agent-remnote 1.4.0 → 1.5.0

package/dist/main.js

@@ -43214,6 +43214,7 @@ var option = (self) => matchEffect(self, {
   onSuccess: (a) => succeed(some2(a))
 });
 var orElseFail = /* @__PURE__ */ dual(2, (self, evaluate2) => orElse2(self, () => failSync(evaluate2)));
+var orElseSucceed = /* @__PURE__ */ dual(2, (self, evaluate2) => orElse2(self, () => sync(evaluate2)));
 var patchFiberRefs = (patch11) => updateFiberRefs((fiberId2, fiberRefs3) => pipe(patch11, patch9(fiberId2, fiberRefs3)));
 var promise = (evaluate2) => evaluate2.length >= 1 ? async_((resolve, signal) => {
   try {
@@ -48400,6 +48401,7 @@ var withUnhandledErrorLogLevel2 = withUnhandledErrorLogLevel;
 var orDie2 = orDie;
 var orElse4 = orElse2;
 var orElseFail2 = orElseFail;
+var orElseSucceed2 = orElseSucceed;
 var runtime4 = runtime3;
 var unsafeMakeSemaphore2 = unsafeMakeSemaphore;
 var makeSemaphore2 = makeSemaphore;
@@ -73990,6 +73992,7 @@ var platformRunnerImpl = /* @__PURE__ */ PlatformRunner2.of({
 // src/main.ts
 import { readFileSync as readFileSync5 } from "node:fs";
 import { format as format10 } from "node:util";
+import { isMainThread as isMainThread2, parentPort as parentPort3, workerData as workerData2 } from "node:worker_threads";
 
 // src/services/UserConfigFile.ts
 import { promises as fs4 } from "node:fs";
@@ -74323,6 +74326,41 @@ function isConfigCommandInvocation(argv) {
   }
   return tokens[i] === "config";
 }
+function isDoctorCommandInvocation(argv) {
+  const tokens = argv.slice(2);
+  let i = 0;
+  while (i < tokens.length) {
+    const raw4 = String(tokens[i] ?? "");
+    if (!raw4)
+      break;
+    if (raw4 === "--") {
+      i += 1;
+      break;
+    }
+    if (!raw4.startsWith("-"))
+      break;
+    const { flag, inlineValue } = splitFlagInlineValue(raw4);
+    if (ROOT_VALUE_FLAGS.has(flag)) {
+      i += inlineValue !== null ? 1 : 2;
+      continue;
+    }
+    if (ROOT_BOOL_FLAGS.has(flag) || BUILTIN_BOOL_FLAGS.has(flag)) {
+      if (inlineValue !== null) {
+        i += 1;
+        continue;
+      }
+      const next4 = tokens[i + 1];
+      if (typeof next4 === "string" && isBooleanLiteralToken(next4)) {
+        i += 2;
+        continue;
+      }
+      i += 1;
+      continue;
+    }
+    break;
+  }
+  return tokens[i] === "doctor";
+}
 function normalizeApiBasePath(raw4) {
   const trimmed2 = raw4.trim();
   if (!trimmed2)
@@ -74534,7 +74572,9 @@ function readUserConfigFile(configFile) {
   const nestedHost = apiObject?.host;
   const nestedPort = apiObject?.port;
   const nestedBasePath = apiObject?.basePath;
-  const apiBaseUrl = config3.apiBaseUrl ?? nestedBaseUrl;
+  const hasRootApiBaseUrl = Object.prototype.hasOwnProperty.call(config3, "apiBaseUrl");
+  const hasNestedBaseUrl = apiObject ? Object.prototype.hasOwnProperty.call(apiObject, "baseUrl") : false;
+  const apiBaseUrl = hasRootApiBaseUrl ? config3.apiBaseUrl : nestedBaseUrl;
   const apiHostRaw = config3.apiHost ?? nestedHost;
   const apiPortRaw = config3.apiPort ?? nestedPort;
   const apiBasePathRaw = config3.apiBasePath ?? nestedBasePath;
@@ -74546,6 +74586,20 @@ function readUserConfigFile(configFile) {
       details: { config_file: file6 }
     });
   }
+  const normalizedApiBaseUrl = apiBaseUrl === undefined ? undefined : (() => {
+    const normalized = normalizeApiBaseUrl(apiBaseUrl);
+    const rootNormalized = typeof config3.apiBaseUrl === "string" ? normalizeApiBaseUrl(config3.apiBaseUrl) : undefined;
+    const nestedNormalized = typeof nestedBaseUrl === "string" ? normalizeApiBaseUrl(nestedBaseUrl) : undefined;
+    if (hasRootApiBaseUrl && hasNestedBaseUrl && rootNormalized !== nestedNormalized) {
+      throw new CliError({
+        code: "INVALID_ARGS",
+        message: `Config keys apiBaseUrl and api.baseUrl conflict: ${file6}`,
+        exitCode: 2,
+        details: { config_file: file6 }
+      });
+    }
+    return normalized;
+  })();
   const apiHost = apiHostRaw === undefined ? undefined : (() => {
     if (typeof apiHostRaw !== "string") {
       throw new CliError({
@@ -74555,7 +74609,18 @@ function readUserConfigFile(configFile) {
         details: { config_file: file6 }
       });
     }
-    return normalizeApiHost(apiHostRaw);
+    const normalized = normalizeApiHost(apiHostRaw);
+    const rootNormalized = typeof config3.apiHost === "string" ? normalizeApiHost(config3.apiHost) : undefined;
+    const nestedNormalized = typeof nestedHost === "string" ? normalizeApiHost(nestedHost) : undefined;
+    if (rootNormalized !== undefined && nestedNormalized !== undefined && rootNormalized !== nestedNormalized) {
+      throw new CliError({
+        code: "INVALID_ARGS",
+        message: `Config keys apiHost and api.host conflict: ${file6}`,
+        exitCode: 2,
+        details: { config_file: file6 }
+      });
+    }
+    return normalized;
   })();
   const apiPort = apiPortRaw === undefined ? undefined : (() => {
     if (typeof apiPortRaw !== "number" && typeof apiPortRaw !== "string") {
@@ -74566,7 +74631,18 @@ function readUserConfigFile(configFile) {
         details: { config_file: file6 }
       });
     }
-    return normalizeApiPort(apiPortRaw);
+    const normalized = normalizeApiPort(apiPortRaw);
+    const rootNormalized = typeof config3.apiPort === "number" || typeof config3.apiPort === "string" ? normalizeApiPort(config3.apiPort) : undefined;
+    const nestedNormalized = typeof nestedPort === "number" || typeof nestedPort === "string" ? normalizeApiPort(nestedPort) : undefined;
+    if (rootNormalized !== undefined && nestedNormalized !== undefined && rootNormalized !== nestedNormalized) {
+      throw new CliError({
+        code: "INVALID_ARGS",
+        message: `Config keys apiPort and api.port conflict: ${file6}`,
+        exitCode: 2,
+        details: { config_file: file6 }
+      });
+    }
+    return normalized;
   })();
   const apiBasePath = apiBasePathRaw === undefined ? undefined : (() => {
     if (typeof apiBasePathRaw !== "string") {
@@ -74577,12 +74653,23 @@ function readUserConfigFile(configFile) {
         details: { config_file: file6 }
       });
     }
-    return normalizeApiBasePath(apiBasePathRaw);
+    const normalized = normalizeApiBasePath(apiBasePathRaw);
+    const rootNormalized = typeof config3.apiBasePath === "string" ? normalizeApiBasePath(config3.apiBasePath) : undefined;
+    const nestedNormalized = typeof nestedBasePath === "string" ? normalizeApiBasePath(nestedBasePath) : undefined;
+    if (rootNormalized !== undefined && nestedNormalized !== undefined && rootNormalized !== nestedNormalized) {
+      throw new CliError({
+        code: "INVALID_ARGS",
+        message: `Config keys apiBasePath and api.basePath conflict: ${file6}`,
+        exitCode: 2,
+        details: { config_file: file6 }
+      });
+    }
+    return normalized;
   })();
   if (apiBaseUrl === undefined && apiHost === undefined && apiPort === undefined && apiBasePath === undefined) {
     return {};
   }
-  return { apiBaseUrl, apiHost, apiPort, apiBasePath };
+  return { apiBaseUrl: normalizedApiBaseUrl, apiHost, apiPort, apiBasePath };
 }
 function resolveConfig() {
   return gen2(function* () {
@@ -74597,7 +74684,7 @@ function resolveConfig() {
         details: { config_file: configFile, error: String(error4?.message || error4) }
       })
     }));
-    const userConfig = userConfigResult._tag === "Right" ? userConfigResult.right : isConfigCommandInvocation(process.argv) ? {} : yield* fail8(userConfigResult.left);
+    const userConfig = userConfigResult._tag === "Right" ? userConfigResult.right : isConfigCommandInvocation(process.argv) || isDoctorCommandInvocation(process.argv) ? {} : yield* fail8(userConfigResult.left);
     const wsStateFile = resolveWsStateFile(raw4.wsStateFile);
     const remnoteDb = optionalTrimmed(raw4.remnoteDb) ? resolveUserFilePath(raw4.remnoteDb) : inferRemnoteDbFromWsState({ wsStateFile, wsStateStaleMs: raw4.wsStateStaleMs }) || undefined;
     const storeDb = resolveUserFilePath(raw4.storeDb);
@@ -74697,8 +74784,22 @@ function readApiBaseUrl(doc) {
   const root = doc.apiBaseUrl;
   const api = doc.api;
   const nested4 = isPlainObject(api) ? api.baseUrl : undefined;
-  const rootValue = root === undefined ? undefined : typeof root === "string" ? root : (errors3.push("Config key apiBaseUrl must be a string"), undefined);
-  const nestedValue = nested4 === undefined ? undefined : typeof nested4 === "string" ? nested4 : (errors3.push("Config key api.baseUrl must be a string"), undefined);
+  const rootValue = root === undefined ? undefined : typeof root === "string" ? (() => {
+    try {
+      return normalizeApiBaseUrl(root);
+    } catch (error4) {
+      errors3.push(isCliError(error4) ? error4.message : "Config key apiBaseUrl must be a valid URL");
+      return;
+    }
+  })() : (errors3.push("Config key apiBaseUrl must be a string"), undefined);
+  const nestedValue = nested4 === undefined ? undefined : typeof nested4 === "string" ? (() => {
+    try {
+      return normalizeApiBaseUrl(nested4);
+    } catch (error4) {
+      errors3.push(isCliError(error4) ? error4.message : "Config key api.baseUrl must be a valid URL");
+      return;
+    }
+  })() : (errors3.push("Config key api.baseUrl must be a string"), undefined);
   if (rootValue && nestedValue && rootValue !== nestedValue) {
     errors3.push("Config keys apiBaseUrl and api.baseUrl conflict");
   }
@@ -74811,6 +74912,34 @@ function inspectDoc(configFile, exists3, doc) {
     valid: errors3.length === 0
   };
 }
+function canonicalizeDoc(doc) {
+  const next4 = cloneDoc(doc);
+  const inspection = inspectDoc("", true, next4);
+  if (!inspection.valid) {
+    return next4;
+  }
+  if (inspection.values.apiBaseUrl !== undefined) {
+    next4.apiBaseUrl = inspection.values.apiBaseUrl;
+  }
+  if (inspection.values.apiHost !== undefined) {
+    next4.apiHost = inspection.values.apiHost;
+  }
+  if (inspection.values.apiPort !== undefined) {
+    next4.apiPort = inspection.values.apiPort;
+  }
+  if (inspection.values.apiBasePath !== undefined) {
+    next4.apiBasePath = inspection.values.apiBasePath;
+  }
+  const api = next4.api;
+  if (isPlainObject(api)) {
+    delete api.baseUrl;
+    delete api.host;
+    delete api.port;
+    delete api.basePath;
+    removeEmptyApiObject(next4);
+  }
+  return next4;
+}
 async function ensureDir(filePath) {
   await fs4.mkdir(path7.dirname(filePath), { recursive: true });
 }
@@ -75002,6 +75131,69 @@ var UserConfigFileLive = succeed10(UserConfigFile, {
     }
     return inspectDoc(parsed.configFile, parsed.exists, parsed.doc);
   }),
+  previewRepair: () => gen2(function* () {
+    const cfg = yield* AppConfig;
+    const parsed = yield* promise2(() => readDocDetailed(cfg.configFile));
+    const { configFile, doc, exists: exists3 } = yield* try_3({
+      try: () => requireParsedDoc(parsed),
+      catch: (error4) => toCliFailure(error4, "Invalid config file")
+    });
+    const before2 = inspectDoc(configFile, exists3, doc);
+    const nextDoc = canonicalizeDoc(doc);
+    const after3 = inspectDoc(configFile, exists3, nextDoc);
+    return {
+      configFile,
+      exists: exists3,
+      changed: JSON.stringify(doc) !== JSON.stringify(nextDoc),
+      before: before2,
+      after: after3,
+      nextDoc
+    };
+  }),
+  repair: () => gen2(function* () {
+    const cfg = yield* AppConfig;
+    const parsed = yield* promise2(() => readDocDetailed(cfg.configFile));
+    const { configFile, doc, exists: exists3 } = yield* try_3({
+      try: () => requireParsedDoc(parsed),
+      catch: (error4) => toCliFailure(error4, "Invalid config file")
+    });
+    const before2 = inspectDoc(configFile, exists3, doc);
+    const nextDoc = canonicalizeDoc(doc);
+    const after3 = inspectDoc(configFile, exists3, nextDoc);
+    const preview = {
+      configFile,
+      exists: exists3,
+      changed: JSON.stringify(doc) !== JSON.stringify(nextDoc),
+      before: before2,
+      after: after3,
+      nextDoc
+    };
+    if (!preview.changed) {
+      return {
+        ...preview,
+        written: false
+      };
+    }
+    if (!preview.before.valid) {
+      return {
+        ...preview,
+        written: false
+      };
+    }
+    yield* tryPromise2({
+      try: async () => await writeDoc(preview.configFile, preview.nextDoc),
+      catch: (error4) => new CliError({
+        code: "INTERNAL",
+        message: "Failed to write config file",
+        exitCode: 1,
+        details: { config_file: preview.configFile, error: String(error4?.message || error4) }
+      })
+    });
+    return {
+      ...preview,
+      written: true
+    };
+  }),
   get: (key) => gen2(function* () {
     const targetKey = yield* try_3({
       try: () => canonicalKey(key),
@@ -75715,35 +75907,181 @@ var configCommand = exports_Command.make("config", {}).pipe(exports_Command.with
   configValidateCommand
 ]));
 
-// src/services/FsAccess.ts
-import { constants as FS_CONSTANTS, promises as fs8 } from "node:fs";
+// src/services/ApiDaemonFiles.ts
+import { promises as fs8 } from "node:fs";
 import path10 from "node:path";
+class ApiDaemonFiles extends Tag2("ApiDaemonFiles")() {
+}
+function ensureDir4(p3) {
+  return fs8.mkdir(path10.dirname(p3), { recursive: true }).then(() => {
+    return;
+  });
+}
+function defaultPidFile2() {
+  const envPidFile = process.env.REMNOTE_API_PID_FILE;
+  if (typeof envPidFile === "string" && envPidFile.trim())
+    return resolveUserFilePath(envPidFile);
+  return path10.join(homeDir(), ".agent-remnote", "api.pid");
+}
+function defaultLogFile2() {
+  const envLogFile = process.env.REMNOTE_API_LOG_FILE;
+  if (typeof envLogFile === "string" && envLogFile.trim())
+    return resolveUserFilePath(envLogFile);
+  return path10.join(homeDir(), ".agent-remnote", "api.log");
+}
+function defaultStateFile2() {
+  const envStateFile = process.env.REMNOTE_API_STATE_FILE;
+  if (typeof envStateFile === "string" && envStateFile.trim())
+    return resolveUserFilePath(envStateFile);
+  return path10.join(homeDir(), ".agent-remnote", "api.state.json");
+}
+function parseJson2(raw4, filePath) {
+  try {
+    return JSON.parse(raw4);
+  } catch (error4) {
+    throw new CliError({
+      code: "INTERNAL",
+      message: `Failed to parse JSON file: ${filePath}`,
+      exitCode: 1,
+      details: { file_path: filePath, error: String(error4?.message || error4) }
+    });
+  }
+}
+var ApiDaemonFilesLive = succeed10(ApiDaemonFiles, {
+  defaultPidFile: defaultPidFile2,
+  defaultLogFile: defaultLogFile2,
+  defaultStateFile: defaultStateFile2,
+  readPidFile: (pidFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      const raw4 = await fs8.readFile(resolved, "utf8");
+      return parseJson2(raw4, resolved);
+    },
+    catch: (error4) => {
+      const code2 = error4?.code;
+      if (code2 === "ENOENT")
+        return;
+      if (isCliError(error4))
+        return error4;
+      return new CliError({
+        code: "INTERNAL",
+        message: "Failed to read api pid file",
+        exitCode: 1,
+        details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+      });
+    }
+  }).pipe(catchAll2((error4) => {
+    if (error4 === undefined)
+      return succeed8(undefined);
+    return fail8(error4);
+  })),
+  writePidFile: (pidFilePath, value8) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      await ensureDir4(resolved);
+      await fs8.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
+`, "utf8");
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to write api pid file",
+      exitCode: 1,
+      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  deletePidFile: (pidFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      await fs8.rm(resolved, { force: true });
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to delete api pid file",
+      exitCode: 1,
+      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  readStateFile: (stateFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      const raw4 = await fs8.readFile(resolved, "utf8");
+      return parseJson2(raw4, resolved);
+    },
+    catch: (error4) => {
+      const code2 = error4?.code;
+      if (code2 === "ENOENT")
+        return;
+      if (isCliError(error4))
+        return error4;
+      return new CliError({
+        code: "INTERNAL",
+        message: "Failed to read api state file",
+        exitCode: 1,
+        details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+      });
+    }
+  }).pipe(catchAll2((error4) => {
+    if (error4 === undefined)
+      return succeed8(undefined);
+    return fail8(error4);
+  })),
+  writeStateFile: (stateFilePath, value8) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      await ensureDir4(resolved);
+      await fs8.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
+`, "utf8");
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to write api state file",
+      exitCode: 1,
+      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  deleteStateFile: (stateFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      await fs8.rm(resolved, { force: true });
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to delete api state file",
+      exitCode: 1,
+      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+    })
+  })
+});
+
+// src/services/FsAccess.ts
+import { constants as FS_CONSTANTS, promises as fs9 } from "node:fs";
+import path11 from "node:path";
 
 class FsAccess extends Tag2("FsAccess")() {
 }
 async function canWritePath(filePath) {
   try {
-    await fs8.mkdir(path10.dirname(filePath), { recursive: true });
-    await fs8.access(path10.dirname(filePath), FS_CONSTANTS.W_OK);
+    await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+    await fs9.access(path11.dirname(filePath), FS_CONSTANTS.W_OK);
     return true;
   } catch {
     return false;
   }
 }
 async function checkWritableFile(filePath) {
-  const dir2 = path10.dirname(filePath);
+  const dir2 = path11.dirname(filePath);
   try {
-    await fs8.mkdir(dir2, { recursive: true });
+    await fs9.mkdir(dir2, { recursive: true });
   } catch (e) {
     return { ok: false, reason: `failed_to_create_dir: ${String(e?.message || e)}` };
   }
   try {
-    await fs8.access(dir2, FS_CONSTANTS.W_OK);
+    await fs9.access(dir2, FS_CONSTANTS.W_OK);
   } catch (e) {
     return { ok: false, reason: `dir_not_writable: ${String(e?.message || e)}` };
   }
   try {
-    await fs8.access(filePath, FS_CONSTANTS.W_OK);
+    await fs9.access(filePath, FS_CONSTANTS.W_OK);
     return { ok: true };
   } catch {
     return { ok: true };
@@ -75752,7 +76090,7 @@ async function checkWritableFile(filePath) {
 var FsAccessLive = succeed10(FsAccess, {
   isFile: (filePath) => tryPromise2({
     try: async () => {
-      const st = await fs8.stat(filePath);
+      const st = await fs9.stat(filePath);
       return st.isFile();
     },
     catch: (e) => e
@@ -75767,8 +76105,270 @@ var FsAccessLive = succeed10(FsAccess, {
   }).pipe(catchAll2(() => succeed8({ ok: false, reason: "unknown_error" })))
 });
 
