@zixt/host 0.0.49 → 0.0.51

package/dist/index.js

@@ -15,23 +15,23 @@ import { spawn as spawn4 } from "node:child_process";
 import { fstatSync } from "node:fs";
 import {
   access as access2,
-  lstat as lstat3,
+  lstat as lstat4,
   mkdir as mkdir3,
   open as open3,
-  readFile as readFile4,
+  readFile as readFile5,
   readlink,
   readdir as readdir2,
   rename as rename2,
   rm as rm3,
   symlink
 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute6, join as join6, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute7, join as join6, relative as relative3, resolve as resolve4, sep as sep3 } from "node:path";
 import { homedir } from "node:os";
 
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.49",
+  version: "0.0.51",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14647,6 +14647,8 @@ var ID_PREFIXES = {
   browserSession: "brs",
   /** One file a person attached to a chat message ('att' is taken by attempt). */
   attachment: "atc",
+  /** Immutable file created by an AI teammate during a Task. */
+  artifact: "art",
   /** One curated memory entry an agent chose to keep ('mem' is taken by member). */
   memory: "mry",
   /** Org-singleton Manager configuration (PRD §8.13). */
@@ -14694,6 +14696,7 @@ var OrgSkillId = idSchema(ID_PREFIXES.orgSkill, "organization skill id");
 var OrgRoutineId = idSchema(ID_PREFIXES.orgRoutine, "organization routine id");
 var BrowserSessionId = idSchema(ID_PREFIXES.browserSession, "browser session id");
 var AttachmentId = idSchema(ID_PREFIXES.attachment, "attachment id");
+var TaskArtifactId = idSchema(ID_PREFIXES.artifact, "task artifact id");
 var MemoryId = idSchema(ID_PREFIXES.memory, "memory id");
 var ManagerId = idSchema(ID_PREFIXES.manager, "manager id");
 var ManagerMemoryId = idSchema(ID_PREFIXES.managerMemory, "manager memory id");
@@ -16019,6 +16022,28 @@ var UploadAttachmentRequest = external_exports.object({
   data: external_exports.string().min(1).max(Math.ceil(TASK_ATTACHMENT_MAX_BYTES / 3 * 4) + 4)
 });
 var UploadAttachmentResponse = external_exports.object({ attachment: TaskAttachmentRef });
+var TASK_ARTIFACT_MAX_BYTES = 10 * 1024 * 1024;
+var TaskArtifact = external_exports.object({
+  id: TaskArtifactId,
+  taskId: TaskId,
+  name: external_exports.string().min(1).max(200).regex(/^[^/\\]+$/, "artifact name must be a filename").refine(isSafeSingleLineDisplayText, "invalid artifact name"),
+  mediaType: external_exports.string().max(200).regex(/^[\w.+-]+\/[\w.+-]+$/, "invalid media type"),
+  size: external_exports.number().int().min(1).max(TASK_ARTIFACT_MAX_BYTES),
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  createdAt: IsoDate
+});
+var TaskFileCapability = external_exports.object({
+  target: external_exports.enum(["zixt", "slack", "linear"]),
+  operation: external_exports.enum(["download", "share", "issue_attachment"]),
+  supported: external_exports.boolean(),
+  available: external_exports.boolean(),
+  maxBytes: external_exports.number().int().positive(),
+  reason: external_exports.string().min(1).max(500).nullable(),
+  remedy: external_exports.enum(["none", "connect", "reconnect", "grant_scope", "manual_link"])
+});
+var TaskFileCapabilities = external_exports.object({
+  capabilities: external_exports.array(TaskFileCapability).length(3)
+});
 var TaskDisposition = external_exports.object({
   outcome: external_exports.enum(["done", "nothing_to_do", "escalated", "cancelled", "failed"]),
   summary: external_exports.string().max(5e4)
@@ -16451,6 +16476,7 @@ var TaskWorkingContextObservation = TaskWorkingContextBase.omit({
 var TaskDetailResponse = external_exports.object({
   task: TaskProjection,
   events: external_exports.array(TaskEventRecord),
+  artifacts: external_exports.array(TaskArtifact),
   /** Newest assignment epoch first. */
   attempts: external_exports.array(TaskAttemptProjection),
   /** Only unresolved asks for this task; decisions still use the typed approval endpoint. */
@@ -16982,6 +17008,39 @@ var AgentOp = external_exports.union([
   }),
   /** The channels a teammate can actually post to: the ones the bot is in. */
   external_exports.object({ kind: external_exports.literal("comm.list_channels"), provider: external_exports.literal("slack") }),
+  /** Snapshot a regular Task-workspace file into immutable tenant storage. */
+  external_exports.object({
+    kind: external_exports.literal("artifact.create"),
+    name: TaskArtifact.shape.name,
+    mediaType: external_exports.string().max(200).regex(/^[\w.+-]+\/[\w.+-]+$/),
+    size: external_exports.number().int().min(1).max(TASK_ARTIFACT_MAX_BYTES),
+    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    data: external_exports.string().min(1).max(Math.ceil(TASK_ARTIFACT_MAX_BYTES / 3 * 4) + 4)
+  }),
+  /** Truthful per-provider file delivery inventory for the current Task. */
+  external_exports.object({ kind: external_exports.literal("artifact.capabilities") }),
+  /** Read-only, provider-verified labels for the exact approval card. */
+  external_exports.object({
+    kind: external_exports.literal("artifact.delivery.preview"),
+    target: external_exports.enum(["slack", "linear"]),
+    artifactId: TaskArtifactId,
+    destinationId: external_exports.string().min(1).max(200)
+  }),
+  /** Cloud Comms Gateway delivery using the vault-held Slack bot token. */
+  external_exports.object({
+    kind: external_exports.literal("artifact.deliver.slack"),
+    artifactId: TaskArtifactId,
+    to: external_exports.string().min(1).max(200),
+    comment: external_exports.string().max(3e3).optional(),
+    threadTs: external_exports.string().max(64).optional()
+  }),
+  /** Upload to Linear private storage and attach the asset to one issue. */
+  external_exports.object({
+    kind: external_exports.literal("artifact.deliver.linear"),
+    artifactId: TaskArtifactId,
+    issueId: external_exports.string().min(1).max(200),
+    title: external_exports.string().min(1).max(1e3).optional()
+  }),
   /** Claim a cloud-side intent before a direct host → Linear mutation. */
   ProviderIntent,
   /** Record provider-confirmed success after the direct mutation returns. */
@@ -19894,10 +19953,77 @@ async function discoverTools(params, fetchFn = fetch) {
   })).filter((t) => t.name.length > 0);
 }
 
+// src/runners/task-artifacts.ts
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { basename, extname, isAbsolute, relative, resolve, sep } from "node:path";
+var MEDIA_TYPES = {
+  ".csv": "text/csv",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".gif": "image/gif",
+  ".html": "text/html",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".json": "application/json",
+  ".md": "text/markdown",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain",
+  ".webp": "image/webp",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xml": "application/xml",
+  ".zip": "application/zip"
+};
+function artifactDataContainsSensitiveValue(data, sensitiveValues) {
+  const decoded = Buffer.from(data, "base64").toString("utf8");
+  return sensitiveValues.some((secret) => secret.length > 0 && decoded.includes(secret));
+}
+function isWithin(file2, root) {
+  const child = relative(root, file2);
+  return child === "" || !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute(child);
+}
+async function publishTaskFile(input) {
+  const candidate = resolve(input.cwd, input.path);
+  const [file2, roots] = await Promise.all([
+    realpath(candidate),
+    Promise.all(input.allowedRoots.map((root) => realpath(root)))
+  ]);
+  if (!roots.some((root) => isWithin(file2, root))) {
+    return { ok: false, error: "the file is outside this task workspace" };
+  }
+  const stat3 = await lstat(file2);
+  if (!stat3.isFile()) return { ok: false, error: "only regular files can be published" };
+  if (stat3.size < 1) return { ok: false, error: "empty files cannot be published" };
+  if (stat3.size > TASK_ARTIFACT_MAX_BYTES) {
+    return {
+      ok: false,
+      error: `the file is larger than Zixt's ${TASK_ARTIFACT_MAX_BYTES / 1024 / 1024} MB limit`
+    };
+  }
+  const name = basename(file2);
+  if (name.length > 200) return { ok: false, error: "the filename is too long" };
+  const inferred = MEDIA_TYPES[extname(name).toLowerCase()] ?? "application/octet-stream";
+  const mediaType = input.mediaType?.trim() || inferred;
+  if (!/^[\w.+-]+\/[\w.+-]+$/.test(mediaType) || mediaType.length > 200) {
+    return { ok: false, error: "media_type must be a valid content type" };
+  }
+  const bytes = await readFile(file2);
+  return input.agentOp({
+    kind: "artifact.create",
+    name,
+    mediaType,
+    size: bytes.length,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    data: bytes.toString("base64")
+  });
+}
+
 // src/runners/exec.ts
 import { spawn } from "node:child_process";
-import { realpath, stat } from "node:fs/promises";
-import { delimiter, extname, isAbsolute, join, resolve } from "node:path";
+import { realpath as realpath2, stat } from "node:fs/promises";
+import { delimiter, extname as extname2, isAbsolute as isAbsolute2, join, resolve as resolve2 } from "node:path";
 function spawnCli(command, args, options = {}) {
   if (process.platform === "win32") {
     return spawn([quoteForCmd(command), ...args.map(quoteForCmd)].join(" "), {
@@ -19909,26 +20035,26 @@ function spawnCli(command, args, options = {}) {
 }
 async function resolveTrustedCliCommand(command, options = {}) {
   const platform = options.platform ?? process.platform;
-  const trustedCwd = resolve(options.trustedCwd ?? process.cwd());
+  const trustedCwd = resolve2(options.trustedCwd ?? process.cwd());
   const hasSeparator = command.includes("/") || command.includes("\\");
   const bases = [];
-  if (isAbsolute(command)) {
+  if (isAbsolute2(command)) {
     bases.push(command);
   } else if (hasSeparator) {
-    bases.push(resolve(trustedCwd, command));
+    bases.push(resolve2(trustedCwd, command));
   } else {
     for (const entry of (options.searchPath ?? process.env.PATH ?? "").split(delimiter)) {
       if (!entry) continue;
-      bases.push(join(isAbsolute(entry) ? entry : resolve(trustedCwd, entry), command));
+      bases.push(join(isAbsolute2(entry) ? entry : resolve2(trustedCwd, entry), command));
     }
   }
-  const extensions = platform === "win32" && extname(command) === "" ? (options.pathExt ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const extensions = platform === "win32" && extname2(command) === "" ? (options.pathExt ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
   for (const base of bases) {
     for (const extension of extensions) {
       try {
-        const candidate = await realpath(`${base}${extension}`);
+        const candidate = await realpath2(`${base}${extension}`);
         const entry = await stat(candidate);
-        if (entry.isFile() && isAbsolute(candidate)) return candidate;
+        if (entry.isFile() && isAbsolute2(candidate)) return candidate;
       } catch {
       }
     }
@@ -19961,7 +20087,7 @@ async function generateTaskTitle(instructions, runner) {
     instructions.slice(0, INSTRUCTIONS_BUDGET),
     "</task_request>"
   ].join("\n");
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const child = spawnCli(
       command,
       [
@@ -19984,7 +20110,7 @@ async function generateTaskTitle(instructions, runner) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve15(value);
+      resolve16(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -20022,7 +20148,7 @@ function isPlausibleTaskTitle(title) {
 // src/worker-watchdog.ts
 import { randomUUID } from "node:crypto";
 import { writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3 } from "node:path";
+import { isAbsolute as isAbsolute4 } from "node:path";
 
