@zixt/host 0.0.72 → 0.0.74

package/dist/index.js

@@ -11,27 +11,27 @@ var __export = (target, all) => {
 import { fstatSync as fstatSync2 } from "node:fs";
 
 // src/supervisor.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { fstatSync } from "node:fs";
 import {
   access as access2,
-  lstat as lstat4,
-  mkdir as mkdir3,
-  open as open3,
-  readFile as readFile5,
+  lstat as lstat5,
+  mkdir as mkdir4,
+  open as open4,
+  readFile as readFile6,
   readlink,
-  readdir as readdir2,
-  rename as rename2,
-  rm as rm3,
+  readdir as readdir3,
+  rename as rename3,
+  rm as rm4,
   symlink
 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute7, join as join6, relative as relative3, resolve as resolve4, sep as sep3 } from "node:path";
-import { homedir } from "node:os";
+import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute8, join as join7, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.72",
+  version: "0.0.74",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14665,6 +14665,12 @@ var ID_PREFIXES = {
   managerUsage: "mgu",
   /** One ordered Manager reply awaiting Slack delivery. */
   managerSlackOutbox: "mso",
+  /** One organization-owned virtual Manager email inbox. */
+  managerEmailInbox: "mei",
+  /** One admitted or quarantined inbound Manager email. */
+  managerEmailEvent: "mee",
+  /** One idempotent outbound Manager email. */
+  managerEmailDelivery: "med",
   /** One organization phone line that reaches its Manager. */
   voiceLine: "vln",
   /** One member-owned phone number admitted to Manager calls. */
@@ -14706,6 +14712,18 @@ var ManagerIntegrationActionId = idSchema(
   ID_PREFIXES.managerIntegrationAction,
   "Manager integration action id"
 );
+var ManagerEmailInboxId = idSchema(
+  ID_PREFIXES.managerEmailInbox,
+  "Manager email inbox id"
+);
+var ManagerEmailEventId = idSchema(
+  ID_PREFIXES.managerEmailEvent,
+  "Manager email event id"
+);
+var ManagerEmailDeliveryId = idSchema(
+  ID_PREFIXES.managerEmailDelivery,
+  "Manager email delivery id"
+);
 var VoiceLineId = idSchema(ID_PREFIXES.voiceLine, "voice line id");
 var VoiceCallerId = idSchema(ID_PREFIXES.voiceCaller, "voice caller id");
 var VoiceCallId = idSchema(ID_PREFIXES.voiceCall, "voice call id");
@@ -18232,7 +18250,33 @@ var ListManagerMemoriesResponse = external_exports.object({
   memories: external_exports.array(ManagerMemoryProjection).max(MANAGER_MEMORY_MAX_ITEMS),
   limit: external_exports.number().int().min(1)
 }).strict();
-var ConversationChannel = external_exports.enum(["web", "slack", "whatsapp", "phone"]);
+var ConversationChannel = external_exports.enum(["web", "slack", "whatsapp", "phone", "email"]);
+var MANAGER_EMAIL_ALLOWLIST_MAX = 200;
+var MANAGER_EMAIL_QUARANTINE_LIMIT = 25;
+var ManagerEmailAddress = external_exports.string().email().max(320);
+var ManagerEmailDomain = external_exports.string().min(3).max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i);
+var ManagerEmailQuarantineProjection = external_exports.object({
+  id: external_exports.string().min(1),
+  sender: ManagerEmailAddress,
+  subject: external_exports.string().max(300),
+  reason: external_exports.enum(["authentication_failed", "not_approved", "automatic_message"]),
+  receivedAt: external_exports.string()
+}).strict();
+var ManagerEmailSettingsResponse = external_exports.object({
+  address: ManagerEmailAddress,
+  status: external_exports.enum(["ready", "not_configured"]),
+  memberAddressesApprovedAutomatically: external_exports.literal(true),
+  allowedAddresses: external_exports.array(ManagerEmailAddress).max(MANAGER_EMAIL_ALLOWLIST_MAX),
+  allowedDomains: external_exports.array(ManagerEmailDomain).max(MANAGER_EMAIL_ALLOWLIST_MAX),
+  quarantine: external_exports.array(ManagerEmailQuarantineProjection).max(MANAGER_EMAIL_QUARANTINE_LIMIT),
+  revision: external_exports.number().int().min(0)
+}).strict();
+var UpdateManagerEmailSettingsRequest = external_exports.object({
+  allowedAddresses: external_exports.array(ManagerEmailAddress).max(MANAGER_EMAIL_ALLOWLIST_MAX),
+  allowedDomains: external_exports.array(ManagerEmailDomain).max(MANAGER_EMAIL_ALLOWLIST_MAX),
+  expectedRevision: external_exports.number().int().min(0)
+}).strict();
+var DeleteManagerEmailQuarantineResponse = external_exports.object({ discarded: external_exports.literal(true) }).strict();
 var ConversationStatus = external_exports.enum(["idle", "thinking"]);
 var ConversationProjection = external_exports.object({
   id: ConversationId,
@@ -23994,6 +24038,23 @@ function createReleaseStateStore(root) {
   };
 }
 
+// src/runners/run-artifacts.ts
+import { spawn as spawn4 } from "node:child_process";
+import {
+  chmod as chmod2,
+  lstat as lstat4,
+  mkdir as mkdir3,
+  open as open3,
+  readdir as readdir2,
+  readFile as readFile5,
+  realpath as realpath3,
+  rename as rename2,
+  rm as rm3,
+  writeFile
+} from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute7, join as join6, relative as relative3, resolve as resolve4, sep as sep3, win32 as win322 } from "node:path";
+
 // src/windows-job.ts
 import { spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -24514,257 +24575,908 @@ async function awaitWindowsContainmentGate(env = process.env, input = process.st
   });
 }
 
