@zixt/host 0.0.43 → 0.0.45

package/dist/index.js

@@ -31,7 +31,7 @@ import { homedir } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.43",
+  version: "0.0.45",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14648,7 +14648,17 @@ var ID_PREFIXES = {
   /** One file a person attached to a chat message ('att' is taken by attempt). */
   attachment: "atc",
   /** One curated memory entry an agent chose to keep ('mem' is taken by member). */
-  memory: "mry"
+  memory: "mry",
+  /** Org-singleton Manager configuration (PRD §8.13). */
+  manager: "mgr",
+  /** One Manager conversation thread (MG-2). */
+  conversation: "cnv",
+  /** One immutable Conversation timeline entry. */
+  conversationEvent: "cve",
+  /** One Manager inference call's token-metering row (MG-8). */
+  managerUsage: "mgu",
+  /** One ordered Manager reply awaiting Slack delivery. */
+  managerSlackOutbox: "mso"
 };
 var idPattern = (prefix) => new RegExp(`^${prefix}_[0-9a-f]{32}$`);
 function newId(prefix) {
@@ -14671,6 +14681,9 @@ var OrgRoutineId = idSchema(ID_PREFIXES.orgRoutine, "organization routine id");
 var BrowserSessionId = idSchema(ID_PREFIXES.browserSession, "browser session id");
 var AttachmentId = idSchema(ID_PREFIXES.attachment, "attachment id");
 var MemoryId = idSchema(ID_PREFIXES.memory, "memory id");
+var ManagerId = idSchema(ID_PREFIXES.manager, "manager id");
+var ConversationId = idSchema(ID_PREFIXES.conversation, "conversation id");
+var ConversationEventId = idSchema(ID_PREFIXES.conversationEvent, "conversation event id");
 
 // ../../packages/contracts/src/browser.ts
 var BrowserViewport = external_exports.object({
@@ -14775,15 +14788,24 @@ var WebLoginValue = external_exports.object({
   username: external_exports.string().min(1).max(500),
   password: external_exports.string().min(1).max(5e3)
 }).strict();
+var BrowserProfileContext = external_exports.object({
+  taskMachineName: external_exports.string().min(1).max(120),
+  savedProfileMachineName: external_exports.string().min(1).max(120)
+}).strict();
 var BrowserSessionProjection = external_exports.object({
   status: external_exports.enum(["none", "starting", "live"]),
   session: BrowserSessionState.optional(),
   /** Whether Start would find an online Machine with a working browser. */
   canStart: external_exports.boolean(),
   /** Member-safe reason when canStart is false. */
-  reason: external_exports.string().max(300).optional()
+  reason: external_exports.string().max(300).optional(),
+  /** Present only when active work must use a different Machine-local profile. */
+  profileContext: BrowserProfileContext.optional()
+}).strict();
+var StartBrowserSessionResponse = external_exports.object({
+  session: BrowserSessionState,
+  profileContext: BrowserProfileContext.optional()
 }).strict();
-var StartBrowserSessionResponse = external_exports.object({ session: BrowserSessionState }).strict();
 var StopBrowserSessionResponse = external_exports.object({ stopped: external_exports.boolean() }).strict();
 var BrowserViewTicketResponse = external_exports.object({ ticket: external_exports.string().min(1).max(200) }).strict();
 
@@ -14807,6 +14829,7 @@ var ACTION_CATEGORIES = [
   "records.modify",
   "records.delete",
   "docker",
+  "browser.use",
   "mcp.call",
   "spend_money"
 ];
@@ -14845,6 +14868,7 @@ var DEFAULT_GUARDRAIL_POLICY = {
   "records.modify": "allow",
   "records.delete": "allow",
   docker: "allow",
+  "browser.use": "allow",
   "mcp.call": "allow",
   spend_money: "allow"
 };
@@ -14853,7 +14877,7 @@ var ApprovalDeliveryStatus = external_exports.enum(["pending", "delivered", "no_
 var ApprovalCategory = external_exports.union([ActionCategory, external_exports.literal("agent.question")]);
 var ApprovalRequestContext = external_exports.object({
   requester: external_exports.object({
-    source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff"]).nullable(),
+    source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff", "manager"]).nullable(),
     trust: external_exports.enum(["internal", "external"]).nullable(),
     contentTrust: PromptContentTrust.nullable(),
     requestedBy: external_exports.string().min(1).nullable(),
@@ -15306,6 +15330,16 @@ var Agent = external_exports.object({
   orgId: OrgId,
   name: external_exports.string().min(1).max(120),
   status: AgentStatus,
+  /**
+   * Archive has fenced new work but is still waiting for one or more exact
+   * Machines to acknowledge deletion of saved website sessions. `archived`
+   * is exposed only after this becomes null.
+   */
+  profileCleanup: external_exports.object({
+    state: external_exports.literal("pending"),
+    remainingProfiles: external_exports.number().int().min(1),
+    intent: external_exports.enum(["archive", "restore"])
+  }).strict().nullable().default(null),
   roleDescription: external_exports.string().max(2e3).default(""),
   /** Persona instructions — system-prompt-like free text (AG-1). */
   instructions: external_exports.string().max(5e4).default(""),
@@ -15481,6 +15515,11 @@ var Host = external_exports.object({
   status: HostStatus,
   /** Persistent assignment admission; pausing never changes socket presence or live work. */
   acceptingNewWork: external_exports.boolean().default(true),
+  /**
+   * Removal is fenced but the Machine remains paired solely so an offline
+   * Host can reconnect and delete its saved browser profiles truthfully.
+   */
+  profileCleanup: external_exports.object({ state: external_exports.literal("pending"), remainingProfiles: external_exports.number().int().min(1) }).strict().nullable().default(null),
   /** `desktop` today; `cloud` when pods run the same host (PRD §7.6). */
   kind: external_exports.enum(["desktop", "cloud"]),
   lastSeenAt: IsoDate2.nullable(),
@@ -15801,7 +15840,7 @@ var TaskAttemptExecutionContext = external_exports.object({
   identity: external_exports.object({
     actingAgentId: AgentId,
     source: external_exports.object({
-      source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff"]),
+      source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff", "manager"]),
       trust: external_exports.enum(["internal", "external"]),
       /** Current attempt prompt authority; absent only on pre-TS-10 snapshots. */
       contentTrust: PromptContentTrust.optional(),
@@ -15830,7 +15869,7 @@ var MemberTaskAttemptExecutionContext = TaskAttemptExecutionContext.omit({
   identity: external_exports.object({
     actingAgentId: AgentId,
     source: external_exports.object({
-      source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff"]),
+      source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff", "manager"]),
       trust: external_exports.enum(["internal", "external"]),
       contentTrust: PromptContentTrust.optional(),
       requestedBy: external_exports.null(),
@@ -15915,7 +15954,8 @@ var TaskStatus = external_exports.enum([
   "cancelled"
 ]);
 var TaskOrigin = external_exports.object({
-  source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff"]),
+  /** `manager` = delegated from a Manager Conversation (MG-4). */
+  source: external_exports.enum(["manual", "webhook", "message", "schedule", "agent", "handoff", "manager"]),
   /** TS-10: external content is data, not instructions. */
   trust: external_exports.enum(["internal", "external"]),
   /** Member id, connector name, or agent id — whoever caused the task. */
@@ -15984,6 +16024,12 @@ var Task = external_exports.object({
   /** Higher runs first; FIFO within equal priority. */
   priority: external_exports.number().int().min(0).max(9),
   origin: TaskOrigin,
+  /**
+   * The Manager thread this Task was delegated from (MG-4); null for
+   * engine-born work (webhook, schedule, provider). Lets task lists tell
+   * thread-backed work from standalone rows without a second lookup.
+   */
+  conversationId: ConversationId.nullable().default(null),
   /** Formal human review is opt-in per Task; ordinary Chat defaults to none. */
   reviewMode: TaskReviewMode.default("none"),
   /** Assignment epoch — bumped every time the task is (re)assigned (PRD §7.4). */
@@ -15994,6 +16040,8 @@ var Task = external_exports.object({
    * its first Machine; assignment then records that choice for later runs.
    */
   requestedHostId: HostId.nullable().default(null),
+  /** Browser-dependent work runs only on a Machine with fresh Browser capability. */
+  requiresBrowser: external_exports.boolean().default(false),
   /** TS-16: per-Task runner/model/effort selection; null runs the teammate's configuration. */
   runner: TaskRunnerSelection.nullable().default(null),
   /**
@@ -16151,6 +16199,8 @@ var CreateTaskInput = external_exports.object({
    * another Machine truthfully queues this Task rather than overriding it.
    */
   requestedHostId: HostId.optional(),
+  /** Require a fresh, working AI teammate Browser on the selected Machine. */
+  requiresBrowser: external_exports.boolean().optional(),
   /** Per-Task runner/model/effort selection (TS-16); absent fields fall back to the teammate's configuration. */
   runner: TaskRunnerSelection.optional(),
   /** Files uploaded ahead of this message; each may belong to one Task only (TS-15). */
@@ -16452,12 +16502,15 @@ var TaskSupportBundle = external_exports.object({
     })
   )
 });
+var TASK_LIST_MAX_LIMIT = 200;
 var ListTasksResponse = external_exports.object({
-  tasks: external_exports.array(TaskProjection)
-});
+  tasks: external_exports.array(TaskProjection).max(TASK_LIST_MAX_LIMIT),
+  nextCursor: external_exports.string().nullable()
+}).strict();
 
 // ../../packages/contracts/src/protocol.ts
-var PROTOCOL_VERSION = 5;
+var PROTOCOL_VERSION = 7;
+var BROWSER_PROFILE_INVENTORY_PAGE_SIZE = 200;
 var TASK_CANCEL_ACK_EVENT = "zixt.task.cancel.acknowledged";
 var TASK_CREDENTIAL_ROLLOVER_ACK_EVENT = "zixt.task.credential_rollover.acknowledged";
 var UnwoundAssignmentRef = external_exports.object({
@@ -16735,6 +16788,11 @@ var AgentOp = external_exports.union([
   }),
   external_exports.object({ kind: external_exports.literal("secret.list") }),
   external_exports.object({ kind: external_exports.literal("agents.list") }),
+  /** Speak to the organization Manager without addressing a human channel directly. */
+  external_exports.object({
+    kind: external_exports.literal("manager.message"),
+    message: external_exports.string().min(1).max(5e4)
+  }),
   /** Read one teammate's non-secret standing configuration; omission means self. */
   external_exports.object({ kind: external_exports.literal("agent.get"), agentId: AgentId.optional() }),
   /**
@@ -16935,6 +16993,12 @@ var TaskAssign = external_exports.object({
   type: external_exports.literal("task.assign"),
   taskId: TaskId,
   agentId: AgentId,
+  /**
+   * A current assignment is a trusted authorization to create a fresh
+   * profile after an explicit restore. Missing legacy values never clear a
+   * Host-side purge tombstone.
+   */
+  browserProfileRevision: external_exports.number().int().min(0).optional(),
   epoch: external_exports.number().int().min(1),
   /**
    * Host-enforced task authority deadline, when anything forces one.
@@ -16960,7 +17024,18 @@ var TaskAssign = external_exports.object({
      * so protocol-v5 outbox rows and hosts remain parseable during rollout;
      * current clouds always populate it for newly dispatched work.
      */
-    origin: TaskOrigin.pick({ source: true, trust: true }).extend({
+    origin: TaskOrigin.pick({ trust: true }).extend({
+      /**
+       * Trigger classification, kept as a lenient string on the wire on
+       * purpose. The Host uses it for a display label and telemetry only,
+       * never for behavior, while the enum on the durable Task keeps its
+       * closed meaning. Parsing it strictly here made adding one source
+       * (`manager`) a breaking wire change: a Host built against the older
+       * enum failed the whole frame union and dropped `task.assign`
+       * silently, so the work sat Assigned forever with no diagnosis. An
+       * unknown value now degrades to an unlabeled source instead.
+       */
+      source: external_exports.string().min(1).max(64),
       /** Cloud-verified provider source; never inferred from provider-authored text. */
       provider: ProviderKind.optional(),
       /**
@@ -17000,6 +17075,11 @@ var TaskAssign = external_exports.object({
     titleWanted: external_exports.boolean().optional(),
     /** Advisory Ask / Plan / Act snapshot for this attempt (TS-12). */
     interactionMode: InteractionMode.optional(),
+    /**
+     * Browser-dependent placement requirement (BR-7). Additive/optional so
+     * persisted assignments from an older cloud remain parseable.
+     */
+    requiresBrowser: external_exports.boolean().optional(),
     /** Configured workspace selected by the cloud; absence means no repository context. */
     workspace: SafeDisplayPath.optional(),
     /** Verified provider repository selected independently of a local workspace path. */
@@ -17410,6 +17490,12 @@ var BrowserOpenFrame = external_exports.object({
   type: external_exports.literal("browser.open"),
   requestId: external_exports.string().min(1).max(200),
   agentId: AgentId,
+  /**
+   * Cloud-owned browser-profile lifecycle revision. A Host persists the last
+   * purged revision and refuses a stale open, so a delayed frame cannot
+   * recreate an archived teammate's website sessions after cleanup.
+   */
+  profileRevision: external_exports.number().int().min(0).optional(),
   /** Cloud-minted; the host adopts it for the session it opens. */
   browserSessionId: external_exports.string().min(1).max(200),
   viewport: BrowserViewport
@@ -17438,6 +17524,18 @@ var BrowserCommandFrame = external_exports.object({
   browserSessionId: external_exports.string().min(1).max(200),
   command: BrowserCommand
 });
+var BrowserProfilePurge = external_exports.object({
+  type: external_exports.literal("browser.profile.purge"),
+  purgeId: external_exports.uuid(),
+  agentId: AgentId,
+  profileRevision: external_exports.number().int().min(1)
+}).strict();
+var BrowserProfilePurged = external_exports.object({
+  type: external_exports.literal("browser.profile.purged"),
+  purgeId: external_exports.uuid(),
+  agentId: AgentId,
+  profileRevision: external_exports.number().int().min(1)
+}).strict();
 var TaskInput = external_exports.object({
   type: external_exports.literal("task.input"),
   taskId: TaskId,
@@ -17451,7 +17549,8 @@ var DurableDownMessage = external_exports.discriminatedUnion("type", [
   TaskInput,
   SecretsGrant,
   ApprovalDecision,
-  ConnectionsGrant
+  ConnectionsGrant,
+  BrowserProfilePurge
 ]);
 var TaskEvent = external_exports.object({
   type: external_exports.literal("task.event"),
@@ -17604,6 +17703,15 @@ var HelloFrame = external_exports.object({
   protocolVersion: external_exports.number().int(),
   /** Highest outbox seq the host has durably processed; cloud replays after it. */
   cursor: external_exports.number().int().min(0),
+  /**
+   * Bounded, path-validated persistent profile inventory from this Machine.
+   * It migrates profiles created before cloud custody tracking existed.
+   */
+  browserProfileInventory: external_exports.object({
+    agentIds: external_exports.array(AgentId).max(BROWSER_PROFILE_INVENTORY_PAGE_SIZE),
+    /** False keeps conservative legacy migration fencing enabled. */
+    complete: external_exports.boolean()
+  }).strict().optional(),
   /**
    * Exact assignments whose local executors finished unwinding after the
    * prior socket died. Optional for rolling v5 hosts; repeated references are
@@ -17611,6 +17719,11 @@ var HelloFrame = external_exports.object({
    */
   unwoundAssignments: external_exports.array(UnwoundAssignmentRef).max(1e3).optional()
 });
+var BrowserProfileInventoryFrame = external_exports.object({
+  type: external_exports.literal("browser.profile.inventory"),
+  agentIds: external_exports.array(AgentId).max(BROWSER_PROFILE_INVENTORY_PAGE_SIZE),
+  complete: external_exports.boolean()
+}).strict();
 var HelloAckFrame = external_exports.object({
   type: external_exports.literal("helloAck"),
   protocolVersion: external_exports.number().int(),
@@ -17693,6 +17806,7 @@ var PingFrame = external_exports.object({ type: external_exports.literal("ping")
 var PongFrame = external_exports.object({ type: external_exports.literal("pong"), at: external_exports.iso.datetime() });
 var HostToCloudFrame = external_exports.discriminatedUnion("type", [
   HelloFrame,
+  BrowserProfileInventoryFrame,
   AckFrame,
   UpFrame,
   ProviderOperationGrantRequestFrame,
@@ -17700,6 +17814,7 @@ var HostToCloudFrame = external_exports.discriminatedUnion("type", [
   BrowserScreencastFrame,
   BrowserSessionEndedFrame,
   BrowserCredentialRequestFrame,
+  BrowserProfilePurged,
   PingFrame,
   PongFrame
 ]);
@@ -18016,7 +18131,9 @@ var HostRemovalOutcome = external_exports.object({
 });
 var RevokeHostResponse = external_exports.object({
   host: AdminHostProjection,
-  removal: HostRemovalOutcome
+  removal: HostRemovalOutcome,
+  /** False while the paired Host is retained solely to finish profile deletion. */
+  removed: external_exports.boolean()
 });
 var MemberHostProjection = Host.pick({
   id: true,
@@ -18025,6 +18142,7 @@ var MemberHostProjection = Host.pick({
   operatingSystem: true,
   status: true,
   acceptingNewWork: true,
+  profileCleanup: true,
   kind: true,
   lastSeenAt: true,
   telemetryAt: true,
@@ -18553,6 +18671,235 @@ var LinearOAuthPopupMessage = external_exports.discriminatedUnion("ok", [
   LinearOAuthPopupFailure
 ]);
 