 // src/worker-ownership.ts
 import {
@@ -20035,8 +20161,8 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
-import { chmod, lstat, mkdir, open, readFile, readdir, rm, rmdir } from "node:fs/promises";
-import { basename, dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2, sep } from "node:path";
+import { chmod, lstat as lstat2, mkdir, open, readFile as readFile2, readdir, rm, rmdir } from "node:fs/promises";
+import { basename as basename2, dirname, isAbsolute as isAbsolute3, join as join2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var LAUNCHER_OWNERSHIP_DIR_ENV = "ZIXT_HOST_LAUNCHER_OWNERSHIP_DIR";
 var WORKER_OWNERSHIP_FILE_ENV = "ZIXT_HOST_WORKER_OWNERSHIP_FILE";
 var SUPERVISOR_OWNERSHIP_FILE_ENV = "ZIXT_HOST_SUPERVISOR_OWNERSHIP_FILE";
@@ -20046,7 +20172,7 @@ var MAX_OWNERSHIP_RECORD_BYTES = 4 * 1024;
 var MAX_OWNERSHIP_RECORDS = 32;
 var MAX_OWNERSHIP_GENERATIONS = 32;
 function workerOwnershipFile(directory, nonce) {
-  if (!isAbsolute2(directory) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce)) return null;
+  if (!isAbsolute3(directory) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce)) return null;
   return join2(directory, `${nonce}.json`);
 }
 function workerOwnershipArguments(nonce) {
@@ -20056,7 +20182,7 @@ function consumeWorkerOwnershipArguments(argv, env) {
   const file2 = env[WORKER_OWNERSHIP_FILE_ENV];
   const nonce = env.ZIXT_HOST_WORKER_WATCHDOG_NONCE;
   if (typeof file2 !== "string") return { argv: [...argv], requested: false, valid: true };
-  if (typeof nonce !== "string" || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || !isAbsolute2(file2) || basename(file2) !== `${nonce}.json`) {
+  if (typeof nonce !== "string" || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || !isAbsolute3(file2) || basename2(file2) !== `${nonce}.json`) {
     return { argv: [...argv], requested: true, valid: false };
   }
   const result = [];
@@ -20083,7 +20209,7 @@ function syncDirectorySync(path) {
   }
 }
 function recordWorkerOwnership(path, nonce, pid = process.pid) {
-  if (!isAbsolute2(path) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || basename(path) !== `${nonce}.json` || !Number.isSafeInteger(pid) || pid <= 1) {
+  if (!isAbsolute3(path) || !SAFE_WORKER_OWNERSHIP_NONCE.test(nonce) || basename2(path) !== `${nonce}.json` || !Number.isSafeInteger(pid) || pid <= 1) {
     return false;
   }
   const directory = dirname(path);
@@ -20141,19 +20267,19 @@ async function syncDirectory(path) {
   }
 }
 async function ensurePrivateOwnershipRoot(root) {
-  if (!isAbsolute2(root)) throw new Error("launcher ownership root is invalid");
+  if (!isAbsolute3(root)) throw new Error("launcher ownership root is invalid");
   const firstCreated = await mkdir(root, { recursive: true, mode: 448 });
   if (firstCreated && process.platform !== "win32") {
-    const first = resolve2(firstCreated);
-    const target = resolve2(root);
+    const first = resolve3(firstCreated);
+    const target = resolve3(root);
     await syncDirectory(dirname(first));
     let current = first;
-    for (const part of relative(first, target).split(sep).filter(Boolean)) {
+    for (const part of relative2(first, target).split(sep2).filter(Boolean)) {
       await syncDirectory(current);
       current = join2(current, part);
     }
   }
-  const metadata = await lstat(root);
+  const metadata = await lstat2(root);
   if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
     throw new Error("launcher ownership root is not a trusted directory");
   }
@@ -20190,7 +20316,7 @@ async function readLauncherOwnershipGenerations(root) {
       throw new Error("launcher ownership root is malformed");
     }
     const directory = join2(root, entry.name);
-    const metadata = await lstat(directory);
+    const metadata = await lstat2(directory);
     if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
       throw new Error("launcher ownership generation is not a trusted directory");
     }
@@ -20212,7 +20338,7 @@ function parseRecord(value, path, expectedNonce) {
   return { schema: 1, nonce: expectedNonce, pid: record2.pid, path };
 }
 async function readWorkerOwnershipRecords(directory) {
-  if (!isAbsolute2(directory)) throw new Error("worker ownership directory is invalid");
+  if (!isAbsolute3(directory)) throw new Error("worker ownership directory is invalid");
   const entries = await readdir(directory, { withFileTypes: true }).catch(
     (error52) => {
       if (error52.code === "ENOENT") return [];
@@ -20231,13 +20357,13 @@ async function readWorkerOwnershipRecords(directory) {
     }
     const match = /^([A-Za-z0-9_-]{16,200})\.json$/.exec(entry.name);
     if (!entry.isFile() || !match) throw new Error("worker ownership directory is malformed");
-    const metadata = await lstat(path);
+    const metadata = await lstat2(path);
     if (!metadata.isFile() || metadata.size > MAX_OWNERSHIP_RECORD_BYTES) {
       throw new Error("worker ownership record is invalid");
     }
     let value;
     try {
-      value = JSON.parse(await readFile(path, "utf8"));
+      value = JSON.parse(await readFile2(path, "utf8"));
     } catch {
       throw new Error("worker ownership record is invalid");
     }
@@ -20246,7 +20372,7 @@ async function readWorkerOwnershipRecords(directory) {
   return records;
 }
 async function forgetWorkerOwnership(path) {
-  if (!isAbsolute2(path)) throw new Error("worker ownership path is invalid");
+  if (!isAbsolute3(path)) throw new Error("worker ownership path is invalid");
   const directory = dirname(path);
   await rm(path, { force: true });
   await syncDirectory(directory);
@@ -20306,11 +20432,11 @@ function createWorkerWatchdogSendDrain() {
         if (completed) return;
         completed = true;
         pending--;
-        if (pending === 0) drained.splice(0).forEach((resolve15) => resolve15());
+        if (pending === 0) drained.splice(0).forEach((resolve16) => resolve16());
       };
     },
     drain: async () => {
-      if (pending > 0) await new Promise((resolve15) => drained.push(resolve15));
+      if (pending > 0) await new Promise((resolve16) => drained.push(resolve16));
     }
   };
 }
@@ -20336,7 +20462,7 @@ function startWorkerWatchdogHeartbeat(env = process.env, argv = process.argv.sli
   }
   const heartbeatFile = env[WORKER_WATCHDOG_FILE_ENV];
   const ipc = typeof process.send === "function" && process.connected;
-  const file2 = !ipc && typeof heartbeatFile === "string" && isAbsolute3(heartbeatFile) ? heartbeatFile : null;
+  const file2 = !ipc && typeof heartbeatFile === "string" && isAbsolute4(heartbeatFile) ? heartbeatFile : null;
   if (!ipc && !file2) {
     heartbeatActive = false;
     heartbeatUsesIpc = false;
@@ -20555,7 +20681,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
   const deadline = Date.parse(retryAt);
   if (!Number.isFinite(deadline) || signal.aborted) return false;
   if (deadline <= Date.now()) return true;
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve16) => {
     let settled = false;
     let timer;
     const finish = (ready) => {
@@ -20563,7 +20689,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
       settled = true;
       if (timer) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve15(ready);
+      resolve16(ready);
     };
     const onAbort = () => finish(false);
     const schedule = () => {
@@ -20831,22 +20957,22 @@ var HostClient = class _HostClient {
     const unwindingAssignments = [...this.activeAssignments.values()];
     for (const cancel of this.cancels.values()) cancel(stopReason);
     for (const entry of this.secretGrants.values()) {
-      for (const resolve15 of entry.resolvers) resolve15({});
+      for (const resolve16 of entry.resolvers) resolve16({});
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.connectionGrants.values()) {
-      for (const resolve15 of entry.resolvers) resolve15([]);
+      for (const resolve16 of entry.resolvers) resolve16([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.providerGrants.values()) {
-      for (const resolve15 of entry.resolvers) resolve15([]);
+      for (const resolve16 of entry.resolvers) resolve16([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const waiters of this.approvalWaiters.values()) {
-      for (const resolve15 of waiters.values()) resolve15({ approved: false, guidance: reason });
+      for (const resolve16 of waiters.values()) resolve16({ approved: false, guidance: reason });
     }
     for (const waiters of this.agentOpWaiters.values()) {
       for (const waiter of waiters.values()) {
@@ -20872,9 +20998,9 @@ var HostClient = class _HostClient {
     let drainTimer;
     const drained = await Promise.race([
       Promise.allSettled(runs).then(() => true),
-      new Promise((resolve15) => {
+      new Promise((resolve16) => {
         drainTimer = setTimeout(
-          () => resolve15(false),
+          () => resolve16(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         drainTimer.unref?.();
@@ -21018,9 +21144,9 @@ var HostClient = class _HostClient {
     let frameDrainTimer;
     const framesDrained = await Promise.race([
       frameTail.then(() => true),
-      new Promise((resolve15) => {
+      new Promise((resolve16) => {
         frameDrainTimer = setTimeout(
-          () => resolve15(false),
+          () => resolve16(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         frameDrainTimer.unref?.();
@@ -21564,7 +21690,7 @@ var HostClient = class _HostClient {
         const entry = this.secretGrants.get(key) ?? { resolvers: [] };
         entry.value = message.secrets;
         entry.expiresAt = expiresAt;
-        for (const resolve15 of entry.resolvers) resolve15(message.secrets);
+        for (const resolve16 of entry.resolvers) resolve16(message.secrets);
         entry.resolvers = [];
         this.secretGrants.set(key, entry);
         return;
@@ -21595,13 +21721,13 @@ var HostClient = class _HostClient {
         const entry = this.connectionGrants.get(key) ?? { resolvers: [] };
         entry.value = message.connections;
         entry.expiresAt = expiresAt;
-        for (const resolve15 of entry.resolvers) resolve15(message.connections);
+        for (const resolve16 of entry.resolvers) resolve16(message.connections);
         entry.resolvers = [];
         this.connectionGrants.set(key, entry);
         const providerEntry = this.providerGrants.get(key) ?? { resolvers: [] };
         providerEntry.value = providers;
         providerEntry.expiresAt = authorityExpiresAt;
-        for (const resolve15 of providerEntry.resolvers) resolve15(providers);
+        for (const resolve16 of providerEntry.resolvers) resolve16(providers);
         providerEntry.resolvers = [];
         this.providerGrants.set(key, providerEntry);
         return;
@@ -21735,8 +21861,8 @@ var HostClient = class _HostClient {
       return redactCredentialText(text, sensitiveSnapshot()).slice(0, maxLength);
     };
     let resolveCancelled;
-    const cancelledPromise = new Promise((resolve15) => {
-      resolveCancelled = resolve15;
+    const cancelledPromise = new Promise((resolve16) => {
+      resolveCancelled = resolve16;
     });
     const endAuthority = (reason = "cloud_cancel") => {
       if (stopReason) return;
@@ -21745,21 +21871,21 @@ var HostClient = class _HostClient {
       authorityController.abort(reason);
       const secretEntry = this.secretGrants.get(cancelKey);
       if (secretEntry) {
-        for (const resolve15 of secretEntry.resolvers) resolve15({});
+        for (const resolve16 of secretEntry.resolvers) resolve16({});
         secretEntry.resolvers = [];
         delete secretEntry.value;
       }
       this.secretGrants.delete(cancelKey);
       const connectionEntry = this.connectionGrants.get(cancelKey);
       if (connectionEntry) {
-        for (const resolve15 of connectionEntry.resolvers) resolve15([]);
+        for (const resolve16 of connectionEntry.resolvers) resolve16([]);
         connectionEntry.resolvers = [];
         delete connectionEntry.value;
       }
       this.connectionGrants.delete(cancelKey);
       const providerEntry = this.providerGrants.get(cancelKey);
       if (providerEntry) {
-        for (const resolve15 of providerEntry.resolvers) resolve15([]);
+        for (const resolve16 of providerEntry.resolvers) resolve16([]);
         providerEntry.resolvers = [];
         delete providerEntry.value;
       }
@@ -21767,8 +21893,8 @@ var HostClient = class _HostClient {
       this.clearAuthorityExpiry(cancelKey);
       const approvalWaiters = this.approvalWaiters.get(cancelKey);
       if (approvalWaiters) {
-        for (const resolve15 of approvalWaiters.values()) {
-          resolve15({ approved: false, guidance: "task was cancelled" });
+        for (const resolve16 of approvalWaiters.values()) {
+          resolve16({ approved: false, guidance: "task was cancelled" });
         }
         approvalWaiters.clear();
       }
@@ -21894,9 +22020,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve15) => {
-        entry.resolvers.push((value) => resolve15(capture(value)));
-        setTimeout(() => resolve15(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve16) => {
+        entry.resolvers.push((value) => resolve16(capture(value)));
+        setTimeout(() => resolve16(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const connections = () => {
@@ -21913,9 +22039,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve15) => {
-        entry.resolvers.push((value) => resolve15(capture(value)));
-        setTimeout(() => resolve15(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve16) => {
+        entry.resolvers.push((value) => resolve16(capture(value)));
+        setTimeout(() => resolve16(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const providers = () => {
@@ -21932,9 +22058,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value !== void 0) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve15) => {
-        entry.resolvers.push((value) => resolve15(capture(value)));
-        setTimeout(() => resolve15(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve16) => {
+        entry.resolvers.push((value) => resolve16(capture(value)));
+        setTimeout(() => resolve16(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const linear = async () => {
@@ -21960,13 +22086,13 @@ var HostClient = class _HostClient {
         payload: safe(payload, 5e4),
         ...questionChoices ? { questionChoices: [...questionChoices] } : {}
       });
-      return new Promise((resolve15) => {
+      return new Promise((resolve16) => {
         const waiters = this.approvalWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.approvalWaiters.set(cancelKey, waiters);
-        waiters.set(requestId, resolve15);
+        waiters.set(requestId, resolve16);
         void cancelledPromise.then(() => {
           if (waiters.delete(requestId)) {
-            resolve15({ approved: false, guidance: "task was cancelled" });
+            resolve16({ approved: false, guidance: "task was cancelled" });
           }
         });
       });
@@ -21977,6 +22103,14 @@ var HostClient = class _HostClient {
         const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "op"}: ${i.message}`).join("; ");
         return Promise.resolve({ ok: false, error: `invalid arguments: ${detail}` });
       }
+      if (parsed.data.kind === "artifact.create") {
+        if (artifactDataContainsSensitiveValue(parsed.data.data, sensitiveSnapshot())) {
+          return Promise.resolve({
+            ok: false,
+            error: "the file contains a task credential and cannot be published"
+          });
+        }
+      }
       if (requestId.length < 1 || requestId.length > 200) {
         return Promise.resolve({ ok: false, error: "invalid provider settlement request id" });
       }
@@ -22004,11 +22138,11 @@ var HostClient = class _HostClient {
         if (existing) message = existing;
         else terminalMessages.set(requestId, message);
       }
-      return new Promise((resolve15) => {
+      return new Promise((resolve16) => {
         const waiters = this.agentOpWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.agentOpWaiters.set(cancelKey, waiters);
         if (waiters.has(requestId)) {
-          resolve15({ ok: false, error: "provider settlement request is already in flight" });
+          resolve16({ ok: false, error: "provider settlement request is already in flight" });
           return;
         }
         const timer = setTimeout(() => {
@@ -22019,7 +22153,7 @@ var HostClient = class _HostClient {
                 (pending) => !(pending.type === "agent.op" && pending.requestId === requestId)
               );
             }
-            resolve15({
+            resolve16({
               ok: false,
               error: terminal ? "The provider call completed, but Zixt could not record its outcome. Do not retry; wait for reconciliation." : "the platform did not answer in time; verify with a list_* tool before retrying a mutating call"
             });
@@ -22027,7 +22161,7 @@ var HostClient = class _HostClient {
         }, _HostClient.AGENT_OP_TIMEOUT_MS);
         timer.unref?.();
         waiters.set(requestId, {
-          resolve: resolve15,
+          resolve: resolve16,
           timer,
           ...terminal ? { terminalMessage: message } : {}
         });
@@ -22073,12 +22207,12 @@ var HostClient = class _HostClient {
             "No GitHub change was attempted; the authority grant request was invalid."
           );
         }
-        const outcome = await new Promise((resolve15) => {
+        const outcome = await new Promise((resolve16) => {
           const timer = setTimeout(() => {
             const waiter = this.operationGrantWaiters.get(requestId);
             if (!waiter) return;
             this.operationGrantWaiters.delete(requestId);
-            resolve15({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
+            resolve16({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
           }, this.operationGrantTimeoutMs);
           timer.unref?.();
           this.operationGrantWaiters.set(requestId, {
@@ -22091,9 +22225,9 @@ var HostClient = class _HostClient {
             timer,
             accept: (grant) => {
               addSensitiveValues(providerGrantSensitiveValues(grant));
-              resolve15({ grant });
+              resolve16({ grant });
             },
-            deny: (retryable, reason, detail, retryAt, retryCode) => resolve15({
+            deny: (retryable, reason, detail, retryAt, retryCode) => resolve16({
               grant: null,
               retryable,
               reason,
@@ -22107,7 +22241,7 @@ var HostClient = class _HostClient {
           } catch {
             clearTimeout(timer);
             this.operationGrantWaiters.delete(requestId);
-            resolve15({ grant: null, retryable: false, reason: "connection_unavailable" });
+            resolve16({ grant: null, retryable: false, reason: "connection_unavailable" });
           }
         });
         if (outcome.grant) {
@@ -22163,7 +22297,7 @@ var HostClient = class _HostClient {
           )
         );
       }
-      return new Promise((resolve15, reject3) => {
+      return new Promise((resolve16, reject3) => {
         const timer = setTimeout(() => {
           if (this.browserCredentialWaiters.delete(requestId)) {
             reject3(
@@ -22182,7 +22316,7 @@ var HostClient = class _HostClient {
           timer,
           accept: (credential) => {
             addSensitiveValues(webLoginSensitiveValues(credential));
-            resolve15(credential);
+            resolve16(credential);
           },
           deny: (reason) => reject3(new Error(reason))
         });
@@ -22470,8 +22604,8 @@ function watchForUpdates(options) {
 
