir6, readFile as readFile12, rename as rename9, rm as rm13 } from "node:fs/promises";
+import { homedir as homedir13 } from "node:os";
+import { dirname as dirname14, join as join24, relative as relative12, resolve as resolve15, sep as sep8 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
 var HOST_DIRECTORY = /^hst_[0-9a-f]{32}$/;
 var OUTCOME_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 function defaultTerminalOutcomeRoot() {
-  return join22(homedir12(), ".zixt", "terminal-outcomes");
+  return join24(homedir13(), ".zixt", "terminal-outcomes");
 }
 function hostOutcomeRoot(root, hostId) {
   if (!HOST_DIRECTORY.test(hostId)) throw new Error("terminal outcome Host identity is malformed");
-  return join22(root, hostId);
+  return join24(root, hostId);
 }
 function outcomePath(root, hostId, taskId, epoch) {
-  return join22(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
+  return join24(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
 }
 async function syncDirectory6(root) {
   if (process.platform === "win32") return;
@@ -42884,19 +43192,19 @@ async function syncDirectory6(root) {
   }
 }
 async function requirePrivateRoot(root, sync = syncDirectory6) {
-  const firstCreated = await mkdir16(root, { recursive: true, mode: DIRECTORY_MODE5 });
+  const firstCreated = await mkdir17(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
     const first = resolve15(firstCreated);
     const target = resolve15(root);
-    await sync(dirname13(first));
+    await sync(dirname14(first));
     let current = first;
     for (const part of relative12(first, target).split(sep8).filter(Boolean)) {
       await sync(current);
-      current = join22(current, part);
+      current = join24(current, part);
     }
   }
-  const stat3 = await lstat12(root);
-  if (stat3.isSymbolicLink() || !stat3.isDirectory()) {
+  const stat4 = await lstat12(root);
+  if (stat4.isSymbolicLink() || !stat4.isDirectory()) {
     throw new Error("terminal outcome journal root is not a trusted directory");
   }
   await chmod9(root, DIRECTORY_MODE5);
@@ -42932,7 +43240,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   } catch (error52) {
     if (error52.code !== "ENOENT") throw error52;
   }
-  const temporary = join22(
+  const temporary = join24(
     scopedRoot,
     `.${outcome.taskId}.${outcome.epoch}.${process.pid}.${Date.now()}.${outcome.resultId}.tmp`
   );
@@ -42949,7 +43257,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm12(temporary, { force: true }).catch(() => {
+    await rm13(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -42985,9 +43293,9 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
       if (!match || !entry.isFile() || entry.isSymbolicLink()) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
-      const path = join22(scopedRoot, entry.name);
-      const stat3 = await lstat12(path);
-      if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > MAX_OUTCOME_BYTES) {
+      const path = join24(scopedRoot, entry.name);
+      const stat4 = await lstat12(path);
+      if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.size > MAX_OUTCOME_BYTES) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const outcome = parseCommittedOutcome(
@@ -43018,7 +43326,7 @@ async function forgetAcknowledgedTerminalOutcomes(refs, root = defaultTerminalOu
     if (acknowledged.get(`${hostId}:${outcome.taskId}:${outcome.epoch}`) !== outcome.resultId) {
       continue;
     }
-    await rm12(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm13(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     changedHostRoots.add(hostOutcomeRoot(root, hostId));
   }
   for (const scopedRoot of changedHostRoots) await syncDirectory6(scopedRoot);
@@ -43030,22 +43338,22 @@ async function forgetSupersededTerminalOutcomes(hostId, taskId, epoch, root = de
     if (scoped.hostId !== hostId) continue;
     const { outcome } = scoped;
     if (outcome.taskId !== taskId || outcome.epoch >= epoch) continue;