+// ../../packages/contracts/src/manager.ts
+var MANAGER_DISPLAY_NAME_MAX = 60;
+var MANAGER_INSTRUCTIONS_MAX = 2e4;
+var CONVERSATION_MESSAGE_MAX = 1e5;
+var CONVERSATION_LIST_LIMIT = 50;
+var ManagerReasoningEffort = external_exports.enum([
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+]);
+var ManagerConfigProjection = external_exports.object({
+  id: ManagerId,
+  /** Shown in the UI and on chat channels; the persona carries the personality (MG-7). */
+  displayName: external_exports.string().min(1).max(MANAGER_DISPLAY_NAME_MAX),
+  /** Appended to the product-owned built-in system prompt; never replaces it. */
+  instructions: external_exports.string().max(MANAGER_INSTRUCTIONS_MAX),
+  model: external_exports.string().min(1).max(100),
+  reasoningEffort: ManagerReasoningEffort,
+  /**
+   * Where the Manager answers on Slack. The workspace bot speaks for the
+   * Manager (MG-1), so the per-teammate mention/DM switches that used to
+   * decide this belong here now — an organization keeps a truthful off
+   * switch for each surface without disconnecting the workspace.
+   */
+  slack: external_exports.object({ answerMentions: external_exports.boolean(), answerDirectMessages: external_exports.boolean() }).strict(),
+  revision: external_exports.number().int().min(0),
+  updatedAt: external_exports.string().nullable()
+}).strict();
+var ManagerMode = external_exports.enum(["openai", "demo", "unconfigured"]);
+var GetManagerResponse = external_exports.object({ manager: ManagerConfigProjection, mode: ManagerMode }).strict();
+var UpdateManagerRequest = external_exports.object({
+  displayName: external_exports.string().min(1).max(MANAGER_DISPLAY_NAME_MAX).optional(),
+  instructions: external_exports.string().max(MANAGER_INSTRUCTIONS_MAX).optional(),
+  model: external_exports.string().min(1).max(100).optional(),
+  reasoningEffort: ManagerReasoningEffort.optional(),
+  slack: external_exports.object({
+    answerMentions: external_exports.boolean().optional(),
+    answerDirectMessages: external_exports.boolean().optional()
+  }).strict().optional(),
+  /** Optimistic concurrency: refuse when another admin saved first. */
+  expectedRevision: external_exports.number().int().min(0).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.displayName === void 0 && value.instructions === void 0 && value.model === void 0 && value.reasoningEffort === void 0 && value.slack === void 0) {
+    ctx.addIssue({ code: "custom", message: "nothing to update" });
+  }
+});
+var ConversationChannel = external_exports.enum(["web", "slack", "whatsapp"]);
+var ConversationStatus = external_exports.enum(["idle", "thinking"]);
+var ConversationProjection = external_exports.object({
+  id: ConversationId,
+  /** First-message prefix until the one creation-time Manager title call settles. */
+  title: external_exports.string().min(1).max(200),
+  channel: ConversationChannel,
+  status: ConversationStatus,
+  /** TS-10 origin trust of the channel; propagated into every delegated Task. */
+  trust: external_exports.enum(["internal", "external"]),
+  /** One-use override for the next Task delegated from this thread. */
+  nextDelegationRunner: TaskRunnerSelection.nullable(),
+  createdAt: external_exports.string(),
+  lastActivityAt: external_exports.string(),
+  /** Archived, but at least one executor has not yet proven it stopped. */
+  archiveState: external_exports.literal("stopping").nullable().optional(),
+  archivedAt: external_exports.string().nullable()
+}).strict().superRefine((conversation, ctx) => {
+  if (conversation.archiveState === "stopping" && conversation.archivedAt === null) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["archivedAt"],
+      message: "a stopping Manager Task must already be in Archived"
+    });
+  }
+});
+var conversationEventBase = {
+  id: ConversationEventId,
+  at: external_exports.string()
+};
+var ConversationEventProjection = external_exports.discriminatedUnion("kind", [
+  /** A human message into the Conversation. */
+  external_exports.object({
+    ...conversationEventBase,
+    kind: external_exports.literal("user"),
+    text: external_exports.string(),
+    /** Display attribution only; authentication subjects remain internal. */
+    author: external_exports.object({ displayName: external_exports.string().nullable() }).strict(),
+    attachments: external_exports.array(TaskAttachmentRef).max(TASK_MESSAGE_MAX_ATTACHMENTS).optional()
+  }).strict(),
+  /** The Manager's prose reply. */
+  external_exports.object({ ...conversationEventBase, kind: external_exports.literal("manager"), text: external_exports.string() }).strict(),
+  /** One Manager tool step: a delegation, follow-up, or status check. */
+  external_exports.object({
+    ...conversationEventBase,
+    kind: external_exports.literal("tool"),
+    tool: external_exports.string(),
+    summary: external_exports.string(),
+    taskId: TaskId.nullable(),
+    agentId: AgentId.nullable()
+  }).strict(),
+  /** A mirrored child-Task event: what the teammate wrote or became. */
+  external_exports.object({
+    ...conversationEventBase,
+    kind: external_exports.literal("task"),
+    taskId: TaskId,
+    agentId: AgentId.nullable(),
+    eventKind: external_exports.enum(["response", "error", "status", "question", "message"]),
+    summary: external_exports.string(),
+    taskStatus: TaskStatus.nullable(),
+    /**
+     * Opaque presentation key shared by the useful report and its synthetic
+     * terminal wake-up. It is never shown to people; clients use it only to
+     * render one outcome when recovery commits those records out of order.
+     * Missing on legacy/non-terminal events.
+     */
+    terminalGroup: external_exports.string().min(1).max(200).nullable().optional()
+  }).strict(),
+  /** A Manager loop failure a person should see (provider outage, refusal). */
+  external_exports.object({ ...conversationEventBase, kind: external_exports.literal("error"), message: external_exports.string() }).strict()
+]);
+var NonEmptyTaskRunnerSelection = TaskRunnerSelection.refine(
+  (selection) => selection.type !== void 0 || selection.model !== void 0 || selection.effort !== void 0,
+  "choose at least one runtime preference"
+);
+var CreateConversationRequest = external_exports.object({
+  /** Stable client-generated key: retrying the same submission returns one Conversation. */
+  requestId: external_exports.uuid(),
+  message: external_exports.string().max(CONVERSATION_MESSAGE_MAX),
+  attachmentIds: external_exports.array(AttachmentId).max(TASK_MESSAGE_MAX_ATTACHMENTS).refine((ids) => new Set(ids).size === ids.length, "duplicate attachment").optional(),
+  /**
+   * Teammate whose persistent Browser is selected beside this web turn.
+   * This is bounded routing context for Browser-directed requests only; it
+   * is never a general delegation preference.
+   */
+  browserAgentId: AgentId.optional(),
+  /**
+   * One-time runtime override for the first Task this thread delegates.
+   * Omission preserves the selected teammate's configured defaults.
+   */
+  initialDelegation: external_exports.object({
+    runner: NonEmptyTaskRunnerSelection
+  }).strict().optional()
+}).strict().superRefine((value, ctx) => {
+  if (!value.message.trim() && !value.attachmentIds?.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["message"],
+      message: "a message needs text or an attachment"
+    });
+  }
+});
+var PostConversationMessageRequest = external_exports.object({
+  /** Stable client-generated key: an ambiguous retry appends exactly once. */
+  requestId: external_exports.uuid(),
+  message: external_exports.string().max(CONVERSATION_MESSAGE_MAX),
+  attachmentIds: external_exports.array(AttachmentId).max(TASK_MESSAGE_MAX_ATTACHMENTS).refine((ids) => new Set(ids).size === ids.length, "duplicate attachment").optional(),
+  /** Selected Manager Browser teammate for Browser-directed requests only. */
+  browserAgentId: AgentId.optional()
+}).strict().superRefine((value, ctx) => {
+  if (!value.message.trim() && !value.attachmentIds?.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["message"],
+      message: "a message needs text or an attachment"
+    });
+  }
+});
+var UpdateNextDelegationRuntimeRequest = external_exports.object({ runner: NonEmptyTaskRunnerSelection.nullable() }).strict();
+var UpdateConversationRequest = external_exports.object({
+  title: external_exports.string().trim().min(1).max(200).optional(),
+  archived: external_exports.boolean().optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.title === void 0 && value.archived === void 0) {
+    ctx.addIssue({ code: "custom", message: "nothing to update" });
+  }
+});
+var ConversationResponse = external_exports.object({ conversation: ConversationProjection }).strict();
+var ListConversationsResponse = external_exports.object({
+  conversations: external_exports.array(ConversationProjection).max(CONVERSATION_LIST_LIMIT),
+  nextCursor: external_exports.string().nullable()
+}).strict();
+var ManagerTaskRailSummariesRequest = external_exports.object({
+  conversationIds: external_exports.array(ConversationId).min(1).max(CONVERSATION_LIST_LIMIT),
+  archived: external_exports.boolean(),
+  agentId: AgentId.optional(),
+  statuses: external_exports.array(TaskStatus).min(1).max(TaskStatus.options.length).optional()
+}).strict().superRefine((value, ctx) => {
+  if (new Set(value.conversationIds).size !== value.conversationIds.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["conversationIds"],
+      message: "conversationIds must be unique"
+    });
+  }
+  if (value.statuses && new Set(value.statuses).size !== value.statuses.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["statuses"],
+      message: "statuses must be unique"
+    });
+  }
+});
+var ManagerTaskRailRepresentative = external_exports.object({
+  id: TaskId,
+  agentId: AgentId,
+  status: TaskStatus,
+  gitSummary: TaskGitSummary.nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+}).strict();
+var ManagerTaskRailSummary = external_exports.object({
+  conversationId: ConversationId,
+  hasChildren: external_exports.boolean(),
+  hasAgentMatch: external_exports.boolean(),
+  hasStatusMatch: external_exports.boolean(),
+  representative: ManagerTaskRailRepresentative.nullable()
+}).strict();
+var ManagerTaskRailSummariesResponse = external_exports.object({ summaries: external_exports.array(ManagerTaskRailSummary).max(CONVERSATION_LIST_LIMIT) }).strict();
+var ConversationDetailResponse = external_exports.object({
+  conversation: ConversationProjection,
+  events: external_exports.array(ConversationEventProjection)
+}).strict();
+var ManagerStreamFrame = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("event"), event: ConversationEventProjection }).strict(),
+  external_exports.object({ type: external_exports.literal("delta"), text: external_exports.string() }).strict(),
+  external_exports.object({ type: external_exports.literal("conversation"), conversation: ConversationProjection }).strict()
+]);
+
 // ../../packages/contracts/src/slack.ts
 var SlackInstallationProjection = external_exports.object({
   id: external_exports.string(),
@@ -19294,7 +19641,7 @@ async function generateTaskTitle(instructions, runner) {
     instructions.slice(0, INSTRUCTIONS_BUDGET),
     "</task_request>"
   ].join("\n");
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const child = spawnCli(
       command,
       [
@@ -19317,7 +19664,7 @@ async function generateTaskTitle(instructions, runner) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve14(value);
+      resolve15(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -19639,11 +19986,11 @@ function createWorkerWatchdogSendDrain() {
         if (completed) return;
         completed = true;
         pending--;
-        if (pending === 0) drained.splice(0).forEach((resolve14) => resolve14());
+        if (pending === 0) drained.splice(0).forEach((resolve15) => resolve15());
       };
     },
     drain: async () => {
-      if (pending > 0) await new Promise((resolve14) => drained.push(resolve14));
+      if (pending > 0) await new Promise((resolve15) => drained.push(resolve15));
     }
   };
 }
@@ -19888,7 +20235,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
   const deadline = Date.parse(retryAt);
   if (!Number.isFinite(deadline) || signal.aborted) return false;
   if (deadline <= Date.now()) return true;
-  return await new Promise((resolve14) => {
+  return await new Promise((resolve15) => {
     let settled = false;
     let timer;
     const finish = (ready) => {
@@ -19896,7 +20243,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
       settled = true;
       if (timer) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve14(ready);
+      resolve15(ready);
     };
     const onAbort = () => finish(false);
     const schedule = () => {
@@ -20164,22 +20511,22 @@ var HostClient = class _HostClient {
     const unwindingAssignments = [...this.activeAssignments.values()];
     for (const cancel of this.cancels.values()) cancel(stopReason);
     for (const entry of this.secretGrants.values()) {
-      for (const resolve14 of entry.resolvers) resolve14({});
+      for (const resolve15 of entry.resolvers) resolve15({});
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.connectionGrants.values()) {
-      for (const resolve14 of entry.resolvers) resolve14([]);
+      for (const resolve15 of entry.resolvers) resolve15([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.providerGrants.values()) {
-      for (const resolve14 of entry.resolvers) resolve14([]);
+      for (const resolve15 of entry.resolvers) resolve15([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const waiters of this.approvalWaiters.values()) {
-      for (const resolve14 of waiters.values()) resolve14({ approved: false, guidance: reason });
+      for (const resolve15 of waiters.values()) resolve15({ approved: false, guidance: reason });
     }
     for (const waiters of this.agentOpWaiters.values()) {
       for (const waiter of waiters.values()) {
@@ -20205,9 +20552,9 @@ var HostClient = class _HostClient {
     let drainTimer;
     const drained = await Promise.race([
       Promise.allSettled(runs).then(() => true),
-      new Promise((resolve14) => {
+      new Promise((resolve15) => {
         drainTimer = setTimeout(
-          () => resolve14(false),
+          () => resolve15(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         drainTimer.unref?.();
@@ -20238,9 +20585,70 @@ var HostClient = class _HostClient {
     let awaitingHeartbeatReply = false;
     let closeReason;
     let frameTail = Promise.resolve();
+    let inventoryRetryTimer;
+    let inventoryRetryAttempts = 0;
+    const inventoryRetryBaseMs = Math.max(20, Number(this.opts.backoffMs ?? 1e3));
     this.ws = ws;
     this.protocolReady = false;
+    const retryInventory = async () => {
+      if (this.stopped || this.ws !== ws || ws.readyState !== WebSocket.OPEN) return;
+      let sawComplete = false;
+      try {
+        const pages = this.opts.browser?.profileInventoryPages?.();
+        if (pages) {
+          for await (const page2 of pages) {
+            if (!this.send(
+              {
+                type: "browser.profile.inventory",
+                agentIds: page2.agentIds,
+                complete: page2.complete
+              },
+              ws
+            )) {
+              return;
+            }
+            sawComplete = page2.complete;
+          }
+        } else {
+          const page2 = await this.opts.browser?.profileInventory?.();
+          if (!page2) return;
+          if (!this.send(
+            {
+              type: "browser.profile.inventory",
+              agentIds: page2.agentIds,
+              complete: page2.complete
+            },
+            ws
+          )) {
+            return;
+          }
+          sawComplete = page2.complete;
+        }
+      } catch {
+        sawComplete = false;
+      }
+      if (sawComplete) {
+        inventoryRetryAttempts = 0;
+      } else {
+        scheduleInventoryRetry();
+      }
+    };
+    function scheduleInventoryRetry() {
+      if (inventoryRetryTimer || ws.readyState !== WebSocket.OPEN) return;
+      const delayMs = Math.min(
+        6e4,
+        inventoryRetryBaseMs * 2 ** Math.min(inventoryRetryAttempts++, 6)
+      );
+      inventoryRetryTimer = setTimeout(() => {
+        inventoryRetryTimer = void 0;
+        void retryInventory();
+      }, delayMs);
+      inventoryRetryTimer.unref?.();
+    }
     ws.on("open", () => {
+      const inventoryConfigured = Boolean(
+        this.opts.browser?.profileInventoryPages || this.opts.browser?.profileInventory
+      );
       const unwoundAssignments = [...this.pendingUnwoundAssignments.values()].sort(
         (left, right) => left.taskId === right.taskId ? left.epoch - right.epoch : left.taskId.localeCompare(right.taskId)
       );
@@ -20249,6 +20657,7 @@ var HostClient = class _HostClient {
           type: "hello",
           protocolVersion: PROTOCOL_VERSION,
           cursor: this.cursor,
+          ...inventoryConfigured ? { browserProfileInventory: { agentIds: [], complete: false } } : {},
           ...unwoundAssignments.length > 0 ? { unwoundAssignments } : {}
         },
         ws
@@ -20265,6 +20674,7 @@ var HostClient = class _HostClient {
         this.send({ type: "ping", at: (/* @__PURE__ */ new Date()).toISOString() });
         void this.reportTelemetry();
       }, heartbeatMs);
+      if (inventoryConfigured) void retryInventory();
     });
     ws.on("message", (raw) => {
       if (this.ws !== ws) return;
@@ -20274,6 +20684,7 @@ var HostClient = class _HostClient {
       });
     });
     ws.on("close", (code) => {
+      if (inventoryRetryTimer) clearTimeout(inventoryRetryTimer);
       void this.handleClose(ws, code, closeReason, frameTail);
     });
     ws.on("error", () => {
@@ -20287,9 +20698,9 @@ var HostClient = class _HostClient {
     let frameDrainTimer;
     const framesDrained = await Promise.race([
       frameTail.then(() => true),
-      new Promise((resolve14) => {
+      new Promise((resolve15) => {
         frameDrainTimer = setTimeout(
-          () => resolve14(false),
+          () => resolve15(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         frameDrainTimer.unref?.();
@@ -20666,7 +21077,13 @@ var HostClient = class _HostClient {
       case "browser.open": {
         const bridge = this.opts.browser;
         if (!bridge) return;
-        void bridge.open(frame.agentId, frame.browserSessionId, frame.viewport, frame.requestId).catch(() => {
+        void bridge.open(
+          frame.agentId,
+          frame.browserSessionId,
+          frame.viewport,
+          frame.requestId,
+          frame.profileRevision
+        ).catch(() => {
           this.sendBrowserFrame({
             type: "browser.session.ended",
             browserSessionId: frame.browserSessionId,
@@ -20677,7 +21094,8 @@ var HostClient = class _HostClient {
         return;
       }
       case "browser.close":
-        void this.opts.browser?.close(frame.agentId, "stopped");
+        void this.opts.browser?.close(frame.agentId, "stopped").catch(() => {
+        });
         return;
       case "browser.view":
         void this.opts.browser?.setViewers(frame.agentId, frame.active, frame.viewerCount);
@@ -20778,8 +21196,34 @@ var HostClient = class _HostClient {
   async handleMessage(message) {
     switch (message.type) {
       case "task.assign":
+        if (message.browserProfileRevision !== void 0) {
+          try {
+            await this.opts.browser?.authorizeProfile?.(
+              message.agentId,
+              message.browserProfileRevision
+            );
+          } catch {
+          }
+        }
         this.startTask(message);
         return;
+      case "browser.profile.purge": {
+        const browser = this.opts.browser;
+        void (async () => {
+          try {
+            if (!browser?.purge) return;
+            await browser.purge(message.agentId, message.purgeId, message.profileRevision);
+            this.send({
+              type: "browser.profile.purged",
+              purgeId: message.purgeId,
+              agentId: message.agentId,
+              profileRevision: message.profileRevision
+            });
+          } catch {
+          }
+        })();
+        return;
+      }
       case "task.cancel":
         this.cancels.get(`${message.taskId}:${message.epoch}`)?.(
           message.purpose === "credential_rollover" ? "credential_rollover" : "cloud_cancel"
@@ -20800,7 +21244,7 @@ var HostClient = class _HostClient {
         const entry = this.secretGrants.get(key) ?? { resolvers: [] };
         entry.value = message.secrets;
         entry.expiresAt = expiresAt;
-        for (const resolve14 of entry.resolvers) resolve14(message.secrets);
+        for (const resolve15 of entry.resolvers) resolve15(message.secrets);
         entry.resolvers = [];
         this.secretGrants.set(key, entry);
         return;
@@ -20831,13 +21275,13 @@ var HostClient = class _HostClient {
         const entry = this.connectionGrants.get(key) ?? { resolvers: [] };
         entry.value = message.connections;
         entry.expiresAt = expiresAt;
-        for (const resolve14 of entry.resolvers) resolve14(message.connections);
+        for (const resolve15 of entry.resolvers) resolve15(message.connections);
         entry.resolvers = [];
         this.connectionGrants.set(key, entry);
         const providerEntry = this.providerGrants.get(key) ?? { resolvers: [] };
         providerEntry.value = providers;
         providerEntry.expiresAt = authorityExpiresAt;
-        for (const resolve14 of providerEntry.resolvers) resolve14(providers);
+        for (const resolve15 of providerEntry.resolvers) resolve15(providers);
         providerEntry.resolvers = [];
         this.providerGrants.set(key, providerEntry);
         return;
@@ -20971,8 +21415,8 @@ var HostClient = class _HostClient {
       return redactCredentialText(text, sensitiveSnapshot()).slice(0, maxLength);
     };
     let resolveCancelled;
-    const cancelledPromise = new Promise((resolve14) => {
-      resolveCancelled = resolve14;
+    const cancelledPromise = new Promise((resolve15) => {
+      resolveCancelled = resolve15;
     });
     const endAuthority = (reason = "cloud_cancel") => {
       if (stopReason) return;
@@ -20981,21 +21425,21 @@ var HostClient = class _HostClient {
       authorityController.abort(reason);
       const secretEntry = this.secretGrants.get(cancelKey);
       if (secretEntry) {
-        for (const resolve14 of secretEntry.resolvers) resolve14({});
+        for (const resolve15 of secretEntry.resolvers) resolve15({});
         secretEntry.resolvers = [];
         delete secretEntry.value;
       }
       this.secretGrants.delete(cancelKey);
       const connectionEntry = this.connectionGrants.get(cancelKey);
       if (connectionEntry) {
-        for (const resolve14 of connectionEntry.resolvers) resolve14([]);
+        for (const resolve15 of connectionEntry.resolvers) resolve15([]);
         connectionEntry.resolvers = [];
         delete connectionEntry.value;
       }
       this.connectionGrants.delete(cancelKey);
       const providerEntry = this.providerGrants.get(cancelKey);
       if (providerEntry) {
-        for (const resolve14 of providerEntry.resolvers) resolve14([]);
+        for (const resolve15 of providerEntry.resolvers) resolve15([]);
         providerEntry.resolvers = [];
         delete providerEntry.value;
       }
@@ -21003,8 +21447,8 @@ var HostClient = class _HostClient {
       this.clearAuthorityExpiry(cancelKey);
       const approvalWaiters = this.approvalWaiters.get(cancelKey);
       if (approvalWaiters) {
-        for (const resolve14 of approvalWaiters.values()) {
-          resolve14({ approved: false, guidance: "task was cancelled" });
+        for (const resolve15 of approvalWaiters.values()) {
+          resolve15({ approved: false, guidance: "task was cancelled" });
         }
         approvalWaiters.clear();
       }
@@ -21130,9 +21574,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve14) => {
-        entry.resolvers.push((value) => resolve14(capture(value)));
-        setTimeout(() => resolve14(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve15) => {
+        entry.resolvers.push((value) => resolve15(capture(value)));
+        setTimeout(() => resolve15(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const connections = () => {
@@ -21149,9 +21593,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve14) => {
-        entry.resolvers.push((value) => resolve14(capture(value)));
-        setTimeout(() => resolve14(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve15) => {
+        entry.resolvers.push((value) => resolve15(capture(value)));
+        setTimeout(() => resolve15(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const providers = () => {
@@ -21168,9 +21612,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value !== void 0) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve14) => {
-        entry.resolvers.push((value) => resolve14(capture(value)));
-        setTimeout(() => resolve14(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve15) => {
+        entry.resolvers.push((value) => resolve15(capture(value)));
+        setTimeout(() => resolve15(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const linear = async () => {
@@ -21196,13 +21640,13 @@ var HostClient = class _HostClient {
         payload: safe(payload, 5e4),
         ...questionChoices ? { questionChoices: [...questionChoices] } : {}
       });
-      return new Promise((resolve14) => {
+      return new Promise((resolve15) => {
         const waiters = this.approvalWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.approvalWaiters.set(cancelKey, waiters);
-        waiters.set(requestId, resolve14);
+        waiters.set(requestId, resolve15);
         void cancelledPromise.then(() => {
           if (waiters.delete(requestId)) {
-            resolve14({ approved: false, guidance: "task was cancelled" });
+            resolve15({ approved: false, guidance: "task was cancelled" });
           }
         });
       });
@@ -21240,11 +21684,11 @@ var HostClient = class _HostClient {
         if (existing) message = existing;
         else terminalMessages.set(requestId, message);
       }
-      return new Promise((resolve14) => {
+      return new Promise((resolve15) => {
         const waiters = this.agentOpWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.agentOpWaiters.set(cancelKey, waiters);
         if (waiters.has(requestId)) {
-          resolve14({ ok: false, error: "provider settlement request is already in flight" });
+          resolve15({ ok: false, error: "provider settlement request is already in flight" });
           return;
         }
         const timer = setTimeout(() => {
@@ -21255,7 +21699,7 @@ var HostClient = class _HostClient {
                 (pending) => !(pending.type === "agent.op" && pending.requestId === requestId)
               );
             }
-            resolve14({
+            resolve15({
               ok: false,
               error: terminal ? "The provider call completed, but Zixt could not record its outcome. Do not retry; wait for reconciliation." : "the platform did not answer in time; verify with a list_* tool before retrying a mutating call"
             });
@@ -21263,7 +21707,7 @@ var HostClient = class _HostClient {
         }, _HostClient.AGENT_OP_TIMEOUT_MS);
         timer.unref?.();
         waiters.set(requestId, {
-          resolve: resolve14,
+          resolve: resolve15,
           timer,
           ...terminal ? { terminalMessage: message } : {}
         });
@@ -21309,12 +21753,12 @@ var HostClient = class _HostClient {
             "No GitHub change was attempted; the authority grant request was invalid."
           );
         }
-        const outcome = await new Promise((resolve14) => {
+        const outcome = await new Promise((resolve15) => {
           const timer = setTimeout(() => {
             const waiter = this.operationGrantWaiters.get(requestId);
             if (!waiter) return;
             this.operationGrantWaiters.delete(requestId);
-            resolve14({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
+            resolve15({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
           }, this.operationGrantTimeoutMs);
           timer.unref?.();
           this.operationGrantWaiters.set(requestId, {
@@ -21327,9 +21771,9 @@ var HostClient = class _HostClient {
             timer,
             accept: (grant) => {
               addSensitiveValues(providerGrantSensitiveValues(grant));
-              resolve14({ grant });
+              resolve15({ grant });
             },
-            deny: (retryable, reason, detail, retryAt, retryCode) => resolve14({
+            deny: (retryable, reason, detail, retryAt, retryCode) => resolve15({
               grant: null,
               retryable,
               reason,
@@ -21343,7 +21787,7 @@ var HostClient = class _HostClient {
           } catch {
             clearTimeout(timer);
             this.operationGrantWaiters.delete(requestId);
-            resolve14({ grant: null, retryable: false, reason: "connection_unavailable" });
+            resolve15({ grant: null, retryable: false, reason: "connection_unavailable" });
           }
         });
         if (outcome.grant) {
@@ -21399,7 +21843,7 @@ var HostClient = class _HostClient {
           )
         );
       }
-      return new Promise((resolve14, reject3) => {
+      return new Promise((resolve15, reject3) => {
         const timer = setTimeout(() => {
           if (this.browserCredentialWaiters.delete(requestId)) {
             reject3(
@@ -21418,7 +21862,7 @@ var HostClient = class _HostClient {
           timer,
           accept: (credential) => {
             addSensitiveValues(webLoginSensitiveValues(credential));
-            resolve14(credential);
+            resolve15(credential);
           },
           deny: (reason) => reject3(new Error(reason))
         });
@@ -21724,6 +22168,9 @@ var ProcessTreeTerminationError = class extends Error {
   }
   name = "ProcessTreeTerminationError";
 };
+function posixIdentityReadMeansMissing(error52) {
+  return ["ENOENT", "ESRCH"].includes(error52.code ?? "");
+}
 function commandContainsNonce(command, nonce) {
   const escaped = nonce.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`(?:^|[\\s"'])${escaped}(?:$|[\\s"'])`).test(command);
@@ -21736,14 +22183,14 @@ async function observeWindowsGuardianNonce(pid, nonce) {
       "Windows runner identity could not be observed"
     );
   }
-  return new Promise((resolve14, reject3) => {
+  return new Promise((resolve15, reject3) => {
     let done = false;
     const finish = (result) => {
       if (done) return;
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve14(result);
+      else resolve15(result);
     };
     const timeout = setTimeout(
       () => finish(
@@ -21781,14 +22228,14 @@ async function observePosixGuardianNonce(pid, nonce) {
       const args = command.toString("utf8").split("\0");
       return args.includes(nonce) ? "match" : "mismatch";
     } catch (error52) {
-      if (error52.code === "ENOENT") return "missing";
+      if (posixIdentityReadMeansMissing(error52)) return "missing";
       throw new ProcessTreeTerminationError(
         "state_unknown",
         "POSIX runner identity could not be observed"
       );
     }
   }
-  return new Promise((resolve14, reject3) => {
+  return new Promise((resolve15, reject3) => {
     const observer = spawn2("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -21799,7 +22246,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve14(result);
+      else resolve15(result);
     };
     const timeout = setTimeout(() => {
       observer.kill("SIGKILL");
@@ -21846,7 +22293,7 @@ async function observeGuardianIdentity(pid, identity) {
   return process.platform === "win32" ? observeWindowsGuardianNonce(pid, identity.nonce) : observePosixGuardianNonce(pid, identity.nonce);
 }
 function delay(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 function posixProcessRecordsFromPs(output) {
   const records = [];
@@ -21879,7 +22326,7 @@ function posixProcessRecordsFromPs(output) {
   return records;
 }
 async function snapshotPosixProcesses() {
-  return new Promise((resolve14, reject3) => {
+  return new Promise((resolve15, reject3) => {
     const observer = spawn2("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -21892,7 +22339,7 @@ async function snapshotPosixProcesses() {
       if (error52) reject3(error52);
       else {
         try {
-          resolve14(posixProcessRecordsFromPs(output));
+          resolve15(posixProcessRecordsFromPs(output));
         } catch (caught) {
           reject3(caught);
         }
@@ -22227,7 +22674,7 @@ async function snapshotWindowsDescendants(rootPid) {
       "Windows process-tree observation could not start"
     );
   }
-  return new Promise((resolve14, reject3) => {
+  return new Promise((resolve15, reject3) => {
     let done = false;
     const timeout = setTimeout(() => {
       if (done) return;
@@ -22254,7 +22701,7 @@ async function snapshotWindowsDescendants(rootPid) {
         return;
       }
       try {
-        resolve14(completeWindowsDescendantPids(rootPid, processes));
+        resolve15(completeWindowsDescendantPids(rootPid, processes));
       } catch (caught) {
         reject3(caught);
       }
@@ -22301,7 +22748,7 @@ async function waitForProcessesExit(pids, timeoutMs) {
 }
 async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, independentlyTrackedPids = []) {
   const trustedCommand = command ?? defaultTaskkillCommand();
-  const result = await new Promise((resolve14, reject3) => {
+  const result = await new Promise((resolve15, reject3) => {
     const killer = spawn2(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -22336,7 +22783,7 @@ async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, indepe
       done = true;
       clearTimeout(timeout);
       if (error52) reject3(error52);
-      else resolve14({ code: killer.exitCode, output, outputTruncated });
+      else resolve15({ code: killer.exitCode, output, outputTruncated });
     };
     killer.once(
       "error",
@@ -23013,12 +23460,12 @@ async function createWindowsJobContainment(pid, options) {
     stderr = `${stderr}${String(chunk)}`.slice(-HELPER_OUTPUT_LIMIT);
   });
   const helperEvents = helper;
-  const exited = new Promise((resolve14) => {
+  const exited = new Promise((resolve15) => {
     let completed = false;
     const complete = (code, signal) => {
       if (completed) return;
       completed = true;
-      resolve14({ code, signal });
+      resolve15({ code, signal });
     };
     helperEvents.once("error", () => {
       failProtocol(new Error("Windows Job Object helper could not start"));
@@ -23031,7 +23478,7 @@ async function createWindowsJobContainment(pid, options) {
   });
   const nextLine = async (expected) => {
     if (protocolFailure) throw protocolFailure;
-    const line = lines.shift() ?? await new Promise((resolve14, reject3) => {
+    const line = lines.shift() ?? await new Promise((resolve15, reject3) => {
       const timer = setTimeout(
         () => reject3(timeoutError("Windows Job Object helper did not answer in time")),
         timeoutMs
@@ -23039,7 +23486,7 @@ async function createWindowsJobContainment(pid, options) {
       timer.unref?.();
       lineWaiters.push((value) => {
         clearTimeout(timer);
-        resolve14(value);
+        resolve15(value);
       });
     });
     if (protocolFailure) throw protocolFailure;
@@ -23052,8 +23499,8 @@ async function createWindowsJobContainment(pid, options) {
     }
     const stopped = await Promise.race([
       exited.then(() => true),
-      new Promise((resolve14) => {
-        const timer = setTimeout(() => resolve14(false), timeoutMs);
+      new Promise((resolve15) => {
+        const timer = setTimeout(() => resolve15(false), timeoutMs);
         timer.unref?.();
       })
     ]);
@@ -23112,7 +23559,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
   if (nonce === void 0) return true;
   if (!SAFE_NONCE2.test(nonce)) return false;
   const expected = windowsContainmentGate(nonce).trimEnd();
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     let pending = Buffer.alloc(0);
     let settled = false;
     const finish = (result) => {
@@ -23123,7 +23570,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       input.off("end", onEnd);
       input.off("error", onEnd);
       if (result) input.pause();
-      resolve14(result);
+      resolve15(result);
     };
     const onData = (chunk) => {
       pending = Buffer.concat([pending, chunk]);
@@ -23548,7 +23995,7 @@ async function installRelease(version2, options = {}) {
     installerContainmentSetupError = error52;
     return null;
   }) : Promise.resolve(null);
-  const installed = await new Promise((resolve14, reject3) => {
+  const installed = await new Promise((resolve15, reject3) => {
     let finished = false;
     let cleanupStarted = false;
     let exitObserved = false;
@@ -23564,7 +24011,7 @@ async function installRelease(version2, options = {}) {
       finished = true;
       clearTimeout(timer);
       options.signal?.removeEventListener("abort", requestCleanup);
-      resolve14(result);
+      resolve15(result);
     };
     const requestCleanup = () => {
       if (cleanupStarted || finished) return;
@@ -23877,11 +24324,11 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   child.stdin?.on("error", () => {
   });
   process.stdin.pipe(child.stdin);
-  return new Promise((resolve14) => {
-    child.once("error", () => resolve14(1));
+  return new Promise((resolve15) => {
+    child.once("error", () => resolve15(1));
     child.once("exit", (code) => {
       process.stdin.unpipe(child.stdin);
-      resolve14(code ?? 1);
+      resolve15(code ?? 1);
     });
   });
 }
@@ -23959,11 +24406,11 @@ async function launchHostSupervisor(options = {}) {
   const waitOrStop = async (ms) => {
     if (stopping) return false;
     if (!customDelay) {
-      await new Promise((resolve14) => {
+      await new Promise((resolve15) => {
         const finish = () => {
           clearTimeout(timer);
           stopController.signal.removeEventListener("abort", finish);
-          resolve14();
+          resolve15();
         };
         const timer = setTimeout(finish, ms);
         stopController.signal.addEventListener("abort", finish, { once: true });
@@ -23971,8 +24418,8 @@ async function launchHostSupervisor(options = {}) {
       return !stopping;
     }
     let finishStop;
-    const stopped = new Promise((resolve14) => {
-      finishStop = () => resolve14();
+    const stopped = new Promise((resolve15) => {
+      finishStop = () => resolve15();
       stopController.signal.addEventListener("abort", finishStop, { once: true });
     });
     await Promise.race([customDelay(ms), stopped]);
@@ -24095,19 +24542,19 @@ async function launchHostSupervisor(options = {}) {
       child = spawnSupervisor(entry, version2, ownershipDirectory, containmentGateNonce);
       const launchedSupervisor = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve14) => {
-        resolveChildExited = resolve14;
+      const childExited = new Promise((resolve15) => {
+        resolveChildExited = resolve15;
       });
       const supervisorContainmentAbort = new AbortController();
       void childExited.then(() => supervisorContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve14) => {
+        (resolve15) => {
           let observed = false;
           const finish = (code, signal) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve14({ code, signal });
+            resolve15({ code, signal });
           };
           child.once("error", () => finish(1, null));
           child.once("exit", finish);
@@ -24128,12 +24575,12 @@ async function launchHostSupervisor(options = {}) {
           if (!supervisorContainment || !launchedSupervisor.stdin) {
             throw new Error("supervisor Job Object gate is unavailable");
           }
-          await new Promise((resolve14, reject3) => {
+          await new Promise((resolve15, reject3) => {
             launchedSupervisor.stdin.write(
               windowsContainmentGate(containmentGateNonce),
               (error52) => {
                 if (error52) reject3(error52);
-                else resolve14();
+                else resolve15();
               }
             );
           });
@@ -24275,18 +24722,18 @@ async function superviseHost(options = {}) {
     }
   }
   let announceShutdown;
-  const shutdownAnnounced = new Promise((resolve14) => {
-    announceShutdown = resolve14;
+  const shutdownAnnounced = new Promise((resolve15) => {
+    announceShutdown = resolve15;
   });
   const attempted = /* @__PURE__ */ new Set();
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
-      await new Promise((resolve14) => {
+      await new Promise((resolve15) => {
         const finish = () => {
           clearTimeout(timer);
           shutdownController.signal.removeEventListener("abort", finish);
-          resolve14();
+          resolve15();
         };
         const timer = setTimeout(finish, ms);
         shutdownController.signal.addEventListener("abort", finish, { once: true });
@@ -24429,19 +24876,19 @@ async function superviseHost(options = {}) {
       child = spawnWorker(command, watchdogLaunch, compatibilityOwnership, containmentGateNonce);
       const watchedChild = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve14) => {
-        resolveChildExited = resolve14;
+      const childExited = new Promise((resolve15) => {
+        resolveChildExited = resolve15;
       });
       const workerContainmentAbort = new AbortController();
       void childExited.then(() => workerContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve14) => {
+        (resolve15) => {
           let observed = false;
           const finish = (result) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve14(result);
+            resolve15(result);
           };
           watchedChild.once("error", () => finish({ code: 1, signal: null }));
           watchedChild.once(
@@ -24463,10 +24910,10 @@ async function superviseHost(options = {}) {
           if (!workerContainment || !watchedChild.stdin) {
             throw new Error("worker Job Object gate is unavailable");
           }
-          await new Promise((resolve14, reject3) => {
+          await new Promise((resolve15, reject3) => {
             watchedChild.stdin.write(windowsContainmentGate(containmentGateNonce), (error52) => {
               if (error52) reject3(error52);
-              else resolve14();
+              else resolve15();
             });
           });
         }
@@ -24733,6 +25180,20 @@ async function superviseHost(options = {}) {
 import { hostname as hostname3 } from "node:os";
 