 // src/runners/process-tree.ts
 import { spawn as spawn2 } from "node:child_process";
-import { readFile as readFile2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join4 } from "node:path";
+import { readFile as readFile3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute5, join as join4 } from "node:path";
 var windowsProcessTreeModule = process.platform === "win32" ? import("@vscode/windows-process-tree").catch(() => null) : null;
 var PROCESS_TERM_GRACE_MS = 500;
 var PROCESS_EXIT_POLL_MS = 20;
@@ -22503,14 +22637,14 @@ async function observeWindowsGuardianNonce(pid, nonce) {
       "Windows runner identity could not be observed"
     );
   }
-  return new Promise((resolve15, reject3) => {
+  return new Promise((resolve16, reject3) => {
     let done = false;
     const finish = (result) => {
       if (done) return;
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve15(result);
+      else resolve16(result);
     };
     const timeout = setTimeout(
       () => finish(
@@ -22544,7 +22678,7 @@ async function observeWindowsGuardianNonce(pid, nonce) {
 async function observePosixGuardianNonce(pid, nonce) {
   if (process.platform === "linux") {
     try {
-      const command = await readFile2(`/proc/${pid}/cmdline`);
+      const command = await readFile3(`/proc/${pid}/cmdline`);
       const args = command.toString("utf8").split("\0");
       return args.includes(nonce) ? "match" : "mismatch";
     } catch (error52) {
@@ -22555,7 +22689,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       );
     }
   }
-  return new Promise((resolve15, reject3) => {
+  return new Promise((resolve16, reject3) => {
     const observer = spawn2("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -22566,7 +22700,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve15(result);
+      else resolve16(result);
     };
     const timeout = setTimeout(() => {
       observer.kill("SIGKILL");
@@ -22613,7 +22747,7 @@ async function observeGuardianIdentity(pid, identity) {
   return process.platform === "win32" ? observeWindowsGuardianNonce(pid, identity.nonce) : observePosixGuardianNonce(pid, identity.nonce);
 }
 function delay(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 function posixProcessRecordsFromPs(output) {
   const records = [];
@@ -22646,7 +22780,7 @@ function posixProcessRecordsFromPs(output) {
   return records;
 }
 async function snapshotPosixProcesses() {
-  return new Promise((resolve15, reject3) => {
+  return new Promise((resolve16, reject3) => {
     const observer = spawn2("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -22659,7 +22793,7 @@ async function snapshotPosixProcesses() {
       if (error52) reject3(error52);
       else {
         try {
-          resolve15(posixProcessRecordsFromPs(output));
+          resolve16(posixProcessRecordsFromPs(output));
         } catch (caught) {
           reject3(caught);
         }
@@ -22927,7 +23061,7 @@ async function observePosixGroupIdentity(records, pgid, identity) {
 }
 function defaultTaskkillCommand() {
   const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  if (!windowsRoot || !isAbsolute4(windowsRoot)) {
+  if (!windowsRoot || !isAbsolute5(windowsRoot)) {
     throw new ProcessTreeTerminationError(
       "termination_failed",
       "Windows runner tree termination authority is unavailable"
@@ -22994,7 +23128,7 @@ async function snapshotWindowsDescendants(rootPid) {
       "Windows process-tree observation could not start"
     );
   }
-  return new Promise((resolve15, reject3) => {
+  return new Promise((resolve16, reject3) => {
     let done = false;
     const timeout = setTimeout(() => {
       if (done) return;
@@ -23021,7 +23155,7 @@ async function snapshotWindowsDescendants(rootPid) {
         return;
       }
       try {
-        resolve15(completeWindowsDescendantPids(rootPid, processes));
+        resolve16(completeWindowsDescendantPids(rootPid, processes));
       } catch (caught) {
         reject3(caught);
       }
@@ -23068,7 +23202,7 @@ async function waitForProcessesExit(pids, timeoutMs) {
 }
 async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, independentlyTrackedPids = []) {
   const trustedCommand = command ?? defaultTaskkillCommand();
-  const result = await new Promise((resolve15, reject3) => {
+  const result = await new Promise((resolve16, reject3) => {
     const killer = spawn2(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -23103,7 +23237,7 @@ async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, indepe
       done = true;
       clearTimeout(timeout);
       if (error52) reject3(error52);
-      else resolve15({ code: killer.exitCode, output, outputTruncated });
+      else resolve16({ code: killer.exitCode, output, outputTruncated });
     };
     killer.once(
       "error",
@@ -23315,7 +23449,7 @@ async function terminateProcessTree(child, childExited, options = {}) {
 }
 
