@zixt/host 0.0.68 → 0.0.70

package/dist/index.js

@@ -31,7 +31,7 @@ import { homedir } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.68",
+  version: "0.0.70",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -15437,6 +15437,19 @@ var WorkspaceTelemetry = external_exports.object({
   checkedAt: IsoDate2,
   error: external_exports.string().max(1e3).nullable()
 });
+var HostHardware = external_exports.object({
+  cpuCount: external_exports.number().int().min(1).max(4096),
+  memoryTotalBytes: external_exports.number().int().min(0),
+  /** Unused memory right now, not memory reclaimable from caches. */
+  memoryFreeBytes: external_exports.number().int().min(0),
+  /** Null when the Machine's own filesystem could not be measured. */
+  disk: external_exports.object({
+    /** The measured filesystem's path, so free space names what it describes. */
+    path: SafeDisplayPath,
+    totalBytes: external_exports.number().int().min(0),
+    freeBytes: external_exports.number().int().min(0)
+  }).nullable().default(null)
+});
 var ProviderToolPackCapabilityBase = {
   version: external_exports.literal(1),
   checkedAt: IsoDate2,
@@ -15479,6 +15492,12 @@ var HostTelemetry = external_exports.object({
   runners: external_exports.array(RunnerTelemetry).default([]),
   workspaces: external_exports.array(WorkspaceTelemetry).default([]),
   docker: external_exports.enum(["available", "unavailable", "unknown"]).default("unknown"),
+  /**
+   * Additive capacity evidence. Optional rather than defaulted so a Host, a
+   * fixture, or a stored document written before hardware reporting existed is
+   * still a complete `HostTelemetry`; the cloud projects the absence as null.
+   */
+  hardware: HostHardware.nullable().optional(),
   /** Additive bundled tool-pack support; missing legacy hosts report false. */
   capabilities: external_exports.object({
     /**
@@ -16758,7 +16777,7 @@ var ListTasksResponse = external_exports.object({
 }).strict();
 
 // ../../packages/contracts/src/protocol.ts
-var PROTOCOL_VERSION = 7;
+var PROTOCOL_VERSION = 8;
 var BROWSER_PROFILE_INVENTORY_PAGE_SIZE = 200;
 var TASK_CANCEL_ACK_EVENT = "zixt.task.cancel.acknowledged";
 var TASK_CREDENTIAL_ROLLOVER_ACK_EVENT = "zixt.task.credential_rollover.acknowledged";
@@ -17452,7 +17471,7 @@ var GithubTaskGrantBase = {
   installationAccount: external_exports.object({
     accountId: GithubNumericId,
     login: external_exports.string().min(1).max(100),
-    type: external_exports.literal("Organization")
+    type: external_exports.enum(["Organization", "User"])
   }).strict(),
   installationRevision: external_exports.number().int().min(1),
   ownershipRevision: external_exports.number().int().min(1),
@@ -17567,6 +17586,13 @@ var GithubTaskGrant = external_exports.union([
       message: "operations and effectiveCapabilities must be the same duplicate-free set"
     });
   }
+  if (grant.installationAccount.type === "User" && grant.operations.includes("repository.create")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["operations"],
+      message: "personal GitHub installations cannot grant repository creation"
+    });
+  }
 });
 var LinearProviderTaskGrant = LinearTaskGrant.extend({
   provider: external_exports.literal("linear")
@@ -18466,6 +18492,186 @@ var ManagerStreamFrame = external_exports.discriminatedUnion("type", [
   external_exports.object({ type: external_exports.literal("conversation"), conversation: ConversationProjection }).strict()
 ]);
 
+// ../../packages/contracts/src/platform.ts
+var JournalEntry = external_exports.object({
+  id: external_exports.string(),
+  agentId: AgentId,
+  /** auto = task/comm lifecycle; note = agent-written. */
+  kind: external_exports.enum(["auto", "note"]),
+  text: external_exports.string().min(1).max(1e4),
+  at: IsoDate2
+});
+var MemoryEntry = external_exports.object({
+  id: external_exports.string(),
+  agentId: AgentId,
+  /** Machine display name; null = true everywhere (global). */
+  machine: external_exports.string().nullable(),
+  kind: external_exports.enum(["fact", "preference", "lesson", "context", "correction", "project", "environment"]),
+  /** TS-10: written during an external-origin run; render as untrusted data. */
+  trust: external_exports.enum(["internal", "external"]),
+  text: external_exports.string().min(1).max(2e3),
+  updatedAt: IsoDate2
+});
+var JournalResponse = external_exports.object({
+  /** Bounded current-state summary (compaction target). */
+  summary: external_exports.string(),
+  entries: external_exports.array(JournalEntry),
+  /** Curated memory, newest first. Absent only from pre-memory clients' view. */
+  memories: external_exports.array(MemoryEntry).default([])
+});
+var AuditRecord = external_exports.object({
+  id: external_exports.string(),
+  /** member:<id>, agent:<id>, host:<id>, or system. */
+  actor: external_exports.string(),
+  action: external_exports.string(),
+  /** Prefixed id of the acted-on resource. */
+  target: external_exports.string(),
+  summary: external_exports.string().max(2e3),
+  /** Exact machine-readable deltas when the event changes configuration. */
+  changes: external_exports.object({
+    connectionAccess: external_exports.object({ before: ConnectionAccess, after: ConnectionAccess }).optional(),
+    requiredConnectionIds: external_exports.object({
+      before: external_exports.array(ConnectionId).max(100),
+      after: external_exports.array(ConnectionId).max(100)
+    }).optional(),
+    integrationSettings: external_exports.object({ before: IntegrationSettings, after: IntegrationSettings }).optional()
+  }).strict().optional(),
+  at: IsoDate2
+});
+var ListAuditResponse = external_exports.object({ records: external_exports.array(AuditRecord) });
+var SecretScope = external_exports.enum(["org", "agent"]);
+var SecretKind = external_exports.enum(["env", "web_login"]);
+var SecretMeta = external_exports.object({
+  name: external_exports.string().min(1).max(120).regex(/^[A-Z][A-Z0-9_]*$/, "UPPER_SNAKE_CASE env var name"),
+  /** Absent on legacy rows/clients means `env`. */
+  kind: SecretKind.default("env"),
+  scope: SecretScope,
+  /** Canonical availability set for teammate-scoped credentials. */
+  agentIds: external_exports.array(AgentId).min(1).nullable().default(null),
+  /** Legacy single-teammate projection, retained while older clients migrate. */
+  agentId: AgentId.nullable(),
+  /**
+   * What this credential is for — rendered into the agent's system prompt
+   * (names and descriptions only, never values) so the agent knows what it
+   * holds and when to reach for it.
+   */
+  description: external_exports.string().max(500).optional(),
+  /** web_login metadata (admin projection only; never the password). */
+  webLogin: external_exports.object({ loginUrl: external_exports.url().max(2e3), username: external_exports.string().min(1).max(500) }).strict().optional(),
+  updatedAt: IsoDate2
+});
+var PutSecretFields = {
+  name: SecretMeta.shape.name,
+  kind: SecretKind.default("env"),
+  /** env kind: required single value. */
+  value: external_exports.string().min(1).max(1e4).optional(),
+  /** web_login kind: required structured value. */
+  webLogin: WebLoginValue.optional(),
+  description: external_exports.string().max(500).optional()
+};
+var requireKindMatchingValue = (request, ctx) => {
+  if (request.kind === "env") {
+    if (request.value === void 0)
+      ctx.addIssue({ code: "custom", path: ["value"], message: "env credentials require a value" });
+    if (request.webLogin !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["webLogin"],
+        message: "env credentials must not carry a website login"
+      });
+  } else {
+    if (request.webLogin === void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["webLogin"],
+        message: "website logins require loginUrl, username, and password"
+      });
+    if (request.value !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: ["value"],
+        message: "website logins must not carry a bare value"
+      });
+  }
+};
+var PutSecretRequest = external_exports.discriminatedUnion("scope", [
+  external_exports.object({ ...PutSecretFields, scope: external_exports.literal("org") }).strict().superRefine(requireKindMatchingValue),
+  external_exports.object({
+    ...PutSecretFields,
+    scope: external_exports.literal("agent"),
+    agentIds: external_exports.array(AgentId).min(1).max(100).optional(),
+    agentId: AgentId.optional()
+  }).strict().superRefine((request, ctx) => {
+    if (request.agentIds === void 0 === (request.agentId === void 0)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["agentIds"],
+        message: "teammate credentials require exactly one of agentIds or legacy agentId"
+      });
+    }
+    if (request.agentIds && new Set(request.agentIds).size !== request.agentIds.length) {
+      ctx.addIssue({ code: "custom", path: ["agentIds"], message: "duplicate AI teammate" });
+    }
+  }).superRefine(requireKindMatchingValue)
+]);
+var AdminSecretsProjection = external_exports.object({
+  metadataRedacted: external_exports.literal(false),
+  secrets: external_exports.array(SecretMeta)
+}).strict();
+var MemberSecretsProjection = external_exports.object({
+  metadataRedacted: external_exports.literal(true),
+  configured: external_exports.boolean(),
+  secrets: external_exports.tuple([])
+}).strict();
+var ListSecretsResponse = external_exports.discriminatedUnion("metadataRedacted", [
+  AdminSecretsProjection,
+  MemberSecretsProjection
+]);
+var Invite = external_exports.object({
+  id: external_exports.string(),
+  orgId: OrgId,
+  email: external_exports.email(),
+  role: OrgRole.exclude(["owner"]),
+  acceptedAt: IsoDate2.nullable(),
+  expiresAt: IsoDate2,
+  revokedAt: IsoDate2.nullable(),
+  createdAt: IsoDate2
+});
+var CreateInviteRequest = external_exports.object({
+  email: external_exports.email(),
+  role: OrgRole.exclude(["owner"]).default("member")
+});
+var CreateInviteResponse = external_exports.object({
+  invite: Invite,
+  /** One-time acceptance URL, also emailed when the deployment has SMTP. */
+  acceptUrl: external_exports.url(),
+  /** True when the invitation email was accepted by the mail server. */
+  emailed: external_exports.boolean().default(false)
+});
+var ListInvitesResponse = external_exports.object({ invites: external_exports.array(Invite) });
+var UpdateMemberRoleRequest = external_exports.object({ role: OrgRole });
+var ConnectorKind = external_exports.enum([
+  "github",
+  "slack",
+  "linear",
+  "zendesk",
+  "jira",
+  "email",
+  "mcp"
+]);
+var ConnectorCatalogEntry = external_exports.object({
+  kind: ConnectorKind,
+  name: external_exports.string(),
+  description: external_exports.string(),
+  status: external_exports.enum(["available", "coming_soon"])
+});
+var ConnectionsCatalogResponse = external_exports.object({
+  catalog: external_exports.array(ConnectorCatalogEntry),
+  connections: external_exports.array(
+    external_exports.object({ id: MemberId.or(external_exports.string()), kind: ConnectorKind, name: external_exports.string() })
+  )
+});
+
 // ../../packages/contracts/src/api.ts
 var ProblemCode = external_exports.enum([
   "network_unavailable",
@@ -18513,6 +18719,11 @@ var CreateOrgRequest = external_exports.object({
   name: Org.shape.name,
   slug: Org.shape.slug
 });
+var RenameOrgRequest = external_exports.object({
+  // Trimmed before the length checks so surrounding whitespace cannot pass as a
+  // name and leave the organization blank everywhere its name is displayed.