+// src/services/PluginServerFiles.ts
+import { promises as fs10 } from "node:fs";
+import path12 from "node:path";
+class PluginServerFiles extends Tag2("PluginServerFiles")() {
+}
+function ensureDir5(p3) {
+  return fs10.mkdir(path12.dirname(p3), { recursive: true }).then(() => {
+    return;
+  });
+}
+function defaultPidFile3() {
+  const envPidFile = process.env.REMNOTE_PLUGIN_SERVER_PID_FILE;
+  if (typeof envPidFile === "string" && envPidFile.trim())
+    return resolveUserFilePath(envPidFile);
+  return path12.join(homeDir(), ".agent-remnote", "plugin-server.pid");
+}
+function defaultLogFile3() {
+  const envLogFile = process.env.REMNOTE_PLUGIN_SERVER_LOG_FILE;
+  if (typeof envLogFile === "string" && envLogFile.trim())
+    return resolveUserFilePath(envLogFile);
+  return path12.join(homeDir(), ".agent-remnote", "plugin-server.log");
+}
+function defaultStateFile3() {
+  const envStateFile = process.env.REMNOTE_PLUGIN_SERVER_STATE_FILE;
+  if (typeof envStateFile === "string" && envStateFile.trim())
+    return resolveUserFilePath(envStateFile);
+  return path12.join(homeDir(), ".agent-remnote", "plugin-server.state.json");
+}
+function parseJson3(raw4, filePath) {
+  try {
+    return JSON.parse(raw4);
+  } catch (error4) {
+    throw new CliError({
+      code: "INTERNAL",
+      message: `Failed to parse JSON file: ${filePath}`,
+      exitCode: 1,
+      details: { file_path: filePath, error: String(error4?.message || error4) }
+    });
+  }
+}
+var PluginServerFilesLive = succeed10(PluginServerFiles, {
+  defaultPidFile: defaultPidFile3,
+  defaultLogFile: defaultLogFile3,
+  defaultStateFile: defaultStateFile3,
+  readPidFile: (pidFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      const raw4 = await fs10.readFile(resolved, "utf8");
+      return parseJson3(raw4, resolved);
+    },
+    catch: (error4) => {
+      const code2 = error4?.code;
+      if (code2 === "ENOENT")
+        return;
+      if (isCliError(error4))
+        return error4;
+      return new CliError({
+        code: "INTERNAL",
+        message: "Failed to read plugin server pid file",
+        exitCode: 1,
+        details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+      });
+    }
+  }).pipe(catchAll2((error4) => {
+    if (error4 === undefined)
+      return succeed8(undefined);
+    return fail8(error4);
+  })),
+  writePidFile: (pidFilePath, value8) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      await ensureDir5(resolved);
+      await fs10.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
+`, "utf8");
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to write plugin server pid file",
+      exitCode: 1,
+      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  deletePidFile: (pidFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(pidFilePath);
+      await fs10.rm(resolved, { force: true });
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to delete plugin server pid file",
+      exitCode: 1,
+      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  readStateFile: (stateFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      const raw4 = await fs10.readFile(resolved, "utf8");
+      return parseJson3(raw4, resolved);
+    },
+    catch: (error4) => {
+      const code2 = error4?.code;
+      if (code2 === "ENOENT")
+        return;
+      if (isCliError(error4))
+        return error4;
+      return new CliError({
+        code: "INTERNAL",
+        message: "Failed to read plugin server state file",
+        exitCode: 1,
+        details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+      });
+    }
+  }).pipe(catchAll2((error4) => {
+    if (error4 === undefined)
+      return succeed8(undefined);
+    return fail8(error4);
+  })),
+  writeStateFile: (stateFilePath, value8) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      await ensureDir5(resolved);
+      await fs10.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
+`, "utf8");
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to write plugin server state file",
+      exitCode: 1,
+      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+    })
+  }),
+  deleteStateFile: (stateFilePath) => tryPromise2({
+    try: async () => {
+      const resolved = resolveUserFilePath(stateFilePath);
+      await fs10.rm(resolved, { force: true });
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: "Failed to delete plugin server state file",
+      exitCode: 1,
+      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
+    })
+  })
+});
+
+// src/services/Process.ts
+import { execFile, spawn as spawn2 } from "node:child_process";
+import fs11 from "node:fs";
+import path13 from "node:path";
+class Process extends Tag2("Process")() {
+}
+function ensureDirSync(filePath) {
+  fs11.mkdirSync(path13.dirname(filePath), { recursive: true });
+}
+var ProcessLive = succeed10(Process, {
+  isPidRunning: (pid) => sync3(() => {
+    if (!Number.isFinite(pid) || pid <= 0)
+      return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error4) {
+      if (error4?.code === "EPERM")
+        return true;
+      return false;
+    }
+  }),
+  getCommandLine: (pid) => async((resume2) => {
+    if (!Number.isFinite(pid) || pid <= 0) {
+      resume2(succeed8(undefined));
+      return;
+    }
+    const finish = (value8) => resume2(succeed8(value8));
+    if (process.platform === "win32") {
+      execFile("powershell.exe", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CommandLine`], { windowsHide: true }, (error4, stdout2) => {
+        if (error4) {
+          finish(undefined);
+          return;
+        }
+        const text15 = String(stdout2 ?? "").trim();
+        finish(text15 || undefined);
+      });
+      return;
+    }
+    execFile("ps", ["-p", String(pid), "-o", "command="], (error4, stdout2) => {
+      if (error4) {
+        finish(undefined);
+        return;
+      }
+      const text15 = String(stdout2 ?? "").trim();
+      finish(text15 || undefined);
+    });
+  }),
+  spawnDetached: (params3) => try_3({
+    try: () => {
+      ensureDirSync(params3.logFile);
+      const fd = fs11.openSync(params3.logFile, "a");
+      const child = spawn2(params3.command, [...params3.args], {
+        cwd: params3.cwd,
+        env: params3.env,
+        detached: true,
+        stdio: ["ignore", fd, fd]
+      });
+      child.unref();
+      return child.pid;
+    },
+    catch: (error4) => {
+      if (isCliError(error4))
+        return error4;
+      return new CliError({
+        code: "INTERNAL",
+        message: "Failed to start background process",
+        exitCode: 1,
+        details: { error: String(error4?.message || error4) }
+      });
+    }
+  }).pipe(flatMap9((pid) => {
+    if (typeof pid !== "number" || !Number.isFinite(pid)) {
+      return fail8(new CliError({
+        code: "INTERNAL",
+        message: "Failed to start background process (pid is unavailable)",
+        exitCode: 1
+      }));
+    }
+    return succeed8(pid);
+  })),
+  kill: (pid, signal) => try_3({
+    try: () => {
+      process.kill(pid, signal);
+    },
+    catch: (error4) => new CliError({
+      code: "INTERNAL",
+      message: `Failed to send signal (${signal})`,
+      exitCode: 1,
+      details: { pid, signal, error: String(error4?.message || error4) }
+    })
+  }),
+  waitForExit: ({ pid, timeoutMs }) => async((resume2) => {
+    const deadline = Date.now() + Math.max(0, timeoutMs);
+    const tick2 = () => {
+      let alive = false;
+      try {
+        process.kill(pid, 0);
+        alive = true;
+      } catch (error4) {
+        alive = error4?.code === "EPERM";
+      }
+      if (!alive) {
+        resume2(succeed8(true));
+        return;
+      }
+      if (Date.now() >= deadline) {
+        resume2(succeed8(false));
+        return;
+      }
+      setTimeout(tick2, 100);
+    };
+    tick2();
+  })
+});
+
 // src/lib/tmux.ts
-import { spawn as spawn2, spawnSync } from "node:child_process";
+import { spawn as spawn3, spawnSync } from "node:child_process";
 function envTmuxRefreshEnabled() {
   const raw4 = String(process.env.REMNOTE_TMUX_REFRESH || process.env.TMUX_REFRESH || "").trim().toLowerCase();
   if (raw4 === "0" || raw4 === "false" || raw4 === "off" || raw4 === "no")
@@ -75805,13 +76405,13 @@ function refreshNow() {
   try {
     if (clients) {
       for (const clientName of clients) {
-        const child = spawn2("tmux", ["refresh-client", "-S", "-t", clientName], { stdio: "ignore" });
+        const child = spawn3("tmux", ["refresh-client", "-S", "-t", clientName], { stdio: "ignore" });
         child.on("error", () => {});
         child.unref();
       }
       return;
     }
-    const fallback = spawn2("tmux", ["refresh-client", "-S"], { stdio: "ignore" });
+    const fallback = spawn3("tmux", ["refresh-client", "-S"], { stdio: "ignore" });
     fallback.on("error", () => {});
     fallback.unref();
   } catch {}
@@ -75860,21 +76460,21 @@ function buildDbFallbackNextAction(queryText) {
 }
 
 // src/lib/wsDebug.ts
-import fs9 from "node:fs";
-import path11 from "node:path";
+import fs12 from "node:fs";
+import path14 from "node:path";
 function envDebug() {
   const v = (process.env.REMNOTE_WS_DEBUG || process.env.WS_DEBUG || "").toLowerCase();
   return v === "1" || v === "true";
 }
 function envLogFilePath(params3) {
   const p3 = process.env.REMNOTE_WS_LOGFILE || process.env.WS_LOGFILE || "";
-  const def = params3.debug ? path11.join(homeDir(), ".agent-remnote", "ws-debug.log") : "";
+  const def = params3.debug ? path14.join(homeDir(), ".agent-remnote", "ws-debug.log") : "";
   const out = p3 && p3.trim() || def;
   if (!out)
     return;
   try {
     const resolved = resolveUserFilePath(out);
-    fs9.mkdirSync(path11.dirname(resolved), { recursive: true });
+    fs12.mkdirSync(path14.dirname(resolved), { recursive: true });
     return resolved;
   } catch {
     return;
@@ -75906,19 +76506,19 @@ function wsLog(level, msg, ctx) {
   if (!LOG_FILE)
     return;
   try {
-    fs9.appendFileSync(LOG_FILE, `${new Date().toISOString()} ${line4}
+    fs12.appendFileSync(LOG_FILE, `${new Date().toISOString()} ${line4}
 `);
   } catch {}
 }
 
 // src/internal/queue/db.ts
-import path13 from "node:path";
+import path16 from "node:path";
 
 // src/internal/store/db.ts
 import Database from "better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
 import { constants as constants2, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import path12 from "node:path";
+import path15 from "node:path";
 
 // src/internal/store/migrations/0001-baseline.ts
 var migration = {
@@ -76439,7 +77039,7 @@ CREATE INDEX IF NOT EXISTS idx_task_runs_queue_txn_id
   ON task_runs(queue_txn_id);
 `;
 function absoluteDefaultStorePath() {
-  return path12.join(homeDir(), ".agent-remnote", "store.sqlite");
+  return path15.join(homeDir(), ".agent-remnote", "store.sqlite");
 }
 function defaultStorePath() {
   const env2 = process.env.REMNOTE_STORE_DB || process.env.STORE_DB;
@@ -76451,15 +77051,15 @@ function defaultLegacyQueuePath() {
   const env2 = process.env.REMNOTE_QUEUE_DB || process.env.QUEUE_DB;
   if (typeof env2 === "string" && env2.trim())
     return resolveUserFilePath(env2);
-  return path12.join(homeDir(), ".agent-remnote", "queue.sqlite");
+  return path15.join(homeDir(), ".agent-remnote", "queue.sqlite");
 }
-function ensureDir4(filePath) {
-  const dir2 = path12.dirname(filePath);
+function ensureDir6(filePath) {
+  const dir2 = path15.dirname(filePath);
   mkdirSync(dir2, { recursive: true });
 }
 function openStoreDb(dbPath = defaultStorePath()) {
   const resolvedPath = resolveUserFilePath(dbPath);
-  ensureDir4(resolvedPath);
+  ensureDir6(resolvedPath);
   maybeInitializeDefaultStoreFromLegacy(resolvedPath, { callerProvidedPath: dbPath });
   const db = new Database(resolvedPath);
   db.pragma("busy_timeout = 5000");
@@ -76796,7 +77396,7 @@ function maybeInitializeDefaultStoreFromLegacy(resolvedStorePath, params3) {
   if (!existsSync(legacyPath))
     return;
   const tmpPath = `${resolvedStorePath}.tmp.${process.pid}.${randomUUID()}`;
-  ensureDir4(tmpPath);
+  ensureDir6(tmpPath);
   try {
     const source = new Database(legacyPath, { readonly: true });
     try {
@@ -76931,10 +77531,10 @@ function defaultQueuePath() {
   const env2 = process.env.REMNOTE_QUEUE_DB || process.env.QUEUE_DB;
   if (typeof env2 === "string" && env2.trim())
     return resolveUserFilePath(env2);
-  return path13.join(homeDir(), ".agent-remnote", "queue.sqlite");
+  return path16.join(homeDir(), ".agent-remnote", "queue.sqlite");
 }
-function ensureDir5(filePath) {
-  ensureDir4(filePath);
+function ensureDir7(filePath) {
+  ensureDir6(filePath);
 }
 function queueErrorFromStoreSchema(dbPath, error4) {
   const code2 = error4.code === "STORE_SCHEMA_NEWER" ? "QUEUE_SCHEMA_NEWER" : error4.code === "STORE_SCHEMA_INVALID" ? "QUEUE_SCHEMA_INVALID" : "QUEUE_SCHEMA_UNKNOWN";
@@ -76947,7 +77547,7 @@ function queueErrorFromStoreSchema(dbPath, error4) {
 }
 function openQueueDb(dbPath = defaultQueuePath()) {
   const resolvedPath = resolveUserFilePath(dbPath);
-  ensureDir5(resolvedPath);
+  ensureDir7(resolvedPath);
   try {
     return openStoreDb(resolvedPath);
   } catch (e) {
@@ -77305,18 +77905,18 @@ function getFirstString(payload, keys8) {
   }
   return null;
 }
-function getFirstStringFromNested(payload, path14) {
+function getFirstStringFromNested(payload, path17) {
   let cur = payload;
-  for (const k of path14) {
+  for (const k of path17) {
     if (!cur || typeof cur !== "object")
       return null;
     cur = cur[k];
   }
   return asNonEmptyString(cur);
 }
-function getStringArrayFromNested(payload, path14) {
+function getStringArrayFromNested(payload, path17) {
   let cur = payload;
-  for (const k of path14) {
+  for (const k of path17) {
     if (!cur || typeof cur !== "object")
       return [];
     cur = cur[k];
@@ -78660,38 +79260,38 @@ function idFieldPathsForOpType(opTypeRaw) {
   return Array.isArray(entry.id_fields) ? entry.id_fields : [];
 }
 // src/kernel/op-catalog/pathWalk.ts
-function parsePathTokens(path14) {
-  return path14.split(".").map((part) => part.trim()).filter(Boolean).map((part) => {
+function parsePathTokens(path17) {
+  return path17.split(".").map((part) => part.trim()).filter(Boolean).map((part) => {
     const isArray2 = part.endsWith("[]");
     const key = isArray2 ? part.slice(0, -2).trim() : part;
     return { key, isArray: isArray2 };
   }).filter((token) => token.key.length > 0);
 }
-function collectLeafValues(value8, path14, idx = 0) {
-  if (idx >= path14.length)
+function collectLeafValues(value8, path17, idx = 0) {
+  if (idx >= path17.length)
     return [value8];
   if (!value8 || typeof value8 !== "object")
     return [];
-  const token = path14[idx];
+  const token = path17[idx];
   const next4 = value8[token.key];
   if (token.isArray) {
     if (!Array.isArray(next4))
       return [];
     const out = [];
     for (const item of next4) {
-      out.push(...collectLeafValues(item, path14, idx + 1));
+      out.push(...collectLeafValues(item, path17, idx + 1));
     }
     return out;
   }
-  return collectLeafValues(next4, path14, idx + 1);
+  return collectLeafValues(next4, path17, idx + 1);
 }
-function mapLeafValuesInPlace(value8, path14, mapFn, idx = 0) {
-  if (idx >= path14.length)
+function mapLeafValuesInPlace(value8, path17, mapFn, idx = 0) {
+  if (idx >= path17.length)
     return;
   if (!value8 || typeof value8 !== "object")
     return;
-  const token = path14[idx];
-  const isLeaf = idx === path14.length - 1;
+  const token = path17[idx];
+  const isLeaf = idx === path17.length - 1;
   if (token.isArray) {
     const next4 = value8[token.key];
     if (!Array.isArray(next4))
@@ -78701,7 +79301,7 @@ function mapLeafValuesInPlace(value8, path14, mapFn, idx = 0) {
       return;
     }
     for (const item of next4) {
-      mapLeafValuesInPlace(item, path14, mapFn, idx + 1);
+      mapLeafValuesInPlace(item, path17, mapFn, idx + 1);
     }
     return;
   }
@@ -78709,7 +79309,7 @@ function mapLeafValuesInPlace(value8, path14, mapFn, idx = 0) {
     value8[token.key] = mapFn(value8[token.key]);
     return;
   }
-  mapLeafValuesInPlace(value8[token.key], path14, mapFn, idx + 1);
+  mapLeafValuesInPlace(value8[token.key], path17, mapFn, idx + 1);
 }
 