 // src/release-state.ts
-import { lstat as lstat2, mkdir as mkdir2, open as open2, readFile as readFile3, rename, rm as rm2 } from "node:fs/promises";
+import { lstat as lstat3, mkdir as mkdir2, open as open2, readFile as readFile4, rename, rm as rm2 } from "node:fs/promises";
 import { dirname as dirname2, join as join5 } from "node:path";
 var STATE_FILE = "release-state.json";
 var STATE_SCHEMA = 1;
@@ -23355,7 +23489,7 @@ function createReleaseStateStore(root) {
   const path = releaseStatePath(root);
   return {
     async load() {
-      const metadata = await lstat2(path).catch((error52) => {
+      const metadata = await lstat3(path).catch((error52) => {
         if (error52.code === "ENOENT") return null;
         throw error52;
       });
@@ -23365,7 +23499,7 @@ function createReleaseStateStore(root) {
       }
       let value;
       try {
-        value = JSON.parse(await readFile3(path, "utf8"));
+        value = JSON.parse(await readFile4(path, "utf8"));
       } catch {
         throw new Error("Host release state cannot be read");
       }
@@ -23390,7 +23524,7 @@ function createReleaseStateStore(root) {
       }
     },
     async clear() {
-      const present = await lstat2(path).then(
+      const present = await lstat3(path).then(
         () => true,
         (error52) => {
           if (error52.code === "ENOENT") return false;
@@ -23407,7 +23541,7 @@ function createReleaseStateStore(root) {
 // src/windows-job.ts
 import { spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { isAbsolute as isAbsolute5, win32 } from "node:path";
+import { isAbsolute as isAbsolute6, win32 } from "node:path";
 var WINDOWS_CONTAINMENT_GATE_ENV = "ZIXT_WINDOWS_CONTAINMENT_GATE";
 var WINDOWS_CONTAINMENT_GATE_PREFIX = "__ZIXT_WINDOWS_CONTAINMENT_READY__";
 var WINDOWS_POST_CONTAINMENT_CWD_ENV = "ZIXT_WINDOWS_POST_CONTAINMENT_CWD";
@@ -23780,12 +23914,12 @@ async function createWindowsJobContainment(pid, options) {
     stderr = `${stderr}${String(chunk)}`.slice(-HELPER_OUTPUT_LIMIT);
   });
   const helperEvents = helper;
-  const exited = new Promise((resolve15) => {
+  const exited = new Promise((resolve16) => {
     let completed = false;
     const complete = (code, signal) => {
       if (completed) return;
       completed = true;
-      resolve15({ code, signal });
+      resolve16({ code, signal });
     };
     helperEvents.once("error", () => {
       failProtocol(new Error("Windows Job Object helper could not start"));
@@ -23798,7 +23932,7 @@ async function createWindowsJobContainment(pid, options) {
   });
   const nextLine = async (expected) => {
     if (protocolFailure) throw protocolFailure;
-    const line = lines.shift() ?? await new Promise((resolve15, reject3) => {
+    const line = lines.shift() ?? await new Promise((resolve16, reject3) => {
       const timer = setTimeout(
         () => reject3(timeoutError("Windows Job Object helper did not answer in time")),
         timeoutMs
@@ -23806,7 +23940,7 @@ async function createWindowsJobContainment(pid, options) {
       timer.unref?.();
       lineWaiters.push((value) => {
         clearTimeout(timer);
-        resolve15(value);
+        resolve16(value);
       });
     });
     if (protocolFailure) throw protocolFailure;
@@ -23819,8 +23953,8 @@ async function createWindowsJobContainment(pid, options) {
     }
     const stopped = await Promise.race([
       exited.then(() => true),
-      new Promise((resolve15) => {
-        const timer = setTimeout(() => resolve15(false), timeoutMs);
+      new Promise((resolve16) => {
+        const timer = setTimeout(() => resolve16(false), timeoutMs);
         timer.unref?.();
       })
     ]);
@@ -23879,7 +24013,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
   if (nonce === void 0) return true;
   if (!SAFE_NONCE2.test(nonce)) return false;
   const expected = windowsContainmentGate(nonce).trimEnd();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     let pending = Buffer.alloc(0);
     let settled = false;
     const finish = (result) => {
@@ -23890,7 +24024,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       input.off("end", onEnd);
       input.off("error", onEnd);
       if (result) input.pause();
-      resolve15(result);
+      resolve16(result);
     };
     const onData = (chunk) => {
       pending = Buffer.concat([pending, chunk]);
@@ -23903,7 +24037,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       const postContainmentCwd = env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
       delete env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
       if (postContainmentCwd !== void 0) {
-        if (!isAbsolute5(postContainmentCwd)) return finish(false);
+        if (!isAbsolute6(postContainmentCwd)) return finish(false);
         try {
           process.chdir(postContainmentCwd);
         } catch {
@@ -23979,8 +24113,8 @@ function releaseManifestAtPrefix(prefix) {
 async function validReleaseAtPrefix(prefix, version2) {
   try {
     const [entry, manifestText] = await Promise.all([
-      lstat3(releaseEntryAtPrefix(prefix)),
-      readFile4(releaseManifestAtPrefix(prefix), "utf8")
+      lstat4(releaseEntryAtPrefix(prefix)),
+      readFile5(releaseManifestAtPrefix(prefix), "utf8")
     ]);
     if (!entry.isFile()) return false;
     const manifest = JSON.parse(manifestText);
@@ -23999,14 +24133,14 @@ async function syncDirectory3(path) {
   }
 }
 function installedReleaseVersion(entry, root = versionsRoot()) {
-  if (!isAbsolute6(entry)) return null;
-  const relativeEntry = relative2(resolve3(root), resolve3(entry));
-  if (!relativeEntry || relativeEntry.startsWith(`..${sep2}`) || isAbsolute6(relativeEntry)) {
+  if (!isAbsolute7(entry)) return null;
+  const relativeEntry = relative3(resolve4(root), resolve4(entry));
+  if (!relativeEntry || relativeEntry.startsWith(`..${sep3}`) || isAbsolute7(relativeEntry)) {
     return null;
   }
-  const version2 = relativeEntry.split(sep2)[0];
+  const version2 = relativeEntry.split(sep3)[0];
   if (!version2 || !VERSION_DIR.test(version2)) return null;
-  return resolve3(entry) === resolve3(installedReleaseEntry(version2, root)) ? version2 : null;
+  return resolve4(entry) === resolve4(installedReleaseEntry(version2, root)) ? version2 : null;
 }
 function currentReleaseEntry(root = versionsRoot(), platform = process.platform) {
   return join6(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
@@ -24071,7 +24205,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
   if (platform === "win32") {
     await mkdir3(root, { recursive: true, mode: 448 });
     const launcher = currentReleaseEntry(root, platform);
-    const existingLauncher = await lstat3(launcher).catch((error52) => {
+    const existingLauncher = await lstat4(launcher).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -24079,7 +24213,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
       if (!existingLauncher.isFile()) {
         throw new Error("the Zixt Host Windows launcher is not a regular file");
       }
-      const contents = await readFile4(launcher, "utf8");
+      const contents = await readFile5(launcher, "utf8");
       if (!contents.startsWith(WINDOWS_LAUNCHER_OWNED_MARKER)) {
         throw new Error("the Zixt Host Windows launcher is not owned by Zixt");
       }
@@ -24090,7 +24224,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
       await replaceDurableFile(launcher, WINDOWS_STABLE_LAUNCHER, sync);
     }
     const pointerPath = windowsReleasePointer(root);
-    const existingPointer = await lstat3(pointerPath).catch((error52) => {
+    const existingPointer = await lstat4(pointerPath).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -24100,7 +24234,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
       }
       let prior;
       try {
-        prior = JSON.parse(await readFile4(pointerPath, "utf8"));
+        prior = JSON.parse(await readFile5(pointerPath, "utf8"));
       } catch {
         throw new Error("the Zixt Host Windows release pointer is invalid");
       }
@@ -24111,7 +24245,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
     }
     await replaceDurableFile(
       pointerPath,
-      `${JSON.stringify({ schema: 1, entry: resolve3(entry) })}
+      `${JSON.stringify({ schema: 1, entry: resolve4(entry) })}
 `,
       sync
     );
@@ -24120,7 +24254,7 @@ async function activateInstalledRelease(entry, root = versionsRoot(), platform =
   if (platform !== "linux" && platform !== "darwin") return entry;
   await mkdir3(root, { recursive: true, mode: 448 });
   const current = currentReleaseEntry(root, platform);
-  const existing = await lstat3(current).catch((error52) => {
+  const existing = await lstat4(current).catch((error52) => {
     if (error52.code === "ENOENT") return null;
     throw error52;
   });
@@ -24142,9 +24276,9 @@ async function activatedReleaseVersion(root = versionsRoot(), platform = process
   if (platform === "win32") {
     try {
       const pointerPath = windowsReleasePointer(root);
-      const metadata = await lstat3(pointerPath);
+      const metadata = await lstat4(pointerPath);
       if (!metadata.isFile() || metadata.size > 4 * 1024) return null;
-      const value = JSON.parse(await readFile4(pointerPath, "utf8"));
+      const value = JSON.parse(await readFile5(pointerPath, "utf8"));
       return value.schema === 1 && typeof value.entry === "string" ? installedReleaseVersion(value.entry, root) : null;
     } catch {
       return null;
@@ -24154,7 +24288,7 @@ async function activatedReleaseVersion(root = versionsRoot(), platform = process
   try {
     const current = currentReleaseEntry(root, platform);
     const target = await readlink(current);
-    return installedReleaseVersion(resolve3(dirname3(current), target), root);
+    return installedReleaseVersion(resolve4(dirname3(current), target), root);
   } catch {
     return null;
   }
@@ -24315,7 +24449,7 @@ async function installRelease(version2, options = {}) {
     installerContainmentSetupError = error52;
     return null;
   }) : Promise.resolve(null);
-  const installed = await new Promise((resolve15, reject3) => {
+  const installed = await new Promise((resolve16, reject3) => {
     let finished = false;
     let cleanupStarted = false;
     let exitObserved = false;
@@ -24331,7 +24465,7 @@ async function installRelease(version2, options = {}) {
       finished = true;
       clearTimeout(timer);
       options.signal?.removeEventListener("abort", requestCleanup);
-      resolve15(result);
+      resolve16(result);
     };
     const requestCleanup = () => {
       if (cleanupStarted || finished) return;
@@ -24428,7 +24562,7 @@ async function installRelease(version2, options = {}) {
       return null;
     }
     if (await validReleaseAtPrefix(prefix, version2)) return entry;
-    const existing = await lstat3(prefix).catch((error52) => {
+    const existing = await lstat4(prefix).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -24447,7 +24581,7 @@ async function installRelease(version2, options = {}) {
 }
 async function pruneInstalledVersions(keep, root = versionsRoot()) {
   const protectedDirs = new Set(keep);
-  const running = process.argv[1] ? resolve3(process.argv[1]) : null;
+  const running = process.argv[1] ? resolve4(process.argv[1]) : null;
   let entries;
   try {
     entries = await readdir2(root);
@@ -24458,7 +24592,7 @@ async function pruneInstalledVersions(keep, root = versionsRoot()) {
   for (const name of entries) {
     if (protectedDirs.has(name) || !VERSION_DIR.test(name)) continue;
     const dir = join6(root, name);
-    if (running && running.startsWith(`${dir}${sep2}`)) continue;
+    if (running && running.startsWith(`${dir}${sep3}`)) continue;
     try {
       await rm3(dir, { recursive: true, force: true });
       removed.push(name);
@@ -24619,7 +24753,7 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   const ownership = consumeWorkerOwnershipArguments(argv, env);
   const nonce = env[WORKER_WATCHDOG_NONCE_ENV];
   const ownershipFile = env[WORKER_OWNERSHIP_FILE_ENV];
-  if (typeof target !== "string" || !isAbsolute6(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
+  if (typeof target !== "string" || !isAbsolute7(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
     return 1;
   }
   if (!recordWorkerOwnership(ownershipFile, nonce)) return 1;
@@ -24644,11 +24778,11 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   child.stdin?.on("error", () => {
   });
   process.stdin.pipe(child.stdin);
-  return new Promise((resolve15) => {
-    child.once("error", () => resolve15(1));
+  return new Promise((resolve16) => {
+    child.once("error", () => resolve16(1));
     child.once("exit", (code) => {
       process.stdin.unpipe(child.stdin);
-      resolve15(code ?? 1);
+      resolve16(code ?? 1);
     });
   });
 }
@@ -24686,7 +24820,7 @@ async function launchHostSupervisor(options = {}) {
     delete env[WORKER_WATCHDOG_FILE_ENV];
     delete env[WORKER_OWNERSHIP_FILE_ENV];
     delete env[SUPERVISOR_OWNERSHIP_FILE_ENV];
-    const generationNonce = ownershipDirectory ? basename2(ownershipDirectory) : null;
+    const generationNonce = ownershipDirectory ? basename3(ownershipDirectory) : null;
     if (ownershipDirectory && generationNonce) {
       env[LAUNCHER_OWNERSHIP_DIR_ENV] = ownershipDirectory;
       env[SUPERVISOR_OWNERSHIP_FILE_ENV] = join6(ownershipDirectory, `${generationNonce}.json`);
@@ -24726,11 +24860,11 @@ async function launchHostSupervisor(options = {}) {
   const waitOrStop = async (ms) => {
     if (stopping) return false;
     if (!customDelay) {
-      await new Promise((resolve15) => {
+      await new Promise((resolve16) => {
         const finish = () => {
           clearTimeout(timer);
           stopController.signal.removeEventListener("abort", finish);
-          resolve15();
+          resolve16();
         };
         const timer = setTimeout(finish, ms);
         stopController.signal.addEventListener("abort", finish, { once: true });
@@ -24738,8 +24872,8 @@ async function launchHostSupervisor(options = {}) {
       return !stopping;
     }
     let finishStop;
-    const stopped = new Promise((resolve15) => {
-      finishStop = () => resolve15();
+    const stopped = new Promise((resolve16) => {
+      finishStop = () => resolve16();
       stopController.signal.addEventListener("abort", finishStop, { once: true });
     });
     await Promise.race([customDelay(ms), stopped]);
@@ -24764,7 +24898,7 @@ async function launchHostSupervisor(options = {}) {
     return false;
   };
   const cleanupOwnershipGeneration = async (directory) => {
-    const generationNonce = basename2(directory);
+    const generationNonce = basename3(directory);
     const firstRecords = await readWorkerOwnershipRecords(directory);
     const supervisorRecord = firstRecords.find((record2) => record2.nonce === generationNonce);
     if (firstRecords.length > 0 && !supervisorRecord) {
@@ -24862,19 +24996,19 @@ async function launchHostSupervisor(options = {}) {
       child = spawnSupervisor(entry, version2, ownershipDirectory, containmentGateNonce);
       const launchedSupervisor = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve15) => {
-        resolveChildExited = resolve15;
+      const childExited = new Promise((resolve16) => {
+        resolveChildExited = resolve16;
       });
       const supervisorContainmentAbort = new AbortController();
       void childExited.then(() => supervisorContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve15) => {
+        (resolve16) => {
           let observed = false;
           const finish = (code, signal) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve15({ code, signal });
+            resolve16({ code, signal });
           };
           child.once("error", () => finish(1, null));
           child.once("exit", finish);
@@ -24883,7 +25017,7 @@ async function launchHostSupervisor(options = {}) {
       let supervisorContainment = null;
       try {
         if (containmentGateNonce) {
-          const supervisorIdentity = ownershipDirectory ? basename2(ownershipDirectory) : null;
+          const supervisorIdentity = ownershipDirectory ? basename3(ownershipDirectory) : null;
           if (!supervisorIdentity) {
             throw new Error("supervisor containment identity is unavailable");
           }
@@ -24895,12 +25029,12 @@ async function launchHostSupervisor(options = {}) {
           if (!supervisorContainment || !launchedSupervisor.stdin) {
             throw new Error("supervisor Job Object gate is unavailable");
           }
-          await new Promise((resolve15, reject3) => {
+          await new Promise((resolve16, reject3) => {
             launchedSupervisor.stdin.write(
               windowsContainmentGate(containmentGateNonce),
               (error52) => {
                 if (error52) reject3(error52);
-                else resolve15();
+                else resolve16();
               }
             );
           });
@@ -24972,9 +25106,9 @@ async function superviseHost(options = {}) {
   const log2 = options.log ?? ((message) => console.error(message));
   const signalWorker = options.signalWorker ?? signalWorkerGroup;
   const inheritedOwnershipDirectory = process.env[LAUNCHER_OWNERSHIP_DIR_ENV];
-  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute6(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
+  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute7(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
   if (productionLifecycle && isSupervisorRole() && launcherOwnershipDirectory) {
-    const generationNonce = basename2(launcherOwnershipDirectory);
+    const generationNonce = basename3(launcherOwnershipDirectory);
     const expectedOwnershipFile = join6(launcherOwnershipDirectory, `${generationNonce}.json`);
     const configuredOwnershipFile = process.env[SUPERVISOR_OWNERSHIP_FILE_ENV];
     if (process.argv0 !== generationNonce || configuredOwnershipFile !== expectedOwnershipFile || !recordWorkerOwnership(expectedOwnershipFile, generationNonce)) {
@@ -25042,18 +25176,18 @@ async function superviseHost(options = {}) {
     }
   }
   let announceShutdown;
-  const shutdownAnnounced = new Promise((resolve15) => {
-    announceShutdown = resolve15;
+  const shutdownAnnounced = new Promise((resolve16) => {
+    announceShutdown = resolve16;
   });
   const attempted = /* @__PURE__ */ new Set();
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
-      await new Promise((resolve15) => {
+      await new Promise((resolve16) => {
         const finish = () => {
           clearTimeout(timer);
           shutdownController.signal.removeEventListener("abort", finish);
-          resolve15();
+          resolve16();
         };
         const timer = setTimeout(finish, ms);
         shutdownController.signal.addEventListener("abort", finish, { once: true });
@@ -25196,19 +25330,19 @@ async function superviseHost(options = {}) {
       child = spawnWorker(command, watchdogLaunch, compatibilityOwnership, containmentGateNonce);
       const watchedChild = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve15) => {
-        resolveChildExited = resolve15;
+      const childExited = new Promise((resolve16) => {
+        resolveChildExited = resolve16;
       });
       const workerContainmentAbort = new AbortController();
       void childExited.then(() => workerContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve15) => {
+        (resolve16) => {
           let observed = false;
           const finish = (result) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve15(result);
+            resolve16(result);
           };
           watchedChild.once("error", () => finish({ code: 1, signal: null }));
           watchedChild.once(
@@ -25230,10 +25364,10 @@ async function superviseHost(options = {}) {
           if (!workerContainment || !watchedChild.stdin) {
             throw new Error("worker Job Object gate is unavailable");
           }
-          await new Promise((resolve15, reject3) => {
+          await new Promise((resolve16, reject3) => {
             watchedChild.stdin.write(windowsContainmentGate(containmentGateNonce), (error52) => {
               if (error52) reject3(error52);
-              else resolve15();
+              else resolve16();
             });
           });
         }
@@ -25686,9 +25820,9 @@ function createDemoBrowserAdapterFactory() {
 }
 
