@zixt/host 0.0.135 → 0.0.137

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir4 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.135",
+  version: "0.0.137",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14700,6 +14700,10 @@ var ID_PREFIXES = {
   voiceTurn: "vtr",
   /** One signed voice-provider webhook receipt. */
   voiceWebhookEvent: "vwe",
+  /** One live browser microphone session with the Zixt Guide (UI-16). */
+  guideVoiceSession: "gvs",
+  /** One Guide reply authorized to be spoken on that session. */
+  guideVoiceSpeech: "gvt",
   /** Org-singleton Company setup record (PRD OB-5). */
   companySetup: "cst",
   /** One durable set of teammate-proposed Automations awaiting an Admin (OB-12). */
@@ -14780,6 +14784,11 @@ var VoiceLineId = idSchema(ID_PREFIXES.voiceLine, "voice line id");
 var VoiceCallerId = idSchema(ID_PREFIXES.voiceCaller, "voice caller id");
 var VoiceCallId = idSchema(ID_PREFIXES.voiceCall, "voice call id");
 var VoiceTurnId = idSchema(ID_PREFIXES.voiceTurn, "voice turn id");
+var GuideVoiceSessionId = idSchema(
+  ID_PREFIXES.guideVoiceSession,
+  "Guide voice session id"
+);
+var GuideVoiceSpeechId = idSchema(ID_PREFIXES.guideVoiceSpeech, "Guide speech id");
 var VoiceWebhookEventId = idSchema(
   ID_PREFIXES.voiceWebhookEvent,
   "voice webhook event id"
@@ -19659,6 +19668,19 @@ var TestWebhookDeliveryRequest = external_exports.object({
 // ../../packages/contracts/src/manager.ts
 var MANAGER_DEFAULT_MODEL = "gpt-5.6-luna";
 var MANAGER_DEFAULT_PORTRAIT = 23;
+var ManagerVoiceName = external_exports.enum([
+  "marin",
+  "cedar",
+  "alloy",
+  "ash",
+  "ballad",
+  "coral",
+  "echo",
+  "sage",
+  "shimmer",
+  "verse"
+]);
+var MANAGER_DEFAULT_VOICE = "marin";
 var MANAGER_DISPLAY_NAME_MAX = 60;
 var MANAGER_INSTRUCTIONS_MAX = 2e4;
 var CONVERSATION_MESSAGE_MAX = 1e5;
@@ -19694,6 +19716,11 @@ var ManagerConfigProjection = external_exports.object({
    * never rejected by a server that has not shipped the newer artwork yet.
    */
   portrait: external_exports.number().int().min(0).max(63).default(MANAGER_DEFAULT_PORTRAIT),
+  /**
+   * The voice every spoken Zixt surface renders in for this organization.
+   * Older rows carry none and read as MANAGER_DEFAULT_VOICE.
+   */
+  voice: ManagerVoiceName.default(MANAGER_DEFAULT_VOICE),
   revision: external_exports.number().int().min(0),
   updatedAt: external_exports.string().nullable()
 }).strict();
@@ -19709,10 +19736,11 @@ var UpdateManagerRequest = external_exports.object({
     answerDirectMessages: external_exports.boolean().optional()
   }).strict().optional(),
   portrait: external_exports.number().int().min(0).max(63).optional(),
+  voice: ManagerVoiceName.optional(),
   /** Optimistic concurrency: refuse when another admin saved first. */
   expectedRevision: external_exports.number().int().min(0).optional()
 }).strict().superRefine((value, ctx) => {
-  if (value.displayName === void 0 && value.instructions === void 0 && value.model === void 0 && value.reasoningEffort === void 0 && value.slack === void 0 && value.portrait === void 0) {
+  if (value.displayName === void 0 && value.instructions === void 0 && value.model === void 0 && value.reasoningEffort === void 0 && value.slack === void 0 && value.portrait === void 0 && value.voice === void 0) {
     ctx.addIssue({ code: "custom", message: "nothing to update" });
   }
 });
@@ -22184,7 +22212,13 @@ var SetupGuideReplyRequest = external_exports.object({
   onboarding: SetupGuideOnboardingState,
   actions: external_exports.array(SetupGuideAvailableAction).max(128),
   toolResults: external_exports.array(SetupGuideToolResult).max(12).default([]),
-  mission: SetupGuideMission.nullable().optional()
+  mission: SetupGuideMission.nullable().optional(),
+  /**
+   * The live Guide voice session this turn was spoken into. It only authorizes
+   * the resulting reply to be spoken on that same session; it never changes
+   * what the Guide may read, propose, or execute.
+   */
+  voiceSessionId: GuideVoiceSessionId.optional()
 });
 var SetupGuideProposedAction = external_exports.object({
   actionId: external_exports.string().regex(/^[a-z][a-z0-9_.-]{0,79}$/),
@@ -22195,11 +22229,21 @@ var SetupGuideProposedAction = external_exports.object({
    */
   parameters: external_exports.array(SetupGuideActionParameter).max(12)
 });
-var SetupGuideReplyResponse = external_exports.object({
+var SetupGuideAnswer = external_exports.object({
   message: GuideText,
   /** One tool at a time keeps UI execution and its result causally ordered. */
   proposedActions: external_exports.array(SetupGuideProposedAction).max(1)
 });
+var SetupGuideReplyResponse = SetupGuideAnswer.extend({
+  /**
+   * Identity this exact committed reply may be spoken under, present only when
+   * the request named a live voice session. The browser runs a bounded action
+   * loop, so only it knows which reply in that loop is the person's answer;
+   * this id is how it says "speak that one" without ever sending prose back for
+   * the cloud to read aloud.
+   */
+  speech: external_exports.object({ id: GuideVoiceSpeechId }).strict().nullable().default(null)
+});
 var SetupGuideTranscriptionRequest = external_exports.object({
   mediaType: external_exports.enum(["audio/webm", "audio/mp4", "audio/ogg"]),
   /** Bounded short-lived audio. The route decodes it in memory and never stores it. */
@@ -22208,6 +22252,52 @@ var SetupGuideTranscriptionRequest = external_exports.object({
 var SetupGuideTranscriptionResponse = external_exports.object({
   text: GuideText
 });
+var StartGuideVoiceSessionRequest = external_exports.object({
+  /** Stable client fence; an ambiguous provider create is never resubmitted under it. */
+  requestId: external_exports.uuid(),
+  offerSdp: BrowserVoiceSessionDescription
+}).strict();
+var GuideVoiceSessionStatus = external_exports.enum([
+  "connecting",
+  "connected",
+  "ending",
+  "ended",
+  "failed"
+]);
+var GuideVoiceSessionProjection = external_exports.object({
+  id: GuideVoiceSessionId,
+  status: GuideVoiceSessionStatus,
+  startedAt: IsoDate2,
+  expiresAt: IsoDate2
+}).strict();
+var StartGuideVoiceSessionResponse = external_exports.object({
+  session: GuideVoiceSessionProjection,
+  /** Applied directly to the browser peer connection and never persisted by Zixt. */
+  answerSdp: BrowserVoiceSessionDescription
+}).strict();
+var AckGuideVoiceSessionResponse = external_exports.object({ session: GuideVoiceSessionProjection }).strict();
+var EndGuideVoiceSessionResponse = external_exports.object({ ended: external_exports.literal(true) }).strict();
+var GuideVoiceCaption = external_exports.string().max(4e3);
+var GuideVoicePresentationFrame = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("listening_started") }).strict(),
+  external_exports.object({ type: external_exports.literal("listening_stopped") }).strict(),
+  external_exports.object({ type: external_exports.literal("user_caption"), text: GuideVoiceCaption, final: external_exports.boolean() }).strict(),
+  external_exports.object({
+    type: external_exports.literal("guide_speech_started"),
+    speechId: GuideVoiceSpeechId,
+    text: GuideVoiceCaption
+  }).strict(),
+  external_exports.object({ type: external_exports.literal("guide_speech_stopped"), speechId: GuideVoiceSpeechId }).strict(),
+  external_exports.object({ type: external_exports.literal("guide_speech_failed"), speechId: GuideVoiceSpeechId }).strict(),
+  external_exports.object({ type: external_exports.literal("guide_speech_idle") }).strict(),
+  external_exports.object({ type: external_exports.literal("transcription_failed") }).strict(),
+  external_exports.object({ type: external_exports.literal("session_ended") }).strict(),
+  external_exports.object({ type: external_exports.literal("session_failed") }).strict()
+]);
+var SpeakGuideVoiceReplyRequest = external_exports.object({ speechId: GuideVoiceSpeechId }).strict();
+var SpeakGuideVoiceReplyResponse = external_exports.object({ speaking: external_exports.boolean() }).strict();
+var InterruptGuideVoiceSessionRequest = external_exports.object({ speechId: GuideVoiceSpeechId }).strict();
+var InterruptGuideVoiceSessionResponse = external_exports.object({ interrupted: external_exports.boolean() }).strict();
 
 // ../../packages/contracts/src/roles.ts
 var CompanyToolKind = external_exports.enum([
@@ -22472,6 +22562,12 @@ var CompanySetupProgress = external_exports.object({
   /** Every recommended step is done or skipped. */
   recommendedSettled: external_exports.boolean()
 });
+var COMPANY_SETUP_PLANNING_NOTE_MAX = 200;
+var COMPANY_SETUP_PLANNING_NOTES_MAX = 20;
+var CompanySetupPlanningNote = external_exports.object({
+  at: IsoDate,
+  text: external_exports.string().trim().min(1).max(COMPANY_SETUP_PLANNING_NOTE_MAX)
+});
 var CompanySetupApproval = external_exports.object({
   at: IsoDate,
   by: MemberId.nullable(),
@@ -22524,7 +22620,12 @@ var CompanySetupView = external_exports.object({
    * The plan is being proposed in the background (a planner call can take a
    * minute); the page polls until the plan lands or an error is recorded.
    */
-  planning: external_exports.object({ startedAt: IsoDate, error: external_exports.string().max(500).nullable() }).nullable(),
+  planning: external_exports.object({
+    startedAt: IsoDate,
+    error: external_exports.string().max(500).nullable(),
+    /** Oldest first; the planner's visible decisions so far. */
+    notes: external_exports.array(CompanySetupPlanningNote).max(COMPANY_SETUP_PLANNING_NOTES_MAX).default([])
+  }).nullable(),
   approval: CompanySetupApproval.nullable(),
   steps: external_exports.array(CompanySetupStep),
   progress: CompanySetupProgress,
@@ -31615,11 +31716,11 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
 }
 
