@zixt/host 0.0.143 → 0.0.145

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir4 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.143",
+  version: "0.0.145",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14716,8 +14716,8 @@ var ID_PREFIXES = {
   productFeedback: "pfb",
   /** One shared company fact every teammate and the Manager read (CP-1). */
   companyProfileEntry: "cpe",
-  /** A bounded, validated image of the organization's own logo (CP-3). */
-  companyLogo: "clg"
+  /** One reusable file the whole organization shares (CP-6). */
+  companyAsset: "cas"
 };
 var idPattern = (prefix) => new RegExp(`^${prefix}_[0-9a-f]{32}$`);
 function newId(prefix) {
@@ -14760,7 +14760,7 @@ var CompanyProfileEntryId = idSchema(
   ID_PREFIXES.companyProfileEntry,
   "company profile entry id"
 );
-var CompanyLogoId = idSchema(ID_PREFIXES.companyLogo, "company logo id");
+var CompanyAssetId = idSchema(ID_PREFIXES.companyAsset, "company asset id");
 var ConversationId = idSchema(ID_PREFIXES.conversation, "conversation id");
 var ConversationEventId = idSchema(ID_PREFIXES.conversationEvent, "conversation event id");
 var ManagerIntegrationActionId = idSchema(
@@ -14826,6 +14826,7 @@ var BrowserTab = external_exports.object({
   loading: external_exports.boolean()
 }).strict();
 var BROWSER_MAX_TABS = 12;
+var TeammateQuestionAttention = external_exports.enum(["browser", "answer"]);
 var BrowserSessionState = external_exports.object({
   browserSessionId: BrowserSessionId,
   taskId: TaskId,
@@ -15808,6 +15809,68 @@ var Host = external_exports.object({
   createdAt: IsoDate2
 });
 
+// ../../packages/contracts/src/company-assets.ts
+var CompanyAssetKind = external_exports.enum([
+  /** The organization's own mark, used wherever it brands something. */
+  "logo",
+  /** Any other picture: a product shot, a team photo, a diagram. */
+  "image",
+  /** A document a teammate should read or send: guidelines, a policy, a deck. */
+  "document",
+  /** Reusable prose: boilerplate, a disclaimer, a bio, a standard reply. */
+  "text",
+  /** Structured data a teammate reads: a price list, a CSV, a config. */
+  "data",
+  "other"
+]);
+var CompanyAssetSource = external_exports.enum(["person", "manager", "teammate", "research"]);
+var CompanyAssetTrust = external_exports.enum(["internal", "external"]);
+var COMPANY_ASSET_NAME_MAX = 60;
+var COMPANY_ASSET_PURPOSE_MAX = 240;
+var COMPANY_ASSET_MAX_BYTES = 5 * 1024 * 1024;
+var COMPANY_ASSET_MAX_ITEMS = 40;
+var COMPANY_ASSET_SOURCE_URL_MAX = 500;
+var CompanyAssetRef = external_exports.object({
+  id: CompanyAssetId,
+  /** Normalized handle; this is what a teammate passes to get_company_asset. */
+  name: external_exports.string().min(1).max(COMPANY_ASSET_NAME_MAX),
+  kind: CompanyAssetKind,
+  mediaType: external_exports.string().max(200).regex(/^[\w.+-]+\/[\w.+-]+$/, "invalid media type"),
+  size: external_exports.number().int().min(1).max(COMPANY_ASSET_MAX_BYTES),
+  /** One line: what it is and when to reach for it. */
+  purpose: external_exports.string().min(1).max(COMPANY_ASSET_PURPOSE_MAX)
+}).strict();
+var CompanyAsset = CompanyAssetRef.extend({
+  source: CompanyAssetSource,
+  trust: CompanyAssetTrust,
+  authorAgentId: AgentId.nullable(),
+  authorMemberId: MemberId.nullable(),
+  /** Where a researched or downloaded file came from, for the person checking. */
+  sourceUrl: external_exports.string().max(COMPANY_ASSET_SOURCE_URL_MAX).nullable(),
+  createdAt: IsoDate,
+  updatedAt: IsoDate
+}).strict();
+var CompanyAssetsView = external_exports.object({
+  assets: external_exports.array(CompanyAsset).max(COMPANY_ASSET_MAX_ITEMS),
+  /** How many more files this organization may keep before it must remove one. */
+  remaining: external_exports.number().int().min(0),
+  /** Members read the inventory; Owners and Admins write it (ORG-2). */
+  editable: external_exports.boolean()
+}).strict();
+var PutCompanyAssetRequest = external_exports.object({
+  name: external_exports.string().trim().min(1).max(COMPANY_ASSET_NAME_MAX),
+  kind: CompanyAssetKind,
+  purpose: external_exports.string().trim().min(1).max(COMPANY_ASSET_PURPOSE_MAX),
+  mediaType: CompanyAssetRef.shape.mediaType,
+  /** Base64 payload (~4/3 of the byte cap); the decoded size is enforced server-side. */
+  data: external_exports.string().min(1).max(Math.ceil(COMPANY_ASSET_MAX_BYTES / 3 * 4) + 4)
+}).strict();
+var UpdateCompanyAssetRequest = external_exports.object({
+  name: external_exports.string().trim().min(1).max(COMPANY_ASSET_NAME_MAX).optional(),
+  kind: CompanyAssetKind.optional(),
+  purpose: external_exports.string().trim().min(1).max(COMPANY_ASSET_PURPOSE_MAX).optional()
+}).strict();
+
 // ../../packages/contracts/src/company-profile.ts
 var CompanyProfileSection = external_exports.enum([
   /** What the business is and what it sells. */
@@ -15867,8 +15930,13 @@ var CompanyProfileEntry = external_exports.object({
 var CompanyProfileHeader = external_exports.object({
   /** The company's own website, as the person gave it, normalized to https. */
   websiteUrl: external_exports.string().max(COMPANY_PROFILE_SOURCE_URL_MAX).nullable(),
-  /** Verified image bytes Zixt stores itself; never a hotlink to their site. */
-  logoAssetId: CompanyLogoId.nullable(),
+  /**
+   * The Company asset (CP-6) holding the verified image bytes Zixt stores
+   * itself, never a hotlink to their site. It lives in the shared asset
+   * store rather than a collection of its own so a teammate can reach the
+   * logo the same way it reaches every other company file.
+   */
+  logoAssetId: CompanyAssetId.nullable(),
   /** Where the logo was found, shown beside it so a person can check. */
   logoSourceUrl: external_exports.string().max(COMPANY_PROFILE_SOURCE_URL_MAX).nullable()
 }).strict();
@@ -18604,6 +18672,35 @@ var AgentOp = external_exports.union([
   }),
   /** Remove a company fact that is wrong or stale, by its id. */
   external_exports.object({ kind: external_exports.literal("company.forget"), entryId: CompanyProfileEntryId }),
+  /**
+   * Resolve one shared company file by the name a teammate used (CP-6). The
+   * cloud answers with metadata only; the Host then pulls the bytes over its
+   * own authenticated HTTP channel, exactly as a chat attachment arrives, so a
+   * five-megabyte file never rides a WebSocket frame or an outbox document.
+   */
+  external_exports.object({
+    kind: external_exports.literal("asset.resolve"),
+    name: external_exports.string().min(1).max(COMPANY_ASSET_NAME_MAX)
+  }),
+  /**
+   * Keep one file the whole organization should reuse. Bytes ride the agent-op
+   * channel the way an artifact's do, bounded the same way; writing a name that
+   * already exists replaces that file rather than minting a rival.
+   */
+  external_exports.object({
+    kind: external_exports.literal("asset.put"),
+    name: external_exports.string().min(1).max(COMPANY_ASSET_NAME_MAX),
+    assetKind: CompanyAssetKind,
+    purpose: external_exports.string().min(1).max(COMPANY_ASSET_PURPOSE_MAX),
+    mediaType: external_exports.string().max(200).regex(/^[\w.+-]+\/[\w.+-]+$/),
+    size: external_exports.number().int().min(1).max(COMPANY_ASSET_MAX_BYTES),
+    data: external_exports.string().min(1).max(Math.ceil(COMPANY_ASSET_MAX_BYTES / 3 * 4) + 4)
+  }),
+  /** Remove a shared company file that is out of date, by name. */
+  external_exports.object({
+    kind: external_exports.literal("asset.forget"),
+    name: external_exports.string().min(1).max(COMPANY_ASSET_NAME_MAX)
+  }),
   /** The teammate's working-folder registry with per-Machine availability. */
   external_exports.object({ kind: external_exports.literal("workspace.list") }),
   /**
@@ -20039,6 +20136,13 @@ var ConversationEventProjection = external_exports.discriminatedUnion("kind", [
       role: external_exports.enum(["member", "teammate"]),
       displayName: external_exports.string().nullable()
     }).strict().nullable().optional(),
+    /**
+     * The pending ask a `question` event mirrors, so the Conversation can
+     * offer the answer where the question was relayed instead of making a
+     * person leave for the Task page to type one sentence (MG-5). Null once
+     * the ask is decided or withheld, and absent on legacy rows.