 // src/browser/manager.ts
-import { lstat as lstat4, mkdir as mkdir4, open as open4, opendir, readFile as readFile5, rename as rename3, rm as rm4 } from "node:fs/promises";
+import { lstat as lstat5, mkdir as mkdir4, open as open4, opendir, readFile as readFile6, rename as rename3, rm as rm4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, join as join7, resolve as resolve5 } from "node:path";
 var SAFE_SEGMENT = /^[A-Za-z0-9_-]{1,200}$/;
 var FRAME_MIN_INTERVAL_MS = 100;
 var IDLE_TIMEOUT_MS = 15 * 6e4;
@@ -25786,8 +25920,8 @@ var BrowserManager = class {
     }
   }
   exactChild(root, child) {
-    const canonicalRoot = resolve4(root);
-    const target = resolve4(canonicalRoot, child);
+    const canonicalRoot = resolve5(root);
+    const target = resolve5(canonicalRoot, child);
     if (dirname4(target) !== canonicalRoot) {
       throw new Error("browser profile path escaped its owned root");
     }
@@ -25795,7 +25929,7 @@ var BrowserManager = class {
   }
   async ensureOwnedDirectory(path) {
     await mkdir4(path, { recursive: true, mode: 448 });
-    const stat3 = await lstat4(path);
+    const stat3 = await lstat5(path);
     if (!stat3.isDirectory() || stat3.isSymbolicLink()) {
       throw new Error("browser profile root must be an owned directory, not a symbolic link");
     }
@@ -25830,7 +25964,7 @@ var BrowserManager = class {
   }
   async readProfileState(agentId) {
     try {
-      const raw = JSON.parse(await readFile5(this.statePath(agentId), "utf8"));
+      const raw = JSON.parse(await readFile6(this.statePath(agentId), "utf8"));
       if (typeof raw !== "object" || raw === null || !Number.isInteger(raw.revision) || Number(raw.revision) < 0 || !["allowed", "purged"].includes(String(raw.state))) {
         throw new Error("browser profile lifecycle marker is invalid");
       }
@@ -25929,7 +26063,7 @@ var BrowserManager = class {
       await this.ensureOwnedDirectory(this.profileRoot);
       const profileDir = this.profilePath(agentId);
       try {
-        const existingProfile = await lstat4(profileDir);
+        const existingProfile = await lstat5(profileDir);
         if (existingProfile.isSymbolicLink() || !existingProfile.isDirectory()) {
           throw new Error("browser profile path is not an owned directory");
         }
@@ -26696,9 +26830,9 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
 // src/runners/cli-runner.ts
 import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
-import { lstat as lstat10, mkdir as mkdir10, realpath as realpath7 } from "node:fs/promises";
+import { lstat as lstat11, mkdir as mkdir10, realpath as realpath8 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute13, join as join14, resolve as resolve8 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute14, join as join14, resolve as resolve9 } from "node:path";
 
 // src/tool-packs/browser/tool-definitions.ts
 function definition(name, description, properties, required2 = []) {
@@ -26953,7 +27087,7 @@ function createBrowserToolPack(deps) {
 }
 
 // src/tool-packs/provider-intents.ts
-import { createHash, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
 
 // src/tool-packs/github/rest-transport.ts
 var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
@@ -27199,7 +27333,7 @@ function canonicalJson(value) {
   return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`).join(",")}}`;
 }
 function payloadFingerprint(value) {
-  return createHash("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash2("sha256").update(canonicalJson(value)).digest("hex");
 }
 function claimResult(result) {
   if (!result.ok || !result.result || typeof result.result !== "object") return null;
@@ -29391,14 +29525,14 @@ function createGithubPushOrchestrator(input) {
 // src/tool-packs/github/git-bridge.ts
 import { spawn as spawn5 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { chmod as chmod3, lstat as lstat6, mkdir as mkdir5, realpath as realpath3, rm as rm5 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute8, join as join9, relative as relative4 } from "node:path";
+import { chmod as chmod3, lstat as lstat7, mkdir as mkdir5, realpath as realpath4, rm as rm5 } from "node:fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute9, join as join9, relative as relative5 } from "node:path";
 
 // src/tool-packs/github/git-credential-broker.ts
 import { createServer } from "node:http";
 import { randomBytes, randomUUID as randomUUID6, timingSafeEqual } from "node:crypto";
-import { chmod as chmod2, lstat as lstat5, realpath as realpath2, writeFile } from "node:fs/promises";
-import { isAbsolute as isAbsolute7, join as join8, relative as relative3 } from "node:path";
+import { chmod as chmod2, lstat as lstat6, realpath as realpath3, writeFile } from "node:fs/promises";
+import { isAbsolute as isAbsolute8, join as join8, relative as relative4 } from "node:path";
 var MAX_REQUEST_BYTES = 16 * 1024;
 var FILE_MODE = 384;
 var HELPER_SOURCE = String.raw`'use strict';
@@ -29511,8 +29645,8 @@ async function readBoundedBody2(request) {
   return Buffer.concat(chunks, size);
 }
 function assertChildPath(parent, child) {
-  const path = relative3(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute7(path)) {
+  const path = relative4(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute8(path)) {
     throw new Error("Git credential helper path escaped its private run directory");
   }
 }
@@ -29522,11 +29656,11 @@ async function createGithubGitCredentialBroker(input) {
     throw new Error("GitHub credential authority has expired");
   }
   assertRepositoryFullName(input.repositoryFullName);
-  const rootEntry = await lstat5(input.runArtifactsRoot);
+  const rootEntry = await lstat6(input.runArtifactsRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("Git credential broker requires a private real run directory");
   }
-  const runRoot = await realpath2(input.runArtifactsRoot);
+  const runRoot = await realpath3(input.runArtifactsRoot);
   const helperPath = join8(runRoot, `git-credential-${randomUUID6()}.cjs`);
   assertChildPath(runRoot, helperPath);
   await writeFile(helperPath, HELPER_SOURCE, { flag: "wx", mode: FILE_MODE });
@@ -29626,26 +29760,26 @@ ${stderr}`;
   return explicitGithubRefusal ? "provider_rejected" : "command_failed";
 }
 function assertBelow(parent, child, label) {
-  const path = relative4(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute8(path)) {
+  const path = relative5(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute9(path)) {
     throw new GithubGitProcessError("invalid_input");
   }
   void label;
 }
 async function requireRealDirectory(path, label) {
-  const entry = await lstat6(path).catch(() => null);
+  const entry = await lstat7(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     void label;
     throw new GithubGitProcessError("invalid_input");
   }
-  return realpath3(path);
+  return realpath4(path);
 }
 async function validateTokenlessPaths(command) {
   if (command.kind === "clone-from-bridge") {
-    if (!isAbsolute8(command.destination)) throw new GithubGitProcessError("invalid_input");
+    if (!isAbsolute9(command.destination)) throw new GithubGitProcessError("invalid_input");
     const parent = await requireRealDirectory(dirname5(command.destination), "clone parent");
     assertBelow(parent, command.destination, "clone destination");
-    const destination = await lstat6(command.destination).catch((error52) => {
+    const destination = await lstat7(command.destination).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -29653,7 +29787,7 @@ async function validateTokenlessPaths(command) {
     return;
   }
   if ("repositoryPath" in command) {
-    if (!isAbsolute8(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+    if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
     const repositoryPath5 = await requireRealDirectory(command.repositoryPath, "repository path");
     if (repositoryPath5 !== command.repositoryPath) throw new GithubGitProcessError("invalid_input");
   }
@@ -29733,7 +29867,7 @@ async function runGit(input, args, env) {
   if (input.authoritySignal.aborted || input.cancelledNow()) {
     throw new GithubGitProcessError("cancelled");
   }
-  if (!isAbsolute8(input.executablePath)) throw new GithubGitProcessError("invalid_input");
+  if (!isAbsolute9(input.executablePath)) throw new GithubGitProcessError("invalid_input");
   const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS2) {
     throw new GithubGitProcessError("invalid_input");
@@ -29753,8 +29887,8 @@ async function runGit(input, args, env) {
     let settled = false;
     let stopping = false;
     let resolveExited;
-    const exited = new Promise((resolve15) => {
-      resolveExited = resolve15;
+    const exited = new Promise((resolve16) => {
+      resolveExited = resolve16;
     });
     child.once("exit", resolveExited);
     const cleanup = () => {
@@ -29839,7 +29973,7 @@ function tokenlessArgs(command) {
   switch (command.kind) {
     case "clone-from-bridge":
       assertRef(command.branch);
-      if (!isAbsolute8(command.destination)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute9(command.destination)) throw new GithubGitProcessError("invalid_input");
       return [
         "clone",
         "--no-recurse-submodules",
@@ -29851,7 +29985,7 @@ function tokenlessArgs(command) {
       ];
     case "fetch-from-bridge":
       assertFetchRefspecs(command.refspecs);
-      if (!isAbsolute8(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -29863,7 +29997,7 @@ function tokenlessArgs(command) {
         ...command.refspecs
       ];
     case "copy-commit-to-bridge":
-      if (!isAbsolute8(command.repositoryPath) || !SHA.test(command.sha)) {
+      if (!isAbsolute9(command.repositoryPath) || !SHA.test(command.sha)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -29875,11 +30009,11 @@ function tokenlessArgs(command) {
         `${command.sha}:refs/zixt/push-source`
       ];
     case "rev-parse":
-      if (!isAbsolute8(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       assertRef(command.ref);
       return ["-C", command.repositoryPath, "rev-parse", "--verify", `${command.ref}^{commit}`];
     case "remote-configure":
-      if (!isAbsolute8(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
+      if (!isAbsolute9(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -29891,7 +30025,7 @@ function tokenlessArgs(command) {
         `https://github.com/${command.repositoryFullName}.git`
       ];
     case "status":
-      if (!isAbsolute8(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -29921,7 +30055,7 @@ function createGithubGitBridge(input) {
   })();
   const requireBridge = async (value) => {
     const current = await roots();
-    if (!isAbsolute8(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
+    if (!isAbsolute9(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
     const real = await requireRealDirectory(value, "git bridge");
     assertBelow(current.bridges, real, "git bridge");
     if (real !== value) throw new GithubGitProcessError("invalid_input");
@@ -30401,8 +30535,8 @@ function createRepositoryTools(runtime) {
 