 // src/runners/cli-runner.ts
-import { spawn as spawn10 } from "node:child_process";
-import { randomUUID as randomUUID11 } from "node:crypto";
-import { lstat as lstat11, mkdir as mkdir12, realpath as realpath8 } from "node:fs/promises";
+import { spawn as spawn11 } from "node:child_process";
+import { randomUUID as randomUUID12 } from "node:crypto";
+import { lstat as lstat11, mkdir as mkdir13, realpath as realpath8 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname10, isAbsolute as isAbsolute16, join as join18, resolve as resolve10 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute16, join as join19, resolve as resolve10 } from "node:path";
 
 // src/tool-packs/browser/authentication-wall.ts
 var AUTH_PATH_SEGMENT = /(?:^|\/)(?:log[-_]?in|sign[-_]?in|sso|saml|auth|authorize|authenticate|oauth2?|session\/new|checkpoint)(?:\/|$)/i;
@@ -38006,6 +38107,415 @@ function renderAttachmentSection(files) {
 
 // src/runners/ask-user-server.ts
 import { createServer as createServer2 } from "node:http";
+
+// src/runners/software-install.ts
+import { spawn as spawn9 } from "node:child_process";
+import { createHash as createHash6, randomUUID as randomUUID11 } from "node:crypto";
+import { chmod as chmod6, mkdir as mkdir11, readFile as readFile10, readdir as readdir5, rename as rename6, rm as rm10, symlink as symlink2, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join17, relative as relative8, resolve as resolvePath, sep as sep5 } from "node:path";
+var SOFTWARE_INSTALL_METHODS = ["npm", "download"];
+var SOFTWARE_INSTALL_REFUSAL = "Zixt installs software only into its own folder on this Machine, using npm or a direct download. It never runs a system package manager, never asks for elevation, and never builds from source. Tell the person plainly what is missing, why this work needs it, and the exact command they would run themselves.";
+var MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
+var PROCESS_TIMEOUT_MS = 10 * 6e4;
+var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
+var FAILURE_COOLDOWN_MS2 = 10 * 6e4;
+var MAX_ARCHIVE_SEARCH_DEPTH = 5;
+var MANIFEST_NAME = "installed.json";
+var COMMAND_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+var NPM_SPEC_PATTERN = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*(?:@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)?$/;
+function defaultSoftwareToolsRoot() {
+  return defaultRunnerToolsRoot();
+}
+function softwareSearchPathEntries(toolsRoot = defaultSoftwareToolsRoot()) {
+  return [toolsRoot, join17(toolsRoot, "bin")];
+}
+function refuseSoftwareRequest(request) {
+  if (!COMMAND_PATTERN.test(request.command)) {
+    return "The command name must be a plain executable name with no path, spaces, or shell characters.";
+  }
+  if (!SOFTWARE_INSTALL_METHODS.includes(request.method)) {
+    return SOFTWARE_INSTALL_REFUSAL;
+  }
+  if (request.method === "npm") {
+    if (!NPM_SPEC_PATTERN.test(request.source)) {
+      return "The npm source must be a package name, optionally with one exact version as name@1.2.3. Ranges, tags, git specs, URLs, and local paths are not installed.";
+    }
+    if (request.sha256 !== void 0) {
+      return "An expected sha256 applies only to downloads; the npm registry names versions, not file digests.";
+    }
+    return null;
+  }
+  let url3;
+  try {
+    url3 = new URL(request.source);
+  } catch {
+    return "The download source must be an absolute HTTPS URL.";
+  }
+  if (url3.protocol !== "https:") return "The download source must use HTTPS.";
+  if (url3.username || url3.password) {
+    return "The download source must not carry credentials in the URL.";
+  }
+  if (request.sha256 !== void 0 && !/^[a-f0-9]{64}$/i.test(request.sha256)) {
+    return "The expected sha256 must be 64 hexadecimal characters.";
+  }
+  return null;
+}
+async function runProcess(plan, label) {
+  const env = sanitizedInstallerEnv(process.env);
+  await new Promise((resolveRun, rejectRun) => {
+    const child = plan.shellLine !== void 0 ? spawn9(plan.shellLine, {
+      ...plan.cwd ? { cwd: plan.cwd } : {},
+      env,
+      // stdin stays closed; output reaches the ordinary worker console, so
+      // progress and failure land on the Host console like a runner install.
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true,
+      shell: true
+    }) : spawn9(plan.command, plan.args, {
+      ...plan.cwd ? { cwd: plan.cwd } : {},
+      env,
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true
+    });
+    let settled = false;
+    const finish = (error52) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error52) rejectRun(error52);
+      else resolveRun();
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish(new Error(`${label} did not finish within 10 minutes`));
+    }, PROCESS_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", (error52) => finish(error52));
+    child.once("exit", (code, signal) => {
+      if (code === 0) finish();
+      else if (signal) finish(new Error(`${label} stopped with ${signal}`));
+      else finish(new Error(`${label} exited with code ${code ?? "unknown"}`));
+    });
+  });
+}
+async function resolveTarCommand(platform) {
+  if (platform !== "win32") return "tar";
+  const root = process.env["SYSTEMROOT"] ?? process.env["WINDIR"];
+  if (!root) return "tar";
+  return await resolveTrustedCliCommand(join17(root, "System32", "tar.exe"), { platform }) ?? "tar";
+}
+function archiveKindFor(url3) {
+  let path;
+  try {
+    path = new URL(url3).pathname.toLowerCase();
+  } catch {
+    return "binary";
+  }
+  if (/\.(?:tar\.(?:gz|xz|bz2)|tgz|tbz2|txz|tar)$/.test(path)) return "tar";
+  if (path.endsWith(".zip")) return "zip";
+  return "binary";
+}
+async function findExtractedExecutable(root, command, platform = process.platform) {
+  const names = platform === "win32" ? [`${command}.exe`, `${command}.cmd`, `${command}.bat`, command] : [command];
+  let frontier = [root];
+  for (let depth = 0; depth <= MAX_ARCHIVE_SEARCH_DEPTH && frontier.length > 0; depth += 1) {
+    const next = [];
+    for (const directory of frontier) {
+      let entries;
+      try {
+        entries = await readdir5(directory, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const name of names) {
+        if (entries.some((entry) => entry.name === name && entry.isFile())) {
+          return join17(directory, name);
+        }
+      }
+      for (const entry of entries) {
+        if (entry.isDirectory()) next.push(join17(directory, entry.name));
+      }
+    }
+    frontier = next;
+  }
+  return null;
+}
+function withinRoot(root, candidate) {
+  const base = resolvePath(root);
+  const target = resolvePath(candidate);
+  return target === base || target.startsWith(base.endsWith(sep5) ? base : `${base}${sep5}`);
+}
+function downloadedBinaryName(command, source, platform = process.platform) {
+  if (platform !== "win32") return command;
+  const extension = /(\.[A-Za-z0-9]{1,8})$/.exec(new URL(source).pathname)?.[1]?.toLowerCase();
+  if (extension !== ".exe" && extension !== ".com") {
+    throw new Error(
+      "a direct Windows download must be a .exe or .com file; use the tool\u2019s .zip release instead"
+    );
+  }
+  return `${command}${extension}`;
+}
+async function placeDownloadedPayload(body, request, options) {
+  const platform = options.platform ?? process.platform;
+  const { toolsRoot } = options;
+  const staging = join17(toolsRoot, ".staging", randomUUID11());
+  const stagedPackage = join17(staging, "pkg");
+  const packageRoot = join17(toolsRoot, "pkgs", request.command);
+  const binDirectory = platform === "win32" ? toolsRoot : join17(toolsRoot, "bin");
+  const kind = archiveKindFor(request.source);
+  await mkdir11(stagedPackage, { recursive: true, mode: 448 });
+  try {
+    if (kind === "binary") {
+      await writeFile7(
+        join17(stagedPackage, downloadedBinaryName(request.command, request.source, platform)),
+        body,
+        {
+          mode: 448
+        }
+      );
+    } else {
+      await writeFile7(join17(staging, "archive"), body, { mode: 448 });
+      if (kind === "tar" || platform !== "linux") {
+        await runProcess(
+          {
+            command: await resolveTarCommand(platform),
+            args: ["-xf", "archive", "-C", "pkg"],
+            cwd: staging
+          },
+          "the archive extraction"
+        );
+      } else {
+        await runProcess(
+          { command: "unzip", args: ["-q", "-o", "archive", "-d", "pkg"], cwd: staging },
+          "the archive extraction"
+        );
+      }
+      await rm10(join17(staging, "archive"), { force: true }).catch(() => void 0);
+    }
+    const stagedExecutable = await findExtractedExecutable(
+      stagedPackage,
+      request.command,
+      platform
+    );
+    if (!stagedExecutable) {
+      throw new Error(`the download did not contain an executable named ${request.command}`);
+    }
+    if (!withinRoot(stagedPackage, stagedExecutable)) {
+      throw new Error("the archive tried to place its executable outside the Zixt folder");
+    }
+    await mkdir11(join17(toolsRoot, "pkgs"), { recursive: true, mode: 448 });
+    await rm10(packageRoot, { recursive: true, force: true });
+    await rename6(stagedPackage, packageRoot);
+    const executable = join17(packageRoot, relative8(stagedPackage, stagedExecutable));
+    await mkdir11(binDirectory, { recursive: true, mode: 448 });
+    if (platform === "win32") {
+      const shim = join17(binDirectory, `${request.command}.cmd`);
+      await writeFile7(shim, `@echo off\r
+${quoteForCmd(executable)} %*\r
+`, {
+        encoding: "utf8",
+        mode: 448
+      });
+      return shim;
+    }
+    await chmod6(executable, 493);
+    const link = join17(binDirectory, request.command);
+    await rm10(link, { force: true });
+    await symlink2(executable, link);
+    return link;
+  } finally {
+    await rm10(staging, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+function createSoftwareInstaller(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const toolsRoot = options.toolsRoot ?? defaultSoftwareToolsRoot();
+  const now = options.now ?? Date.now;
+  const manifestPath = join17(toolsRoot, MANIFEST_NAME);
+  const inFlight = /* @__PURE__ */ new Map();
+  const failures = /* @__PURE__ */ new Map();
+  const searchPath = () => {
+    const inherited = options.resolution?.searchPath ?? process.env.PATH ?? "";
+    const separator = platform === "win32" ? ";" : ":";
+    return [inherited, ...softwareSearchPathEntries(toolsRoot)].filter(Boolean).join(separator);
+  };
+  const resolveCommand = async (command) => resolveTrustedCliCommand(command, {
+    ...options.resolution ?? {},
+    platform,
+    searchPath: searchPath()
+  });
+  const readManifest = async () => {
+    try {
+      const parsed = JSON.parse(await readFile10(manifestPath, "utf8"));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  };
+  let manifestTurn = Promise.resolve();
+  const recordInstall = (record2) => {
+    const write = manifestTurn.then(async () => {
+      const existing = (await readManifest()).filter((entry) => entry.command !== record2.command);
+      const staged = `${manifestPath}.${randomUUID11()}`;
+      await writeFile7(staged, `${JSON.stringify([...existing, record2], null, 2)}
+`, {
+        encoding: "utf8",
+        mode: 384
+      });
+      await rename6(staged, manifestPath);
+    });
+    manifestTurn = write.catch(() => void 0);
+    return write;
+  };
+  const installFromNpm = async (request) => {
+    await mkdir11(toolsRoot, { recursive: true, mode: 448 });
+    const npm = await resolveInstallerCommand({ platform });
+    const args = [
+      "install",
+      "-g",
+      "--prefix",
+      toolsRoot,
+      "--no-audit",
+      "--no-fund",
+      "--ignore-scripts",
+      // `--` ends npm's flag parsing, so even a spec that slipped the pattern
+      // could not become an npm option.
+      "--",
+      request.source
+    ];
+    if (platform === "win32") {
+      await runProcess(
+        { shellLine: windowsInstallerCommandLine(npm, args), cwd: toolsRoot },
+        "the npm install"
+      );
+    } else {
+      await runProcess({ command: npm, args, cwd: toolsRoot }, "the npm install");
+    }
+  };
+  const installFromDownload = async (request) => {
+    const response = await fetch(request.source, {
+      redirect: "follow",
+      signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
+    });
+    if (!response.ok) throw new Error(`the download answered HTTP ${response.status}`);
+    if (response.url && !response.url.startsWith("https:")) {
+      throw new Error("the download redirected off HTTPS and was not installed");
+    }
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (Number.isFinite(declared) && declared > MAX_DOWNLOAD_BYTES) {
+      throw new Error("the download is larger than Zixt installs unattended");
+    }
+    if (!response.body) throw new Error("the download had no body");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > MAX_DOWNLOAD_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        throw new Error("the download is larger than Zixt installs unattended");
+      }
+      chunks.push(Buffer.from(value));
+    }
+    const body = Buffer.concat(chunks);
+    if (body.length === 0) throw new Error("the download was empty");