-// src/supervisor.ts
-var PACKAGE_NAME = "@zixt/host";
-var WORKER_ROLE_ENV = "ZIXT_HOST_ROLE";
-var WORKER_ROLE = "worker";
-var WORKER_PROXY_ROLE = "worker_proxy";
-var SUPERVISOR_ROLE = "supervisor";
-var WORKER_PROXY_ENTRY_ENV = "ZIXT_HOST_WORKER_PROXY_ENTRY";
-var SUPERVISOR_PROTOCOL_ENV = "ZIXT_HOST_SUPERVISOR_PROTOCOL";
-var SUPERVISOR_VERSION_ENV = "ZIXT_HOST_SUPERVISOR_VERSION";
-var SUPERVISOR_PROTOCOL = "2";
-var SUPERVISOR_RELOAD_EXIT_CODE = 76;
-var DO_NOT_RESTART_EXIT_CODE = 64;
-var RESTART_BACKOFF_MS = 2e3;
-var MAX_RESTART_BACKOFF_MS = 6e4;
-var CRASH_STREAK_RESET_MS = 6e4;
-var RELEASE_PROBATION_MS = 5 * 6e4;
-var FAST_UPDATE_EXIT_MS = 1e4;
-var STOP_GRACE_MS = 3e4;
-var INSTALL_TIMEOUT_MS = 5 * 6e4;
-var WORKER_WATCHDOG_CHECK_MS = 1e3;
-var WORKER_WATCHDOG_TIMEOUT_MS = 15e3;
-var WORKER_WATCHDOG_STARTUP_MS = 6e4;
-var WORKER_READINESS_TIMEOUT_MS = 9e4;
+// src/runners/run-artifacts.ts
+var SAFE_SEGMENT = /^[A-Za-z0-9_-]{1,200}$/;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
 var CLEANUP_ATTEMPTS = 3;
-var VERSION_DIR = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-var CURRENT_RELEASE_ENTRY = "current.js";
-var WINDOWS_RELEASE_POINTER = "current-release.json";
-var WINDOWS_LAUNCHER_OWNED_MARKER = "// Zixt Host stable Windows launcher v";
-var WINDOWS_LAUNCHER_MARKER = `${WINDOWS_LAUNCHER_OWNED_MARKER}2`;
-function signalWorkerGroup(child, signal) {
-  if (!child.pid) return;
+var CLEANUP_RETRY_DELAY_MS = 50;
+var WINDOWS_ACL_TIMEOUT_MS = 5e3;
+var RUNNER_GUARDIAN = String.raw`
+const { spawn } = require('node:child_process');
+
+const quote = (value) => '"' + String(value).replace(/\\/g, '/').replaceAll('"', '""') + '"';
+const launchMarker = '__ZIXT_RELEASE_RUNNER__';
+const exitMarker = process.argv[2];
+const guardianNonce = process.argv[3];
+if (!/^[A-Za-z0-9_-]{16,200}$/.test(guardianNonce || '')) process.exit(1);
+const containmentNonce = process.env[${JSON.stringify(WINDOWS_CONTAINMENT_GATE_ENV)}];
+const containmentMarker = ${JSON.stringify(WINDOWS_CONTAINMENT_GATE_PREFIX)};
+let containmentReady = !containmentNonce;
+const maxReleaseBytes = 32 * 1024 * 1024;
+let target = null;
+let pending = Buffer.alloc(0);
+let stdinEnded = false;
+let expectedBytes = null;
+let config = null;
+let launchPending = false;
+let stderrTail = '';
+let postReleaseInput = Buffer.alloc(0);
+let reported = false;
+const report = (result) => {
+  if (reported) return;
+  reported = true;
+  process.stdout.write(
+    '\n' + exitMarker + JSON.stringify({ ...result, stderrTail }) + '\n'
+  );
+  setInterval(() => {}, 2_147_483_647);
+};
+
+// Job helper setup + assignment each have a bounded Windows phase. This gate
+// must outlive both, including slow first-run Add-Type under endpoint protection.
+const prelaunchTimeout = setTimeout(() => process.exit(1), 130_000);
+prelaunchTimeout.unref();
+
+const launchTarget = (release) => {
   try {
-    if (process.platform === "win32") child.kill(signal);
-    else process.kill(-child.pid, signal);
+    const command = config.comspec || config.command;
+    const args = config.comspec
+      ? ['/d', '/s', '/c', '"' + [config.command, ...config.args].map(quote).join(' ') + '"']
+      : config.args;
+    target = spawn(command, args, {
+      cwd: config.cwd,
+      env: config.env,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+      windowsVerbatimArguments: Boolean(config.comspec),
+    });
+    launchPending = false;
   } catch {
+    process.exit(1);
+    return;
   }
-}
-function versionsRoot() {
-  return process.env.ZIXT_HOST_VERSIONS_DIR ?? join6(homedir(), ".zixt", "host-versions");
-}
-function npmCommand(platform = process.platform) {
-  return platform === "win32" ? "npm.cmd" : "npm";
-}
-function windowsInstallerCommandLine(command, args) {
-  return [command, ...args].map(quoteForCmd).join(" ");
-}
-function installedReleaseEntry(version2, root = versionsRoot()) {
-  return join6(root, version2, "node_modules", PACKAGE_NAME, "dist", "index.js");
-}
-function releaseEntryAtPrefix(prefix) {
-  return join6(prefix, "node_modules", PACKAGE_NAME, "dist", "index.js");
-}
-function releaseManifestAtPrefix(prefix) {
-  return join6(prefix, "node_modules", PACKAGE_NAME, "package.json");
-}
-async function validReleaseAtPrefix(prefix, version2) {
+
+  target.stdin.on('error', () => {});
+  target.stdout.pipe(process.stdout, { end: false });
+  target.stderr.on('data', (chunk) => {
+    process.stderr.write(chunk);
+    stderrTail = (stderrTail + String(chunk)).slice(-32_768);
+  });
+  let targetResult;
+  let stdoutEnded = false;
+  const maybeReport = () => {
+    if (targetResult && stdoutEnded) report(targetResult);
+  };
+  target.stdout.once('end', () => {
+    stdoutEnded = true;
+    maybeReport();
+  });
+  target.stdout.once('close', () => {
+    stdoutEnded = true;
+    maybeReport();
+  });
+  target.once('error', () => {
+    targetResult = { kind: 'spawn_error' };
+    stdoutEnded = true;
+    maybeReport();
+  });
+  target.once('close', (code, signal) => {
+    targetResult = { kind: 'close', code, signal };
+    maybeReport();
+  });
+  if (config.prompt) target.stdin.write(config.prompt);
+  if (postReleaseInput.length) {
+    target.stdin.write(postReleaseInput);
+    postReleaseInput = Buffer.alloc(0);
+  }
+  if (stdinEnded) target.stdin.end();
+};
+
+const launch = (release) => {
+  clearTimeout(prelaunchTimeout);
+  config = release;
+  launchPending = true;
+  if (process.platform === 'win32') {
+    launchTarget(release);
+    return;
+  }
+
+  // A detached POSIX group's numeric id outlives its leader, but without a
+  // live identity witness a stale registry entry cannot distinguish that
+  // inherited group from the same PGID being recycled later. This
+  // credential-free sentinel inherits the guardian's exact group and carries
+  // only its high-entropy nonce in argv. It deliberately survives SIGTERM so
+  // checked recovery can keep the PGID reserved through the graceful pass and
+  // validate the nonce again immediately before a group-wide SIGKILL.
+  const identitySentinel = spawn(
+    process.execPath,
+    [
+      '-e',
+      "process.on('SIGTERM', () => {}); setInterval(() => {}, 2147483647);",
+      guardianNonce,
+    ],
+    { env: process.env, stdio: 'ignore' },
+  );
+  identitySentinel.once('error', () => process.exit(1));
+  identitySentinel.once('spawn', () => launchTarget(release));
+  identitySentinel.once('exit', () => {
+    if (!reported) process.exit(1);
+  });
+};
+
+process.stdin.on('data', (chunk) => {
+  if (target) {
+    target.stdin.write(chunk);
+    return;
+  }
+  if (config) {
+    postReleaseInput = Buffer.concat([postReleaseInput, chunk]);
+    if (postReleaseInput.length > maxReleaseBytes) process.exit(1);
+    return;
+  }
+  pending = Buffer.concat([pending, chunk]);
+  if (pending.length > maxReleaseBytes + 256) process.exit(1);
+  if (!containmentReady) {
+    const gateNewline = pending.indexOf(10);
+    if (gateNewline < 0) return;
+    const gate = pending.subarray(0, gateNewline).toString().replace(/\r$/, '');
+    if (gate !== containmentMarker + ' ' + containmentNonce) process.exit(1);
+    containmentReady = true;
+    pending = pending.subarray(gateNewline + 1);
+  }
+  if (expectedBytes === null) {
+    const newline = pending.indexOf(10);
+    if (newline < 0) return;
+    const header = pending.subarray(0, newline).toString();
+    const match = new RegExp('^' + launchMarker + ' ([1-9][0-9]{0,8})$').exec(header);
+    if (!match) process.exit(1);
+    expectedBytes = Number(match[1]);
+    if (expectedBytes > maxReleaseBytes) process.exit(1);
+    pending = pending.subarray(newline + 1);
+  }
+  if (pending.length < expectedBytes) return;
   try {
-    const [entry, manifestText] = await Promise.all([
-      lstat4(releaseEntryAtPrefix(prefix)),
-      readFile5(releaseManifestAtPrefix(prefix), "utf8")
-    ]);
-    if (!entry.isFile()) return false;
-    const manifest = JSON.parse(manifestText);
-    return manifest.name === PACKAGE_NAME && manifest.version === version2;
+    const release = JSON.parse(pending.subarray(0, expectedBytes).toString('utf8'));
+    postReleaseInput = pending.subarray(expectedBytes);
+    pending = Buffer.alloc(0);
+    launch(release);
   } catch {
-    return false;
+    process.exit(1);
   }
-}
-async function syncDirectory3(path) {
-  if (process.platform === "win32") return;
-  const directory = await open3(path, "r");
-  try {
-    await directory.sync();
-  } finally {
-    await directory.close();
+});
+process.stdin.on('end', () => {
+  stdinEnded = true;
+  if (!containmentReady) process.exit(1);
+  if (target) target.stdin.end();
+  else if (!launchPending) process.exit(1);
+});
+process.stdin.on('error', () => process.exit(1));
+`;
+var WINDOWS_PRIVATE_DACL_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$paths = ConvertFrom-Json $env:ZIXT_RUN_ARTIFACT_PATHS
+$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$system = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-18')
+$admins = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+$allowed = @($current.Value, $system.Value, $admins.Value)
+foreach ($path in $paths) {
+  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+  $acl.SetAccessRuleProtection($true, $false)
+  foreach ($sid in @($current, $system, $admins)) {
+    $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+      $sid,
+      [System.Security.AccessControl.FileSystemRights]::FullControl,
+      [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
+      [System.Security.AccessControl.PropagationFlags]::None,
+      [System.Security.AccessControl.AccessControlType]::Allow
+    )
+    [void]$acl.AddAccessRule($rule)
+  }
+  $entry = [System.IO.DirectoryInfo]::new($path)
+  $entry.SetAccessControl($acl)
+  $check = $entry.GetAccessControl()
+  if (-not $check.AreAccessRulesProtected) { throw 'DACL inheritance remained enabled' }
+  $seen = @{}
+  foreach ($rule in $check.Access) {
+    $sid = $rule.IdentityReference.Translate(
+      [System.Security.Principal.SecurityIdentifier]
+    ).Value
+    if ($rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $sid) {
+      throw 'Unexpected DACL entry'
+    }
+    $seen[$sid] = $true
+  }
+  foreach ($sid in $allowed) {
+    if (-not $seen.ContainsKey($sid)) { throw 'Required DACL entry is missing' }
   }
 }
-function installedReleaseVersion(entry, root = versionsRoot()) {
-  if (!isAbsolute7(entry)) return null;
-  const relativeEntry = relative3(resolve4(root), resolve4(entry));
-  if (!relativeEntry || relativeEntry.startsWith(`..${sep3}`) || isAbsolute7(relativeEntry)) {
-    return null;
+`;
+function defaultRunArtifactRoot() {
+  return join6(homedir(), ".zixt", "run-artifacts");
+}
+function requireSafeSegment(value, field) {
+  if (!SAFE_SEGMENT.test(value)) {
+    throw new Error(`${field} must be a safe path segment`);
   }
-  const version2 = relativeEntry.split(sep3)[0];
-  if (!version2 || !VERSION_DIR.test(version2)) return null;
-  return resolve4(entry) === resolve4(installedReleaseEntry(version2, root)) ? version2 : null;
 }
-function currentReleaseEntry(root = versionsRoot(), platform = process.platform) {
-  return join6(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
+function isMissing(error52) {
+  return error52.code === "ENOENT";
 }
-function windowsReleasePointer(root = versionsRoot()) {
-  return join6(root, WINDOWS_RELEASE_POINTER);
+function assertBelow(parent, child) {
+  const path = relative3(parent, child);
+  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute7(path);
+  if (escapes) throw new Error("run artifact path escapes its private root");
 }
-var WINDOWS_STABLE_LAUNCHER = `${WINDOWS_LAUNCHER_MARKER}
-'use strict';
-const { spawn } = require('node:child_process');
-const { readFileSync } = require('node:fs');
-const { dirname, isAbsolute, join } = require('node:path');
-const pointer = JSON.parse(readFileSync(join(dirname(__filename), '${WINDOWS_RELEASE_POINTER}'), 'utf8'));
-if (pointer.schema !== 1 || typeof pointer.entry !== 'string' || !isAbsolute(pointer.entry)) process.exit(64);
-const child = spawn(process.execPath, [pointer.entry, ...process.argv.slice(2)], {
-  // This wrapper owns the only write end of the installed launcher's stdin.
-  // If Task Scheduler/the wrapper dies, EOF reaches launchHostSupervisor and
-  // triggers checked supervisor/worker cleanup before a scheduled restart.
-  stdio: ['pipe', 'inherit', 'inherit'],
-  windowsHide: true,
-});
-child.stdin.on('error', () => {});
-let stopping = false;
-const closeChildInput = () => {
-  if (stopping) return;
-  stopping = true;
-  try { child.stdin.end(); } catch {}
-};
-process.stdin.on('data', (chunk) => {
-  if (!stopping && child.stdin.writable) child.stdin.write(chunk);
-});
-process.stdin.on('end', closeChildInput);
-process.stdin.on('error', closeChildInput);
-process.stdin.resume();
-process.on('SIGINT', closeChildInput);
-process.on('SIGTERM', closeChildInput);
-child.once('error', () => process.exit(1));
-child.once('exit', (code) => process.exit(code == null ? 1 : code));
-`;
-async function replaceDurableFile(path, contents, sync = syncDirectory3) {
-  const parent = dirname3(path);
-  await mkdir3(parent, { recursive: true, mode: 448 });
-  const temporary = join6(parent, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
-  const handle = await open3(temporary, "wx", 384);
-  try {
-    await handle.writeFile(contents, "utf8");
-    await handle.sync();
-    await handle.close();
-    await rename2(temporary, path);
-    await sync(parent);
-  } catch (error52) {
-    await handle.close().catch(() => void 0);
-    await rm3(temporary, { force: true }).catch(() => void 0);
-    throw error52;
-  }
+async function requireRealDirectory(path, label) {
+  const entry = await lstat4(path);
+  if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
+  if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
+  return realpath3(path);
 }
-async function activateInstalledRelease(entry, root = versionsRoot(), platform = process.platform, sync = syncDirectory3) {
-  if (installedReleaseVersion(entry, root) === null) {
-    throw new Error("release entry is outside the Zixt Host versions directory");
+function assertWindowsProfileBoundary(profile, target) {
+  const path = win322.relative(win322.resolve(profile), win322.resolve(target));
+  if (path === "" || path === ".." || path.startsWith("..\\") || win322.isAbsolute(path)) {
+    throw new Error("run artifact root must be inside the current Windows user profile");
   }
-  await access2(entry);
-  if (platform === "win32") {
-    await mkdir3(root, { recursive: true, mode: 448 });
-    const launcher = currentReleaseEntry(root, platform);
-    const existingLauncher = await lstat4(launcher).catch((error52) => {
-      if (error52.code === "ENOENT") return null;
-      throw error52;
-    });
-    if (existingLauncher) {
-      if (!existingLauncher.isFile()) {
-        throw new Error("the Zixt Host Windows launcher is not a regular file");
-      }
-      const contents = await readFile5(launcher, "utf8");
-      if (!contents.startsWith(WINDOWS_LAUNCHER_OWNED_MARKER)) {
-        throw new Error("the Zixt Host Windows launcher is not owned by Zixt");
-      }
-      if (contents !== WINDOWS_STABLE_LAUNCHER) {
-        await replaceDurableFile(launcher, WINDOWS_STABLE_LAUNCHER, sync);
+}
+async function rejectWindowsSymlinkAncestors(profile, target) {
+  const path = win322.relative(win322.resolve(profile), win322.resolve(target));
+  let current = win322.resolve(profile);
+  for (const segment of path.split("\\").filter(Boolean)) {
+    current = win322.join(current, segment);
+    try {
+      const entry = await lstat4(current);
+      if (entry.isSymbolicLink()) {
+        throw new Error("run artifact path must not contain symbolic links or junctions");
       }
-    } else {
-      await replaceDurableFile(launcher, WINDOWS_STABLE_LAUNCHER, sync);
-    }
-    const pointerPath = windowsReleasePointer(root);
-    const existingPointer = await lstat4(pointerPath).catch((error52) => {
-      if (error52.code === "ENOENT") return null;
+    } catch (error52) {
+      if (isMissing(error52)) return;
       throw error52;
-    });
-    if (existingPointer) {
-      if (!existingPointer.isFile() || existingPointer.size > 4 * 1024) {
-        throw new Error("the Zixt Host Windows release pointer is invalid");
-      }
-      let prior;
-      try {
-        prior = JSON.parse(await readFile5(pointerPath, "utf8"));
-      } catch {
-        throw new Error("the Zixt Host Windows release pointer is invalid");
-      }
-      const candidate = prior;
-      if (!prior || typeof prior !== "object" || candidate.schema !== 1 || typeof candidate.entry !== "string" || installedReleaseVersion(candidate.entry, root) === null) {
-        throw new Error("the Zixt Host Windows release pointer is invalid");
-      }
     }
-    await replaceDurableFile(
-      pointerPath,
-      `${JSON.stringify({ schema: 1, entry: resolve4(entry) })}
-`,
-      sync
-    );
-    return launcher;
   }
-  if (platform !== "linux" && platform !== "darwin") return entry;
-  await mkdir3(root, { recursive: true, mode: 448 });
-  const current = currentReleaseEntry(root, platform);
-  const existing = await lstat4(current).catch((error52) => {
-    if (error52.code === "ENOENT") return null;
-    throw error52;
-  });
-  if (existing && !existing.isSymbolicLink()) {
-    throw new Error("the Zixt Host current-release entry is not a symbolic link");
+}
+async function prepareRoot(root) {
+  const absolute = resolve4(root);
+  let realProfile;
+  if (process.platform === "win32") {
+    const profile = resolve4(homedir());
+    assertWindowsProfileBoundary(profile, absolute);
+    await rejectWindowsSymlinkAncestors(profile, absolute);
+    realProfile = await realpath3(profile);
   }
-  const temporary = join6(root, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
   try {
-    await symlink(entry, temporary, "file");
-    await rename2(temporary, current);
-    await sync(root);
+    await lstat4(absolute);
   } catch (error52) {
-    await rm3(temporary, { force: true }).catch(() => void 0);
-    throw error52;
+    if (!isMissing(error52)) throw error52;
+    await mkdir3(absolute, { recursive: true, mode: DIRECTORY_MODE });
   }
-  return current;
+  const real = await requireRealDirectory(absolute, "run artifact root");
+  if (realProfile) assertWindowsProfileBoundary(realProfile, real);
+  await chmod2(real, DIRECTORY_MODE);
+  return real;
 }
-async function activatedReleaseVersion(root = versionsRoot(), platform = process.platform) {
-  if (platform === "win32") {
+async function prepareAgentRoot(root, agentId) {
+  const path = join6(root, agentId);
+  assertBelow(root, path);
+  try {
+    await lstat4(path);
+  } catch (error52) {
+    if (!isMissing(error52)) throw error52;
     try {
-      const pointerPath = windowsReleasePointer(root);
-      const metadata = await lstat4(pointerPath);
-      if (!metadata.isFile() || metadata.size > 4 * 1024) return null;
-      const value = JSON.parse(await readFile5(pointerPath, "utf8"));
-      return value.schema === 1 && typeof value.entry === "string" ? installedReleaseVersion(value.entry, root) : null;
-    } catch {
-      return null;
+      await mkdir3(path, { mode: DIRECTORY_MODE });
+    } catch (mkdirError) {
+      if (mkdirError.code !== "EEXIST") throw mkdirError;
     }
   }
-  if (platform !== "linux" && platform !== "darwin") return null;
-  try {
-    const current = currentReleaseEntry(root, platform);
-    const target = await readlink(current);
-    return installedReleaseVersion(resolve4(dirname3(current), target), root);
-  } catch {
-    return null;
+  const real = await requireRealDirectory(path, "run artifact Agent directory");
+  assertBelow(root, real);
+  await chmod2(real, DIRECTORY_MODE);
+  return real;
+}
+async function lockDownWindowsDirectories(paths) {
+  if (process.platform !== "win32") return;
+  const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
+  if (!windowsRoot || !win322.isAbsolute(windowsRoot)) {
+    throw new Error("private Windows run-artifact ACL authority is unavailable");
   }
+  const powershell = join6(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const encoded = Buffer.from(WINDOWS_PRIVATE_DACL_SCRIPT, "utf16le").toString("base64");
+  await new Promise((resolvePromise, reject3) => {
+    const helper = spawn4(
+      powershell,
+      ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded],
+      {
+        env: {
+          SystemRoot: windowsRoot,
+          WINDIR: windowsRoot,
+          ...process.env.TEMP ? { TEMP: process.env.TEMP } : {},
+          ...process.env.TMP ? { TMP: process.env.TMP } : {},
+          ZIXT_RUN_ARTIFACT_PATHS: JSON.stringify(paths)
+        },
+        stdio: "ignore",
+        windowsHide: true
+      }
+    );
+    let finished = false;
+    const timeout = setTimeout(() => {
+      helper.kill("SIGKILL");
+      finish(new Error("private Windows run-artifact ACL update timed out"));
+    }, WINDOWS_ACL_TIMEOUT_MS);
+    timeout.unref?.();
+    const finish = (error52) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timeout);
+      if (error52) reject3(error52);
+      else resolvePromise();
+    };
+    helper.once(
+      "error",
+      () => finish(new Error("private Windows run-artifact ACL update could not start"))
+    );
+    helper.once(
+      "close",
+      (code) => finish(code === 0 ? void 0 : new Error("private Windows run-artifact ACL update failed"))
+    );
+  });
 }
-function sanitizedInstallerEnv(inherited) {
-  const allowed = /* @__PURE__ */ new Set([
-    "PATH",
-    "HOME",
-    "USERPROFILE",
-    "SYSTEMROOT",
-    "WINDIR",
-    "TEMP",
-    "TMP",
-    "TMPDIR",
-    "LOCALAPPDATA",
-    "APPDATA",
-    "XDG_CONFIG_HOME",
+async function createPrivateDirectory(parent, name) {
+  const path = join6(parent, name);
+  assertBelow(parent, path);
+  await mkdir3(path, { mode: DIRECTORY_MODE });
+  await chmod2(path, DIRECTORY_MODE);
+  const real = await realpath3(path);
+  assertBelow(parent, real);
+  return real;
+}
+async function writePrivateFile(path, content) {
+  await writeFile(path, content, { flag: "wx", mode: FILE_MODE });
+  await chmod2(path, FILE_MODE);
+}
+function quotePosix(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function quoteWindows(value) {
+  if (value.includes('"') || /[\r\n]/.test(value)) {
+    throw new Error("Windows command paths must not contain quotes or newlines");
+  }
+  return `"${value}"`;
+}
+function buildDenySshCommand(executablePath, scriptPath, platform = process.platform) {
+  const quote2 = platform === "win32" ? quoteWindows : quotePosix;
+  return `${quote2(executablePath)} ${quote2(scriptPath)}`;
+}
+async function createRunArtifacts(input) {
+  requireSafeSegment(input.agentId, "agentId");
+  requireSafeSegment(input.runToken, "runToken");
+  const root = await prepareRoot(input.root);
+  const removeTree = input.removeTree ?? ((path) => rm3(path, { recursive: true, force: true }));
+  const cleanupRetryDelayMs = input.cleanupRetryDelayMs ?? CLEANUP_RETRY_DELAY_MS;
+  const agentRoot = await prepareAgentRoot(root, input.agentId);
+  await lockDownWindowsDirectories([root, agentRoot]);
+  const runRoot = join6(agentRoot, input.runToken);
+  assertBelow(agentRoot, runRoot);
+  try {
+    await mkdir3(runRoot, { mode: DIRECTORY_MODE });
+    await chmod2(runRoot, DIRECTORY_MODE);
+    const realRunRoot = await realpath3(runRoot);
+    assertBelow(agentRoot, realRunRoot);
+    const emptyGithubConfigDirectory = await createPrivateDirectory(realRunRoot, "gh-config");
+    const emptyGitHooksDirectory = await createPrivateDirectory(realRunRoot, "git-hooks");
+    const gitBridgesDirectory = await createPrivateDirectory(realRunRoot, "git-bridges");
+    const denySshScript = join6(realRunRoot, "deny-ssh.cjs");
+    const runnerWrapperScript = join6(realRunRoot, "runner-wrapper.cjs");
+    const systemPromptPath = join6(realRunRoot, "system-prompt.txt");
+    const mcpConfigPath = join6(realRunRoot, "mcp.json");
+    await writePrivateFile(denySshScript, "process.exitCode = 127;");
+    await writePrivateFile(runnerWrapperScript, RUNNER_GUARDIAN);
+    return {
+      runRoot: realRunRoot,
+      emptyGithubConfigDirectory,
+      emptyGitHooksDirectory,
+      gitBridgesDirectory,
+      denySshScript,
+      denySshCommand: buildDenySshCommand(process.execPath, denySshScript),
+      runnerWrapperScript,
+      nullConfigPath: process.platform === "win32" ? "NUL" : "/dev/null",
+      async writeSystemPrompt(content) {
+        await writePrivateFile(systemPromptPath, content);
+        return systemPromptPath;
+      },
+      async writeMcpConfig(content) {
+        await writePrivateFile(mcpConfigPath, content);
+        return mcpConfigPath;
+      },
+      async cleanup() {
+        await removePrivateTreeWithRetries(realRunRoot, removeTree, cleanupRetryDelayMs);
+      }
+    };
+  } catch (error52) {
+    await removePrivateTreeWithRetries(runRoot, removeTree, cleanupRetryDelayMs).catch(() => {
+    });
+    throw error52;
+  }
+}
+async function removePrivateTreeWithRetries(path, removeTree, retryDelayMs) {
+  for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS; attempt++) {
+    try {
+      await removeTree(path);
+      return;
+    } catch (error52) {
+      if (attempt === CLEANUP_ATTEMPTS) throw error52;
+      await new Promise((resolveDelay) => setTimeout(resolveDelay, retryDelayMs));
+    }
+  }
+}
+async function sweepOrphanedRunArtifacts(root) {
+  const absolute = resolve4(root);
+  let realProfile;
+  if (process.platform === "win32") {
+    const profile = resolve4(homedir());
+    assertWindowsProfileBoundary(profile, absolute);
+    await rejectWindowsSymlinkAncestors(profile, absolute);
+    realProfile = await realpath3(profile);
+  }
+  let realRoot;
+  try {
+    realRoot = await requireRealDirectory(absolute, "run artifact root");
+  } catch (error52) {
+    if (isMissing(error52)) return 0;
+    throw error52;
+  }
+  if (realProfile) assertWindowsProfileBoundary(realProfile, realRoot);
+  await chmod2(realRoot, DIRECTORY_MODE);
+  await lockDownWindowsDirectories([realRoot]);
+  const agents = await readdir2(realRoot, { withFileTypes: true });
+  let removed = 0;
+  for (const agent of agents) {
+    if (!SAFE_SEGMENT.test(agent.name) || !agent.isDirectory() || agent.isSymbolicLink()) continue;
+    const agentPath = join6(realRoot, agent.name);
+    const runs = await readdir2(agentPath, { withFileTypes: true });
+    for (const run3 of runs) {
+      if (!SAFE_SEGMENT.test(run3.name) || !run3.isDirectory() || run3.isSymbolicLink()) continue;
+      const runPath = join6(agentPath, run3.name);
+      assertBelow(agentPath, runPath);
+      await rm3(runPath, { recursive: true, force: true });
+      removed++;
+    }
+  }
+  return removed;
+}
+function defaultRunRegistryRoot() {
+  return join6(homedir(), ".zixt", "run-registry");
+}
+async function terminateRecordedRunProcesses(registryRoot = defaultRunRegistryRoot(), terminate = terminateRecordedProcessTree) {
+  const entries = await readRecordedRunAssignmentEntriesStrict(registryRoot);
+  const terminated = /* @__PURE__ */ new Set();
+  const orderedEntries = [...entries].sort(
+    (left, right) => Number(Boolean(right.record.identity)) - Number(Boolean(left.record.identity))
+  );
+  for (const { record: record2 } of orderedEntries) {
+    const identityKey = record2.identity ? `${record2.identity.kind}:${record2.identity.nonce}` : "legacy";
+    const witnessKey = `${record2.pid}:${identityKey}`;
+    if (terminated.has(witnessKey)) continue;
+    await terminate(record2.pid, record2.identity);
+    terminated.add(witnessKey);
+  }
+  return entries.map(({ record: record2 }) => record2);
+}
+async function syncRunRegistryDirectory(path) {
+  const handle = await open3(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory7) {
+  const firstCreated = await mkdir3(registryRoot, { recursive: true, mode: DIRECTORY_MODE });
+  if (firstCreated && process.platform !== "win32") {
+    const first = resolve4(firstCreated);
+    const target = resolve4(registryRoot);
+    await syncDirectory7(dirname3(first));
+    let current = first;
+    for (const part of relative3(first, target).split(sep3).filter(Boolean)) {
+      await syncDirectory7(current);
+      current = join6(current, part);
+    }
+  }
+  await chmod2(registryRoot, DIRECTORY_MODE);
+}
+async function recordRunAssignment(runToken, record2, registryRoot = defaultRunRegistryRoot(), options = {}) {
+  if (!SAFE_SEGMENT.test(runToken)) return false;
+  const destination = join6(registryRoot, `${runToken}.json`);
+  const temporary = join6(registryRoot, `.${runToken}.${process.pid}.${Date.now()}.tmp`);
+  let handle;
+  try {
+    const syncDirectory7 = options.syncDirectory ?? syncRunRegistryDirectory;
+    await ensureDurableRunRegistryRoot(registryRoot, syncDirectory7);
+    handle = await open3(temporary, "wx", FILE_MODE);
+    await handle.writeFile(JSON.stringify(record2), "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await rename2(temporary, destination);
+    if (process.platform !== "win32") {
+      await syncDirectory7(registryRoot);
+    }
+    return true;
+  } catch {
+    return false;
+  } finally {
+    await handle?.close().catch(() => {
+    });
+    await rm3(temporary, { force: true }).catch(() => {
+    });
+  }
+}
+var retainingAssignments = false;
+function retainRunAssignments() {
+  retainingAssignments = true;
+}
+async function forgetRunAssignment(runToken, registryRoot = defaultRunRegistryRoot()) {
+  if (retainingAssignments) return;