 // src/browser/adapter.ts
+var BROWSER_LOGIN_ORIGIN_CHANGED = "No sign-in was attempted: the browser left the approved sign-in site. Return to that site and try again.";
+function requireBrowserLoginOrigin(currentUrl, loginUrl) {
+  try {
+    const current = new URL(currentUrl);
+    const expected = new URL(loginUrl);
+    const currentIsWeb = current.protocol === "https:" || current.protocol === "http:";
+    const expectedIsWeb = expected.protocol === "https:" || expected.protocol === "http:";
+    if (currentIsWeb && expectedIsWeb && current.origin === expected.origin) {
+      return expected.origin;
+    }
+  } catch {
+  }
+  throw new Error(BROWSER_LOGIN_ORIGIN_CHANGED);
+}
 var DEMO_FRAME_JPEG_BASE64 = "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAIAAgDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iiigD//2Q==";
 function createDemoBrowserAdapterFactory() {
   return {
@@ -24882,6 +25343,7 @@ function createDemoBrowserAdapterFactory() {
           return frame();
         },
         async fillLogin(credential) {
+          requireBrowserLoginOrigin(active().url, credential.loginUrl);
           const landedUrl = new URL("/account", credential.loginUrl).toString();
           const tab = active();
           tab.url = landedUrl;
@@ -24904,9 +25366,9 @@ function createDemoBrowserAdapterFactory() {
 }
 