+    const digest = createHash6("sha256").update(body).digest("hex");
+    if (request.sha256 && digest !== request.sha256.toLowerCase()) {
+      throw new Error("the download did not match the expected sha256");
+    }
+    await placeDownloadedPayload(body, request, { toolsRoot, platform });
+  };
+  const perform = options.perform ?? (async (request) => {
+    if (request.method === "npm") await installFromNpm(request);
+    else await installFromDownload(request);
+    const resolved = await resolveCommand(request.command);
+    if (!resolved) {
+      throw new Error(
+        `the install finished but ${request.command} is still not runnable on this Machine`
+      );
+    }
+    return resolved;
+  });
+  const attempt = async (request) => {
+    options.onEvent?.({ command: request.command, state: "started" });
+    try {
+      const path = await perform(request, toolsRoot);
+      if (!withinRoot(toolsRoot, path)) {
+        throw new Error(
+          `${request.command} resolves outside the Zixt folder and was not installed by Zixt`
+        );
+      }
+      const record2 = {
+        command: request.command,
+        method: request.method,
+        source: request.source,
+        path,
+        sha256: request.sha256 ? request.sha256.toLowerCase() : null,
+        installedAt: new Date(now()).toISOString()
+      };
+      await recordInstall(record2).catch(() => void 0);
+      options.onEvent?.({ command: request.command, state: "completed" });
+      return { ok: true, record: record2 };
+    } catch (error52) {
+      const message = error52 instanceof Error ? error52.message : "unknown software install error";
+      options.onEvent?.({ command: request.command, state: "failed", error: message });
+      return { ok: false, error: message };
+    }
+  };
+  return {
+    toolsRoot,
+    async probe(command) {
+      if (!COMMAND_PATTERN.test(command)) {
+        return { command, present: false, path: null, managed: false };
+      }
+      const path = await resolveCommand(command);
+      return {
+        command,
+        present: path !== null,
+        path,
+        managed: path !== null && withinRoot(toolsRoot, path)
+      };
+    },
+    async install(request) {
+      const refusal = refuseSoftwareRequest(request);
+      if (refusal) return { ok: false, error: refusal };
+      const key = [
+        request.command,
+        request.method,
+        request.source,
+        request.sha256?.toLowerCase() ?? ""
+      ].join("\n");
+      const running = inFlight.get(key);
+      if (running) return running;
+      const failure2 = failures.get(key);
+      if (failure2 && now() - failure2.at < FAILURE_COOLDOWN_MS2) {
+        return {
+          ok: false,
+          error: `This exact install already failed on this Machine: ${failure2.error}. Do not repeat it. Finish the work another way, or tell the person what is missing and the command they would run.`
+        };
+      }
+      const started = (async () => {
+        const result = await attempt(request);
+        if (result.ok) failures.delete(key);
+        else failures.set(key, { at: now(), error: result.error });
+        return result;
+      })();
+      inFlight.set(key, started);
+      try {
+        return await started;
+      } finally {
+        inFlight.delete(key);
+      }
+    },
+    async installed() {
+      return readManifest();
+    }
+  };
+}
+
+// src/runners/ask-user-server.ts
 var CADENCE_PROPS = {
   cadence_kind: {
     type: "string",
@@ -38121,6 +38631,55 @@ var TOOLS = [
       additionalProperties: false
     }
   },
+  {
+    name: "check_software",
+    description: "Check whether a command is already available on this Machine before assuming it is missing. Returns whether it is present, where it resolved, and whether Zixt is the one that installed it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          description: "The plain command name, for example ffmpeg or gh. No path, no arguments."
+        }
+      },
+      required: ["command"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "install_software",
+    description: "Install a command this Machine is missing, into the folder Zixt owns, after the person approves it. Prefer not to call this. Installing software on someone else\u2019s computer is friction, so first try to finish the work with what the Machine already has: a different tool, a project dependency, or another approach. Call it only when the missing command genuinely blocks the work or is clearly the right way to do it, and never speculatively. Zixt can install an npm package, or download and unpack a release from an HTTPS URL. It cannot use a system package manager such as apt, brew, winget, or choco, cannot ask for elevation or sudo, and cannot build from source. When the tool needs any of those, or the install looks complicated, do not call this: tell the person what is missing, why this work needs it, and the exact command they would run on their operating system. The person sees your reason and the exact source before anything runs, and may say no.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          description: "The plain command name the work needs on PATH, for example ffmpeg."
+        },
+        reason: {
+          type: "string",
+          minLength: 1,
+          maxLength: 500,
+          description: "Why this work needs it, in one plain sentence. The person reads this before deciding."
+        },
+        method: {
+          type: "string",
+          enum: [...SOFTWARE_INSTALL_METHODS],
+          description: "npm for an npm package; download for a release archive or binary."
+        },
+        source: {
+          type: "string",
+          description: "npm: the package name, optionally name@version with an exact version. download: the HTTPS URL of the release archive or binary."
+        },
+        sha256: {
+          type: "string",
+          description: "download only: the published SHA-256 of that file, when the project publishes one. Include it whenever you can."
+        }
+      },
+      required: ["command", "reason", "method", "source"],
+      additionalProperties: false
+    }
+  },
   {
     name: "publish_file",
     description: "Snapshot a file you created in this Task workspace into Zixt so the user can download it. This only creates the Zixt file; it does not send it anywhere externally. The result returns an artifact_id.",
@@ -38906,6 +39465,57 @@ function createAskUserServer() {
           }
           return;
         }
+        if (surface.platform && (name === "check_software" || name === "install_software")) {
+          if (!handlers.software) {
+            toolText("Software checks are unavailable for this runner.", true);
+            return;
+          }
+          const command = typeof args["command"] === "string" ? args["command"].trim() : "";
+          if (!command) {
+            toolText("missing required argument `command`", true);
+            return;
+          }
+          try {
+            if (name === "check_software") {
+              toolText(JSON.stringify(await handlers.software.check(command), null, 2));
+              return;
+            }
+            const reason = typeof args["reason"] === "string" ? args["reason"].trim() : "";
+            const method = typeof args["method"] === "string" ? args["method"] : "";
+            const source = typeof args["source"] === "string" ? args["source"].trim() : "";
+            const sha256 = typeof args["sha256"] === "string" && args["sha256"] ? args["sha256"] : void 0;
+            if (!reason) {
+              toolText(
+                "missing required argument `reason`: the person decides by reading why this work needs it",
+                true
+              );
+              return;
+            }
+            if (!SOFTWARE_INSTALL_METHODS.includes(method)) {
+              toolText(`\`method\` must be one of ${SOFTWARE_INSTALL_METHODS.join(", ")}.`, true);
+              return;
+            }
+            const request = {
+              command,
+              method,
+              source,
+              sha256
+            };
+            const refusal = refuseSoftwareRequest(request);
+            if (refusal) {
+              toolText(refusal, true);
+              return;
+            }
+            const outcome = await handlers.software.install({ ...request, reason });
+            toolText(outcome.detail, !outcome.ok);
+          } catch (err) {
+            toolText(
+              `The software request could not be completed: ${String(err instanceof Error ? err.message : err)}`,
+              true
+            );
+          }
+          return;
+        }
         if (surface.platform && name === "publish_file") {
           if (!handlers.publishFile) {
             toolText("file publishing is unavailable for this runner", true);
@@ -39021,6 +39631,7 @@ function createAskUserServer() {
         agentOp: input.agentOp,
         ..."requestApproval" in input && input.requestApproval ? { requestApproval: input.requestApproval } : {},
         ..."publishFile" in input && input.publishFile ? { publishFile: input.publishFile } : {},
+        ..."software" in input && input.software ? { software: input.software } : {},
         ...toolPacks.length > 0 ? { toolPacks } : {}
       };
       const toolOwners = /* @__PURE__ */ new Map();
@@ -39173,7 +39784,10 @@ function buildRunnerEnv(input) {
       env[name] = value;
     }
   }
-  const searchPath = sanitizeInheritedSearchPath(inheritedValue(input.inherited, "PATH"));
+  const searchPath = [
+    sanitizeInheritedSearchPath(inheritedValue(input.inherited, "PATH")),
+    ...(input.softwareToolsPath ?? []).filter((entry) => isAbsolute14(entry))
+  ].filter((entry) => entry !== "").join(delimiter2);
   const gitConfig = input.githubShell ? [
     ["credential.helper", ""],
     ["credential.helper", input.githubShell.gitCredentialHelper],
@@ -39240,9 +39854,9 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod6, lstat as lstat10, mkdir as mkdir11, realpath as realpath7, writeFile as writeFile7 } from "node:fs/promises";
+import { chmod as chmod7, lstat as lstat10, mkdir as mkdir12, realpath as realpath7, writeFile as writeFile8 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { isAbsolute as isAbsolute15, join as join17, relative as relative8 } from "node:path";
+import { isAbsolute as isAbsolute15, join as join18, relative as relative9 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
 var DIRECTORY_MODE4 = 448;
 var PRIVATE_FILE_MODE = 384;
@@ -39606,7 +40220,7 @@ function activationCredential(grant, now = Date.now()) {
   return expiresAt.getTime() <= now ? null : { accessToken: grant.accessToken, expiresAt };
 }
 function assertChildPath2(parent, child) {
-  const path = relative8(parent, child);
+  const path = relative9(parent, child);
   if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute15(path)) {
     throw new Error("GitHub shell helper path escaped its private run directory");
   }
@@ -39618,11 +40232,11 @@ function quoteForPosixShell(value) {
   return quoteForGitShell2(value);
 }
 async function writePrivate(path, content, executable = false) {
-  await writeFile7(path, content, {
+  await writeFile8(path, content, {
     flag: "wx",
     mode: executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE
   });
-  await chmod6(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
+  await chmod7(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
 }
 async function prepareHelpers(input) {
   const rootEntry = await lstat10(input.runRoot);
@@ -39630,7 +40244,7 @@ async function prepareHelpers(input) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
   const runRoot = await realpath7(input.runRoot);
-  const helperPath = join17(runRoot, "github-shell-git-credential.cjs");
+  const helperPath = join18(runRoot, "github-shell-git-credential.cjs");
   assertChildPath2(runRoot, helperPath);
   await writePrivate(helperPath, GIT_HELPER_SOURCE);
   if (!input.ghExecutablePath) {
@@ -39641,14 +40255,14 @@ async function prepareHelpers(input) {
       wrapperSourcePath: null
     };
   }
-  const shellToolsDirectory = join17(runRoot, "shell-tools");
+  const shellToolsDirectory = join18(runRoot, "shell-tools");
   assertChildPath2(runRoot, shellToolsDirectory);
-  await mkdir11(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
-  await chmod6(shellToolsDirectory, DIRECTORY_MODE4);
-  const wrapperSourcePath = join17(runRoot, "github-shell-gh-wrapper.cjs");
+  await mkdir12(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
+  await chmod7(shellToolsDirectory, DIRECTORY_MODE4);
+  const wrapperSourcePath = join18(runRoot, "github-shell-gh-wrapper.cjs");
   assertChildPath2(runRoot, wrapperSourcePath);
   await writePrivate(wrapperSourcePath, GH_WRAPPER_SOURCE);
-  const wrapperPath = join17(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
+  const wrapperPath = join18(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
   assertChildPath2(runRoot, wrapperPath);
   const launcher = process.platform === "win32" ? `@"${process.execPath.replaceAll('"', '""')}" "${wrapperSourcePath.replaceAll('"', '""')}" %*\r
 ` : `#!/bin/sh
@@ -39871,7 +40485,7 @@ password=${credential.accessToken}
 }
 