+  name: external_exports.string().trim().pipe(Org.shape.name)
+});
 var DESKTOP_SIDEBAR_MIN_WIDTH_PX = 240;
 var DESKTOP_SIDEBAR_MAX_WIDTH_PX = 420;
 var TASK_SIDEBAR_MIN_WIDTH_PX = 240;
@@ -18814,6 +19025,15 @@ var HostConsoleResponse = external_exports.object({
   available: external_exports.boolean()
 });
 var HostUpdateResponse = external_exports.object({ accepted: external_exports.literal(true) });
+var MachineMemoryEntry = MemoryEntry.omit({ machine: true }).extend({
+  agentName: external_exports.string().min(1).max(120)
+});
+var MachineMemoriesResponse = external_exports.object({
+  /** Machine-scoped memory across the organization's teammates, newest first. */
+  memories: external_exports.array(MachineMemoryEntry).max(200).default([]),
+  /** True when older entries exist beyond the bounded set; never silent. */
+  truncated: external_exports.boolean().default(false)
+});
 
 // ../../packages/contracts/src/redaction.ts
 var REDACTED_CREDENTIAL = "[REDACTED]";
@@ -19842,11 +20062,6 @@ var HttpOrigin2 = external_exports.url().max(2e3).refine((value) => {
   return (parsed.protocol === "https:" || parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) && parsed.origin === value && parsed.username === "" && parsed.password === "";
 }, "must be an exact credential-free HTTPS origin or local loopback HTTP origin");
 var StartGithubConnectionRequest = external_exports.object({
-  /**
-   * Reopen GitHub's account picker instead of the account already connected.
-   * Configuring the known account is one click; changing it is deliberate.
-   */
-  switchAccount: external_exports.boolean().optional(),
   returnPath: SafeReturnPath2.optional()
 }).strict();
 var StartGithubTeammateOAuthRequest = external_exports.object({
@@ -19916,186 +20131,6 @@ var BrowserOAuthConfig = external_exports.object({
   githubAppSlug: GithubAppSlug.nullable()
 }).strict();
 
-// ../../packages/contracts/src/platform.ts
-var JournalEntry = external_exports.object({
-  id: external_exports.string(),
-  agentId: AgentId,
-  /** auto = task/comm lifecycle; note = agent-written. */
-  kind: external_exports.enum(["auto", "note"]),
-  text: external_exports.string().min(1).max(1e4),
-  at: IsoDate2
-});
-var MemoryEntry = external_exports.object({
-  id: external_exports.string(),
-  agentId: AgentId,
-  /** Machine display name; null = true everywhere (global). */
-  machine: external_exports.string().nullable(),
-  kind: external_exports.enum(["fact", "preference", "lesson", "context", "correction", "project", "environment"]),
-  /** TS-10: written during an external-origin run; render as untrusted data. */
-  trust: external_exports.enum(["internal", "external"]),
-  text: external_exports.string().min(1).max(2e3),
-  updatedAt: IsoDate2
-});
-var JournalResponse = external_exports.object({
-  /** Bounded current-state summary (compaction target). */
-  summary: external_exports.string(),
-  entries: external_exports.array(JournalEntry),
-  /** Curated memory, newest first. Absent only from pre-memory clients' view. */
-  memories: external_exports.array(MemoryEntry).default([])
-});
-var AuditRecord = external_exports.object({
-  id: external_exports.string(),
-  /** member:<id>, agent:<id>, host:<id>, or system. */
-  actor: external_exports.string(),
-  action: external_exports.string(),
-  /** Prefixed id of the acted-on resource. */
-  target: external_exports.string(),
-  summary: external_exports.string().max(2e3),
-  /** Exact machine-readable deltas when the event changes configuration. */
-  changes: external_exports.object({
-    connectionAccess: external_exports.object({ before: ConnectionAccess, after: ConnectionAccess }).optional(),
-    requiredConnectionIds: external_exports.object({
-      before: external_exports.array(ConnectionId).max(100),
-      after: external_exports.array(ConnectionId).max(100)
-    }).optional(),
-    integrationSettings: external_exports.object({ before: IntegrationSettings, after: IntegrationSettings }).optional()
-  }).strict().optional(),
-  at: IsoDate2
-});
-var ListAuditResponse = external_exports.object({ records: external_exports.array(AuditRecord) });
-var SecretScope = external_exports.enum(["org", "agent"]);
-var SecretKind = external_exports.enum(["env", "web_login"]);
-var SecretMeta = external_exports.object({
-  name: external_exports.string().min(1).max(120).regex(/^[A-Z][A-Z0-9_]*$/, "UPPER_SNAKE_CASE env var name"),
-  /** Absent on legacy rows/clients means `env`. */
-  kind: SecretKind.default("env"),
-  scope: SecretScope,
-  /** Canonical availability set for teammate-scoped credentials. */
-  agentIds: external_exports.array(AgentId).min(1).nullable().default(null),
-  /** Legacy single-teammate projection, retained while older clients migrate. */
-  agentId: AgentId.nullable(),
-  /**
-   * What this credential is for — rendered into the agent's system prompt
-   * (names and descriptions only, never values) so the agent knows what it
-   * holds and when to reach for it.