 // src/kernel/op-catalog/substituteIds.ts
@@ -78731,8 +79331,8 @@ function collectTempIdsFromPayload(opTypeRaw, payload) {
   if (!payload || typeof payload !== "object")
     return [];
   const out = [];
-  for (const path14 of idFieldPathsForOpType(opTypeRaw)) {
-    const tokens = parsePathTokens(path14);
+  for (const path17 of idFieldPathsForOpType(opTypeRaw)) {
+    const tokens = parsePathTokens(path17);
     if (tokens.length === 0)
       continue;
     const values5 = collectLeafValues(payload, tokens);
@@ -78747,8 +79347,8 @@ function substituteTempIdsInPayload(opTypeRaw, payload, idMap) {
   if (!payload || typeof payload !== "object")
     return payload;
   const out = cloneJson(payload);
-  for (const path14 of idFieldPathsForOpType(opTypeRaw)) {
-    const tokens = parsePathTokens(path14);
+  for (const path17 of idFieldPathsForOpType(opTypeRaw)) {
+    const tokens = parsePathTokens(path17);
     if (tokens.length === 0)
       continue;
     mapLeafValuesInPlace(out, tokens, (value8) => {
@@ -80149,8 +80749,8 @@ function toWsBridgeClient2(client) {
 var GLOBAL_BRIDGE_KEY = Symbol.for("__REMNOTE_WS_BRIDGE__");
 // src/internal/remdb-tools/shared.ts
 import BetterSqlite3 from "better-sqlite3";
-import { promises as fs10 } from "fs";
-import path14 from "path";
+import { promises as fs13 } from "fs";
+import path17 from "path";
 
 // ../../node_modules/date-fns/constants.js
 var daysInYear = 365.2425;
@@ -81639,18 +82239,18 @@ async function withResolvedDatabase(dbPath, fn) {
 async function resolveDatabasePath(dbPath) {
   if (dbPath) {
     const expanded = expandHome2(dbPath.trim());
-    const stat3 = await fs10.stat(expanded);
+    const stat3 = await fs13.stat(expanded);
     if (!stat3.isFile()) {
       throw new Error(`${expanded} is not a file`);
     }
     return {
       dbPath: expanded,
       source: "explicit",
-      baseDir: path14.dirname(expanded)
+      baseDir: path17.dirname(expanded)
     };
   }
-  const baseDir = path14.join(homeDir(), REMNOTE_RELATIVE_DIR);
-  const entries2 = await fs10.readdir(baseDir, { withFileTypes: true }).catch(() => {
+  const baseDir = path17.join(homeDir(), REMNOTE_RELATIVE_DIR);
+  const entries2 = await fs13.readdir(baseDir, { withFileTypes: true }).catch(() => {
     throw new Error(`RemNote directory ${baseDir} not found – please specify dbPath manually`);
   });
   const candidates = [];
@@ -81663,9 +82263,9 @@ async function resolveDatabasePath(dbPath) {
     const isSecondary = SECONDARY_DIRS.has(entry.name);
     if (!isPrimary && !isSecondary)
       continue;
-    const candidatePath = path14.join(baseDir, entry.name, REMNOTE_DB_NAME);
+    const candidatePath = path17.join(baseDir, entry.name, REMNOTE_DB_NAME);
     try {
-      const stat3 = await fs10.stat(candidatePath);
+      const stat3 = await fs13.stat(candidatePath);
       candidates.push({
         dbPath: candidatePath,
         dirName: entry.name,
@@ -81696,18 +82296,18 @@ async function discoverBackups(basePath) {
   const backups = [];
   let entries2;
   try {
-    entries2 = await fs10.readdir(basePath, { withFileTypes: true });
+    entries2 = await fs13.readdir(basePath, { withFileTypes: true });
   } catch (error4) {
     throw new Error(`Unable to read ${basePath}: ${String(error4)}`);
   }
   for (const entry of entries2) {
     if (!entry.isDirectory())
       continue;
-    const accountDir = path14.join(basePath, entry.name);
-    const backupDir = path14.join(accountDir, "backups");
+    const accountDir = path17.join(basePath, entry.name);
+    const backupDir = path17.join(accountDir, "backups");
     let backupFiles;
     try {
-      backupFiles = await fs10.readdir(backupDir, { withFileTypes: true });
+      backupFiles = await fs13.readdir(backupDir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -81716,8 +82316,8 @@ async function discoverBackups(basePath) {
         continue;
       if (!file6.name.endsWith(".db") && !file6.name.endsWith(".db.zip"))
         continue;
-      const fullPath = path14.join(backupDir, file6.name);
-      const stat3 = await fs10.stat(fullPath);
+      const fullPath = path17.join(backupDir, file6.name);
+      const stat3 = await fs13.stat(fullPath);
       backups.push({
         accountDir: entry.name,
         file: file6.name,
@@ -81838,8 +82438,8 @@ function parseOrThrow(schema2, input, options6) {
   throw new Error(prefix2 + lines3.join("; "));
 }
 function formatZodIssueEN(issue) {
-  const path15 = issue.path && issue.path.length > 0 ? issue.path.join(".") : undefined;
-  const where = path15 ? `field ${path15}: ` : "";
+  const path18 = issue.path && issue.path.length > 0 ? issue.path.join(".") : undefined;
+  const where = path18 ? `field ${path18}: ` : "";
   switch (issue.code) {
     case "invalid_type": {
       const expected = toENType(issue.expected);
@@ -82291,8 +82891,8 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 var makeIssue = (params3) => {
-  const { data, path: path15, errorMaps, issueData } = params3;
-  const fullPath = [...path15, ...issueData.path || []];
+  const { data, path: path18, errorMaps, issueData } = params3;
+  const fullPath = [...path18, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -82420,11 +83020,11 @@ var _ZodEnum_cache;
 var _ZodNativeEnum_cache;
 
 class ParseInputLazyPath {
-  constructor(parent, value8, path15, key) {
+  constructor(parent, value8, path18, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value8;
-    this._path = path15;
+    this._path = path18;
     this._key = key;
   }
   get path() {
@@ -85801,7 +86401,7 @@ var z = /* @__PURE__ */ Object.freeze({
 });
 
 // src/internal/remdb-tools/listRemBackups.ts
-import path15 from "node:path";
+import path18 from "node:path";
 var inputShape = {
   basePath: z.string().optional().describe("RemNote base directory (default: ~/remnote)"),
   limit: z.number().int().min(1).max(200).optional().describe("Max backups to return (default 50)")
@@ -85809,7 +86409,7 @@ var inputShape = {
 var listRemBackupsSchema = z.object(inputShape);
 async function executeListRemBackups(params3) {
   const parsed = parseOrThrow(listRemBackupsSchema, params3, { label: "list_rem_backups" });
-  const basePath = expandHome2(parsed.basePath ?? path15.join(homeDir(), REMNOTE_RELATIVE_DIR));
+  const basePath = expandHome2(parsed.basePath ?? path18.join(homeDir(), REMNOTE_RELATIVE_DIR));
   const backups = await discoverBackups(basePath);
   const limit = parsed.limit ?? 50;
   return {
@@ -85819,6 +86419,7 @@ async function executeListRemBackups(params3) {
   };
 }
 // src/internal/remdb-tools/searchRemOverview.ts
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { isMainThread, parentPort as parentPort2, workerData } from "node:worker_threads";
 
 // src/internal/remdb-tools/timeFilters.ts
@@ -86098,6 +86699,21 @@ class HardTimeoutError extends Error {
     this.timeoutMs = timeoutMs;
   }
 }
+async function runSearchRemOverviewWorkerJob(job, port3) {
+  if (job.kind === "search_rem_overview") {
+    try {
+      const result = await executeSearchRemOverviewDirect(job.input);
+      port3.postMessage({ ok: true, result });
+    } catch (e) {
+      port3.postMessage({
+        ok: false,
+        error: { message: asErrorMessage(e), stack: e?.stack }
+      });
+    }
+    return;
+  }
+  port3.postMessage({ ok: false, error: { message: "Unknown worker job" } });
+}
 function asErrorMessage(e) {
   return String(e?.message || e || "Unknown error");
 }
@@ -86108,7 +86724,8 @@ async function executeSearchRemOverviewDirect(params3) {
 }
 async function executeSearchRemOverviewWithHardTimeout(params3, timeoutMs) {
   const selfUrl = new URL(import.meta.url);
-  const isSourceMode = selfUrl.protocol === "file:" && selfUrl.pathname.endsWith(".ts");
+  const selfFilePath = selfUrl.protocol === "file:" ? fileURLToPath2(selfUrl) : "";
+  const isSourceMode = selfFilePath.endsWith(".ts");
   if (isSourceMode) {
     return await executeSearchRemOverviewDirect(params3);
   }
@@ -86125,18 +86742,7 @@ if (!isMainThread) {
     throw new Error("Worker parentPort is unavailable");
   }
   const job = workerData ?? { kind: "unknown" };
-  if (job.kind === "search_rem_overview") {
-    executeSearchRemOverviewDirect(job.input).then((result) => {
-      port3.postMessage({ ok: true, result });
-    }, (e) => {
-      port3.postMessage({
-        ok: false,
-        error: { message: asErrorMessage(e), stack: e?.stack }
-      });
-    });
-  } else {
-    port3.postMessage({ ok: false, error: { message: "Unknown worker job" } });
-  }
+  runSearchRemOverviewWorkerJob(job, port3);
 }
 async function executeSearchRemOverview(params3) {
   const parsed = parseOrThrow(searchRemOverviewSchema, params3, { label: "search_rem_overview" });
@@ -87644,10 +88250,10 @@ function fetchDocs(db, rootId, includeDescendants, maxDepth) {
   }
   return rows.map((row) => convertRow(row.id, row.doc));
 }
-function collectReferences(value8, remId, path16, into3) {
+function collectReferences(value8, remId, path19, into3) {
   if (Array.isArray(value8)) {
     value8.forEach((item, index) => {
-      collectReferences(item, remId, [...path16, index], into3);
+      collectReferences(item, remId, [...path19, index], into3);
     });
     return;
   }
@@ -87657,7 +88263,7 @@ function collectReferences(value8, remId, path16, into3) {
       into3.push({
         refId: maybeRef._id,
         remId,
-        path: formatPath2(path16),
+        path: formatPath2(path19),
         tokenKind: classifyToken(maybeRef)
       });
       return;
@@ -87666,13 +88272,13 @@ function collectReferences(value8, remId, path16, into3) {
       into3.push({
         refId: maybeRef._id,
         remId,
-        path: formatPath2(path16),
+        path: formatPath2(path19),
         tokenKind: classifyToken(maybeRef)
       });
       return;
     }
     for (const [key, child] of Object.entries(maybeRef)) {
-      collectReferences(child, remId, [...path16, key], into3);
+      collectReferences(child, remId, [...path19, key], into3);
     }
   }
 }
@@ -87789,8 +88395,8 @@ function buildReferencesMarkdown(remId, guidance, outbound, inbound, includeInbo
       const tokenKind = Array.isArray(ref.tokenKinds) ? `type: ${formatTokenKinds(ref.tokenKinds)}` : "";
       const ancestor = ref.ancestor ? `, ancestor: ${ref.ancestor}` : "";
       const count4 = typeof ref.count === "number" ? `${ref.count} occurrences` : "";
-      const path16 = ref.occurrences ? ref.occurrences[0]?.path ?? null : ref.representativePath;
-      const samplePath = path16 ? `, sample path: ${path16}` : "";
+      const path19 = ref.occurrences ? ref.occurrences[0]?.path ?? null : ref.representativePath;
+      const samplePath = path19 ? `, sample path: ${path19}` : "";
       lines3.push(`- **${name}** (ID: ${ref.refId}, ${count4}${ancestor}${samplePath}${tokenKind ? `, ${tokenKind}` : ""})`);
     });
   }
@@ -91737,107 +92343,559 @@ var WsClientLive = succeed10(WsClient, {
   })
 });
 