-    await rm12(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm13(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     removed = true;
   }
   if (removed) await syncDirectory6(hostOutcomeRoot(root, hostId));
 }
 
 // src/accepted-assignments.ts
-import { chmod as chmod10, lstat as lstat13, mkdir as mkdir17, open as open11, readdir as readdir7, rename as rename10, rm as rm13 } from "node:fs/promises";
-import { homedir as homedir13 } from "node:os";
-import { dirname as dirname14, join as join23, relative as relative13, resolve as resolve16, sep as sep9 } from "node:path";
+import { chmod as chmod10, lstat as lstat13, mkdir as mkdir18, open as open11, readdir as readdir7, rename as rename10, rm as rm14 } from "node:fs/promises";
+import { homedir as homedir14 } from "node:os";
+import { dirname as dirname15, join as join25, relative as relative13, resolve as resolve16, sep as sep9 } from "node:path";
 var DIRECTORY_MODE6 = 448;
 var FILE_MODE5 = 384;
 var CLAIM_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 var TASK_ID = /^tsk_[0-9a-f]{32}$/;
 function defaultAcceptedAssignmentRoot() {
-  return join23(homedir13(), ".zixt", "accepted-assignments");
+  return join25(homedir14(), ".zixt", "accepted-assignments");
 }
 async function syncDirectory7(root) {
   if (process.platform === "win32") return;
@@ -43057,19 +43365,19 @@ async function syncDirectory7(root) {
   }
 }
 async function requirePrivateRoot2(root, sync = syncDirectory7) {
-  const firstCreated = await mkdir17(root, { recursive: true, mode: DIRECTORY_MODE6 });
+  const firstCreated = await mkdir18(root, { recursive: true, mode: DIRECTORY_MODE6 });
   if (firstCreated) {
     const first = resolve16(firstCreated);
     const target = resolve16(root);
-    await sync(dirname14(first));
+    await sync(dirname15(first));
     let current = first;
     for (const part of relative13(first, target).split(sep9).filter(Boolean)) {
       await sync(current);
-      current = join23(current, part);
+      current = join25(current, part);
     }
   }
-  const stat3 = await lstat13(root);
-  if (stat3.isSymbolicLink() || !stat3.isDirectory()) {
+  const stat4 = await lstat13(root);
+  if (stat4.isSymbolicLink() || !stat4.isDirectory()) {
     throw new Error("accepted assignment journal root is not a trusted directory");
   }
   await chmod10(root, DIRECTORY_MODE6);
@@ -43079,7 +43387,7 @@ function claimPath(root, taskId, epoch) {
   if (!Number.isSafeInteger(epoch) || epoch < 1) {
     throw new Error("accepted assignment epoch is malformed");
   }
-  return join23(root, `${taskId}.${epoch}.json`);
+  return join25(root, `${taskId}.${epoch}.json`);
 }
 async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssignmentRoot(), options = {}) {
   const sync = options.syncDirectory ?? syncDirectory7;
@@ -43089,7 +43397,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } catch {
     return false;
   }
-  const temporary = join23(
+  const temporary = join25(
     root,
     `.${assignment.taskId}.${assignment.epoch}.${process.pid}.${Date.now()}.tmp`
   );
@@ -43109,7 +43417,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm13(temporary, { force: true }).catch(() => {
+    await rm14(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -43143,13 +43451,18 @@ async function forgetAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } catch {
     return;
   }
-  await rm13(path, { force: true }).catch(() => {
+  await rm14(path, { force: true }).catch(() => {
   });
 }
 async function forgetAcknowledgedAcceptedAssignments(assignments, root = defaultAcceptedAssignmentRoot()) {
   for (const assignment of assignments) await forgetAcceptedAssignment(assignment, root);
 }
 
+// src/local-observability.ts
+import { appendFile, mkdir as mkdir19, open as open12, rename as rename11, rm as rm15, stat as stat3 } from "node:fs/promises";
+import { homedir as homedir15 } from "node:os";
+import { basename as basename7, dirname as dirname16, join as join26 } from "node:path";
+