+     */
+    questionApprovalId: ApprovalId.nullable().optional(),
     /**
      * Opaque presentation key shared by the useful report and its synthetic
      * terminal wake-up. It is never shown to people; clients use it only to
@@ -20433,12 +20537,13 @@ var ManagerTaskRailRepresentative = external_exports.object({
   updatedAt: external_exports.string()
 }).strict();
 var MANAGER_RAIL_WORKSTREAM_LIMIT = 10;
+var ManagerRailAttention = external_exports.enum(["none", "answer", "browser"]);
 var ManagerTaskRailWorkstream = external_exports.object({
   workstreamId: external_exports.string().min(1).max(160),
   /** The workstream's newest live Task title, already role-projected. */
   title: external_exports.string().max(1e3),
   representative: ManagerTaskRailRepresentative,
-  browserAttention: external_exports.boolean().default(false)
+  attention: ManagerRailAttention.default("none")
 }).strict();
 var ManagerTaskRailSummary = external_exports.object({
   conversationId: ConversationId,
@@ -20446,7 +20551,7 @@ var ManagerTaskRailSummary = external_exports.object({
   hasAgentMatch: external_exports.boolean(),
   hasStatusMatch: external_exports.boolean(),
   representative: ManagerTaskRailRepresentative.nullable(),
-  browserAttention: external_exports.boolean().default(false),
+  attention: ManagerRailAttention.default("none"),
   /**
    * Live workstreams this thread carries besides the one its own row
    * represents. Defaulted so a browser that outruns a deploy degrades to the
@@ -23393,7 +23498,7 @@ function runnerCommandCandidates(type, options = {}) {
   return platform === "win32" ? [join3(toolsRoot, "codex")] : [join3(toolsRoot, "bin", "codex")];
 }
 async function commandRuns(path) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     let child;
     try {
       child = spawnCli(path, ["--version"], {
@@ -23401,21 +23506,21 @@ async function commandRuns(path) {
         windowsHide: true
       });
     } catch {
-      resolve19(false);
+      resolve20(false);
       return;
     }
     const timer = setTimeout(() => {
       child.kill();
-      resolve19(false);
+      resolve20(false);
     }, 1e4);
     timer.unref?.();
     child.once("error", () => {
       clearTimeout(timer);
-      resolve19(false);
+      resolve20(false);
     });
     child.once("exit", (code) => {
       clearTimeout(timer);
-      resolve19(code === 0);
+      resolve20(code === 0);
     });
   });
 }
@@ -23621,7 +23726,7 @@ async function generateTaskTitle(instructions, runner) {
     instructions.slice(0, INSTRUCTIONS_BUDGET),
     "</task_request>"
   ].join("\n");
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const child = spawnCli(
       command,
       [
@@ -23644,7 +23749,7 @@ async function generateTaskTitle(instructions, runner) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve19(value);
+      resolve20(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -23973,11 +24078,11 @@ function createWorkerWatchdogSendDrain() {
         if (completed) return;
         completed = true;
         pending--;
-        if (pending === 0) drained.splice(0).forEach((resolve19) => resolve19());
+        if (pending === 0) drained.splice(0).forEach((resolve20) => resolve20());
       };
     },
     drain: async () => {
-      if (pending > 0) await new Promise((resolve19) => drained.push(resolve19));
+      if (pending > 0) await new Promise((resolve20) => drained.push(resolve20));
     }
   };
 }
@@ -24494,7 +24599,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
   const deadline = Date.parse(retryAt);
   if (!Number.isFinite(deadline) || signal.aborted) return false;
   if (deadline <= Date.now()) return true;
-  return await new Promise((resolve19) => {
+  return await new Promise((resolve20) => {
     let settled = false;
     let timer;
     const finish = (ready) => {
@@ -24502,7 +24607,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
       settled = true;
       if (timer) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve19(ready);
+      resolve20(ready);
     };
     const onAbort = () => finish(false);
     const schedule = () => {
@@ -24783,27 +24888,27 @@ var HostClient = class _HostClient {
     const unwindingAssignments = [...this.activeAssignments.values()];
     for (const cancel of this.cancels.values()) cancel(stopReason);
     for (const entry of this.secretGrants.values()) {
-      for (const resolve19 of entry.resolvers) resolve19({});
+      for (const resolve20 of entry.resolvers) resolve20({});
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.connectionGrants.values()) {
-      for (const resolve19 of entry.resolvers) resolve19([]);
+      for (const resolve20 of entry.resolvers) resolve20([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.providerGrants.values()) {
-      for (const resolve19 of entry.resolvers) resolve19([]);
+      for (const resolve20 of entry.resolvers) resolve20([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.integrationToolServerGrants.values()) {
-      for (const resolve19 of entry.resolvers) resolve19([]);
+      for (const resolve20 of entry.resolvers) resolve20([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const waiters of this.approvalWaiters.values()) {
-      for (const resolve19 of waiters.values()) resolve19({ approved: false, guidance: reason });
+      for (const resolve20 of waiters.values()) resolve20({ approved: false, guidance: reason });
     }
     for (const waiters of this.agentOpWaiters.values()) {
       for (const waiter of waiters.values()) {
@@ -24830,9 +24935,9 @@ var HostClient = class _HostClient {
     let drainTimer;
     const drained = await Promise.race([
       Promise.allSettled(runs).then(() => true),
-      new Promise((resolve19) => {
+      new Promise((resolve20) => {
         drainTimer = setTimeout(
-          () => resolve19(false),
+          () => resolve20(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         drainTimer.unref?.();
@@ -24985,9 +25090,9 @@ var HostClient = class _HostClient {
     let frameDrainTimer;
     const framesDrained = await Promise.race([
       frameTail.then(() => true),
-      new Promise((resolve19) => {
+      new Promise((resolve20) => {
         frameDrainTimer = setTimeout(
-          () => resolve19(false),
+          () => resolve20(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         frameDrainTimer.unref?.();
@@ -25500,17 +25605,24 @@ var HostClient = class _HostClient {
    * The /gateway WebSocket origin answers plain HTTPS too; attachment bytes
    * ride that, authenticated by the same host token as the socket (TS-15).
    */
+  /** CP-6: same channel, same token, a different Zixt-owned collection. */
+  async fetchCompanyAsset(assetId, signal) {
+    return this.fetchGatewayBytes(`/gateway/company-assets/${assetId}`, "company file", signal);
+  }
   async fetchAttachment(attachmentId, signal) {
+    return this.fetchGatewayBytes(`/gateway/attachments/${attachmentId}`, "attachment", signal);
+  }
+  async fetchGatewayBytes(pathname, label, signal) {
     const url3 = new URL(this.opts.url);
     url3.protocol = url3.protocol === "wss:" ? "https:" : "http:";
-    url3.pathname = `/gateway/attachments/${attachmentId}`;
+    url3.pathname = pathname;
     url3.search = "";
     const response = await fetch(url3, {
       headers: { authorization: `Bearer ${this.opts.token}` },
       signal
     });
     if (!response.ok) {
-      throw new Error(`attachment download failed (${response.status})`);
+      throw new Error(`${label} download failed (${response.status})`);
     }
     return new Uint8Array(await response.arrayBuffer());
   }
@@ -25565,7 +25677,7 @@ var HostClient = class _HostClient {
         const entry = this.secretGrants.get(key) ?? { resolvers: [] };
         entry.value = message.secrets;
         entry.expiresAt = expiresAt;
-        for (const resolve19 of entry.resolvers) resolve19(message.secrets);
+        for (const resolve20 of entry.resolvers) resolve20(message.secrets);
         entry.resolvers = [];
         this.secretGrants.set(key, entry);
         return;
@@ -25596,19 +25708,19 @@ var HostClient = class _HostClient {
         const entry = this.connectionGrants.get(key) ?? { resolvers: [] };
         entry.value = message.connections;
         entry.expiresAt = expiresAt;
-        for (const resolve19 of entry.resolvers) resolve19(message.connections);
+        for (const resolve20 of entry.resolvers) resolve20(message.connections);
         entry.resolvers = [];
         this.connectionGrants.set(key, entry);
         const providerEntry = this.providerGrants.get(key) ?? { resolvers: [] };
         providerEntry.value = providers;
         providerEntry.expiresAt = authorityExpiresAt;
-        for (const resolve19 of providerEntry.resolvers) resolve19(providers);
+        for (const resolve20 of providerEntry.resolvers) resolve20(providers);
         providerEntry.resolvers = [];
         this.providerGrants.set(key, providerEntry);
         const toolServerEntry = this.integrationToolServerGrants.get(key) ?? { resolvers: [] };
         const toolServers = [...message.toolServers ?? []];
         toolServerEntry.value = toolServers;
-        for (const resolve19 of toolServerEntry.resolvers) resolve19(toolServers);
+        for (const resolve20 of toolServerEntry.resolvers) resolve20(toolServers);
         toolServerEntry.resolvers = [];
         this.integrationToolServerGrants.set(key, toolServerEntry);
         return;
@@ -25747,8 +25859,8 @@ var HostClient = class _HostClient {
       return redactCredentialText(text, sensitiveSnapshot()).slice(0, maxLength);
     };
     let resolveCancelled;
-    const cancelledPromise = new Promise((resolve19) => {
-      resolveCancelled = resolve19;
+    const cancelledPromise = new Promise((resolve20) => {
+      resolveCancelled = resolve20;
     });
     const endAuthority = (reason = "cloud_cancel") => {
       if (stopReason) return;
@@ -25757,28 +25869,28 @@ var HostClient = class _HostClient {
       authorityController.abort(reason);
       const secretEntry = this.secretGrants.get(cancelKey);
       if (secretEntry) {
-        for (const resolve19 of secretEntry.resolvers) resolve19({});
+        for (const resolve20 of secretEntry.resolvers) resolve20({});
         secretEntry.resolvers = [];
         delete secretEntry.value;
       }
       this.secretGrants.delete(cancelKey);
       const connectionEntry = this.connectionGrants.get(cancelKey);
       if (connectionEntry) {
-        for (const resolve19 of connectionEntry.resolvers) resolve19([]);
+        for (const resolve20 of connectionEntry.resolvers) resolve20([]);
         connectionEntry.resolvers = [];
         delete connectionEntry.value;
       }
       this.connectionGrants.delete(cancelKey);
       const providerEntry = this.providerGrants.get(cancelKey);
       if (providerEntry) {
-        for (const resolve19 of providerEntry.resolvers) resolve19([]);
+        for (const resolve20 of providerEntry.resolvers) resolve20([]);
         providerEntry.resolvers = [];
         delete providerEntry.value;
       }
       this.providerGrants.delete(cancelKey);
       const toolServerEntry = this.integrationToolServerGrants.get(cancelKey);
       if (toolServerEntry) {
-        for (const resolve19 of toolServerEntry.resolvers) resolve19([]);
+        for (const resolve20 of toolServerEntry.resolvers) resolve20([]);
         toolServerEntry.resolvers = [];
         delete toolServerEntry.value;
       }
@@ -25786,8 +25898,8 @@ var HostClient = class _HostClient {
       this.clearAuthorityExpiry(cancelKey);
       const approvalWaiters = this.approvalWaiters.get(cancelKey);
       if (approvalWaiters) {
-        for (const resolve19 of approvalWaiters.values()) {
-          resolve19({ approved: false, guidance: "task was cancelled" });
+        for (const resolve20 of approvalWaiters.values()) {
+          resolve20({ approved: false, guidance: "task was cancelled" });
         }
         approvalWaiters.clear();
       }
@@ -25913,9 +26025,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve19) => {
-        entry.resolvers.push((value) => resolve19(capture(value)));
-        setTimeout(() => resolve19(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve20) => {
+        entry.resolvers.push((value) => resolve20(capture(value)));
+        setTimeout(() => resolve20(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const connections = () => {
@@ -25932,9 +26044,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve19) => {
-        entry.resolvers.push((value) => resolve19(capture(value)));
-        setTimeout(() => resolve19(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve20) => {
+        entry.resolvers.push((value) => resolve20(capture(value)));
+        setTimeout(() => resolve20(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const providers = () => {
@@ -25951,9 +26063,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value !== void 0) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve19) => {
-        entry.resolvers.push((value) => resolve19(capture(value)));
-        setTimeout(() => resolve19(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve20) => {
+        entry.resolvers.push((value) => resolve20(capture(value)));
+        setTimeout(() => resolve20(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const integrationToolServers = () => {
@@ -25962,9 +26074,9 @@ var HostClient = class _HostClient {
       this.integrationToolServerGrants.set(cancelKey, entry);
       const capture = (value) => authorityController.signal.aborted ? [] : value;
       if (entry.value !== void 0) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve19) => {
-        entry.resolvers.push((value) => resolve19(capture(value)));
-        setTimeout(() => resolve19(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve20) => {
+        entry.resolvers.push((value) => resolve20(capture(value)));
+        setTimeout(() => resolve20(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const linear = async () => {
@@ -25991,13 +26103,13 @@ var HostClient = class _HostClient {
         ...questionChoices ? { questionChoices: [...questionChoices] } : {},
         ...questionnaire ? { questionnaire } : {}
       });
-      return new Promise((resolve19) => {
+      return new Promise((resolve20) => {
         const waiters = this.approvalWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.approvalWaiters.set(cancelKey, waiters);
-        waiters.set(requestId, resolve19);
+        waiters.set(requestId, resolve20);
         void cancelledPromise.then(() => {
           if (waiters.delete(requestId)) {
-            resolve19({ approved: false, guidance: "task was cancelled" });
+            resolve20({ approved: false, guidance: "task was cancelled" });
           }
         });
       });
@@ -26043,11 +26155,11 @@ var HostClient = class _HostClient {
         if (existing) message = existing;
         else terminalMessages.set(requestId, message);
       }
-      return new Promise((resolve19) => {
+      return new Promise((resolve20) => {
         const waiters = this.agentOpWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.agentOpWaiters.set(cancelKey, waiters);
         if (waiters.has(requestId)) {
-          resolve19({ ok: false, error: "provider settlement request is already in flight" });
+          resolve20({ ok: false, error: "provider settlement request is already in flight" });
           return;
         }
         const timer = setTimeout(() => {
@@ -26058,7 +26170,7 @@ var HostClient = class _HostClient {
                 (pending) => !(pending.type === "agent.op" && pending.requestId === requestId)
               );
             }
-            resolve19({
+            resolve20({
               ok: false,
               error: terminal ? "The provider call completed, but Zixt could not record its outcome. Do not retry; wait for reconciliation." : "the platform did not answer in time; verify with a list_* tool before retrying a mutating call"
             });
@@ -26066,7 +26178,7 @@ var HostClient = class _HostClient {
         }, _HostClient.AGENT_OP_TIMEOUT_MS);
         timer.unref?.();
         waiters.set(requestId, {
-          resolve: resolve19,
+          resolve: resolve20,
           timer,
           ...terminal ? { terminalMessage: message } : {}
         });
@@ -26112,12 +26224,12 @@ var HostClient = class _HostClient {
             "No GitHub change was attempted; the authority grant request was invalid."