 // src/browser/manager.ts
-import { mkdir as mkdir4 } from "node:fs/promises";
+import { lstat as lstat4, mkdir as mkdir4, open as open4, opendir, readFile as readFile5, rename as rename3, rm as rm4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 var SAFE_SEGMENT = /^[A-Za-z0-9_-]{1,200}$/;
 var FRAME_MIN_INTERVAL_MS = 100;
 var IDLE_TIMEOUT_MS = 15 * 6e4;
@@ -24914,18 +25376,34 @@ var BrowserManager = class {
   constructor(opts) {
     this.opts = opts;
     this.profileRoot = opts.profileRoot ?? join7(homedir2(), ".zixt", "browser-profiles");
+    this.profileStateRoot = join7(this.profileRoot, ".profile-state");
     this.viewport = opts.viewport ?? BROWSER_DEFAULT_VIEWPORT;
     this.idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
     this.frameMinIntervalMs = opts.frameMinIntervalMs ?? FRAME_MIN_INTERVAL_MS;
+    this.profileInventoryLimit = Math.max(
+      1,
+      Math.min(
+        BROWSER_PROFILE_INVENTORY_PAGE_SIZE,
+        Math.trunc(opts.profileInventoryLimit ?? BROWSER_PROFILE_INVENTORY_PAGE_SIZE)
+      )
+    );
   }
   sessions = /* @__PURE__ */ new Map();
+  /**
+   * Fail closed after lifecycle authorization could not be durably checked or
+   * written. Non-browser runner work may continue, but no local Browser can
+   * open until a later trusted revision is successfully authorized.
+   */
+  deniedAuthorizations = /* @__PURE__ */ new Map();
   /** Serializes open/close per teammate: one profile allows one live browser. */
   locks = /* @__PURE__ */ new Map();
   events = null;
   profileRoot;
+  profileStateRoot;
   viewport;
   idleTimeoutMs;
   frameMinIntervalMs;
+  profileInventoryLimit;
   /**
    * Wired once by the host client; replaces any prior socket generation's
    * sink. Attaching re-announces every live session, because the cloud keeps
@@ -24942,6 +25420,31 @@ var BrowserManager = class {
   capability() {
     return this.opts.factory.capability();
   }
+  /**
+   * Page a path-validated migration inventory without holding an unbounded
+   * directory in memory. A final `complete: true` page is emitted even when
+   * the directory contains an exact multiple of the page size.
+   */
+  async *profileInventoryPages() {
+    await this.ensureOwnedDirectory(this.profileRoot);
+    const agentIds = [];
+    const directory = await opendir(this.profileRoot);
+    for await (const entry of directory) {
+      if (!entry.isDirectory() || entry.isSymbolicLink() || !AgentId.safeParse(entry.name).success) {
+        continue;
+      }
+      if (agentIds.length === this.profileInventoryLimit) {
+        yield { agentIds: agentIds.splice(0).sort(), complete: false };
+      }
+      agentIds.push(entry.name);
+    }
+    yield { agentIds: agentIds.sort(), complete: true };
+  }
+  /** First bounded page retained for embedders that have not adopted continuations. */
+  async profileInventory() {
+    const first = await this.profileInventoryPages().next();
+    return first.value ?? { agentIds: [], complete: true };
+  }
   sessionState(agentId) {
     const session = this.sessions.get(agentId);
     return session && !session.closed ? this.stateOf(session) : null;
@@ -24957,6 +25460,122 @@ var BrowserManager = class {
     );
     return next;
   }
+  validateAgentId(agentId) {
+    if (!SAFE_SEGMENT.test(agentId) || !AgentId.safeParse(agentId).success) {
+      throw new Error("invalid agent id for a browser profile path");
+    }
+  }
+  exactChild(root, child) {
+    const canonicalRoot = resolve4(root);
+    const target = resolve4(canonicalRoot, child);
+    if (dirname4(target) !== canonicalRoot) {
+      throw new Error("browser profile path escaped its owned root");
+    }
+    return target;
+  }
+  async ensureOwnedDirectory(path) {
+    await mkdir4(path, { recursive: true, mode: 448 });
+    const stat3 = await lstat4(path);
+    if (!stat3.isDirectory() || stat3.isSymbolicLink()) {
+      throw new Error("browser profile root must be an owned directory, not a symbolic link");
+    }
+  }
+  /**
+   * POSIX needs directory fsync for a rename/unlink to survive sudden power
+   * loss. Windows does not support opening directories this way, so only its
+   * unsupported-operation errors are tolerated; file fsync still remains
+   * mandatory on every platform.
+   */
+  async syncDirectory(path) {
+    try {
+      const directory = await open4(path, "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    } catch (error52) {
+      const code = error52.code;
+      if (process.platform === "win32" && (code === "EISDIR" || code === "EACCES" || code === "EPERM" || code === "EINVAL" || code === "ENOTSUP")) {
+        return;
+      }
+      throw error52;
+    }
+  }
+  profilePath(agentId) {
+    return this.exactChild(this.profileRoot, agentId);
+  }
+  statePath(agentId) {
+    return this.exactChild(this.profileStateRoot, `${agentId}.json`);
+  }
+  async readProfileState(agentId) {
+    try {
+      const raw = JSON.parse(await readFile5(this.statePath(agentId), "utf8"));
+      if (typeof raw !== "object" || raw === null || !Number.isInteger(raw.revision) || Number(raw.revision) < 0 || !["allowed", "purged"].includes(String(raw.state))) {
+        throw new Error("browser profile lifecycle marker is invalid");
+      }
+      return raw;
+    } catch (error52) {
+      if (error52.code === "ENOENT") return null;
+      throw error52;
+    }
+  }
+  async writeProfileState(agentId, state) {
+    await this.ensureOwnedDirectory(this.profileRoot);
+    await this.ensureOwnedDirectory(this.profileStateRoot);
+    const destination = this.statePath(agentId);
+    const temporary = this.exactChild(
+      this.profileStateRoot,
+      `${agentId}.${crypto.randomUUID()}.tmp`
+    );
+    try {
+      const marker = await open4(temporary, "wx+", 384);
+      try {
+        await marker.writeFile(JSON.stringify(state), "utf8");
+        await marker.sync();
+      } finally {
+        await marker.close();
+      }
+      await rename3(temporary, destination);
+      await this.syncDirectory(this.profileStateRoot);
+      await this.syncDirectory(this.profileRoot);
+    } catch (error52) {
+      await rm4(temporary, { force: true }).catch(() => {
+      });
+      throw error52;
+    }
+  }
+  /** Trusted cloud lifecycle authorization after an explicit restore/current assignment. */
+  async authorizeProfile(agentId, revision) {
+    this.validateAgentId(agentId);
+    if (!Number.isInteger(revision) || revision < 0) {
+      throw new Error("invalid browser profile lifecycle revision");
+    }
+    try {
+      await this.withLock(agentId, async () => {
+        const current = await this.readProfileState(agentId);
+        if (current && current.revision > revision) {
+          throw new Error("stale browser profile authorization was refused");
+        }
+        if (current?.state === "purged" && current.revision === revision) {
+          throw new Error("this browser profile remains retired until the AI teammate is restored");
+        }
+        if (!current || current.revision < revision || current.state !== "allowed") {
+          await this.writeProfileState(agentId, { revision, state: "allowed" });
+        }
+      });
+      const deniedRevision = this.deniedAuthorizations.get(agentId);
+      if (deniedRevision !== void 0 && revision >= deniedRevision) {
+        this.deniedAuthorizations.delete(agentId);
+      }
+    } catch (error52) {
+      this.deniedAuthorizations.set(
+        agentId,
+        Math.max(revision, this.deniedAuthorizations.get(agentId) ?? revision)
+      );
+      throw error52;
+    }
+  }
   /**
    * Ensure a live session for this teammate. An existing session is adopted
    * as-is (the cloud-minted id loses to the live one — the cloud reconciles
@@ -24964,16 +25583,39 @@ var BrowserManager = class {
    * with the install remedy.
    */
   ensure(agentId, browserSessionId) {
-    if (!SAFE_SEGMENT.test(agentId)) {
-      return Promise.reject(new Error("invalid agent id for a browser profile path"));
+    try {
+      this.validateAgentId(agentId);
+    } catch (error52) {
+      return Promise.reject(error52);
     }
     return this.withLock(agentId, async () => {
+      if (this.deniedAuthorizations.has(agentId)) {
+        throw new Error(
+          "this browser profile is unavailable until its lifecycle authorization succeeds"
+        );
+      }
+      const lifecycle = await this.readProfileState(agentId);
+      if (lifecycle?.state === "purged") {
+        throw new Error("this browser profile was retired and cannot be recreated locally");
+      }
       const existing = this.sessions.get(agentId);
+      if (existing?.closeFailed) {
+        throw new Error("the previous browser termination is not yet confirmed");
+      }
       if (existing && !existing.closed) {
         this.markActivity(agentId);
         return this.stateOf(existing);
       }
-      const profileDir = join7(this.profileRoot, agentId);
+      await this.ensureOwnedDirectory(this.profileRoot);
+      const profileDir = this.profilePath(agentId);
+      try {
+        const existingProfile = await lstat4(profileDir);
+        if (existingProfile.isSymbolicLink() || !existingProfile.isDirectory()) {
+          throw new Error("browser profile path is not an owned directory");
+        }
+      } catch (error52) {
+        if (error52.code !== "ENOENT") throw error52;
+      }
       await mkdir4(profileDir, { recursive: true, mode: 448 });
       const adapter = await this.opts.factory.open({
         agentId,
@@ -24994,7 +25636,8 @@ var BrowserManager = class {
         framesPaused: false,
         inputQueue: Promise.resolve(),
         resizeGeneration: 0,
-        closed: false
+        closed: false,
+        closeFailed: false
       };
       this.sessions.set(agentId, session);
       adapter.onStateChanged(() => {
@@ -25006,7 +25649,8 @@ var BrowserManager = class {
     });
   }
   /** browser.open handler: ensure, then announce with the request correlation. */
-  async open(agentId, browserSessionId, _viewport, openRequestId) {
+  async open(agentId, browserSessionId, _viewport, openRequestId, profileRevision) {
+    if (profileRevision !== void 0) await this.authorizeProfile(agentId, profileRevision);
     const state = await this.ensure(agentId, browserSessionId);
     this.events?.state(state, openRequestId);
     return state;
@@ -25016,18 +25660,45 @@ var BrowserManager = class {
   }
   async closeLocked(agentId, reason) {
     const session = this.sessions.get(agentId);
-    if (!session || session.closed) return;
+    if (!session || session.closed && !session.closeFailed) return;
     session.closed = true;
+    session.closeFailed = false;
     if (session.frameTimer) clearTimeout(session.frameTimer);
     if (session.idleTimer) clearTimeout(session.idleTimer);
-    this.sessions.delete(agentId);
     try {
-      await session.adapter.setFrameSink(null);
+      await session.adapter.setFrameSink(null).catch(() => {
+      });
       await session.adapter.close();
-    } catch {
+    } catch (error52) {
+      session.closeFailed = true;
+      throw error52;
     }
+    this.sessions.delete(agentId);
     this.events?.ended(session.browserSessionId, agentId, reason);
   }
+  /** Persist retirement, close a live Chromium, then delete only this exact profile. */
+  purge(agentId, purgeId, profileRevision) {
+    try {
+      this.validateAgentId(agentId);
+    } catch (error52) {
+      return Promise.reject(error52);
+    }
+    if (!Number.isInteger(profileRevision) || profileRevision < 1) {
+      return Promise.reject(new Error("invalid browser profile purge revision"));
+    }
+    return this.withLock(agentId, async () => {
+      const current = await this.readProfileState(agentId);
+      if (current && current.revision > profileRevision) return;
+      await this.writeProfileState(agentId, {
+        revision: profileRevision,
+        state: "purged",
+        purgeId
+      });
+      await this.closeLocked(agentId, "stopped");
+      await rm4(this.profilePath(agentId), { recursive: true, force: true, maxRetries: 3 });
+      await this.syncDirectory(this.profileRoot);
+    });
+  }
   async closeAll(reason) {
     await Promise.allSettled(
       [...this.sessions.keys()].map((agentId) => this.close(agentId, reason))
@@ -25067,8 +25738,8 @@ var BrowserManager = class {
     return this.enqueue(session, async () => {
       if (resizeGeneration !== null && resizeGeneration !== session.resizeGeneration) return;
       await session.adapter.command(command);
-      const changesCaptureTarget = command.action === "activateTab" || command.action === "newTab" || command.action === "closeTab";
-      if (changesCaptureTarget && session.viewerCount > 0) {
+      const needsImmediateFrame = command.action === "resize" || command.action === "activateTab" || command.action === "newTab" || command.action === "closeTab";
+      if (needsImmediateFrame && session.viewerCount > 0) {
         try {
           this.enqueueFrame(session, await session.adapter.screenshot());
         } catch {
@@ -25174,7 +25845,8 @@ var BrowserManager = class {
         this.armIdleTimer(session);
         return;
       }
-      void this.close(session.agentId, "idle_timeout");
+      void this.close(session.agentId, "idle_timeout").catch(() => {
+      });
     }, this.idleTimeoutMs);
     session.idleTimer.unref?.();
   }
@@ -25191,12 +25863,13 @@ async function loadPlaywright() {
   return import("playwright-core");
 }
 var KEY_ALIASES = { " ": "Space" };
-function createPlaywrightBrowserAdapterFactory() {
+function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
+  const load = dependencies.loadPlaywright ?? loadPlaywright;
   return {
     kind: "playwright",
     async capability() {
       try {
-        const playwright = await loadPlaywright();
+        const playwright = await load();
         const executable = playwright.chromium.executablePath();
         if (!executable) return { status: "unavailable", error: BROWSER_INSTALL_REMEDY };
         await access3(executable);
@@ -25206,7 +25879,7 @@ function createPlaywrightBrowserAdapterFactory() {
       }
     },
     async open({ profileDir, viewport }) {
-      const playwright = await loadPlaywright();
+      const playwright = await load();
       const context = await playwright.chromium.launchPersistentContext(profileDir, {
         headless: true,
         viewport,
@@ -25575,8 +26248,10 @@ function createPlaywrightBrowserAdapterFactory() {
         async fillLogin(credential) {
           const tab = requireActive();
           const { page: page2 } = tab;
+          const expectedOrigin = requireBrowserLoginOrigin(safeUrl(page2), credential.loginUrl);
           const password = page2.locator('input[type="password"]:visible').first();
           await password.waitFor({ state: "visible", timeout: ACTION_TIMEOUT_MS });
+          requireBrowserLoginOrigin(safeUrl(page2), credential.loginUrl);
           const username = page2.locator(
             [
               'input[autocomplete="username"]:visible',
@@ -25586,14 +26261,66 @@ function createPlaywrightBrowserAdapterFactory() {
               'input[type="text"]:visible'
             ].join(", ")
           ).first();
-          if (await username.count() > 0) {
-            try {
-              await username.fill(credential.username, { timeout: ACTION_TIMEOUT_MS });
-            } catch {
+          const [passwordInputHandle] = await password.elementHandles();
+          if (!passwordInputHandle) throw new Error("the password field disappeared");
+          const [usernameInputHandle] = await username.elementHandles();
+          const originSentinel = "ZIXT_BROWSER_LOGIN_ORIGIN_CHANGED";
+          try {
+            await passwordInputHandle.evaluate(
+              (node, values) => {
+                const browser = globalThis;
+                const passwordInput = node;
+                if (passwordInput.tagName !== "INPUT" || browser.location.origin !== values.origin) {
+                  throw new Error(values.originSentinel);
+                }
+                const visible = (input) => {
+                  const style = browser.getComputedStyle(input);
+                  const bounds = input.getBoundingClientRect();
+                  return input.isConnected && !input.disabled && style.display !== "none" && style.visibility !== "hidden" && bounds.width > 0 && bounds.height > 0;
+                };
+                const write = (input, value) => {
+                  input.focus();
+                  const setter = Object.getOwnPropertyDescriptor(
+                    browser.HTMLInputElement.prototype,
+                    "value"
+                  )?.set;
+                  if (setter) setter.call(input, value);
+                  else input.value = value;
+                  input.dispatchEvent(
+                    new browser.Event("input", { bubbles: true, composed: true })
+                  );
+                  input.dispatchEvent(new browser.Event("change", { bubbles: true }));
+                };
+                const usernameInput = values.usernameInput;
+                if (usernameInput && usernameInput.ownerDocument === passwordInput.ownerDocument && visible(usernameInput)) {
+                  write(usernameInput, values.username);
+                }
+                if (!passwordInput.isConnected || browser.location.origin !== values.origin) {
+                  throw new Error(values.originSentinel);
+                }
+                write(passwordInput, values.password);
+              },
+              {
+                usernameInput: usernameInputHandle ?? null,
+                origin: expectedOrigin,
+                originSentinel,
+                username: credential.username,
+                password: credential.password
+              }
+            );
+            requireBrowserLoginOrigin(safeUrl(page2), credential.loginUrl);
+            await passwordInputHandle.press("Enter");
+          } catch (error52) {
+            if (String(error52).includes(originSentinel)) {
+              throw new Error(BROWSER_LOGIN_ORIGIN_CHANGED);
             }
+            throw error52;
+          } finally {
+            await Promise.allSettled([
+              passwordInputHandle.dispose(),
+              ...usernameInputHandle ? [usernameInputHandle.dispose()] : []
+            ]);
           }
-          await password.fill(credential.password, { timeout: ACTION_TIMEOUT_MS });
-          await password.press("Enter");
           try {
             await page2.waitForLoadState("load", { timeout: 15e3 });
           } catch {
@@ -25639,10 +26366,7 @@ function createPlaywrightBrowserAdapterFactory() {
         async close() {
           closed = true;
           for (const tab of tabs) await detachSession(tab);
-          try {
-            await context.close();
-          } catch {
-          }
+          await context.close();
         }
       };
     }
@@ -25652,9 +26376,9 @@ function createPlaywrightBrowserAdapterFactory() {
 // src/runners/cli-runner.ts
 import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
-import { lstat as lstat9, mkdir as mkdir10, realpath as realpath7 } from "node:fs/promises";
+import { lstat as lstat10, mkdir as mkdir10, realpath as realpath7 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute13, join as join14, resolve as resolve7 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute13, join as join14, resolve as resolve8 } from "node:path";
 