 // src/logger.ts
 var ANSI = {
   reset: "\x1B[0m",
@@ -43241,7 +43554,9 @@ function createHostLogger(options = {}) {
   const color = options.color ?? (process.stderr.isTTY === true && process.env.NO_COLOR === void 0);
   const write = options.write ?? ((line) => console.error(line));
   const log2 = (level, message, context) => {
-    write(formatHostLogLine(level, message, context, { at: now(), color }));
+    const at = now();
+    write(formatHostLogLine(level, message, context, { at, color }));
+    options.onEntry?.({ at, level, message, context: context ?? {} });
   };
   return {
     info: (message, context) => log2("info", message, context),
@@ -43251,24 +43566,105 @@ function createHostLogger(options = {}) {
   };
 }
 
+// src/local-observability.ts
+var LOCAL_CONSOLE_FILE = "console.jsonl";
+var LOCAL_CONSOLE_PREVIOUS_FILE = "console.prev.jsonl";
+var LOCAL_STATUS_FILE = "status.json";
+var DEFAULT_CONSOLE_ROTATE_BYTES = 2 * 1024 * 1024;
+function defaultLocalObservabilityRoot() {
+  return join26(homedir15(), ".zixt", "observability");
+}
+function createLocalConsoleSink(options = {}) {
+  const root = options.root ?? defaultLocalObservabilityRoot();
+  const consolePath = join26(root, LOCAL_CONSOLE_FILE);
+  const rotateBytes = options.rotateBytes ?? DEFAULT_CONSOLE_ROTATE_BYTES;
+  let disabled = false;
+  let prepared = false;
+  let approximateBytes = 0;
+  let queue = Promise.resolve();
+  const write = async (entry) => {
+    if (disabled) return;
+    try {
+      if (!prepared) {
+        await mkdir19(root, { recursive: true, mode: 448 });
+        approximateBytes = await stat3(consolePath).then(
+          (existing) => existing.size,
+          () => 0
+        );
+        prepared = true;
+      }
+      if (approximateBytes >= rotateBytes) {
+        await rm15(join26(root, LOCAL_CONSOLE_PREVIOUS_FILE), { force: true });
+        await rename11(consolePath, join26(root, LOCAL_CONSOLE_PREVIOUS_FILE)).catch(
+          (error52) => {
+            if (error52.code !== "ENOENT") throw error52;
+          }
+        );
+        approximateBytes = 0;
+      }
+      const line = `${JSON.stringify({
+        at: entry.at.toISOString(),
+        level: entry.level,
+        line: formatHostLogLine(entry.level, entry.message, entry.context, {
+          at: entry.at,
+          color: false
+        })
+      })}
+`;
+      await appendFile(consolePath, line, { encoding: "utf8", mode: 384 });
+      approximateBytes += Buffer.byteLength(line);
+    } catch (error52) {
+      disabled = true;
+      options.onDisabled?.(error52);
+    }
+  };
+  return {
+    entry(entry) {
+      queue = queue.then(() => write(entry));
+    },
+    settled: () => queue
+  };
+}
+async function writeLocalStatus(status, root = defaultLocalObservabilityRoot()) {
+  const destination = join26(root, LOCAL_STATUS_FILE);
+  const temporary = join26(
+    dirname16(destination),
+    `.${basename7(destination)}.${process.pid}.${crypto.randomUUID()}.tmp`
+  );
+  try {
+    await mkdir19(root, { recursive: true, mode: 448 });
+    const handle = await open12(temporary, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(status)}
+`, "utf8");
+    } finally {
+      await handle.close();
+    }
+    await rename11(temporary, destination);
+  } catch {
+    await rm15(temporary, { force: true }).catch(() => void 0);
+  }
+}
+
 // src/demo-state.ts
-import { isAbsolute as isAbsolute18, join as join24, parse as parse3, resolve as resolve17 } from "node:path";
+import { isAbsolute as isAbsolute19, join as join27, parse as parse3, resolve as resolve17 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
   if (!configured) return null;
   const root = resolve17(configured);
-  if (!isAbsolute18(configured) || root === parse3(root).root) {
+  if (!isAbsolute19(configured) || root === parse3(root).root) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
   return {
-    runRegistryRoot: join24(root, "run-registry"),