-// src/commands/ws/_shared.ts
-import path18 from "node:path";
-
-// src/services/Process.ts
-import { spawn as spawn3 } from "node:child_process";
-import fs11 from "node:fs";
-import path16 from "node:path";
-class Process extends Tag2("Process")() {
-}
-function ensureDirSync(filePath) {
-  fs11.mkdirSync(path16.dirname(filePath), { recursive: true });
+// src/lib/managedRuntimePaths.ts
+import path19 from "node:path";
+function resolveManagedStateFile(params3) {
+  const defaultPath = resolveUserFilePath(params3.defaultStateFilePath);
+  const explicitPath = params3.explicitStateFilePath ? resolveUserFilePath(params3.explicitStateFilePath) : undefined;
+  const candidatePath = params3.candidate ? resolveUserFilePath(params3.candidate) : undefined;
+  if (!candidatePath) {
+    return explicitPath ?? defaultPath;
+  }
+  if (candidatePath === defaultPath)
+    return candidatePath;
+  if (explicitPath && candidatePath === explicitPath)
+    return candidatePath;
+  const pidRoot = path19.dirname(params3.pidFilePath);
+  const rel = path19.relative(pidRoot, candidatePath);
+  if (rel === "" || !rel.startsWith("..") && !path19.isAbsolute(rel)) {
+    return candidatePath;
+  }
+  return explicitPath ?? defaultPath;
+}
+
+// src/lib/pidTrust.ts
+import path20 from "node:path";
+function normalizeToken(value8) {
+  return value8.trim().replace(/\\/g, "/").toLowerCase();
 }
-var ProcessLive = succeed10(Process, {
-  isPidRunning: (pid) => sync3(() => {
-    if (!Number.isFinite(pid) || pid <= 0)
+function collectCommandTokens(raw4) {
+  const out = new Set;
+  for (const item of raw4) {
+    const normalized = normalizeToken(String(item ?? ""));
+    if (!normalized)
+      continue;
+    const unquoted = normalized.replace(/^['"]|['"]$/g, "");
+    const base = path20.basename(unquoted);
+    if (unquoted.includes("agent-remnote") || base.includes("agent-remnote")) {
+      out.add("agent-remnote");
+    }
+    if (base === "node" || base === "node.exe")
+      out.add("node");
+    if (base === "tsx" || base === "tsx.cmd")
+      out.add("tsx");
+    if (base.endsWith(".js") || base.endsWith(".ts"))
+      out.add(base);
+    if (!unquoted.startsWith("-") && !unquoted.includes("/"))
+      out.add(unquoted);
+  }
+  out.add("agent-remnote");
+  return Array.from(out);
+}
+function expectedTokens(record2) {
+  const raw4 = Array.isArray(record2.cmd) ? record2.cmd : [];
+  return collectCommandTokens(raw4);
+}
+function actualTokens(commandLine) {
+  const parts2 = commandLine.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  return new Set(collectCommandTokens(parts2));
+}
+function isTrustedPidRecord(record2) {
+  return gen2(function* () {
+    const proc = yield* Process;
+    const alive = yield* proc.isPidRunning(record2.pid);
+    if (!alive)
       return false;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (error4) {
-      if (error4?.code === "EPERM")
-        return true;
+    if (!proc.getCommandLine)
       return false;
-    }
-  }),
-  spawnDetached: (params3) => try_3({
-    try: () => {
-      ensureDirSync(params3.logFile);
-      const fd = fs11.openSync(params3.logFile, "a");
-      const child = spawn3(params3.command, [...params3.args], {
-        cwd: params3.cwd,
-        env: params3.env,
-        detached: true,
-        stdio: ["ignore", fd, fd]
-      });
-      child.unref();
-      return child.pid;
+    const commandLine = yield* proc.getCommandLine(record2.pid);
+    if (!commandLine)
+      return false;
+    const expected = expectedTokens(record2);
+    const actual = actualTokens(commandLine);
+    return expected.every((token) => actual.has(token));
+  });
+}
+function requireTrustedPidRecord(params3) {
+  return gen2(function* () {
+    const trusted = yield* isTrustedPidRecord(params3.record);
+    if (trusted)
+      return;
+    return yield* fail8(new CliError({
+      code: "INTERNAL",
+      message: "Refusing to operate on a pidfile that does not match a live agent-remnote process",
+      exitCode: 1,
+      details: {
+        pid: params3.record.pid,
+        pid_file: params3.pidFilePath,
+        cmd: params3.record.cmd ?? []
+      }
+    }));
+  });
+}
+
+// src/lib/statuslineArtifacts.ts
+import { promises as fs15 } from "node:fs";
+
+// src/services/StatusLineFile.ts
+import { promises as fs14 } from "node:fs";
+import path21 from "node:path";
+class StatusLineFile extends Tag2("StatusLineFile")() {
+}
+function defaultTextFile() {
+  return path21.join(homeDir(), ".agent-remnote", "status-line.txt");
+}
+function defaultJsonFile() {
+  return path21.join(homeDir(), ".agent-remnote", "status-line.json");
+}
+function ensureDir8(p3) {
+  return fs14.mkdir(path21.dirname(p3), { recursive: true }).then(() => {
+    return;
+  });
+}
+async function readFileOrEmpty(filePath) {
+  try {
+    return await fs14.readFile(filePath, "utf8");
+  } catch (e) {
+    if (e?.code === "ENOENT")
+      return "";
+    throw e;
+  }
+}
+async function writeTextAtomic(filePath, content) {
+  await ensureDir8(filePath);
+  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  await fs14.writeFile(tmp, content, "utf8");
+  await fs14.rename(tmp, filePath);
+}
+var StatusLineFileLive = succeed10(StatusLineFile, {
+  defaultTextFile: () => defaultTextFile(),
+  defaultJsonFile: () => defaultJsonFile(),
+  write: ({ text: text15, textFilePath, debug: debug2, jsonFilePath, json: json4 }) => tryPromise2({
+    try: async () => {
+      const resolvedTextFile = resolveUserFilePath(textFilePath ?? defaultTextFile());
+      const normalizedText = text15.trimEnd();
+      const desired = normalizedText.length > 0 ? `${normalizedText}
+` : "";
+      const existing = await readFileOrEmpty(resolvedTextFile);
+      if (existing === desired)
+        return { wrote: false, textFilePath: resolvedTextFile };
+      await writeTextAtomic(resolvedTextFile, desired);
+      if (debug2 === true) {
+        const resolvedJsonFile = resolveUserFilePath(jsonFilePath ?? defaultJsonFile());
+        const payload = json4 !== undefined ? json4 : { text: normalizedText };
+        await writeTextAtomic(resolvedJsonFile, `${JSON.stringify(payload)}
+`);
+      }
+      return { wrote: true, textFilePath: resolvedTextFile };
     },
     catch: (error4) => {
       if (isCliError(error4))
         return error4;
       return new CliError({
         code: "INTERNAL",
-        message: "Failed to start background process",
+        message: "Failed to write status line file",
         exitCode: 1,
         details: { error: String(error4?.message || error4) }
       });
     }
-  }).pipe(flatMap9((pid) => {
-    if (typeof pid !== "number" || !Number.isFinite(pid)) {
-      return fail8(new CliError({
-        code: "INTERNAL",
-        message: "Failed to start background process (pid is unavailable)",
-        exitCode: 1
-      }));
+  })
+});
+
+// src/lib/statuslineArtifacts.ts
+function normalizeOptionalPath(value8) {
+  if (typeof value8 !== "string")
+    return;
+  const t = value8.trim();
+  return t.length > 0 ? resolveUserFilePath(t) : undefined;
+}
+function resolveStatuslineArtifactPaths(params3) {
+  const pidInfo = params3.pidInfo;
+  const wsBridgeStateFilePath = normalizeOptionalPath(pidInfo?.ws_bridge_state_file) ?? params3.cfg.wsStateFile.path;
+  const statusLineFilePath = normalizeOptionalPath(pidInfo?.status_line_file) ?? params3.cfg.statusLineFile;
+  const statusLineJsonFilePath = normalizeOptionalPath(pidInfo?.status_line_json_file) ?? params3.cfg.statusLineJsonFile;
+  return { wsBridgeStateFilePath, statusLineFilePath, statusLineJsonFilePath };
+}
+function deleteFileIfExists(filePath) {
+  return promise2(async () => {
+    try {
+      await fs15.unlink(filePath);
+      return { action: "deleted", file: filePath };
+    } catch (e) {
+      if (e?.code === "ENOENT")
+        return { action: "skipped", file: filePath };
+      return { action: "failed", file: filePath, error: String(e?.message || e) };
     }
-    return succeed8(pid);
-  })),
-  kill: (pid, signal) => try_3({
-    try: () => {
-      process.kill(pid, signal);
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: `Failed to send signal (${signal})`,
-      exitCode: 1,
-      details: { pid, signal, error: String(error4?.message || error4) }
-    })
-  }),
-  waitForExit: ({ pid, timeoutMs }) => async((resume2) => {
-    const deadline = Date.now() + Math.max(0, timeoutMs);
-    const tick2 = () => {
-      let alive = false;
-      try {
-        process.kill(pid, 0);
-        alive = true;
-      } catch (error4) {
-        alive = error4?.code === "EPERM";
+  });
+}
+function cleanupStatuslineArtifacts(paths) {
+  return gen2(function* () {
+    const statusLineFile = yield* StatusLineFile;
+    const wsBridgeStateFile = yield* deleteFileIfExists(paths.wsBridgeStateFilePath);
+    const cleared = yield* statusLineFile.write({ text: "", textFilePath: paths.statusLineFilePath, debug: false }).pipe(either3);
+    const statusLineFileOutcome = cleared._tag === "Right" ? cleared.right.wrote ? { action: "cleared", file: cleared.right.textFilePath } : { action: "skipped", file: cleared.right.textFilePath } : {
+      action: "failed",
+      file: paths.statusLineFilePath,
+      error: String(cleared.left?.message || cleared.left)
+    };
+    const statusLineJsonFile = yield* deleteFileIfExists(paths.statusLineJsonFilePath);
+    return { wsBridgeStateFile, statusLineFile: statusLineFileOutcome, statusLineJsonFile };
+  });
+}
+
+// src/lib/doctor/fixes.ts
+function applyDoctorFixes() {
+  return gen2(function* () {
+    const cfg = yield* AppConfig;
+    const daemonFiles = yield* DaemonFiles;
+    const apiFiles = yield* ApiDaemonFiles;
+    const pluginFiles = yield* PluginServerFiles;
+    const supervisorState = yield* SupervisorState;
+    const proc = yield* Process;
+    const userConfig = yield* UserConfigFile;
+    let changed = false;
+    const fixes = [];
+    const cleaned = [];
+    const cleanupFailures = [];
+    const daemonPidFile = daemonFiles.defaultPidFile();
+    const daemonPidInfo = yield* daemonFiles.readPidFile(daemonPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (daemonPidInfo?.pid && !(yield* isTrustedPidRecord(daemonPidInfo))) {
+      const daemonStateFile = resolveManagedStateFile({
+        pidFilePath: daemonPidFile,
+        defaultStateFilePath: supervisorState.defaultStateFile(),
+        candidate: daemonPidInfo.state_file
+      });
+      const result = yield* gen2(function* () {
+        yield* daemonFiles.deletePidFile(daemonPidFile);
+        yield* supervisorState.deleteStateFile(daemonStateFile);
+        return yield* cleanupStatuslineArtifacts(resolveStatuslineArtifactPaths({ cfg, pidInfo: daemonPidInfo }));
+      }).pipe(either3);
+      if (result._tag === "Right") {
+        cleaned.push({ service: "daemon", pidFile: daemonPidFile, stateFile: daemonStateFile, pid: daemonPidInfo.pid });
+        changed = true;
+      } else {
+        cleanupFailures.push({
+          service: "daemon",
+          pidFile: daemonPidFile,
+          stateFile: daemonStateFile,
+          pid: daemonPidInfo.pid,
+          error: result.left.message
+        });
       }
-      if (!alive) {
-        resume2(succeed8(true));
-        return;
+    }
+    const apiPidFile = apiFiles.defaultPidFile();
+    const apiPidInfo = yield* apiFiles.readPidFile(apiPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (apiPidInfo?.pid && !(yield* isTrustedPidRecord(apiPidInfo))) {
+      const apiStateFile = resolveManagedStateFile({
+        pidFilePath: apiPidFile,
+        defaultStateFilePath: apiFiles.defaultStateFile(),
+        candidate: apiPidInfo.state_file
+      });
+      const result = yield* gen2(function* () {
+        yield* apiFiles.deletePidFile(apiPidFile);
+        yield* apiFiles.deleteStateFile(apiStateFile);
+      }).pipe(either3);
+      if (result._tag === "Right") {
+        cleaned.push({ service: "api", pidFile: apiPidFile, stateFile: apiStateFile, pid: apiPidInfo.pid });
+        changed = true;
+      } else {
+        cleanupFailures.push({
+          service: "api",
+          pidFile: apiPidFile,
+          stateFile: apiStateFile,
+          pid: apiPidInfo.pid,
+          error: result.left.message
+        });
       }
-      if (Date.now() >= deadline) {
-        resume2(succeed8(false));
-        return;
+    }
+    const pluginPidFile = pluginFiles.defaultPidFile();
+    const pluginPidInfo = yield* pluginFiles.readPidFile(pluginPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (pluginPidInfo?.pid && !(yield* isTrustedPidRecord(pluginPidInfo))) {
+      const pluginStateFile = resolveManagedStateFile({
+        pidFilePath: pluginPidFile,
+        defaultStateFilePath: pluginFiles.defaultStateFile(),
+        candidate: pluginPidInfo.state_file
+      });
+      const result = yield* gen2(function* () {
+        yield* pluginFiles.deletePidFile(pluginPidFile);
+        yield* pluginFiles.deleteStateFile(pluginStateFile);
+      }).pipe(either3);
+      if (result._tag === "Right") {
+        cleaned.push({ service: "plugin", pidFile: pluginPidFile, stateFile: pluginStateFile, pid: pluginPidInfo.pid });
+        changed = true;
+      } else {
+        cleanupFailures.push({
+          service: "plugin",
+          pidFile: pluginPidFile,
+          stateFile: pluginStateFile,
+          pid: pluginPidInfo.pid,
+          error: result.left.message
+        });
       }
-      setTimeout(tick2, 100);
+    }
+    fixes.push({
+      id: "runtime.cleanup_stale_artifacts",
+      ok: cleanupFailures.length === 0,
+      changed: cleaned.length > 0,
+      summary: cleaned.length === 0 && cleanupFailures.length === 0 ? "No stale runtime artifacts needed cleanup" : cleanupFailures.length === 0 ? `Cleaned ${cleaned.length} stale runtime artifact set(s)` : `Cleaned ${cleaned.length} stale runtime artifact set(s); ${cleanupFailures.length} cleanup failure(s) need manual follow-up`,
+      details: {
+        cleaned,
+        failed: cleanupFailures
+      }
+    });
+    const configRepair = yield* userConfig.repair().pipe(either3);
+    if (configRepair._tag === "Right") {
+      if (configRepair.right.changed && configRepair.right.before.valid)
+        changed = true;
+      fixes.push({
+        id: "config.rewrite_canonical_user_config",
+        ok: configRepair.right.before.valid,
+        changed: configRepair.right.before.valid ? configRepair.right.changed : false,
+        summary: !configRepair.right.before.valid ? "Skipped config rewrite because the current config is invalid or conflicting" : configRepair.right.changed ? "Rewrote user config into canonical form" : "User config already canonical",
+        details: {
+          config_file: configRepair.right.configFile,
+          before: configRepair.right.before,
+          after: configRepair.right.after
+        }
+      });
+    } else {
+      fixes.push({
+        id: "config.rewrite_canonical_user_config",
+        ok: false,
+        changed: false,
+        summary: "Failed to rewrite user config",
+        details: { error: configRepair.left.message }
+      });
+    }
+    const restartSummary = {
+      attempted: [],
+      restarted: [],
+      skipped: ["safe_restart_disabled"],
+      failed: []
     };
-    tick2();
-  })
-});
+    fixes.push({
+      id: "runtime.restart_mismatched_services",
+      ok: true,
+      changed: false,
+      summary: "Skipped automatic runtime restart inside doctor --fix to preserve the safe repair boundary",
+      details: restartSummary
+    });
+    return { fixes, changed, restartSummary };
+  });
+}
+
+// src/lib/doctor/checks.ts
+import path26 from "node:path";
+
+// src/lib/builtin-scenarios/index.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import path22 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+var MODULE_DIR = path22.dirname(fileURLToPath3(import.meta.url));
+function locateBuiltinSourceRoot() {
+  const packageRootCandidates = [
+    path22.resolve(MODULE_DIR, "../../../"),
+    path22.resolve(MODULE_DIR, "..")
+  ];
+  for (const packageRoot of packageRootCandidates) {
+    const builtinSourceRoot = path22.join(packageRoot, "builtin-scenarios");
+    if (existsSync2(path22.join(builtinSourceRoot, "catalog.json"))) {
+      return { packageRoot, builtinSourceRoot };
+    }
+  }
+  throw new Error(`Unable to locate builtin-scenarios catalog from ${MODULE_DIR}`);
+}
+var { packageRoot: PACKAGE_ROOT, builtinSourceRoot: BUILTIN_SOURCE_ROOT } = locateBuiltinSourceRoot();
+var REPO_ROOT = path22.resolve(PACKAGE_ROOT, "../..");
+var BUILTIN_CATALOG_PATH = path22.join(BUILTIN_SOURCE_ROOT, "catalog.json");
+var BUILTIN_SOURCE_PREFIX = "packages/agent-remnote/builtin-scenarios/";
+function readJsonFile(filePath) {
+  return JSON.parse(readFileSync2(filePath, "utf8"));
+}
+function resolveRepoPath(relPath) {
+  return path22.resolve(REPO_ROOT, relPath);
+}
+function resolveBuiltinPackagePath(relPath) {
+  const normalized = relPath.replaceAll("\\", "/");
+  if (normalized.startsWith(BUILTIN_SOURCE_PREFIX)) {
+    return path22.resolve(BUILTIN_SOURCE_ROOT, normalized.slice(BUILTIN_SOURCE_PREFIX.length));
+  }
+  return resolveRepoPath(relPath);
+}
+var builtinScenarioCatalog = readJsonFile(BUILTIN_CATALOG_PATH);
+var builtinScenarioPackageCache = new Map;
+var builtinScenarioPackagesTarget = {};
+function loadBuiltinScenarioPackage(entry) {
+  const cached4 = builtinScenarioPackageCache.get(entry.package_id);
+  if (cached4)
+    return cached4;
+  const loaded = readJsonFile(resolveBuiltinPackagePath(entry.package_path));
+  builtinScenarioPackageCache.set(entry.package_id, loaded);
+  return loaded;
+}
+for (const entry of builtinScenarioCatalog) {
+  Object.defineProperty(builtinScenarioPackagesTarget, entry.package_id, {
+    enumerable: true,
+    configurable: false,
+    get: () => loadBuiltinScenarioPackage(entry)
+  });
+}
+var builtinScenarioPackages = Object.freeze(builtinScenarioPackagesTarget);
+function getBuiltinScenarioPackage(id2) {
+  const entry = builtinScenarioCatalog.find((item) => item.package_id === id2);
+  if (!entry) {
+    throw new Error(`Unknown builtin scenario package: ${id2}`);
+  }
+  return loadBuiltinScenarioPackage(entry);
+}
+function getBuiltinScenarioPackageSourcePath(id2) {
+  const entry = builtinScenarioCatalog.find((item) => item.package_id === id2);
+  if (!entry) {
+    throw new Error(`Unknown builtin scenario source: ${id2}`);
+  }
+  return resolveBuiltinPackagePath(entry.package_path);
+}
+
+// src/lib/pluginBuildInfo.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import path24 from "node:path";
+
+// src/lib/pluginArtifacts.ts
+import { existsSync as existsSync3, statSync } from "node:fs";
+import path23 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+function currentDir(moduleUrl) {
+  return path23.dirname(fileURLToPath4(moduleUrl));
+}
+function isDirectory(targetPath) {
+  try {
+    return statSync(targetPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isFile(targetPath) {
+  try {
+    return statSync(targetPath).isFile();
+  } catch {
+    return false;
+  }
+}
+function distCandidates(moduleUrl) {
+  const dir2 = currentDir(moduleUrl);
+  return [
+    path23.resolve(dir2, "../../plugin-artifacts/dist"),
+    path23.resolve(dir2, "../plugin-artifacts/dist"),
+    path23.resolve(dir2, "../../../plugin/dist"),
+    path23.resolve(dir2, "../../plugin/dist")
+  ];
+}
+function zipCandidates(moduleUrl) {
+  const dir2 = currentDir(moduleUrl);
+  return [
+    path23.resolve(dir2, "../../plugin-artifacts/PluginZip.zip"),
+    path23.resolve(dir2, "../plugin-artifacts/PluginZip.zip"),
+    path23.resolve(dir2, "../../../plugin/PluginZip.zip"),
+    path23.resolve(dir2, "../../plugin/PluginZip.zip")
+  ];
+}
+function validateDistPath(targetPath) {
+  return isDirectory(targetPath) && existsSync3(path23.join(targetPath, "manifest.json"));
+}
+function hasBuildInfo(targetPath) {
+  return isFile(path23.join(targetPath, "build-info.json"));
+}
+function resolvePluginDistPath(moduleUrl = import.meta.url) {
+  for (const candidate of distCandidates(moduleUrl)) {
+    if (validateDistPath(candidate) && hasBuildInfo(candidate))
+      return candidate;
+  }
+  for (const candidate of distCandidates(moduleUrl)) {
+    if (validateDistPath(candidate))
+      return candidate;
+  }
+  throw new CliError({
+    code: "DEPENDENCY_MISSING",
+    message: "Plugin build artifacts are unavailable",
+    exitCode: 1,
+    details: { candidates: distCandidates(moduleUrl) },
+    hint: [
+      "Run npm run build --workspace @remnote/plugin in the repository checkout",
+      "Or install a packaged agent-remnote release that includes plugin artifacts"
+    ]
+  });
+}
+function resolvePluginZipPath(moduleUrl = import.meta.url) {
+  for (const candidate of zipCandidates(moduleUrl)) {
+    if (isFile(candidate))
+      return candidate;
+  }
+  throw new CliError({
+    code: "DEPENDENCY_MISSING",
+    message: "Plugin zip artifact is unavailable",
+    exitCode: 1,
+    details: { candidates: zipCandidates(moduleUrl) },
+    hint: [
+      "Run npm run build --workspace @remnote/plugin in the repository checkout",
+      "Or install a packaged agent-remnote release that includes plugin artifacts"
+    ]
+  });
+}
+
+// src/lib/pluginBuildInfo.ts
+function readPluginDistBuildInfo(distPath) {
+  const normalized = typeof distPath === "string" ? distPath.trim() : "";
+  if (!normalized)
+    return null;
+  const target2 = path24.join(normalized, "build-info.json");
+  try {
+    const raw4 = readFileSync3(target2, "utf8");
+    const parsed = JSON.parse(raw4);
+    if (typeof parsed?.name === "string" && typeof parsed?.version === "string" && typeof parsed?.build_id === "string" && typeof parsed?.built_at === "number" && typeof parsed?.source_stamp === "number") {
+      return {
+        name: parsed.name,
+        version: parsed.version,
+        build_id: parsed.build_id,
+        built_at: parsed.built_at,
+        source_stamp: parsed.source_stamp,
+        mode: parsed.mode === "src" || parsed.mode === "dist" || parsed.mode === "unknown" ? parsed.mode : "dist"
+      };
+    }
+  } catch {}
+  return null;
+}
+function currentExpectedPluginBuildInfo() {
+  try {
+    const dist = resolvePluginDistPath();
+    return readPluginDistBuildInfo(dist);
+  } catch {
+    return null;
+  }
+}
+function pluginBuildWarnings(params3) {
+  if (!params3.expected || !params3.live)
+    return [];
+  if (params3.expected.build_id === params3.live.build_id)
+    return [];
+  return [
+    `plugin build mismatch: expected=${params3.expected.build_id} live=${params3.live.build_id}`
+  ];
+}
 