+  if (!SAFE_SEGMENT.test(runToken)) return;
+  try {
+    await rm3(join6(registryRoot, `${runToken}.json`), { force: true });
+  } catch {
+  }
+}
+function parseAssignment(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const value = parsed;
+  if (typeof value.taskId !== "string" || value.taskId === "") return null;
+  if (typeof value.epoch !== "number" || !Number.isInteger(value.epoch) || value.epoch < 1) {
+    return null;
+  }
+  const pid = value.pid;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 1) return null;
+  let identity;
+  if (value.identity !== void 0) {
+    if (typeof value.identity !== "object" || value.identity === null || value.identity.kind !== "guardian_nonce" || typeof value.identity.nonce !== "string" || !/^[A-Za-z0-9_-]{16,200}$/.test(value.identity.nonce)) {
+      return null;
+    }
+    identity = {
+      kind: "guardian_nonce",
+      nonce: value.identity.nonce
+    };
+  }
+  return { taskId: value.taskId, epoch: value.epoch, pid, ...identity ? { identity } : {} };
+}
+async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistryRoot()) {
+  let entries;
+  try {
+    entries = await readdir2(registryRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || entry.isSymbolicLink() || !entry.name.endsWith(".json")) continue;
+    const runToken = entry.name.slice(0, -".json".length);
+    if (!SAFE_SEGMENT.test(runToken)) continue;
+    let text;
+    try {
+      text = await readFile5(join6(registryRoot, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseAssignment(text);
+    if (record2) found.push({ runToken, record: record2 });
+  }
+  return found;
+}
+async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunRegistryRoot()) {
+  let rootStat;
+  try {
+    rootStat = await lstat4(registryRoot);
+  } catch (error52) {
+    if (isMissing(error52)) return [];
+    throw new Error("run registry state could not be observed");
+  }
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error("run registry root is not a trusted directory");
+  }
+  let entries;
+  try {
+    entries = await readdir2(registryRoot, { withFileTypes: true });
+  } catch {
+    throw new Error("run registry state could not be observed");
+  }
+  const found = [];
+  for (const entry of entries) {
+    if (!entry.name.endsWith(".json")) continue;
+    const runToken = entry.name.slice(0, -".json".length);
+    if (!SAFE_SEGMENT.test(runToken)) continue;
+    if (!entry.isFile() || entry.isSymbolicLink()) {
+      throw new Error("committed run registry witness is not a regular file");
+    }
+    let text;
+    try {
+      text = await readFile5(join6(registryRoot, entry.name), "utf8");
+    } catch {
+      throw new Error("committed run registry witness could not be read");
+    }
+    const record2 = parseAssignment(text);
+    if (!record2) throw new Error("committed run registry witness is malformed");
+    found.push({ runToken, record: record2 });
+  }
+  return found;
+}
+async function forgetAcknowledgedRunAssignments(assignments, registryRoot = defaultRunRegistryRoot()) {
+  if (assignments.length === 0) return;
+  const acknowledged = new Set(
+    assignments.map((assignment) => `${assignment.taskId}:${assignment.epoch}`)
+  );
+  const entries = await readRecordedRunAssignmentEntries(registryRoot);
+  await Promise.all(
+    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm3(join6(registryRoot, `${runToken}.json`), { force: true }))
+  );
+}
+async function forgetSupersededRunAssignments(taskId, epoch, registryRoot = defaultRunRegistryRoot()) {
+  const entries = await readRecordedRunAssignmentEntries(registryRoot);
+  await Promise.all(
+    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm3(join6(registryRoot, `${runToken}.json`), { force: true }))
+  );
+}
+
+// src/supervisor.ts
+var PACKAGE_NAME = "@zixt/host";
+var WORKER_ROLE_ENV = "ZIXT_HOST_ROLE";
+var WORKER_ROLE = "worker";
+var WORKER_PROXY_ROLE = "worker_proxy";
+var SUPERVISOR_ROLE = "supervisor";
+var WORKER_PROXY_ENTRY_ENV = "ZIXT_HOST_WORKER_PROXY_ENTRY";
+var SUPERVISOR_PROTOCOL_ENV = "ZIXT_HOST_SUPERVISOR_PROTOCOL";
+var SUPERVISOR_VERSION_ENV = "ZIXT_HOST_SUPERVISOR_VERSION";
+var SUPERVISOR_PROTOCOL = "2";
+var SUPERVISOR_RELOAD_EXIT_CODE = 76;
+var DO_NOT_RESTART_EXIT_CODE = 64;
+var RESTART_BACKOFF_MS = 2e3;
+var MAX_RESTART_BACKOFF_MS = 6e4;
+var CRASH_STREAK_RESET_MS = 6e4;
+var RELEASE_PROBATION_MS = 5 * 6e4;
+var FAST_UPDATE_EXIT_MS = 1e4;
+var STOP_GRACE_MS = 3e4;
+var INSTALL_TIMEOUT_MS = 5 * 6e4;
+var WORKER_WATCHDOG_CHECK_MS = 1e3;
+var WORKER_WATCHDOG_TIMEOUT_MS = 15e3;
+var WORKER_WATCHDOG_STARTUP_MS = 6e4;
+var WORKER_READINESS_TIMEOUT_MS = 9e4;
+var CLEANUP_ATTEMPTS2 = 3;
+var VERSION_DIR = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+var CURRENT_RELEASE_ENTRY = "current.js";
+var WINDOWS_RELEASE_POINTER = "current-release.json";
+var WINDOWS_LAUNCHER_OWNED_MARKER = "// Zixt Host stable Windows launcher v";
+var WINDOWS_LAUNCHER_MARKER = `${WINDOWS_LAUNCHER_OWNED_MARKER}2`;
+function signalWorkerGroup(child, signal) {
+  if (!child.pid) return;
+  try {
+    if (process.platform === "win32") child.kill(signal);
+    else process.kill(-child.pid, signal);
+  } catch {
+  }
+}
+function versionsRoot() {
+  return process.env.ZIXT_HOST_VERSIONS_DIR ?? join7(homedir2(), ".zixt", "host-versions");
+}
+function npmCommand(platform = process.platform) {
+  return platform === "win32" ? "npm.cmd" : "npm";
+}
+function windowsInstallerCommandLine(command, args) {
+  return [command, ...args].map(quoteForCmd).join(" ");
+}
+function installedReleaseEntry(version2, root = versionsRoot()) {
+  return join7(root, version2, "node_modules", PACKAGE_NAME, "dist", "index.js");
+}
+function releaseEntryAtPrefix(prefix) {
+  return join7(prefix, "node_modules", PACKAGE_NAME, "dist", "index.js");
+}
+function releaseManifestAtPrefix(prefix) {
+  return join7(prefix, "node_modules", PACKAGE_NAME, "package.json");
+}
+async function validReleaseAtPrefix(prefix, version2) {
+  try {
+    const [entry, manifestText] = await Promise.all([
+      lstat5(releaseEntryAtPrefix(prefix)),
+      readFile6(releaseManifestAtPrefix(prefix), "utf8")
+    ]);
+    if (!entry.isFile()) return false;
+    const manifest = JSON.parse(manifestText);
+    return manifest.name === PACKAGE_NAME && manifest.version === version2;
+  } catch {
+    return false;
+  }
+}
+async function syncDirectory3(path) {
+  if (process.platform === "win32") return;
+  const directory = await open4(path, "r");
+  try {
+    await directory.sync();
+  } finally {
+    await directory.close();
+  }
+}
+function installedReleaseVersion(entry, root = versionsRoot()) {
+  if (!isAbsolute8(entry)) return null;
+  const relativeEntry = relative4(resolve5(root), resolve5(entry));
+  if (!relativeEntry || relativeEntry.startsWith(`..${sep4}`) || isAbsolute8(relativeEntry)) {
+    return null;
+  }
+  const version2 = relativeEntry.split(sep4)[0];
+  if (!version2 || !VERSION_DIR.test(version2)) return null;
+  return resolve5(entry) === resolve5(installedReleaseEntry(version2, root)) ? version2 : null;
+}
+function currentReleaseEntry(root = versionsRoot(), platform = process.platform) {
+  return join7(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
+}
+function windowsReleasePointer(root = versionsRoot()) {
+  return join7(root, WINDOWS_RELEASE_POINTER);
+}
+var WINDOWS_STABLE_LAUNCHER = `${WINDOWS_LAUNCHER_MARKER}
+'use strict';
+const { spawn } = require('node:child_process');
+const { readFileSync } = require('node:fs');
+const { dirname, isAbsolute, join } = require('node:path');
+const pointer = JSON.parse(readFileSync(join(dirname(__filename), '${WINDOWS_RELEASE_POINTER}'), 'utf8'));
+if (pointer.schema !== 1 || typeof pointer.entry !== 'string' || !isAbsolute(pointer.entry)) process.exit(64);
+const child = spawn(process.execPath, [pointer.entry, ...process.argv.slice(2)], {
+  // This wrapper owns the only write end of the installed launcher's stdin.
+  // If Task Scheduler/the wrapper dies, EOF reaches launchHostSupervisor and
+  // triggers checked supervisor/worker cleanup before a scheduled restart.
+  stdio: ['pipe', 'inherit', 'inherit'],
+  windowsHide: true,
+});
+child.stdin.on('error', () => {});
+let stopping = false;
+const closeChildInput = () => {
+  if (stopping) return;
+  stopping = true;
+  try { child.stdin.end(); } catch {}
+};
+process.stdin.on('data', (chunk) => {
+  if (!stopping && child.stdin.writable) child.stdin.write(chunk);
+});
+process.stdin.on('end', closeChildInput);
+process.stdin.on('error', closeChildInput);
+process.stdin.resume();
+process.on('SIGINT', closeChildInput);
+process.on('SIGTERM', closeChildInput);
+child.once('error', () => process.exit(1));
+child.once('exit', (code) => process.exit(code == null ? 1 : code));
+`;
+async function replaceDurableFile(path, contents, sync = syncDirectory3) {
+  const parent = dirname4(path);
+  await mkdir4(parent, { recursive: true, mode: 448 });
+  const temporary = join7(parent, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
+  const handle = await open4(temporary, "wx", 384);
+  try {
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+    await handle.close();
+    await rename3(temporary, path);
+    await sync(parent);
+  } catch (error52) {
+    await handle.close().catch(() => void 0);
+    await rm4(temporary, { force: true }).catch(() => void 0);
+    throw error52;
+  }
+}
+async function activateInstalledRelease(entry, root = versionsRoot(), platform = process.platform, sync = syncDirectory3) {
+  if (installedReleaseVersion(entry, root) === null) {
+    throw new Error("release entry is outside the Zixt Host versions directory");
+  }
+  await access2(entry);
+  if (platform === "win32") {
+    await mkdir4(root, { recursive: true, mode: 448 });
+    const launcher = currentReleaseEntry(root, platform);
+    const existingLauncher = await lstat5(launcher).catch((error52) => {
+      if (error52.code === "ENOENT") return null;
+      throw error52;
+    });
+    if (existingLauncher) {
+      if (!existingLauncher.isFile()) {
+        throw new Error("the Zixt Host Windows launcher is not a regular file");
+      }
+      const contents = await readFile6(launcher, "utf8");
+      if (!contents.startsWith(WINDOWS_LAUNCHER_OWNED_MARKER)) {
+        throw new Error("the Zixt Host Windows launcher is not owned by Zixt");
+      }
+      if (contents !== WINDOWS_STABLE_LAUNCHER) {
+        await replaceDurableFile(launcher, WINDOWS_STABLE_LAUNCHER, sync);
+      }
+    } else {
+      await replaceDurableFile(launcher, WINDOWS_STABLE_LAUNCHER, sync);
+    }
+    const pointerPath = windowsReleasePointer(root);
+    const existingPointer = await lstat5(pointerPath).catch((error52) => {
+      if (error52.code === "ENOENT") return null;
+      throw error52;
+    });
+    if (existingPointer) {
+      if (!existingPointer.isFile() || existingPointer.size > 4 * 1024) {
+        throw new Error("the Zixt Host Windows release pointer is invalid");
+      }
+      let prior;
+      try {
+        prior = JSON.parse(await readFile6(pointerPath, "utf8"));
+      } catch {
+        throw new Error("the Zixt Host Windows release pointer is invalid");
+      }
+      const candidate = prior;
+      if (!prior || typeof prior !== "object" || candidate.schema !== 1 || typeof candidate.entry !== "string" || installedReleaseVersion(candidate.entry, root) === null) {
+        throw new Error("the Zixt Host Windows release pointer is invalid");
+      }
+    }
+    await replaceDurableFile(
+      pointerPath,
+      `${JSON.stringify({ schema: 1, entry: resolve5(entry) })}
+`,
+      sync
+    );
+    return launcher;
+  }
+  if (platform !== "linux" && platform !== "darwin") return entry;
+  await mkdir4(root, { recursive: true, mode: 448 });
+  const current = currentReleaseEntry(root, platform);
+  const existing = await lstat5(current).catch((error52) => {
+    if (error52.code === "ENOENT") return null;
+    throw error52;
+  });
+  if (existing && !existing.isSymbolicLink()) {
+    throw new Error("the Zixt Host current-release entry is not a symbolic link");
+  }
+  const temporary = join7(root, `.${CURRENT_RELEASE_ENTRY}.${process.pid}.${crypto.randomUUID()}`);
+  try {
+    await symlink(entry, temporary, "file");
+    await rename3(temporary, current);
+    await sync(root);
+  } catch (error52) {
+    await rm4(temporary, { force: true }).catch(() => void 0);
+    throw error52;
+  }
+  return current;
+}
+async function activatedReleaseVersion(root = versionsRoot(), platform = process.platform) {
+  if (platform === "win32") {
+    try {
+      const pointerPath = windowsReleasePointer(root);
+      const metadata = await lstat5(pointerPath);
+      if (!metadata.isFile() || metadata.size > 4 * 1024) return null;
+      const value = JSON.parse(await readFile6(pointerPath, "utf8"));
+      return value.schema === 1 && typeof value.entry === "string" ? installedReleaseVersion(value.entry, root) : null;
+    } catch {
+      return null;
+    }
+  }
+  if (platform !== "linux" && platform !== "darwin") return null;
+  try {
+    const current = currentReleaseEntry(root, platform);
+    const target = await readlink(current);
+    return installedReleaseVersion(resolve5(dirname4(current), target), root);
+  } catch {
+    return null;
+  }
+}
+function sanitizedInstallerEnv(inherited) {
+  const allowed = /* @__PURE__ */ new Set([
+    "PATH",
+    "HOME",
+    "USERPROFILE",
+    "SYSTEMROOT",
+    "WINDIR",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "LOCALAPPDATA",
+    "APPDATA",
+    "XDG_CONFIG_HOME",
     "XDG_CACHE_HOME",
     "HTTP_PROXY",
     "HTTPS_PROXY",
@@ -24851,13 +25563,13 @@ async function installRelease(version2, options = {}) {
   const platform = options.platform ?? process.platform;
   const installerCommand = options.installerCommand ?? npmCommand(platform);
   const root = options.root ?? versionsRoot();
-  const prefix = join6(root, version2);
+  const prefix = join7(root, version2);
   const entry = installedReleaseEntry(version2, root);
   if (await validReleaseAtPrefix(prefix, version2)) return entry;
   if (options.signal?.aborted) return null;
-  await mkdir3(root, { recursive: true, mode: 448 });
-  const staging = join6(root, `.install-${version2}-${process.pid}-${crypto.randomUUID()}`);
-  const quarantine = join6(root, `.invalid-${version2}-${process.pid}-${crypto.randomUUID()}`);
+  await mkdir4(root, { recursive: true, mode: 448 });
+  const staging = join7(root, `.install-${version2}-${process.pid}-${crypto.randomUUID()}`);
+  const quarantine = join7(root, `.invalid-${version2}-${process.pid}-${crypto.randomUUID()}`);
   const usesWindowsInstallerGuardian = platform === "win32" && options.spawnInstaller === void 0;
   const installerGateNonce = usesWindowsInstallerGuardian ? crypto.randomUUID() : null;
   const installerArguments = (installPrefix, installVersion) => [
@@ -24872,14 +25584,14 @@ async function installRelease(version2, options = {}) {
   const spawnInstaller = options.spawnInstaller ?? ((installPrefix, installVersion) => {
     const installerArgs = installerArguments(installPrefix, installVersion);
     if (usesWindowsInstallerGuardian) {
-      return spawn4(process.execPath, ["-e", WINDOWS_INSTALLER_GUARDIAN, installerGateNonce], {
+      return spawn5(process.execPath, ["-e", WINDOWS_INSTALLER_GUARDIAN, installerGateNonce], {
         cwd: root,
         stdio: ["pipe", "inherit", "inherit", "ipc"],
         env: sanitizedInstallerEnv(process.env),
         windowsHide: true
       });
     }
-    return spawn4(installerCommand, installerArgs, {
+    return spawn5(installerCommand, installerArgs, {
       stdio: "inherit",
       env: sanitizedInstallerEnv(process.env),
       detached: true
@@ -24889,7 +25601,7 @@ async function installRelease(version2, options = {}) {
   try {
     child = spawnInstaller(staging, version2);
   } catch {
-    await rm3(staging, { recursive: true, force: true }).catch(() => void 0);
+    await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
     return null;
   }
   let resolveChildExited;
@@ -24934,7 +25646,7 @@ async function installRelease(version2, options = {}) {
       if (cleanupStarted || finished) return;
       cleanupStarted = true;
       void (async () => {
-        for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS; attempt++) {
+        for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
           try {
             let containment = null;
             try {
@@ -24948,7 +25660,7 @@ async function installRelease(version2, options = {}) {
             finish(successfulCleanupResult);
             return;
           } catch (error52) {
-            if (attempt === CLEANUP_ATTEMPTS) {
+            if (attempt === CLEANUP_ATTEMPTS2) {
               finished = true;
               clearTimeout(timer);
               options.signal?.removeEventListener("abort", requestCleanup);
@@ -25026,39 +25738,39 @@ async function installRelease(version2, options = {}) {
       return null;
     }
     if (await validReleaseAtPrefix(prefix, version2)) return entry;
-    const existing = await lstat4(prefix).catch((error52) => {
+    const existing = await lstat5(prefix).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
-    if (existing) await rename2(prefix, quarantine);
+    if (existing) await rename3(prefix, quarantine);
     try {
-      await rename2(staging, prefix);
+      await rename3(staging, prefix);
     } catch {
       return await validReleaseAtPrefix(prefix, version2) ? entry : null;
     }
     await syncDirectory3(root);
     return await validReleaseAtPrefix(prefix, version2) ? entry : null;
   } finally {
-    await rm3(staging, { recursive: true, force: true }).catch(() => void 0);
-    await rm3(quarantine, { recursive: true, force: true }).catch(() => void 0);
+    await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
+    await rm4(quarantine, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 async function pruneInstalledVersions(keep, root = versionsRoot()) {
   const protectedDirs = new Set(keep);
-  const running = process.argv[1] ? resolve4(process.argv[1]) : null;
+  const running = process.argv[1] ? resolve5(process.argv[1]) : null;
   let entries;
   try {
-    entries = await readdir2(root);
+    entries = await readdir3(root);
   } catch {
     return [];
   }
   const removed = [];
   for (const name of entries) {
     if (protectedDirs.has(name) || !VERSION_DIR.test(name)) continue;
-    const dir = join6(root, name);
-    if (running && running.startsWith(`${dir}${sep3}`)) continue;
+    const dir = join7(root, name);
+    if (running && running.startsWith(`${dir}${sep4}`)) continue;
     try {
-      await rm3(dir, { recursive: true, force: true });
+      await rm4(dir, { recursive: true, force: true });
       removed.push(name);
     } catch {
     }
@@ -25069,7 +25781,7 @@ function durableState(phase, candidateVersion, fallbackVersion) {
   return { schema: 1, phase, candidateVersion, fallbackVersion };
 }
 async function validInstalledRelease(version2, root = versionsRoot()) {
-  return validReleaseAtPrefix(join6(root, version2), version2);
+  return validReleaseAtPrefix(join7(root, version2), version2);
 }
 async function recoverDurableReleaseState(store, runningVersion, activeBootVersion, activate, log2) {
   const state = await store.load();
@@ -25181,14 +25893,14 @@ function defaultSpawn(command, argv, supervisorVersion, watchdog, compatibilityO
   delete env.ZIXT_HOST_REJECT_VERSION;
   if (command.rejectedVersion) env.ZIXT_HOST_REJECT_VERSION = command.rejectedVersion;
   const entry = compatibilityProxy ? process.argv[1] ?? "" : command.entry ?? process.argv[1] ?? "";
-  const child = spawn4(process.execPath, [entry, ...argv, ...ownership?.argv ?? []], {
+  const child = spawn5(process.execPath, [entry, ...argv, ...ownership?.argv ?? []], {
     // stdin is a pipe this process owns: closing it is how the worker is
     // asked to stop, which works identically on Windows, where there is no
     // real SIGINT to send. stdout/stderr stay the person's terminal.
     stdio: watchdog ? ["pipe", "inherit", "inherit", "ipc"] : ["pipe", "inherit", "inherit"],
     env,
     ...containmentGateNonce ? {
-      cwd: ownership?.ownershipFile ? dirname3(ownership.ownershipFile) : dirname3(entry)
+      cwd: ownership?.ownershipFile ? dirname4(ownership.ownershipFile) : dirname4(entry)
     } : {},
     // The launch nonce is not a user-facing CLI argument. Keeping it as
     // argv[0] gives the stable launcher an exact cross-platform process
@@ -25217,7 +25929,7 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   const ownership = consumeWorkerOwnershipArguments(argv, env);
   const nonce = env[WORKER_WATCHDOG_NONCE_ENV];
   const ownershipFile = env[WORKER_OWNERSHIP_FILE_ENV];
-  if (typeof target !== "string" || !isAbsolute7(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
+  if (typeof target !== "string" || !isAbsolute8(target) || typeof nonce !== "string" || typeof ownershipFile !== "string" || !ownership.requested || !ownership.valid) {
     return 1;
   }
   if (!recordWorkerOwnership(ownershipFile, nonce)) return 1;
@@ -25232,7 +25944,7 @@ async function runWorkerCompatibilityProxy(env = process.env, argv = process.arg
   delete workerEnv[WORKER_OWNERSHIP_FILE_ENV];
   delete workerEnv[LAUNCHER_OWNERSHIP_DIR_ENV];
   delete workerEnv[SUPERVISOR_OWNERSHIP_FILE_ENV];
-  const child = spawn4(process.execPath, [target, ...ownership.argv], {
+  const child = spawn5(process.execPath, [target, ...ownership.argv], {
     stdio: ["pipe", "inherit", "inherit"],
     env: workerEnv,
     // The proxy is already a detached group/session leader on POSIX. The old
@@ -25288,7 +26000,7 @@ async function launchHostSupervisor(options = {}) {
     const generationNonce = ownershipDirectory ? basename3(ownershipDirectory) : null;
     if (ownershipDirectory && generationNonce) {
       env[LAUNCHER_OWNERSHIP_DIR_ENV] = ownershipDirectory;
-      env[SUPERVISOR_OWNERSHIP_FILE_ENV] = join6(ownershipDirectory, `${generationNonce}.json`);
+      env[SUPERVISOR_OWNERSHIP_FILE_ENV] = join7(ownershipDirectory, `${generationNonce}.json`);
     } else {
       delete env[LAUNCHER_OWNERSHIP_DIR_ENV];
     }
@@ -25296,10 +26008,10 @@ async function launchHostSupervisor(options = {}) {
     if (!containmentGateNonce) delete env[WINDOWS_POST_CONTAINMENT_CWD_ENV];
     if (version2) env[SUPERVISOR_VERSION_ENV] = version2;
     else delete env[SUPERVISOR_VERSION_ENV];
-    const child2 = spawn4(process.execPath, [supervisorEntry, ...argv], {
+    const child2 = spawn5(process.execPath, [supervisorEntry, ...argv], {
       stdio: ["pipe", "inherit", "inherit"],
       env,
-      ...containmentGateNonce ? { cwd: ownershipDirectory ?? dirname3(supervisorEntry) } : {},
+      ...containmentGateNonce ? { cwd: ownershipDirectory ?? dirname4(supervisorEntry) } : {},
       detached: platform !== "win32",
       // The new launcher can discover the durable PID record and still has
       // to bind it to this exact process before signalling a recycled PID.
@@ -25311,7 +26023,8 @@ async function launchHostSupervisor(options = {}) {
   });
   const customDelay = options.delay;
   const ownsWorkerBoundary = options.spawnSupervisor === void 0 || options.ownershipRoot !== void 0;
-  const ownershipRoot = options.ownershipRoot ?? join6(versionsRoot(), "launcher-ownership");
+  const ownershipRoot = options.ownershipRoot ?? join7(versionsRoot(), "launcher-ownership");
+  const runRegistryRoot2 = options.runRegistryRoot ?? (options.ownershipRoot ? join7(dirname4(options.ownershipRoot), "run-registry") : defaultRunRegistryRoot());
   const terminateRecordedOwnership = options.terminateRecordedOwnership ?? terminateRecordedProcessTree;
   const createSupervisorContainment = options.createSupervisorContainment ?? (platform === "win32" && options.spawnSupervisor === void 0 ? async (target, identityNonce, signal) => {
     if (!target.pid) throw new Error("supervisor process id is unavailable");
@@ -25346,14 +26059,17 @@ async function launchHostSupervisor(options = {}) {
     return !stopping;
   };
   const cleanupSupervisorBoundary = async (exitedSupervisor, supervisorExited, ownershipDirectory, containment) => {
-    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS; attempt++) {
+    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
       try {
         if (containment) await containment.terminate();
         else await terminateProcessTree(exitedSupervisor, supervisorExited);
         if (ownershipDirectory) await cleanupOwnershipGeneration(ownershipDirectory);
+        if (ownsWorkerBoundary) {
+          await terminateRecordedRunProcesses(runRegistryRoot2, terminateRecordedOwnership);
+        }
         return true;
       } catch (error52) {
-        const finalAttempt = attempt === CLEANUP_ATTEMPTS;
+        const finalAttempt = attempt === CLEANUP_ATTEMPTS2;
         log2(
           `Zixt Host launcher: old supervisor cleanup is incomplete (${error52 instanceof Error ? error52.message : "unknown error"}); ${finalAttempt ? "exiting for service-manager recovery" : "retrying"}`
         );
@@ -25436,15 +26152,16 @@ async function launchHostSupervisor(options = {}) {
   }
   const recoverPriorOwnership = async () => {
     if (!ownsWorkerBoundary) return true;
-    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS; attempt++) {
+    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
       try {
         const generations = await readLauncherOwnershipGenerations(ownershipRoot);
         for (const generation of generations) {
           await cleanupOwnershipGeneration(generation.directory);
         }
+        await terminateRecordedRunProcesses(runRegistryRoot2, terminateRecordedOwnership);
         return true;
       } catch (error52) {
-        const finalAttempt = attempt === CLEANUP_ATTEMPTS;
+        const finalAttempt = attempt === CLEANUP_ATTEMPTS2;
         log2(
           `Zixt Host launcher: prior worker cleanup is incomplete (${error52 instanceof Error ? error52.message : "unknown error"}); ${finalAttempt ? "exiting for service-manager recovery" : "retrying"}`
         );
@@ -25574,10 +26291,10 @@ async function superviseHost(options = {}) {
   const log2 = options.log ?? ((message) => console.error(message));
   const signalWorker = options.signalWorker ?? signalWorkerGroup;
   const inheritedOwnershipDirectory = process.env[LAUNCHER_OWNERSHIP_DIR_ENV];
-  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute7(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
+  const launcherOwnershipDirectory = productionLifecycle && typeof inheritedOwnershipDirectory === "string" && isAbsolute8(inheritedOwnershipDirectory) ? inheritedOwnershipDirectory : null;
   if (productionLifecycle && isSupervisorRole() && launcherOwnershipDirectory) {
     const generationNonce = basename3(launcherOwnershipDirectory);
-    const expectedOwnershipFile = join6(launcherOwnershipDirectory, `${generationNonce}.json`);
+    const expectedOwnershipFile = join7(launcherOwnershipDirectory, `${generationNonce}.json`);
     const configuredOwnershipFile = process.env[SUPERVISOR_OWNERSHIP_FILE_ENV];
     if (process.argv0 !== generationNonce || configuredOwnershipFile !== expectedOwnershipFile || !recordWorkerOwnership(expectedOwnershipFile, generationNonce)) {
       log2("Zixt Host: supervisor ownership could not be committed; refusing to start a worker");
@@ -25675,7 +26392,7 @@ async function superviseHost(options = {}) {
     return waitOrShutdown(backoff);
   };
   const cleanupExitedWorker = async (exitedChild, childExited, workerBoundary, containment) => {
-    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS; attempt++) {
+    for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
       try {
         if (containment) await containment.terminate();
         else if (cleanupWorker) await cleanupWorker(exitedChild, childExited);
@@ -25694,7 +26411,7 @@ async function superviseHost(options = {}) {
         }
         return true;
       } catch (error52) {
-        const finalAttempt = attempt === CLEANUP_ATTEMPTS;
+        const finalAttempt = attempt === CLEANUP_ATTEMPTS2;
         log2(
           finalAttempt ? `Zixt Host: exited worker cleanup could not be confirmed (${error52 instanceof Error ? error52.message : "unknown error"}); handing recovery to the stable launcher` : "Zixt Host: exited worker cleanup could not be confirmed; retrying"
         );
@@ -26104,9 +26821,9 @@ import { homedir as homedir12, hostname as hostname3 } from "node:os";
 // src/hardware.ts
 import { existsSync } from "node:fs";
 import { statfs } from "node:fs/promises";
-import { cpus, freemem, homedir as homedir2, totalmem } from "node:os";
-import { dirname as dirname4, resolve as resolve5 } from "node:path";
-async function machineHardware(workRoot = homedir2()) {
+import { cpus, freemem, homedir as homedir3, totalmem } from "node:os";
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
+async function machineHardware(workRoot = homedir3()) {
   return {
     // A container or cgroup can hide processors from this count; it is what
     // this process can see, which is what its Tasks will actually get.
@@ -26131,10 +26848,10 @@ async function diskSpace(workRoot) {
   }
 }
 function nearestExistingPath(start) {
-  let candidate = resolve5(start);
+  let candidate = resolve6(start);
   for (let depth = 0; depth < 16; depth++) {
     if (existsSync(candidate)) return candidate;
-    const parent = dirname4(candidate);
+    const parent = dirname5(candidate);
     if (parent === candidate) return null;
     candidate = parent;
   }
@@ -26328,17 +27045,17 @@ function createDemoBrowserAdapterFactory() {
 }
 