 // src/runners/working-context.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { resolve as resolve9 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
@@ -40002,7 +40616,7 @@ async function stopWorkingContextCommand(child, childExited, options = {}) {
 function run(command, args, cwd, env, signal) {
   if (signal?.aborted) return Promise.resolve(null);
   return new Promise((resolvePromise) => {
-    const child = spawn9(command, [...args], {
+    const child = spawn10(command, [...args], {
       cwd,
       env: { ...env, GIT_OPTIONAL_LOCKS: "0" },
       detached: process.platform !== "win32",
@@ -40420,6 +41034,7 @@ var WorkingContextPullRequestCache = class {
 };
 
 // src/runners/cli-runner.ts
+var softwareInstaller = createSoftwareInstaller();
 var PRIVATE_CLEANUP_FAILURE = "Private runner cleanup could not be completed. Restart the Zixt Host before accepting more work.";
 var PROCESS_CLEANUP_FAILURE = "Runner process cleanup could not be confirmed. Restart the Zixt Host before accepting more work.";
 var PROVIDER_CLEANUP_FAILURE = "Provider tool cleanup could not be completed. Restart the Zixt Host before accepting more work.";
@@ -40442,7 +41057,7 @@ async function settlesWithin(promise2, timeoutMs) {
   }
 }
 function defaultRunnerWorkspaceRoot() {
-  return join18(homedir7(), ".zixt", "workspaces");
+  return join19(homedir7(), ".zixt", "workspaces");
 }
 function defaultRunnerArtifactRoot() {
   return defaultRunArtifactRoot();
@@ -40491,7 +41106,7 @@ function createCliRunner(adapter, opts = {}) {
   const prefixArgs = opts.commandPrefixArgs ?? [];
   const maxWallTimeMs = opts.maxWallTimeMs;
   const workspaceRoot = opts.workspaceRoot ?? defaultRunnerWorkspaceRoot();
-  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join18(dirname10(workspaceRoot), "run-artifacts"));
+  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join19(dirname10(workspaceRoot), "run-artifacts"));
   const runRegistryRoot2 = opts.runRegistryRoot ?? defaultRunRegistryRoot();
   const createArtifacts = opts.createArtifacts ?? createRunArtifacts;
   const toolPackRegistry2 = opts.toolPackRegistry ?? createDefaultToolPackRegistry();
@@ -40509,7 +41124,7 @@ function createCliRunner(adapter, opts = {}) {
   };
   const askUserServer = createAskUserServer();
   const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join18(windowsRoot, "System32", "cmd.exe") : void 0;
+  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join19(windowsRoot, "System32", "cmd.exe") : void 0;
   let safetyFailure;
   return async (task) => {
     if (safetyFailure) {
@@ -40549,8 +41164,8 @@ function createCliRunner(adapter, opts = {}) {
         usage: { inputTokens: 0, outputTokens: 0 }
       };
     }
-    const taskRoot = join18(workspaceRoot, task.agentId);
-    await mkdir12(taskRoot, { recursive: true });
+    const taskRoot = join19(workspaceRoot, task.agentId);
+    await mkdir13(taskRoot, { recursive: true });
     if (task.cancelledNow()) return cancelledBeforeRun();
     const configuredWorkspace = task.spec.workspace;
     let cwd = taskRoot;
@@ -40597,7 +41212,7 @@ function createCliRunner(adapter, opts = {}) {
         summaryEvidence: "host_observed"
       };
     }
-    const runToken = randomUUID11();
+    const runToken = randomUUID12();
     const artifacts = await createArtifacts({
       root: artifactRoot,
       agentId: task.agentId,
@@ -40653,7 +41268,8 @@ function createCliRunner(adapter, opts = {}) {
         runner: { type: adapter.type, auth: runner.auth },
         gitIdentity: githubCommitIdentity(providerGrants),
         isolation: artifacts,
-        githubShell
+        githubShell,
+        softwareToolsPath: softwareSearchPathEntries(softwareInstaller.toolsRoot)
       });
       toolPacks = await toolPackRegistry2.createInstances(providerGrants, {
         taskId: task.taskId,
@@ -40746,6 +41362,51 @@ function createCliRunner(adapter, opts = {}) {
           }
         },
         publishFile,
+        // AG-4a. The person approves in the Task thread through the ordinary
+        // approvals pipeline, so the wall clock pauses while they decide, and
+        // a refusal is an answer the session can act on rather than a failure.
+        software: {
+          check: (command2) => softwareInstaller.probe(command2),
+          install: async ({ reason, ...request }) => {
+            pendingAsks++;
+            let decision;
+            try {
+              decision = await task.requestApproval(
+                "agent.question",
+                `Install ${request.command} on this Machine: ${reason}`.slice(0, 500),
+                JSON.stringify({
+                  command: request.command,
+                  reason,
+                  method: request.method,
+                  source: request.source,
+                  ...request.sha256 ? { sha256: request.sha256 } : {},
+                  folder: softwareInstaller.toolsRoot
+                }).slice(0, MAX_APPROVAL_PAYLOAD)
+              );
+            } finally {
+              pendingAsks--;
+            }
+            if (!decision.approved) {
+              return {
+                ok: false,
+                detail: decision.guidance ?? `The person did not approve installing ${request.command}. Do not ask again for this task. Finish the work another way, or explain what is blocked.`
+              };
+            }
+            task.event("status", `Installing ${request.command} on this Machine`, {
+              tool: "install_software"
+            });
+            const result2 = await softwareInstaller.install(request);
+            task.event(
+              "status",
+              result2.ok ? `Installed ${request.command} on this Machine` : `Could not install ${request.command} on this Machine`,
+              { tool: "install_software" }
+            );
+            return result2.ok ? {
+              ok: true,
+              detail: `${request.command} is installed at ${result2.record.path} and is on your PATH. Continue the work.`
+            } : { ok: false, detail: result2.error };
+          }
+        },
         agentOp: (op) => task.agentOp(op),
         // GitHub repository work belongs in the installed `git` and `gh`
         // commands backed by GithubShellAuth. Do not advertise the bundled
@@ -40970,8 +41631,8 @@ ${attachmentSection}` : prompt;
           }
           comspec = resolvedWindowsComspec;
         }
-        const exitMarker = `__ZIXT_RUNNER_EXIT_${randomUUID11()}__`;
-        const guardianNonce = randomUUID11();
+        const exitMarker = `__ZIXT_RUNNER_EXIT_${randomUUID12()}__`;
+        const guardianNonce = randomUUID12();
         return runCliProcess({
           command: resolvedCommand,
           args,
@@ -41328,8 +41989,8 @@ function runCliProcess(options) {
   }
   return new Promise((resolve19) => {
     const platform = options.platform ?? process.platform;
-    const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID11() : void 0;
-    const child = options.guardian ? spawn10(
+    const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID12() : void 0;
+    const child = options.guardian ? spawn11(
       options.guardian.nodeCommand,
       [
         options.guardian.scriptPath,
@@ -41617,12 +42278,12 @@ function runCliProcess(options) {
 }
 