 // src/lib/runtimeBuildInfo.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
-import path17 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import path25 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function packageInfo() {
   try {
-    const raw4 = readFileSync2(new URL("../../package.json", import.meta.url), "utf8");
+    const raw4 = readFileSync4(new URL("../../package.json", import.meta.url), "utf8");
     const parsed = JSON.parse(raw4);
     const name = typeof parsed?.name === "string" && parsed.name.trim() ? parsed.name.trim() : "agent-remnote";
     const version = typeof parsed?.version === "string" && parsed.version.trim() ? parsed.version.trim() : "0.0.0";
@@ -91848,13 +92906,13 @@ function packageInfo() {
 }
 function fileMtimeMs(targetPath) {
   try {
-    return Math.floor(statSync(targetPath).mtimeMs);
+    return Math.floor(statSync2(targetPath).mtimeMs);
   } catch {
     return 0;
   }
 }
 function latestMtimeMs(dirPath) {
-  if (!existsSync2(dirPath))
+  if (!existsSync4(dirPath))
     return 0;
   let max7 = 0;
   const stack = [dirPath];
@@ -91867,10 +92925,10 @@ function latestMtimeMs(dirPath) {
       continue;
     }
     for (const entry of entries2) {
-      const full = path17.join(current2, entry);
+      const full = path25.join(current2, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync2(full);
       } catch {
         continue;
       }
@@ -91896,7 +92954,7 @@ function computeDefaultBuildInfo() {
   const mode = detectMode();
   const srcDir = new URL("../", import.meta.url);
   const packageJson = new URL("../../package.json", import.meta.url);
-  const sourceStamp = Math.max(latestMtimeMs(fileURLToPath2(srcDir)), fileMtimeMs(fileURLToPath2(packageJson)));
+  const sourceStamp = Math.max(latestMtimeMs(fileURLToPath5(srcDir)), fileMtimeMs(fileURLToPath5(packageJson)));
   const buildIdInput = `${pkg.name}
 ${pkg.version}
 ${mode}
@@ -91945,7 +93003,147 @@ function runtimeVersionWarnings(params3) {
   return warnings;
 }
 
+// src/lib/doctor/checks.ts
+function collectDoctorChecks() {
+  return gen2(function* () {
+    const cfg = yield* AppConfig;
+    const daemonFiles = yield* DaemonFiles;
+    const apiFiles = yield* ApiDaemonFiles;
+    const pluginFiles = yield* PluginServerFiles;
+    const userConfig = yield* UserConfigFile;
+    const fsAccess = yield* FsAccess;
+    const staleArtifacts = [];
+    const daemonPidFile = daemonFiles.defaultPidFile();
+    const daemonPidInfo = yield* daemonFiles.readPidFile(daemonPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (daemonPidInfo?.pid && !(yield* isTrustedPidRecord(daemonPidInfo))) {
+      staleArtifacts.push({
+        service: "daemon",
+        pidFile: daemonPidFile,
+        stateFile: daemonPidInfo.state_file ?? path26.join(path26.dirname(daemonPidFile), "ws.state.json"),
+        pid: daemonPidInfo.pid
+      });
+    }
+    const apiPidFile = apiFiles.defaultPidFile();
+    const apiPidInfo = yield* apiFiles.readPidFile(apiPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (apiPidInfo?.pid && !(yield* isTrustedPidRecord(apiPidInfo))) {
+      staleArtifacts.push({
+        service: "api",
+        pidFile: apiPidFile,
+        stateFile: apiPidInfo.state_file ?? apiFiles.defaultStateFile(),
+        pid: apiPidInfo.pid
+      });
+    }
+    const pluginPidFile = pluginFiles.defaultPidFile();
+    const pluginPidInfo = yield* pluginFiles.readPidFile(pluginPidFile).pipe(orElseSucceed2(() => {
+      return;
+    }));
+    if (pluginPidInfo?.pid && !(yield* isTrustedPidRecord(pluginPidInfo))) {
+      staleArtifacts.push({
+        service: "plugin",
+        pidFile: pluginPidFile,
+        stateFile: pluginPidInfo.state_file ?? pluginFiles.defaultStateFile(),
+        pid: pluginPidInfo.pid
+      });
+    }
+    const current2 = currentRuntimeBuildInfo();
+    const expectedPlugin = currentExpectedPluginBuildInfo();
+    const mismatches = [
+      daemonPidInfo?.build?.build_id && daemonPidInfo.build.build_id !== current2.build_id ? { service: "daemon", live: daemonPidInfo.build.build_id } : null,
+      apiPidInfo?.build?.build_id && apiPidInfo.build.build_id !== current2.build_id ? { service: "api", live: apiPidInfo.build.build_id } : null,
+      pluginPidInfo?.build?.build_id && pluginPidInfo.build.build_id !== current2.build_id ? { service: "plugin", live: pluginPidInfo.build.build_id } : null,
+      expectedPlugin && pluginPidInfo?.build?.build_id && pluginPidInfo.build.build_id !== expectedPlugin.build_id ? { service: "plugin-artifact", live: pluginPidInfo.build.build_id, expected: expectedPlugin.build_id } : null
+    ].filter(Boolean);
+    const configPreview = yield* userConfig.previewRepair().pipe(either3);
+    const configChanged = configPreview._tag === "Right" ? configPreview.right.changed : false;
+    const configValid = configPreview._tag === "Right" ? configPreview.right.before.valid : false;
+    const configRepairable = configPreview._tag === "Right" ? configPreview.right.before.valid && configPreview.right.changed : false;
+    const configDetails = configPreview._tag === "Right" ? configPreview.right : { error: configPreview.left.message };
+    const packageCheck = yield* sync3(() => {
+      try {
+        getBuiltinScenarioPackage("dn_recent_todos_to_today_move");
+        getBuiltinScenarioPackage("dn_recent_todos_to_today_portal");
+        return { ok: true, details: undefined };
+      } catch (error4) {
+        return { ok: false, details: { error: String(error4?.message || error4) } };
+      }
+    });
+    const pluginArtifactsCheck = yield* sync3(() => {
+      try {
+        return { ok: true, details: { distPath: resolvePluginDistPath(), zipPath: resolvePluginZipPath() } };
+      } catch (error4) {
+        return { ok: false, details: { error: String(error4?.message || error4) } };
+      }
+    });
+    const pidWritable = yield* fsAccess.canWritePath(daemonPidFile);
+    const logWritable = yield* fsAccess.canWritePath(daemonFiles.defaultLogFile());
+    const storeWritable = yield* fsAccess.checkWritableFile(cfg.storeDb);
+    const pathOk = pidWritable && logWritable && storeWritable.ok;
+    return [
+      {
+        id: "runtime.stale_pid_or_state",
+        ok: staleArtifacts.length === 0,
+        severity: staleArtifacts.length === 0 ? "info" : "warning",
+        summary: staleArtifacts.length === 0 ? "No stale runtime pid/state artifacts" : `Found ${staleArtifacts.length} stale runtime artifact set(s)`,
+        details: staleArtifacts,
+        repairable: staleArtifacts.length > 0
+      },
+      {
+        id: "runtime.version_mismatch",
+        ok: mismatches.length === 0,
+        severity: mismatches.length === 0 ? "info" : "warning",
+        summary: mismatches.length === 0 ? "No runtime build mismatch detected" : `Found ${mismatches.length} runtime build mismatch(es)`,
+        details: mismatches,
+        repairable: mismatches.length > 0
+      },
+      {
+        id: "config.migration_needed",
+        ok: configValid && !configChanged,
+        severity: !configValid ? "error" : configChanged ? "warning" : "info",
+        summary: !configValid ? "User config is invalid or conflicting" : configChanged ? "User config can be canonicalized" : "User config already canonical",
+        details: configDetails,
+        repairable: configRepairable
+      },
+      {
+        id: "package.builtin_scenarios_broken",
+        ok: packageCheck.ok,
+        severity: packageCheck.ok ? "info" : "error",
+        summary: packageCheck.ok ? "Builtin scenarios are loadable" : "Builtin scenario package loading failed",
+        details: packageCheck.details,
+        repairable: !packageCheck.ok
+      },
+      {
+        id: "package.plugin_artifacts_unavailable",
+        ok: pluginArtifactsCheck.ok,
+        severity: pluginArtifactsCheck.ok ? "info" : "error",
+        summary: pluginArtifactsCheck.ok ? "Plugin artifacts are available" : "Plugin artifacts are unavailable",
+        details: pluginArtifactsCheck.details,
+        repairable: false
+      },
+      {
+        id: "env.path_or_permission_problem",
+        ok: pathOk,
+        severity: pathOk ? "info" : "error",
+        summary: pathOk ? "Required writable paths are available" : "One or more required paths are not writable",
+        details: {
+          daemon_pid_file: daemonPidFile,
+          daemon_log_file: daemonFiles.defaultLogFile(),
+          pid_writable: pidWritable,
+          log_writable: logWritable,
+          store_db: cfg.storeDb,
+          store_writable: storeWritable
+        },
+        repairable: false
+      }
+    ];
+  });
+}
+
 // src/commands/ws/_shared.ts
+import path27 from "node:path";
 var WS_HEALTH_TIMEOUT_MS = 2000;
 var WS_START_WAIT_DEFAULT_MS = 15000;
 var WS_STOP_WAIT_DEFAULT_MS = 5000;
@@ -92035,7 +93233,7 @@ function toInitialSupervisorState(now2) {
   };
 }
 function defaultStateFilePathFromPidFile(pidFilePath) {
-  return path18.join(path18.dirname(pidFilePath), "ws.state.json");
+  return path27.join(path27.dirname(pidFilePath), "ws.state.json");
 }
 function startWsSupervisor(params3) {
   return gen2(function* () {
@@ -92054,6 +93252,7 @@ function startWsSupervisor(params3) {
         yield* daemonFiles.deletePidFile(pidFilePath);
         yield* supervisorState.deleteStateFile(stateFilePath);
       } else {
+        yield* requireTrustedPidRecord({ record: existingPidFile, pidFilePath });
         return {
           started: false,
           pid: existingPidFile.pid,
@@ -92117,6 +93316,7 @@ function ensureWsSupervisor(params3) {
       if (existingPidFile) {
         const alive = yield* proc.isPidRunning(existingPidFile.pid);
         if (alive) {
+          yield* requireTrustedPidRecord({ record: existingPidFile, pidFilePath });
           return {
             started: false,
             pid: existingPidFile.pid,
@@ -92136,75 +93336,99 @@ function ensureWsSupervisor(params3) {
 }
 