 // src/browser/manager.ts
-import { lstat as lstat5, mkdir as mkdir4, open as open4, opendir, readFile as readFile6, rename as rename3, rm as rm4 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname5, join as join7, resolve as resolve6 } from "node:path";
-var SAFE_SEGMENT = /^[A-Za-z0-9_-]{1,200}$/;
+import { lstat as lstat6, mkdir as mkdir5, open as open5, opendir, readFile as readFile7, rename as rename4, rm as rm5 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname6, join as join8, resolve as resolve7 } from "node:path";
+var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
 var FRAME_MIN_INTERVAL_MS = 100;
 var IDLE_TIMEOUT_MS = 15 * 6e4;
 var BrowserManager = class {
   constructor(opts) {
     this.opts = opts;
-    this.profileRoot = opts.profileRoot ?? join7(homedir3(), ".zixt", "browser-profiles");
-    this.profileStateRoot = join7(this.profileRoot, ".profile-state");
+    this.profileRoot = opts.profileRoot ?? join8(homedir4(), ".zixt", "browser-profiles");
+    this.profileStateRoot = join8(this.profileRoot, ".profile-state");
     this.viewport = opts.viewport ?? BROWSER_DEFAULT_VIEWPORT;
     this.idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
     this.frameMinIntervalMs = opts.frameMinIntervalMs ?? FRAME_MIN_INTERVAL_MS;
@@ -26423,21 +27140,21 @@ var BrowserManager = class {
     return next;
   }
   validateAgentId(agentId) {
-    if (!SAFE_SEGMENT.test(agentId) || !AgentId.safeParse(agentId).success) {
+    if (!SAFE_SEGMENT2.test(agentId) || !AgentId.safeParse(agentId).success) {
       throw new Error("invalid agent id for a browser profile path");
     }
   }
   exactChild(root, child) {
-    const canonicalRoot = resolve6(root);
-    const target = resolve6(canonicalRoot, child);
-    if (dirname5(target) !== canonicalRoot) {
+    const canonicalRoot = resolve7(root);
+    const target = resolve7(canonicalRoot, child);
+    if (dirname6(target) !== canonicalRoot) {
       throw new Error("browser profile path escaped its owned root");
     }
     return target;
   }
   async ensureOwnedDirectory(path) {
-    await mkdir4(path, { recursive: true, mode: 448 });
-    const stat3 = await lstat5(path);
+    await mkdir5(path, { recursive: true, mode: 448 });
+    const stat3 = await lstat6(path);
     if (!stat3.isDirectory() || stat3.isSymbolicLink()) {
       throw new Error("browser profile root must be an owned directory, not a symbolic link");
     }
@@ -26450,7 +27167,7 @@ var BrowserManager = class {
    */
   async syncDirectory(path) {
     try {
-      const directory = await open4(path, "r");
+      const directory = await open5(path, "r");
       try {
         await directory.sync();
       } finally {
@@ -26472,7 +27189,7 @@ var BrowserManager = class {
   }
   async readProfileState(agentId) {
     try {
-      const raw = JSON.parse(await readFile6(this.statePath(agentId), "utf8"));
+      const raw = JSON.parse(await readFile7(this.statePath(agentId), "utf8"));
       if (typeof raw !== "object" || raw === null || !Number.isInteger(raw.revision) || Number(raw.revision) < 0 || !["allowed", "purged"].includes(String(raw.state))) {
         throw new Error("browser profile lifecycle marker is invalid");
       }
@@ -26491,18 +27208,18 @@ var BrowserManager = class {
       `${agentId}.${crypto.randomUUID()}.tmp`
     );
     try {
-      const marker = await open4(temporary, "wx+", 384);
+      const marker = await open5(temporary, "wx+", 384);
       try {
         await marker.writeFile(JSON.stringify(state), "utf8");
         await marker.sync();
       } finally {
         await marker.close();
       }
-      await rename3(temporary, destination);
+      await rename4(temporary, destination);
       await this.syncDirectory(this.profileStateRoot);
       await this.syncDirectory(this.profileRoot);
     } catch (error52) {
-      await rm4(temporary, { force: true }).catch(() => {
+      await rm5(temporary, { force: true }).catch(() => {
       });
       throw error52;
     }
@@ -26571,14 +27288,14 @@ var BrowserManager = class {
       await this.ensureOwnedDirectory(this.profileRoot);
       const profileDir = this.profilePath(agentId);
       try {
-        const existingProfile = await lstat5(profileDir);
+        const existingProfile = await lstat6(profileDir);
         if (existingProfile.isSymbolicLink() || !existingProfile.isDirectory()) {
           throw new Error("browser profile path is not an owned directory");
         }
       } catch (error52) {
         if (error52.code !== "ENOENT") throw error52;
       }
-      await mkdir4(profileDir, { recursive: true, mode: 448 });
+      await mkdir5(profileDir, { recursive: true, mode: 448 });
       const adapter = await this.opts.factory.open({
         agentId,
         profileDir,
@@ -26657,7 +27374,7 @@ var BrowserManager = class {
         purgeId
       });
       await this.closeLocked(agentId, "stopped");
-      await rm4(this.profilePath(agentId), { recursive: true, force: true, maxRetries: 3 });
+      await rm5(this.profilePath(agentId), { recursive: true, force: true, maxRetries: 3 });
       await this.syncDirectory(this.profileRoot);
     });
   }
@@ -26844,6 +27561,16 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
       const playwright = await load();
       const context = await playwright.chromium.launchPersistentContext(profileDir, {
         headless: true,
+        // Without a channel, Playwright resolves `headless: true` to its
+        // `chromium_headless_shell` build — a stripped binary missing pieces
+        // a browser is expected to have (no `window.chrome`, no plugins, a
+        // single-entry `navigator.languages`). Google Accounts reads that
+        // shape as "this browser or app may not be secure" and refuses the
+        // sign-in outright, which made every site behind a Google login a
+        // dead end for the person watching the panel. `chromium` selects the
+        // full browser this adapter's capability probe already checks for
+        // (`executablePath()` resolves to it), so the two now agree.
+        channel: "chromium",
         viewport,
         // Headless Chromium announces itself in two ways that bot protection
         // reads as "not a person": `HeadlessChrome` in the user agent, and
@@ -30063,18 +30790,18 @@ function createGithubPushOrchestrator(input) {
 }
 