-    terminalOutcomeRoot: join24(root, "terminal-outcomes"),
-    acceptedAssignmentRoot: join24(root, "accepted-assignments"),
-    runArtifactRoot: join24(root, "run-artifacts"),
-    browserProfileRoot: join24(root, "browser-profiles"),
-    runnerWorkspaceRoot: join24(root, "workspaces"),
-    codexThreadIndexRoot: join24(root, "codex-threads")
+    runRegistryRoot: join27(root, "run-registry"),
+    terminalOutcomeRoot: join27(root, "terminal-outcomes"),
+    acceptedAssignmentRoot: join27(root, "accepted-assignments"),
+    runArtifactRoot: join27(root, "run-artifacts"),
+    browserProfileRoot: join27(root, "browser-profiles"),
+    runnerWorkspaceRoot: join27(root, "workspaces"),
+    codexThreadIndexRoot: join27(root, "codex-threads"),
+    localObservabilityRoot: join27(root, "local-observability")
   };
 }
 
@@ -43330,6 +43726,9 @@ function parseHostCliOptions(argv) {
   }
   return options;
 }
+function isServiceSetupInvocation(argv) {
+  return argv.includes("--install-service");
+}
 function forcedColor(mode) {
   if (mode === "always") return true;
   if (mode === "never") return false;
@@ -43412,7 +43811,9 @@ if (packagedBuild) {
   if (isWorkerProxyRole()) process.exit(managedExit(await runWorkerCompatibilityProxy()));
   if (needsLegacySupervisorHandoff()) process.exit(managedExit(await launchHostSupervisor()));
   if (isSupervisorRole()) process.exit(managedExit(await superviseHost()));
-  if (!isWorkerRole()) process.exit(managedExit(await launchHostSupervisor()));
+  if (!isWorkerRole() && !isServiceSetupInvocation(process.argv.slice(2))) {
+    process.exit(managedExit(await launchHostSupervisor()));
+  }
 }
 var workerWatchdog = startWorkerWatchdogHeartbeat();
 if (packagedBuild && isWorkerRole() && process.env[WORKER_WATCHDOG_NONCE_ENV] !== void 0 && !workerWatchdog.active) {
@@ -43440,12 +43841,14 @@ function recordConsoleLine(line) {
   if (hostConsoleTail.length > 200) hostConsoleTail.shift();
   clientForConsole.current?.hostConsoleLine(entry);
 }
+var localConsoleSink = { current: null };
 var log = createHostLogger({
   ...colorOverride === void 0 ? {} : { color: colorOverride },
   write: (line) => {
     console.error(line);
     recordConsoleLine(line);
-  }
+  },
+  onEntry: (entry) => localConsoleSink.current?.entry(entry)
 });
 function replayConsoleLine(level, message, context) {
   recordConsoleLine(
@@ -43453,6 +43856,7 @@ function replayConsoleLine(level, message, context) {
       ...colorOverride === void 0 ? {} : { color: colorOverride }
     })
   );
+  localConsoleSink.current?.entry({ at: /* @__PURE__ */ new Date(), level, message, context: context ?? {} });
 }
 if (cliOptions.help) {
   process.stdout.write(`${hostHelpText()}
@@ -43516,8 +43920,20 @@ var {
   runArtifactRoot,
   browserProfileRoot,
   runnerWorkspaceRoot,
-  codexThreadIndexRoot
+  codexThreadIndexRoot,
+  localObservabilityRoot
 } = demoState ?? {};
+localConsoleSink.current = createLocalConsoleSink({
+  ...localObservabilityRoot ? { root: localObservabilityRoot } : {},
+  onDisabled: (error52) => {
+    console.error(
+      formatHostLogLine("warn", "The local console file was disabled after a write failure", {
+        machine,
+        error: error52 instanceof Error ? error52.message : "unknown error"
+      })
+    );
+  }
+});
 var disclaimableAssignments;
 var acceptedAssignments;
 var terminalOutcomes;
@@ -43559,6 +43975,23 @@ if (!token) {
   process.exit(DO_NOT_RESTART_EXIT_CODE);
 }
 var demoPreflightScript = forceDemo ? process.env.ZIXT_DEMO_PREFLIGHT_SCRIPT : void 0;
+var runnerAutoInstaller = forceDemo || process.env.ZIXT_RUNNER_AUTOINSTALL === "off" ? null : createRunnerAutoInstaller({
+  onEvent: (event) => {
+    const name = event.runner === "claude-code" ? "Claude Code" : "Codex";
+    if (event.state === "started") {
+      log.info(`${name} not found; installing it for this Machine`, { machine });
+    } else if (event.state === "completed") {
+      log.success(`${name} installed`, { machine });
+      cachedRunners = null;