           );
         }
-        const outcome = await new Promise((resolve19) => {
+        const outcome = await new Promise((resolve20) => {
           const timer = setTimeout(() => {
             const waiter = this.operationGrantWaiters.get(requestId);
             if (!waiter) return;
             this.operationGrantWaiters.delete(requestId);
-            resolve19({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
+            resolve20({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
           }, this.operationGrantTimeoutMs);
           timer.unref?.();
           this.operationGrantWaiters.set(requestId, {
@@ -26130,9 +26242,9 @@ var HostClient = class _HostClient {
             timer,
             accept: (grant) => {
               addSensitiveValues(providerGrantSensitiveValues(grant));
-              resolve19({ grant });
+              resolve20({ grant });
             },
-            deny: (retryable, reason, detail, retryAt, retryCode) => resolve19({
+            deny: (retryable, reason, detail, retryAt, retryCode) => resolve20({
               grant: null,
               retryable,
               reason,
@@ -26146,7 +26258,7 @@ var HostClient = class _HostClient {
           } catch {
             clearTimeout(timer);
             this.operationGrantWaiters.delete(requestId);
-            resolve19({ grant: null, retryable: false, reason: "connection_unavailable" });
+            resolve20({ grant: null, retryable: false, reason: "connection_unavailable" });
           }
         });
         if (outcome.grant) {
@@ -26202,7 +26314,7 @@ var HostClient = class _HostClient {
           )
         );
       }
-      return new Promise((resolve19, reject3) => {
+      return new Promise((resolve20, reject3) => {
         const timer = setTimeout(() => {
           if (this.browserCredentialWaiters.delete(requestId)) {
             reject3(
@@ -26221,7 +26333,7 @@ var HostClient = class _HostClient {
           timer,
           accept: (credential) => {
             addSensitiveValues(webLoginSensitiveValues(credential));
-            resolve19(credential);
+            resolve20(credential);
           },
           deny: (reason) => reject3(new Error(reason))
         });
@@ -26249,6 +26361,7 @@ var HostClient = class _HostClient {
         runnerRuntime: emitRunnerRuntime,
         siblingTasks: () => [...this.liveTasks.values()].filter((live) => live.agentId === assign.agentId && live.taskId !== assign.taskId).map(({ taskId, title }) => ({ taskId, title })),
         fetchAttachment: (attachmentId) => this.fetchAttachment(attachmentId, authorityController.signal),
+        fetchCompanyAsset: (assetId) => this.fetchCompanyAsset(assetId, authorityController.signal),
         followUps: (handler5) => {
           if (cancelled) return () => {
           };
@@ -26547,14 +26660,14 @@ async function observeWindowsGuardianNonce(pid, nonce) {
       "Windows runner identity could not be observed"
     );
   }
-  return new Promise((resolve19, reject3) => {
+  return new Promise((resolve20, reject3) => {
     let done = false;
     const finish = (result) => {
       if (done) return;
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve19(result);
+      else resolve20(result);
     };
     const timeout = setTimeout(
       () => finish(
@@ -26599,7 +26712,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       );
     }
   }
-  return new Promise((resolve19, reject3) => {
+  return new Promise((resolve20, reject3) => {
     const observer = spawn3("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -26610,7 +26723,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve19(result);
+      else resolve20(result);
     };
     const timeout = setTimeout(() => {
       observer.kill("SIGKILL");
@@ -26657,7 +26770,7 @@ async function observeGuardianIdentity(pid, identity) {
   return process.platform === "win32" ? observeWindowsGuardianNonce(pid, identity.nonce) : observePosixGuardianNonce(pid, identity.nonce);
 }
 function delay(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 function posixProcessRecordsFromPs(output) {
   const records = [];
@@ -26690,7 +26803,7 @@ function posixProcessRecordsFromPs(output) {
   return records;
 }
 async function snapshotPosixProcesses() {
-  return new Promise((resolve19, reject3) => {
+  return new Promise((resolve20, reject3) => {
     const observer = spawn3("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -26703,7 +26816,7 @@ async function snapshotPosixProcesses() {
       if (error52) reject3(error52);
       else {
         try {
-          resolve19(posixProcessRecordsFromPs(output));
+          resolve20(posixProcessRecordsFromPs(output));
         } catch (caught) {
           reject3(caught);
         }
@@ -27038,7 +27151,7 @@ async function snapshotWindowsDescendants(rootPid) {
       "Windows process-tree observation could not start"
     );
   }
-  return new Promise((resolve19, reject3) => {
+  return new Promise((resolve20, reject3) => {
     let done = false;
     const timeout = setTimeout(() => {
       if (done) return;
@@ -27065,7 +27178,7 @@ async function snapshotWindowsDescendants(rootPid) {
         return;
       }
       try {
-        resolve19(completeWindowsDescendantPids(rootPid, processes));
+        resolve20(completeWindowsDescendantPids(rootPid, processes));
       } catch (caught) {
         reject3(caught);
       }
@@ -27112,7 +27225,7 @@ async function waitForProcessesExit(pids, timeoutMs) {
 }
 async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, independentlyTrackedPids = []) {
   const trustedCommand = command ?? defaultTaskkillCommand();
-  const result = await new Promise((resolve19, reject3) => {
+  const result = await new Promise((resolve20, reject3) => {
     const killer = spawn3(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -27147,7 +27260,7 @@ async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, indepe
       done = true;
       clearTimeout(timeout);
       if (error52) reject3(error52);
-      else resolve19({ code: killer.exitCode, output, outputTruncated });
+      else resolve20({ code: killer.exitCode, output, outputTruncated });
     };
     killer.once(
       "error",
@@ -27951,12 +28064,12 @@ async function createWindowsJobContainment(pid, options) {
     stderr = `${stderr}${String(chunk)}`.slice(-HELPER_OUTPUT_LIMIT);
   });
   const helperEvents = helper;
-  const exited = new Promise((resolve19) => {
+  const exited = new Promise((resolve20) => {
     let completed = false;
     const complete = (code, signal) => {
       if (completed) return;
       completed = true;
-      resolve19({ code, signal });
+      resolve20({ code, signal });
     };
     helperEvents.once("error", () => {
       failProtocol(new Error("Windows Job Object helper could not start"));
@@ -27969,7 +28082,7 @@ async function createWindowsJobContainment(pid, options) {
   });
   const nextLine = async (expected) => {
     if (protocolFailure) throw protocolFailure;
-    const line = lines.shift() ?? await new Promise((resolve19, reject3) => {
+    const line = lines.shift() ?? await new Promise((resolve20, reject3) => {
       const timer = setTimeout(
         () => reject3(timeoutError("Windows Job Object helper did not answer in time")),
         timeoutMs
@@ -27977,7 +28090,7 @@ async function createWindowsJobContainment(pid, options) {
       timer.unref?.();
       lineWaiters.push((value) => {
         clearTimeout(timer);
-        resolve19(value);
+        resolve20(value);
       });
     });
     if (protocolFailure) throw protocolFailure;
@@ -27990,8 +28103,8 @@ async function createWindowsJobContainment(pid, options) {
     }
     const stopped = await Promise.race([
       exited.then(() => true),
-      new Promise((resolve19) => {
-        const timer = setTimeout(() => resolve19(false), timeoutMs);
+      new Promise((resolve20) => {
+        const timer = setTimeout(() => resolve20(false), timeoutMs);
         timer.unref?.();
       })
     ]);
@@ -28050,7 +28163,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
   if (nonce === void 0) return true;
   if (!SAFE_NONCE2.test(nonce)) return false;
   const expected = windowsContainmentGate(nonce).trimEnd();
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     let pending = Buffer.alloc(0);
     let settled = false;
     const finish = (result) => {
@@ -28061,7 +28174,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       input.off("end", onEnd);
       input.off("error", onEnd);
       if (result) input.pause();
-      resolve19(result);
+      resolve20(result);
     };
     const onData = (chunk) => {
       pending = Buffer.concat([pending, chunk]);
@@ -29165,7 +29278,7 @@ async function installRelease(version2, options = {}) {
   }) : Promise.resolve(null);
   const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS2;
   const outcome = { code: null, signal: null, timedOut: false, spawnError: null };
-  const installed = await new Promise((resolve19, reject3) => {
+  const installed = await new Promise((resolve20, reject3) => {
     let finished = false;
     let cleanupStarted = false;
     let exitObserved = false;
@@ -29181,7 +29294,7 @@ async function installRelease(version2, options = {}) {
       finished = true;
       clearTimeout(timer);
       options.signal?.removeEventListener("abort", requestCleanup);
-      resolve19(result);
+      resolve20(result);
     };
     const requestCleanup = () => {
       if (cleanupStarted || finished) return;
@@ -29546,11 +29659,11 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   child.stdin?.on("error", () => {
   });
   process.stdin.pipe(child.stdin);
-  return new Promise((resolve19) => {
-    child.once("error", () => resolve19(1));
+  return new Promise((resolve20) => {
+    child.once("error", () => resolve20(1));
     child.once("exit", (code) => {
       process.stdin.unpipe(child.stdin);
-      resolve19(code ?? 1);
+      resolve20(code ?? 1);
     });
   });
 }
@@ -29630,11 +29743,11 @@ async function launchHostSupervisor(options = {}) {
   const waitOrStop = async (ms) => {
     if (stopping) return false;
     if (!customDelay) {
-      await new Promise((resolve19) => {
+      await new Promise((resolve20) => {
         const finish = () => {
           clearTimeout(timer);
           stopController.signal.removeEventListener("abort", finish);
-          resolve19();
+          resolve20();
         };
         const timer = setTimeout(finish, ms);
         stopController.signal.addEventListener("abort", finish, { once: true });
@@ -29642,8 +29755,8 @@ async function launchHostSupervisor(options = {}) {
       return !stopping;
     }
     let finishStop;
-    const stopped = new Promise((resolve19) => {
-      finishStop = () => resolve19();
+    const stopped = new Promise((resolve20) => {
+      finishStop = () => resolve20();
       stopController.signal.addEventListener("abort", finishStop, { once: true });
     });
     await Promise.race([customDelay(ms), stopped]);
@@ -29773,19 +29886,19 @@ async function launchHostSupervisor(options = {}) {
       child = spawnSupervisor(entry, version2, ownershipDirectory, containmentGateNonce);
       const launchedSupervisor = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve19) => {
-        resolveChildExited = resolve19;
+      const childExited = new Promise((resolve20) => {
+        resolveChildExited = resolve20;
       });
       const supervisorContainmentAbort = new AbortController();
       void childExited.then(() => supervisorContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve19) => {
+        (resolve20) => {
           let observed = false;
           const finish = (code, signal) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve19({ code, signal });
+            resolve20({ code, signal });
           };
           child.once("error", () => finish(1, null));
           child.once("exit", finish);