 // src/tool-packs/github/git-bridge.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { chmod as chmod3, lstat as lstat7, mkdir as mkdir5, realpath as realpath4, rm as rm5 } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute9, join as join9, relative as relative5 } from "node:path";
+import { chmod as chmod4, lstat as lstat8, mkdir as mkdir6, realpath as realpath5, rm as rm6 } from "node:fs/promises";
+import { dirname as dirname7, isAbsolute as isAbsolute10, join as join10, relative as relative6 } from "node:path";
 
 // src/tool-packs/github/git-credential-broker.ts
 import { createServer } from "node:http";
 import { randomBytes, randomUUID as randomUUID6, timingSafeEqual } from "node:crypto";
-import { chmod as chmod2, lstat as lstat6, realpath as realpath3, writeFile } from "node:fs/promises";
-import { isAbsolute as isAbsolute8, join as join8, relative as relative4 } from "node:path";
+import { chmod as chmod3, lstat as lstat7, realpath as realpath4, writeFile as writeFile2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute9, join as join9, relative as relative5 } from "node:path";
 var MAX_REQUEST_BYTES = 16 * 1024;
-var FILE_MODE = 384;
+var FILE_MODE2 = 384;
 var HELPER_SOURCE = String.raw`'use strict';
 const http = require('node:http');
 
@@ -30185,8 +30912,8 @@ async function readBoundedBody2(request) {
   return Buffer.concat(chunks, size);
 }
 function assertChildPath(parent, child) {
-  const path = relative4(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute8(path)) {
+  const path = relative5(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute9(path)) {
     throw new Error("Git credential helper path escaped its private run directory");
   }
 }
@@ -30196,15 +30923,15 @@ async function createGithubGitCredentialBroker(input) {
     throw new Error("GitHub credential authority has expired");
   }
   assertRepositoryFullName(input.repositoryFullName);
-  const rootEntry = await lstat6(input.runArtifactsRoot);
+  const rootEntry = await lstat7(input.runArtifactsRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("Git credential broker requires a private real run directory");
   }
-  const runRoot = await realpath3(input.runArtifactsRoot);
-  const helperPath = join8(runRoot, `git-credential-${randomUUID6()}.cjs`);
+  const runRoot = await realpath4(input.runArtifactsRoot);
+  const helperPath = join9(runRoot, `git-credential-${randomUUID6()}.cjs`);
   assertChildPath(runRoot, helperPath);
-  await writeFile(helperPath, HELPER_SOURCE, { flag: "wx", mode: FILE_MODE });
-  await chmod2(helperPath, FILE_MODE);
+  await writeFile2(helperPath, HELPER_SOURCE, { flag: "wx", mode: FILE_MODE2 });
+  await chmod3(helperPath, FILE_MODE2);
   const capability2 = randomBytes(32).toString("base64url");
   const expectedPath = `${input.repositoryFullName}.git`;
   let closed = false;
@@ -30275,7 +31002,7 @@ password=${input.accessToken}
 }
 
 // src/tool-packs/github/git-bridge.ts
-var DIRECTORY_MODE = 448;
+var DIRECTORY_MODE2 = 448;
 var MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 var DEFAULT_TIMEOUT_MS2 = 12e4;
 var SHA = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/;
@@ -30299,27 +31026,27 @@ ${stderr}`;
   );
   return explicitGithubRefusal ? "provider_rejected" : "command_failed";
 }
-function assertBelow(parent, child, label) {
-  const path = relative5(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute9(path)) {
+function assertBelow2(parent, child, label) {
+  const path = relative6(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute10(path)) {
     throw new GithubGitProcessError("invalid_input");
   }
   void label;
 }
-async function requireRealDirectory(path, label) {
-  const entry = await lstat7(path).catch(() => null);
+async function requireRealDirectory2(path, label) {
+  const entry = await lstat8(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     void label;
     throw new GithubGitProcessError("invalid_input");
   }
-  return realpath4(path);
+  return realpath5(path);
 }
 async function validateTokenlessPaths(command) {
   if (command.kind === "clone-from-bridge") {
-    if (!isAbsolute9(command.destination)) throw new GithubGitProcessError("invalid_input");
-    const parent = await requireRealDirectory(dirname6(command.destination), "clone parent");
-    assertBelow(parent, command.destination, "clone destination");
-    const destination = await lstat7(command.destination).catch((error52) => {
+    if (!isAbsolute10(command.destination)) throw new GithubGitProcessError("invalid_input");
+    const parent = await requireRealDirectory2(dirname7(command.destination), "clone parent");
+    assertBelow2(parent, command.destination, "clone destination");
+    const destination = await lstat8(command.destination).catch((error52) => {
       if (error52.code === "ENOENT") return null;
       throw error52;
     });
@@ -30327,8 +31054,8 @@ async function validateTokenlessPaths(command) {
     return;
   }
   if ("repositoryPath" in command) {
-    if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
-    const repositoryPath5 = await requireRealDirectory(command.repositoryPath, "repository path");
+    if (!isAbsolute10(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+    const repositoryPath5 = await requireRealDirectory2(command.repositoryPath, "repository path");
     if (repositoryPath5 !== command.repositoryPath) throw new GithubGitProcessError("invalid_input");
   }
 }
@@ -30407,13 +31134,13 @@ async function runGit(input, args, env) {
   if (input.authoritySignal.aborted || input.cancelledNow()) {
     throw new GithubGitProcessError("cancelled");
   }
-  if (!isAbsolute9(input.executablePath)) throw new GithubGitProcessError("invalid_input");
+  if (!isAbsolute10(input.executablePath)) throw new GithubGitProcessError("invalid_input");
   const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS2) {
     throw new GithubGitProcessError("invalid_input");
   }
   return new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn5(input.executablePath, [...input.commandPrefixArgs ?? [], ...args], {
+    const child = spawn6(input.executablePath, [...input.commandPrefixArgs ?? [], ...args], {
       cwd: input.trustedCwd,
       env,
       shell: false,
@@ -30513,7 +31240,7 @@ function tokenlessArgs(command) {
   switch (command.kind) {
     case "clone-from-bridge":
       assertRef(command.branch);
-      if (!isAbsolute9(command.destination)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute10(command.destination)) throw new GithubGitProcessError("invalid_input");
       return [
         "clone",
         "--no-recurse-submodules",
@@ -30525,7 +31252,7 @@ function tokenlessArgs(command) {
       ];
     case "fetch-from-bridge":
       assertFetchRefspecs(command.refspecs);
-      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute10(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -30537,7 +31264,7 @@ function tokenlessArgs(command) {
         ...command.refspecs
       ];
     case "copy-commit-to-bridge":
-      if (!isAbsolute9(command.repositoryPath) || !SHA.test(command.sha)) {
+      if (!isAbsolute10(command.repositoryPath) || !SHA.test(command.sha)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -30549,11 +31276,11 @@ function tokenlessArgs(command) {
         `${command.sha}:refs/zixt/push-source`
       ];
     case "rev-parse":
-      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute10(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       assertRef(command.ref);
       return ["-C", command.repositoryPath, "rev-parse", "--verify", `${command.ref}^{commit}`];
     case "remote-configure":
-      if (!isAbsolute9(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
+      if (!isAbsolute10(command.repositoryPath) || !REPOSITORY.test(command.repositoryFullName)) {
         throw new GithubGitProcessError("invalid_input");
       }
       return [
@@ -30565,7 +31292,7 @@ function tokenlessArgs(command) {
         `https://github.com/${command.repositoryFullName}.git`
       ];
     case "status":
-      if (!isAbsolute9(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
+      if (!isAbsolute10(command.repositoryPath)) throw new GithubGitProcessError("invalid_input");
       return [
         "-C",
         command.repositoryPath,
@@ -30583,21 +31310,21 @@ function createGithubGitBridge(input) {
   let closed = false;
   let rootsPromise;
   const roots = () => rootsPromise ??= (async () => {
-    const trustedCwd = await requireRealDirectory(input.trustedCwd, "trusted cwd");
-    const runRoot = await requireRealDirectory(input.artifacts.runRoot, "run root");
-    const bridges = await requireRealDirectory(
+    const trustedCwd = await requireRealDirectory2(input.trustedCwd, "trusted cwd");
+    const runRoot = await requireRealDirectory2(input.artifacts.runRoot, "run root");
+    const bridges = await requireRealDirectory2(
       input.artifacts.gitBridgesDirectory,
       "git bridge root"
     );
-    assertBelow(runRoot, bridges, "git bridge root");
+    assertBelow2(runRoot, bridges, "git bridge root");
     if (trustedCwd !== runRoot) throw new GithubGitProcessError("invalid_input");
     return { trustedCwd, runRoot, bridges };
   })();
   const requireBridge = async (value) => {
     const current = await roots();
-    if (!isAbsolute9(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
-    const real = await requireRealDirectory(value, "git bridge");
-    assertBelow(current.bridges, real, "git bridge");
+    if (!isAbsolute10(value) || !active.has(value)) throw new GithubGitProcessError("invalid_input");
+    const real = await requireRealDirectory2(value, "git bridge");
+    assertBelow2(current.bridges, real, "git bridge");
     if (real !== value) throw new GithubGitProcessError("invalid_input");
     return real;
   };
@@ -30605,10 +31332,10 @@ function createGithubGitBridge(input) {
     async createPrivateBridge() {
       if (closed) throw new GithubGitProcessError("cancelled");
       const current = await roots();
-      const path = join9(current.bridges, `${randomUUID7()}.git`);
-      assertBelow(current.bridges, path, "git bridge");
-      await mkdir5(path, { mode: DIRECTORY_MODE });
-      await chmod3(path, DIRECTORY_MODE);
+      const path = join10(current.bridges, `${randomUUID7()}.git`);
+      assertBelow2(current.bridges, path, "git bridge");
+      await mkdir6(path, { mode: DIRECTORY_MODE2 });
+      await chmod4(path, DIRECTORY_MODE2);
       try {
         await runGit(
           { ...input, trustedCwd: current.trustedCwd },
@@ -30621,18 +31348,18 @@ function createGithubGitBridge(input) {
           ],
           minimalEnvironment(input.artifacts)
         );
-        const real = await requireRealDirectory(path, "git bridge");
-        assertBelow(current.bridges, real, "git bridge");
-        const hooks = join9(real, "hooks");
-        await rm5(hooks, { recursive: true, force: true });
-        await mkdir5(hooks, { mode: DIRECTORY_MODE });
-        await chmod3(hooks, DIRECTORY_MODE);
-        const config2 = join9(real, "config");
-        await chmod3(config2, 384);
+        const real = await requireRealDirectory2(path, "git bridge");
+        assertBelow2(current.bridges, real, "git bridge");
+        const hooks = join10(real, "hooks");
+        await rm6(hooks, { recursive: true, force: true });
+        await mkdir6(hooks, { mode: DIRECTORY_MODE2 });
+        await chmod4(hooks, DIRECTORY_MODE2);
+        const config2 = join10(real, "config");
+        await chmod4(config2, 384);
         active.add(real);
         return real;
       } catch (error52) {
-        await rm5(path, { recursive: true, force: true }).catch(() => {
+        await rm6(path, { recursive: true, force: true }).catch(() => {
         });
         throw error52;
       }
@@ -30726,7 +31453,7 @@ function createGithubGitBridge(input) {
     },
     async destroyPrivateBridge(path) {
       const bridge = await requireBridge(path);
-      await rm5(bridge, { recursive: true, force: true });
+      await rm6(bridge, { recursive: true, force: true });
       active.delete(bridge);
       credentialed2.delete(bridge);
     },
@@ -30734,7 +31461,7 @@ function createGithubGitBridge(input) {
       if (closed) return;
       closed = true;
       const paths = [...active];
-      await Promise.all(paths.map((path) => rm5(path, { recursive: true, force: true })));
+      await Promise.all(paths.map((path) => rm6(path, { recursive: true, force: true })));
       active.clear();
       credentialed2.clear();
     }
@@ -31075,12 +31802,12 @@ function createRepositoryTools(runtime) {
 