+    } else {
+      log.warn(`${name} installation failed`, {
+        machine,
+        ...event.error ? { error: event.error } : {},
+        next: `Install the ${event.runner === "claude-code" ? "claude" : "codex"} CLI manually; the Host retries later`
+      });
+    }
+  }
+});
 var gitPreflight = await preflightGit();
 var gitRefresh = null;
 var GIT_PREFLIGHT_REFRESH_MS = 4 * 6e4;
@@ -43702,12 +44135,18 @@ async function telemetry() {
       preflightCodex()
     ]);
     cachedRunnersAt = Date.now();
-    for (const runner of cachedRunners) reportRunnerReadiness(runner);
+    for (const runner of cachedRunners) {
+      reportRunnerReadiness(runner);
+      if (!runner.installed && (runner.type === "claude-code" || runner.type === "codex") && runnerAutoInstaller) {
+        runnerAutoInstaller.ensureInstalled(runner.type);
+      }
+    }
   }
   const providerToolPacks = toolPackRegistry.capabilities({
     now: /* @__PURE__ */ new Date(),
     git: await currentGitPreflight()
   });
+  publishLocalStatus();
   providerToolPacks.push({
     provider: "email",
     version: 1,
@@ -43734,7 +44173,7 @@ async function telemetry() {
     // Measured per heartbeat: free memory and free disk are only useful while
     // they are current, and a demo Host reports its own private root so the
     // number describes the filesystem its Tasks would really write to.
-    hardware: await machineHardware(runnerWorkspaceRoot ?? homedir14()),
+    hardware: await machineHardware(runnerWorkspaceRoot ?? homedir16()),
     capabilities: {
       linearToolPack: providerToolPacks.some(
         (pack) => pack.provider === "linear" && pack.health === "ready"
@@ -43791,6 +44230,36 @@ var connectionContext = connectionLogContext({
   cloud: cloudTarget,
   version: HOST_VERSION
 });
+var hostStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+var localCloudState = "connecting";
+var localCloudConnectedAt;
+var localStatusQueued = false;
+function publishLocalStatus() {
+  if (localStatusQueued) return;
+  localStatusQueued = true;
+  queueMicrotask(() => {
+    localStatusQueued = false;
+    void writeLocalStatus(
+      {
+        schema: 1,
+        version: HOST_VERSION,
+        pid: process.pid,
+        machine,
+        startedAt: hostStartedAt,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        cloud: {
+          target: cloudTarget,
+          state: localCloudState,
+          ...localCloudConnectedAt ? { connectedAt: localCloudConnectedAt } : {}
+        },
+        activeSessions,
+        runners: cachedRunners ?? [],
+        browser: cachedBrowserCapability ?? { status: "unavailable" }
+      },
+      ...localObservabilityRoot ? [localObservabilityRoot] : []
+    );
+  });
+}
 var stopUpdateWatch = () => {
 };
 var releaseParentPipeWatch = () => {
@@ -43915,6 +44384,9 @@ var client = new HostClient({
     switch (status) {
       case "connected":
         log.success("Connected to Zixt Cloud", connectionContext);
+        localCloudState = "connected";
+        localCloudConnectedAt = (/* @__PURE__ */ new Date()).toISOString();
+        publishLocalStatus();
         if (reportedWorkerExits.length > 0) {
           void forgetWorkerExits(reportedWorkerExits.map(({ file: file2 }) => file2));
         }
@@ -43924,12 +44396,16 @@ var client = new HostClient({
           ...connectionContext,
           next: "Check the cloud and Machine pairing if this continues"
         });
+        localCloudState = "connecting";
+        publishLocalStatus();
         break;
       case "unresponsive":
         log.warn("Zixt Cloud stopped answering; Tasks unwound before reconnecting", {
           ...connectionContext,
           next: "Check this Machine's network path and Zixt Cloud health if this repeats"
         });
+        localCloudState = "connecting";
+        publishLocalStatus();
         break;
       case "replaced":
         log.warn("Another Host process took over this Machine", connectionContext);