@@ -29806,12 +29919,12 @@ async function launchHostSupervisor(options = {}) {
           if (!supervisorContainment || !launchedSupervisor.stdin) {
             throw new Error("supervisor Job Object gate is unavailable");
           }
-          await new Promise((resolve19, reject3) => {
+          await new Promise((resolve20, reject3) => {
             launchedSupervisor.stdin.write(
               windowsContainmentGate(containmentGateNonce),
               (error52) => {
                 if (error52) reject3(error52);
-                else resolve19();
+                else resolve20();
               }
             );
           });
@@ -29959,19 +30072,19 @@ async function superviseHost(options = {}) {
     }
   }
   let announceShutdown;
-  const shutdownAnnounced = new Promise((resolve19) => {
-    announceShutdown = resolve19;
+  const shutdownAnnounced = new Promise((resolve20) => {
+    announceShutdown = resolve20;
   });
   const attempted = /* @__PURE__ */ new Set();
   let unsatisfiableUpdates = 0;
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
-      await new Promise((resolve19) => {
+      await new Promise((resolve20) => {
         const finish = () => {
           clearTimeout(timer);
           shutdownController.signal.removeEventListener("abort", finish);
-          resolve19();
+          resolve20();
         };
         const timer = setTimeout(finish, ms);
         shutdownController.signal.addEventListener("abort", finish, { once: true });
@@ -30121,19 +30234,19 @@ async function superviseHost(options = {}) {
       const watchedChild = child;
       const workerStderr = captureWorkerStderr(watchedChild);
       let resolveChildExited;
-      const childExited = new Promise((resolve19) => {
-        resolveChildExited = resolve19;
+      const childExited = new Promise((resolve20) => {
+        resolveChildExited = resolve20;
       });
       const workerContainmentAbort = new AbortController();
       void childExited.then(() => workerContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve19) => {
+        (resolve20) => {
           let observed = false;
           const finish = (result) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve19(result);
+            resolve20(result);
           };
           watchedChild.once("error", () => finish({ code: 1, signal: null }));
           watchedChild.once(
@@ -30155,10 +30268,10 @@ async function superviseHost(options = {}) {
           if (!workerContainment || !watchedChild.stdin) {
             throw new Error("worker Job Object gate is unavailable");
           }
-          await new Promise((resolve19, reject3) => {
+          await new Promise((resolve20, reject3) => {
             watchedChild.stdin.write(windowsContainmentGate(containmentGateNonce), (error52) => {
               if (error52) reject3(error52);
-              else resolve19();
+              else resolve20();
             });
           });
         }
@@ -31336,7 +31449,7 @@ async function loadPlaywright() {
 }
 async function installChromium() {
   const cliPath = join12(playwrightCoreRoot, "cli.js");
-  await new Promise((resolve19, reject3) => {
+  await new Promise((resolve20, reject3) => {
     const child = spawn7(process.execPath, [cliPath, "install", "chromium"], {
       env: process.env,
       stdio: ["ignore", "inherit", "inherit"],
@@ -31351,7 +31464,7 @@ async function installChromium() {
       settled = true;
       clearTimeout(timeout);
       if (error52) reject3(error52);
-      else resolve19();
+      else resolve20();
     };
     const timeout = setTimeout(() => {
       child.kill();
@@ -31971,9 +32084,9 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
 // src/runners/cli-runner.ts
 import { spawn as spawn11 } from "node:child_process";
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { lstat as lstat11, mkdir as mkdir13, realpath as realpath8 } from "node:fs/promises";
+import { lstat as lstat11, mkdir as mkdir14, realpath as realpath8 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname10, isAbsolute as isAbsolute16, join as join19, resolve as resolve10 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute17, join as join20, resolve as resolve11 } from "node:path";
 
 // src/tool-packs/browser/authentication-wall.ts
 var AUTH_PATH_SEGMENT = /(?:^|\/)(?:log[-_]?in|sign[-_]?in|sso|saml|auth|authorize|authenticate|oauth2?|session\/new|checkpoint)(?:\/|$)/i;
@@ -35155,8 +35268,8 @@ async function runGit(input, args, env) {
     let settled = false;
     let stopping = false;
     let resolveExited;
-    const exited = new Promise((resolve19) => {
-      resolveExited = resolve19;
+    const exited = new Promise((resolve20) => {
+      resolveExited = resolve20;
     });
     child.once("exit", resolveExited);
     const cleanup = () => {
@@ -37966,8 +38079,8 @@ var linearToolPackFactory = {
   async create(grant, context) {
     let resolveCancelled;
     let closed = false;
-    const cancelled = new Promise((resolve19) => {
-      resolveCancelled = resolve19;
+    const cancelled = new Promise((resolve20) => {
+      resolveCancelled = resolve20;
     });
     const cancel = () => {
       if (closed) return;
@@ -39188,6 +39301,47 @@ var TOOLS = [
       required: ["agent_id"]
     }
   },
+  {
+    name: "get_company_asset",
+    description: "Download one of the shared company files into your working folder and get back its path, so you can read or use it like any other file. Ask for it by the name shown in the company files list - the logo, the brand guidelines, a price list. Use this instead of describing or recreating something the company already has.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "The company file name." }
+      },
+      required: ["name"]
+    }
+  },
+  {
+    name: "put_company_asset",
+    description: "Keep a file from your working folder as a shared company file, so every teammate can use it later. Use it for something the whole company should reuse, not for this task working output. Writing a name that already exists replaces that file.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Short name teammates will ask for it by." },
+        path: { type: "string", description: "Path to the file in your working folder." },
+        kind: {
+          type: "string",
+          enum: ["logo", "image", "document", "text", "data", "other"],
+          description: "What sort of file this is."
+        },
+        purpose: {
+          type: "string",
+          description: "One line: what it is and when a teammate should reach for it."
+        }
+      },
+      required: ["name", "path", "kind", "purpose"]
+    }
+  },
+  {
+    name: "forget_company_asset",
+    description: "Remove a shared company file that is out of date or was never right, by its name.",
+    inputSchema: {
+      type: "object",
+      properties: { name: { type: "string", description: "The company file name." } },
+      required: ["name"]
+    }
+  },
   {
     name: "note_company_fact",
     description: "Keep one short fact about the organization you work for in the shared company profile, which every teammate and the manager read on every task: what the business does, who it serves, how customers reach it, how it operates, how it sounds, or who it competes with. Use it when you learn something durable about the business itself, and to correct a fact that is wrong - writing the same section and subject again replaces the earlier text. This is not your own memory: use remember for what you learned about a project or this machine, and this for what is true about the company.",
@@ -39579,6 +39733,8 @@ function opFor(name, args) {
     }
     case "forget_company_fact":
       return { kind: "company.forget", entryId: str("entry_id") };
+    case "forget_company_asset":
+      return { kind: "asset.forget", name: str("name") };
     case "list_workspaces":
       return { kind: "workspace.list" };
     case "add_workspace":
@@ -39680,7 +39836,7 @@ function createAskUserServer() {
   let server;
   let listening;
   function ensureListening() {
-    listening ??= new Promise((resolve19, reject3) => {
+    listening ??= new Promise((resolve20, reject3) => {
       server = createServer2((req, res) => {
         res.on("error", () => {
         });
@@ -39696,7 +39852,7 @@ function createAskUserServer() {
       server.on("error", reject3);
       server.listen(0, "127.0.0.1", () => {
         const address = server.address();
-        if (address && typeof address === "object") resolve19(address.port);
+        if (address && typeof address === "object") resolve20(address.port);
         else reject3(new Error("ask_user server failed to bind"));
       });
       server.unref();
@@ -39883,6 +40039,34 @@ function createAskUserServer() {
           }
           return;
         }
+        if (surface.platform && (name === "get_company_asset" || name === "put_company_asset")) {
+          const companyAssets = handlers.companyAssets;
+          if (!companyAssets) {
+            toolText("company files are unavailable for this runner", true);
+            return;
+          }
+          const assetName = typeof args["name"] === "string" ? args["name"] : "";
+          if (!assetName) {
+            toolText("missing required argument `name`", true);
+            return;
+          }
+          try {
+            const outcome = name === "get_company_asset" ? await companyAssets.get(assetName) : await companyAssets.put({
+              name: assetName,
+              path: typeof args["path"] === "string" ? args["path"] : "",
+              kind: typeof args["kind"] === "string" ? args["kind"] : "other",
+              purpose: typeof args["purpose"] === "string" ? args["purpose"] : ""
+            });
+            if (outcome.ok) toolText(JSON.stringify(outcome.result ?? { ok: true }, null, 2));
+            else toolText(outcome.error ?? "the company file could not be used", true);
+          } catch (err) {
+            toolText(
+              `the company file could not be used: ${String(err instanceof Error ? err.message : err)}`,
+              true
+            );
+          }
+          return;
+        }
         if (surface.platform && name === "publish_file") {
           if (!handlers.publishFile) {
             toolText("file publishing is unavailable for this runner", true);
@@ -40077,8 +40261,137 @@ function createAskUserServer() {
   };
 }
 
+// src/runners/company-assets.ts
+import { mkdir as mkdir12, readFile as readFile11, writeFile as writeFile8 } from "node:fs/promises";
+import { isAbsolute as isAbsolute14, join as join18, resolve as resolve9 } from "node:path";
+var MAX_PUT_BYTES = 5 * 1024 * 1024;
+function parseRef(result) {
+  if (!result || typeof result !== "object") return null;
+  const asset = result.asset;
+  if (!asset || typeof asset !== "object") return null;
+  const candidate = asset;
+  if (typeof candidate["id"] !== "string" || typeof candidate["name"] !== "string" || typeof candidate["mediaType"] !== "string" || typeof candidate["size"] !== "number" || typeof candidate["kind"] !== "string" || typeof candidate["purpose"] !== "string") {
+    return null;
+  }
+  return candidate;
+}
+function extensionFor(mediaType) {
+  const known = {
+    "image/svg+xml": ".svg",
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/webp": ".webp",
+    "image/gif": ".gif",
+    "application/pdf": ".pdf",
+    "text/plain": ".txt",
+    "text/markdown": ".md",
+    "text/csv": ".csv",
+    "application/json": ".json"
+  };
+  return known[mediaType.toLowerCase()] ?? "";
+}
+function createCompanyAssetHandlers(io) {
+  return {
+    async get(name) {
+      const resolved = await io.agentOp({ kind: "asset.resolve", name });
+      if (!resolved.ok) {
+        return { ok: false, error: resolved.error ?? `no company file named "${name}"` };
+      }
+      const ref2 = parseRef(resolved.result);