 // src/tool-packs/github/workspace.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat8, mkdir as mkdir6, readFile as readFile7, realpath as realpath5, rename as rename4, rm as rm6, writeFile as writeFile2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute10, join as join10, relative as relative6, resolve as resolve7 } from "node:path";
+import { chmod as chmod5, lstat as lstat9, mkdir as mkdir7, readFile as readFile8, realpath as realpath6, rename as rename5, rm as rm7, writeFile as writeFile3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute11, join as join11, relative as relative7, resolve as resolve8 } from "node:path";
 var SAFE_LOCAL_ID = /^[A-Za-z0-9_-]{1,200}$/;
 var FULL_NAME2 = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
-var DIRECTORY_MODE2 = 448;
-var FILE_MODE2 = 384;
+var DIRECTORY_MODE3 = 448;
+var FILE_MODE3 = 384;
 var METADATA_VERSION = 1;
 var workspaceLocks = /* @__PURE__ */ new Map();
 function assertSafeLocalId(value, label) {
@@ -31092,37 +31819,37 @@ function hasControlCharacter2(value) {
     return codePoint <= 31 || codePoint === 127;
   });
 }
-function assertBelow2(parent, child, label) {
-  const path = relative6(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute10(path)) {
+function assertBelow3(parent, child, label) {
+  const path = relative7(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute11(path)) {
     throw new Error(`${label} escaped the task workspace`);
   }
 }
 function samePath(left, right) {
-  return process.platform === "win32" ? resolve7(left).toLowerCase() === resolve7(right).toLowerCase() : resolve7(left) === resolve7(right);
+  return process.platform === "win32" ? resolve8(left).toLowerCase() === resolve8(right).toLowerCase() : resolve8(left) === resolve8(right);
 }
-async function requireRealDirectory2(path, label) {
-  const entry = await lstat8(path).catch(() => null);
+async function requireRealDirectory3(path, label) {
+  const entry = await lstat9(path).catch(() => null);
   if (!entry || !entry.isDirectory() || entry.isSymbolicLink()) {
     throw new Error(`${label} must be a real directory, not a symbolic link or junction`);
   }
-  const real = await realpath5(path);
+  const real = await realpath6(path);
   if (!samePath(real, path)) {
     throw new Error(`${label} must not traverse a symbolic link or junction`);
   }
   return real;
 }
 async function createOrRequirePrivateDirectory(parent, name, label) {
-  const path = join10(parent, name);
-  assertBelow2(parent, path, label);
+  const path = join11(parent, name);
+  assertBelow3(parent, path, label);
   try {
-    await mkdir6(path, { mode: DIRECTORY_MODE2 });
+    await mkdir7(path, { mode: DIRECTORY_MODE3 });
   } catch (error52) {
     if (error52.code !== "EEXIST") throw error52;
   }
-  const real = await requireRealDirectory2(path, label);
-  assertBelow2(parent, real, label);
-  await chmod4(real, DIRECTORY_MODE2);
+  const real = await requireRealDirectory3(path, label);
+  assertBelow3(parent, real, label);
+  await chmod5(real, DIRECTORY_MODE3);
   return real;
 }
 function parseMetadata(text) {
@@ -31139,7 +31866,7 @@ function parseMetadata(text) {
 }
 async function pathExists(path) {
   try {
-    await lstat8(path);
+    await lstat9(path);
     return true;
   } catch (error52) {
     if (error52.code === "ENOENT") return false;
@@ -31166,7 +31893,7 @@ async function createGithubWorkspaceService(input) {
   const grant = validateGithubTaskGrant(input.grant);
   assertSafeLocalId(input.context.agentId, "agent ID");
   assertSafeLocalId(input.context.taskId, "task ID");
-  const taskRoot = await requireRealDirectory2(input.context.taskRoot, "task workspace");
+  const taskRoot = await requireRealDirectory3(input.context.taskRoot, "task workspace");
   const repositoriesRoot = await createOrRequirePrivateDirectory(
     taskRoot,
     "repositories",
@@ -31196,33 +31923,33 @@ async function createGithubWorkspaceService(input) {
     if (expectedFullName !== void 0 && repository.fullName !== expectedFullName) {
       throw new Error("GitHub repository name does not match this task grant");
     }
-    const destination = join10(repositoriesRoot, parsed.data);
-    const metadataPath = join10(metadataRoot, `${parsed.data}.json`);
+    const destination = join11(repositoriesRoot, parsed.data);
+    const metadataPath = join11(metadataRoot, `${parsed.data}.json`);
     if (!await pathExists(destination) || !await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace has not been prepared");
     }
-    const metadataEntry = await lstat8(metadataPath);
+    const metadataEntry = await lstat9(metadataPath);
     if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
       throw new Error("GitHub workspace metadata is invalid");
     }
-    const metadata = parseMetadata(await readFile7(metadataPath, "utf8"));
+    const metadata = parseMetadata(await readFile8(metadataPath, "utf8"));
     if (metadata.repositoryId !== parsed.data || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
       throw new Error("GitHub workspace metadata does not match this repository");
     }
-    const real = await requireRealDirectory2(destination, "GitHub repository");
-    assertBelow2(repositoriesRoot, real, "repository path");
+    const real = await requireRealDirectory3(destination, "GitHub repository");
+    assertBelow3(repositoriesRoot, real, "repository path");
     return real;
   };
   const cloneRepository = async (clone2) => {
-    const destination = join10(repositoriesRoot, clone2.repositoryId);
-    const metadataPath = join10(metadataRoot, `${clone2.repositoryId}.json`);
-    assertBelow2(repositoriesRoot, destination, "repository path");
-    assertBelow2(metadataRoot, metadataPath, "repository metadata");
+    const destination = join11(repositoriesRoot, clone2.repositoryId);
+    const metadataPath = join11(metadataRoot, `${clone2.repositoryId}.json`);
+    assertBelow3(repositoriesRoot, destination, "repository path");
+    assertBelow3(metadataRoot, metadataPath, "repository metadata");
     if (await pathExists(destination) || await pathExists(metadataPath)) {
       throw new Error("GitHub repository workspace already exists or is inconsistent");
     }
-    const temporary = join10(repositoriesRoot, `.clone-${randomUUID8()}`);
-    assertBelow2(repositoriesRoot, temporary, "temporary clone");
+    const temporary = join11(repositoriesRoot, `.clone-${randomUUID8()}`);
+    assertBelow3(repositoriesRoot, temporary, "temporary clone");
     try {
       await input.git.clone({
         accessToken: clone2.accessToken,
@@ -31231,8 +31958,8 @@ async function createGithubWorkspaceService(input) {
         destination: temporary,
         branch: clone2.defaultBranch
       });
-      const temporaryReal = await requireRealDirectory2(temporary, "temporary GitHub clone");
-      assertBelow2(repositoriesRoot, temporaryReal, "temporary clone");
+      const temporaryReal = await requireRealDirectory3(temporary, "temporary GitHub clone");
+      assertBelow3(repositoriesRoot, temporaryReal, "temporary clone");
       await input.git.configureOrigin({
         repositoryPath: temporaryReal,
         repositoryFullName: clone2.fullName
@@ -31246,27 +31973,27 @@ async function createGithubWorkspaceService(input) {
         path: destination,
         ...clone2.createIntentId === void 0 ? {} : { createIntentId: clone2.createIntentId }
       };
-      const metadataTemporary = join10(metadataRoot, `.${clone2.repositoryId}-${randomUUID8()}.tmp`);
-      assertBelow2(metadataRoot, metadataTemporary, "temporary repository metadata");
-      await writeFile2(metadataTemporary, `${JSON.stringify(metadata)}
+      const metadataTemporary = join11(metadataRoot, `.${clone2.repositoryId}-${randomUUID8()}.tmp`);
+      assertBelow3(metadataRoot, metadataTemporary, "temporary repository metadata");
+      await writeFile3(metadataTemporary, `${JSON.stringify(metadata)}
 `, {
         flag: "wx",
-        mode: FILE_MODE2
+        mode: FILE_MODE3
       });
-      await chmod4(metadataTemporary, FILE_MODE2);
+      await chmod5(metadataTemporary, FILE_MODE3);
       try {
-        await rename4(temporaryReal, destination);
+        await rename5(temporaryReal, destination);
         try {
-          await rename4(metadataTemporary, metadataPath);
+          await rename5(metadataTemporary, metadataPath);
         } catch (error52) {
-          await rm6(destination, { recursive: true, force: true });
+          await rm7(destination, { recursive: true, force: true });
           throw error52;
         }
       } finally {
-        await rm6(metadataTemporary, { force: true }).catch(() => {
+        await rm7(metadataTemporary, { force: true }).catch(() => {
         });
       }
-      const path = await requireRealDirectory2(destination, "GitHub repository");
+      const path = await requireRealDirectory3(destination, "GitHub repository");
       return {
         provider: "github",
         repositoryId: clone2.repositoryId,
@@ -31275,16 +32002,16 @@ async function createGithubWorkspaceService(input) {
         headSha
       };
     } finally {
-      await rm6(temporary, { recursive: true, force: true }).catch(() => {
+      await rm7(temporary, { recursive: true, force: true }).catch(() => {
       });
     }
   };
   const prepareRepository = async (authority) => {
     const { repository } = authority;
-    const destination = join10(repositoriesRoot, repository.repositoryId);
-    const metadataPath = join10(metadataRoot, `${repository.repositoryId}.json`);
-    assertBelow2(repositoriesRoot, destination, "repository path");
-    assertBelow2(metadataRoot, metadataPath, "repository metadata");
+    const destination = join11(repositoriesRoot, repository.repositoryId);
+    const metadataPath = join11(metadataRoot, `${repository.repositoryId}.json`);
+    assertBelow3(repositoriesRoot, destination, "repository path");
+    assertBelow3(metadataRoot, metadataPath, "repository metadata");
     return withWorkspaceLock(destination, async () => {
       const destinationExists = await pathExists(destination);
       const metadataExists = await pathExists(metadataPath);
@@ -31303,16 +32030,16 @@ async function createGithubWorkspaceService(input) {
           expiresAt: authority.expiresAt
         });
       }
-      const metadataEntry = await lstat8(metadataPath);
+      const metadataEntry = await lstat9(metadataPath);
       if (!metadataEntry.isFile() || metadataEntry.isSymbolicLink()) {
         throw new Error("GitHub workspace metadata is invalid");
       }
-      const metadata = parseMetadata(await readFile7(metadataPath, "utf8"));
+      const metadata = parseMetadata(await readFile8(metadataPath, "utf8"));
       if (metadata.repositoryId !== repository.repositoryId || metadata.fullName !== repository.fullName || !samePath(metadata.path, destination)) {
         throw new Error("GitHub workspace metadata does not match this repository");
       }
-      const repositoryPath6 = await requireRealDirectory2(destination, "GitHub repository");
-      assertBelow2(repositoriesRoot, repositoryPath6, "repository path");
+      const repositoryPath6 = await requireRealDirectory3(destination, "GitHub repository");
+      assertBelow3(repositoriesRoot, repositoryPath6, "repository path");
       if (!authority.operations.includes("repository.fetch")) {
         throw new Error("GitHub authority cannot refresh this repository");
       }
@@ -31447,7 +32174,7 @@ async function createGithubWorkspaceService(input) {
         throw new Error("GitHub created repository is outside this installation");
       }
       parseGitRef(cloneInput.repository.defaultBranch, "default branch");
-      return withWorkspaceLock(join10(repositoriesRoot, repositoryId2), async () => {
+      return withWorkspaceLock(join11(repositoriesRoot, repositoryId2), async () => {
         const prepared = await cloneRepository({
           repositoryId: repositoryId2,
           fullName: cloneInput.repository.fullName,
@@ -32988,8 +33715,8 @@ function createDefaultToolPackRegistry() {
 }
 
 // src/runners/attachments.ts
-import { mkdir as mkdir7, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { mkdir as mkdir8, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
 function sanitizeAttachmentFileName(name) {
   const base = name.split(/[/\\]/).pop() ?? "";
@@ -33018,10 +33745,10 @@ async function materializeAttachments(task, taskRoot) {
         `attached file "${attachment.name}" arrived incomplete (${bytes.byteLength} of ${attachment.size} bytes)`
       );
     }
-    const directory = join11(taskRoot, ".zixt-attachments", task.taskId, attachment.id);
-    await mkdir7(directory, { recursive: true });
-    const path = join11(directory, sanitizeAttachmentFileName(attachment.name));
-    await writeFile3(path, bytes);
+    const directory = join12(taskRoot, ".zixt-attachments", task.taskId, attachment.id);
+    await mkdir8(directory, { recursive: true });
+    const path = join12(directory, sanitizeAttachmentFileName(attachment.name));
+    await writeFile4(path, bytes);
     materialized.push({
       path,
       name: attachment.name,
@@ -33985,7 +34712,7 @@ function createAskUserServer() {
 }
 