 // src/tool-packs/github/workspace.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat7, mkdir as mkdir6, readFile as readFile6, realpath as realpath4, rename as rename4, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute9, join as join10, relative as relative5, resolve as resolve5 } from "node:path";
+import { chmod as chmod4, lstat as lstat8, mkdir as mkdir6, readFile as readFile7, realpath as realpath5, rename as rename4, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute10, join as join10, relative as relative6, resolve as resolve6 } from "node:path";
 var SAFE_LOCAL_ID = /^[A-Za-z0-9_-]{1,200}$/;
 var FULL_NAME2 = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
 var DIRECTORY_MODE2 = 448;
@@ -30419,20 +30553,20 @@ function hasControlCharacter2(value) {
   });
 }
 function assertBelow2(parent, child, label) {
-  const path = relative5(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute9(path)) {
+  const path = relative6(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute10(path)) {
     throw new Error(`${label} escaped the task workspace`);
   }
 }
 function samePath(left, right) {
-  return process.platform === "win32" ? resolve5(left).toLowerCase() === resolve5(right).toLowerCase() : resolve5(left) === resolve5(right);
+  return process.platform === "win32" ? resolve6(left).toLowerCase() === resolve6(right).toLowerCase() : resolve6(left) === resolve6(right);
 }
 async function requireRealDirectory2(path, label) {
-  const entry = await lstat7(path).catch(() => null);
+  const entry = await lstat8(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     throw new Error(`${label} must be a real directory, not a symbolic link or junction`);
   }
-  const real = await realpath4(path);
+  const real = await realpath5(path);
   if (!samePath(real, path)) {
     throw new Error(`${label} must not traverse a symbolic link or junction`);
   }
@@ -30465,7 +30599,7 @@ function parseMetadata(text) {
 }
 async function pathExists(path) {
   try {
-    await lstat7(path);
+    await lstat8(path);
     return true;
   } catch (error52) {
     if (error52.code === "ENOENT") return false;
@@ -30527,11 +30661,11 @@ async function createGithubWorkspaceService(input) {
     if (!await pathExists(destination) || !await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace has not been prepared");
     }
-    const metadataEntry = await lstat7(metadataPath);
+    const metadataEntry = await lstat8(metadataPath);
     if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
       throw new Error("GitHub workspace metadata is invalid");
     }
-    const metadata = parseMetadata(await readFile6(metadataPath, "utf8"));
+    const metadata = parseMetadata(await readFile7(metadataPath, "utf8"));
     if (metadata.repositoryId !== parsed.data || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
       throw new Error("GitHub workspace metadata does not match this repository");
     }
@@ -30629,11 +30763,11 @@ async function createGithubWorkspaceService(input) {
           expiresAt: authority.expiresAt
         });
       }
-      const metadataEntry = await lstat7(metadataPath);
+      const metadataEntry = await lstat8(metadataPath);
       if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
         throw new Error("GitHub workspace metadata is invalid");
       }
-      const metadata = parseMetadata(await readFile6(metadataPath, "utf8"));
+      const metadata = parseMetadata(await readFile7(metadataPath, "utf8"));
       if (metadata.repositoryId !== repository.repositoryId || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
         throw new Error("GitHub workspace metadata does not match this repository");
       }
@@ -31180,7 +31314,7 @@ function createGithubToolPackFactory(options = {}) {
 var githubToolPackFactory = createGithubToolPackFactory();
 
 // src/runners/linear-api.ts
-import { createHash as createHash2, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID9 } from "node:crypto";
 var MAX_RESPONSE_BYTES2 = 2 * 1024 * 1024;
 var MAX_RESULT_STRING = 1e5;
 var MAX_RESULT_ARRAY = 100;
@@ -31751,7 +31885,7 @@ function operationFor(name, args, appUserId, heldBy) {
   }
 }
 function fingerprint(value) {
-  return createHash2("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
+  return createHash3("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
 }
 function providerIntentFor(mutation, payloadFingerprint2) {
   const common = {
@@ -32242,8 +32376,8 @@ var linearToolPackFactory = {
   async create(grant, context) {
     let resolveCancelled;
     let closed = false;
-    const cancelled = new Promise((resolve15) => {
-      resolveCancelled = resolve15;
+    const cancelled = new Promise((resolve16) => {
+      resolveCancelled = resolve16;
     });
     const cancel = () => {
       if (closed) return;
@@ -32433,6 +32567,56 @@ var TOOLS = [
       additionalProperties: false
     }
   },
+  {
+    name: "publish_file",
+    description: "Snapshot a file you created in this Task workspace into Zixt so the user can download it. This only creates the Zixt file; it does not send it anywhere externally. The result returns an artifact_id.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Workspace-relative or absolute path to the file." },
+        media_type: {
+          type: "string",
+          description: "Optional MIME content type; inferred from the filename when omitted."
+        }
+      },
+      required: ["path"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "list_file_capabilities",
+    description: "List the file actions currently available for this Task in Zixt, Slack, and Linear, including any missing connection or OAuth scope.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    name: "send_file_to_slack",
+    description: "After publish_file, ask the user for approval and upload that immutable Zixt file to one Slack member or channel. Use ids returned by find_person or list_channels.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        artifact_id: { type: "string" },
+        to: { type: "string", description: "Slack U\u2026, C\u2026, or G\u2026 id." },
+        comment: { type: "string", description: "Optional message accompanying the file." },
+        thread_ts: { type: "string", description: "Optional existing Slack thread timestamp." }
+      },
+      required: ["artifact_id", "to"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "attach_file_to_linear",
+    description: "After publish_file, ask the user for approval, upload that immutable Zixt file to Linear private storage, and attach its private asset URL to one issue.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        artifact_id: { type: "string" },
+        issue_id: { type: "string", description: "Stable Linear issue id." },
+        title: { type: "string", description: "Optional attachment title." }
+      },
+      required: ["artifact_id", "issue_id"],
+      additionalProperties: false
+    }
+  },
   {
     name: "schedule_task",
     description: 'Create a durable Zixt Automation for YOURSELF: every tick runs the given instructions as a new task. The Automation survives runner sessions and Machine restarts and has no end unless you explicitly provide ends_at because the user requested a limit. Use this tool for every request to schedule recurring Zixt work. If a tick finds nothing to do, end that run with "nothing to do"; never invent work.',
@@ -32911,6 +33095,23 @@ function opFor(name, args) {
       };
     case "list_channels":
       return { kind: "comm.list_channels", provider: "slack" };
+    case "list_file_capabilities":
+      return { kind: "artifact.capabilities" };
+    case "send_file_to_slack":
+      return {
+        kind: "artifact.deliver.slack",
+        artifactId: str("artifact_id"),
+        to: str("to"),
+        ...typeof args["comment"] === "string" && args["comment"] ? { comment: args["comment"] } : {},
+        ...typeof args["thread_ts"] === "string" && args["thread_ts"] ? { threadTs: args["thread_ts"] } : {}
+      };
+    case "attach_file_to_linear":
+      return {
+        kind: "artifact.deliver.linear",
+        artifactId: str("artifact_id"),
+        issueId: str("issue_id"),
+        ...typeof args["title"] === "string" && args["title"] ? { title: args["title"] } : {}
+      };
     case "send_message":
       return {
         kind: "comm.send",
@@ -32929,7 +33130,7 @@ function createAskUserServer() {
   let server;
   let listening;
   function ensureListening() {
-    listening ??= new Promise((resolve15, reject3) => {
+    listening ??= new Promise((resolve16, reject3) => {
       server = createServer2((req, res) => {
         res.on("error", () => {
         });
@@ -32945,7 +33146,7 @@ function createAskUserServer() {
       server.on("error", reject3);
       server.listen(0, "127.0.0.1", () => {
         const address = server.address();
-        if (address && typeof address === "object") resolve15(address.port);
+        if (address && typeof address === "object") resolve16(address.port);
         else reject3(new Error("ask_user server failed to bind"));
       });
       server.unref();
@@ -33046,6 +33247,26 @@ function createAskUserServer() {
           }
           return;
         }
+        if (name === "publish_file") {
+          if (!handlers.publishFile) {
+            toolText("file publishing is unavailable for this runner", true);
+            return;
+          }
+          try {
+            const path = typeof args["path"] === "string" ? args["path"] : "";
+            if (!path) {
+              toolText("missing required argument `path`", true);
+              return;
+            }
+            const mediaType = typeof args["media_type"] === "string" && args["media_type"] ? args["media_type"] : void 0;
+            const outcome = await handlers.publishFile(path, mediaType);
+            if (outcome.ok) toolText(JSON.stringify(outcome.result ?? { ok: true }, null, 2));
+            else toolText(outcome.error ?? "the file could not be published", true);
+          } catch {
+            toolText("the file could not be read safely", true);
+          }
+          return;
+        }
         const toolPack = run3.toolOwners.get(name);
         if (toolPack) {
           try {
@@ -33084,7 +33305,40 @@ function createAskUserServer() {
           return;
         }
         try {
-          const outcome = await handlers.agentOp(opFor(name, args));
+          const op = opFor(name, args);
+          if (op.kind === "artifact.deliver.slack" || op.kind === "artifact.deliver.linear") {
+            if (!handlers.requestApproval) {
+              toolText("file delivery requires user approval, but approval is unavailable", true);
+              return;
+            }
+            const preview = await handlers.agentOp({
+              kind: "artifact.delivery.preview",
+              target: op.kind === "artifact.deliver.slack" ? "slack" : "linear",
+              artifactId: op.artifactId,
+              destinationId: op.kind === "artifact.deliver.slack" ? op.to : op.issueId
+            });
+            if (!preview.ok || !preview.result || typeof preview.result !== "object") {
+              toolText(preview.error ?? "The file or destination is no longer available.", true);
+              return;
+            }
+            const artifactName = preview.result["artifactName"];
+            const destinationLabel = preview.result["destinationLabel"];
+            if (typeof artifactName !== "string" || typeof destinationLabel !== "string") {
+              toolText("Zixt could not verify the file and destination.", true);
+              return;
+            }
+            const destination = op.kind === "artifact.deliver.slack" ? `Slack destination ${destinationLabel}` : `Linear issue ${destinationLabel}`;
+            const decision = await handlers.requestApproval(
+              "content.publish",
+              `Send \u201C${artifactName}\u201D to ${destination}`,
+              JSON.stringify({ file: artifactName, destination })
+            );
+            if (!decision.approved) {
+              toolText(decision.guidance ?? "The user did not approve this file delivery.", true);
+              return;
+            }
+          }
+          const outcome = await handlers.agentOp(op);
           if (outcome.ok) toolText(JSON.stringify(outcome.result ?? { ok: true }, null, 2));
           else toolText(outcome.error ?? "the operation failed", true);
         } catch (err) {
@@ -33106,6 +33360,8 @@ function createAskUserServer() {
       const handlers = {
         askUser: input.askUser,
         agentOp: input.agentOp,
+        ..."requestApproval" in input && input.requestApproval ? { requestApproval: input.requestApproval } : {},
+        ..."publishFile" in input && input.publishFile ? { publishFile: input.publishFile } : {},
         ...toolPacks.length > 0 ? { toolPacks } : {}
       };
       const toolOwners = /* @__PURE__ */ new Map();
@@ -33137,7 +33393,7 @@ function createAskUserServer() {
 }
 
 // src/runners/runner-env.ts
-import { delimiter as delimiter2, isAbsolute as isAbsolute10 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute11 } from "node:path";
 var PROVIDER_AUTHORITY_PREFIXES = ["GH_", "GITHUB_", "GIT_", "SSH_"];
 var HOST_AUTHORITY_PREFIXES = [
   "ZIXT_",
@@ -33196,7 +33452,7 @@ function inheritedValue(env, name) {
 }
 function sanitizeInheritedSearchPath(path) {
   if (!path) return "";
-  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute10(entry)).join(delimiter2);
+  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute11(entry)).join(delimiter2);
 }
 function buildRunnerEnv(input) {
   const env = {};
@@ -33277,9 +33533,9 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat8, mkdir as mkdir8, realpath as realpath5, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod as chmod5, lstat as lstat9, mkdir as mkdir8, realpath as realpath6, writeFile as writeFile4 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { isAbsolute as isAbsolute11, join as join12, relative as relative6 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join12, relative as relative7 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
 var DIRECTORY_MODE3 = 448;
 var PRIVATE_FILE_MODE = 384;
@@ -33485,7 +33741,7 @@ function parseGhInvocation(body) {
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const { args, cwd } = value;
-  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute11(cwd)) {
+  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute12(cwd)) {
     return null;
   }
   return { args, cwd };
@@ -33643,8 +33899,8 @@ function activationCredential(grant, now = Date.now()) {
   return expiresAt.getTime() <= now ? null : { accessToken: grant.accessToken, expiresAt };
 }
 function assertChildPath2(parent, child) {
-  const path = relative6(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute11(path)) {
+  const path = relative7(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute12(path)) {
     throw new Error("GitHub shell helper path escaped its private run directory");
   }
 }
@@ -33662,11 +33918,11 @@ async function writePrivate(path, content, executable = false) {
   await chmod5(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
 }
 async function prepareHelpers(input) {
-  const rootEntry = await lstat8(input.runRoot);
+  const rootEntry = await lstat9(input.runRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
-  const runRoot = await realpath5(input.runRoot);
+  const runRoot = await realpath6(input.runRoot);
   const helperPath = join12(runRoot, "github-shell-git-credential.cjs");
   assertChildPath2(runRoot, helperPath);
   await writePrivate(helperPath, GIT_HELPER_SOURCE);
@@ -33909,7 +34165,7 @@ password=${credential.accessToken}
 