+      if (!ref2) return { ok: false, error: "the company file could not be identified" };
+      const bytes = await io.fetchCompanyAsset(ref2.id);
+      if (bytes.byteLength !== ref2.size) {
+        return {
+          ok: false,
+          error: `the company file "${ref2.name}" arrived incomplete (${bytes.byteLength} of ${ref2.size} bytes)`
+        };
+      }
+      const directory = join18(io.taskRoot, ".zixt-company-files", ref2.id);
+      await mkdir12(directory, { recursive: true });
+      const base = sanitizeAttachmentFileName(ref2.name) || "file";
+      const fileName = base.includes(".") ? base : `${base}${extensionFor(ref2.mediaType)}`;
+      const path = join18(directory, fileName);
+      await writeFile8(path, bytes);
+      return {
+        ok: true,
+        result: {
+          path,
+          name: ref2.name,
+          kind: ref2.kind,
+          mediaType: ref2.mediaType,
+          size: ref2.size,
+          purpose: ref2.purpose
+        }
+      };
+    },
+    async put(input) {
+      if (!input.path) return { ok: false, error: "missing required argument `path`" };
+      if (!input.purpose) {
+        return { ok: false, error: "say in one line what this file is for" };
+      }
+      const candidate = isAbsolute14(input.path) ? input.path : resolve9(io.cwd, input.path);
+      const permitted = io.allowedRoots.some((root) => {
+        const normalized = resolve9(root);
+        return candidate === normalized || candidate.startsWith(`${normalized}${sep6()}`);
+      });
+      if (!permitted) {
+        return { ok: false, error: "that file is outside the folders this task may read" };
+      }
+      let bytes;
+      try {
+        bytes = new Uint8Array(await readFile11(candidate));
+      } catch {
+        return { ok: false, error: `the file at ${input.path} could not be read` };
+      }
+      if (bytes.byteLength === 0) return { ok: false, error: "that file is empty" };
+      if (bytes.byteLength > MAX_PUT_BYTES) {
+        return { ok: false, error: "that file is too large to keep as a company file" };
+      }
+      const outcome = await io.agentOp({
+        kind: "asset.put",
+        name: input.name,
+        assetKind: assetKindOf(input.kind),
+        purpose: input.purpose,
+        mediaType: mediaTypeFor(candidate),
+        size: bytes.byteLength,
+        data: Buffer.from(bytes).toString("base64")
+      });
+      if (!outcome.ok) {
+        return { ok: false, error: outcome.error ?? "the company file could not be kept" };
+      }
+      return { ok: true, result: outcome.result ?? { ok: true } };
+    }
+  };
+}
+function sep6() {
+  return process.platform === "win32" ? "\\" : "/";
+}
+function assetKindOf(kind) {
+  return kind === "logo" || kind === "image" || kind === "document" || kind === "text" || kind === "data" ? kind : "other";
+}
+function mediaTypeFor(path) {
+  const lower = path.toLowerCase();
+  const byExtension = [
+    [".svg", "image/svg+xml"],
+    [".png", "image/png"],
+    [".jpg", "image/jpeg"],
+    [".jpeg", "image/jpeg"],
+    [".webp", "image/webp"],
+    [".gif", "image/gif"],
+    [".pdf", "application/pdf"],
+    [".md", "text/markdown"],
+    [".txt", "text/plain"],
+    [".csv", "text/csv"],
+    [".json", "application/json"]
+  ];
+  for (const [extension, mediaType] of byExtension) {
+    if (lower.endsWith(extension)) return mediaType;
+  }
+  return "application/octet-stream";
+}
+
 // src/runners/runner-env.ts
-import { delimiter as delimiter2, isAbsolute as isAbsolute14 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute15 } from "node:path";
 var PROVIDER_AUTHORITY_PREFIXES = ["GH_", "GITHUB_", "GIT_", "SSH_"];
 var HOST_AUTHORITY_PREFIXES = [
   "ZIXT_",
@@ -40137,7 +40450,7 @@ function inheritedValue(env, name) {
 }
 function sanitizeInheritedSearchPath(path) {
   if (!path) return "";
-  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute14(entry)).join(delimiter2);
+  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute15(entry)).join(delimiter2);
 }
 function buildRunnerEnv(input) {
   const env = {};
@@ -40153,7 +40466,7 @@ function buildRunnerEnv(input) {
   }
   const searchPath = [
     sanitizeInheritedSearchPath(inheritedValue(input.inherited, "PATH")),
-    ...(input.softwareToolsPath ?? []).filter((entry) => isAbsolute14(entry))
+    ...(input.softwareToolsPath ?? []).filter((entry) => isAbsolute15(entry))
   ].filter((entry) => entry !== "").join(delimiter2);
   const gitConfig = input.githubShell ? [
     ["credential.helper", ""],
@@ -40221,9 +40534,9 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod7, lstat as lstat10, mkdir as mkdir12, realpath as realpath7, writeFile as writeFile8 } from "node:fs/promises";
+import { chmod as chmod7, lstat as lstat10, mkdir as mkdir13, realpath as realpath7, writeFile as writeFile9 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { isAbsolute as isAbsolute15, join as join18, relative as relative9 } from "node:path";
+import { isAbsolute as isAbsolute16, join as join19, relative as relative9 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
 var DIRECTORY_MODE4 = 448;
 var PRIVATE_FILE_MODE = 384;
@@ -40429,7 +40742,7 @@ function parseGhInvocation(body) {
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const { args, cwd } = value;
-  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute15(cwd)) {
+  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute16(cwd)) {
     return null;
   }
   return { args, cwd };
@@ -40588,7 +40901,7 @@ function activationCredential(grant, now = Date.now()) {
 }
 function assertChildPath2(parent, child) {
   const path = relative9(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute15(path)) {
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute16(path)) {
     throw new Error("GitHub shell helper path escaped its private run directory");
   }
 }
@@ -40599,7 +40912,7 @@ function quoteForPosixShell(value) {
   return quoteForGitShell2(value);
 }
 async function writePrivate(path, content, executable = false) {
-  await writeFile8(path, content, {
+  await writeFile9(path, content, {
     flag: "wx",
     mode: executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE
   });
@@ -40611,7 +40924,7 @@ async function prepareHelpers(input) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
   const runRoot = await realpath7(input.runRoot);
-  const helperPath = join18(runRoot, "github-shell-git-credential.cjs");
+  const helperPath = join19(runRoot, "github-shell-git-credential.cjs");
   assertChildPath2(runRoot, helperPath);
   await writePrivate(helperPath, GIT_HELPER_SOURCE);
   if (!input.ghExecutablePath) {
@@ -40622,14 +40935,14 @@ async function prepareHelpers(input) {
       wrapperSourcePath: null
     };
   }
-  const shellToolsDirectory = join18(runRoot, "shell-tools");
+  const shellToolsDirectory = join19(runRoot, "shell-tools");
   assertChildPath2(runRoot, shellToolsDirectory);
-  await mkdir12(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
+  await mkdir13(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
   await chmod7(shellToolsDirectory, DIRECTORY_MODE4);
-  const wrapperSourcePath = join18(runRoot, "github-shell-gh-wrapper.cjs");
+  const wrapperSourcePath = join19(runRoot, "github-shell-gh-wrapper.cjs");
   assertChildPath2(runRoot, wrapperSourcePath);
   await writePrivate(wrapperSourcePath, GH_WRAPPER_SOURCE);
-  const wrapperPath = join18(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
+  const wrapperPath = join19(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
   assertChildPath2(runRoot, wrapperPath);
   const launcher = process.platform === "win32" ? `@"${process.execPath.replaceAll('"', '""')}" "${wrapperSourcePath.replaceAll('"', '""')}" %*\r
 ` : `#!/bin/sh
@@ -40853,7 +41166,7 @@ password=${credential.accessToken}
 
 // src/runners/working-context.ts
 import { spawn as spawn10 } from "node:child_process";
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
 var COMMAND_STOP_TIMEOUT_MS = 2e4;
@@ -41248,8 +41561,8 @@ async function repositoryState(directory, git, env, signal) {
   const pathLines = paths.trim().split(/\r?\n/);
   if (pathLines.length < 3 || !pathLines[0] || !pathLines[1] || !pathLines[2]) return null;
   const root = pathLines[0];
-  const gitDirectory = resolve9(directory, pathLines[1]);
-  const commonDirectory = resolve9(directory, pathLines[2]);
+  const gitDirectory = resolve10(directory, pathLines[1]);
+  const commonDirectory = resolve10(directory, pathLines[2]);
   const records = status.split(/\0|\r?\n/).filter(Boolean);
   const rawBranch = statusField(records, "branch.head");
   if (!rawBranch || rawBranch.length > 512 || !isSafeSingleLineDisplayText(rawBranch)) return null;
@@ -41424,7 +41737,7 @@ async function settlesWithin(promise2, timeoutMs) {
   }
 }
 function defaultRunnerWorkspaceRoot() {
-  return join19(homedir7(), ".zixt", "workspaces");
+  return join20(homedir7(), ".zixt", "workspaces");
 }
 function defaultRunnerArtifactRoot() {
   return defaultRunArtifactRoot();
@@ -41473,7 +41786,7 @@ function createCliRunner(adapter, opts = {}) {
   const prefixArgs = opts.commandPrefixArgs ?? [];
   const maxWallTimeMs = opts.maxWallTimeMs;
   const workspaceRoot = opts.workspaceRoot ?? defaultRunnerWorkspaceRoot();
-  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join19(dirname10(workspaceRoot), "run-artifacts"));
+  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join20(dirname10(workspaceRoot), "run-artifacts"));
   const runRegistryRoot2 = opts.runRegistryRoot ?? defaultRunRegistryRoot();
   const createArtifacts = opts.createArtifacts ?? createRunArtifacts;
   const toolPackRegistry2 = opts.toolPackRegistry ?? createDefaultToolPackRegistry();
@@ -41491,7 +41804,7 @@ function createCliRunner(adapter, opts = {}) {
   };
   const askUserServer = createAskUserServer();
   const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join19(windowsRoot, "System32", "cmd.exe") : void 0;
+  const windowsComspecCandidate = process.platform === "win32" && windowsRoot ? join20(windowsRoot, "System32", "cmd.exe") : void 0;
   let safetyFailure;
   return async (task) => {
     if (safetyFailure) {
@@ -41531,8 +41844,8 @@ function createCliRunner(adapter, opts = {}) {
         usage: { inputTokens: 0, outputTokens: 0 }
       };
     }
-    const taskRoot = join19(workspaceRoot, task.agentId);
-    await mkdir13(taskRoot, { recursive: true });
+    const taskRoot = join20(workspaceRoot, task.agentId);
+    await mkdir14(taskRoot, { recursive: true });
     if (task.cancelledNow()) return cancelledBeforeRun();
     const configuredWorkspace = task.spec.workspace;
     let cwd = taskRoot;
@@ -41558,12 +41871,19 @@ function createCliRunner(adapter, opts = {}) {
         outcome.ok && outcome.result && typeof outcome.result === "object" ? outcome.result["artifact"] : void 0
       );
       if (parsed.success) {
-        const candidate = resolve10(cwd, path);
+        const candidate = resolve11(cwd, path);
         const key = await realpath8(candidate).catch(() => candidate);
         publishedTaskFiles.set(key, parsed.data);
       }
       return outcome;
     };
+    const companyAssets = createCompanyAssetHandlers({
+      agentOp: (op) => task.agentOp(op),
+      fetchCompanyAsset: (assetId) => task.fetchCompanyAsset(assetId),
+      taskRoot,
+      allowedRoots: [taskRoot, cwd],
+      cwd
+    });
     const [secrets, attachedConnections, providerGrants, integrationToolServers] = await Promise.all([
       task.secrets(),
       task.connections(),
@@ -41729,6 +42049,7 @@ function createCliRunner(adapter, opts = {}) {
           }
         },
         publishFile,
+        companyAssets,
         // AG-4a. The person approves in the Task thread through the ordinary
         // approvals pipeline, so the wall clock pauses while they decide, and
         // a refusal is an answer the session can act on rather than a failure.