-   */
-  description: external_exports.string().max(500).optional(),
-  /** web_login metadata (admin projection only; never the password). */
-  webLogin: external_exports.object({ loginUrl: external_exports.url().max(2e3), username: external_exports.string().min(1).max(500) }).strict().optional(),
-  updatedAt: IsoDate2
-});
-var PutSecretFields = {
-  name: SecretMeta.shape.name,
-  kind: SecretKind.default("env"),
-  /** env kind: required single value. */
-  value: external_exports.string().min(1).max(1e4).optional(),
-  /** web_login kind: required structured value. */
-  webLogin: WebLoginValue.optional(),
-  description: external_exports.string().max(500).optional()
-};
-var requireKindMatchingValue = (request, ctx) => {
-  if (request.kind === "env") {
-    if (request.value === void 0)
-      ctx.addIssue({ code: "custom", path: ["value"], message: "env credentials require a value" });
-    if (request.webLogin !== void 0)
-      ctx.addIssue({
-        code: "custom",
-        path: ["webLogin"],
-        message: "env credentials must not carry a website login"
-      });
-  } else {
-    if (request.webLogin === void 0)
-      ctx.addIssue({
-        code: "custom",
-        path: ["webLogin"],
-        message: "website logins require loginUrl, username, and password"
-      });
-    if (request.value !== void 0)
-      ctx.addIssue({
-        code: "custom",
-        path: ["value"],
-        message: "website logins must not carry a bare value"
-      });
-  }
-};
-var PutSecretRequest = external_exports.discriminatedUnion("scope", [
-  external_exports.object({ ...PutSecretFields, scope: external_exports.literal("org") }).strict().superRefine(requireKindMatchingValue),
-  external_exports.object({
-    ...PutSecretFields,
-    scope: external_exports.literal("agent"),
-    agentIds: external_exports.array(AgentId).min(1).max(100).optional(),
-    agentId: AgentId.optional()
-  }).strict().superRefine((request, ctx) => {
-    if (request.agentIds === void 0 === (request.agentId === void 0)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["agentIds"],
-        message: "teammate credentials require exactly one of agentIds or legacy agentId"
-      });
-    }
-    if (request.agentIds && new Set(request.agentIds).size !== request.agentIds.length) {
-      ctx.addIssue({ code: "custom", path: ["agentIds"], message: "duplicate AI teammate" });
-    }
-  }).superRefine(requireKindMatchingValue)
-]);
-var AdminSecretsProjection = external_exports.object({
-  metadataRedacted: external_exports.literal(false),
-  secrets: external_exports.array(SecretMeta)
-}).strict();
-var MemberSecretsProjection = external_exports.object({
-  metadataRedacted: external_exports.literal(true),
-  configured: external_exports.boolean(),
-  secrets: external_exports.tuple([])
-}).strict();
-var ListSecretsResponse = external_exports.discriminatedUnion("metadataRedacted", [
-  AdminSecretsProjection,
-  MemberSecretsProjection
-]);
-var Invite = external_exports.object({
-  id: external_exports.string(),
-  orgId: OrgId,
-  email: external_exports.email(),
-  role: OrgRole.exclude(["owner"]),
-  acceptedAt: IsoDate2.nullable(),
-  expiresAt: IsoDate2,
-  revokedAt: IsoDate2.nullable(),
-  createdAt: IsoDate2
-});
-var CreateInviteRequest = external_exports.object({
-  email: external_exports.email(),
-  role: OrgRole.exclude(["owner"]).default("member")
-});
-var CreateInviteResponse = external_exports.object({
-  invite: Invite,
-  /** One-time acceptance URL, also emailed when the deployment has SMTP. */
-  acceptUrl: external_exports.url(),
-  /** True when the invitation email was accepted by the mail server. */
-  emailed: external_exports.boolean().default(false)
-});
-var ListInvitesResponse = external_exports.object({ invites: external_exports.array(Invite) });
-var UpdateMemberRoleRequest = external_exports.object({ role: OrgRole });
-var ConnectorKind = external_exports.enum([
-  "github",
-  "slack",
-  "linear",
-  "zendesk",
-  "jira",
-  "email",
-  "mcp"
-]);
-var ConnectorCatalogEntry = external_exports.object({
-  kind: ConnectorKind,
-  name: external_exports.string(),
-  description: external_exports.string(),
-  status: external_exports.enum(["available", "coming_soon"])
-});
-var ConnectionsCatalogResponse = external_exports.object({
-  catalog: external_exports.array(ConnectorCatalogEntry),
-  connections: external_exports.array(
-    external_exports.object({ id: MemberId.or(external_exports.string()), kind: ConnectorKind, name: external_exports.string() })
-  )
-});
-
 // ../../packages/contracts/src/secrets-env.ts
 var BLOCKED_SECRET_ENV = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
@@ -20499,7 +20534,7 @@ async function generateTaskTitle(instructions, runner) {
     instructions.slice(0, INSTRUCTIONS_BUDGET),
     "</task_request>"
   ].join("\n");
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const child = spawnCli(
       command,
       [
@@ -20522,7 +20557,7 @@ async function generateTaskTitle(instructions, runner) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve16(value);
+      resolve17(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -20844,11 +20879,11 @@ function createWorkerWatchdogSendDrain() {
         if (completed) return;
         completed = true;
         pending--;
-        if (pending === 0) drained.splice(0).forEach((resolve16) => resolve16());
+        if (pending === 0) drained.splice(0).forEach((resolve17) => resolve17());
       };
     },
     drain: async () => {
-      if (pending > 0) await new Promise((resolve16) => drained.push(resolve16));
+      if (pending > 0) await new Promise((resolve17) => drained.push(resolve17));
     }
   };
 }
@@ -21093,7 +21128,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
   const deadline = Date.parse(retryAt);
   if (!Number.isFinite(deadline) || signal.aborted) return false;
   if (deadline <= Date.now()) return true;
-  return await new Promise((resolve16) => {
+  return await new Promise((resolve17) => {
     let settled = false;
     let timer;
     const finish = (ready) => {
@@ -21101,7 +21136,7 @@ async function waitForOperationGrantRetry(retryAt, signal) {
       settled = true;
       if (timer) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve16(ready);
+      resolve17(ready);
     };
     const onAbort = () => finish(false);
     const schedule = () => {
@@ -21369,22 +21404,22 @@ var HostClient = class _HostClient {
     const unwindingAssignments = [...this.activeAssignments.values()];
     for (const cancel of this.cancels.values()) cancel(stopReason);
     for (const entry of this.secretGrants.values()) {
-      for (const resolve16 of entry.resolvers) resolve16({});
+      for (const resolve17 of entry.resolvers) resolve17({});
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.connectionGrants.values()) {
-      for (const resolve16 of entry.resolvers) resolve16([]);
+      for (const resolve17 of entry.resolvers) resolve17([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const entry of this.providerGrants.values()) {
-      for (const resolve16 of entry.resolvers) resolve16([]);
+      for (const resolve17 of entry.resolvers) resolve17([]);
       entry.resolvers = [];
       delete entry.value;
     }
     for (const waiters of this.approvalWaiters.values()) {
-      for (const resolve16 of waiters.values()) resolve16({ approved: false, guidance: reason });
+      for (const resolve17 of waiters.values()) resolve17({ approved: false, guidance: reason });
     }
     for (const waiters of this.agentOpWaiters.values()) {
       for (const waiter of waiters.values()) {
@@ -21410,9 +21445,9 @@ var HostClient = class _HostClient {
     let drainTimer;
     const drained = await Promise.race([
       Promise.allSettled(runs).then(() => true),
-      new Promise((resolve16) => {
+      new Promise((resolve17) => {
         drainTimer = setTimeout(
-          () => resolve16(false),
+          () => resolve17(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         drainTimer.unref?.();