 // src/runners/claude-code.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 
 // src/runners/runtime-observation.ts
-import { open as open6, readdir as readdir5, realpath as realpath9 } from "node:fs/promises";
+import { open as open6, readdir as readdir6, realpath as realpath9 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
 var CATALOG_TIMEOUT_MS = 15e3;
 var CATALOG_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
@@ -41682,9 +42343,9 @@ function displayValue(value, maxLength) {
   return trimmed;
 }
 function claudeTranscriptPath(input) {
-  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join19(homeFrom(input.env), ".claude");
+  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join20(homeFrom(input.env), ".claude");
   const slug = input.resolvedCwd.replace(/[^a-zA-Z0-9]/g, "-");
-  return join19(configDir, "projects", slug, `${input.sessionId}.jsonl`);
+  return join20(configDir, "projects", slug, `${input.sessionId}.jsonl`);
 }
 async function readClaudeSessionEffort(input) {
   const resolvedCwd = await realpath9(input.cwd).catch(() => input.cwd);
@@ -41699,19 +42360,19 @@ async function readClaudeSessionEffort(input) {
   return null;
 }
 async function newestDirectories(root, limit) {
-  const entries = await readdir5(root, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join19(root, name));
+  const entries = await readdir6(root, { withFileTypes: true }).catch(() => []);
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join20(root, name));
 }
 async function findCodexRolloutPath(input) {
-  const codexHome = input.env["CODEX_HOME"] || join19(homeFrom(input.env), ".codex");
-  const sessions = join19(codexHome, "sessions");
+  const codexHome = input.env["CODEX_HOME"] || join20(homeFrom(input.env), ".codex");
+  const sessions = join20(codexHome, "sessions");
   const suffix = `-${input.threadId}.jsonl`;
   for (const year of await newestDirectories(sessions, 2)) {
     for (const month of await newestDirectories(year, 2)) {
       for (const day of await newestDirectories(month, 3)) {
-        const files = await readdir5(day).catch(() => []);
+        const files = await readdir6(day).catch(() => []);
         const match = files.find((name) => name.endsWith(suffix));
-        if (match) return join19(day, match);
+        if (match) return join20(day, match);
       }
     }
   }
@@ -41809,7 +42470,7 @@ var claudeCodeAdapter = {
       input.gitDetected,
       liveInput
     );
-    const sessionId = input.task.spec.sessionKey ?? randomUUID12();
+    const sessionId = input.task.spec.sessionKey ?? randomUUID13();
     const observeRuntime = createRuntimeReporter(input, sessionId);
     return {
       argsFor: (mode) => [
@@ -41938,7 +42599,7 @@ function createClaudeLiveParser(onStream, onSessionModel) {
     ...parser,
     async start(writer, prompt) {
       write = writer;
-      await writer(input(randomUUID12(), prompt));
+      await writer(input(randomUUID13(), prompt));
     },
     async steer(followUp) {
       if (!write) return false;
@@ -42105,22 +42766,22 @@ function improveErrorMessage(error52) {
 }
 
 // src/runners/codex.ts
-import { mkdir as mkdir13, readFile as readFile10, writeFile as writeFile8 } from "node:fs/promises";
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { mkdir as mkdir14, readFile as readFile11, writeFile as writeFile9 } from "node:fs/promises";
+import { randomUUID as randomUUID14 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var CODEX_NOT_FOUND_MESSAGE = "The `codex` CLI was not found on this Machine. Install it (npm install -g @openai/codex) and sign in with `codex login`, or switch the agent to API-key auth.";
 function defaultCodexThreadIndexRoot() {
-  return join20(homedir9(), ".zixt", "codex-threads");
+  return join21(homedir9(), ".zixt", "codex-threads");
 }
 var SAFE_SEGMENT3 = /^[A-Za-z0-9_-]{1,200}$/;
 function threadIndexPath(root, agentId, sessionKey) {
   if (!SAFE_SEGMENT3.test(agentId) || !SAFE_SEGMENT3.test(sessionKey)) return null;
-  return join20(root, agentId, `${sessionKey}.json`);
+  return join21(root, agentId, `${sessionKey}.json`);
 }
 async function readThreadId(path) {
   try {
-    const parsed = JSON.parse(await readFile10(path, "utf8"));
+    const parsed = JSON.parse(await readFile11(path, "utf8"));
     return typeof parsed.threadId === "string" && /^[A-Za-z0-9-]{1,120}$/.test(parsed.threadId) ? parsed.threadId : null;
   } catch {
     return null;
@@ -42220,7 +42881,7 @@ ${value}` : value;
       const recordedThreadId = indexPath ? await readThreadId(indexPath) : null;
       const rememberThread = (threadId) => {
         if (!indexPath) return;
-        void mkdir13(join20(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile8(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
+        void mkdir14(join21(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile9(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
         });
       };
       const observeRuntime = (threadId) => {
@@ -42324,7 +42985,7 @@ function createCodexAppServerParser(onStream, options) {
       params: {
         threadId,
         input: [{ type: "text", text: prompt }],
-        clientUserMessageId: randomUUID13(),
+        clientUserMessageId: randomUUID14(),
         ...options.model ? { model: options.model } : {},
         ...options.effort ? { effort: options.effort } : {}
       }
@@ -42683,7 +43344,7 @@ function improveCodexErrorMessage(error52) {
 }
 
 // src/runners/git-preflight.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn12 } from "node:child_process";
 import { realpath as realpath10 } from "node:fs/promises";
 import { isAbsolute as isAbsolute17, resolve as resolve11 } from "node:path";
 var OUTPUT_LIMIT = 8192;
@@ -42732,7 +43393,7 @@ async function preflightGit(options = {}) {
 }
 async function runVersionProbe(input) {
   return new Promise((resolvePromise) => {
-    const child = spawn11(input.executablePath, input.args, {
+    const child = spawn12(input.executablePath, input.args, {
       cwd: input.cwd,
       env: {
         ...process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {},
@@ -42954,16 +43615,16 @@ function run2(command, args) {
 }
 
 // src/linux-service.ts
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
-import { access as access5, chmod as chmod8, mkdir as mkdir15, open as open7, rename as rename7, rm as rm11 } from "node:fs/promises";
+import { access as access5, chmod as chmod9, mkdir as mkdir16, open as open7, rename as rename8, rm as rm12 } from "node:fs/promises";
 import { homedir as homedir11, userInfo } from "node:os";
-import { basename as basename4, dirname as dirname11, join as join22, relative as relative9, resolve as resolve13, sep as sep6 } from "node:path";
+import { basename as basename4, dirname as dirname11, join as join23, relative as relative10, resolve as resolve13, sep as sep7 } from "node:path";
 