 // src/tool-packs/browser/tool-definitions.ts
 function definition(name, description, properties, required2 = []) {
@@ -25876,9 +26600,13 @@ function createBrowserToolPack(deps) {
           });
           const credential = await deps.requestWebLogin(credentialName, origin);
           try {
+            requireBrowserLoginOrigin(tool.state().url, credential.loginUrl);
             const { landedUrl } = await tool.fillLogin(credential);
             return { ok: true, result: { loggedIn: true, landedUrl } };
-          } catch {
+          } catch (error52) {
+            if (error52 instanceof Error && error52.message === BROWSER_LOGIN_ORIGIN_CHANGED) {
+              return { ok: false, error: BROWSER_LOGIN_ORIGIN_CHANGED };
+            }
             return {
               ok: false,
               error: "no login form was found or the sign-in did not complete; browser_read the page and try again, or ask a human to take over from the Browser panel"
@@ -28343,13 +29071,13 @@ function createGithubPushOrchestrator(input) {
 // src/tool-packs/github/git-bridge.ts
 import { spawn as spawn5 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { chmod as chmod3, lstat as lstat5, mkdir as mkdir5, realpath as realpath3, rm as rm4 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute8, join as join9, relative as relative4 } from "node:path";
+import { chmod as chmod3, lstat as lstat6, mkdir as mkdir5, realpath as realpath3, rm as rm5 } from "node:fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute8, join as join9, relative as relative4 } from "node:path";
 