@@ -21556,9 +21591,9 @@ var HostClient = class _HostClient {
     let frameDrainTimer;
     const framesDrained = await Promise.race([
       frameTail.then(() => true),
-      new Promise((resolve16) => {
+      new Promise((resolve17) => {
         frameDrainTimer = setTimeout(
-          () => resolve16(false),
+          () => resolve17(false),
           this.opts.unwindTimeoutMs ?? _HostClient.DEFAULT_UNWIND_TIMEOUT_MS
         );
         frameDrainTimer.unref?.();
@@ -22102,7 +22137,7 @@ var HostClient = class _HostClient {
         const entry = this.secretGrants.get(key) ?? { resolvers: [] };
         entry.value = message.secrets;
         entry.expiresAt = expiresAt;
-        for (const resolve16 of entry.resolvers) resolve16(message.secrets);
+        for (const resolve17 of entry.resolvers) resolve17(message.secrets);
         entry.resolvers = [];
         this.secretGrants.set(key, entry);
         return;
@@ -22133,13 +22168,13 @@ var HostClient = class _HostClient {
         const entry = this.connectionGrants.get(key) ?? { resolvers: [] };
         entry.value = message.connections;
         entry.expiresAt = expiresAt;
-        for (const resolve16 of entry.resolvers) resolve16(message.connections);
+        for (const resolve17 of entry.resolvers) resolve17(message.connections);
         entry.resolvers = [];
         this.connectionGrants.set(key, entry);
         const providerEntry = this.providerGrants.get(key) ?? { resolvers: [] };
         providerEntry.value = providers;
         providerEntry.expiresAt = authorityExpiresAt;
-        for (const resolve16 of providerEntry.resolvers) resolve16(providers);
+        for (const resolve17 of providerEntry.resolvers) resolve17(providers);
         providerEntry.resolvers = [];
         this.providerGrants.set(key, providerEntry);
         return;
@@ -22273,8 +22308,8 @@ var HostClient = class _HostClient {
       return redactCredentialText(text, sensitiveSnapshot()).slice(0, maxLength);
     };
     let resolveCancelled;
-    const cancelledPromise = new Promise((resolve16) => {
-      resolveCancelled = resolve16;
+    const cancelledPromise = new Promise((resolve17) => {
+      resolveCancelled = resolve17;
     });
     const endAuthority = (reason = "cloud_cancel") => {
       if (stopReason) return;
@@ -22283,21 +22318,21 @@ var HostClient = class _HostClient {
       authorityController.abort(reason);
       const secretEntry = this.secretGrants.get(cancelKey);
       if (secretEntry) {
-        for (const resolve16 of secretEntry.resolvers) resolve16({});
+        for (const resolve17 of secretEntry.resolvers) resolve17({});
         secretEntry.resolvers = [];
         delete secretEntry.value;
       }
       this.secretGrants.delete(cancelKey);
       const connectionEntry = this.connectionGrants.get(cancelKey);
       if (connectionEntry) {
-        for (const resolve16 of connectionEntry.resolvers) resolve16([]);
+        for (const resolve17 of connectionEntry.resolvers) resolve17([]);
         connectionEntry.resolvers = [];
         delete connectionEntry.value;
       }
       this.connectionGrants.delete(cancelKey);
       const providerEntry = this.providerGrants.get(cancelKey);
       if (providerEntry) {
-        for (const resolve16 of providerEntry.resolvers) resolve16([]);
+        for (const resolve17 of providerEntry.resolvers) resolve17([]);
         providerEntry.resolvers = [];
         delete providerEntry.value;
       }
@@ -22305,8 +22340,8 @@ var HostClient = class _HostClient {
       this.clearAuthorityExpiry(cancelKey);
       const approvalWaiters = this.approvalWaiters.get(cancelKey);
       if (approvalWaiters) {
-        for (const resolve16 of approvalWaiters.values()) {
-          resolve16({ approved: false, guidance: "task was cancelled" });
+        for (const resolve17 of approvalWaiters.values()) {
+          resolve17({ approved: false, guidance: "task was cancelled" });
         }
         approvalWaiters.clear();
       }
@@ -22432,9 +22467,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve16) => {
-        entry.resolvers.push((value) => resolve16(capture(value)));
-        setTimeout(() => resolve16(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve17) => {
+        entry.resolvers.push((value) => resolve17(capture(value)));
+        setTimeout(() => resolve17(capture(entry.value ?? {})), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const connections = () => {
@@ -22451,9 +22486,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve16) => {
-        entry.resolvers.push((value) => resolve16(capture(value)));
-        setTimeout(() => resolve16(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve17) => {
+        entry.resolvers.push((value) => resolve17(capture(value)));
+        setTimeout(() => resolve17(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const providers = () => {
@@ -22470,9 +22505,9 @@ var HostClient = class _HostClient {
         return value;
       };
       if (entry.value !== void 0) return Promise.resolve(capture(entry.value));
-      return new Promise((resolve16) => {
-        entry.resolvers.push((value) => resolve16(capture(value)));
-        setTimeout(() => resolve16(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
+      return new Promise((resolve17) => {
+        entry.resolvers.push((value) => resolve17(capture(value)));
+        setTimeout(() => resolve17(capture(entry.value ?? [])), _HostClient.SECRETS_WAIT_MS);
       });
     };
     const linear = async () => {
@@ -22498,13 +22533,13 @@ var HostClient = class _HostClient {
         payload: safe(payload, 5e4),
         ...questionChoices ? { questionChoices: [...questionChoices] } : {}
       });
-      return new Promise((resolve16) => {
+      return new Promise((resolve17) => {
         const waiters = this.approvalWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.approvalWaiters.set(cancelKey, waiters);
-        waiters.set(requestId, resolve16);
+        waiters.set(requestId, resolve17);
         void cancelledPromise.then(() => {
           if (waiters.delete(requestId)) {
-            resolve16({ approved: false, guidance: "task was cancelled" });
+            resolve17({ approved: false, guidance: "task was cancelled" });
           }
         });
       });
@@ -22550,11 +22585,11 @@ var HostClient = class _HostClient {
         if (existing) message = existing;
         else terminalMessages.set(requestId, message);
       }
-      return new Promise((resolve16) => {
+      return new Promise((resolve17) => {
         const waiters = this.agentOpWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
         this.agentOpWaiters.set(cancelKey, waiters);
         if (waiters.has(requestId)) {
-          resolve16({ ok: false, error: "provider settlement request is already in flight" });
+          resolve17({ ok: false, error: "provider settlement request is already in flight" });
           return;
         }
         const timer = setTimeout(() => {
@@ -22565,7 +22600,7 @@ var HostClient = class _HostClient {
                 (pending) => !(pending.type === "agent.op" && pending.requestId === requestId)
               );
             }
-            resolve16({
+            resolve17({
               ok: false,
               error: terminal ? "The provider call completed, but Zixt could not record its outcome. Do not retry; wait for reconciliation." : "the platform did not answer in time; verify with a list_* tool before retrying a mutating call"
             });
@@ -22573,7 +22608,7 @@ var HostClient = class _HostClient {
         }, _HostClient.AGENT_OP_TIMEOUT_MS);
         timer.unref?.();
         waiters.set(requestId, {
-          resolve: resolve16,
+          resolve: resolve17,
           timer,
           ...terminal ? { terminalMessage: message } : {}
         });
@@ -22619,12 +22654,12 @@ var HostClient = class _HostClient {
             "No GitHub change was attempted; the authority grant request was invalid."