 // src/service-runtime.ts
-import { access as access4, chmod as chmod7, copyFile, mkdir as mkdir14, rename as rename6, rm as rm10 } from "node:fs/promises";
+import { access as access4, chmod as chmod8, copyFile, mkdir as mkdir15, rename as rename7, rm as rm11 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { join as join21, resolve as resolve12, sep as sep5 } from "node:path";
+import { join as join22, resolve as resolve12, sep as sep6 } from "node:path";
 async function ensureDurableServiceNode(options = {}) {
   const execPath = resolve12(options.execPath ?? process.execPath);
   const home = options.home ?? homedir10();
@@ -42973,22 +43634,22 @@ async function ensureDurableServiceNode(options = {}) {
     throw new Error("the Node runtime version is not a safe directory name");
   }
   const zixtRoot = resolve12(home, ".zixt");
-  if (execPath === zixtRoot || execPath.startsWith(zixtRoot + sep5)) return execPath;
-  const directory = join21(zixtRoot, "runtime", `node-${version2}`);
-  const destination = join21(directory, platform === "win32" ? "node.exe" : "node");
+  if (execPath === zixtRoot || execPath.startsWith(zixtRoot + sep6)) return execPath;
+  const directory = join22(zixtRoot, "runtime", `node-${version2}`);
+  const destination = join22(directory, platform === "win32" ? "node.exe" : "node");
   const alreadyCopied = await access4(destination).then(
     () => true,
     () => false
   );
   if (alreadyCopied) return destination;
-  await mkdir14(directory, { recursive: true, mode: 448 });
+  await mkdir15(directory, { recursive: true, mode: 448 });
   const temporary = `${destination}.${process.pid}.${crypto.randomUUID()}.tmp`;
   try {
     await copyFile(execPath, temporary);
-    await chmod7(temporary, 493);
-    await rename6(temporary, destination);
+    await chmod8(temporary, 493);
+    await rename7(temporary, destination);
   } catch (error52) {
-    await rm10(temporary, { force: true }).catch(() => void 0);
+    await rm11(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
   await options.syncDirectory?.(directory);
@@ -43024,7 +43685,7 @@ function boundedAppend(current, chunk) {
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
   return new Promise((resolve19) => {
-    const child = spawn12(command, [...args], {
+    const child = spawn13(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
       windowsHide: true
@@ -43096,33 +43757,33 @@ async function defaultSyncDirectory(path) {
   }
 }
 async function ensureDirectory(path, mode, syncDirectory8) {
-  const firstCreated = await mkdir15(path, { recursive: true, mode });
+  const firstCreated = await mkdir16(path, { recursive: true, mode });
   if (!firstCreated) return;
   const first = resolve13(firstCreated);
   const target = resolve13(path);
   await syncDirectory8(dirname11(first));
   let current = first;
-  const descendants = relative9(first, target);
-  for (const part of descendants ? descendants.split(sep6) : []) {
+  const descendants = relative10(first, target);
+  for (const part of descendants ? descendants.split(sep7) : []) {
     await syncDirectory8(current);
-    current = join22(current, part);
+    current = join23(current, part);
   }
 }
 async function replacePrivateFile(path, contents, mode, syncDirectory8) {
   const parent = dirname11(path);
   await ensureDirectory(parent, 448, syncDirectory8);
-  const temporary = join22(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join23(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open7(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
     await handle.close();
-    await rename7(temporary, path);
-    await chmod8(path, mode);
+    await rename8(temporary, path);
+    await chmod9(path, mode);
     await syncDirectory8(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm11(temporary, { force: true }).catch(() => void 0);
+    await rm12(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -43163,11 +43824,11 @@ async function installLinuxService(options) {
     "command search path"
   );
   const cloudUrl = options.cloudUrl ? oneLine(options.cloudUrl, "Zixt Cloud address") : void 0;
-  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join22(home, ".config");
-  const configRoot = options.serviceConfigRoot ?? join22(xdgConfigHome, "zixt");
-  const unitRoot = options.userUnitRoot ?? join22(xdgConfigHome, "systemd", "user");
-  const environmentPath = join22(configRoot, "host.env");
-  const unitPath = join22(unitRoot, SERVICE_NAME);
+  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join23(home, ".config");
+  const configRoot = options.serviceConfigRoot ?? join23(xdgConfigHome, "zixt");
+  const unitRoot = options.userUnitRoot ?? join23(xdgConfigHome, "systemd", "user");
+  const environmentPath = join23(configRoot, "host.env");
+  const unitPath = join23(unitRoot, SERVICE_NAME);
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : activateInstalledRelease);
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
@@ -43207,7 +43868,7 @@ async function installLinuxService(options) {
     }
   }
   await ensureDirectory(configRoot, 448, syncDirectory8);
-  await chmod8(configRoot, 448);
+  await chmod9(configRoot, 448);
   const serviceEnvironment = [
     `ZIXT_HOST_TOKEN=${systemdEnvironmentValue(token2)}`,
     ...cloudUrl ? [`ZIXT_CLOUD_URL=${systemdEnvironmentValue(cloudUrl)}`] : [],
@@ -43295,11 +43956,11 @@ async function installLinuxService(options) {
 }
 
 // src/macos-service.ts
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn14 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
-import { access as access6, chmod as chmod9, mkdir as mkdir16, open as open8, rename as rename8, rm as rm12 } from "node:fs/promises";
+import { access as access6, chmod as chmod10, mkdir as mkdir17, open as open8, rename as rename9, rm as rm13 } from "node:fs/promises";
 import { homedir as homedir12, userInfo as userInfo2 } from "node:os";
-import { basename as basename5, dirname as dirname12, join as join23, relative as relative10, resolve as resolve14, sep as sep7 } from "node:path";
+import { basename as basename5, dirname as dirname12, join as join24, relative as relative11, resolve as resolve14, sep as sep8 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var STATUS_WAIT_MS = 2e4;
@@ -43324,32 +43985,32 @@ async function syncDirectory4(path) {
   }
 }
 async function ensureDirectory2(path, sync) {
-  const firstCreated = await mkdir16(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir17(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
   const first = resolve14(firstCreated);
   const target = resolve14(path);
   await sync(dirname12(first));
   let current = first;
-  for (const part of relative10(first, target).split(sep7).filter(Boolean)) {
+  for (const part of relative11(first, target).split(sep8).filter(Boolean)) {
     await sync(current);
-    current = join23(current, part);
+    current = join24(current, part);
   }
 }
 async function replacePrivateFile2(path, contents, mode, sync) {
   const parent = dirname12(path);
   await ensureDirectory2(parent, sync);
-  const temporary = join23(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join24(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open8(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
     await handle.close();
-    await rename8(temporary, path);
-    await chmod9(path, mode);
+    await rename9(temporary, path);
+    await chmod10(path, mode);
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm12(temporary, { force: true }).catch(() => void 0);
+    await rm13(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -43363,7 +44024,7 @@ function commandEnvironment(env) {
 }
 async function defaultRunCommand2(command, args, env) {
   return new Promise((resolveResult) => {
-    const child = spawn13(command, [...args], {
+    const child = spawn14(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment(env)
     });
@@ -43435,14 +44096,14 @@ async function installMacosService(options) {
     options.path ?? env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin",
     "command search path"
   );
-  const configRoot = options.configRoot ?? join23(home, "Library", "Application Support", "Zixt");
-  const launchAgentsRoot = options.launchAgentsRoot ?? join23(home, "Library", "LaunchAgents");
-  const logRoot = options.logRoot ?? join23(home, "Library", "Logs", "Zixt");
-  const configPath = join23(configRoot, "host.env");
-  const launcherPath = join23(configRoot, "host-launcher.sh");
-  const plistPath = join23(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
-  const stdoutPath = join23(logRoot, "host.log");
-  const stderrPath = join23(logRoot, "host-error.log");
+  const configRoot = options.configRoot ?? join24(home, "Library", "Application Support", "Zixt");
+  const launchAgentsRoot = options.launchAgentsRoot ?? join24(home, "Library", "LaunchAgents");
+  const logRoot = options.logRoot ?? join24(home, "Library", "Logs", "Zixt");
+  const configPath = join24(configRoot, "host.env");
+  const launcherPath = join24(configRoot, "host-launcher.sh");
+  const plistPath = join24(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
+  const stdoutPath = join24(logRoot, "host.log");
+  const stderrPath = join24(logRoot, "host-error.log");
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? (async () => defaultResolveCommand2());
@@ -43465,7 +44126,7 @@ async function installMacosService(options) {
   await ensureDirectory2(configRoot, sync);
   await ensureDirectory2(launchAgentsRoot, sync);
   await ensureDirectory2(logRoot, sync);
-  await chmod9(configRoot, 448);
+  await chmod10(configRoot, 448);
   const serviceEnvironment = [
     `ZIXT_HOST_TOKEN=${shellValue(token2)}`,
     ...cloudUrl ? [`ZIXT_CLOUD_URL=${shellValue(cloudUrl)}`] : [],
@@ -43543,11 +44204,11 @@ async function installMacosService(options) {
 }
 