@@ -41917,7 +42238,7 @@ ${attachmentSection}` : prompt;
         let changed = false;
         for (const path of paths) {
           if (!path || path.length > 4096) continue;
-          const absolutePath = isAbsolute16(path) ? path : resolve10(cwd, path);
+          const absolutePath = isAbsolute17(path) ? path : resolve11(cwd, path);
           const directory = dirname10(absolutePath);
           observedWorkingDirectories.delete(directory);
           observedWorkingDirectories.add(directory);
@@ -42354,7 +42675,7 @@ function runCliProcess(options) {
       usage: { inputTokens: 0, outputTokens: 0 }
     });
   }
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const platform = options.platform ?? process.platform;
     const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID12() : void 0;
     const child = options.guardian ? spawn11(
@@ -42416,7 +42737,7 @@ function runCliProcess(options) {
       clearInterval(timer);
       unregisterFollowUps?.();
       parser.stop?.();
-      resolve19(result);
+      resolve20(result);
     };
     const terminate = (result) => {
       if (settled || forcedResult) return;
@@ -42650,7 +42971,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 // src/runners/runtime-observation.ts
 import { open as open6, readdir as readdir6, realpath as realpath9 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
 var CATALOG_TIMEOUT_MS = 15e3;
 var CATALOG_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
@@ -42710,9 +43031,9 @@ function displayValue(value, maxLength) {
   return trimmed;
 }
 function claudeTranscriptPath(input) {
-  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join20(homeFrom(input.env), ".claude");
+  const configDir = input.env["CLAUDE_CONFIG_DIR"] || join21(homeFrom(input.env), ".claude");
   const slug = input.resolvedCwd.replace(/[^a-zA-Z0-9]/g, "-");
-  return join20(configDir, "projects", slug, `${input.sessionId}.jsonl`);
+  return join21(configDir, "projects", slug, `${input.sessionId}.jsonl`);
 }
 async function readClaudeSessionEffort(input) {
   const resolvedCwd = await realpath9(input.cwd).catch(() => input.cwd);
@@ -42728,18 +43049,18 @@ async function readClaudeSessionEffort(input) {
 }
 async function newestDirectories(root, limit) {
   const entries = await readdir6(root, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join20(root, name));
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => right.localeCompare(left)).slice(0, limit).map((name) => join21(root, name));
 }
 async function findCodexRolloutPath(input) {
-  const codexHome = input.env["CODEX_HOME"] || join20(homeFrom(input.env), ".codex");
-  const sessions = join20(codexHome, "sessions");
+  const codexHome = input.env["CODEX_HOME"] || join21(homeFrom(input.env), ".codex");
+  const sessions = join21(codexHome, "sessions");
   const suffix = `-${input.threadId}.jsonl`;
   for (const year of await newestDirectories(sessions, 2)) {
     for (const month of await newestDirectories(year, 2)) {
       for (const day of await newestDirectories(month, 3)) {
         const files = await readdir6(day).catch(() => []);
         const match = files.find((name) => name.endsWith(suffix));
-        if (match) return join20(day, match);
+        if (match) return join21(day, match);
       }
     }
   }
@@ -42762,7 +43083,7 @@ async function readCodexSessionRuntime(input) {
 }
 var codexCatalogCache = /* @__PURE__ */ new Map();
 async function loadCodexModelCatalog(command, prefixArgs, env) {
-  const output = await new Promise((resolve19) => {
+  const output = await new Promise((resolve20) => {
     const child = spawnCli(command, [...prefixArgs, "debug", "models"], {
       stdio: ["ignore", "pipe", "ignore"],
       windowsHide: true,
@@ -42777,7 +43098,7 @@ async function loadCodexModelCatalog(command, prefixArgs, env) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve19(value);
+      resolve20(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -42882,8 +43203,8 @@ function createRuntimeReporter(input, sessionId) {
 var EFFORT_READ_ATTEMPTS = 5;
 var EFFORT_READ_INTERVAL_MS = 3e3;
 function delay2(ms) {
-  return new Promise((resolve19) => {
-    const timer = setTimeout(resolve19, ms);
+  return new Promise((resolve20) => {
+    const timer = setTimeout(resolve20, ms);
     timer.unref?.();
   });
 }
@@ -42970,10 +43291,10 @@ function createClaudeLiveParser(onStream, onSessionModel) {
     },
     async steer(followUp) {
       if (!write) return false;
-      return await new Promise((resolve19) => {
-        acknowledgements.set(followUp.inputId, resolve19);
+      return await new Promise((resolve20) => {
+        acknowledgements.set(followUp.inputId, resolve20);
         void write(input(followUp.inputId, followUp.text)).catch(() => {
-          if (acknowledgements.delete(followUp.inputId)) resolve19(false);
+          if (acknowledgements.delete(followUp.inputId)) resolve20(false);
         });
       });
     },
@@ -43133,22 +43454,22 @@ function improveErrorMessage(error52) {
 }
 
 // src/runners/codex.ts
-import { mkdir as mkdir14, readFile as readFile11, writeFile as writeFile9 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile12, writeFile as writeFile10 } from "node:fs/promises";
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var CODEX_NOT_FOUND_MESSAGE = "The `codex` CLI was not found on this Machine. Install it (npm install -g @openai/codex) and sign in with `codex login`, or switch the agent to API-key auth.";
 function defaultCodexThreadIndexRoot() {
-  return join21(homedir9(), ".zixt", "codex-threads");
+  return join22(homedir9(), ".zixt", "codex-threads");
 }
 var SAFE_SEGMENT3 = /^[A-Za-z0-9_-]{1,200}$/;
 function threadIndexPath(root, agentId, sessionKey) {
   if (!SAFE_SEGMENT3.test(agentId) || !SAFE_SEGMENT3.test(sessionKey)) return null;
-  return join21(root, agentId, `${sessionKey}.json`);
+  return join22(root, agentId, `${sessionKey}.json`);
 }
 async function readThreadId(path) {
   try {
-    const parsed = JSON.parse(await readFile11(path, "utf8"));
+    const parsed = JSON.parse(await readFile12(path, "utf8"));
     return typeof parsed.threadId === "string" && /^[A-Za-z0-9-]{1,120}$/.test(parsed.threadId) ? parsed.threadId : null;
   } catch {
     return null;
@@ -43248,7 +43569,7 @@ ${value}` : value;
       const recordedThreadId = indexPath ? await readThreadId(indexPath) : null;
       const rememberThread = (threadId) => {
         if (!indexPath) return;
-        void mkdir14(join21(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile9(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
+        void mkdir15(join22(threadIndexRoot, task.agentId), { recursive: true }).then(() => writeFile10(indexPath, JSON.stringify({ threadId }), "utf8")).catch(() => {
         });
       };
       const observeRuntime = (threadId) => {
@@ -43289,8 +43610,8 @@ ${value}` : value;
 var RUNTIME_READ_ATTEMPTS = 5;
 var RUNTIME_READ_INTERVAL_MS = 2e3;
 function delay3(ms) {
-  return new Promise((resolve19) => {
-    const timer = setTimeout(resolve19, ms);
+  return new Promise((resolve20) => {
+    const timer = setTimeout(resolve20, ms);
     timer.unref?.();
   });
 }
@@ -43329,7 +43650,7 @@ function createCodexAppServerParser(onStream, options) {
   const turnReadyWaiters = /* @__PURE__ */ new Set();
   const usage = () => ({ inputTokens, outputTokens });
   const settleTurnReadiness = (ready) => {
-    for (const resolve19 of turnReadyWaiters) resolve19(ready);
+    for (const resolve20 of turnReadyWaiters) resolve20(ready);
     turnReadyWaiters.clear();
   };
   const send = async (message) => {
@@ -43510,12 +43831,12 @@ function createCodexAppServerParser(onStream, options) {
     async steer(input) {
       if (stopped) return false;
       if (!activeTurnId) {
-        const ready = await new Promise((resolve19) => turnReadyWaiters.add(resolve19));
+        const ready = await new Promise((resolve20) => turnReadyWaiters.add(resolve20));
         if (!ready || stopped) return false;
       }
       if (!threadId || !activeTurnId) return false;
-      return await new Promise((resolve19) => {
-        steerWaiters.set(input.inputId, resolve19);
+      return await new Promise((resolve20) => {
+        steerWaiters.set(input.inputId, resolve20);
         void send({
           id: `steer:${input.inputId}`,
           method: "turn/steer",
@@ -43526,7 +43847,7 @@ function createCodexAppServerParser(onStream, options) {
             clientUserMessageId: input.inputId
           }
         }).catch(() => {
-          if (steerWaiters.delete(input.inputId)) resolve19(false);
+          if (steerWaiters.delete(input.inputId)) resolve20(false);
         });
       });
     },
@@ -43534,7 +43855,7 @@ function createCodexAppServerParser(onStream, options) {
       stopped = true;
       write = null;
       settleTurnReadiness(false);
-      for (const resolve19 of steerWaiters.values()) resolve19(false);
+      for (const resolve20 of steerWaiters.values()) resolve20(false);
       steerWaiters.clear();
     },
     push(chunk) {
@@ -43713,7 +44034,7 @@ function improveCodexErrorMessage(error52) {
 // src/runners/git-preflight.ts
 import { spawn as spawn12 } from "node:child_process";
 import { realpath as realpath10 } from "node:fs/promises";
-import { isAbsolute as isAbsolute17, resolve as resolve11 } from "node:path";
+import { isAbsolute as isAbsolute18, resolve as resolve12 } from "node:path";
 var OUTPUT_LIMIT = 8192;
 var DEFAULT_TIMEOUT_MS4 = 1e4;
 var VERSION_PATTERN = /^git version [^\r\n]{1,108}$/;
@@ -43729,10 +44050,10 @@ function unavailable(error52, checkedAt, executablePath = null) {
 async function preflightGit(options = {}) {
   const checkedAt = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const configured = options.command;
-  if (configured !== void 0 && !isAbsolute17(configured)) {
+  if (configured !== void 0 && !isAbsolute18(configured)) {
     return unavailable("configured git command must be an absolute file", checkedAt);
   }
-  const trustedCwd = await realpath10(resolve11(options.trustedCwd ?? process.cwd())).catch(() => null);
+  const trustedCwd = await realpath10(resolve12(options.trustedCwd ?? process.cwd())).catch(() => null);
   if (!trustedCwd)
     return unavailable("Host-owned git preflight directory is unavailable", checkedAt);
   const executablePath = await resolveTrustedCliCommand(configured ?? "git", {
@@ -43954,7 +44275,7 @@ function parseAuth(result) {
   return "unknown";
 }
 function run2(command, args) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const child = spawnCli(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -43970,7 +44291,7 @@ function run2(command, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
-      resolve19(result);
+      resolve20(result);
     };
     const timeout = setTimeout(() => {
       child.kill();
@@ -43984,32 +44305,32 @@ function run2(command, args) {
 // src/linux-service.ts
 import { spawn as spawn13 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
-import { access as access5, chmod as chmod9, mkdir as mkdir16, open as open7, rename as rename8, rm as rm12 } from "node:fs/promises";
+import { access as access5, chmod as chmod9, mkdir as mkdir17, open as open7, rename as rename8, rm as rm12 } from "node:fs/promises";
 import { homedir as homedir11, userInfo } from "node:os";
-import { basename as basename4, dirname as dirname11, join as join23, relative as relative10, resolve as resolve13, sep as sep7 } from "node:path";
+import { basename as basename4, dirname as dirname11, join as join24, relative as relative10, resolve as resolve14, sep as sep8 } from "node:path";
 
 // src/service-runtime.ts
-import { access as access4, chmod as chmod8, copyFile, mkdir as mkdir15, rename as rename7, rm as rm11 } from "node:fs/promises";
+import { access as access4, chmod as chmod8, copyFile, mkdir as mkdir16, rename as rename7, rm as rm11 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { join as join22, resolve as resolve12, sep as sep6 } from "node:path";
+import { join as join23, resolve as resolve13, sep as sep7 } from "node:path";
 async function ensureDurableServiceNode(options = {}) {
-  const execPath = resolve12(options.execPath ?? process.execPath);
+  const execPath = resolve13(options.execPath ?? process.execPath);