           );
         }
-        const outcome = await new Promise((resolve16) => {
+        const outcome = await new Promise((resolve17) => {
           const timer = setTimeout(() => {
             const waiter = this.operationGrantWaiters.get(requestId);
             if (!waiter) return;
             this.operationGrantWaiters.delete(requestId);
-            resolve16({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
+            resolve17({ grant: null, retryable: true, reason: "no_reply_from_zixt" });
           }, this.operationGrantTimeoutMs);
           timer.unref?.();
           this.operationGrantWaiters.set(requestId, {
@@ -22637,9 +22672,9 @@ var HostClient = class _HostClient {
             timer,
             accept: (grant) => {
               addSensitiveValues(providerGrantSensitiveValues(grant));
-              resolve16({ grant });
+              resolve17({ grant });
             },
-            deny: (retryable, reason, detail, retryAt, retryCode) => resolve16({
+            deny: (retryable, reason, detail, retryAt, retryCode) => resolve17({
               grant: null,
               retryable,
               reason,
@@ -22653,7 +22688,7 @@ var HostClient = class _HostClient {
           } catch {
             clearTimeout(timer);
             this.operationGrantWaiters.delete(requestId);
-            resolve16({ grant: null, retryable: false, reason: "connection_unavailable" });
+            resolve17({ grant: null, retryable: false, reason: "connection_unavailable" });
           }
         });
         if (outcome.grant) {
@@ -22709,7 +22744,7 @@ var HostClient = class _HostClient {
           )
         );
       }
-      return new Promise((resolve16, reject3) => {
+      return new Promise((resolve17, reject3) => {
         const timer = setTimeout(() => {
           if (this.browserCredentialWaiters.delete(requestId)) {
             reject3(
@@ -22728,7 +22763,7 @@ var HostClient = class _HostClient {
           timer,
           accept: (credential) => {
             addSensitiveValues(webLoginSensitiveValues(credential));
-            resolve16(credential);
+            resolve17(credential);
           },
           deny: (reason) => reject3(new Error(reason))
         });
@@ -23049,14 +23084,14 @@ async function observeWindowsGuardianNonce(pid, nonce) {
       "Windows runner identity could not be observed"
     );
   }
-  return new Promise((resolve16, reject3) => {
+  return new Promise((resolve17, reject3) => {
     let done = false;
     const finish = (result) => {
       if (done) return;
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve16(result);
+      else resolve17(result);
     };
     const timeout = setTimeout(
       () => finish(
@@ -23101,7 +23136,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       );
     }
   }
-  return new Promise((resolve16, reject3) => {
+  return new Promise((resolve17, reject3) => {
     const observer = spawn2("/bin/ps", ["-ww", "-o", "command=", "-p", String(pid)], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -23112,7 +23147,7 @@ async function observePosixGuardianNonce(pid, nonce) {
       done = true;
       clearTimeout(timeout);
       if (result instanceof Error) reject3(result);
-      else resolve16(result);
+      else resolve17(result);
     };
     const timeout = setTimeout(() => {
       observer.kill("SIGKILL");
@@ -23159,7 +23194,7 @@ async function observeGuardianIdentity(pid, identity) {
   return process.platform === "win32" ? observeWindowsGuardianNonce(pid, identity.nonce) : observePosixGuardianNonce(pid, identity.nonce);
 }
 function delay(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 function posixProcessRecordsFromPs(output) {
   const records = [];
@@ -23192,7 +23227,7 @@ function posixProcessRecordsFromPs(output) {
   return records;
 }
 async function snapshotPosixProcesses() {
-  return new Promise((resolve16, reject3) => {
+  return new Promise((resolve17, reject3) => {
     const observer = spawn2("/bin/ps", ["-axo", "uid=,pid=,ppid=,pgid=,stat="], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -23205,7 +23240,7 @@ async function snapshotPosixProcesses() {
       if (error52) reject3(error52);
       else {
         try {
-          resolve16(posixProcessRecordsFromPs(output));
+          resolve17(posixProcessRecordsFromPs(output));
         } catch (caught) {
           reject3(caught);
         }
@@ -23540,7 +23575,7 @@ async function snapshotWindowsDescendants(rootPid) {
       "Windows process-tree observation could not start"
     );
   }
-  return new Promise((resolve16, reject3) => {
+  return new Promise((resolve17, reject3) => {
     let done = false;
     const timeout = setTimeout(() => {
       if (done) return;
@@ -23567,7 +23602,7 @@ async function snapshotWindowsDescendants(rootPid) {
         return;
       }
       try {
-        resolve16(completeWindowsDescendantPids(rootPid, processes));
+        resolve17(completeWindowsDescendantPids(rootPid, processes));
       } catch (caught) {
         reject3(caught);
       }
@@ -23614,7 +23649,7 @@ async function waitForProcessesExit(pids, timeoutMs) {
 }
 async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, independentlyTrackedPids = []) {
   const trustedCommand = command ?? defaultTaskkillCommand();
-  const result = await new Promise((resolve16, reject3) => {
+  const result = await new Promise((resolve17, reject3) => {
     const killer = spawn2(trustedCommand, ["/PID", String(pid), "/T", "/F"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -23649,7 +23684,7 @@ async function runTaskkill(pid, command, timeoutMs = TASKKILL_TIMEOUT_MS, indepe
       done = true;
       clearTimeout(timeout);
       if (error52) reject3(error52);
-      else resolve16({ code: killer.exitCode, output, outputTruncated });
+      else resolve17({ code: killer.exitCode, output, outputTruncated });
     };
     killer.once(
       "error",
@@ -24326,12 +24361,12 @@ async function createWindowsJobContainment(pid, options) {
     stderr = `${stderr}${String(chunk)}`.slice(-HELPER_OUTPUT_LIMIT);
   });
   const helperEvents = helper;
-  const exited = new Promise((resolve16) => {
+  const exited = new Promise((resolve17) => {
     let completed = false;
     const complete = (code, signal) => {
       if (completed) return;
       completed = true;
-      resolve16({ code, signal });
+      resolve17({ code, signal });
     };
     helperEvents.once("error", () => {
       failProtocol(new Error("Windows Job Object helper could not start"));
@@ -24344,7 +24379,7 @@ async function createWindowsJobContainment(pid, options) {
   });
   const nextLine = async (expected) => {
     if (protocolFailure) throw protocolFailure;
-    const line = lines.shift() ?? await new Promise((resolve16, reject3) => {
+    const line = lines.shift() ?? await new Promise((resolve17, reject3) => {
       const timer = setTimeout(
         () => reject3(timeoutError("Windows Job Object helper did not answer in time")),
         timeoutMs
@@ -24352,7 +24387,7 @@ async function createWindowsJobContainment(pid, options) {
       timer.unref?.();
       lineWaiters.push((value) => {
         clearTimeout(timer);
-        resolve16(value);
+        resolve17(value);
       });
     });
     if (protocolFailure) throw protocolFailure;
@@ -24365,8 +24400,8 @@ async function createWindowsJobContainment(pid, options) {
     }
     const stopped = await Promise.race([
       exited.then(() => true),
-      new Promise((resolve16) => {
-        const timer = setTimeout(() => resolve16(false), timeoutMs);
+      new Promise((resolve17) => {
+        const timer = setTimeout(() => resolve17(false), timeoutMs);
         timer.unref?.();
       })
     ]);
@@ -24425,7 +24460,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
   if (nonce === void 0) return true;
   if (!SAFE_NONCE2.test(nonce)) return false;
   const expected = windowsContainmentGate(nonce).trimEnd();
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let pending = Buffer.alloc(0);
     let settled = false;
     const finish = (result) => {
@@ -24436,7 +24471,7 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
       input.off("end", onEnd);
       input.off("error", onEnd);
       if (result) input.pause();
-      resolve16(result);
+      resolve17(result);
     };
     const onData = (chunk) => {
       pending = Buffer.concat([pending, chunk]);
@@ -24861,7 +24896,7 @@ async function installRelease(version2, options = {}) {
     installerContainmentSetupError = error52;
     return null;
   }) : Promise.resolve(null);
-  const installed = await new Promise((resolve16, reject3) => {
+  const installed = await new Promise((resolve17, reject3) => {
     let finished = false;
     let cleanupStarted = false;
     let exitObserved = false;
@@ -24877,7 +24912,7 @@ async function installRelease(version2, options = {}) {
       finished = true;
       clearTimeout(timer);
       options.signal?.removeEventListener("abort", requestCleanup);
-      resolve16(result);
+      resolve17(result);
     };
     const requestCleanup = () => {
       if (cleanupStarted || finished) return;
@@ -25190,11 +25225,11 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   child.stdin?.on("error", () => {
   });
   process.stdin.pipe(child.stdin);
-  return new Promise((resolve16) => {
-    child.once("error", () => resolve16(1));
+  return new Promise((resolve17) => {
+    child.once("error", () => resolve17(1));
     child.once("exit", (code) => {
       process.stdin.unpipe(child.stdin);
-      resolve16(code ?? 1);
+      resolve17(code ?? 1);
     });
   });
 }
@@ -25273,11 +25308,11 @@ async function launchHostSupervisor(options = {}) {
   const waitOrStop = async (ms) => {
     if (stopping) return false;
     if (!customDelay) {
-      await new Promise((resolve16) => {
+      await new Promise((resolve17) => {
         const finish = () => {
           clearTimeout(timer);
           stopController.signal.removeEventListener("abort", finish);
-          resolve16();
+          resolve17();
         };
         const timer = setTimeout(finish, ms);
         stopController.signal.addEventListener("abort", finish, { once: true });
@@ -25285,8 +25320,8 @@ async function launchHostSupervisor(options = {}) {
       return !stopping;
     }
     let finishStop;
-    const stopped = new Promise((resolve16) => {
-      finishStop = () => resolve16();
+    const stopped = new Promise((resolve17) => {
+      finishStop = () => resolve17();
       stopController.signal.addEventListener("abort", finishStop, { once: true });
     });
     await Promise.race([customDelay(ms), stopped]);
@@ -25412,19 +25447,19 @@ async function launchHostSupervisor(options = {}) {
       child = spawnSupervisor(entry, version2, ownershipDirectory, containmentGateNonce);
       const launchedSupervisor = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve16) => {
-        resolveChildExited = resolve16;
+      const childExited = new Promise((resolve17) => {
+        resolveChildExited = resolve17;
       });
       const supervisorContainmentAbort = new AbortController();
       void childExited.then(() => supervisorContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve16) => {
+        (resolve17) => {
           let observed = false;
           const finish = (code, signal) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve16({ code, signal });
+            resolve17({ code, signal });
           };
           child.once("error", () => finish(1, null));
           child.once("exit", finish);
@@ -25445,12 +25480,12 @@ async function launchHostSupervisor(options = {}) {
           if (!supervisorContainment || !launchedSupervisor.stdin) {
             throw new Error("supervisor Job Object gate is unavailable");
           }
-          await new Promise((resolve16, reject3) => {
+          await new Promise((resolve17, reject3) => {
             launchedSupervisor.stdin.write(
               windowsContainmentGate(containmentGateNonce),
               (error52) => {
                 if (error52) reject3(error52);
-                else resolve16();
+                else resolve17();
               }
             );
           });
@@ -25592,18 +25627,18 @@ async function superviseHost(options = {}) {
     }
   }
   let announceShutdown;
-  const shutdownAnnounced = new Promise((resolve16) => {
-    announceShutdown = resolve16;
+  const shutdownAnnounced = new Promise((resolve17) => {
+    announceShutdown = resolve17;
   });
   const attempted = /* @__PURE__ */ new Set();
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
-      await new Promise((resolve16) => {
+      await new Promise((resolve17) => {
         const finish = () => {
           clearTimeout(timer);
           shutdownController.signal.removeEventListener("abort", finish);
-          resolve16();
+          resolve17();
         };
         const timer = setTimeout(finish, ms);
         shutdownController.signal.addEventListener("abort", finish, { once: true });
@@ -25746,19 +25781,19 @@ async function superviseHost(options = {}) {
       child = spawnWorker(command, watchdogLaunch, compatibilityOwnership, containmentGateNonce);
       const watchedChild = child;
       let resolveChildExited;
-      const childExited = new Promise((resolve16) => {
-        resolveChildExited = resolve16;
+      const childExited = new Promise((resolve17) => {
+        resolveChildExited = resolve17;
       });
       const workerContainmentAbort = new AbortController();
       void childExited.then(() => workerContainmentAbort.abort());
       const outcomePromise = new Promise(
-        (resolve16) => {
+        (resolve17) => {
           let observed = false;
           const finish = (result) => {
             if (observed) return;
             observed = true;
             resolveChildExited();
-            resolve16(result);
+            resolve17(result);
           };
           watchedChild.once("error", () => finish({ code: 1, signal: null }));
           watchedChild.once(
@@ -25780,10 +25815,10 @@ async function superviseHost(options = {}) {
           if (!workerContainment || !watchedChild.stdin) {
             throw new Error("worker Job Object gate is unavailable");
           }
-          await new Promise((resolve16, reject3) => {
+          await new Promise((resolve17, reject3) => {
             watchedChild.stdin.write(windowsContainmentGate(containmentGateNonce), (error52) => {
               if (error52) reject3(error52);
-              else resolve16();
+              else resolve17();
             });
           });
         }
@@ -26047,7 +26082,47 @@ async function superviseHost(options = {}) {
 }
 
 // src/index.ts
-import { hostname as hostname3 } from "node:os";
+import { homedir as homedir12, hostname as hostname3 } from "node:os";
+
+// src/hardware.ts
+import { existsSync } from "node:fs";
+import { statfs } from "node:fs/promises";
+import { cpus, freemem, homedir as homedir2, totalmem } from "node:os";
+import { dirname as dirname4, resolve as resolve5 } from "node:path";
+async function machineHardware(workRoot = homedir2()) {
+  return {
+    // A container or cgroup can hide processors from this count; it is what
+    // this process can see, which is what its Tasks will actually get.