 // src/commands/doctor.ts
-var doctorCommand = exports_Command.make("doctor", {}, () => gen2(function* () {
+var doctorCommand = exports_Command.make("doctor", { fix: boolean8("fix") }, ({ fix }) => gen2(function* () {
   const cfg = yield* AppConfig;
   const queue = yield* Queue;
   const remDb = yield* RemDb;
   const ws = yield* WsClient;
   const daemonFiles = yield* DaemonFiles;
   const fsAccess = yield* FsAccess;
-  const queueStats2 = yield* queue.stats({ dbPath: cfg.storeDb }).pipe(either3);
-  const remnote = yield* remDb.withDb(cfg.remnoteDb, (db) => {
-    db.prepare("SELECT 1 FROM quanta LIMIT 1").get();
-    const hasSearchInfos = !!db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='remsSearchInfos' LIMIT 1`).get();
-    const hasContents = !!db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='remsContents' LIMIT 1`).get();
-    return { has_search_index: hasSearchInfos && hasContents };
-  }).pipe(either3);
-  const schema2 = yield* try_3({
-    try: () => {
-      const db = openStoreDb(cfg.storeDb);
-      try {
-        return readStoreSchemaStatus(db);
-      } finally {
-        db.close();
+  yield* ApiDaemonFiles;
+  yield* PluginServerFiles;
+  yield* Process;
+  yield* SupervisorState;
+  yield* UserConfigFile;
+  const collectSnapshot = () => gen2(function* () {
+    const queueStats2 = yield* queue.stats({ dbPath: cfg.storeDb }).pipe(either3);
+    const remnote = yield* remDb.withDb(cfg.remnoteDb, (db) => {
+      db.prepare("SELECT 1 FROM quanta LIMIT 1").get();
+      const hasSearchInfos = !!db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='remsSearchInfos' LIMIT 1`).get();
+      const hasContents = !!db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='remsContents' LIMIT 1`).get();
+      return { has_search_index: hasSearchInfos && hasContents };
+    }).pipe(either3);
+    const schema2 = yield* try_3({
+      try: () => {
+        const db = openStoreDb(cfg.storeDb);
+        try {
+          return readStoreSchemaStatus(db);
+        } finally {
+          db.close();
+        }
+      },
+      catch: (error4) => new CliError({
+        code: "DB_UNAVAILABLE",
+        message: `Failed to read store schema: ${String(error4?.message || error4)}`,
+        exitCode: 1
+      })
+    }).pipe(either3);
+    const wsHealth = yield* ws.health({ url: cfg.wsUrl, timeoutMs: WS_HEALTH_TIMEOUT_MS }).pipe(either3);
+    const wsClients = yield* ws.queryClients({ url: cfg.wsUrl, timeoutMs: WS_HEALTH_TIMEOUT_MS }).pipe(either3);
+    const pidFilePath = daemonFiles.defaultPidFile();
+    const logFilePath = daemonFiles.defaultLogFile();
+    const pidWritable = yield* fsAccess.canWritePath(pidFilePath);
+    const logWritable = yield* fsAccess.canWritePath(logFilePath);
+    const storeDbWritable = yield* fsAccess.checkWritableFile(cfg.storeDb);
+    return {
+      queue: {
+        ok: queueStats2._tag === "Right",
+        db_path: cfg.storeDb,
+        schema: schema2._tag === "Right" ? schema2.right : undefined,
+        schema_error: schema2._tag === "Left" ? schema2.left.message : undefined,
+        writable: storeDbWritable.ok,
+        writable_reason: storeDbWritable.reason,
+        stats: queueStats2._tag === "Right" ? queueStats2.right : undefined,
+        error: queueStats2._tag === "Left" ? queueStats2.left.message : undefined
+      },
+      remnote_db: {
+        ok: remnote._tag === "Right",
+        db_path: remnote._tag === "Right" ? remnote.right.info.dbPath : cfg.remnoteDb,
+        resolution: remnote._tag === "Right" ? remnote.right.info.source : undefined,
+        has_search_index: remnote._tag === "Right" ? remnote.right.result.has_search_index : undefined,
+        error: remnote._tag === "Left" ? remnote.left.message : undefined
+      },
+      ws: {
+        ok: wsHealth._tag === "Right",
+        url: cfg.wsUrl,
+        rtt_ms: wsHealth._tag === "Right" ? wsHealth.right.rtt_ms : undefined,
+        error: wsHealth._tag === "Left" ? wsHealth.left.message : undefined,
+        clients: wsClients._tag === "Right" ? wsClients.right.clients : []
+      },
+      daemon_files: {
+        pid_file: pidFilePath,
+        log_file: logFilePath,
+        pid_writable: pidWritable,
+        log_writable: logWritable
       }
-    },
-    catch: (error4) => new CliError({
-      code: "DB_UNAVAILABLE",
-      message: `Failed to read store schema: ${String(error4?.message || error4)}`,
-      exitCode: 1
-    })
-  }).pipe(either3);
-  const wsHealth = yield* ws.health({ url: cfg.wsUrl, timeoutMs: WS_HEALTH_TIMEOUT_MS }).pipe(either3);
-  const wsClients = yield* ws.queryClients({ url: cfg.wsUrl, timeoutMs: WS_HEALTH_TIMEOUT_MS }).pipe(either3);
-  const pidFilePath = daemonFiles.defaultPidFile();
-  const logFilePath = daemonFiles.defaultLogFile();
-  const pidWritable = yield* fsAccess.canWritePath(pidFilePath);
-  const logWritable = yield* fsAccess.canWritePath(logFilePath);
-  const storeDbWritable = yield* fsAccess.checkWritableFile(cfg.storeDb);
+    };
+  });
+  const snapshotBefore = yield* collectSnapshot();
+  const checksBefore = yield* collectDoctorChecks();
+  const fixResult = fix ? yield* applyDoctorFixes() : { fixes: [], changed: false, restartSummary: { attempted: [], restarted: [], skipped: [], failed: [] } };
+  const snapshotAfter = fix ? yield* collectSnapshot() : snapshotBefore;
+  const checks = fix ? yield* collectDoctorChecks() : checksBefore;
   const data = {
-    queue: {
-      ok: queueStats2._tag === "Right",
-      db_path: cfg.storeDb,
-      schema: schema2._tag === "Right" ? schema2.right : undefined,
-      schema_error: schema2._tag === "Left" ? schema2.left.message : undefined,
-      writable: storeDbWritable.ok,
-      writable_reason: storeDbWritable.reason,
-      stats: queueStats2._tag === "Right" ? queueStats2.right : undefined,
-      error: queueStats2._tag === "Left" ? queueStats2.left.message : undefined
-    },
-    remnote_db: {
-      ok: remnote._tag === "Right",
-      db_path: remnote._tag === "Right" ? remnote.right.info.dbPath : cfg.remnoteDb,
-      resolution: remnote._tag === "Right" ? remnote.right.info.source : undefined,
-      has_search_index: remnote._tag === "Right" ? remnote.right.result.has_search_index : undefined,
-      error: remnote._tag === "Left" ? remnote.left.message : undefined
-    },
-    ws: {
-      ok: wsHealth._tag === "Right",
-      url: cfg.wsUrl,
-      rtt_ms: wsHealth._tag === "Right" ? wsHealth.right.rtt_ms : undefined,
-      error: wsHealth._tag === "Left" ? wsHealth.left.message : undefined,
-      clients: wsClients._tag === "Right" ? wsClients.right.clients : []
-    },
-    daemon_files: {
-      pid_file: pidFilePath,
-      log_file: logFilePath,
-      pid_writable: pidWritable,
-      log_writable: logWritable
-    }
-  };
-  const overallOk = data.queue.ok && data.remnote_db.ok && data.ws.ok && data.daemon_files.pid_writable && data.daemon_files.log_writable;
+    queue: snapshotAfter.queue,
+    remnote_db: snapshotAfter.remnote_db,
+    ws: snapshotAfter.ws,
+    daemon_files: snapshotAfter.daemon_files,
+    before: fix ? snapshotBefore : undefined,
+    changed: fixResult.changed,
+    checks_before: checksBefore,
+    checks,
+    fixes: fixResult.fixes,
+    restart_summary: fixResult.restartSummary
+  };
+  const overallOk = data.queue.ok && data.remnote_db.ok && data.ws.ok && data.daemon_files.pid_writable && data.daemon_files.log_writable && checks.every((check2) => check2.ok);
   const hints = [];
   if (!data.ws.ok)
     hints.push("Try: agent-remnote daemon ensure / agent-remnote daemon status");
@@ -92243,6 +93467,9 @@ var doctorCommand = exports_Command.make("doctor", {}, () => gen2(function* () {
     `- pid_file: ${data.daemon_files.pid_file}`,
     `- log_file_writable: ${data.daemon_files.log_writable}`,
     `- log_file: ${data.daemon_files.log_file}`,
+    `- changed: ${data.changed}`,
+    `- checks_total: ${data.checks.length}`,
+    `- fixes_total: ${data.fixes.length}`,
     hints.length > 0 ? `
 ## Hint` : "",
     ...hints.map((h) => `- ${h}`)
@@ -92564,121 +93791,37 @@ var wsLogsCommand = exports_Command.make("logs", {
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/ws/restart.ts
-import path20 from "node:path";
-
-// src/lib/statuslineArtifacts.ts
-import { promises as fs13 } from "node:fs";
-
-// src/services/StatusLineFile.ts
-import { promises as fs12 } from "node:fs";
-import path19 from "node:path";
-class StatusLineFile extends Tag2("StatusLineFile")() {
-}
-function defaultTextFile() {
-  return path19.join(homeDir(), ".agent-remnote", "status-line.txt");
-}
-function defaultJsonFile() {
-  return path19.join(homeDir(), ".agent-remnote", "status-line.json");
-}
-function ensureDir6(p3) {
-  return fs12.mkdir(path19.dirname(p3), { recursive: true }).then(() => {
-    return;
-  });
-}
-async function readFileOrEmpty(filePath) {
-  try {
-    return await fs12.readFile(filePath, "utf8");
-  } catch (e) {
-    if (e?.code === "ENOENT")
-      return "";
-    throw e;
-  }
-}
-async function writeTextAtomic(filePath, content) {
-  await ensureDir6(filePath);
-  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  await fs12.writeFile(tmp, content, "utf8");
-  await fs12.rename(tmp, filePath);
-}
-var StatusLineFileLive = succeed10(StatusLineFile, {
-  defaultTextFile: () => defaultTextFile(),
-  defaultJsonFile: () => defaultJsonFile(),
-  write: ({ text: text15, textFilePath, debug: debug2, jsonFilePath, json: json4 }) => tryPromise2({
-    try: async () => {
-      const resolvedTextFile = resolveUserFilePath(textFilePath ?? defaultTextFile());
-      const normalizedText = text15.trimEnd();
-      const desired = normalizedText.length > 0 ? `${normalizedText}
-` : "";
-      const existing = await readFileOrEmpty(resolvedTextFile);
-      if (existing === desired)
-        return { wrote: false, textFilePath: resolvedTextFile };
-      await writeTextAtomic(resolvedTextFile, desired);
-      if (debug2 === true) {
-        const resolvedJsonFile = resolveUserFilePath(jsonFilePath ?? defaultJsonFile());
-        const payload = json4 !== undefined ? json4 : { text: normalizedText };
-        await writeTextAtomic(resolvedJsonFile, `${JSON.stringify(payload)}
-`);
-      }
-      return { wrote: true, textFilePath: resolvedTextFile };
-    },
-    catch: (error4) => {
-      if (isCliError(error4))
-        return error4;
-      return new CliError({
-        code: "INTERNAL",
-        message: "Failed to write status line file",
-        exitCode: 1,
-        details: { error: String(error4?.message || error4) }
-      });
-    }
-  })
-});
-
-// src/lib/statuslineArtifacts.ts
-function normalizeOptionalPath(value8) {
-  if (typeof value8 !== "string")
-    return;
-  const t = value8.trim();
-  return t.length > 0 ? resolveUserFilePath(t) : undefined;
-}
-function resolveStatuslineArtifactPaths(params3) {
-  const pidInfo = params3.pidInfo;
-  const wsBridgeStateFilePath = normalizeOptionalPath(pidInfo?.ws_bridge_state_file) ?? params3.cfg.wsStateFile.path;
-  const statusLineFilePath = normalizeOptionalPath(pidInfo?.status_line_file) ?? params3.cfg.statusLineFile;
-  const statusLineJsonFilePath = normalizeOptionalPath(pidInfo?.status_line_json_file) ?? params3.cfg.statusLineJsonFile;
-  return { wsBridgeStateFilePath, statusLineFilePath, statusLineJsonFilePath };
-}
-function deleteFileIfExists(filePath) {
-  return promise2(async () => {
-    try {
-      await fs13.unlink(filePath);
-      return { action: "deleted", file: filePath };
-    } catch (e) {
-      if (e?.code === "ENOENT")
-        return { action: "skipped", file: filePath };
-      return { action: "failed", file: filePath, error: String(e?.message || e) };
-    }
-  });
-}
-function cleanupStatuslineArtifacts(paths) {
-  return gen2(function* () {
-    const statusLineFile = yield* StatusLineFile;
-    const wsBridgeStateFile = yield* deleteFileIfExists(paths.wsBridgeStateFilePath);
-    const cleared = yield* statusLineFile.write({ text: "", textFilePath: paths.statusLineFilePath, debug: false }).pipe(either3);
-    const statusLineFileOutcome = cleared._tag === "Right" ? cleared.right.wrote ? { action: "cleared", file: cleared.right.textFilePath } : { action: "skipped", file: cleared.right.textFilePath } : {
-      action: "failed",
-      file: paths.statusLineFilePath,
-      error: String(cleared.left?.message || cleared.left)
-    };
-    const statusLineJsonFile = yield* deleteFileIfExists(paths.statusLineJsonFilePath);
-    return { wsBridgeStateFile, statusLineFile: statusLineFileOutcome, statusLineJsonFile };
-  });
-}
-
-// src/commands/ws/restart.ts
+import path28 from "node:path";
 function optionToUndefined3(opt) {
   return isSome2(opt) ? opt.value : undefined;
 }
+function resolveManagedStateFile2(params3) {
+  const candidate = params3.candidate ? resolveUserFilePath(params3.candidate) : undefined;
+  if (!candidate)
+    return resolveUserFilePath(params3.defaultStateFilePath);
+  if (candidate === resolveUserFilePath(params3.defaultStateFilePath))
+    return candidate;
+  return path28.dirname(candidate) === path28.dirname(params3.pidFilePath) ? candidate : resolveUserFilePath(params3.defaultStateFilePath);
+}
+function isWithinRoot(rootDir, targetPath) {
+  const rel = path28.relative(rootDir, targetPath);
+  return rel === "" || !rel.startsWith("..") && !path28.isAbsolute(rel);
+}
+function sanitizePidInfoForArtifacts(params3) {
+  const rootDir = path28.dirname(params3.pidFilePath);
+  const normalizeMaybe = (value8) => {
+    if (typeof value8 !== "string" || !value8.trim())
+      return;
+    const resolved = resolveUserFilePath(value8);
+    return isWithinRoot(rootDir, resolved) ? resolved : undefined;
+  };
+  return {
+    ...params3.pidInfo,
+    ws_bridge_state_file: normalizeMaybe(params3.pidInfo.ws_bridge_state_file),
+    status_line_file: normalizeMaybe(params3.pidInfo.status_line_file),
+    status_line_json_file: normalizeMaybe(params3.pidInfo.status_line_json_file)
+  };
+}
 var pidFile3 = text10("pid-file").pipe(optional6, map34(optionToUndefined3));
 var logFile2 = text10("log-file").pipe(optional6, map34(optionToUndefined3));
 var wsRestartCommand = exports_Command.make("restart", {
@@ -92694,7 +93837,11 @@ var wsRestartCommand = exports_Command.make("restart", {
   const pidFilePath = resolveUserFilePath(pidFile4 ?? daemonFiles.defaultPidFile());
   const existing = yield* daemonFiles.readPidFile(pidFilePath);
   let stopResult = { stopped: true, pid_file: pidFilePath };
-  const stateFilePath = resolveUserFilePath(existing?.state_file ?? path20.join(path20.dirname(pidFilePath), "ws.state.json"));
+  const stateFilePath = resolveManagedStateFile2({
+    pidFilePath,
+    defaultStateFilePath: supervisorState.defaultStateFile(),
+    candidate: existing?.state_file
+  });
   if (existing) {
     const alive = yield* proc.isPidRunning(existing.pid);
     if (!alive) {
@@ -92702,6 +93849,7 @@ var wsRestartCommand = exports_Command.make("restart", {
       yield* supervisorState.deleteStateFile(stateFilePath);
       stopResult = { stopped: true, stale: true, pid: existing.pid, pid_file: pidFilePath };
     } else {
+      yield* requireTrustedPidRecord({ record: existing, pidFilePath });
       yield* proc.kill(existing.pid, "SIGTERM");
       const exited = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: WS_STOP_WAIT_DEFAULT_MS });
       if (!exited) {
@@ -92729,7 +93877,10 @@ var wsRestartCommand = exports_Command.make("restart", {
       stopResult = { stopped: true, pid: existing.pid, pid_file: pidFilePath };
     }
   }
-  const cleanup = yield* cleanupStatuslineArtifacts(resolveStatuslineArtifactPaths({ cfg, pidInfo: existing }));
+  const cleanup = yield* cleanupStatuslineArtifacts(resolveStatuslineArtifactPaths({
+    cfg,
+    pidInfo: existing ? sanitizePidInfoForArtifacts({ pidFilePath, pidInfo: existing }) : undefined
+  }));
   yield* sync3(() => refreshTmuxStatusLine());
   stopResult = { ...stopResult, cleanup };
   const startResult = yield* startWsSupervisor({ waitMs: wait, pidFile: pidFile4, logFile: logFile3 });
@@ -92766,10 +93917,10 @@ function safeJsonParse2(text15) {
   }
 }
 var WsBridgeServerLive = succeed10(WsBridgeServer, {
-  listen: ({ port: port3, path: path21, host }) => acquireRelease2(gen2(function* () {
+  listen: ({ port: port3, path: path29, host }) => acquireRelease2(gen2(function* () {
     const events = yield* unbounded5();
     const sockets = new Map;
-    const wss = new import_websocket_server.default({ port: port3, host, path: path21 });
+    const wss = new import_websocket_server.default({ port: port3, host, path: path29 });
     wss.on("connection", (ws, req) => {
       const connId = randomUUID4();
       const remoteAddr = safeStringHeader(req?.socket?.remoteAddress);
@@ -92803,7 +93954,7 @@ var WsBridgeServerLive = succeed10(WsBridgeServer, {
     });
     const handle = {
       events,
-      serverInfo: { port: port3, path: path21 },
+      serverInfo: { port: port3, path: path29 },
       sendText: (connId, text15) => sync3(() => {
         const ws = sockets.get(connId);
         if (!ws)
@@ -92865,23 +94016,23 @@ var WsBridgeServerLive = succeed10(WsBridgeServer, {
     code: "WS_UNAVAILABLE",
     message: "Failed to start ws bridge server",
     exitCode: 1,
-    details: { error: String(error4?.message || error4), port: port3, path: path21, host }
+    details: { error: String(error4?.message || error4), port: port3, path: path29, host }
   }))))
 });
 
 // src/services/WsBridgeStateFile.ts
-import { promises as fs14 } from "node:fs";
-import path21 from "node:path";
+import { promises as fs16 } from "node:fs";
+import path29 from "node:path";
 class WsBridgeStateFile extends Tag2("WsBridgeStateFile")() {
 }
-async function ensureDir7(filePath) {
-  await fs14.mkdir(path21.dirname(filePath), { recursive: true });
+async function ensureDir9(filePath) {
+  await fs16.mkdir(path29.dirname(filePath), { recursive: true });
 }
 async function writeTextAtomic2(filePath, content) {
-  await ensureDir7(filePath);
+  await ensureDir9(filePath);
   const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  await fs14.writeFile(tmp, content, "utf8");
-  await fs14.rename(tmp, filePath);
+  await fs16.writeFile(tmp, content, "utf8");
+  await fs16.rename(tmp, filePath);
 }
 var WsBridgeStateFileLive = succeed10(WsBridgeStateFile, {
   write: ({ filePath, json: json4 }) => tryPromise2({
@@ -92987,7 +94138,7 @@ var TmuxLive = scoped3(Tmux, gen2(function* () {
 }));
 