   const home = options.home ?? homedir10();
   const platform = options.platform ?? process.platform;
   const version2 = options.nodeVersion ?? process.version;
   if (!/^v?[0-9A-Za-z.-]+$/.test(version2)) {
     throw new Error("the Node runtime version is not a safe directory name");
   }
-  const zixtRoot = resolve12(home, ".zixt");
-  if (execPath === zixtRoot || execPath.startsWith(zixtRoot + sep6)) return execPath;
-  const directory = join22(zixtRoot, "runtime", `node-${version2}`);
-  const destination = join22(directory, platform === "win32" ? "node.exe" : "node");
+  const zixtRoot = resolve13(home, ".zixt");
+  if (execPath === zixtRoot || execPath.startsWith(zixtRoot + sep7)) return execPath;
+  const directory = join23(zixtRoot, "runtime", `node-${version2}`);
+  const destination = join23(directory, platform === "win32" ? "node.exe" : "node");
   const alreadyCopied = await access4(destination).then(
     () => true,
     () => false
   );
   if (alreadyCopied) return destination;
-  await mkdir15(directory, { recursive: true, mode: 448 });
+  await mkdir16(directory, { recursive: true, mode: 448 });
   const temporary = `${destination}.${process.pid}.${crypto.randomUUID()}.tmp`;
   try {
     await copyFile(execPath, temporary);
@@ -44051,7 +44372,7 @@ function boundedAppend(current, chunk) {
 }
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const child = spawn13(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
@@ -44065,7 +44386,7 @@ async function defaultRunCommand(command, args) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve19(result);
+      resolve20(result);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = boundedAppend(stdout, chunk);
@@ -44124,22 +44445,22 @@ async function defaultSyncDirectory(path) {
   }
 }
 async function ensureDirectory(path, mode, syncDirectory8) {
-  const firstCreated = await mkdir16(path, { recursive: true, mode });
+  const firstCreated = await mkdir17(path, { recursive: true, mode });
   if (!firstCreated) return;
-  const first = resolve13(firstCreated);
-  const target = resolve13(path);
+  const first = resolve14(firstCreated);
+  const target = resolve14(path);
   await syncDirectory8(dirname11(first));
   let current = first;
   const descendants = relative10(first, target);
-  for (const part of descendants ? descendants.split(sep7) : []) {
+  for (const part of descendants ? descendants.split(sep8) : []) {
     await syncDirectory8(current);
-    current = join23(current, part);
+    current = join24(current, part);
   }
 }
 async function replacePrivateFile(path, contents, mode, syncDirectory8) {
   const parent = dirname11(path);
   await ensureDirectory(parent, 448, syncDirectory8);
-  const temporary = join23(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join24(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open7(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -44191,17 +44512,17 @@ async function installLinuxService(options) {
     "command search path"
   );
   const cloudUrl = options.cloudUrl ? oneLine(options.cloudUrl, "Zixt Cloud address") : void 0;
-  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join23(home, ".config");
-  const configRoot = options.serviceConfigRoot ?? join23(xdgConfigHome, "zixt");
-  const unitRoot = options.userUnitRoot ?? join23(xdgConfigHome, "systemd", "user");
-  const environmentPath = join23(configRoot, "host.env");
-  const unitPath = join23(unitRoot, SERVICE_NAME);
+  const xdgConfigHome = env.XDG_CONFIG_HOME ? oneLine(env.XDG_CONFIG_HOME, "Linux configuration path") : join24(home, ".config");
+  const configRoot = options.serviceConfigRoot ?? join24(xdgConfigHome, "zixt");
+  const unitRoot = options.userUnitRoot ?? join24(xdgConfigHome, "systemd", "user");
+  const environmentPath = join24(configRoot, "host.env");
+  const unitPath = join24(unitRoot, SERVICE_NAME);
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : activateInstalledRelease);
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
   const run3 = options.runCommand ?? defaultRunCommand;
   const syncDirectory8 = options.syncDirectory ?? defaultSyncDirectory;
-  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve19) => setTimeout(resolve19, ms)));
+  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve20) => setTimeout(resolve20, ms)));
   const [systemctl, loginctl] = await Promise.all([
     resolveCommand("systemctl"),
     resolveCommand("loginctl")
@@ -44325,9 +44646,9 @@ async function installLinuxService(options) {
 // src/macos-service.ts
 import { spawn as spawn14 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
-import { access as access6, chmod as chmod10, mkdir as mkdir17, open as open8, rename as rename9, rm as rm13 } from "node:fs/promises";
+import { access as access6, chmod as chmod10, mkdir as mkdir18, open as open8, rename as rename9, rm as rm13 } from "node:fs/promises";
 import { homedir as homedir12, userInfo as userInfo2 } from "node:os";
-import { basename as basename5, dirname as dirname12, join as join24, relative as relative11, resolve as resolve14, sep as sep8 } from "node:path";
+import { basename as basename5, dirname as dirname12, join as join25, relative as relative11, resolve as resolve15, sep as sep9 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var STATUS_WAIT_MS = 2e4;
@@ -44352,21 +44673,21 @@ async function syncDirectory4(path) {
   }
 }
 async function ensureDirectory2(path, sync) {
-  const firstCreated = await mkdir17(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir18(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve14(firstCreated);
-  const target = resolve14(path);
+  const first = resolve15(firstCreated);
+  const target = resolve15(path);
   await sync(dirname12(first));
   let current = first;
-  for (const part of relative11(first, target).split(sep8).filter(Boolean)) {
+  for (const part of relative11(first, target).split(sep9).filter(Boolean)) {
     await sync(current);
-    current = join24(current, part);
+    current = join25(current, part);
   }
 }
 async function replacePrivateFile2(path, contents, mode, sync) {
   const parent = dirname12(path);
   await ensureDirectory2(parent, sync);
-  const temporary = join24(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join25(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open8(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -44463,14 +44784,14 @@ async function installMacosService(options) {
     options.path ?? env.PATH ?? "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin",
     "command search path"
   );
-  const configRoot = options.configRoot ?? join24(home, "Library", "Application Support", "Zixt");
-  const launchAgentsRoot = options.launchAgentsRoot ?? join24(home, "Library", "LaunchAgents");
-  const logRoot = options.logRoot ?? join24(home, "Library", "Logs", "Zixt");
-  const configPath = join24(configRoot, "host.env");
-  const launcherPath = join24(configRoot, "host-launcher.sh");
-  const plistPath = join24(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
-  const stdoutPath = join24(logRoot, "host.log");
-  const stderrPath = join24(logRoot, "host-error.log");
+  const configRoot = options.configRoot ?? join25(home, "Library", "Application Support", "Zixt");
+  const launchAgentsRoot = options.launchAgentsRoot ?? join25(home, "Library", "LaunchAgents");
+  const logRoot = options.logRoot ?? join25(home, "Library", "Logs", "Zixt");
+  const configPath = join25(configRoot, "host.env");
+  const launcherPath = join25(configRoot, "host-launcher.sh");
+  const plistPath = join25(launchAgentsRoot, `${LAUNCH_AGENT_LABEL}.plist`);
+  const stdoutPath = join25(logRoot, "host.log");
+  const stderrPath = join25(logRoot, "host-error.log");
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? (async () => defaultResolveCommand2());
@@ -44573,9 +44894,9 @@ async function installMacosService(options) {
 // src/windows-service.ts
 import { spawn as spawn15 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
-import { access as access7, mkdir as mkdir18, open as open9, readFile as readFile12, rename as rename10, rm as rm14 } from "node:fs/promises";
+import { access as access7, mkdir as mkdir19, open as open9, readFile as readFile13, rename as rename10, rm as rm14 } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
-import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute18, join as join25, relative as relative12, resolve as resolve15, sep as sep9 } from "node:path";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute19, join as join26, relative as relative12, resolve as resolve16, sep as sep10 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -44601,21 +44922,21 @@ async function syncDirectory5(path) {
   }
 }
 async function ensureDirectory3(path, sync) {
-  const firstCreated = await mkdir18(path, { recursive: true, mode: 448 });
+  const firstCreated = await mkdir19(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve15(firstCreated);
-  const target = resolve15(path);
+  const first = resolve16(firstCreated);
+  const target = resolve16(path);
   await sync(dirname13(first));
   let current = first;
-  for (const part of relative12(first, target).split(sep9).filter(Boolean)) {
+  for (const part of relative12(first, target).split(sep10).filter(Boolean)) {
     await sync(current);
-    current = join25(current, part);
+    current = join26(current, part);
   }
 }
 async function replacePrivateFile3(path, contents, sync, encoding = "utf8") {
   const parent = dirname13(path);
   await ensureDirectory3(parent, sync);
-  const temporary = join25(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join26(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open9(temporary, "wx", 384);
   try {
     await handle.writeFile(encoding === "utf16le" ? `\uFEFF${contents}` : contents, encoding);
@@ -44669,8 +44990,8 @@ async function runChild(command, args, env, input) {
 }
 async function defaultResolveCommand3(name, env) {
   const root = env.SYSTEMROOT ?? env.WINDIR;
-  if (!root || !isAbsolute18(root)) return null;
-  const candidate = name === "powershell" ? join25(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join25(root, "System32", `${name}.exe`);
+  if (!root || !isAbsolute19(root)) return null;
+  const candidate = name === "powershell" ? join26(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join26(root, "System32", `${name}.exe`);
   return access7(candidate, constants4.X_OK).then(
     () => candidate,
     () => null
@@ -44760,7 +45081,7 @@ exit $code
 }
 async function defaultObserveStatus(path, generation) {
   try {
-    const text = (await readFile12(path, "utf8")).replace(/^\uFEFF/, "");
+    const text = (await readFile13(path, "utf8")).replace(/^\uFEFF/, "");
     const value = JSON.parse(text);
     if (value.schema !== 1 || value.generation !== generation || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) {
       return null;
@@ -44815,18 +45136,18 @@ async function installWindowsService(options) {
   const env = options.env ?? process.env;
   const home = options.home ?? homedir13();
   const localAppData = options.localAppData ?? env.LOCALAPPDATA;
-  if (!localAppData || !isAbsolute18(localAppData)) {
+  if (!localAppData || !isAbsolute19(localAppData)) {
     throw new Error("Windows local application data path is unavailable.");
   }
   const token2 = oneLine3(options.token, "pairing code");
   const cloudUrl = options.cloudUrl ? oneLine3(options.cloudUrl, "Zixt Cloud address") : void 0;
   const path = oneLine3(options.path ?? env.PATH ?? "", "command search path");
-  const configRoot = options.configRoot ?? join25(localAppData, "Zixt", "Host");
-  const configPath = join25(configRoot, "host.json");
-  const launcherPath = join25(configRoot, "host-launcher.ps1");
-  const launchShimPath = join25(configRoot, "host-launch.vbs");
-  const taskXmlPath = join25(configRoot, "host-task.xml");
-  const statusPath = join25(configRoot, "host-status.json");
+  const configRoot = options.configRoot ?? join26(localAppData, "Zixt", "Host");
+  const configPath = join26(configRoot, "host.json");
+  const launcherPath = join26(configRoot, "host-launcher.ps1");
+  const launchShimPath = join26(configRoot, "host-launch.vbs");
+  const taskXmlPath = join26(configRoot, "host-task.xml");
+  const statusPath = join26(configRoot, "host-status.json");