+    cpuCount: Math.max(1, cpus().length),
+    memoryTotalBytes: totalmem(),
+    memoryFreeBytes: freemem(),
+    disk: await diskSpace(workRoot)
+  };
+}
+async function diskSpace(workRoot) {
+  const measured = nearestExistingPath(workRoot);
+  if (!measured) return null;
+  try {
+    const stats = await statfs(measured);
+    const blockSize = Number(stats.bsize);
+    const freeBytes = Number(stats.bavail) * blockSize;
+    const totalBytes = Number(stats.blocks) * blockSize;
+    if (!Number.isSafeInteger(totalBytes) || !Number.isSafeInteger(freeBytes)) return null;
+    return { path: measured, totalBytes, freeBytes: Math.min(freeBytes, totalBytes) };
+  } catch {
+    return null;
+  }
+}
+function nearestExistingPath(start) {
+  let candidate = resolve5(start);
+  for (let depth = 0; depth < 16; depth++) {
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname4(candidate);
+    if (parent === candidate) return null;
+    candidate = parent;
+  }
+  return null;
+}
 
 // src/browser/adapter.ts
 var BROWSER_LOGIN_ORIGIN_CHANGED = "No sign-in was attempted: the browser left the approved sign-in site. Return to that site and try again.";
@@ -26237,15 +26312,15 @@ function createDemoBrowserAdapterFactory() {
 
 // src/browser/manager.ts
 import { lstat as lstat5, mkdir as mkdir4, open as open4, opendir, readFile as readFile6, rename as rename3, rm as rm4 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join7, resolve as resolve5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname5, join as join7, resolve as resolve6 } from "node:path";
 var SAFE_SEGMENT = /^[A-Za-z0-9_-]{1,200}$/;
 var FRAME_MIN_INTERVAL_MS = 100;
 var IDLE_TIMEOUT_MS = 15 * 6e4;
 var BrowserManager = class {
   constructor(opts) {
     this.opts = opts;
-    this.profileRoot = opts.profileRoot ?? join7(homedir2(), ".zixt", "browser-profiles");
+    this.profileRoot = opts.profileRoot ?? join7(homedir3(), ".zixt", "browser-profiles");
     this.profileStateRoot = join7(this.profileRoot, ".profile-state");
     this.viewport = opts.viewport ?? BROWSER_DEFAULT_VIEWPORT;
     this.idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
@@ -26336,9 +26411,9 @@ var BrowserManager = class {
     }
   }
   exactChild(root, child) {
-    const canonicalRoot = resolve5(root);
-    const target = resolve5(canonicalRoot, child);
-    if (dirname4(target) !== canonicalRoot) {
+    const canonicalRoot = resolve6(root);
+    const target = resolve6(canonicalRoot, child);
+    if (dirname5(target) !== canonicalRoot) {
       throw new Error("browser profile path escaped its owned root");
     }
     return target;
@@ -27247,8 +27322,8 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
 import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { lstat as lstat11, mkdir as mkdir10, realpath as realpath8 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute14, join as join14, resolve as resolve9 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname8, isAbsolute as isAbsolute14, join as join14, resolve as resolve10 } from "node:path";
 
 // src/tool-packs/browser/authentication-wall.ts
 var AUTH_PATH_SEGMENT = /(?:^|\/)(?:log[-_]?in|sign[-_]?in|sso|saml|auth|authorize|authenticate|oauth2?|session\/new|checkpoint)(?:\/|$)/i;
@@ -29974,7 +30049,7 @@ function createGithubPushOrchestrator(input) {
 import { spawn as spawn5 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { chmod as chmod3, lstat as lstat7, mkdir as mkdir5, realpath as realpath4, rm as rm5 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute9, join as join9, relative as relative5 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute9, join as join9, relative as relative5 } from "node:path";
 
 // src/tool-packs/github/git-credential-broker.ts
 import { createServer } from "node:http";
@@ -30225,7 +30300,7 @@ async function requireRealDirectory(path, label) {
 async function validateTokenlessPaths(command) {
   if (command.kind === "clone-from-bridge") {
     if (!isAbsolute9(command.destination)) throw new GithubGitProcessError("invalid_input");
-    const parent = await requireRealDirectory(dirname5(command.destination), "clone parent");
+    const parent = await requireRealDirectory(dirname6(command.destination), "clone parent");
     assertBelow(parent, command.destination, "clone destination");
     const destination = await lstat7(command.destination).catch((error52) => {
       if (error52.code === "ENOENT") return null;
@@ -30335,8 +30410,8 @@ async function runGit(input, args, env) {
     let settled = false;
     let stopping = false;
     let resolveExited;
-    const exited = new Promise((resolve16) => {
-      resolveExited = resolve16;
+    const exited = new Promise((resolve17) => {
+      resolveExited = resolve17;
     });
     child.once("exit", resolveExited);
     const cleanup = () => {
@@ -30984,7 +31059,7 @@ function createRepositoryTools(runtime) {
 // src/tool-packs/github/workspace.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { chmod as chmod4, lstat as lstat8, mkdir as mkdir6, readFile as readFile7, realpath as realpath5, rename as rename4, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute10, join as join10, relative as relative6, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join10, relative as relative6, resolve as resolve7 } from "node:path";
 var SAFE_LOCAL_ID = /^[A-Za-z0-9_-]{1,200}$/;
 var FULL_NAME2 = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
 var DIRECTORY_MODE2 = 448;
@@ -31007,7 +31082,7 @@ function assertBelow2(parent, child, label) {
   }
 }
 function samePath(left, right) {
-  return process.platform === "win32" ? resolve6(left).toLowerCase() === resolve6(right).toLowerCase() : resolve6(left) === resolve6(right);
+  return process.platform === "win32" ? resolve7(left).toLowerCase() === resolve7(right).toLowerCase() : resolve7(left) === resolve7(right);
 }
 async function requireRealDirectory2(path, label) {
   const entry = await lstat8(path).catch(() => null);
@@ -32824,8 +32899,8 @@ var linearToolPackFactory = {
   async create(grant, context) {
     let resolveCancelled;
     let closed = false;
-    const cancelled = new Promise((resolve16) => {
-      resolveCancelled = resolve16;
+    const cancelled = new Promise((resolve17) => {
+      resolveCancelled = resolve17;
     });
     const cancel = () => {
       if (closed) return;
@@ -33625,7 +33700,7 @@ function createAskUserServer() {
   let server;
   let listening;
   function ensureListening() {
-    listening ??= new Promise((resolve16, reject3) => {
+    listening ??= new Promise((resolve17, reject3) => {
       server = createServer2((req, res) => {
         res.on("error", () => {
         });
@@ -33641,7 +33716,7 @@ function createAskUserServer() {
       server.on("error", reject3);
       server.listen(0, "127.0.0.1", () => {
         const address = server.address();
-        if (address && typeof address === "object") resolve16(address.port);
+        if (address && typeof address === "object") resolve17(address.port);
         else reject3(new Error("ask_user server failed to bind"));
       });
       server.unref();
@@ -34665,7 +34740,7 @@ password=${credential.accessToken}
 
 // src/runners/working-context.ts
 import { spawn as spawn6 } from "node:child_process";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
 var COMMAND_STOP_TIMEOUT_MS = 2e4;
@@ -35060,8 +35135,8 @@ async function repositoryState(directory, git, env, signal) {
   const pathLines = paths.trim().split(/\r?\n/);
   if (pathLines.length < 3 || !pathLines[0] || !pathLines[1] || !pathLines[2]) return null;
   const root = pathLines[0];
-  const gitDirectory = resolve7(directory, pathLines[1]);
-  const commonDirectory = resolve7(directory, pathLines[2]);
+  const gitDirectory = resolve8(directory, pathLines[1]);
+  const commonDirectory = resolve8(directory, pathLines[2]);
   const records = status.split(/\0|\r?\n/).filter(Boolean);
   const rawBranch = statusField(records, "branch.head");
   if (!rawBranch || rawBranch.length > 512 || !isSafeSingleLineDisplayText(rawBranch)) return null;
@@ -35226,8 +35301,8 @@ import {
   rm as rm7,
   writeFile as writeFile5
 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute13, join as join13, relative as relative8, resolve as resolve8, sep as sep4, win32 as win322 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute13, join as join13, relative as relative8, resolve as resolve9, sep as sep4, win32 as win322 } from "node:path";
 var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
 var DIRECTORY_MODE4 = 448;
 var FILE_MODE3 = 384;
@@ -35444,7 +35519,7 @@ foreach ($path in $paths) {
 }
 `;
 function defaultRunArtifactRoot() {
-  return join13(homedir3(), ".zixt", "run-artifacts");
+  return join13(homedir4(), ".zixt", "run-artifacts");
 }
 function requireSafeSegment(value, field) {
   if (!SAFE_SEGMENT2.test(value)) {
@@ -35488,10 +35563,10 @@ async function rejectWindowsSymlinkAncestors(profile, target) {
   }
 }
 async function prepareRoot(root) {
-  const absolute = resolve8(root);
+  const absolute = resolve9(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve8(homedir3());
+    const profile = resolve9(homedir4());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath7(profile);
@@ -35661,10 +35736,10 @@ async function removePrivateTreeWithRetries(path, removeTree, retryDelayMs) {
   }
 }
 async function sweepOrphanedRunArtifacts(root) {
-  const absolute = resolve8(root);
+  const absolute = resolve9(root);
   let realProfile;
   if (process.platform === "win32") {
-    const profile = resolve8(homedir3());
+    const profile = resolve9(homedir4());
     assertWindowsProfileBoundary(profile, absolute);
     await rejectWindowsSymlinkAncestors(profile, absolute);
     realProfile = await realpath7(profile);
@@ -35696,7 +35771,7 @@ async function sweepOrphanedRunArtifacts(root) {
   return removed;
 }
 function defaultRunRegistryRoot() {
-  return join13(homedir3(), ".zixt", "run-registry");
+  return join13(homedir4(), ".zixt", "run-registry");
 }
 async function syncRunRegistryDirectory(path) {
   const handle = await open5(path, "r");
@@ -35709,9 +35784,9 @@ async function syncRunRegistryDirectory(path) {
 async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory7) {
   const firstCreated = await mkdir9(registryRoot, { recursive: true, mode: DIRECTORY_MODE4 });
   if (firstCreated && process.platform !== "win32") {
-    const first = resolve8(firstCreated);
-    const target = resolve8(registryRoot);
-    await syncDirectory7(dirname6(first));
+    const first = resolve9(firstCreated);
+    const target = resolve9(registryRoot);
+    await syncDirectory7(dirname7(first));
     let current = first;
     for (const part of relative8(first, target).split(sep4).filter(Boolean)) {
       await syncDirectory7(current);
@@ -35886,7 +35961,7 @@ async function settlesWithin(promise2, timeoutMs) {
   }
 }
 function defaultRunnerWorkspaceRoot() {
-  return join14(homedir4(), ".zixt", "workspaces");
+  return join14(homedir5(), ".zixt", "workspaces");
 }
 function defaultRunnerArtifactRoot() {
   return defaultRunArtifactRoot();
@@ -35946,7 +36021,7 @@ function createCliRunner(adapter, opts = {}) {
   const prefixArgs = opts.commandPrefixArgs ?? [];
   const maxWallTimeMs = opts.maxWallTimeMs;
   const workspaceRoot = opts.workspaceRoot ?? defaultRunnerWorkspaceRoot();
-  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join14(dirname7(workspaceRoot), "run-artifacts"));
+  const artifactRoot = opts.artifactRoot ?? (opts.workspaceRoot === void 0 ? defaultRunnerArtifactRoot() : join14(dirname8(workspaceRoot), "run-artifacts"));
   const runRegistryRoot2 = opts.runRegistryRoot ?? defaultRunRegistryRoot();
   const createArtifacts = opts.createArtifacts ?? createRunArtifacts;
   const toolPackRegistry2 = opts.toolPackRegistry ?? createDefaultToolPackRegistry();
@@ -36031,7 +36106,7 @@ function createCliRunner(adapter, opts = {}) {
         outcome.ok && outcome.result && typeof outcome.result === "object" ? outcome.result["artifact"] : void 0
       );
       if (parsed.success) {
-        const candidate = resolve9(cwd, path);
+        const candidate = resolve10(cwd, path);
         const key = await realpath8(candidate).catch(() => candidate);
         publishedTaskFiles.set(key, parsed.data);
       }
@@ -36312,8 +36387,8 @@ ${attachmentSection}` : prompt;
         let changed = false;
         for (const path of paths) {
           if (!path || path.length > 4096) continue;
-          const absolutePath = isAbsolute14(path) ? path : resolve9(cwd, path);
-          const directory = dirname7(absolutePath);
+          const absolutePath = isAbsolute14(path) ? path : resolve10(cwd, path);
+          const directory = dirname8(absolutePath);
           observedWorkingDirectories.delete(directory);
           observedWorkingDirectories.add(directory);
           while (observedWorkingDirectories.size > 19) {
@@ -36745,7 +36820,7 @@ function runCliProcess(options) {
       usage: { inputTokens: 0, outputTokens: 0 }
     });
   }
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const platform = options.platform ?? process.platform;
     const containmentGateNonce = options.guardian && platform === "win32" ? randomUUID10() : void 0;
     const child = options.guardian ? spawn8(
@@ -36759,7 +36834,7 @@ function runCliProcess(options) {
         // The idle pre-assignment guardian must never load from or depend
         // on an untrusted Task checkout. Only the post-gate target enters
         // the requested working directory from its private release frame.