 // src/tool-packs/github/git-credential-broker.ts
 import { createServer } from "node:http";
 import { randomBytes, randomUUID as randomUUID6, timingSafeEqual } from "node:crypto";
-import { chmod as chmod2, lstat as lstat4, realpath as realpath2, writeFile } from "node:fs/promises";
+import { chmod as chmod2, lstat as lstat5, realpath as realpath2, writeFile } from "node:fs/promises";
 import { isAbsolute as isAbsolute7, join as join8, relative as relative3 } from "node:path";
 var MAX_REQUEST_BYTES = 16 * 1024;
 var FILE_MODE = 384;
@@ -28474,7 +29202,7 @@ async function createGithubGitCredentialBroker(input) {
     throw new Error("GitHub credential authority has expired");
   }
   assertRepositoryFullName(input.repositoryFullName);
-  const rootEntry = await lstat4(input.runArtifactsRoot);
+  const rootEntry = await lstat5(input.runArtifactsRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("Git credential broker requires a private real run directory");
   }
@@ -28585,7 +29313,7 @@ function assertBelow(parent, child, label) {
   void label;
 }
 async function requireRealDirectory(path, label) {
-  const entry = await lstat5(path).catch(() => null);
+  const entry = await lstat6(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     void label;
     throw new GithubGitProcessError("invalid_input");
@@ -28595,9 +29323,9 @@ async function requireRealDirectory(path, label) {
 async function validateTokenlessPaths(command) {
   if (command.kind === "clone-from-bridge") {
     if (!isAbsolute8(command.destination)) throw new GithubGitProcessError("invalid_input");
-    const parent = await requireRealDirectory(dirname4(command.destination), "clone parent");
+    const parent = await requireRealDirectory(dirname5(command.destination), "clone parent");
     assertBelow(parent, command.destination, "clone destination");
-    const destination = await lstat5(command.destination).catch((error52) => {
+    const destination = await lstat6(command.destination).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -28705,8 +29433,8 @@ async function runGit(input, args, env) {
     let settled = false;
     let stopping = false;
     let resolveExited;
-    const exited = new Promise((resolve14) => {
-      resolveExited = resolve14;
+    const exited = new Promise((resolve15) => {
+      resolveExited = resolve15;
     });
     child.once("exit", resolveExited);
     const cleanup = () => {
@@ -28902,7 +29630,7 @@ function createGithubGitBridge(input) {
         const real = await requireRealDirectory(path, "git bridge");
         assertBelow(current.bridges, real, "git bridge");
         const hooks = join9(real, "hooks");
-        await rm4(hooks, { recursive: true, force: true });
+        await rm5(hooks, { recursive: true, force: true });
         await mkdir5(hooks, { mode: DIRECTORY_MODE });
         await chmod3(hooks, DIRECTORY_MODE);
         const config2 = join9(real, "config");
@@ -28910,7 +29638,7 @@ function createGithubGitBridge(input) {
         active.add(real);
         return real;
       } catch (error52) {
-        await rm4(path, { recursive: true, force: true }).catch(() => {
+        await rm5(path, { recursive: true, force: true }).catch(() => {
         });
         throw error52;
       }
@@ -29004,7 +29732,7 @@ function createGithubGitBridge(input) {
     },
     async destroyPrivateBridge(path) {
       const bridge = await requireBridge(path);
-      await rm4(bridge, { recursive: true, force: true });
+      await rm5(bridge, { recursive: true, force: true });
       active.delete(bridge);
       credentialed2.delete(bridge);
     },
@@ -29012,7 +29740,7 @@ function createGithubGitBridge(input) {
       if (closed) return;
       closed = true;
       const paths = [...active];
-      await Promise.all(paths.map((path) => rm4(path, { recursive: true, force: true })));
+      await Promise.all(paths.map((path) => rm5(path, { recursive: true, force: true })));
       active.clear();
       credentialed2.clear();
     }
@@ -29353,8 +30081,8 @@ function createRepositoryTools(runtime) {
 
 // src/tool-packs/github/workspace.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat6, mkdir as mkdir6, readFile as readFile5, realpath as realpath4, rename as rename3, rm as rm5, writeFile as writeFile2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute9, join as join10, relative as relative5, resolve as resolve4 } from "node:path";
+import { chmod as chmod4, lstat as lstat7, mkdir as mkdir6, readFile as readFile6, realpath as realpath4, rename as rename4, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute9, join as join10, relative as relative5, resolve as resolve5 } from "node:path";
 var SAFE_LOCAL_ID = /^[A-Za-z0-9_-]{1,200}$/;
 var FULL_NAME2 = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
 var DIRECTORY_MODE2 = 448;
@@ -29377,10 +30105,10 @@ function assertBelow2(parent, child, label) {
   }
 }
 function samePath(left, right) {
-  return process.platform === "win32" ? resolve4(left).toLowerCase() === resolve4(right).toLowerCase() : resolve4(left) === resolve4(right);
+  return process.platform === "win32" ? resolve5(left).toLowerCase() === resolve5(right).toLowerCase() : resolve5(left) === resolve5(right);
 }
 async function requireRealDirectory2(path, label) {
-  const entry = await lstat6(path).catch(() => null);
+  const entry = await lstat7(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     throw new Error(`${label} must be a real directory, not a symbolic link or junction`);
   }
@@ -29417,7 +30145,7 @@ function parseMetadata(text) {
 }
 async function pathExists(path) {
   try {
-    await lstat6(path);
+    await lstat7(path);
     return true;
   } catch (error52) {
     if (error52.code === "ENOENT") return false;
@@ -29479,11 +30207,11 @@ async function createGithubWorkspaceService(input) {
     if (!await pathExists(destination) || !await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace has not been prepared");
     }
-    const metadataEntry = await lstat6(metadataPath);
+    const metadataEntry = await lstat7(metadataPath);
     if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
       throw new Error("GitHub workspace metadata is invalid");
     }
-    const metadata = parseMetadata(await readFile5(metadataPath, "utf8"));
+    const metadata = parseMetadata(await readFile6(metadataPath, "utf8"));
     if (metadata.repositoryId !== parsed.data || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
       throw new Error("GitHub workspace metadata does not match this repository");
     }
@@ -29533,15 +30261,15 @@ async function createGithubWorkspaceService(input) {
       });
       await chmod4(metadataTemporary, FILE_MODE2);
       try {
-        await rename3(temporaryReal, destination);
+        await rename4(temporaryReal, destination);
         try {
-          await rename3(metadataTemporary, metadataPath);
+          await rename4(metadataTemporary, metadataPath);
         } catch (error52) {
-          await rm5(destination, { recursive: true, force: true });
+          await rm6(destination, { recursive: true, force: true });
           throw error52;
         }
       } finally {
-        await rm5(metadataTemporary, { force: true }).catch(() => {
+        await rm6(metadataTemporary, { force: true }).catch(() => {
         });
       }
       const path = await requireRealDirectory2(destination, "GitHub repository");
@@ -29553,7 +30281,7 @@ async function createGithubWorkspaceService(input) {
         headSha
       };
     } finally {
-      await rm5(temporary, { recursive: true, force: true }).catch(() => {
+      await rm6(temporary, { recursive: true, force: true }).catch(() => {
       });
     }
   };
@@ -29581,11 +30309,11 @@ async function createGithubWorkspaceService(input) {
           expiresAt: authority.expiresAt
         });
       }
-      const metadataEntry = await lstat6(metadataPath);
+      const metadataEntry = await lstat7(metadataPath);
       if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
         throw new Error("GitHub workspace metadata is invalid");
       }
-      const metadata = parseMetadata(await readFile5(metadataPath, "utf8"));
+      const metadata = parseMetadata(await readFile6(metadataPath, "utf8"));
       if (metadata.repositoryId !== repository.repositoryId || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
         throw new Error("GitHub workspace metadata does not match this repository");
       }
@@ -31194,8 +31922,8 @@ var linearToolPackFactory = {
   async create(grant, context) {
     let resolveCancelled;
     let closed = false;
-    const cancelled = new Promise((resolve14) => {
-      resolveCancelled = resolve14;
+    const cancelled = new Promise((resolve15) => {
+      resolveCancelled = resolve15;
     });
     const cancel = () => {
       if (closed) return;
@@ -31564,6 +32292,21 @@ var TOOLS = [
       required: ["agent_id", "message"]
     }
   },
+  {
+    name: "message_manager",
+    description: "Message the organization Manager. Use this when a human should be informed or asked through the organization\u2019s conversation front door, or when the Manager should decide how to route what you need. This does not address Slack or WhatsApp directly.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        message: {
+          type: "string",
+          description: "A self-contained report, request, or question for the Manager."
+        }
+      },
+      required: ["message"],
+      additionalProperties: false
+    }
+  },
   {
     name: "get_org_config",
     description: "The organization inventory: connected integrations with their ids and endpoints, MCP connections, and the names of credentials that reach your session as environment variables. Read this before deciding how to reach a system nothing wrapped in a tool.",
@@ -31806,6 +32549,8 @@ function opFor(name, args) {
         message: str("message"),
         ...typeof args["task_id"] === "string" && args["task_id"] ? { taskId: args["task_id"] } : {}
       };
+    case "message_manager":
+      return { kind: "manager.message", message: str("message") };
     case "get_org_config":
       return { kind: "org.config" };
     case "read_credential": {
@@ -31864,7 +32609,7 @@ function createAskUserServer() {
   let server;
   let listening;
   function ensureListening() {
-    listening ??= new Promise((resolve14, reject3) => {
+    listening ??= new Promise((resolve15, reject3) => {
       server = createServer2((req, res) => {
         res.on("error", () => {
         });
@@ -31880,7 +32625,7 @@ function createAskUserServer() {
       server.on("error", reject3);
       server.listen(0, "127.0.0.1", () => {
         const address = server.address();
-        if (address && typeof address === "object") resolve14(address.port);
+        if (address && typeof address === "object") resolve15(address.port);
         else reject3(new Error("ask_user server failed to bind"));
       });
       server.unref();
@@ -32212,7 +32957,7 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat7, mkdir as mkdir8, realpath as realpath5, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod as chmod5, lstat as lstat8, mkdir as mkdir8, realpath as realpath5, writeFile as writeFile4 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
 import { isAbsolute as isAbsolute11, join as join12, relative as relative6 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
@@ -32597,7 +33342,7 @@ async function writePrivate(path, content, executable = false) {
   await chmod5(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
 }
 async function prepareHelpers(input) {
-  const rootEntry = await lstat7(input.runRoot);
+  const rootEntry = await lstat8(input.runRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
@@ -32844,7 +33589,7 @@ password=${credential.accessToken}
 
 // src/runners/working-context.ts
 import { spawn as spawn6 } from "node:child_process";
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
 var COMMAND_STOP_TIMEOUT_MS = 2e4;
@@ -33202,8 +33947,8 @@ async function repositoryState(directory, git, env, signal) {
   const pathLines = paths.trim().split(/\r?\n/);
   if (pathLines.length < 3 || !pathLines[0] || !pathLines[1] || !pathLines[2]) return null;
   const root = pathLines[0];
-  const gitDirectory = resolve5(directory, pathLines[1]);
-  const commonDirectory = resolve5(directory, pathLines[2]);
+  const gitDirectory = resolve6(directory, pathLines[1]);
+  const commonDirectory = resolve6(directory, pathLines[2]);
   const records = status.split(/\0|\r?\n/).filter(Boolean);
   const rawBranch = statusField(records, "branch.head");
   if (!rawBranch || rawBranch.length > 512 || !isSafeSingleLineDisplayText(rawBranch)) return null;
@@ -33350,18 +34095,18 @@ var WorkingContextPullRequestCache = class {
 import { spawn as spawn7 } from "node:child_process";
 import {
   chmod as chmod6,
-  lstat as lstat8,
+  lstat as lstat9,
   mkdir as mkdir9,
-  open as open4,
+  open as open5,
   readdir as readdir3,
-  readFile as readFile6,
+  readFile as readFile7,
   realpath as realpath6,
-  rename as rename4,
-  rm as rm6,
+  rename as rename5,
+  rm as rm7,
   writeFile as writeFile5
 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname5, isAbsolute as isAbsolute12, join as join13, relative as relative7, resolve as resolve6, sep as sep3, win32 as win322 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute12, join as join13, relative as relative7, resolve as resolve7, sep as sep3, win32 as win322 } from "node:path";
 var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
 var DIRECTORY_MODE4 = 448;
 var FILE_MODE3 = 384;
@@ -33594,7 +34339,7 @@ function assertBelow3(parent, child) {
   if (escapes) throw new Error("run artifact path escapes its private root");
 }
 async function requireRealDirectory3(path, label) {
-  const entry = await lstat8(path);
+  const entry = await lstat9(path);
   if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
   if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
   return realpath6(path);
@@ -33611,7 +34356,7 @@ async function rejectWindowsSymlinkAncestors(profile, target) {
   for (const segment of path.split("\\").filter(Boolean)) {
     current = win322.join(current, segment);
     try {
-      const entry = await lstat8(current);
+      const entry = await lstat9(current);
       if (entry.isSymbolicLink()) {
         throw new Error("run artifact path must not contain symbolic links or junctions");
       }
@@ -33622,16 +34367,16 @@ async function rejectWindowsSymlinkAncestors(profile, target) {
   }
 }
 async function prepareRoot(root) {
-  const absolute = resolve6(root);
+  const absolute = resolve7(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve6(homedir3());
+    const profile = resolve7(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath6(profile);
   }
   try {
-    await lstat8(absolute);
+    await lstat9(absolute);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
     await mkdir9(absolute, { recursive: true, mode: DIRECTORY_MODE4 });
@@ -33645,7 +34390,7 @@ async function prepareAgentRoot(root, agentId) {
   const path = join13(root, agentId);
   assertBelow3(root, path);
   try {
-    await lstat8(path);
+    await lstat9(path);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
     try {
@@ -33736,7 +34481,7 @@ async function createRunArtifacts(input) {
   requireSafeSegment(input.agentId, "agentId");
   requireSafeSegment(input.runToken, "runToken");
   const root = await prepareRoot(input.root);
-  const removeTree = input.removeTree ?? ((path) => rm6(path, { recursive: true, force: true }));
+  const removeTree = input.removeTree ?? ((path) => rm7(path, { recursive: true, force: true }));
   const cleanupRetryDelayMs = input.cleanupRetryDelayMs ?? CLEANUP_RETRY_DELAY_MS;
   const agentRoot = await prepareAgentRoot(root, input.agentId);
   await lockDownWindowsDirectories([root, agentRoot]);
@@ -33795,10 +34540,10 @@ async function removePrivateTreeWithRetries(path, removeTree, retryDelayMs) {
   }
 }
 async function sweepOrphanedRunArtifacts(root) {
-  const absolute = resolve6(root);
+  const absolute = resolve7(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve6(homedir3());
+    const profile = resolve7(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath6(profile);
@@ -33823,7 +34568,7 @@ async function sweepOrphanedRunArtifacts(root) {
       if (!SAFE_SEGMENT2.test(run3.name) || !run3.isDirectory() || run3.isSymbolicLink()) continue;
       const runPath = join13(agentPath, run3.name);
       assertBelow3(agentPath, runPath);
-      await rm6(runPath, { recursive: true, force: true });
+      await rm7(runPath, { recursive: true, force: true });
       removed++;
     }
   }
@@ -33833,7 +34578,7 @@ function defaultRunRegistryRoot() {
   return join13(homedir3(), ".zixt", "run-registry");
 }
 async function syncRunRegistryDirectory(path) {
-  const handle = await open4(path, "r");
+  const handle = await open5(path, "r");
   try {
     await handle.sync();
   } finally {
@@ -33843,9 +34588,9 @@ async function syncRunRegistryDirectory(path) {
 async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory7) {
   const firstCreated = await mkdir9(registryRoot, { recursive: true, mode: DIRECTORY_MODE4 });
   if (firstCreated && process.platform !== "win32") {
-    const first = resolve6(firstCreated);
-    const target = resolve6(registryRoot);
-    await syncDirectory7(dirname5(first));
+    const first = resolve7(firstCreated);
+    const target = resolve7(registryRoot);
+    await syncDirectory7(dirname6(first));
     let current = first;
     for (const part of relative7(first, target).split(sep3).filter(Boolean)) {
       await syncDirectory7(current);
@@ -33862,12 +34607,12 @@ async function recordRunAssignment(runToken, record2, registryRoot = defaultRunR
   try {
     const syncDirectory7 = options.syncDirectory ?? syncRunRegistryDirectory;
     await ensureDurableRunRegistryRoot(registryRoot, syncDirectory7);
-    handle = await open4(temporary, "wx", FILE_MODE3);
+    handle = await open5(temporary, "wx", FILE_MODE3);
     await handle.writeFile(JSON.stringify(record2), "utf8");
     await handle.sync();
     await handle.close();
     handle = void 0;
-    await rename4(temporary, destination);
+    await rename5(temporary, destination);
     if (process.platform !== "win32") {
       await syncDirectory7(registryRoot);
     }
@@ -33877,7 +34622,7 @@ async function recordRunAssignment(runToken, record2, registryRoot = defaultRunR
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm6(temporary, { force: true }).catch(() => {
+    await rm7(temporary, { force: true }).catch(() => {
     });
   }
 }
@@ -33889,7 +34634,7 @@ async function forgetRunAssignment(runToken, registryRoot = defaultRunRegistryRo
   if (retainingAssignments) return;
   if (!SAFE_SEGMENT2.test(runToken)) return;
   try {
-    await rm6(join13(registryRoot, `${runToken}.json`), { force: true });
+    await rm7(join13(registryRoot, `${runToken}.json`), { force: true });
   } catch {
   }
 }
@@ -33934,7 +34679,7 @@ async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistr
     if (!SAFE_SEGMENT2.test(runToken)) continue;
     let text;
     try {
-      text = await readFile6(join13(registryRoot, entry.name), "utf8");
+      text = await readFile7(join13(registryRoot, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -33946,7 +34691,7 @@ async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistr
 async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunRegistryRoot()) {
   let rootStat;
   try {
-    rootStat = await lstat8(registryRoot);
+    rootStat = await lstat9(registryRoot);
   } catch (error52) {
     if (isMissing(error52)) return [];
     throw new Error("run registry state could not be observed");
@@ -33970,7 +34715,7 @@ async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunR
     }
     let text;
     try {
-      text = await readFile6(join13(registryRoot, entry.name), "utf8");
+      text = await readFile7(join13(registryRoot, entry.name), "utf8");
     } catch {
       throw new Error("committed run registry witness could not be read");
     }
@@ -33987,13 +34732,13 @@ async function forgetAcknowledgedRunAssignments(assignments, registryRoot = defa
   );
   const entries = await readRecordedRunAssignmentEntries(registryRoot);
   await Promise.all(
-    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm6(join13(registryRoot, `${runToken}.json`), { force: true }))
+    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm7(join13(registryRoot, `${runToken}.json`), { force: true }))
   );
 }
 async function forgetSupersededRunAssignments(taskId, epoch, registryRoot = defaultRunRegistryRoot()) {
   const entries = await readRecordedRunAssignmentEntries(registryRoot);
   await Promise.all(
-    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm6(join13(registryRoot, `${runToken}.json`), { force: true }))
+    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm7(join13(registryRoot, `${runToken}.json`), { force: true }))
   );
 }
 