 // src/windows-service.ts
-import { spawn as spawn14 } from "node:child_process";
+import { spawn as spawn15 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
-import { access as access7, mkdir as mkdir17, open as open9, readFile as readFile11, rename as rename9, rm as rm13 } from "node:fs/promises";
+import { access as access7, mkdir as mkdir18, open as open9, readFile as readFile12, rename as rename10, rm as rm14 } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
-import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute18, join as join24, relative as relative11, resolve as resolve15, sep as sep8 } from "node:path";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute18, join as join25, relative as relative12, resolve as resolve15, sep as sep9 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -43573,31 +44234,31 @@ async function syncDirectory5(path) {
   }
 }
 async function ensureDirectory3(path, sync) {
-  const firstCreated = await mkdir17(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir18(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
   const first = resolve15(firstCreated);
   const target = resolve15(path);
   await sync(dirname13(first));
   let current = first;
-  for (const part of relative11(first, target).split(sep8).filter(Boolean)) {
+  for (const part of relative12(first, target).split(sep9).filter(Boolean)) {
     await sync(current);
-    current = join24(current, part);
+    current = join25(current, part);
   }
 }
 async function replacePrivateFile3(path, contents, sync, encoding = "utf8") {
   const parent = dirname13(path);
   await ensureDirectory3(parent, sync);
-  const temporary = join24(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join25(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open9(temporary, "wx", 384);
   try {
     await handle.writeFile(encoding === "utf16le" ? `\uFEFF${contents}` : contents, encoding);
     await handle.sync();
     await handle.close();
-    await rename9(temporary, path);
+    await rename10(temporary, path);
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm13(temporary, { force: true }).catch(() => void 0);
+    await rm14(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -43608,7 +44269,7 @@ function commandEnvironment2(env) {
 }
 async function runChild(command, args, env, input) {
   return new Promise((resolveResult) => {
-    const child = spawn14(command, [...args], {
+    const child = spawn15(command, [...args], {
       stdio: [input === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
       env: commandEnvironment2(env),
       windowsHide: true
@@ -43642,7 +44303,7 @@ async function runChild(command, args, env, input) {
 async function defaultResolveCommand3(name, env) {
   const root = env.SYSTEMROOT ?? env.WINDIR;
   if (!root || !isAbsolute18(root)) return null;
-  const candidate = name === "powershell" ? join24(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join24(root, "System32", `${name}.exe`);
+  const candidate = name === "powershell" ? join25(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join25(root, "System32", `${name}.exe`);
   return access7(candidate, constants4.X_OK).then(
     () => candidate,
     () => null
@@ -43732,7 +44393,7 @@ exit $code
 }
 async function defaultObserveStatus(path, generation) {
   try {
-    const text = (await readFile11(path, "utf8")).replace(/^\uFEFF/, "");
+    const text = (await readFile12(path, "utf8")).replace(/^\uFEFF/, "");
     const value = JSON.parse(text);
     if (value.schema !== 1 || value.generation !== generation || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) {
       return null;
@@ -43793,12 +44454,12 @@ async function installWindowsService(options) {
   const token2 = oneLine3(options.token, "pairing code");
   const cloudUrl = options.cloudUrl ? oneLine3(options.cloudUrl, "Zixt Cloud address") : void 0;
   const path = oneLine3(options.path ?? env.PATH ?? "", "command search path");
-  const configRoot = options.configRoot ?? join24(localAppData, "Zixt", "Host");
-  const configPath = join24(configRoot, "host.json");
-  const launcherPath = join24(configRoot, "host-launcher.ps1");
-  const launchShimPath = join24(configRoot, "host-launch.vbs");
-  const taskXmlPath = join24(configRoot, "host-task.xml");
-  const statusPath = join24(configRoot, "host-status.json");
+  const configRoot = options.configRoot ?? join25(localAppData, "Zixt", "Host");
+  const configPath = join25(configRoot, "host.json");
+  const launcherPath = join25(configRoot, "host-launcher.ps1");
+  const launchShimPath = join25(configRoot, "host-launch.vbs");
+  const taskXmlPath = join25(configRoot, "host-task.xml");
+  const statusPath = join25(configRoot, "host-status.json");
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? ((name) => defaultResolveCommand3(name, env));
@@ -43865,7 +44526,7 @@ async function installWindowsService(options) {
     sync,
     "utf16le"
   );
-  await rm13(statusPath, { force: true });
+  await rm14(statusPath, { force: true });
   const acl = await run3(icacls, [
     configRoot,
     "/inheritance:r",
@@ -43925,23 +44586,23 @@ async function installSystemService(options) {
 }
 
 // src/terminal-outcomes.ts
-import { chmod as chmod10, lstat as lstat12, mkdir as mkdir18, open as open10, readdir as readdir6, readFile as readFile12, rename as rename10, rm as rm14 } from "node:fs/promises";
+import { chmod as chmod11, lstat as lstat12, mkdir as mkdir19, open as open10, readdir as readdir7, readFile as readFile13, rename as rename11, rm as rm15 } from "node:fs/promises";
 import { homedir as homedir14 } from "node:os";
-import { dirname as dirname14, join as join25, relative as relative12, resolve as resolve16, sep as sep9 } from "node:path";
+import { dirname as dirname14, join as join26, relative as relative13, resolve as resolve16, sep as sep10 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
 var HOST_DIRECTORY = /^hst_[0-9a-f]{32}$/;
 var OUTCOME_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 function defaultTerminalOutcomeRoot() {
-  return join25(homedir14(), ".zixt", "terminal-outcomes");
+  return join26(homedir14(), ".zixt", "terminal-outcomes");
 }
 function hostOutcomeRoot(root, hostId) {
   if (!HOST_DIRECTORY.test(hostId)) throw new Error("terminal outcome Host identity is malformed");
-  return join25(root, hostId);
+  return join26(root, hostId);
 }
 function outcomePath(root, hostId, taskId, epoch) {
-  return join25(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
+  return join26(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
 }
 async function syncDirectory6(root) {
   if (process.platform === "win32") return;
@@ -43953,22 +44614,22 @@ async function syncDirectory6(root) {
   }
 }
 async function requirePrivateRoot(root, sync = syncDirectory6) {
-  const firstCreated = await mkdir18(root, { recursive: true, mode: DIRECTORY_MODE5 });
+  const firstCreated = await mkdir19(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
     const first = resolve16(firstCreated);
     const target = resolve16(root);
     await sync(dirname14(first));
     let current = first;
-    for (const part of relative12(first, target).split(sep9).filter(Boolean)) {
+    for (const part of relative13(first, target).split(sep10).filter(Boolean)) {
       await sync(current);
-      current = join25(current, part);
+      current = join26(current, part);
     }
   }
   const stat4 = await lstat12(root);
   if (stat4.isSymbolicLink() || !stat4.isDirectory()) {
     throw new Error("terminal outcome journal root is not a trusted directory");
   }
-  await chmod10(root, DIRECTORY_MODE5);
+  await chmod11(root, DIRECTORY_MODE5);
 }
 function parseCommittedOutcome(text, taskId, epoch) {
   let json2;
@@ -43992,7 +44653,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   const destination = outcomePath(root, hostId, outcome.taskId, outcome.epoch);
   try {
     const existing = parseCommittedOutcome(
-      await readFile12(destination, { encoding: "utf8", flag: "r" }),
+      await readFile13(destination, { encoding: "utf8", flag: "r" }),
       outcome.taskId,
       outcome.epoch
     );
@@ -44001,7 +44662,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   } catch (error52) {
     if (error52.code !== "ENOENT") throw error52;
   }
-  const temporary = join25(
+  const temporary = join26(
     scopedRoot,
     `.${outcome.taskId}.${outcome.epoch}.${process.pid}.${Date.now()}.${outcome.resultId}.tmp`
   );
@@ -44012,13 +44673,13 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
     await handle.sync();
     await handle.close();
     handle = void 0;
-    await rename10(temporary, destination);
+    await rename11(temporary, destination);
     await sync(scopedRoot);
     await sync(root);
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm14(temporary, { force: true }).catch(() => {
+    await rm15(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -44033,8 +44694,8 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
     throw new Error("terminal outcome journal root is not a trusted directory");
   }
-  await chmod10(root, DIRECTORY_MODE5);
-  const hostEntries = await readdir6(root, { withFileTypes: true });
+  await chmod11(root, DIRECTORY_MODE5);
+  const hostEntries = await readdir7(root, { withFileTypes: true });
   const outcomes = [];
   const resultIds = /* @__PURE__ */ new Set();
   for (const hostEntry of hostEntries) {
@@ -44046,21 +44707,21 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
     if (scopedStat.isSymbolicLink() || !scopedStat.isDirectory()) {
       throw new Error("terminal outcome Host scope is not a trusted directory");
     }
-    await chmod10(scopedRoot, DIRECTORY_MODE5);
-    const entries = await readdir6(scopedRoot, { withFileTypes: true });
+    await chmod11(scopedRoot, DIRECTORY_MODE5);
+    const entries = await readdir7(scopedRoot, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.name.endsWith(".json")) continue;
       const match = OUTCOME_FILE.exec(entry.name);
       if (!match || !entry.isFile() || entry.isSymbolicLink()) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
-      const path = join25(scopedRoot, entry.name);
+      const path = join26(scopedRoot, entry.name);
       const stat4 = await lstat12(path);
       if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.size > MAX_OUTCOME_BYTES) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const outcome = parseCommittedOutcome(
-        await readFile12(path, "utf8"),
+        await readFile13(path, "utf8"),
         match[1],
         Number(match[2])
       );
@@ -44087,7 +44748,7 @@ async function forgetAcknowledgedTerminalOutcomes(refs, root = defaultTerminalOu
     if (acknowledged.get(`${hostId}:${outcome.taskId}:${outcome.epoch}`) !== outcome.resultId) {
       continue;
     }
-    await rm14(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm15(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     changedHostRoots.add(hostOutcomeRoot(root, hostId));
   }
   for (const scopedRoot of changedHostRoots) await syncDirectory6(scopedRoot);
@@ -44099,22 +44760,22 @@ async function forgetSupersededTerminalOutcomes(hostId, taskId, epoch, root = de
     if (scoped.hostId !== hostId) continue;
     const { outcome } = scoped;
     if (outcome.taskId !== taskId || outcome.epoch >= epoch) continue;
-    await rm14(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm15(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     removed = true;
   }
   if (removed) await syncDirectory6(hostOutcomeRoot(root, hostId));
 }
 