 // src/services/WsBridgeState.ts
-import { promises as fs15 } from "node:fs";
+import { promises as fs17 } from "node:fs";
 class WsBridgeState extends Tag2("WsBridgeState")() {
 }
 function toNonNegativeInt3(value8) {
@@ -93013,7 +94164,7 @@ var WsBridgeStateLive = succeed10(WsBridgeState, {
       return { connection: "off", selection: { kind: "none" } };
     }
     const raw4 = yield* tryPromise2({
-      try: async () => await fs15.readFile(cfg.wsStateFile.path, "utf8"),
+      try: async () => await fs17.readFile(cfg.wsStateFile.path, "utf8"),
       catch: (e) => {
         if (e?.code === "ENOENT")
           return null;
@@ -93427,18 +94578,18 @@ function parseWsUrl(url2) {
   }
   const port3 = u.port ? Number(u.port) : u.protocol === "wss:" ? 443 : 80;
   const host = u.hostname && u.hostname.length > 0 ? u.hostname : "localhost";
-  const path22 = u.pathname && u.pathname.length > 0 ? u.pathname : "/ws";
+  const path30 = u.pathname && u.pathname.length > 0 ? u.pathname : "/ws";
   if (!Number.isFinite(port3) || port3 <= 0) {
     throw new CliError({ code: "INVALID_ARGS", message: `Invalid wsUrl port: ${url2}`, exitCode: 2 });
   }
-  if (!path22.startsWith("/")) {
+  if (!path30.startsWith("/")) {
     throw new CliError({ code: "INVALID_ARGS", message: `Invalid wsUrl path: ${url2}`, exitCode: 2 });
   }
-  return { host, port: port3, path: path22 };
+  return { host, port: port3, path: path30 };
 }
 var wsServeCommand = exports_Command.make("serve", {}, () => gen2(function* () {
   const cfg = yield* AppConfig;
-  const { host, port: port3, path: path22 } = yield* try_3({
+  const { host, port: port3, path: path30 } = yield* try_3({
     try: () => parseWsUrl(cfg.wsUrl),
     catch: (e) => isCliError(e) ? e : new CliError({
       code: "INVALID_ARGS",
@@ -93447,7 +94598,7 @@ var wsServeCommand = exports_Command.make("serve", {}, () => gen2(function* () {
       details: { ws_url: cfg.wsUrl, error: String(e?.message || e) }
     })
   });
-  yield* runWsBridgeRuntime({ host, port: port3, path: path22 });
+  yield* runWsBridgeRuntime({ host, port: port3, path: path30 });
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/ws/start.ts
@@ -93463,14 +94614,14 @@ function parseWsUrl2(url2) {
   }
   const port3 = u.port ? Number(u.port) : u.protocol === "wss:" ? 443 : 80;
   const host = u.hostname && u.hostname.length > 0 ? u.hostname : "localhost";
-  const path22 = u.pathname && u.pathname.length > 0 ? u.pathname : "/ws";
+  const path30 = u.pathname && u.pathname.length > 0 ? u.pathname : "/ws";
   if (!Number.isFinite(port3) || port3 <= 0) {
     throw new CliError({ code: "INVALID_ARGS", message: `Invalid wsUrl port: ${url2}`, exitCode: 2 });
   }
-  if (!path22.startsWith("/")) {
+  if (!path30.startsWith("/")) {
     throw new CliError({ code: "INVALID_ARGS", message: `Invalid wsUrl path: ${url2}`, exitCode: 2 });
   }
-  return { host, port: port3, path: path22 };
+  return { host, port: port3, path: path30 };
 }
 var pidFile4 = text10("pid-file").pipe(optional6, map34(optionToUndefined4));
 var logFile3 = text10("log-file").pipe(optional6, map34(optionToUndefined4));
@@ -93482,7 +94633,7 @@ var wsStartCommand = exports_Command.make("start", {
 }, ({ foreground, wait, pidFile: pidFile5, logFile: logFile4 }) => gen2(function* () {
   const cfg = yield* AppConfig;
   if (foreground) {
-    const { host, port: port3, path: path22 } = yield* try_3({
+    const { host, port: port3, path: path30 } = yield* try_3({
       try: () => parseWsUrl2(cfg.wsUrl),
       catch: (e) => isCliError(e) ? e : new CliError({
         code: "INVALID_ARGS",
@@ -93491,7 +94642,7 @@ var wsStartCommand = exports_Command.make("start", {
         details: { ws_url: cfg.wsUrl, error: String(e?.message || e) }
       })
     });
-    yield* runWsBridgeRuntime({ host, port: port3, path: path22 });
+    yield* runWsBridgeRuntime({ host, port: port3, path: path30 });
     return;
   }
   const result = yield* startWsSupervisor({ waitMs: wait, pidFile: pidFile5, logFile: logFile4 });
@@ -93506,110 +94657,7 @@ var wsStartCommand = exports_Command.make("start", {
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/ws/status.ts
-import path24 from "node:path";
-
-// src/lib/pluginBuildInfo.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import path23 from "node:path";
-
-// src/lib/pluginArtifacts.ts
-import { existsSync as existsSync3, statSync as statSync2 } from "node:fs";
-import path22 from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-function currentDir(moduleUrl) {
-  return path22.dirname(fileURLToPath3(moduleUrl));
-}
-function isDirectory(targetPath) {
-  try {
-    return statSync2(targetPath).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function isFile(targetPath) {
-  try {
-    return statSync2(targetPath).isFile();
-  } catch {
-    return false;
-  }
-}
-function distCandidates(moduleUrl) {
-  const dir2 = currentDir(moduleUrl);
-  return [
-    path22.resolve(dir2, "../../plugin-artifacts/dist"),
-    path22.resolve(dir2, "../plugin-artifacts/dist"),
-    path22.resolve(dir2, "../../../plugin/dist"),
-    path22.resolve(dir2, "../../plugin/dist")
-  ];
-}
-function validateDistPath(targetPath) {
-  return isDirectory(targetPath) && existsSync3(path22.join(targetPath, "manifest.json"));
-}
-function hasBuildInfo(targetPath) {
-  return isFile(path22.join(targetPath, "build-info.json"));
-}
-function resolvePluginDistPath(moduleUrl = import.meta.url) {
-  for (const candidate of distCandidates(moduleUrl)) {
-    if (validateDistPath(candidate) && hasBuildInfo(candidate))
-      return candidate;
-  }
-  for (const candidate of distCandidates(moduleUrl)) {
-    if (validateDistPath(candidate))
-      return candidate;
-  }
-  throw new CliError({
-    code: "DEPENDENCY_MISSING",
-    message: "Plugin build artifacts are unavailable",
-    exitCode: 1,
-    details: { candidates: distCandidates(moduleUrl) },
-    hint: [
-      "Run npm run build --workspace @remnote/plugin in the repository checkout",
-      "Or install a packaged agent-remnote release that includes plugin artifacts"
-    ]
-  });
-}
-
-// src/lib/pluginBuildInfo.ts
-function readPluginDistBuildInfo(distPath) {
-  const normalized = typeof distPath === "string" ? distPath.trim() : "";
-  if (!normalized)
-    return null;
-  const target2 = path23.join(normalized, "build-info.json");
-  try {
-    const raw4 = readFileSync3(target2, "utf8");
-    const parsed = JSON.parse(raw4);
-    if (typeof parsed?.name === "string" && typeof parsed?.version === "string" && typeof parsed?.build_id === "string" && typeof parsed?.built_at === "number" && typeof parsed?.source_stamp === "number") {
-      return {
-        name: parsed.name,
-        version: parsed.version,
-        build_id: parsed.build_id,
-        built_at: parsed.built_at,
-        source_stamp: parsed.source_stamp,
-        mode: parsed.mode === "src" || parsed.mode === "dist" || parsed.mode === "unknown" ? parsed.mode : "dist"
-      };
-    }
-  } catch {}
-  return null;
-}
-function currentExpectedPluginBuildInfo() {
-  try {
-    const dist = resolvePluginDistPath();
-    return readPluginDistBuildInfo(dist);
-  } catch {
-    return null;
-  }
-}
-function pluginBuildWarnings(params3) {
-  if (!params3.expected || !params3.live)
-    return [];
-  if (params3.expected.build_id === params3.live.build_id)
-    return [];
-  return [
-    `plugin build mismatch: expected=${params3.expected.build_id} live=${params3.live.build_id}`
-  ];
-}
-
-// src/commands/ws/status.ts
+import path30 from "node:path";
 function optionToUndefined5(opt) {
   return isSome2(opt) ? opt.value : undefined;
 }
@@ -93628,14 +94676,14 @@ var wsStatusCommand = exports_Command.make("status", { pidFile: pidFile5 }, ({ p
     if (!alive) {
       const stalePidInfo = pidInfo;
       yield* daemonFiles.deletePidFile(pidFilePath);
-      const staleStateFilePath = resolveUserFilePath(pidInfo.state_file ?? path24.join(path24.dirname(pidFilePath), "ws.state.json"));
+      const staleStateFilePath = resolveUserFilePath(pidInfo.state_file ?? path30.join(path30.dirname(pidFilePath), "ws.state.json"));
       yield* supervisorState.deleteStateFile(staleStateFilePath);
       selfHealCleanup = yield* cleanupStatuslineArtifacts(resolveStatuslineArtifactPaths({ cfg, pidInfo: stalePidInfo }));
       yield* sync3(() => refreshTmuxStatusLine());
       pidInfo = undefined;
     }
   }
-  const stateFilePath = resolveUserFilePath(pidInfo?.state_file ?? path24.join(path24.dirname(pidFilePath), "ws.state.json"));
+  const stateFilePath = resolveUserFilePath(pidInfo?.state_file ?? path30.join(path30.dirname(pidFilePath), "ws.state.json"));
   const state = yield* supervisorState.readStateFile(stateFilePath);
   const mode = pidInfo ? pidInfo.mode ?? "legacy" : "supervisor";
   const supervisorPid = pidInfo?.pid;
@@ -93818,10 +94866,37 @@ var wsStatusLineCommand = exports_Command.make("status-line", { stateFile, stale
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/ws/stop.ts
-import path25 from "node:path";
+import path31 from "node:path";
 function optionToUndefined7(opt) {
   return isSome2(opt) ? opt.value : undefined;
 }
+function resolveManagedStateFile3(params3) {
+  const candidate = params3.candidate ? resolveUserFilePath(params3.candidate) : undefined;
+  if (!candidate)
+    return resolveUserFilePath(params3.defaultStateFilePath);
+  if (candidate === resolveUserFilePath(params3.defaultStateFilePath))
+    return candidate;
+  return path31.dirname(candidate) === path31.dirname(params3.pidFilePath) ? candidate : resolveUserFilePath(params3.defaultStateFilePath);
+}
+function isWithinRoot2(rootDir, targetPath) {
+  const rel = path31.relative(rootDir, targetPath);
+  return rel === "" || !rel.startsWith("..") && !path31.isAbsolute(rel);
+}
+function sanitizePidInfoForArtifacts2(params3) {
+  const rootDir = path31.dirname(params3.pidFilePath);
+  const normalizeMaybe = (value8) => {
+    if (typeof value8 !== "string" || !value8.trim())
+      return;
+    const resolved = resolveUserFilePath(value8);
+    return isWithinRoot2(rootDir, resolved) ? resolved : undefined;
+  };
+  return {
+    ...params3.pidInfo,
+    ws_bridge_state_file: normalizeMaybe(params3.pidInfo.ws_bridge_state_file),
+    status_line_file: normalizeMaybe(params3.pidInfo.status_line_file),
+    status_line_json_file: normalizeMaybe(params3.pidInfo.status_line_json_file)
+  };
+}
 var pidFile6 = text10("pid-file").pipe(optional6, map34(optionToUndefined7));
 var wsStopCommand = exports_Command.make("stop", { force: boolean8("force"), pidFile: pidFile6 }, ({ force, pidFile: pidFile7 }) => gen2(function* () {
   const cfg = yield* AppConfig;
@@ -93831,7 +94906,10 @@ var wsStopCommand = exports_Command.make("stop", { force: boolean8("force"), pid
   const pidFilePath = resolveUserFilePath(pidFile7 ?? daemonFiles.defaultPidFile());
   const existing = yield* daemonFiles.readPidFile(pidFilePath);
   const cleanupDisplayArtifacts = (pidInfo) => gen2(function* () {
-    const paths = resolveStatuslineArtifactPaths({ cfg, pidInfo });
+    const paths = resolveStatuslineArtifactPaths({
+      cfg,
+      pidInfo: pidInfo ? sanitizePidInfoForArtifacts2({ pidFilePath, pidInfo }) : undefined
+    });
     const cleanup2 = yield* cleanupStatuslineArtifacts(paths);
     yield* sync3(() => refreshTmuxStatusLine());
     return cleanup2;
@@ -93846,7 +94924,11 @@ var wsStopCommand = exports_Command.make("stop", { force: boolean8("force"), pid
     });
     return;
   }
-  const stateFilePath = resolveUserFilePath(existing.state_file ?? path25.join(path25.dirname(pidFilePath), "ws.state.json"));
+  const stateFilePath = resolveManagedStateFile3({
+    pidFilePath,
+    defaultStateFilePath: supervisorState.defaultStateFile(),
+    candidate: existing.state_file
+  });
   const alive = yield* proc.isPidRunning(existing.pid);
   if (!alive) {
     yield* daemonFiles.deletePidFile(pidFilePath);
@@ -93862,6 +94944,7 @@ var wsStopCommand = exports_Command.make("stop", { force: boolean8("force"), pid
     });
     return;
   }
+  yield* requireTrustedPidRecord({ record: existing, pidFilePath });
   yield* proc.kill(existing.pid, "SIGTERM");
   const exited = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: WS_STOP_WAIT_DEFAULT_MS });
   if (!exited) {
@@ -94040,8 +95123,8 @@ var ChildProcessLive = succeed10(ChildProcess2, {
 });
 
 // src/services/LogWriter.ts
-import { promises as fs16 } from "node:fs";
-import path26 from "node:path";
+import { promises as fs18 } from "node:fs";
+import path32 from "node:path";
 class LogWriterFactory extends Tag2("LogWriterFactory")() {
 }
 function sanitizePositiveInt(value8, fallback) {
@@ -94052,12 +95135,12 @@ function sanitizeMaxBytes(value8, fallback) {
     return null;
   return Number.isFinite(value8) && value8 > 0 ? Math.floor(value8) : fallback;
 }
-async function ensureDir8(filePath) {
-  await fs16.mkdir(path26.dirname(filePath), { recursive: true });
+async function ensureDir10(filePath) {
+  await fs18.mkdir(path32.dirname(filePath), { recursive: true });
 }
 async function safeStat(filePath) {
   try {
-    const s = await fs16.stat(filePath);
+    const s = await fs18.stat(filePath);
     return { size: s.size };
   } catch {
     return;
@@ -94066,25 +95149,25 @@ async function safeStat(filePath) {
 async function rotateFiles(filePath, keep) {
   if (keep <= 0)
     return;
-  const dir2 = path26.dirname(filePath);
-  const base = path26.basename(filePath);
+  const dir2 = path32.dirname(filePath);
+  const base = path32.basename(filePath);
   let entries2 = [];
   try {
-    entries2 = await fs16.readdir(dir2);
+    entries2 = await fs18.readdir(dir2);
   } catch {
     return;
   }
-  const rotated = entries2.filter((name) => name.startsWith(`${base}.`)).map((name) => path26.join(dir2, name)).sort().reverse();
+  const rotated = entries2.filter((name) => name.startsWith(`${base}.`)).map((name) => path32.join(dir2, name)).sort().reverse();
   for (const p3 of rotated.slice(keep)) {
     try {
-      await fs16.unlink(p3);
+      await fs18.unlink(p3);
     } catch {}
   }
 }
 async function createLogWriter(filePath, options6) {
   const maxBytes = sanitizeMaxBytes(options6.maxBytes, 20 * 1024 * 1024);
   const keep = sanitizePositiveInt(options6.keep, 5);
-  await ensureDir8(filePath);
+  await ensureDir10(filePath);
   let currentSize = (await safeStat(filePath))?.size ?? 0;
   let handle;
   let closing = false;
@@ -94093,7 +95176,7 @@ async function createLogWriter(filePath, options6) {
   async function openIfNeeded() {
     if (handle)
       return handle;
-    handle = await fs16.open(filePath, "a");
+    handle = await fs18.open(filePath, "a");
     return handle;
   }
   async function rotateIfNeeded(nextBytes) {
@@ -94107,7 +95190,7 @@ async function createLogWriter(filePath, options6) {
     handle = undefined;
     const rotatedPath = `${filePath}.${Date.now()}`;
     try {
-      await fs16.rename(filePath, rotatedPath);
+      await fs18.rename(filePath, rotatedPath);
     } catch {}
     currentSize = 0;
     await rotateFiles(filePath, keep);
@@ -94920,7 +96003,7 @@ var HostApiClientLive = effect(HostApiClient, gen2(function* () {
 }));
 
 // src/lib/workspaceResolver.ts
-import fs17 from "node:fs";
+import fs19 from "node:fs";
 
 // src/lib/business-semantics/uiContextResolution.ts
 function loadBridgeUiContextSnapshot(params3) {
@@ -95226,7 +96309,7 @@ function pathExists(filePath) {
   if (!filePath)
     return false;
   try {
-    return fs17.statSync(filePath).isFile();
+    return fs19.statSync(filePath).isFile();
   } catch {
     return false;
   }
@@ -96727,7 +97810,7 @@ function isSingleRootOutlineMarkdown(input) {
 }
 
 // src/services/Payload.ts
-import { promises as fs18 } from "node:fs";
+import { promises as fs20 } from "node:fs";
 class Payload extends Tag2("Payload")() {
 }
 var MAX_PAYLOAD_BYTES = 5 * 1024 * 1024;
@@ -96768,7 +97851,7 @@ async function readPayloadSpec(spec) {
     if (!filePath) {
       throw new CliError({ code: "INVALID_ARGS", message: "Payload file path cannot be empty", exitCode: 2 });
     }
-    return await fs18.readFile(filePath, "utf8");
+    return await fs20.readFile(filePath, "utf8");
   }
   return spec;
 }
@@ -97078,8 +98161,8 @@ function resolveRefsInPayload(params3) {
     const out = structuredClone(params3.payload);
     const resolvedRefCache = new Map;
     const idPaths = idFieldPathsForOpType(params3.opType);
-    for (const path27 of idPaths) {
-      const tokens = parsePathTokens(path27);
+    for (const path33 of idPaths) {
+      const tokens = parsePathTokens(path33);
       if (tokens.length === 0)
         continue;
       const leaves = collectLeafValues(out, tokens);
@@ -97698,7 +98781,7 @@ function validateOptionMutationOps(params3) {
 
 // src/services/RefResolver.ts
 import { homedir } from "node:os";
-import path27 from "node:path";
+import path33 from "node:path";
 class RefResolver extends Tag2("RefResolver")() {
 }
 function stripQuotes(s) {
@@ -97778,8 +98861,8 @@ function normalizeDbPathInput(dbPath) {
   const raw4 = typeof dbPath === "string" ? dbPath.trim() : "";
   if (!raw4)
     return;
-  const expanded = raw4 === "~" ? homedir() : raw4.startsWith("~/") || raw4.startsWith("~\\") ? path27.join(homedir(), raw4.slice(2)) : raw4;
-  return path27.resolve(path27.normalize(expanded));
+  const expanded = raw4 === "~" ? homedir() : raw4.startsWith("~/") || raw4.startsWith("~\\") ? path33.join(homedir(), raw4.slice(2)) : raw4;
+  return path33.resolve(path33.normalize(expanded));
 }
 var RefResolverLive = succeed10(RefResolver, {
   resolve: (ref, options6) => gen2(function* () {
@@ -100378,152 +101461,6 @@ var applyCommand = exports_Command.make("apply", {
   });
 }).pipe(catchAll2(writeFailure)));
 