@@ -34064,7 +34809,7 @@ function truncateThought(text) {
 }
 var MAX_APPROVAL_PAYLOAD = 5e4;
 async function requireRealDirectory4(path, label) {
-  const entry = await lstat9(path).catch(() => null);
+  const entry = await lstat10(path).catch(() => null);
   if (!entry) throw new Error(`${label} does not exist`);
   if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
   if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
@@ -34080,7 +34825,7 @@ function createCliRunner(adapter, opts = {}) {
   const prefixArgs = opts.commandPrefixArgs ?? [];
   const maxWallTimeMs = opts.maxWallTimeMs;
   const workspaceRoot = opts.workspaceRoot ?? defaultRunnerWorkspaceRoot();
-  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join14(dirname6(workspaceRoot), "run-artifacts"));
+  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join14(dirname7(workspaceRoot), "run-artifacts"));
   const runRegistryRoot2 = opts.runRegistryRoot ?? defaultRunRegistryRoot();
   const createArtifacts = opts.createArtifacts ?? createRunArtifacts;
   const toolPackRegistry2 = opts.toolPackRegistry ?? createDefaultToolPackRegistry();
@@ -34124,7 +34869,12 @@ function createCliRunner(adapter, opts = {}) {
       usage: { inputTokens: 0, outputTokens: 0 }
     });
     if (task.cancelledNow()) return cancelledBeforeRun();
-    const runner = task.spec.runner ?? { type: "claude-code", auth: "machine" };
+    const configuredRunner = task.spec.runner ?? {
+      type: "claude-code",
+      auth: "machine"
+    };
+    const runner = { ...configuredRunner };
+    if (runner.model === "default") delete runner.model;
     if (runner.type !== adapter.type) {
       return {
         outcome: "failed",
@@ -34236,7 +34986,13 @@ function createCliRunner(adapter, opts = {}) {
           )
         );
       }
-      if (opts.browserManager) {
+      const browserAvailable = opts.browserAvailable ? await opts.browserAvailable() : true;
+      if (task.spec.requiresBrowser && (!opts.browserManager || !browserAvailable)) {
+        throw new Error(
+          "This Task needs a web browser, but the Browser is no longer available on this Machine. Install the pinned Chromium build or continue the Task on a Browser-ready Machine."
+        );
+      }
+      if (task.spec.requiresBrowser && opts.browserManager && browserAvailable) {
         toolPacks.push(
           createBrowserToolPack({
             manager: opts.browserManager,
@@ -34407,8 +35163,8 @@ ${attachmentSection}` : prompt;
         let changed = false;
         for (const path of paths) {
           if (!path || path.length > 4096) continue;
-          const absolutePath = isAbsolute13(path) ? path : resolve7(cwd, path);
-          const directory = dirname6(absolutePath);
+          const absolutePath = isAbsolute13(path) ? path : resolve8(cwd, path);
+          const directory = dirname7(absolutePath);
           observedWorkingDirectories.delete(directory);
           observedWorkingDirectories.add(directory);
           while (observedWorkingDirectories.size > 19) {
@@ -34830,7 +35586,7 @@ function runCliProcess(options) {
       usage: { inputTokens: 0, outputTokens: 0 }
     });
   }
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const platform = options.platform ?? process.platform;
     const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID10() : void 0;
     const child = options.guardian ? spawn8(
@@ -34844,7 +35600,7 @@ function runCliProcess(options) {
         // The idle pre-assignment guardian must never load from or depend
         // on an untrusted Task checkout. Only the post-gate target enters
         // the requested working directory from its private release frame.
-        cwd: dirname6(options.guardian.scriptPath),
+        cwd: dirname7(options.guardian.scriptPath),
         env: runnerGuardianEnv(process.env, containmentGateNonce),
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true,
@@ -34891,7 +35647,7 @@ function runCliProcess(options) {
       clearInterval(timer);
       unregisterFollowUps?.();
       parser.stop?.();
-      resolve14(result);
+      resolve15(result);
     };
     const terminate = (result) => {
       if (settled || forcedResult) return;
@@ -35122,7 +35878,7 @@ function runCliProcess(options) {
 import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/runners/runtime-observation.ts
-import { open as open5, readdir as readdir4, realpath as realpath8 } from "node:fs/promises";
+import { open as open6, readdir as readdir4, realpath as realpath8 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { join as join15 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
@@ -35134,7 +35890,7 @@ function homeFrom(env) {
 async function readHead(path) {
   let handle;
   try {
-    handle = await open5(path, "r");
+    handle = await open6(path, "r");
     const buffer = Buffer.alloc(READ_WINDOW_BYTES);
     const { bytesRead } = await handle.read(buffer, 0, READ_WINDOW_BYTES, 0);
     return buffer.subarray(0, bytesRead).toString("utf8");
@@ -35148,7 +35904,7 @@ async function readHead(path) {
 async function readTail(path) {
   let handle;
   try {
-    handle = await open5(path, "r");
+    handle = await open6(path, "r");
     const { size } = await handle.stat();
     const start = Math.max(0, size - READ_WINDOW_BYTES);
     const length = Math.min(size, READ_WINDOW_BYTES);
@@ -35236,7 +35992,7 @@ async function readCodexSessionRuntime(input) {
 }
 var codexCatalogCache = /* @__PURE__ */ new Map();
 async function loadCodexModelCatalog(command, prefixArgs, env) {
-  const output = await new Promise((resolve14) => {
+  const output = await new Promise((resolve15) => {
     const child = spawnCli(command, [...prefixArgs, "debug", "models"], {
       stdio: ["ignore", "pipe", "ignore"],
       windowsHide: true,
@@ -35251,7 +36007,7 @@ async function loadCodexModelCatalog(command, prefixArgs, env) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve14(value);
+      resolve15(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -35356,8 +36112,8 @@ function createRuntimeReporter(input, sessionId) {
 var EFFORT_READ_ATTEMPTS = 5;
 var EFFORT_READ_INTERVAL_MS = 3e3;
 function delay2(ms) {
-  return new Promise((resolve14) => {
-    const timer = setTimeout(resolve14, ms);
+  return new Promise((resolve15) => {
+    const timer = setTimeout(resolve15, ms);
     timer.unref?.();
   });
 }
@@ -35434,10 +36190,10 @@ function createClaudeLiveParser(onStream, onSessionModel) {
     },
     async steer(followUp) {
       if (!write) return false;
-      return await new Promise((resolve14) => {
-        acknowledgements.set(followUp.inputId, resolve14);
+      return await new Promise((resolve15) => {
+        acknowledgements.set(followUp.inputId, resolve15);
         void write(input(followUp.inputId, followUp.text)).catch(() => {
-          if (acknowledgements.delete(followUp.inputId)) resolve14(false);
+          if (acknowledgements.delete(followUp.inputId)) resolve15(false);
         });
       });
     },
@@ -35591,13 +36347,13 @@ function improveErrorMessage(error52) {
     return "Anthropic authentication failed. Sign in with `claude` on this host, or set a valid ANTHROPIC_API_KEY secret and switch the agent to API-key auth.";
   }
   if (lower.includes("issue with the selected model") || lower.includes("model_not_found")) {
-    return "The selected model is not available. Pick a different model in the agent profile.";
+    return "The selected model is not available. Open the failed Task, choose another model or Default in its runtime controls, then Retry.";
   }
   return error52;
 }
 