 // src/accepted-assignments.ts
-import { chmod as chmod11, lstat as lstat13, mkdir as mkdir19, open as open11, readdir as readdir7, rename as rename11, rm as rm15 } from "node:fs/promises";
+import { chmod as chmod12, lstat as lstat13, mkdir as mkdir20, open as open11, readdir as readdir8, rename as rename12, rm as rm16 } from "node:fs/promises";
 import { homedir as homedir15 } from "node:os";
-import { dirname as dirname15, join as join26, relative as relative13, resolve as resolve17, sep as sep10 } from "node:path";
+import { dirname as dirname15, join as join27, relative as relative14, resolve as resolve17, sep as sep11 } from "node:path";
 var DIRECTORY_MODE6 = 448;
 var FILE_MODE5 = 384;
 var CLAIM_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 var TASK_ID = /^tsk_[0-9a-f]{32}$/;
 function defaultAcceptedAssignmentRoot() {
-  return join26(homedir15(), ".zixt", "accepted-assignments");
+  return join27(homedir15(), ".zixt", "accepted-assignments");
 }
 async function syncDirectory7(root) {
   if (process.platform === "win32") return;
@@ -44126,29 +44787,29 @@ async function syncDirectory7(root) {
   }
 }
 async function requirePrivateRoot2(root, sync = syncDirectory7) {
-  const firstCreated = await mkdir19(root, { recursive: true, mode: DIRECTORY_MODE6 });
+  const firstCreated = await mkdir20(root, { recursive: true, mode: DIRECTORY_MODE6 });
   if (firstCreated) {
     const first = resolve17(firstCreated);
     const target = resolve17(root);
     await sync(dirname15(first));
     let current = first;
-    for (const part of relative13(first, target).split(sep10).filter(Boolean)) {
+    for (const part of relative14(first, target).split(sep11).filter(Boolean)) {
       await sync(current);
-      current = join26(current, part);
+      current = join27(current, part);
     }
   }
   const stat4 = await lstat13(root);
   if (stat4.isSymbolicLink() || !stat4.isDirectory()) {
     throw new Error("accepted assignment journal root is not a trusted directory");
   }
-  await chmod11(root, DIRECTORY_MODE6);
+  await chmod12(root, DIRECTORY_MODE6);
 }
 function claimPath(root, taskId, epoch) {
   if (!TASK_ID.test(taskId)) throw new Error("accepted assignment Task identity is malformed");
   if (!Number.isSafeInteger(epoch) || epoch < 1) {
     throw new Error("accepted assignment epoch is malformed");
   }
-  return join26(root, `${taskId}.${epoch}.json`);
+  return join27(root, `${taskId}.${epoch}.json`);
 }
 async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssignmentRoot(), options = {}) {
   const sync = options.syncDirectory ?? syncDirectory7;
@@ -44158,7 +44819,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } catch {
     return false;
   }
-  const temporary = join26(
+  const temporary = join27(
     root,
     `.${assignment.taskId}.${assignment.epoch}.${process.pid}.${Date.now()}.tmp`
   );
@@ -44170,7 +44831,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
     await handle.sync();
     await handle.close();
     handle = void 0;
-    await rename11(temporary, destination);
+    await rename12(temporary, destination);
     if (process.platform !== "win32") await sync(root);
     return true;
   } catch {
@@ -44178,7 +44839,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm15(temporary, { force: true }).catch(() => {
+    await rm16(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -44193,9 +44854,9 @@ async function recoverAcceptedAssignments(root = defaultAcceptedAssignmentRoot()
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
     throw new Error("accepted assignment journal root is not a trusted directory");
   }
-  await chmod11(root, DIRECTORY_MODE6);
+  await chmod12(root, DIRECTORY_MODE6);
   const claims = [];
-  for (const entry of await readdir7(root, { withFileTypes: true })) {
+  for (const entry of await readdir8(root, { withFileTypes: true })) {
     if (!entry.isFile()) continue;
     const match = CLAIM_FILE.exec(entry.name);
     if (!match) continue;
@@ -44212,7 +44873,7 @@ async function forgetAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } catch {
     return;
   }
-  await rm15(path, { force: true }).catch(() => {
+  await rm16(path, { force: true }).catch(() => {
   });
 }
 async function forgetAcknowledgedAcceptedAssignments(assignments, root = defaultAcceptedAssignmentRoot()) {
@@ -44220,9 +44881,9 @@ async function forgetAcknowledgedAcceptedAssignments(assignments, root = default
 }
 
 // src/local-observability.ts
-import { appendFile, mkdir as mkdir20, open as open12, readdir as readdir8, rename as rename12, rm as rm16, stat as stat3 } from "node:fs/promises";
+import { appendFile, mkdir as mkdir21, open as open12, readdir as readdir9, rename as rename13, rm as rm17, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename7, dirname as dirname16, join as join27 } from "node:path";
+import { basename as basename7, dirname as dirname16, join as join28 } from "node:path";
 
 // src/logger.ts
 var ANSI = {
@@ -44334,11 +44995,11 @@ var LOCAL_STATUS_FILE = "status.json";
 var LOCAL_REQUESTS_DIR = "requests";
 var DEFAULT_CONSOLE_ROTATE_BYTES = 2 * 1024 * 1024;
 function defaultLocalObservabilityRoot() {
-  return join27(homedir16(), ".zixt", "observability");
+  return join28(homedir16(), ".zixt", "observability");
 }
 function createLocalConsoleSink(options = {}) {
   const root = options.root ?? defaultLocalObservabilityRoot();
-  const consolePath = join27(root, LOCAL_CONSOLE_FILE);
+  const consolePath = join28(root, LOCAL_CONSOLE_FILE);
   const rotateBytes = options.rotateBytes ?? DEFAULT_CONSOLE_ROTATE_BYTES;
   let disabled = false;
   let prepared = false;
@@ -44348,7 +45009,7 @@ function createLocalConsoleSink(options = {}) {
     if (disabled) return;
     try {
       if (!prepared) {
-        await mkdir20(root, { recursive: true, mode: 448 });
+        await mkdir21(root, { recursive: true, mode: 448 });
         approximateBytes = await stat3(consolePath).then(
           (existing) => existing.size,
           () => 0
@@ -44356,8 +45017,8 @@ function createLocalConsoleSink(options = {}) {
         prepared = true;
       }
       if (approximateBytes >= rotateBytes) {
-        await rm16(join27(root, LOCAL_CONSOLE_PREVIOUS_FILE), { force: true });
-        await rename12(consolePath, join27(root, LOCAL_CONSOLE_PREVIOUS_FILE)).catch(
+        await rm17(join28(root, LOCAL_CONSOLE_PREVIOUS_FILE), { force: true });
+        await rename13(consolePath, join28(root, LOCAL_CONSOLE_PREVIOUS_FILE)).catch(
           (error52) => {
             if (error52.code !== "ENOENT") throw error52;
           }
@@ -44388,11 +45049,11 @@ function createLocalConsoleSink(options = {}) {
   };
 }
 async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot()) {
-  const directory = join27(root, LOCAL_REQUESTS_DIR);
+  const directory = join28(root, LOCAL_REQUESTS_DIR);
   const requested = /* @__PURE__ */ new Set();
   let names;
   try {
-    names = await readdir8(directory);
+    names = await readdir9(directory);
   } catch {
     return requested;
   }
@@ -44400,7 +45061,7 @@ async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot
     const name = `install-runner-${type}.json`;
     if (!names.includes(name)) continue;
     try {
-      await rm16(join27(directory, name), { force: true });
+      await rm17(join28(directory, name), { force: true });
       requested.add(type);
     } catch {
     }
@@ -44408,13 +45069,13 @@ async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot
   return requested;
 }
 async function writeLocalStatus(status, root = defaultLocalObservabilityRoot()) {
-  const destination = join27(root, LOCAL_STATUS_FILE);
-  const temporary = join27(
+  const destination = join28(root, LOCAL_STATUS_FILE);
+  const temporary = join28(
     dirname16(destination),
     `.${basename7(destination)}.${process.pid}.${crypto.randomUUID()}.tmp`
   );
   try {
-    await mkdir20(root, { recursive: true, mode: 448 });
+    await mkdir21(root, { recursive: true, mode: 448 });
     const handle = await open12(temporary, "wx", 384);
     try {
       await handle.writeFile(`${JSON.stringify(status)}
@@ -44422,14 +45083,14 @@ async function writeLocalStatus(status, root = defaultLocalObservabilityRoot())
     } finally {
       await handle.close();
     }
-    await rename12(temporary, destination);
+    await rename13(temporary, destination);
   } catch {
-    await rm16(temporary, { force: true }).catch(() => void 0);
+    await rm17(temporary, { force: true }).catch(() => void 0);
   }
 }
 
 // src/demo-state.ts
-import { isAbsolute as isAbsolute19, join as join28, parse as parse3, resolve as resolve18 } from "node:path";
+import { isAbsolute as isAbsolute19, join as join29, parse as parse3, resolve as resolve18 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
@@ -44439,14 +45100,14 @@ function resolveDemoHostStatePaths(env = process.env) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
   return {
-    runRegistryRoot: join28(root, "run-registry"),
-    terminalOutcomeRoot: join28(root, "terminal-outcomes"),
-    acceptedAssignmentRoot: join28(root, "accepted-assignments"),
-    runArtifactRoot: join28(root, "run-artifacts"),
-    browserProfileRoot: join28(root, "browser-profiles"),
-    runnerWorkspaceRoot: join28(root, "workspaces"),
-    codexThreadIndexRoot: join28(root, "codex-threads"),
-    localObservabilityRoot: join28(root, "local-observability")
+    runRegistryRoot: join29(root, "run-registry"),
+    terminalOutcomeRoot: join29(root, "terminal-outcomes"),
+    acceptedAssignmentRoot: join29(root, "accepted-assignments"),
+    runArtifactRoot: join29(root, "run-artifacts"),
+    browserProfileRoot: join29(root, "browser-profiles"),
+    runnerWorkspaceRoot: join29(root, "workspaces"),
+    codexThreadIndexRoot: join29(root, "codex-threads"),
+    localObservabilityRoot: join29(root, "local-observability")
   };
 }