 // src/runners/runner-env.ts
-import { delimiter as delimiter2, isAbsolute as isAbsolute11 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute12 } from "node:path";
 var PROVIDER_AUTHORITY_PREFIXES = ["GH_", "GITHUB_", "GIT_", "SSH_"];
 var HOST_AUTHORITY_PREFIXES = [
   "ZIXT_",
@@ -34044,7 +34771,7 @@ function inheritedValue(env, name) {
 }
 function sanitizeInheritedSearchPath(path) {
   if (!path) return "";
-  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute11(entry)).join(delimiter2);
+  return path.split(delimiter2).filter((entry) => entry !== "" && isAbsolute12(entry)).join(delimiter2);
 }
 function buildRunnerEnv(input) {
   const env = {};
@@ -34125,11 +34852,11 @@ function buildRunnerEnv(input) {
 // src/runners/github-shell-auth.ts
 import { execFile } from "node:child_process";
 import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat9, mkdir as mkdir8, realpath as realpath6, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod as chmod6, lstat as lstat10, mkdir as mkdir9, realpath as realpath7, writeFile as writeFile5 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { isAbsolute as isAbsolute12, join as join12, relative as relative7 } from "node:path";
+import { isAbsolute as isAbsolute13, join as join13, relative as relative8 } from "node:path";
 var MAX_REQUEST_BYTES2 = 16 * 1024;
-var DIRECTORY_MODE3 = 448;
+var DIRECTORY_MODE4 = 448;
 var PRIVATE_FILE_MODE = 384;
 var EXECUTABLE_FILE_MODE = 448;
 var GIT_HELPER_SOURCE = String.raw`'use strict';
@@ -34333,7 +35060,7 @@ function parseGhInvocation(body) {
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const { args, cwd } = value;
-  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute12(cwd)) {
+  if (!Array.isArray(args) || args.length > 256 || args.some((argument) => typeof argument !== "string" || argument.length > 4096) || typeof cwd !== "string" || cwd.length === 0 || cwd.length > 4096 || !isAbsolute13(cwd)) {
     return null;
   }
   return { args, cwd };
@@ -34491,8 +35218,8 @@ function activationCredential(grant, now = Date.now()) {
   return expiresAt.getTime() <= now ? null : { accessToken: grant.accessToken, expiresAt };
 }
 function assertChildPath2(parent, child) {
-  const path = relative7(parent, child);
-  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute12(path)) {
+  const path = relative8(parent, child);
+  if (!path || path === ".." || path.startsWith("../") || path.startsWith("..\\") || isAbsolute13(path)) {
     throw new Error("GitHub shell helper path escaped its private run directory");
   }
 }
@@ -34503,19 +35230,19 @@ function quoteForPosixShell(value) {
   return quoteForGitShell2(value);
 }
 async function writePrivate(path, content, executable = false) {
-  await writeFile4(path, content, {
+  await writeFile5(path, content, {
     flag: "wx",
     mode: executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE
   });
-  await chmod5(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
+  await chmod6(path, executable ? EXECUTABLE_FILE_MODE : PRIVATE_FILE_MODE);
 }
 async function prepareHelpers(input) {
-  const rootEntry = await lstat9(input.runRoot);
+  const rootEntry = await lstat10(input.runRoot);
   if (!rootEntry.isDirectory() || rootEntry.isSymbolicLink()) {
     throw new Error("GitHub shell authentication requires a private real run directory");
   }
-  const runRoot = await realpath6(input.runRoot);
-  const helperPath = join12(runRoot, "github-shell-git-credential.cjs");
+  const runRoot = await realpath7(input.runRoot);
+  const helperPath = join13(runRoot, "github-shell-git-credential.cjs");
   assertChildPath2(runRoot, helperPath);
   await writePrivate(helperPath, GIT_HELPER_SOURCE);
   if (!input.ghExecutablePath) {
@@ -34526,14 +35253,14 @@ async function prepareHelpers(input) {
       wrapperSourcePath: null
     };
   }
-  const shellToolsDirectory = join12(runRoot, "shell-tools");
+  const shellToolsDirectory = join13(runRoot, "shell-tools");
   assertChildPath2(runRoot, shellToolsDirectory);
-  await mkdir8(shellToolsDirectory, { mode: DIRECTORY_MODE3 });
-  await chmod5(shellToolsDirectory, DIRECTORY_MODE3);
-  const wrapperSourcePath = join12(runRoot, "github-shell-gh-wrapper.cjs");
+  await mkdir9(shellToolsDirectory, { mode: DIRECTORY_MODE4 });
+  await chmod6(shellToolsDirectory, DIRECTORY_MODE4);
+  const wrapperSourcePath = join13(runRoot, "github-shell-gh-wrapper.cjs");
   assertChildPath2(runRoot, wrapperSourcePath);
   await writePrivate(wrapperSourcePath, GH_WRAPPER_SOURCE);
-  const wrapperPath = join12(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
+  const wrapperPath = join13(shellToolsDirectory, process.platform === "win32" ? "gh.cmd" : "gh");
   assertChildPath2(runRoot, wrapperPath);
   const launcher = process.platform === "win32" ? `@"${process.execPath.replaceAll('"', '""')}" "${wrapperSourcePath.replaceAll('"', '""')}" %*\r
 ` : `#!/bin/sh
@@ -34756,8 +35483,8 @@ password=${credential.accessToken}
 }
 
 // src/runners/working-context.ts
-import { spawn as spawn6 } from "node:child_process";
-import { resolve as resolve8 } from "node:path";
+import { spawn as spawn7 } from "node:child_process";
+import { resolve as resolve9 } from "node:path";
 var COMMAND_TIMEOUT_MS = 5e3;
 var OUTPUT_LIMIT_BYTES = 128 * 1024;
 var COMMAND_STOP_TIMEOUT_MS = 2e4;
@@ -34887,7 +35614,7 @@ async function stopWorkingContextCommand(child, childExited, options = {}) {
 function run(command, args, cwd, env, signal) {
   if (signal?.aborted) return Promise.resolve(null);
   return new Promise((resolvePromise) => {
-    const child = spawn6(command, [...args], {
+    const child = spawn7(command, [...args], {
       cwd,
       env: { ...env, GIT_OPTIONAL_LOCKS: "0" },
       detached: process.platform !== "win32",
@@ -35152,8 +35879,8 @@ async function repositoryState(directory, git, env, signal) {
   const pathLines = paths.trim().split(/\r?\n/);
   if (pathLines.length < 3 || !pathLines[0] || !pathLines[1] || !pathLines[2]) return null;
   const root = pathLines[0];
-  const gitDirectory = resolve8(directory, pathLines[1]);
-  const commonDirectory = resolve8(directory, pathLines[2]);
+  const gitDirectory = resolve9(directory, pathLines[1]);
+  const commonDirectory = resolve9(directory, pathLines[2]);
   const records = status.split(/\0|\r?\n/).filter(Boolean);
   const rawBranch = statusField(records, "branch.head");
   if (!rawBranch || rawBranch.length > 512 || !isSafeSingleLineDisplayText(rawBranch)) return null;
@@ -35304,657 +36031,6 @@ var WorkingContextPullRequestCache = class {
   }
 };
 