 // src/runners/working-context.ts
 import { spawn as spawn6 } from "node:child_process";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
 var COMMAND_STOP_TIMEOUT_MS = 2e4;
@@ -34267,8 +34523,8 @@ async function repositoryState(directory, git, env, signal) {
   const pathLines = paths.trim().split(/\r?\n/);
   if (pathLines.length < 3 || !pathLines[0] || !pathLines[1] || !pathLines[2]) return null;
   const root = pathLines[0];
-  const gitDirectory = resolve6(directory, pathLines[1]);
-  const commonDirectory = resolve6(directory, pathLines[2]);
+  const gitDirectory = resolve7(directory, pathLines[1]);
+  const commonDirectory = resolve7(directory, pathLines[2]);
   const records = status.split(/\0|\r?\n/).filter(Boolean);
   const rawBranch = statusField(records, "branch.head");
   if (!rawBranch || rawBranch.length > 512 || !isSafeSingleLineDisplayText(rawBranch)) return null;
@@ -34415,18 +34671,18 @@ var WorkingContextPullRequestCache = class {
 import { spawn as spawn7 } from "node:child_process";
 import {
   chmod as chmod6,
-  lstat as lstat9,
+  lstat as lstat10,
   mkdir as mkdir9,
   open as open5,
   readdir as readdir3,
-  readFile as readFile7,
-  realpath as realpath6,
+  readFile as readFile8,
+  realpath as realpath7,
   rename as rename5,
   rm as rm7,
   writeFile as writeFile5
 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute12, join as join13, relative as relative7, resolve as resolve7, sep as sep3, win32 as win322 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute13, join as join13, relative as relative8, resolve as resolve8, sep as sep4, win32 as win322 } from "node:path";
 var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
 var DIRECTORY_MODE4 = 448;
 var FILE_MODE3 = 384;
@@ -34654,15 +34910,15 @@ function isMissing(error52) {
   return error52.code === "ENOENT";
 }
 function assertBelow3(parent, child) {
-  const path = relative7(parent, child);
-  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute12(path);
+  const path = relative8(parent, child);
+  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute13(path);
   if (escapes) throw new Error("run artifact path escapes its private root");
 }
 async function requireRealDirectory3(path, label) {
-  const entry = await lstat9(path);
+  const entry = await lstat10(path);
   if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
   if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
-  return realpath6(path);
+  return realpath7(path);
 }
 function assertWindowsProfileBoundary(profile, target) {
   const path = win322.relative(win322.resolve(profile), win322.resolve(target));
@@ -34676,7 +34932,7 @@ async function rejectWindowsSymlinkAncestors(profile, target) {
   for (const segment of path.split("\\").filter(Boolean)) {
     current = win322.join(current, segment);
     try {
-      const entry = await lstat9(current);
+      const entry = await lstat10(current);
       if (entry.isSymbolicLink()) {
         throw new Error("run artifact path must not contain symbolic links or junctions");
       }
@@ -34687,16 +34943,16 @@ async function rejectWindowsSymlinkAncestors(profile, target) {
   }
 }
 async function prepareRoot(root) {
-  const absolute = resolve7(root);
+  const absolute = resolve8(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve7(homedir3());
+    const profile = resolve8(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
-    realProfile = await realpath6(profile);
+    realProfile = await realpath7(profile);
   }
   try {
-    await lstat9(absolute);
+    await lstat10(absolute);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
     await mkdir9(absolute, { recursive: true, mode: DIRECTORY_MODE4 });
@@ -34710,7 +34966,7 @@ async function prepareAgentRoot(root, agentId) {
   const path = join13(root, agentId);
   assertBelow3(root, path);
   try {
-    await lstat9(path);
+    await lstat10(path);
   } catch (error52) {
     if (!isMissing(error52)) throw error52;
     try {
@@ -34776,7 +35032,7 @@ async function createPrivateDirectory(parent, name) {
   assertBelow3(parent, path);
   await mkdir9(path, { mode: DIRECTORY_MODE4 });
   await chmod6(path, DIRECTORY_MODE4);
-  const real = await realpath6(path);
+  const real = await realpath7(path);
   assertBelow3(parent, real);
   return real;
 }
@@ -34810,7 +35066,7 @@ async function createRunArtifacts(input) {
   try {
     await mkdir9(runRoot, { mode: DIRECTORY_MODE4 });
     await chmod6(runRoot, DIRECTORY_MODE4);
-    const realRunRoot = await realpath6(runRoot);
+    const realRunRoot = await realpath7(runRoot);
     assertBelow3(agentRoot, realRunRoot);
     const emptyGithubConfigDirectory = await createPrivateDirectory(realRunRoot, "gh-config");
     const emptyGitHooksDirectory = await createPrivateDirectory(realRunRoot, "git-hooks");
@@ -34860,13 +35116,13 @@ async function removePrivateTreeWithRetries(path, removeTree, retryDelayMs) {
   }
 }
 async function sweepOrphanedRunArtifacts(root) {
-  const absolute = resolve7(root);
+  const absolute = resolve8(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve7(homedir3());
+    const profile = resolve8(homedir3());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
-    realProfile = await realpath6(profile);
+    realProfile = await realpath7(profile);
   }
   let realRoot;
   try {
@@ -34908,11 +35164,11 @@ async function syncRunRegistryDirectory(path) {
 async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory7) {
   const firstCreated = await mkdir9(registryRoot, { recursive: true, mode: DIRECTORY_MODE4 });
   if (firstCreated && process.platform !== "win32") {
-    const first = resolve7(firstCreated);
-    const target = resolve7(registryRoot);
+    const first = resolve8(firstCreated);
+    const target = resolve8(registryRoot);
     await syncDirectory7(dirname6(first));
     let current = first;
-    for (const part of relative7(first, target).split(sep3).filter(Boolean)) {
+    for (const part of relative8(first, target).split(sep4).filter(Boolean)) {
       await syncDirectory7(current);
       current = join13(current, part);
     }
@@ -34999,7 +35255,7 @@ async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistr
     if (!SAFE_SEGMENT2.test(runToken)) continue;
     let text;
     try {
-      text = await readFile7(join13(registryRoot, entry.name), "utf8");
+      text = await readFile8(join13(registryRoot, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -35011,7 +35267,7 @@ async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistr
 async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunRegistryRoot()) {
   let rootStat;
   try {
-    rootStat = await lstat9(registryRoot);
+    rootStat = await lstat10(registryRoot);
   } catch (error52) {
     if (isMissing(error52)) return [];
     throw new Error("run registry state could not be observed");
@@ -35035,7 +35291,7 @@ async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunR
     }
     let text;
     try {
-      text = await readFile7(join13(registryRoot, entry.name), "utf8");
+      text = await readFile8(join13(registryRoot, entry.name), "utf8");
     } catch {
       throw new Error("committed run registry witness could not be read");
     }
@@ -35129,11 +35385,11 @@ function truncateThought(text) {
 }
 var MAX_APPROVAL_PAYLOAD = 5e4;
 async function requireRealDirectory4(path, label) {
-  const entry = await lstat10(path).catch(() => null);
+  const entry = await lstat11(path).catch(() => null);
   if (!entry) throw new Error(`${label} does not exist`);
   if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
   if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
-  return realpath7(path);
+  return realpath8(path);
 }
 function createCliRunner(adapter, opts = {}) {
   const command = opts.command ?? adapter.defaultCommand;
@@ -35352,6 +35608,21 @@ function createCliRunner(adapter, opts = {}) {
             pendingAsks--;
           }
         },
+        requestApproval: async (category, summary, payload) => {
+          pendingAsks++;
+          try {
+            return await task.requestApproval(category, summary, payload);
+          } finally {
+            pendingAsks--;
+          }
+        },
+        publishFile: (path, mediaType) => publishTaskFile({
+          path,
+          ...mediaType ? { mediaType } : {},
+          cwd,
+          allowedRoots: [taskRoot, cwd],
+          agentOp: (op) => task.agentOp(op)
+        }),
         agentOp: (op) => task.agentOp(op),
         // GitHub repository work belongs in the installed `git` and `gh`
         // commands backed by GithubShellAuth. Do not advertise the bundled
@@ -35483,7 +35754,7 @@ ${attachmentSection}` : prompt;
         let changed = false;
         for (const path of paths) {
           if (!path || path.length > 4096) continue;
-          const absolutePath = isAbsolute13(path) ? path : resolve8(cwd, path);
+          const absolutePath = isAbsolute14(path) ? path : resolve9(cwd, path);
           const directory = dirname7(absolutePath);
           observedWorkingDirectories.delete(directory);
           observedWorkingDirectories.add(directory);
@@ -35906,7 +36177,7 @@ function runCliProcess(options) {
       usage: { inputTokens: 0, outputTokens: 0 }
     });
   }
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const platform = options.platform ?? process.platform;
     const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID10() : void 0;
     const child = options.guardian ? spawn8(
@@ -35967,7 +36238,7 @@ function runCliProcess(options) {
       clearInterval(timer);
       unregisterFollowUps?.();
       parser.stop?.();
-      resolve15(result);
+      resolve16(result);
     };
     const terminate = (result) => {
       if (settled || forcedResult) return;
@@ -36198,7 +36469,7 @@ function runCliProcess(options) {
 import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/runners/runtime-observation.ts
-import { open as open6, readdir as readdir4, realpath as realpath8 } from "node:fs/promises";
+import { open as open6, readdir as readdir4, realpath as realpath9 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { join as join15 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
@@ -36265,7 +36536,7 @@ function claudeTranscriptPath(input) {
   return join15(configDir, "projects", slug, `${input.sessionId}.jsonl`);
 }
 async function readClaudeSessionEffort(input) {
-  const resolvedCwd = await realpath8(input.cwd).catch(() => input.cwd);
+  const resolvedCwd = await realpath9(input.cwd).catch(() => input.cwd);
   const path = claudeTranscriptPath({ env: input.env, resolvedCwd, sessionId: input.sessionId });
   const records = parseLines(await readTail(path));
   for (let index = records.length - 1; index >= 0; index -= 1) {
@@ -36312,7 +36583,7 @@ async function readCodexSessionRuntime(input) {
 }
 var codexCatalogCache = /* @__PURE__ */ new Map();
 async function loadCodexModelCatalog(command, prefixArgs, env) {
-  const output = await new Promise((resolve15) => {
+  const output = await new Promise((resolve16) => {
     const child = spawnCli(command, [...prefixArgs, "debug", "models"], {
       stdio: ["ignore", "pipe", "ignore"],
       windowsHide: true,
@@ -36327,7 +36598,7 @@ async function loadCodexModelCatalog(command, prefixArgs, env) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve15(value);
+      resolve16(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -36432,8 +36703,8 @@ function createRuntimeReporter(input, sessionId) {
 var EFFORT_READ_ATTEMPTS = 5;
 var EFFORT_READ_INTERVAL_MS = 3e3;
 function delay2(ms) {
-  return new Promise((resolve15) => {
-    const timer = setTimeout(resolve15, ms);
+  return new Promise((resolve16) => {
+    const timer = setTimeout(resolve16, ms);
     timer.unref?.();
   });
 }
@@ -36510,10 +36781,10 @@ function createClaudeLiveParser(onStream, onSessionModel) {
     },
     async steer(followUp) {
       if (!write) return false;
-      return await new Promise((resolve15) => {
-        acknowledgements.set(followUp.inputId, resolve15);
+      return await new Promise((resolve16) => {
+        acknowledgements.set(followUp.inputId, resolve16);
         void write(input(followUp.inputId, followUp.text)).catch(() => {
-          if (acknowledgements.delete(followUp.inputId)) resolve15(false);
+          if (acknowledgements.delete(followUp.inputId)) resolve16(false);
         });
       });
     },
@@ -36673,7 +36944,7 @@ function improveErrorMessage(error52) {
 }
 
 // src/runners/codex.ts
-import { mkdir as mkdir11, readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdir as mkdir11, readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
 import { randomUUID as randomUUID12 } from "node:crypto";
 import { homedir as homedir6 } from "node:os";
 import { join as join16 } from "node:path";
@@ -36688,7 +36959,7 @@ function threadIndexPath(root, agentId, sessionKey) {
 }
 async function readThreadId(path) {
   try {
-    const parsed = JSON.parse(await readFile8(path, "utf8"));
+    const parsed = JSON.parse(await readFile9(path, "utf8"));
     return typeof parsed.threadId === "string" && /^[A-Za-z0-9-]{1,120}$/.test(parsed.threadId) ? parsed.threadId : null;
   } catch {
     return null;
@@ -36820,8 +37091,8 @@ ${value}` : value;
 var RUNTIME_READ_ATTEMPTS = 5;
 var RUNTIME_READ_INTERVAL_MS = 2e3;
 function delay3(ms) {
-  return new Promise((resolve15) => {
-    const timer = setTimeout(resolve15, ms);
+  return new Promise((resolve16) => {
+    const timer = setTimeout(resolve16, ms);
     timer.unref?.();
   });
 }
@@ -36860,7 +37131,7 @@ function createCodexAppServerParser(onStream, options) {
   const turnReadyWaiters = /* @__PURE__ */ new Set();
   const usage = () => ({ inputTokens, outputTokens });
   const settleTurnReadiness = (ready) => {
-    for (const resolve15 of turnReadyWaiters) resolve15(ready);
+    for (const resolve16 of turnReadyWaiters) resolve16(ready);
     turnReadyWaiters.clear();
   };
   const send = async (message) => {
@@ -37041,12 +37312,12 @@ function createCodexAppServerParser(onStream, options) {
     async steer(input) {
       if (stopped) return false;
       if (!activeTurnId) {
-        const ready = await new Promise((resolve15) => turnReadyWaiters.add(resolve15));
+        const ready = await new Promise((resolve16) => turnReadyWaiters.add(resolve16));
         if (!ready || stopped) return false;
       }
       if (!threadId || !activeTurnId) return false;
-      return await new Promise((resolve15) => {
-        steerWaiters.set(input.inputId, resolve15);
+      return await new Promise((resolve16) => {
+        steerWaiters.set(input.inputId, resolve16);
         void send({
           id: `steer:${input.inputId}`,
           method: "turn/steer",
@@ -37057,7 +37328,7 @@ function createCodexAppServerParser(onStream, options) {
             clientUserMessageId: input.inputId
           }
         }).catch(() => {
-          if (steerWaiters.delete(input.inputId)) resolve15(false);
+          if (steerWaiters.delete(input.inputId)) resolve16(false);
         });
       });
     },
@@ -37065,7 +37336,7 @@ function createCodexAppServerParser(onStream, options) {
       stopped = true;
       write = null;
       settleTurnReadiness(false);
-      for (const resolve15 of steerWaiters.values()) resolve15(false);
+      for (const resolve16 of steerWaiters.values()) resolve16(false);
       steerWaiters.clear();
     },
     push(chunk) {
@@ -37243,8 +37514,8 @@ function improveCodexErrorMessage(error52) {
 