 // src/runners/codex.ts
-import { mkdir as mkdir11, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdir as mkdir11, readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
 import { randomUUID as randomUUID12 } from "node:crypto";
 import { homedir as homedir6 } from "node:os";
 import { join as join16 } from "node:path";
@@ -35612,7 +36368,7 @@ function threadIndexPath(root, agentId, sessionKey) {
 }
 async function readThreadId(path) {
   try {
-    const parsed = JSON.parse(await readFile7(path, "utf8"));
+    const parsed = JSON.parse(await readFile8(path, "utf8"));
     return typeof parsed.threadId === "string" && /^[A-Za-z0-9-]{1,120}$/.test(parsed.threadId) ? parsed.threadId : null;
   } catch {
     return null;
@@ -35744,8 +36500,8 @@ ${value}` : value;
 var RUNTIME_READ_ATTEMPTS = 5;
 var RUNTIME_READ_INTERVAL_MS = 2e3;
 function delay3(ms) {
-  return new Promise((resolve14) => {
-    const timer = setTimeout(resolve14, ms);
+  return new Promise((resolve15) => {
+    const timer = setTimeout(resolve15, ms);
     timer.unref?.();
   });
 }
@@ -35784,7 +36540,7 @@ function createCodexAppServerParser(onStream, options) {
   const turnReadyWaiters = /* @__PURE__ */ new Set();
   const usage = () => ({ inputTokens, outputTokens });
   const settleTurnReadiness = (ready) => {
-    for (const resolve14 of turnReadyWaiters) resolve14(ready);
+    for (const resolve15 of turnReadyWaiters) resolve15(ready);
     turnReadyWaiters.clear();
   };
   const send = async (message) => {
@@ -35965,12 +36721,12 @@ function createCodexAppServerParser(onStream, options) {
     async steer(input) {
       if (stopped) return false;
       if (!activeTurnId) {
-        const ready = await new Promise((resolve14) => turnReadyWaiters.add(resolve14));
+        const ready = await new Promise((resolve15) => turnReadyWaiters.add(resolve15));
         if (!ready || stopped) return false;
       }
       if (!threadId || !activeTurnId) return false;
-      return await new Promise((resolve14) => {
-        steerWaiters.set(input.inputId, resolve14);
+      return await new Promise((resolve15) => {
+        steerWaiters.set(input.inputId, resolve15);
         void send({
           id: `steer:${input.inputId}`,
           method: "turn/steer",
@@ -35981,7 +36737,7 @@ function createCodexAppServerParser(onStream, options) {
             clientUserMessageId: input.inputId
           }
         }).catch(() => {
-          if (steerWaiters.delete(input.inputId)) resolve14(false);
+          if (steerWaiters.delete(input.inputId)) resolve15(false);
         });
       });
     },
@@ -35989,7 +36745,7 @@ function createCodexAppServerParser(onStream, options) {
       stopped = true;
       write = null;
       settleTurnReadiness(false);
-      for (const resolve14 of steerWaiters.values()) resolve14(false);
+      for (const resolve15 of steerWaiters.values()) resolve15(false);
       steerWaiters.clear();
     },
     push(chunk) {
@@ -36160,7 +36916,7 @@ function improveCodexErrorMessage(error52) {
     return "OpenAI authentication failed. Sign in with `codex login` on this host, or set a valid OPENAI_API_KEY secret and switch the agent to API-key auth.";
   }
   if (lower.includes("model_not_found") || lower.includes("model") && (lower.includes("not found") || lower.includes("unsupported") || lower.includes("invalid"))) {
-    return "The selected model is not available. Pick a different model in the agent profile.";
+    return "The selected model is not available. Open the failed Task, choose another model or Default in its runtime controls, then Retry.";
   }
   return error52;
 }
@@ -36168,7 +36924,7 @@ function improveCodexErrorMessage(error52) {
 // src/runners/git-preflight.ts
 import { spawn as spawn9 } from "node:child_process";
 import { realpath as realpath9 } from "node:fs/promises";
-import { isAbsolute as isAbsolute14, resolve as resolve8 } from "node:path";
+import { isAbsolute as isAbsolute14, resolve as resolve9 } from "node:path";
 var OUTPUT_LIMIT = 8192;
 var DEFAULT_TIMEOUT_MS4 = 1e4;
 var VERSION_PATTERN = /^git version [^\r\n]{1,108}$/;
@@ -36187,7 +36943,7 @@ async function preflightGit(options = {}) {
   if (configured !== void 0 && !isAbsolute14(configured)) {
     return unavailable("configured git command must be an absolute file", checkedAt);
   }
-  const trustedCwd = await realpath9(resolve8(options.trustedCwd ?? process.cwd())).catch(() => null);
+  const trustedCwd = await realpath9(resolve9(options.trustedCwd ?? process.cwd())).catch(() => null);
   if (!trustedCwd)
     return unavailable("Host-owned git preflight directory is unavailable", checkedAt);
   const executablePath = await resolveTrustedCliCommand(configured ?? "git", {
@@ -36409,7 +37165,7 @@ function parseAuth(result) {
   return "unknown";
 }
 function run2(command, args) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const child = spawnCli(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -36425,7 +37181,7 @@ function run2(command, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
-      resolve14(result);
+      resolve15(result);
     };
     const timeout = setTimeout(() => {
       child.kill();
@@ -36439,9 +37195,9 @@ function run2(command, args) {
 // src/linux-service.ts
 import { spawn as spawn10 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
-import { access as access4, chmod as chmod7, mkdir as mkdir12, open as open6, rename as rename5, rm as rm7 } from "node:fs/promises";
+import { access as access4, chmod as chmod7, mkdir as mkdir12, open as open7, rename as rename6, rm as rm8 } from "node:fs/promises";
 import { homedir as homedir7, userInfo } from "node:os";
-import { basename as basename3, dirname as dirname7, join as join17, relative as relative8, resolve as resolve9, sep as sep4 } from "node:path";
+import { basename as basename3, dirname as dirname8, join as join17, relative as relative8, resolve as resolve10, sep as sep4 } from "node:path";
 var SERVICE_NAME = "zixt-host.service";
 var SYSTEM_SERVICE_COMMAND_TIMEOUT_MS = 7e4;
 var SERVICE_STABILITY_DELAY_MS = 2e3;
@@ -36469,7 +37225,7 @@ function boundedAppend(current, chunk) {
 }
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const child = spawn10(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
@@ -36483,7 +37239,7 @@ async function defaultRunCommand(command, args) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve14(result);
+      resolve15(result);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = boundedAppend(stdout, chunk);
@@ -36525,11 +37281,16 @@ function systemdQuotedValue(value, escapeDollar) {
 function systemdUnitValue(value) {
   return systemdQuotedValue(value, true);
 }
-function systemdDirectiveValue(value) {
-  return systemdQuotedValue(value, false);
+function systemdDirectivePath(value) {
+  const path = oneLine(value, "service path");
+  if (!path.startsWith("/")) throw new Error("service path must be absolute");
+  return path.replace(/[%\s"'\\$]/gu, (character) => {
+    if (character === "%") return "%%";
+    return [...Buffer.from(character, "utf8")].map((byte) => `\\x${byte.toString(16).padStart(2, "0")}`).join("");
+  });
 }
 async function defaultSyncDirectory(path) {
-  const directory = await open6(path, "r");
+  const directory = await open7(path, "r");
   try {
     await directory.sync();
   } finally {
@@ -36539,9 +37300,9 @@ async function defaultSyncDirectory(path) {
 async function ensureDirectory(path, mode, syncDirectory7) {
   const firstCreated = await mkdir12(path, { recursive: true, mode });
   if (!firstCreated) return;
-  const first = resolve9(firstCreated);
-  const target = resolve9(path);
-  await syncDirectory7(dirname7(first));
+  const first = resolve10(firstCreated);
+  const target = resolve10(path);
+  await syncDirectory7(dirname8(first));
   let current = first;
   const descendants = relative8(first, target);
   for (const part of descendants ? descendants.split(sep4) : []) {
@@ -36550,20 +37311,20 @@ async function ensureDirectory(path, mode, syncDirectory7) {
   }
 }
 async function replacePrivateFile(path, contents, mode, syncDirectory7) {
-  const parent = dirname7(path);
+  const parent = dirname8(path);
   await ensureDirectory(parent, 448, syncDirectory7);
   const temporary = join17(parent, `.${basename3(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-  const handle = await open6(temporary, "wx", mode);
+  const handle = await open7(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
     await handle.close();
-    await rename5(temporary, path);
+    await rename6(temporary, path);
     await chmod7(path, mode);
     await syncDirectory7(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm7(temporary, { force: true }).catch(() => void 0);
+    await rm8(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -36614,7 +37375,7 @@ async function installLinuxService(options) {
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
   const run3 = options.runCommand ?? defaultRunCommand;
   const syncDirectory7 = options.syncDirectory ?? defaultSyncDirectory;
-  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
+  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
   const [systemctl, loginctl] = await Promise.all([
     resolveCommand("systemctl"),
     resolveCommand("loginctl")
@@ -36661,7 +37422,7 @@ async function installLinuxService(options) {
     // Type=exec does not report startup success until the kernel has executed
     // Node, so a missing/corrupt release cannot masquerade as an active Host.
     "Type=exec",
-    `EnvironmentFile=${systemdDirectiveValue(environmentPath)}`,
+    `EnvironmentFile=${systemdDirectivePath(environmentPath)}`,
     `ExecStart=${systemdUnitValue(process.execPath)} ${systemdUnitValue(currentEntry)}`,
     "Restart=on-failure",
     "RestartPreventExitStatus=64",
@@ -36727,9 +37488,9 @@ async function installLinuxService(options) {
 // src/macos-service.ts
 import { spawn as spawn11 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
-import { access as access5, chmod as chmod8, mkdir as mkdir13, open as open7, rename as rename6, rm as rm8 } from "node:fs/promises";
+import { access as access5, chmod as chmod8, mkdir as mkdir13, open as open8, rename as rename7, rm as rm9 } from "node:fs/promises";
 import { homedir as homedir8, userInfo as userInfo2 } from "node:os";
-import { basename as basename4, dirname as dirname8, join as join18, relative as relative9, resolve as resolve10, sep as sep5 } from "node:path";
+import { basename as basename4, dirname as dirname9, join as join18, relative as relative9, resolve as resolve11, sep as sep5 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var COMMAND_TIMEOUT_MS2 = 7e4;
@@ -36745,7 +37506,7 @@ function shellValue(value) {
   return `'${oneLine2(value, "service setting").replaceAll("'", `'"'"'`)}'`;
 }
 async function syncDirectory4(path) {
-  const directory = await open7(path, "r");
+  const directory = await open8(path, "r");
   try {
     await directory.sync();
   } finally {
@@ -36755,9 +37516,9 @@ async function syncDirectory4(path) {
 async function ensureDirectory2(path, sync) {
   const firstCreated = await mkdir13(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve10(firstCreated);
-  const target = resolve10(path);
-  await sync(dirname8(first));
+  const first = resolve11(firstCreated);
+  const target = resolve11(path);
+  await sync(dirname9(first));
   let current = first;
   for (const part of relative9(first, target).split(sep5).filter(Boolean)) {
     await sync(current);
@@ -36765,20 +37526,20 @@ async function ensureDirectory2(path, sync) {
   }
 }
 async function replacePrivateFile2(path, contents, mode, sync) {
-  const parent = dirname8(path);
+  const parent = dirname9(path);
   await ensureDirectory2(parent, sync);
   const temporary = join18(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-  const handle = await open7(temporary, "wx", mode);
+  const handle = await open8(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
     await handle.close();
-    await rename6(temporary, path);
+    await rename7(temporary, path);
     await chmod8(path, mode);
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm8(temporary, { force: true }).catch(() => void 0);
+    await rm9(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -36958,9 +37719,9 @@ async function installMacosService(options) {
 // src/windows-service.ts
 import { spawn as spawn12 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
-import { access as access6, mkdir as mkdir14, open as open8, readFile as readFile8, rename as rename7, rm as rm9 } from "node:fs/promises";
+import { access as access6, mkdir as mkdir14, open as open9, readFile as readFile9, rename as rename8, rm as rm10 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename5, dirname as dirname9, isAbsolute as isAbsolute15, join as join19, relative as relative10, resolve as resolve11, sep as sep6 } from "node:path";
+import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute15, join as join19, relative as relative10, resolve as resolve12, sep as sep6 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -36978,7 +37739,7 @@ function psLiteral(value) {
 }
 async function syncDirectory5(path) {
   if (process.platform === "win32") return;
-  const directory = await open8(path, "r");
+  const directory = await open9(path, "r");
   try {
     await directory.sync();
   } finally {
@@ -36988,9 +37749,9 @@ async function syncDirectory5(path) {
 async function ensureDirectory3(path, sync) {
   const firstCreated = await mkdir14(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve11(firstCreated);
-  const target = resolve11(path);
-  await sync(dirname9(first));
+  const first = resolve12(firstCreated);
+  const target = resolve12(path);
+  await sync(dirname10(first));
   let current = first;
   for (const part of relative10(first, target).split(sep6).filter(Boolean)) {
     await sync(current);
@@ -36998,19 +37759,19 @@ async function ensureDirectory3(path, sync) {
   }
 }
 async function replacePrivateFile3(path, contents, sync) {
-  const parent = dirname9(path);
+  const parent = dirname10(path);
   await ensureDirectory3(parent, sync);
   const temporary = join19(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-  const handle = await open8(temporary, "wx", 384);
+  const handle = await open9(temporary, "wx", 384);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
     await handle.close();
-    await rename7(temporary, path);
+    await rename8(temporary, path);
     await sync(parent);
   } catch (error52) {
     await handle.close().catch(() => void 0);
-    await rm9(temporary, { force: true }).catch(() => void 0);
+    await rm10(temporary, { force: true }).catch(() => void 0);
     throw error52;
   }
 }
@@ -37143,7 +37904,7 @@ exit $code
 }
 async function defaultObserveStatus(path, generation) {
   try {
-    const text = (await readFile8(path, "utf8")).replace(/^\uFEFF/, "");
+    const text = (await readFile9(path, "utf8")).replace(/^\uFEFF/, "");
     const value = JSON.parse(text);
     if (value.schema !== 1 || value.generation !== generation || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) {
       return null;
@@ -37245,7 +38006,7 @@ async function installWindowsService(options) {
   );
   await replacePrivateFile3(launcherPath, launcherSource2(configPath, statusPath), sync);
   await replacePrivateFile3(taskXmlPath, taskXml({ sid, powershell, launcherPath, home }), sync);
-  await rm9(statusPath, { force: true });
+  await rm10(statusPath, { force: true });
   const acl = await run3(icacls, [
     configRoot,
     "/inheritance:r",
@@ -37297,9 +38058,9 @@ async function installSystemService(options) {
 }
 
 // src/terminal-outcomes.ts
-import { chmod as chmod9, lstat as lstat10, mkdir as mkdir15, open as open9, readdir as readdir5, readFile as readFile9, rename as rename8, rm as rm10 } from "node:fs/promises";
+import { chmod as chmod9, lstat as lstat11, mkdir as mkdir15, open as open10, readdir as readdir5, readFile as readFile10, rename as rename9, rm as rm11 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname10, join as join20, relative as relative11, resolve as resolve12, sep as sep7 } from "node:path";
+import { dirname as dirname11, join as join20, relative as relative11, resolve as resolve13, sep as sep7 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
@@ -37317,7 +38078,7 @@ function outcomePath(root, hostId, taskId, epoch) {
 }
 async function syncDirectory6(root) {
   if (process.platform === "win32") return;
-  const handle = await open9(root, "r");
+  const handle = await open10(root, "r");
   try {
     await handle.sync();
   } finally {
@@ -37327,16 +38088,16 @@ async function syncDirectory6(root) {
 async function requirePrivateRoot(root, sync = syncDirectory6) {
   const firstCreated = await mkdir15(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
-    const first = resolve12(firstCreated);
-    const target = resolve12(root);
-    await sync(dirname10(first));
+    const first = resolve13(firstCreated);
+    const target = resolve13(root);
+    await sync(dirname11(first));
     let current = first;
     for (const part of relative11(first, target).split(sep7).filter(Boolean)) {
       await sync(current);
       current = join20(current, part);
     }
   }
-  const stat3 = await lstat10(root);
+  const stat3 = await lstat11(root);
   if (stat3.isSymbolicLink() || !stat3.isDirectory()) {
     throw new Error("terminal outcome journal root is not a trusted directory");
   }
@@ -37364,7 +38125,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   const destination = outcomePath(root, hostId, outcome.taskId, outcome.epoch);
   try {
     const existing = parseCommittedOutcome(
-      await readFile9(destination, { encoding: "utf8", flag: "r" }),
+      await readFile10(destination, { encoding: "utf8", flag: "r" }),
       outcome.taskId,
       outcome.epoch
     );
@@ -37379,25 +38140,25 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   );
   let handle;
   try {
-    handle = await open9(temporary, "wx", FILE_MODE4);
+    handle = await open10(temporary, "wx", FILE_MODE4);
     await handle.writeFile(JSON.stringify(outcome), "utf8");
     await handle.sync();
     await handle.close();
     handle = void 0;
-    await rename8(temporary, destination);
+    await rename9(temporary, destination);
     await sync(scopedRoot);
     await sync(root);
   } finally {
     await handle?.close().catch(() => {
     });
-    await rm10(temporary, { force: true }).catch(() => {
+    await rm11(temporary, { force: true }).catch(() => {
     });
   }
 }
 async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
   let rootStat;
   try {
-    rootStat = await lstat10(root);
+    rootStat = await lstat11(root);
   } catch (error52) {
     if (error52.code === "ENOENT") return [];
     throw new Error("terminal outcome journal could not be observed");
@@ -37414,7 +38175,7 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
       throw new Error("terminal outcome Host scope is not a trusted directory");
     }
     const scopedRoot = hostOutcomeRoot(root, hostEntry.name);
-    const scopedStat = await lstat10(scopedRoot);
+    const scopedStat = await lstat11(scopedRoot);
     if (scopedStat.isSymbolicLink() || !scopedStat.isDirectory()) {
       throw new Error("terminal outcome Host scope is not a trusted directory");
     }
@@ -37427,12 +38188,12 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const path = join20(scopedRoot, entry.name);
-      const stat3 = await lstat10(path);
+      const stat3 = await lstat11(path);
       if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > MAX_OUTCOME_BYTES) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const outcome = parseCommittedOutcome(
-        await readFile9(path, "utf8"),
+        await readFile10(path, "utf8"),
         match[1],
         Number(match[2])
       );
@@ -37459,7 +38220,7 @@ async function forgetAcknowledgedTerminalOutcomes(refs, root = defaultTerminalOu
     if (acknowledged.get(`${hostId}:${outcome.taskId}:${outcome.epoch}`) !== outcome.resultId) {
       continue;
     }
-    await rm10(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm11(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     changedHostRoots.add(hostOutcomeRoot(root, hostId));
   }
   for (const scopedRoot of changedHostRoots) await syncDirectory6(scopedRoot);
@@ -37471,7 +38232,7 @@ async function forgetSupersededTerminalOutcomes(hostId, taskId, epoch, root = de
     if (scoped.hostId !== hostId) continue;
     const { outcome } = scoped;
     if (outcome.taskId !== taskId || outcome.epoch >= epoch) continue;
-    await rm10(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
+    await rm11(outcomePath(root, hostId, outcome.taskId, outcome.epoch), { force: true });
     removed = true;
   }
   if (removed) await syncDirectory6(hostOutcomeRoot(root, hostId));
@@ -37579,12 +38340,12 @@ function createHostLogger(options = {}) {
 }
 
 // src/demo-state.ts
-import { isAbsolute as isAbsolute16, join as join21, parse as parse3, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute16, join as join21, parse as parse3, resolve as resolve14 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
   if (!configured) return null;
-  const root = resolve13(configured);
+  const root = resolve14(configured);
   if (!isAbsolute16(configured) || root === parse3(root).root) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
@@ -37694,6 +38455,8 @@ function taskSourceLabel(origin) {
       return "Message";
     case "webhook":
       return "Webhook";
+    case "manager":
+      return "Manager";
     default:
       return void 0;
   }
@@ -37904,6 +38667,7 @@ var claudeCode = createClaudeCodeRunner({
   ...runRegistryRoot ? { runRegistryRoot } : {},
   toolPackRegistry,
   browserManager,
+  browserAvailable: async () => (await currentBrowserCapability()).status === "ok",
   gitPreflight: currentGitPreflight,
   onUnsafeRunnerCleanup: restartAfterUnsafeRunnerCleanup
 });
@@ -37914,6 +38678,7 @@ var codex = createCodexRunner({
   ...codexThreadIndexRoot ? { threadIndexRoot: codexThreadIndexRoot } : {},
   toolPackRegistry,
   browserManager,
+  browserAvailable: async () => (await currentBrowserCapability()).status === "ok",
   gitPreflight: currentGitPreflight,
   onUnsafeRunnerCleanup: restartAfterUnsafeRunnerCleanup
 });