-        cwd: dirname7(options.guardian.scriptPath),
+        cwd: dirname8(options.guardian.scriptPath),
         env: runnerGuardianEnv(process.env, containmentGateNonce),
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true,
@@ -36807,7 +36882,7 @@ function runCliProcess(options) {
       clearInterval(timer);
       unregisterFollowUps?.();
       parser.stop?.();
-      resolve16(result);
+      resolve17(result);
     };
     const terminate = (result) => {
       if (settled || forcedResult) return;
@@ -37040,13 +37115,13 @@ import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/runners/runtime-observation.ts
 import { open as open6, readdir as readdir4, realpath as realpath9 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join15 } from "node:path";
 var READ_WINDOW_BYTES = 1024 * 1024;
 var CATALOG_TIMEOUT_MS = 15e3;
 var CATALOG_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
 function homeFrom(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir5();
+  return env["HOME"] || env["USERPROFILE"] || homedir6();
 }
 async function readHead(path) {
   let handle;
@@ -37153,7 +37228,7 @@ async function readCodexSessionRuntime(input) {
 }
 var codexCatalogCache = /* @__PURE__ */ new Map();
 async function loadCodexModelCatalog(command, prefixArgs, env) {
-  const output = await new Promise((resolve16) => {
+  const output = await new Promise((resolve17) => {
     const child = spawnCli(command, [...prefixArgs, "debug", "models"], {
       stdio: ["ignore", "pipe", "ignore"],
       windowsHide: true,
@@ -37168,7 +37243,7 @@ async function loadCodexModelCatalog(command, prefixArgs, env) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve16(value);
+      resolve17(value);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -37273,8 +37348,8 @@ function createRuntimeReporter(input, sessionId) {
 var EFFORT_READ_ATTEMPTS = 5;
 var EFFORT_READ_INTERVAL_MS = 3e3;
 function delay2(ms) {
-  return new Promise((resolve16) => {
-    const timer = setTimeout(resolve16, ms);
+  return new Promise((resolve17) => {
+    const timer = setTimeout(resolve17, ms);
     timer.unref?.();
   });
 }
@@ -37351,10 +37426,10 @@ function createClaudeLiveParser(onStream, onSessionModel) {
     },
     async steer(followUp) {
       if (!write) return false;
-      return await new Promise((resolve16) => {
-        acknowledgements.set(followUp.inputId, resolve16);
+      return await new Promise((resolve17) => {
+        acknowledgements.set(followUp.inputId, resolve17);
         void write(input(followUp.inputId, followUp.text)).catch(() => {
-          if (acknowledgements.delete(followUp.inputId)) resolve16(false);
+          if (acknowledgements.delete(followUp.inputId)) resolve17(false);
         });
       });
     },
@@ -37516,11 +37591,11 @@ function improveErrorMessage(error52) {
 // src/runners/codex.ts
 import { mkdir as mkdir11, readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { join as join16 } from "node:path";
 var CODEX_NOT_FOUND_MESSAGE = "The `codex` CLI was not found on this Machine. Install it (npm install -g @openai/codex) and sign in with `codex login`, or switch the agent to API-key auth.";
 function defaultCodexThreadIndexRoot() {
-  return join16(homedir6(), ".zixt", "codex-threads");
+  return join16(homedir7(), ".zixt", "codex-threads");
 }
 var SAFE_SEGMENT3 = /^[A-Za-z0-9_-]{1,200}$/;
 function threadIndexPath(root, agentId, sessionKey) {
@@ -37661,8 +37736,8 @@ ${value}` : value;
 var RUNTIME_READ_ATTEMPTS = 5;
 var RUNTIME_READ_INTERVAL_MS = 2e3;
 function delay3(ms) {
-  return new Promise((resolve16) => {
-    const timer = setTimeout(resolve16, ms);
+  return new Promise((resolve17) => {
+    const timer = setTimeout(resolve17, ms);
     timer.unref?.();
   });
 }
@@ -37701,7 +37776,7 @@ function createCodexAppServerParser(onStream, options) {
   const turnReadyWaiters = /* @__PURE__ */ new Set();
   const usage = () => ({ inputTokens, outputTokens });
   const settleTurnReadiness = (ready) => {
-    for (const resolve16 of turnReadyWaiters) resolve16(ready);
+    for (const resolve17 of turnReadyWaiters) resolve17(ready);
     turnReadyWaiters.clear();
   };
   const send = async (message) => {
@@ -37882,12 +37957,12 @@ function createCodexAppServerParser(onStream, options) {
     async steer(input) {
       if (stopped) return false;
       if (!activeTurnId) {
-        const ready = await new Promise((resolve16) => turnReadyWaiters.add(resolve16));
+        const ready = await new Promise((resolve17) => turnReadyWaiters.add(resolve17));
         if (!ready || stopped) return false;
       }
       if (!threadId || !activeTurnId) return false;
-      return await new Promise((resolve16) => {
-        steerWaiters.set(input.inputId, resolve16);
+      return await new Promise((resolve17) => {
+        steerWaiters.set(input.inputId, resolve17);
         void send({
           id: `steer:${input.inputId}`,
           method: "turn/steer",
@@ -37898,7 +37973,7 @@ function createCodexAppServerParser(onStream, options) {
             clientUserMessageId: input.inputId
           }
         }).catch(() => {
-          if (steerWaiters.delete(input.inputId)) resolve16(false);
+          if (steerWaiters.delete(input.inputId)) resolve17(false);
         });
       });
     },
@@ -37906,7 +37981,7 @@ function createCodexAppServerParser(onStream, options) {
       stopped = true;
       write = null;
       settleTurnReadiness(false);
-      for (const resolve16 of steerWaiters.values()) resolve16(false);
+      for (const resolve17 of steerWaiters.values()) resolve17(false);
       steerWaiters.clear();
     },
     push(chunk) {
@@ -38085,7 +38160,7 @@ function improveCodexErrorMessage(error52) {
 // src/runners/git-preflight.ts
 import { spawn as spawn9 } from "node:child_process";
 import { realpath as realpath10 } from "node:fs/promises";
-import { isAbsolute as isAbsolute15, resolve as resolve10 } from "node:path";
+import { isAbsolute as isAbsolute15, resolve as resolve11 } from "node:path";
 var OUTPUT_LIMIT = 8192;
 var DEFAULT_TIMEOUT_MS4 = 1e4;
 var VERSION_PATTERN = /^git version [^\r\n]{1,108}$/;
@@ -38104,7 +38179,7 @@ async function preflightGit(options = {}) {
   if (configured !== void 0 && !isAbsolute15(configured)) {
     return unavailable("configured git command must be an absolute file", checkedAt);
   }
-  const trustedCwd = await realpath10(resolve10(options.trustedCwd ?? process.cwd())).catch(() => null);
+  const trustedCwd = await realpath10(resolve11(options.trustedCwd ?? process.cwd())).catch(() => null);
   if (!trustedCwd)
     return unavailable("Host-owned git preflight directory is unavailable", checkedAt);
   const executablePath = await resolveTrustedCliCommand(configured ?? "git", {
@@ -38326,7 +38401,7 @@ function parseAuth(result) {
   return "unknown";
 }
 function run2(command, args) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const child = spawnCli(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -38342,7 +38417,7 @@ function run2(command, args) {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
-      resolve16(result);
+      resolve17(result);
     };
     const timeout = setTimeout(() => {
       child.kill();
@@ -38357,8 +38432,8 @@ function run2(command, args) {
 import { spawn as spawn10 } from "node:child_process";
 import { constants as constants2 } from "node:fs";
 import { access as access4, chmod as chmod7, mkdir as mkdir12, open as open7, rename as rename6, rm as rm8 } from "node:fs/promises";
-import { homedir as homedir7, userInfo } from "node:os";
-import { basename as basename4, dirname as dirname8, join as join17, relative as relative9, resolve as resolve11, sep as sep5 } from "node:path";
+import { homedir as homedir8, userInfo } from "node:os";
+import { basename as basename4, dirname as dirname9, join as join17, relative as relative9, resolve as resolve12, sep as sep5 } from "node:path";
 var SERVICE_NAME = "zixt-host.service";
 var SYSTEM_SERVICE_COMMAND_TIMEOUT_MS = 7e4;
 var SERVICE_STABILITY_DELAY_MS = 2e3;
@@ -38386,7 +38461,7 @@ function boundedAppend(current, chunk) {
 }
 async function defaultRunCommand(command, args) {
   const commandEnvironment3 = systemServiceCommandEnvironment();
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const child = spawn10(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: commandEnvironment3,
@@ -38400,7 +38475,7 @@ async function defaultRunCommand(command, args) {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve16(result);
+      resolve17(result);
     };
     child.stdout?.on("data", (chunk) => {
       stdout = boundedAppend(stdout, chunk);
@@ -38461,9 +38536,9 @@ async function defaultSyncDirectory(path) {
 async function ensureDirectory(path, mode, syncDirectory7) {
   const firstCreated = await mkdir12(path, { recursive: true, mode });
   if (!firstCreated) return;
-  const first = resolve11(firstCreated);
-  const target = resolve11(path);
-  await syncDirectory7(dirname8(first));
+  const first = resolve12(firstCreated);
+  const target = resolve12(path);