 // src/runners/git-preflight.ts
 import { spawn as spawn9 } from "node:child_process";
-import { realpath as realpath9 } from "node:fs/promises";
-import { isAbsolute as isAbsolute14, resolve as resolve9 } from "node:path";
+import { realpath as realpath10 } from "node:fs/promises";
+import { isAbsolute as isAbsolute15, resolve as resolve10 } from "node:path";
 var OUTPUT_LIMIT = 8192;
 var DEFAULT_TIMEOUT_MS4 = 1e4;
 var VERSION_PATTERN = /^git version [^\r\n]{1,108}$/;
@@ -37260,10 +37531,10 @@ function unavailable(error52, checkedAt, executablePath = null) {
 async function preflightGit(options = {}) {
   const checkedAt = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const configured = options.command;
-  if (configured !== void 0 && !isAbsolute14(configured)) {
+  if (configured !== void 0 && !isAbsolute15(configured)) {
     return unavailable("configured git command must be an absolute file", checkedAt);
   }
-  const trustedCwd = await realpath9(resolve9(options.trustedCwd ?? process.cwd())).catch(() => null);
+  const trustedCwd = await realpath10(resolve10(options.trustedCwd ?? process.cwd())).catch(() => null);
   if (!trustedCwd)
     return unavailable("Host-owned git preflight directory is unavailable", checkedAt);
   const executablePath = await resolveTrustedCliCommand(configured ?? "git", {
@@ -37485,7 +37756,7 @@ function parseAuth(result) {
   return "unknown";
 }
 function run2(command, args) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const child = spawnCli(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -37501,7 +37772,7 @@ function run2(command, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
-      resolve15(result);
+      resolve16(result);
     };
     const timeout = setTimeout(() => {
       child.kill();
@@ -37517,7 +37788,7 @@ import { spawn as spawn10 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
 import { access as access4, chmod as chmod7, mkdir as mkdir12, open as open7, rename as rename6, rm as rm8 } from "node:fs/promises";
 import { homedir as homedir7, userInfo } from "node:os";
-import { basename as basename3, dirname as dirname8, join as join17, relative as relative8, resolve as resolve10, sep as sep4 } from "node:path";
+import { basename as basename4, dirname as dirname8, join as join17, relative as relative9, resolve as resolve11, sep as sep5 } from "node:path";
 var SERVICE_NAME = "zixt-host.service";
 var SYSTEM_SERVICE_COMMAND_TIMEOUT_MS = 7e4;
 var SERVICE_STABILITY_DELAY_MS = 2e3;
@@ -37545,7 +37816,7 @@ function boundedAppend(current, chunk) {
 }
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const child = spawn10(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
@@ -37559,7 +37830,7 @@ async function defaultRunCommand(command, args) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve15(result);
+      resolve16(result);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = boundedAppend(stdout, chunk);
@@ -37620,12 +37891,12 @@ async function defaultSyncDirectory(path) {
 async function ensureDirectory(path, mode, syncDirectory7) {
   const firstCreated = await mkdir12(path, { recursive: true, mode });
   if (!firstCreated) return;
-  const first = resolve10(firstCreated);
-  const target = resolve10(path);
+  const first = resolve11(firstCreated);
+  const target = resolve11(path);
   await syncDirectory7(dirname8(first));
   let current = first;
-  const descendants = relative8(first, target);
-  for (const part of descendants ? descendants.split(sep4) : []) {
+  const descendants = relative9(first, target);
+  for (const part of descendants ? descendants.split(sep5) : []) {
     await syncDirectory7(current);
     current = join17(current, part);
   }
@@ -37633,7 +37904,7 @@ async function ensureDirectory(path, mode, syncDirectory7) {
 async function replacePrivateFile(path, contents, mode, syncDirectory7) {
   const parent = dirname8(path);
   await ensureDirectory(parent, 448, syncDirectory7);
-  const temporary = join17(parent, `.${basename3(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join17(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open7(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -37695,7 +37966,7 @@ async function installLinuxService(options) {
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
   const run3 = options.runCommand ?? defaultRunCommand;
   const syncDirectory7 = options.syncDirectory ?? defaultSyncDirectory;
-  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
+  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve16) => setTimeout(resolve16, ms)));
   const [systemctl, loginctl] = await Promise.all([
     resolveCommand("systemctl"),
     resolveCommand("loginctl")
@@ -37810,7 +38081,7 @@ import { spawn as spawn11 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
 import { access as access5, chmod as chmod8, mkdir as mkdir13, open as open8, rename as rename7, rm as rm9 } from "node:fs/promises";
 import { homedir as homedir8, userInfo as userInfo2 } from "node:os";
-import { basename as basename4, dirname as dirname9, join as join18, relative as relative9, resolve as resolve11, sep as sep5 } from "node:path";
+import { basename as basename5, dirname as dirname9, join as join18, relative as relative10, resolve as resolve12, sep as sep6 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var COMMAND_TIMEOUT_MS2 = 7e4;
@@ -37836,11 +38107,11 @@ async function syncDirectory4(path) {
 async function ensureDirectory2(path, sync) {
   const firstCreated = await mkdir13(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve11(firstCreated);
-  const target = resolve11(path);
+  const first = resolve12(firstCreated);
+  const target = resolve12(path);
   await sync(dirname9(first));
   let current = first;
-  for (const part of relative9(first, target).split(sep5).filter(Boolean)) {
+  for (const part of relative10(first, target).split(sep6).filter(Boolean)) {
     await sync(current);
     current = join18(current, part);
   }
@@ -37848,7 +38119,7 @@ async function ensureDirectory2(path, sync) {
 async function replacePrivateFile2(path, contents, mode, sync) {
   const parent = dirname9(path);
   await ensureDirectory2(parent, sync);
-  const temporary = join18(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join18(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open8(temporary, "wx", mode);
   try {
     await handle.writeFile(contents, "utf8");
@@ -38039,9 +38310,9 @@ async function installMacosService(options) {
 // src/windows-service.ts
 import { spawn as spawn12 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
-import { access as access6, mkdir as mkdir14, open as open9, readFile as readFile9, rename as rename8, rm as rm10 } from "node:fs/promises";
+import { access as access6, mkdir as mkdir14, open as open9, readFile as readFile10, rename as rename8, rm as rm10 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute15, join as join19, relative as relative10, resolve as resolve12, sep as sep6 } from "node:path";
+import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute16, join as join19, relative as relative11, resolve as resolve13, sep as sep7 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -38069,11 +38340,11 @@ async function syncDirectory5(path) {
 async function ensureDirectory3(path, sync) {
   const firstCreated = await mkdir14(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve12(firstCreated);
-  const target = resolve12(path);
+  const first = resolve13(firstCreated);
+  const target = resolve13(path);
   await sync(dirname10(first));
   let current = first;
-  for (const part of relative10(first, target).split(sep6).filter(Boolean)) {
+  for (const part of relative11(first, target).split(sep7).filter(Boolean)) {
     await sync(current);
     current = join19(current, part);
   }
@@ -38081,7 +38352,7 @@ async function ensureDirectory3(path, sync) {
 async function replacePrivateFile3(path, contents, sync) {
   const parent = dirname10(path);
   await ensureDirectory3(parent, sync);
-  const temporary = join19(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const temporary = join19(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open9(temporary, "wx", 384);
   try {
     await handle.writeFile(contents, "utf8");
@@ -38135,7 +38406,7 @@ async function runChild(command, args, env, input) {
 }
 async function defaultResolveCommand3(name, env) {
   const root = env.SYSTEMROOT ?? env.WINDIR;
-  if (!root || !isAbsolute15(root)) return null;
+  if (!root || !isAbsolute16(root)) return null;
   const candidate = name === "powershell" ? join19(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : join19(root, "System32", `${name}.exe`);
   return access6(candidate, constants4.X_OK).then(
     () => candidate,
@@ -38224,7 +38495,7 @@ exit $code
 }
 async function defaultObserveStatus(path, generation) {
   try {
-    const text = (await readFile9(path, "utf8")).replace(/^\uFEFF/, "");
+    const text = (await readFile10(path, "utf8")).replace(/^\uFEFF/, "");
     const value = JSON.parse(text);
     if (value.schema !== 1 || value.generation !== generation || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) {
       return null;
@@ -38267,7 +38538,7 @@ async function installWindowsService(options) {
   const env = options.env ?? process.env;
   const home = options.home ?? homedir9();
   const localAppData = options.localAppData ?? env.LOCALAPPDATA;
-  if (!localAppData || !isAbsolute15(localAppData)) {
+  if (!localAppData || !isAbsolute16(localAppData)) {
     throw new Error("Windows local application data path is unavailable.");
   }
   const token2 = oneLine3(options.token, "pairing code");
@@ -38378,9 +38649,9 @@ async function installSystemService(options) {
 }
 
 // src/terminal-outcomes.ts
-import { chmod as chmod9, lstat as lstat11, mkdir as mkdir15, open as open10, readdir as readdir5, readFile as readFile10, rename as rename9, rm as rm11 } from "node:fs/promises";
+import { chmod as chmod9, lstat as lstat12, mkdir as mkdir15, open as open10, readdir as readdir5, readFile as readFile11, rename as rename9, rm as rm11 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname11, join as join20, relative as relative11, resolve as resolve13, sep as sep7 } from "node:path";
+import { dirname as dirname11, join as join20, relative as relative12, resolve as resolve14, sep as sep8 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
@@ -38408,16 +38679,16 @@ async function syncDirectory6(root) {
 async function requirePrivateRoot(root, sync = syncDirectory6) {
   const firstCreated = await mkdir15(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
-    const first = resolve13(firstCreated);
-    const target = resolve13(root);
+    const first = resolve14(firstCreated);
+    const target = resolve14(root);
     await sync(dirname11(first));
     let current = first;
-    for (const part of relative11(first, target).split(sep7).filter(Boolean)) {
+    for (const part of relative12(first, target).split(sep8).filter(Boolean)) {
       await sync(current);
       current = join20(current, part);
     }
   }
-  const stat3 = await lstat11(root);
+  const stat3 = await lstat12(root);
   if (stat3.isSymbolicLink() || !stat3.isDirectory()) {
     throw new Error("terminal outcome journal root is not a trusted directory");
   }
@@ -38445,7 +38716,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
   const destination = outcomePath(root, hostId, outcome.taskId, outcome.epoch);
   try {
     const existing = parseCommittedOutcome(
-      await readFile10(destination, { encoding: "utf8", flag: "r" }),
+      await readFile11(destination, { encoding: "utf8", flag: "r" }),
       outcome.taskId,
       outcome.epoch
     );
@@ -38478,7 +38749,7 @@ async function recordTerminalOutcome(hostId, input, root = defaultTerminalOutcom
 async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
   let rootStat;
   try {
-    rootStat = await lstat11(root);
+    rootStat = await lstat12(root);
   } catch (error52) {
     if (error52.code === "ENOENT") return [];
     throw new Error("terminal outcome journal could not be observed");
@@ -38495,7 +38766,7 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
       throw new Error("terminal outcome Host scope is not a trusted directory");
     }
     const scopedRoot = hostOutcomeRoot(root, hostEntry.name);
-    const scopedStat = await lstat11(scopedRoot);
+    const scopedStat = await lstat12(scopedRoot);
     if (scopedStat.isSymbolicLink() || !scopedStat.isDirectory()) {
       throw new Error("terminal outcome Host scope is not a trusted directory");
     }
@@ -38508,12 +38779,12 @@ async function readTerminalOutcomesStrict(root = defaultTerminalOutcomeRoot()) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const path = join20(scopedRoot, entry.name);
-      const stat3 = await lstat11(path);
+      const stat3 = await lstat12(path);
       if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > MAX_OUTCOME_BYTES) {
         throw new Error("committed terminal outcome is not a trusted regular file");
       }
       const outcome = parseCommittedOutcome(
-        await readFile10(path, "utf8"),
+        await readFile11(path, "utf8"),
         match[1],
         Number(match[2])
       );
@@ -38660,13 +38931,13 @@ function createHostLogger(options = {}) {
 }
 
 // src/demo-state.ts
-import { isAbsolute as isAbsolute16, join as join21, parse as parse3, resolve as resolve14 } from "node:path";
+import { isAbsolute as isAbsolute17, join as join21, parse as parse3, resolve as resolve15 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
   if (!configured) return null;
-  const root = resolve14(configured);
-  if (!isAbsolute16(configured) || root === parse3(root).root) {
+  const root = resolve15(configured);
+  if (!isAbsolute17(configured) || root === parse3(root).root) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
   return {