-// src/runners/run-artifacts.ts
-import { spawn as spawn7 } from "node:child_process";
-import {
-  chmod as chmod6,
-  lstat as lstat10,
-  mkdir as mkdir9,
-  open as open5,
-  readdir as readdir3,
-  readFile as readFile8,
-  realpath as realpath7,
-  rename as rename5,
-  rm as rm7,
-  writeFile as writeFile5
-} from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute13, join as join13, relative as relative8, resolve as resolve9, sep as sep4, win32 as win322 } from "node:path";
-var SAFE_SEGMENT2 = /^[A-Za-z0-9_-]{1,200}$/;
-var DIRECTORY_MODE4 = 448;
-var FILE_MODE3 = 384;
-var CLEANUP_ATTEMPTS2 = 3;
-var CLEANUP_RETRY_DELAY_MS = 50;
-var WINDOWS_ACL_TIMEOUT_MS = 5e3;
-var RUNNER_GUARDIAN = String.raw`
-const { spawn } = require('node:child_process');
-
-const quote = (value) => '"' + String(value).replace(/\\/g, '/').replaceAll('"', '""') + '"';
-const launchMarker = '__ZIXT_RELEASE_RUNNER__';
-const exitMarker = process.argv[2];
-const guardianNonce = process.argv[3];
-if (!/^[A-Za-z0-9_-]{16,200}$/.test(guardianNonce || '')) process.exit(1);
-const containmentNonce = process.env[${JSON.stringify(WINDOWS_CONTAINMENT_GATE_ENV)}];
-const containmentMarker = ${JSON.stringify(WINDOWS_CONTAINMENT_GATE_PREFIX)};
-let containmentReady = !containmentNonce;
-const maxReleaseBytes = 32 * 1024 * 1024;
-let target = null;
-let pending = Buffer.alloc(0);
-let stdinEnded = false;
-let expectedBytes = null;
-let config = null;
-let launchPending = false;
-let stderrTail = '';
-let postReleaseInput = Buffer.alloc(0);
-let reported = false;
-const report = (result) => {
-  if (reported) return;
-  reported = true;
-  process.stdout.write(
-    '\n' + exitMarker + JSON.stringify({ ...result, stderrTail }) + '\n'
-  );
-  setInterval(() => {}, 2_147_483_647);
-};
-
-// Job helper setup + assignment each have a bounded Windows phase. This gate
-// must outlive both, including slow first-run Add-Type under endpoint protection.
-const prelaunchTimeout = setTimeout(() => process.exit(1), 130_000);
-prelaunchTimeout.unref();
-
-const launchTarget = (release) => {
-  try {
-    const command = config.comspec || config.command;
-    const args = config.comspec
-      ? ['/d', '/s', '/c', '"' + [config.command, ...config.args].map(quote).join(' ') + '"']
-      : config.args;
-    target = spawn(command, args, {
-      cwd: config.cwd,
-      env: config.env,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      windowsHide: true,
-      windowsVerbatimArguments: Boolean(config.comspec),
-    });
-    launchPending = false;
-  } catch {
-    process.exit(1);
-    return;
-  }
-
-  target.stdin.on('error', () => {});
-  target.stdout.pipe(process.stdout, { end: false });
-  target.stderr.on('data', (chunk) => {
-    process.stderr.write(chunk);
-    stderrTail = (stderrTail + String(chunk)).slice(-32_768);
-  });
-  let targetResult;
-  let stdoutEnded = false;
-  const maybeReport = () => {
-    if (targetResult && stdoutEnded) report(targetResult);
-  };
-  target.stdout.once('end', () => {
-    stdoutEnded = true;
-    maybeReport();
-  });
-  target.stdout.once('close', () => {
-    stdoutEnded = true;
-    maybeReport();
-  });
-  target.once('error', () => {
-    targetResult = { kind: 'spawn_error' };
-    stdoutEnded = true;
-    maybeReport();
-  });
-  target.once('close', (code, signal) => {
-    targetResult = { kind: 'close', code, signal };
-    maybeReport();
-  });
-  if (config.prompt) target.stdin.write(config.prompt);
-  if (postReleaseInput.length) {
-    target.stdin.write(postReleaseInput);
-    postReleaseInput = Buffer.alloc(0);
-  }
-  if (stdinEnded) target.stdin.end();
-};
-
-const launch = (release) => {
-  clearTimeout(prelaunchTimeout);
-  config = release;
-  launchPending = true;
-  if (process.platform === 'win32') {
-    launchTarget(release);
-    return;
-  }
-
-  // A detached POSIX group's numeric id outlives its leader, but without a
-  // live identity witness a stale registry entry cannot distinguish that
-  // inherited group from the same PGID being recycled later. This
-  // credential-free sentinel inherits the guardian's exact group and carries
-  // only its high-entropy nonce in argv. It deliberately survives SIGTERM so
-  // checked recovery can keep the PGID reserved through the graceful pass and
-  // validate the nonce again immediately before a group-wide SIGKILL.
-  const identitySentinel = spawn(
-    process.execPath,
-    [
-      '-e',
-      "process.on('SIGTERM', () => {}); setInterval(() => {}, 2147483647);",
-      guardianNonce,
-    ],
-    { env: process.env, stdio: 'ignore' },
-  );
-  identitySentinel.once('error', () => process.exit(1));
-  identitySentinel.once('spawn', () => launchTarget(release));
-  identitySentinel.once('exit', () => {
-    if (!reported) process.exit(1);
-  });
-};
-
-process.stdin.on('data', (chunk) => {
-  if (target) {
-    target.stdin.write(chunk);
-    return;
-  }
-  if (config) {
-    postReleaseInput = Buffer.concat([postReleaseInput, chunk]);
-    if (postReleaseInput.length > maxReleaseBytes) process.exit(1);
-    return;
-  }
-  pending = Buffer.concat([pending, chunk]);
-  if (pending.length > maxReleaseBytes + 256) process.exit(1);
-  if (!containmentReady) {
-    const gateNewline = pending.indexOf(10);
-    if (gateNewline < 0) return;
-    const gate = pending.subarray(0, gateNewline).toString().replace(/\r$/, '');
-    if (gate !== containmentMarker + ' ' + containmentNonce) process.exit(1);
-    containmentReady = true;
-    pending = pending.subarray(gateNewline + 1);
-  }
-  if (expectedBytes === null) {
-    const newline = pending.indexOf(10);
-    if (newline < 0) return;
-    const header = pending.subarray(0, newline).toString();
-    const match = new RegExp('^' + launchMarker + ' ([1-9][0-9]{0,8})$').exec(header);
-    if (!match) process.exit(1);
-    expectedBytes = Number(match[1]);
-    if (expectedBytes > maxReleaseBytes) process.exit(1);
-    pending = pending.subarray(newline + 1);
-  }
-  if (pending.length < expectedBytes) return;
-  try {
-    const release = JSON.parse(pending.subarray(0, expectedBytes).toString('utf8'));
-    postReleaseInput = pending.subarray(expectedBytes);
-    pending = Buffer.alloc(0);
-    launch(release);
-  } catch {
-    process.exit(1);
-  }
-});
-process.stdin.on('end', () => {
-  stdinEnded = true;
-  if (!containmentReady) process.exit(1);
-  if (target) target.stdin.end();
-  else if (!launchPending) process.exit(1);
-});
-process.stdin.on('error', () => process.exit(1));
-`;
-var WINDOWS_PRIVATE_DACL_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-$paths = ConvertFrom-Json $env:ZIXT_RUN_ARTIFACT_PATHS
-$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$system = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-18')
-$admins = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
-$allowed = @($current.Value, $system.Value, $admins.Value)
-foreach ($path in $paths) {
-  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
-  $acl.SetAccessRuleProtection($true, $false)
-  foreach ($sid in @($current, $system, $admins)) {
-    $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
-      $sid,
-      [System.Security.AccessControl.FileSystemRights]::FullControl,
-      [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
-      [System.Security.AccessControl.PropagationFlags]::None,
-      [System.Security.AccessControl.AccessControlType]::Allow
-    )
-    [void]$acl.AddAccessRule($rule)
-  }
-  $entry = [System.IO.DirectoryInfo]::new($path)
-  $entry.SetAccessControl($acl)
-  $check = $entry.GetAccessControl()
-  if (-not $check.AreAccessRulesProtected) { throw 'DACL inheritance remained enabled' }
-  $seen = @{}
-  foreach ($rule in $check.Access) {
-    $sid = $rule.IdentityReference.Translate(
-      [System.Security.Principal.SecurityIdentifier]
-    ).Value
-    if ($rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $sid) {
-      throw 'Unexpected DACL entry'
-    }
-    $seen[$sid] = $true
-  }
-  foreach ($sid in $allowed) {
-    if (-not $seen.ContainsKey($sid)) { throw 'Required DACL entry is missing' }
-  }
-}
-`;
-function defaultRunArtifactRoot() {
-  return join13(homedir4(), ".zixt", "run-artifacts");
-}
-function requireSafeSegment(value, field) {
-  if (!SAFE_SEGMENT2.test(value)) {
-    throw new Error(`${field} must be a safe path segment`);
-  }
-}
-function isMissing(error52) {
-  return error52.code === "ENOENT";
-}
-function assertBelow3(parent, child) {
-  const path = relative8(parent, child);
-  const escapes = path === "" || path === ".." || path.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute13(path);
-  if (escapes) throw new Error("run artifact path escapes its private root");
-}
-async function requireRealDirectory3(path, label) {
-  const entry = await lstat10(path);
-  if (entry.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
-  if (!entry.isDirectory()) throw new Error(`${label} must be a directory`);
-  return realpath7(path);
-}
-function assertWindowsProfileBoundary(profile, target) {
-  const path = win322.relative(win322.resolve(profile), win322.resolve(target));
-  if (path === "" || path === ".." || path.startsWith("..\\") || win322.isAbsolute(path)) {
-    throw new Error("run artifact root must be inside the current Windows user profile");
-  }
-}
-async function rejectWindowsSymlinkAncestors(profile, target) {
-  const path = win322.relative(win322.resolve(profile), win322.resolve(target));
-  let current = win322.resolve(profile);
-  for (const segment of path.split("\\").filter(Boolean)) {
-    current = win322.join(current, segment);
-    try {
-      const entry = await lstat10(current);
-      if (entry.isSymbolicLink()) {
-        throw new Error("run artifact path must not contain symbolic links or junctions");
-      }
-    } catch (error52) {
-      if (isMissing(error52)) return;
-      throw error52;
-    }
-  }
-}
-async function prepareRoot(root) {
-  const absolute = resolve9(root);
-  let realProfile;
-  if (process.platform === "win32") {
-    const profile = resolve9(homedir4());
-    assertWindowsProfileBoundary(profile, absolute);
-    await rejectWindowsSymlinkAncestors(profile, absolute);
-    realProfile = await realpath7(profile);
-  }
-  try {
-    await lstat10(absolute);
-  } catch (error52) {
-    if (!isMissing(error52)) throw error52;
-    await mkdir9(absolute, { recursive: true, mode: DIRECTORY_MODE4 });
-  }
-  const real = await requireRealDirectory3(absolute, "run artifact root");
-  if (realProfile) assertWindowsProfileBoundary(realProfile, real);
-  await chmod6(real, DIRECTORY_MODE4);
-  return real;
-}
-async function prepareAgentRoot(root, agentId) {
-  const path = join13(root, agentId);
-  assertBelow3(root, path);
-  try {
-    await lstat10(path);
-  } catch (error52) {
-    if (!isMissing(error52)) throw error52;
-    try {
-      await mkdir9(path, { mode: DIRECTORY_MODE4 });
-    } catch (mkdirError) {
-      if (mkdirError.code !== "EEXIST") throw mkdirError;
-    }
-  }
-  const real = await requireRealDirectory3(path, "run artifact Agent directory");
-  assertBelow3(root, real);
-  await chmod6(real, DIRECTORY_MODE4);
-  return real;
-}
-async function lockDownWindowsDirectories(paths) {
-  if (process.platform !== "win32") return;
-  const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-  if (!windowsRoot || !win322.isAbsolute(windowsRoot)) {
-    throw new Error("private Windows run-artifact ACL authority is unavailable");
-  }
-  const powershell = join13(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-  const encoded = Buffer.from(WINDOWS_PRIVATE_DACL_SCRIPT, "utf16le").toString("base64");
-  await new Promise((resolvePromise, reject3) => {
-    const helper = spawn7(
-      powershell,
-      ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded],
-      {
-        env: {
-          SystemRoot: windowsRoot,
-          WINDIR: windowsRoot,
-          ...process.env.TEMP ? { TEMP: process.env.TEMP } : {},
-          ...process.env.TMP ? { TMP: process.env.TMP } : {},
-          ZIXT_RUN_ARTIFACT_PATHS: JSON.stringify(paths)
-        },
-        stdio: "ignore",
-        windowsHide: true
-      }
-    );
-    let finished = false;
-    const timeout = setTimeout(() => {
-      helper.kill("SIGKILL");
-      finish(new Error("private Windows run-artifact ACL update timed out"));
-    }, WINDOWS_ACL_TIMEOUT_MS);
-    timeout.unref?.();
-    const finish = (error52) => {
-      if (finished) return;
-      finished = true;
-      clearTimeout(timeout);
-      if (error52) reject3(error52);
-      else resolvePromise();
-    };
-    helper.once(
-      "error",
-      () => finish(new Error("private Windows run-artifact ACL update could not start"))
-    );
-    helper.once(
-      "close",
-      (code) => finish(code === 0 ? void 0 : new Error("private Windows run-artifact ACL update failed"))
-    );
-  });
-}
-async function createPrivateDirectory(parent, name) {
-  const path = join13(parent, name);
-  assertBelow3(parent, path);
-  await mkdir9(path, { mode: DIRECTORY_MODE4 });
-  await chmod6(path, DIRECTORY_MODE4);
-  const real = await realpath7(path);
-  assertBelow3(parent, real);
-  return real;
-}
-async function writePrivateFile(path, content) {
-  await writeFile5(path, content, { flag: "wx", mode: FILE_MODE3 });
-  await chmod6(path, FILE_MODE3);
-}
-function quotePosix(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function quoteWindows(value) {
-  if (value.includes('"') || /[\r\n]/.test(value)) {
-    throw new Error("Windows command paths must not contain quotes or newlines");
-  }
-  return `"${value}"`;
-}
-function buildDenySshCommand(executablePath, scriptPath, platform = process.platform) {
-  const quote2 = platform === "win32" ? quoteWindows : quotePosix;
-  return `${quote2(executablePath)} ${quote2(scriptPath)}`;
-}
-async function createRunArtifacts(input) {
-  requireSafeSegment(input.agentId, "agentId");
-  requireSafeSegment(input.runToken, "runToken");
-  const root = await prepareRoot(input.root);
-  const removeTree = input.removeTree ?? ((path) => rm7(path, { recursive: true, force: true }));
-  const cleanupRetryDelayMs = input.cleanupRetryDelayMs ?? CLEANUP_RETRY_DELAY_MS;
-  const agentRoot = await prepareAgentRoot(root, input.agentId);
-  await lockDownWindowsDirectories([root, agentRoot]);
-  const runRoot = join13(agentRoot, input.runToken);
-  assertBelow3(agentRoot, runRoot);
-  try {
-    await mkdir9(runRoot, { mode: DIRECTORY_MODE4 });
-    await chmod6(runRoot, DIRECTORY_MODE4);
-    const realRunRoot = await realpath7(runRoot);
-    assertBelow3(agentRoot, realRunRoot);
-    const emptyGithubConfigDirectory = await createPrivateDirectory(realRunRoot, "gh-config");
-    const emptyGitHooksDirectory = await createPrivateDirectory(realRunRoot, "git-hooks");
-    const gitBridgesDirectory = await createPrivateDirectory(realRunRoot, "git-bridges");
-    const denySshScript = join13(realRunRoot, "deny-ssh.cjs");
-    const runnerWrapperScript = join13(realRunRoot, "runner-wrapper.cjs");
-    const systemPromptPath = join13(realRunRoot, "system-prompt.txt");
-    const mcpConfigPath = join13(realRunRoot, "mcp.json");
-    await writePrivateFile(denySshScript, "process.exitCode = 127;");
-    await writePrivateFile(runnerWrapperScript, RUNNER_GUARDIAN);
-    return {
-      runRoot: realRunRoot,
-      emptyGithubConfigDirectory,
-      emptyGitHooksDirectory,
-      gitBridgesDirectory,
-      denySshScript,
-      denySshCommand: buildDenySshCommand(process.execPath, denySshScript),
-      runnerWrapperScript,
-      nullConfigPath: process.platform === "win32" ? "NUL" : "/dev/null",
-      async writeSystemPrompt(content) {
-        await writePrivateFile(systemPromptPath, content);
-        return systemPromptPath;
-      },
-      async writeMcpConfig(content) {
-        await writePrivateFile(mcpConfigPath, content);
-        return mcpConfigPath;
-      },
-      async cleanup() {
-        await removePrivateTreeWithRetries(realRunRoot, removeTree, cleanupRetryDelayMs);
-      }
-    };
-  } catch (error52) {
-    await removePrivateTreeWithRetries(runRoot, removeTree, cleanupRetryDelayMs).catch(() => {
-    });
-    throw error52;
-  }
-}
-async function removePrivateTreeWithRetries(path, removeTree, retryDelayMs) {
-  for (let attempt = 1; attempt <= CLEANUP_ATTEMPTS2; attempt++) {
-    try {
-      await removeTree(path);
-      return;
-    } catch (error52) {
-      if (attempt === CLEANUP_ATTEMPTS2) throw error52;
-      await new Promise((resolveDelay) => setTimeout(resolveDelay, retryDelayMs));
-    }
-  }
-}
-async function sweepOrphanedRunArtifacts(root) {
-  const absolute = resolve9(root);
-  let realProfile;
-  if (process.platform === "win32") {
-    const profile = resolve9(homedir4());
-    assertWindowsProfileBoundary(profile, absolute);
-    await rejectWindowsSymlinkAncestors(profile, absolute);
-    realProfile = await realpath7(profile);
-  }
-  let realRoot;
-  try {
-    realRoot = await requireRealDirectory3(absolute, "run artifact root");
-  } catch (error52) {
-    if (isMissing(error52)) return 0;
-    throw error52;
-  }
-  if (realProfile) assertWindowsProfileBoundary(realProfile, realRoot);
-  await chmod6(realRoot, DIRECTORY_MODE4);
-  await lockDownWindowsDirectories([realRoot]);
-  const agents = await readdir3(realRoot, { withFileTypes: true });
-  let removed = 0;
-  for (const agent of agents) {
-    if (!SAFE_SEGMENT2.test(agent.name) || !agent.isDirectory() || agent.isSymbolicLink()) continue;
-    const agentPath = join13(realRoot, agent.name);
-    const runs = await readdir3(agentPath, { withFileTypes: true });
-    for (const run3 of runs) {
-      if (!SAFE_SEGMENT2.test(run3.name) || !run3.isDirectory() || run3.isSymbolicLink()) continue;
-      const runPath = join13(agentPath, run3.name);
-      assertBelow3(agentPath, runPath);
-      await rm7(runPath, { recursive: true, force: true });
-      removed++;
-    }
-  }
-  return removed;
-}
-function defaultRunRegistryRoot() {
-  return join13(homedir4(), ".zixt", "run-registry");
-}
-async function syncRunRegistryDirectory(path) {
-  const handle = await open5(path, "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-async function ensureDurableRunRegistryRoot(registryRoot, syncDirectory7) {
-  const firstCreated = await mkdir9(registryRoot, { recursive: true, mode: DIRECTORY_MODE4 });
-  if (firstCreated && process.platform !== "win32") {
-    const first = resolve9(firstCreated);
-    const target = resolve9(registryRoot);
-    await syncDirectory7(dirname7(first));
-    let current = first;
-    for (const part of relative8(first, target).split(sep4).filter(Boolean)) {
-      await syncDirectory7(current);
-      current = join13(current, part);
-    }
-  }
-  await chmod6(registryRoot, DIRECTORY_MODE4);
-}
-async function recordRunAssignment(runToken, record2, registryRoot = defaultRunRegistryRoot(), options = {}) {
-  if (!SAFE_SEGMENT2.test(runToken)) return false;
-  const destination = join13(registryRoot, `${runToken}.json`);
-  const temporary = join13(registryRoot, `.${runToken}.${process.pid}.${Date.now()}.tmp`);
-  let handle;
-  try {
-    const syncDirectory7 = options.syncDirectory ?? syncRunRegistryDirectory;
-    await ensureDurableRunRegistryRoot(registryRoot, syncDirectory7);
-    handle = await open5(temporary, "wx", FILE_MODE3);
-    await handle.writeFile(JSON.stringify(record2), "utf8");
-    await handle.sync();
-    await handle.close();
-    handle = void 0;
-    await rename5(temporary, destination);
-    if (process.platform !== "win32") {
-      await syncDirectory7(registryRoot);
-    }
-    return true;
-  } catch {
-    return false;
-  } finally {
-    await handle?.close().catch(() => {
-    });
-    await rm7(temporary, { force: true }).catch(() => {
-    });
-  }
-}
-var retainingAssignments = false;
-function retainRunAssignments() {
-  retainingAssignments = true;
-}
-async function forgetRunAssignment(runToken, registryRoot = defaultRunRegistryRoot()) {
-  if (retainingAssignments) return;
-  if (!SAFE_SEGMENT2.test(runToken)) return;
-  try {
-    await rm7(join13(registryRoot, `${runToken}.json`), { force: true });
-  } catch {
-  }
-}
-function parseAssignment(text) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const value = parsed;
-  if (typeof value.taskId !== "string" || value.taskId === "") return null;
-  if (typeof value.epoch !== "number" || !Number.isInteger(value.epoch) || value.epoch < 1) {
-    return null;
-  }
-  const pid = value.pid;
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 1) return null;
-  let identity;
-  if (value.identity !== void 0) {
-    if (typeof value.identity !== "object" || value.identity === null || value.identity.kind !== "guardian_nonce" || typeof value.identity.nonce !== "string" || !/^[A-Za-z0-9_-]{16,200}$/.test(value.identity.nonce)) {
-      return null;
-    }
-    identity = {
-      kind: "guardian_nonce",
-      nonce: value.identity.nonce
-    };
-  }
-  return { taskId: value.taskId, epoch: value.epoch, pid, ...identity ? { identity } : {} };
-}
-async function readRecordedRunAssignmentEntries(registryRoot = defaultRunRegistryRoot()) {
-  let entries;
-  try {
-    entries = await readdir3(registryRoot, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  const found = [];
-  for (const entry of entries) {
-    if (!entry.isFile() || entry.isSymbolicLink() || !entry.name.endsWith(".json")) continue;
-    const runToken = entry.name.slice(0, -".json".length);
-    if (!SAFE_SEGMENT2.test(runToken)) continue;
-    let text;
-    try {
-      text = await readFile8(join13(registryRoot, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    const record2 = parseAssignment(text);
-    if (record2) found.push({ runToken, record: record2 });
-  }
-  return found;
-}
-async function readRecordedRunAssignmentEntriesStrict(registryRoot = defaultRunRegistryRoot()) {
-  let rootStat;
-  try {
-    rootStat = await lstat10(registryRoot);
-  } catch (error52) {
-    if (isMissing(error52)) return [];
-    throw new Error("run registry state could not be observed");
-  }
-  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-    throw new Error("run registry root is not a trusted directory");
-  }
-  let entries;
-  try {
-    entries = await readdir3(registryRoot, { withFileTypes: true });
-  } catch {
-    throw new Error("run registry state could not be observed");
-  }
-  const found = [];
-  for (const entry of entries) {
-    if (!entry.name.endsWith(".json")) continue;
-    const runToken = entry.name.slice(0, -".json".length);
-    if (!SAFE_SEGMENT2.test(runToken)) continue;
-    if (!entry.isFile() || entry.isSymbolicLink()) {
-      throw new Error("committed run registry witness is not a regular file");
-    }
-    let text;
-    try {
-      text = await readFile8(join13(registryRoot, entry.name), "utf8");
-    } catch {
-      throw new Error("committed run registry witness could not be read");
-    }
-    const record2 = parseAssignment(text);
-    if (!record2) throw new Error("committed run registry witness is malformed");
-    found.push({ runToken, record: record2 });
-  }
-  return found;
-}
-async function forgetAcknowledgedRunAssignments(assignments, registryRoot = defaultRunRegistryRoot()) {
-  if (assignments.length === 0) return;
-  const acknowledged = new Set(
-    assignments.map((assignment) => `${assignment.taskId}:${assignment.epoch}`)
-  );
-  const entries = await readRecordedRunAssignmentEntries(registryRoot);
-  await Promise.all(
-    entries.filter(({ record: record2 }) => acknowledged.has(`${record2.taskId}:${record2.epoch}`)).map(({ runToken }) => rm7(join13(registryRoot, `${runToken}.json`), { force: true }))
-  );
-}
-async function forgetSupersededRunAssignments(taskId, epoch, registryRoot = defaultRunRegistryRoot()) {
-  const entries = await readRecordedRunAssignmentEntries(registryRoot);
-  await Promise.all(
-    entries.filter(({ record: record2 }) => record2.taskId === taskId && record2.epoch < epoch).map(({ runToken }) => rm7(join13(registryRoot, `${runToken}.json`), { force: true }))
-  );
-}
-
 // src/runners/cli-runner.ts
 var PRIVATE_CLEANUP_FAILURE = "Private runner cleanup could not be completed. Restart the Zixt Host before accepting more work.";
 var PROCESS_CLEANUP_FAILURE = "Runner process cleanup could not be confirmed. Restart the Zixt Host before accepting more work.";
@@ -35986,21 +36062,10 @@ function defaultRunnerArtifactRoot() {
 async function sweepOrphanedRunnerArtifacts(artifactRoot = defaultRunnerArtifactRoot()) {
   return sweepOrphanedRunArtifacts(artifactRoot);
 }
-async function recoverRecordedRunAssignments(registryRoot = defaultRunRegistryRoot(), terminate = terminateRecordedProcessTree) {
-  const entries = await readRecordedRunAssignmentEntriesStrict(registryRoot);
-  const terminated = /* @__PURE__ */ new Set();
-  const orderedEntries = [...entries].sort(
-    (left, right) => Number(Boolean(right.record.identity)) - Number(Boolean(left.record.identity))
-  );
-  for (const { record: record2 } of orderedEntries) {
-    const identityKey = record2.identity ? `${record2.identity.kind}:${record2.identity.nonce}` : "legacy";
-    const witnessKey = `${record2.pid}:${identityKey}`;
-    if (terminated.has(witnessKey)) continue;
-    await terminate(record2.pid, record2.identity);
-    terminated.add(witnessKey);
-  }
+async function recoverRecordedRunAssignments(registryRoot = defaultRunRegistryRoot(), terminate) {
+  const records = terminate ? await terminateRecordedRunProcesses(registryRoot, terminate) : await terminateRecordedRunProcesses(registryRoot);
   const assignments = /* @__PURE__ */ new Map();
-  for (const { record: record2 } of entries) {
+  for (const record2 of records) {
     const assignment = { taskId: record2.taskId, epoch: record2.epoch };
     assignments.set(`${record2.taskId}:${record2.epoch}`, assignment);
   }