   const installVersion = options.installVersion ?? ((version2, onFailure) => installRelease(version2, onFailure ? { onFailure } : {}));
   const activateVersion = options.activateVersion ?? (options.installVersion ? async (entry) => entry : (entry) => activateInstalledRelease(entry));
   const resolveCommand = options.resolveCommand ?? ((name) => defaultResolveCommand3(name, env));
@@ -44953,23 +45274,23 @@ async function installSystemService(options) {
 }
 
 // src/terminal-outcomes.ts
-import { chmod as chmod11, lstat as lstat12, mkdir as mkdir19, open as open10, readdir as readdir7, readFile as readFile13, rename as rename11, rm as rm15 } from "node:fs/promises";
+import { chmod as chmod11, lstat as lstat12, mkdir as mkdir20, open as open10, readdir as readdir7, readFile as readFile14, rename as rename11, rm as rm15 } from "node:fs/promises";
 import { homedir as homedir14 } from "node:os";
-import { dirname as dirname14, join as join26, relative as relative13, resolve as resolve16, sep as sep10 } from "node:path";
+import { dirname as dirname14, join as join27, relative as relative13, resolve as resolve17, sep as sep11 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
 var HOST_DIRECTORY = /^hst_[0-9a-f]{32}$/;
 var OUTCOME_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 function defaultTerminalOutcomeRoot() {
-  return join26(homedir14(), ".zixt", "terminal-outcomes");
+  return join27(homedir14(), ".zixt", "terminal-outcomes");
 }
 function hostOutcomeRoot(root, hostId) {
   if (!HOST_DIRECTORY.test(hostId)) throw new Error("terminal outcome Host identity is malformed");
-  return join26(root, hostId);
+  return join27(root, hostId);
 }
 function outcomePath(root, hostId, taskId, epoch) {
-  return join26(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
+  return join27(hostOutcomeRoot(root, hostId), `${taskId}.${epoch}.json`);
 }
 async function syncDirectory6(root) {
   if (process.platform === "win32") return;
@@ -44981,15 +45302,15 @@ async function syncDirectory6(root) {
   }
 }
 async function requirePrivateRoot(root, sync = syncDirectory6) {
-  const firstCreated = await mkdir19(root, { recursive: true, mode: DIRECTORY_MODE5 });
+  const firstCreated = await mkdir20(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
-    const first = resolve16(firstCreated);
-    const target = resolve16(root);
+    const first = resolve17(firstCreated);
+    const target = resolve17(root);
     await sync(dirname14(first));
     let current = first;
-    for (const part of relative13(first, target).split(sep10).filter(Boolean)) {
+    for (const part of relative13(first, target).split(sep11).filter(Boolean)) {
       await sync(current);
-      current = join26(current, part);
+      current = join27(current, part);
     }
   }
   const stat4 = await lstat12(root);
@@ -45020,7 +45341,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   const destination = outcomePath(root, hostId, outcome.taskId, outcome.epoch);
   try {
     const existing = parseCommittedOutcome(
-      await readFile13(destination, { encoding: "utf8", flag: "r" }),
+      await readFile14(destination, { encoding: "utf8", flag: "r" }),
       outcome.taskId,
       outcome.epoch
     );
@@ -45029,7 +45350,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   } catch (error52) {
     if (error52.code !== "ENOENT") throw error52;
   }
-  const temporary = join26(
+  const temporary = join27(
     scopedRoot,
     `.${outcome.taskId}.${outcome.epoch}.${process.pid}.${Date.now()}.${outcome.resultId}.tmp`
   );
@@ -45082,13 +45403,13 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
       if (!match || !entry.isFile() || entry.isSymbolicLink()) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
-      const path = join26(scopedRoot, entry.name);
+      const path = join27(scopedRoot, entry.name);
       const stat4 = await lstat12(path);
       if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.size > MAX_OUTCOME_BYTES) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const outcome = parseCommittedOutcome(
-        await readFile13(path, "utf8"),
+        await readFile14(path, "utf8"),
         match[1],
         Number(match[2])
       );
@@ -45134,15 +45455,15 @@ async function forgetSupersededTerminalOutcomes(hostId, taskId, epoch, root = de
 }
 
 // src/accepted-assignments.ts
-import { chmod as chmod12, lstat as lstat13, mkdir as mkdir20, open as open11, readdir as readdir8, rename as rename12, rm as rm16 } from "node:fs/promises";
+import { chmod as chmod12, lstat as lstat13, mkdir as mkdir21, open as open11, readdir as readdir8, rename as rename12, rm as rm16 } from "node:fs/promises";
 import { homedir as homedir15 } from "node:os";
-import { dirname as dirname15, join as join27, relative as relative14, resolve as resolve17, sep as sep11 } from "node:path";
+import { dirname as dirname15, join as join28, relative as relative14, resolve as resolve18, sep as sep12 } from "node:path";
 var DIRECTORY_MODE6 = 448;
 var FILE_MODE5 = 384;
 var CLAIM_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 var TASK_ID = /^tsk_[0-9a-f]{32}$/;
 function defaultAcceptedAssignmentRoot() {
-  return join27(homedir15(), ".zixt", "accepted-assignments");
+  return join28(homedir15(), ".zixt", "accepted-assignments");
 }
 async function syncDirectory7(root) {
   if (process.platform === "win32") return;
@@ -45154,15 +45475,15 @@ async function syncDirectory7(root) {
   }
 }
 async function requirePrivateRoot2(root, sync = syncDirectory7) {
-  const firstCreated = await mkdir20(root, { recursive: true, mode: DIRECTORY_MODE6 });
+  const firstCreated = await mkdir21(root, { recursive: true, mode: DIRECTORY_MODE6 });
   if (firstCreated) {
-    const first = resolve17(firstCreated);
-    const target = resolve17(root);
+    const first = resolve18(firstCreated);
+    const target = resolve18(root);
     await sync(dirname15(first));
     let current = first;
-    for (const part of relative14(first, target).split(sep11).filter(Boolean)) {
+    for (const part of relative14(first, target).split(sep12).filter(Boolean)) {
       await sync(current);
-      current = join27(current, part);
+      current = join28(current, part);
     }
   }
   const stat4 = await lstat13(root);
@@ -45176,7 +45497,7 @@ function claimPath(root, taskId, epoch) {
   if (!Number.isSafeInteger(epoch) || epoch < 1) {
     throw new Error("accepted assignment epoch is malformed");
   }
-  return join27(root, `${taskId}.${epoch}.json`);
+  return join28(root, `${taskId}.${epoch}.json`);
 }
 async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssignmentRoot(), options = {}) {
   const sync = options.syncDirectory ?? syncDirectory7;
@@ -45186,7 +45507,7 @@ async function recordAcceptedAssignment(assignment, root = defaultAcceptedAssign
   } catch {
     return false;
   }
-  const temporary = join27(
+  const temporary = join28(
     root,
     `.${assignment.taskId}.${assignment.epoch}.${process.pid}.${Date.now()}.tmp`
   );
@@ -45248,9 +45569,9 @@ async function forgetAcknowledgedAcceptedAssignments(assignments, root = default
 }
 
 // src/local-observability.ts
-import { appendFile, mkdir as mkdir21, open as open12, readdir as readdir9, rename as rename13, rm as rm17, stat as stat3 } from "node:fs/promises";
+import { appendFile, mkdir as mkdir22, open as open12, readdir as readdir9, rename as rename13, rm as rm17, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename7, dirname as dirname16, join as join28 } from "node:path";
+import { basename as basename7, dirname as dirname16, join as join29 } from "node:path";
 
 // src/logger.ts
 var ANSI = {
@@ -45362,11 +45683,11 @@ var LOCAL_STATUS_FILE = "status.json";
 var LOCAL_REQUESTS_DIR = "requests";
 var DEFAULT_CONSOLE_ROTATE_BYTES = 2 * 1024 * 1024;
 function defaultLocalObservabilityRoot() {
-  return join28(homedir16(), ".zixt", "observability");
+  return join29(homedir16(), ".zixt", "observability");
 }
 function createLocalConsoleSink(options = {}) {
   const root = options.root ?? defaultLocalObservabilityRoot();
-  const consolePath = join28(root, LOCAL_CONSOLE_FILE);
+  const consolePath = join29(root, LOCAL_CONSOLE_FILE);
   const rotateBytes = options.rotateBytes ?? DEFAULT_CONSOLE_ROTATE_BYTES;
   let disabled = false;
   let prepared = false;
@@ -45376,7 +45697,7 @@ function createLocalConsoleSink(options = {}) {
     if (disabled) return;
     try {
       if (!prepared) {
-        await mkdir21(root, { recursive: true, mode: 448 });
+        await mkdir22(root, { recursive: true, mode: 448 });
         approximateBytes = await stat3(consolePath).then(
           (existing) => existing.size,
           () => 0
@@ -45384,8 +45705,8 @@ function createLocalConsoleSink(options = {}) {
         prepared = true;
       }
       if (approximateBytes >= rotateBytes) {
-        await rm17(join28(root, LOCAL_CONSOLE_PREVIOUS_FILE), { force: true });
-        await rename13(consolePath, join28(root, LOCAL_CONSOLE_PREVIOUS_FILE)).catch(
+        await rm17(join29(root, LOCAL_CONSOLE_PREVIOUS_FILE), { force: true });
+        await rename13(consolePath, join29(root, LOCAL_CONSOLE_PREVIOUS_FILE)).catch(
           (error52) => {
             if (error52.code !== "ENOENT") throw error52;
           }
@@ -45416,7 +45737,7 @@ function createLocalConsoleSink(options = {}) {
   };
 }
 async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot()) {
-  const directory = join28(root, LOCAL_REQUESTS_DIR);
+  const directory = join29(root, LOCAL_REQUESTS_DIR);
   const requested = /* @__PURE__ */ new Set();
   let names;
   try {
@@ -45428,7 +45749,7 @@ async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot
     const name = `install-runner-${type}.json`;
     if (!names.includes(name)) continue;
     try {
-      await rm17(join28(directory, name), { force: true });
+      await rm17(join29(directory, name), { force: true });
       requested.add(type);
     } catch {
     }
@@ -45436,13 +45757,13 @@ async function consumeRunnerInstallRequests(root = defaultLocalObservabilityRoot
   return requested;
 }
 async function writeLocalStatus(status, root = defaultLocalObservabilityRoot()) {
-  const destination = join28(root, LOCAL_STATUS_FILE);
-  const temporary = join28(
+  const destination = join29(root, LOCAL_STATUS_FILE);
+  const temporary = join29(
     dirname16(destination),
     `.${basename7(destination)}.${process.pid}.${crypto.randomUUID()}.tmp`
   );
   try {
-    await mkdir21(root, { recursive: true, mode: 448 });
+    await mkdir22(root, { recursive: true, mode: 448 });
     const handle = await open12(temporary, "wx", 384);
     try {
       await handle.writeFile(`${JSON.stringify(status)}
@@ -45457,24 +45778,24 @@ async function writeLocalStatus(status, root = defaultLocalObservabilityRoot())
 }
 
 // src/demo-state.ts
-import { isAbsolute as isAbsolute19, join as join29, parse as parse3, resolve as resolve18 } from "node:path";
+import { isAbsolute as isAbsolute20, join as join30, parse as parse3, resolve as resolve19 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
   if (!configured) return null;
-  const root = resolve18(configured);
-  if (!isAbsolute19(configured) || root === parse3(root).root) {
+  const root = resolve19(configured);
+  if (!isAbsolute20(configured) || root === parse3(root).root) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
   return {
-    runRegistryRoot: join29(root, "run-registry"),
-    terminalOutcomeRoot: join29(root, "terminal-outcomes"),
-    acceptedAssignmentRoot: join29(root, "accepted-assignments"),
-    runArtifactRoot: join29(root, "run-artifacts"),
-    browserProfileRoot: join29(root, "browser-profiles"),
-    runnerWorkspaceRoot: join29(root, "workspaces"),
-    codexThreadIndexRoot: join29(root, "codex-threads"),
-    localObservabilityRoot: join29(root, "local-observability")
+    runRegistryRoot: join30(root, "run-registry"),
+    terminalOutcomeRoot: join30(root, "terminal-outcomes"),
+    acceptedAssignmentRoot: join30(root, "accepted-assignments"),
+    runArtifactRoot: join30(root, "run-artifacts"),
+    browserProfileRoot: join30(root, "browser-profiles"),
+    runnerWorkspaceRoot: join30(root, "workspaces"),
+    codexThreadIndexRoot: join30(root, "codex-threads"),
+    localObservabilityRoot: join30(root, "local-observability")
   };
 }