+  await syncDirectory7(dirname9(first));
   let current = first;
   const descendants = relative9(first, target);
   for (const part of descendants ? descendants.split(sep5) : []) {
@@ -38472,7 +38547,7 @@ async function ensureDirectory(path, mode, syncDirectory7) {
   }
 }
 async function replacePrivateFile(path, contents, mode, syncDirectory7) {
-  const parent = dirname8(path);
+  const parent = dirname9(path);
   await ensureDirectory(parent, 448, syncDirectory7);
   const temporary = join17(parent, `.${basename4(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open7(temporary, "wx", mode);
@@ -38518,7 +38593,7 @@ async function installLinuxService(options) {
     throw new Error("Linux automatic startup is available only on Linux.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir7();
+  const home = options.home ?? homedir8();
   const username = oneLine(options.username ?? userInfo().username, "user name");
   const token2 = oneLine(options.token, "pairing code");
   const path = oneLine(
@@ -38536,7 +38611,7 @@ async function installLinuxService(options) {
   const resolveCommand = options.resolveCommand ?? defaultResolveCommand;
   const run3 = options.runCommand ?? defaultRunCommand;
   const syncDirectory7 = options.syncDirectory ?? defaultSyncDirectory;
-  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve16) => setTimeout(resolve16, ms)));
+  const stabilityDelay = options.delay ?? ((ms) => new Promise((resolve17) => setTimeout(resolve17, ms)));
   const [systemctl, loginctl] = await Promise.all([
     resolveCommand("systemctl"),
     resolveCommand("loginctl")
@@ -38650,8 +38725,8 @@ async function installLinuxService(options) {
 import { spawn as spawn11 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
 import { access as access5, chmod as chmod8, mkdir as mkdir13, open as open8, rename as rename7, rm as rm9 } from "node:fs/promises";
-import { homedir as homedir8, userInfo as userInfo2 } from "node:os";
-import { basename as basename5, dirname as dirname9, join as join18, relative as relative10, resolve as resolve12, sep as sep6 } from "node:path";
+import { homedir as homedir9, userInfo as userInfo2 } from "node:os";
+import { basename as basename5, dirname as dirname10, join as join18, relative as relative10, resolve as resolve13, sep as sep6 } from "node:path";
 var LAUNCH_AGENT_LABEL = "ai.zixt.host";
 var SERVICE_STABILITY_DELAY_MS2 = 2e3;
 var COMMAND_TIMEOUT_MS2 = 7e4;
@@ -38677,9 +38752,9 @@ async function syncDirectory4(path) {
 async function ensureDirectory2(path, sync) {
   const firstCreated = await mkdir13(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve12(firstCreated);
-  const target = resolve12(path);
-  await sync(dirname9(first));
+  const first = resolve13(firstCreated);
+  const target = resolve13(path);
+  await sync(dirname10(first));
   let current = first;
   for (const part of relative10(first, target).split(sep6).filter(Boolean)) {
     await sync(current);
@@ -38687,7 +38762,7 @@ async function ensureDirectory2(path, sync) {
   }
 }
 async function replacePrivateFile2(path, contents, mode, sync) {
-  const parent = dirname9(path);
+  const parent = dirname10(path);
   await ensureDirectory2(parent, sync);
   const temporary = join18(parent, `.${basename5(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open8(temporary, "wx", mode);
@@ -38777,7 +38852,7 @@ async function installMacosService(options) {
     throw new Error("macOS automatic startup is available only on macOS.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir8();
+  const home = options.home ?? homedir9();
   const uid = options.uid ?? userInfo2().uid;
   if (!Number.isSafeInteger(uid) || uid < 0) throw new Error("macOS user id is invalid.");
   const token2 = oneLine2(options.token, "pairing code");
@@ -38881,8 +38956,8 @@ async function installMacosService(options) {
 import { spawn as spawn12 } from "node:child_process";
 import { constants as constants4 } from "node:fs";
 import { access as access6, mkdir as mkdir14, open as open9, readFile as readFile10, rename as rename8, rm as rm10 } from "node:fs/promises";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute16, join as join19, relative as relative11, resolve as resolve13, sep as sep7 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename6, dirname as dirname11, isAbsolute as isAbsolute16, join as join19, relative as relative11, resolve as resolve14, sep as sep7 } from "node:path";
 var TASK_NAME = "Zixt Host";
 var COMMAND_TIMEOUT_MS3 = 7e4;
 var SERVICE_STABILITY_DELAY_MS3 = 2e3;
@@ -38910,9 +38985,9 @@ async function syncDirectory5(path) {
 async function ensureDirectory3(path, sync) {
   const firstCreated = await mkdir14(path, { recursive: true, mode: 448 });
   if (!firstCreated) return;
-  const first = resolve13(firstCreated);
-  const target = resolve13(path);
-  await sync(dirname10(first));
+  const first = resolve14(firstCreated);
+  const target = resolve14(path);
+  await sync(dirname11(first));
   let current = first;
   for (const part of relative11(first, target).split(sep7).filter(Boolean)) {
     await sync(current);
@@ -38920,7 +38995,7 @@ async function ensureDirectory3(path, sync) {
   }
 }
 async function replacePrivateFile3(path, contents, sync) {
-  const parent = dirname10(path);
+  const parent = dirname11(path);
   await ensureDirectory3(parent, sync);
   const temporary = join19(parent, `.${basename6(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   const handle = await open9(temporary, "wx", 384);
@@ -39106,7 +39181,7 @@ async function installWindowsService(options) {
     throw new Error("Windows automatic startup is available only on Windows.");
   }
   const env = options.env ?? process.env;
-  const home = options.home ?? homedir9();
+  const home = options.home ?? homedir10();
   const localAppData = options.localAppData ?? env.LOCALAPPDATA;
   if (!localAppData || !isAbsolute16(localAppData)) {
     throw new Error("Windows local application data path is unavailable.");
@@ -39220,15 +39295,15 @@ async function installSystemService(options) {
 
 // src/terminal-outcomes.ts
 import { chmod as chmod9, lstat as lstat12, mkdir as mkdir15, open as open10, readdir as readdir5, readFile as readFile11, rename as rename9, rm as rm11 } from "node:fs/promises";
-import { homedir as homedir10 } from "node:os";
-import { dirname as dirname11, join as join20, relative as relative12, resolve as resolve14, sep as sep8 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { dirname as dirname12, join as join20, relative as relative12, resolve as resolve15, sep as sep8 } from "node:path";
 var DIRECTORY_MODE5 = 448;
 var FILE_MODE4 = 384;
 var MAX_OUTCOME_BYTES = 4 * 1024 * 1024;
 var HOST_DIRECTORY = /^hst_[0-9a-f]{32}$/;
 var OUTCOME_FILE = /^(tsk_[0-9a-f]{32})\.([1-9][0-9]*)\.json$/;
 function defaultTerminalOutcomeRoot() {
-  return join20(homedir10(), ".zixt", "terminal-outcomes");
+  return join20(homedir11(), ".zixt", "terminal-outcomes");
 }
 function hostOutcomeRoot(root, hostId) {
   if (!HOST_DIRECTORY.test(hostId)) throw new Error("terminal outcome Host identity is malformed");
@@ -39249,9 +39324,9 @@ async function syncDirectory6(root) {
 async function requirePrivateRoot(root, sync = syncDirectory6) {
   const firstCreated = await mkdir15(root, { recursive: true, mode: DIRECTORY_MODE5 });
   if (firstCreated) {
-    const first = resolve14(firstCreated);
-    const target = resolve14(root);
-    await sync(dirname11(first));
+    const first = resolve15(firstCreated);
+    const target = resolve15(root);
+    await sync(dirname12(first));
     let current = first;
     for (const part of relative12(first, target).split(sep8).filter(Boolean)) {
       await sync(current);
@@ -39501,12 +39576,12 @@ function createHostLogger(options = {}) {
 }
 
 // src/demo-state.ts
-import { isAbsolute as isAbsolute17, join as join21, parse as parse3, resolve as resolve15 } from "node:path";
+import { isAbsolute as isAbsolute17, join as join21, parse as parse3, resolve as resolve16 } from "node:path";
 var DEMO_STATE_ROOT_ENV = "ZIXT_DEMO_STATE_ROOT";
 function resolveDemoHostStatePaths(env = process.env) {
   const configured = env.ZIXT_RUNNER === "demo" ? env[DEMO_STATE_ROOT_ENV] : void 0;
   if (!configured) return null;
-  const root = resolve15(configured);
+  const root = resolve16(configured);
   if (!isAbsolute17(configured) || root === parse3(root).root) {
     throw new Error(`${DEMO_STATE_ROOT_ENV} must be a dedicated absolute directory`);
   }
@@ -39924,6 +39999,10 @@ async function telemetry() {
     runners: cachedRunners ?? [],
     workspaces: [],
     docker: "unknown",
+    // Measured per heartbeat: free memory and free disk are only useful while
+    // they are current, and a demo Host reports its own private root so the
+    // number describes the filesystem its Tasks would really write to.
+    hardware: await machineHardware(runnerWorkspaceRoot ?? homedir12()),
     capabilities: {
       linearToolPack: providerToolPacks.some(
         (pack) => pack.provider === "linear" && pack.health === "ready"