-// src/services/ApiDaemonFiles.ts
-import { promises as fs19 } from "node:fs";
-import path28 from "node:path";
-class ApiDaemonFiles extends Tag2("ApiDaemonFiles")() {
-}
-function ensureDir9(p3) {
-  return fs19.mkdir(path28.dirname(p3), { recursive: true }).then(() => {
-    return;
-  });
-}
-function defaultPidFile2() {
-  const envPidFile = process.env.REMNOTE_API_PID_FILE;
-  if (typeof envPidFile === "string" && envPidFile.trim())
-    return resolveUserFilePath(envPidFile);
-  return path28.join(homeDir(), ".agent-remnote", "api.pid");
-}
-function defaultLogFile2() {
-  const envLogFile = process.env.REMNOTE_API_LOG_FILE;
-  if (typeof envLogFile === "string" && envLogFile.trim())
-    return resolveUserFilePath(envLogFile);
-  return path28.join(homeDir(), ".agent-remnote", "api.log");
-}
-function defaultStateFile2() {
-  const envStateFile = process.env.REMNOTE_API_STATE_FILE;
-  if (typeof envStateFile === "string" && envStateFile.trim())
-    return resolveUserFilePath(envStateFile);
-  return path28.join(homeDir(), ".agent-remnote", "api.state.json");
-}
-function parseJson2(raw4, filePath) {
-  try {
-    return JSON.parse(raw4);
-  } catch (error4) {
-    throw new CliError({
-      code: "INTERNAL",
-      message: `Failed to parse JSON file: ${filePath}`,
-      exitCode: 1,
-      details: { file_path: filePath, error: String(error4?.message || error4) }
-    });
-  }
-}
-var ApiDaemonFilesLive = succeed10(ApiDaemonFiles, {
-  defaultPidFile: defaultPidFile2,
-  defaultLogFile: defaultLogFile2,
-  defaultStateFile: defaultStateFile2,
-  readPidFile: (pidFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      const raw4 = await fs19.readFile(resolved, "utf8");
-      return parseJson2(raw4, resolved);
-    },
-    catch: (error4) => {
-      const code2 = error4?.code;
-      if (code2 === "ENOENT")
-        return;
-      if (isCliError(error4))
-        return error4;
-      return new CliError({
-        code: "INTERNAL",
-        message: "Failed to read api pid file",
-        exitCode: 1,
-        details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-      });
-    }
-  }).pipe(catchAll2((error4) => {
-    if (error4 === undefined)
-      return succeed8(undefined);
-    return fail8(error4);
-  })),
-  writePidFile: (pidFilePath, value8) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      await ensureDir9(resolved);
-      await fs19.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
-`, "utf8");
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to write api pid file",
-      exitCode: 1,
-      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  deletePidFile: (pidFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      await fs19.rm(resolved, { force: true });
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to delete api pid file",
-      exitCode: 1,
-      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  readStateFile: (stateFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      const raw4 = await fs19.readFile(resolved, "utf8");
-      return parseJson2(raw4, resolved);
-    },
-    catch: (error4) => {
-      const code2 = error4?.code;
-      if (code2 === "ENOENT")
-        return;
-      if (isCliError(error4))
-        return error4;
-      return new CliError({
-        code: "INTERNAL",
-        message: "Failed to read api state file",
-        exitCode: 1,
-        details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-      });
-    }
-  }).pipe(catchAll2((error4) => {
-    if (error4 === undefined)
-      return succeed8(undefined);
-    return fail8(error4);
-  })),
-  writeStateFile: (stateFilePath, value8) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      await ensureDir9(resolved);
-      await fs19.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
-`, "utf8");
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to write api state file",
-      exitCode: 1,
-      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  deleteStateFile: (stateFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      await fs19.rm(resolved, { force: true });
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to delete api state file",
-      exitCode: 1,
-      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-    })
-  })
-});
-
 // src/commands/api/_shared.ts
 var API_HEALTH_TIMEOUT_MS = 2000;
 var API_START_WAIT_DEFAULT_MS = 15000;
@@ -100609,6 +101546,7 @@ function startApiDaemon(params3) {
       if (!alive) {
         yield* apiFiles.deletePidFile(pidFilePath);
       } else {
+        yield* requireTrustedPidRecord({ record: existing, pidFilePath });
         return {
           started: false,
           pid: existing.pid,
@@ -100686,6 +101624,7 @@ function ensureApiDaemon(params3) {
       if (existing) {
         const alive = yield* proc.isPidRunning(existing.pid);
         if (alive) {
+          yield* requireTrustedPidRecord({ record: existing, pidFilePath });
           return {
             started: false,
             pid: existing.pid,
@@ -100817,20 +101756,43 @@ var apiRestartCommand = exports_Command.make("restart", {
   const proc = yield* Process;
   const pidFilePath = resolveUserFilePath(pidFile11 ?? apiFiles.defaultPidFile());
   const existing = yield* apiFiles.readPidFile(pidFilePath);
+  const stateFilePath = resolveManagedStateFile({
+    pidFilePath,
+    defaultStateFilePath: apiFiles.defaultStateFile(),
+    explicitStateFilePath: stateFile5,
+    candidate: existing?.state_file
+  });
   let stoppedPid;
   if (existing) {
     const alive = yield* proc.isPidRunning(existing.pid);
     if (alive) {
+      yield* requireTrustedPidRecord({ record: existing, pidFilePath });
       yield* proc.kill(existing.pid, "SIGTERM");
       const exited = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: API_STOP_WAIT_DEFAULT_MS });
-      if (!exited && force) {
+      if (!exited) {
+        if (!force) {
+          return yield* fail8(new CliError({
+            code: "INTERNAL",
+            message: `Host API did not exit within ${API_STOP_WAIT_DEFAULT_MS}ms; use --force`,
+            exitCode: 1,
+            details: { pid: existing.pid, pid_file: pidFilePath }
+          }));
+        }
         yield* proc.kill(existing.pid, "SIGKILL");
-        yield* proc.waitForExit({ pid: existing.pid, timeoutMs: API_STOP_WAIT_DEFAULT_MS });
+        const killed = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: API_STOP_WAIT_DEFAULT_MS });
+        if (!killed) {
+          return yield* fail8(new CliError({
+            code: "INTERNAL",
+            message: "Force stop failed (process is still alive)",
+            exitCode: 1,
+            details: { pid: existing.pid, pid_file: pidFilePath }
+          }));
+        }
       }
       stoppedPid = existing.pid;
     }
     yield* apiFiles.deletePidFile(pidFilePath).pipe(catchAll2(() => _void));
-    yield* apiFiles.deleteStateFile(existing.state_file ?? resolveUserFilePath(stateFile5 ?? apiFiles.defaultStateFile())).pipe(catchAll2(() => _void));
+    yield* apiFiles.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
   }
   const started = yield* startApiDaemon({ host: host3, port: port5, waitMs: wait3, pidFile: pidFile11, logFile: logFile7, stateFile: stateFile5 });
   yield* writeSuccess({
@@ -101647,8 +102609,13 @@ var apiStopCommand = exports_Command.make("stop", { force: boolean8("force"), pi
   const apiFiles = yield* ApiDaemonFiles;
   const proc = yield* Process;
   const pidFilePath = resolveUserFilePath(pidFile14 ?? apiFiles.defaultPidFile());
-  const stateFilePath = resolveUserFilePath(stateFile9 ?? apiFiles.defaultStateFile());
   const existing = yield* apiFiles.readPidFile(pidFilePath);
+  const stateFilePath = resolveManagedStateFile({
+    pidFilePath,
+    defaultStateFilePath: apiFiles.defaultStateFile(),
+    explicitStateFilePath: stateFile9,
+    candidate: existing?.state_file
+  });
   if (!existing) {
     yield* apiFiles.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
     yield* writeSuccess({
@@ -101662,7 +102629,7 @@ var apiStopCommand = exports_Command.make("stop", { force: boolean8("force"), pi
   const alive = yield* proc.isPidRunning(existing.pid);
   if (!alive) {
     yield* apiFiles.deletePidFile(pidFilePath);
-    yield* apiFiles.deleteStateFile(existing.state_file ?? stateFilePath).pipe(catchAll2(() => _void));
+    yield* apiFiles.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
     yield* writeSuccess({
       data: { stopped: true, stale: true, pid: existing.pid, pid_file: pidFilePath },
       md: `- stopped: true
@@ -101673,6 +102640,7 @@ var apiStopCommand = exports_Command.make("stop", { force: boolean8("force"), pi
     });
     return;
   }
+  yield* requireTrustedPidRecord({ record: existing, pidFilePath });
   yield* proc.kill(existing.pid, "SIGTERM");
   const exited = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: API_STOP_WAIT_DEFAULT_MS });
   if (!exited) {
@@ -101696,7 +102664,7 @@ var apiStopCommand = exports_Command.make("stop", { force: boolean8("force"), pi
     }
   }
   yield* apiFiles.deletePidFile(pidFilePath);
-  yield* apiFiles.deleteStateFile(existing.state_file ?? stateFilePath).pipe(catchAll2(() => _void));
+  yield* apiFiles.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
   yield* writeSuccess({
     data: { stopped: true, pid: existing.pid, pid_file: pidFilePath },
     md: `- stopped: true
@@ -101753,13 +102721,13 @@ var readSelectionCurrentCommand = exports_Command.make("current", { stateFile: s
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/read/selection/outline.ts
-import path29 from "node:path";
+import path34 from "node:path";
 function optionToUndefined25(opt) {
   return isSome2(opt) ? opt.value : undefined;
 }
 function normalizeOptionalStateFile(stateFile10) {
   const trimmed2 = typeof stateFile10 === "string" ? stateFile10.trim() : "";
-  return trimmed2 ? path29.resolve(resolveUserFilePath(trimmed2)) : undefined;
+  return trimmed2 ? path34.resolve(resolveUserFilePath(trimmed2)) : undefined;
 }
 var stateFile10 = text10("state-file").pipe(optional6, map34(optionToUndefined25));
 var staleMs3 = integer7("stale-ms").pipe(optional6, map34(optionToUndefined25));
@@ -102103,152 +103071,6 @@ function waitForPluginServerHealth(baseUrl, waitMs, timeoutMs3) {
   });
 }
 
-// src/services/PluginServerFiles.ts
-import { promises as fs20 } from "node:fs";
-import path30 from "node:path";
-class PluginServerFiles extends Tag2("PluginServerFiles")() {
-}
-function ensureDir10(p3) {
-  return fs20.mkdir(path30.dirname(p3), { recursive: true }).then(() => {
-    return;
-  });
-}
-function defaultPidFile3() {
-  const envPidFile = process.env.REMNOTE_PLUGIN_SERVER_PID_FILE;
-  if (typeof envPidFile === "string" && envPidFile.trim())
-    return resolveUserFilePath(envPidFile);
-  return path30.join(homeDir(), ".agent-remnote", "plugin-server.pid");
-}
-function defaultLogFile3() {
-  const envLogFile = process.env.REMNOTE_PLUGIN_SERVER_LOG_FILE;
-  if (typeof envLogFile === "string" && envLogFile.trim())
-    return resolveUserFilePath(envLogFile);
-  return path30.join(homeDir(), ".agent-remnote", "plugin-server.log");
-}
-function defaultStateFile3() {
-  const envStateFile = process.env.REMNOTE_PLUGIN_SERVER_STATE_FILE;
-  if (typeof envStateFile === "string" && envStateFile.trim())
-    return resolveUserFilePath(envStateFile);
-  return path30.join(homeDir(), ".agent-remnote", "plugin-server.state.json");
-}
-function parseJson3(raw4, filePath) {
-  try {
-    return JSON.parse(raw4);
-  } catch (error4) {
-    throw new CliError({
-      code: "INTERNAL",
-      message: `Failed to parse JSON file: ${filePath}`,
-      exitCode: 1,
-      details: { file_path: filePath, error: String(error4?.message || error4) }
-    });
-  }
-}
-var PluginServerFilesLive = succeed10(PluginServerFiles, {
-  defaultPidFile: defaultPidFile3,
-  defaultLogFile: defaultLogFile3,
-  defaultStateFile: defaultStateFile3,
-  readPidFile: (pidFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      const raw4 = await fs20.readFile(resolved, "utf8");
-      return parseJson3(raw4, resolved);
-    },
-    catch: (error4) => {
-      const code2 = error4?.code;
-      if (code2 === "ENOENT")
-        return;
-      if (isCliError(error4))
-        return error4;
-      return new CliError({
-        code: "INTERNAL",
-        message: "Failed to read plugin server pid file",
-        exitCode: 1,
-        details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-      });
-    }
-  }).pipe(catchAll2((error4) => {
-    if (error4 === undefined)
-      return succeed8(undefined);
-    return fail8(error4);
-  })),
-  writePidFile: (pidFilePath, value8) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      await ensureDir10(resolved);
-      await fs20.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
-`, "utf8");
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to write plugin server pid file",
-      exitCode: 1,
-      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  deletePidFile: (pidFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(pidFilePath);
-      await fs20.rm(resolved, { force: true });
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to delete plugin server pid file",
-      exitCode: 1,
-      details: { file_path: pidFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  readStateFile: (stateFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      const raw4 = await fs20.readFile(resolved, "utf8");
-      return parseJson3(raw4, resolved);
-    },
-    catch: (error4) => {
-      const code2 = error4?.code;
-      if (code2 === "ENOENT")
-        return;
-      if (isCliError(error4))
-        return error4;
-      return new CliError({
-        code: "INTERNAL",
-        message: "Failed to read plugin server state file",
-        exitCode: 1,
-        details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-      });
-    }
-  }).pipe(catchAll2((error4) => {
-    if (error4 === undefined)
-      return succeed8(undefined);
-    return fail8(error4);
-  })),
-  writeStateFile: (stateFilePath, value8) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      await ensureDir10(resolved);
-      await fs20.writeFile(resolved, `${JSON.stringify(value8, null, 2)}
-`, "utf8");
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to write plugin server state file",
-      exitCode: 1,
-      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-    })
-  }),
-  deleteStateFile: (stateFilePath) => tryPromise2({
-    try: async () => {
-      const resolved = resolveUserFilePath(stateFilePath);
-      await fs20.rm(resolved, { force: true });
-    },
-    catch: (error4) => new CliError({
-      code: "INTERNAL",
-      message: "Failed to delete plugin server state file",
-      exitCode: 1,
-      details: { file_path: stateFilePath, error: String(error4?.message || error4) }
-    })
-  })
-});
-
 // src/commands/plugin/_shared.ts
 var PLUGIN_SERVER_HEALTH_TIMEOUT_MS = 2000;
 var PLUGIN_SERVER_START_WAIT_DEFAULT_MS = 15000;
@@ -102302,6 +103124,7 @@ function startPluginServer(params3) {
       if (!alive) {
         yield* files.deletePidFile(pidFilePath);
       } else {
+        yield* requireTrustedPidRecord({ record: existing, pidFilePath });
         return {
           started: false,
           pid: existing.pid,
@@ -102368,6 +103191,7 @@ function ensurePluginServer(params3) {
       if (existing) {
         const alive = yield* proc.isPidRunning(existing.pid);
         if (alive) {
+          yield* requireTrustedPidRecord({ record: existing, pidFilePath });
           return {
             started: false,
             pid: existing.pid,
@@ -102499,20 +103323,43 @@ var pluginRestartCommand = exports_Command.make("restart", {
   const proc = yield* Process;
   const pidFilePath = resolveUserFilePath(pidFile17 ?? files.defaultPidFile());
   const existing = yield* files.readPidFile(pidFilePath);
+  const stateFilePath = resolveManagedStateFile({
+    pidFilePath,
+    defaultStateFilePath: files.defaultStateFile(),
+    explicitStateFilePath: stateFile20,
+    candidate: existing?.state_file
+  });
   let stoppedPid;
   if (existing) {
     const alive = yield* proc.isPidRunning(existing.pid);
     if (alive) {
+      yield* requireTrustedPidRecord({ record: existing, pidFilePath });
       yield* proc.kill(existing.pid, "SIGTERM");
       const exited = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: PLUGIN_SERVER_STOP_WAIT_DEFAULT_MS });
-      if (!exited && force) {
+      if (!exited) {
+        if (!force) {
+          return yield* fail8(new CliError({
+            code: "INTERNAL",
+            message: `Plugin server did not exit within ${PLUGIN_SERVER_STOP_WAIT_DEFAULT_MS}ms; use --force`,
+            exitCode: 1,
+            details: { pid: existing.pid, pid_file: pidFilePath }
+          }));
+        }
         yield* proc.kill(existing.pid, "SIGKILL");
-        yield* proc.waitForExit({ pid: existing.pid, timeoutMs: PLUGIN_SERVER_STOP_WAIT_DEFAULT_MS });
+        const killed = yield* proc.waitForExit({ pid: existing.pid, timeoutMs: PLUGIN_SERVER_STOP_WAIT_DEFAULT_MS });
+        if (!killed) {
+          return yield* fail8(new CliError({
+            code: "INTERNAL",
+            message: "Force stop failed (process is still alive)",
+            exitCode: 1,
+            details: { pid: existing.pid, pid_file: pidFilePath }
+          }));
+        }
       }
       stoppedPid = existing.pid;
     }
     yield* files.deletePidFile(pidFilePath).pipe(catchAll2(() => _void));
-    yield* files.deleteStateFile(existing.state_file ?? resolveUserFilePath(stateFile20 ?? files.defaultStateFile())).pipe(catchAll2(() => _void));
+    yield* files.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
   }
   const started = yield* startPluginServer({ host: host7, port: port9, waitMs: wait3, pidFile: pidFile17, logFile: logFile10, stateFile: stateFile20 });
   yield* writeSuccess({
@@ -102570,7 +103417,7 @@ import { createServer as createServer2 } from "node:http";
 
 // src/lib/pluginStaticFiles.ts
 import { promises as fs21 } from "node:fs";
-import path31 from "node:path";
+import path35 from "node:path";
 var CONTENT_TYPES = new Map([
   [".css", "text/css; charset=utf-8"],
   [".html", "text/html; charset=utf-8"],
@@ -102580,7 +103427,7 @@ var CONTENT_TYPES = new Map([
   [".txt", "text/plain; charset=utf-8"]
 ]);
 function contentTypeFor(filePath) {
-  return CONTENT_TYPES.get(path31.extname(filePath).toLowerCase()) ?? "application/octet-stream";
+  return CONTENT_TYPES.get(path35.extname(filePath).toLowerCase()) ?? "application/octet-stream";
 }
 function normalizeAssetPath(pathname) {
   let decoded;
@@ -102590,7 +103437,7 @@ function normalizeAssetPath(pathname) {
     return null;
   }
   const raw4 = decoded === "/" ? "index.html" : decoded.replace(/^\/+/, "");
-  const normalized = path31.posix.normalize(raw4);
+  const normalized = path35.posix.normalize(raw4);
   if (!normalized || normalized === "." || normalized.startsWith("../") || normalized === "..")
     return null;
   return normalized;
@@ -102604,8 +103451,8 @@ async function readPluginStaticAsset(params3) {
   if (!relativePath) {
     return { ok: false, statusCode: 404, message: "Not found" };
   }
-  const filePath = path31.resolve(params3.distPath, relativePath);
-  if (filePath !== params3.distPath && !filePath.startsWith(`${params3.distPath}${path31.sep}`)) {
+  const filePath = path35.resolve(params3.distPath, relativePath);
+  if (filePath !== params3.distPath && !filePath.startsWith(`${params3.distPath}${path35.sep}`)) {
     return { ok: false, statusCode: 404, message: "Not found" };
   }
   try {
@@ -102922,8 +103769,14 @@ function stopPluginServer(params3) {
     const files = yield* PluginServerFiles;
     const proc = yield* Process;
     const existing = yield* files.readPidFile(params3.pidFilePath);
+    const stateFilePath = resolveManagedStateFile({
+      pidFilePath: params3.pidFilePath,
+      defaultStateFilePath: files.defaultStateFile(),
+      explicitStateFilePath: params3.stateFilePath,
+      candidate: existing?.state_file
+    });
     if (!existing) {
-      yield* files.deleteStateFile(params3.stateFilePath).pipe(catchAll2(() => _void));
+      yield* files.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
       return {
         stopped: true,
         pid_file: params3.pidFilePath
@@ -102931,7 +103784,7 @@ function stopPluginServer(params3) {
     }
     const cleanupStale = () => gen2(function* () {
       yield* files.deletePidFile(params3.pidFilePath);
-      yield* files.deleteStateFile(existing.state_file ?? params3.stateFilePath).pipe(catchAll2(() => _void));
+      yield* files.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
       return {
         stopped: true,
         stale: true,
@@ -102943,6 +103796,7 @@ function stopPluginServer(params3) {
     if (!alive) {
       return yield* cleanupStale();
     }
+    yield* requireTrustedPidRecord({ record: existing, pidFilePath: params3.pidFilePath });
     const termResult = yield* proc.kill(existing.pid, "SIGTERM").pipe(either3);
     if (termResult._tag === "Left") {
       if (isEsrch(termResult.left)) {
@@ -102972,7 +103826,7 @@ function stopPluginServer(params3) {
       }
     }
     yield* files.deletePidFile(params3.pidFilePath);
-    yield* files.deleteStateFile(existing.state_file ?? params3.stateFilePath).pipe(catchAll2(() => _void));
+    yield* files.deleteStateFile(stateFilePath).pipe(catchAll2(() => _void));
     return {
       stopped: true,
       pid: existing.pid,
@@ -108621,53 +109475,9 @@ var writeReplaceCommand = exports_Command.make("replace", {}).pipe(exports_Comma
 var replaceCommand = writeReplaceCommand;
 
 // src/lib/scenario-store/index.ts
-import path33 from "node:path";
+import path36 from "node:path";
 import { promises as fs22 } from "node:fs";
 
-// src/lib/builtin-scenarios/index.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import path32 from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-var MODULE_DIR = path32.dirname(fileURLToPath4(import.meta.url));
-function locateBuiltinSourceRoot() {
-  const packageRootCandidates = [
-    path32.resolve(MODULE_DIR, "../../../"),
-    path32.resolve(MODULE_DIR, "..")
-  ];
-  for (const packageRoot of packageRootCandidates) {
-    const builtinSourceRoot = path32.join(packageRoot, "builtin-scenarios");
-    if (existsSync4(path32.join(builtinSourceRoot, "catalog.json"))) {
-      return { packageRoot, builtinSourceRoot };
-    }
-  }
-  throw new Error(`Unable to locate builtin-scenarios catalog from ${MODULE_DIR}`);
-}
-var { packageRoot: PACKAGE_ROOT, builtinSourceRoot: BUILTIN_SOURCE_ROOT } = locateBuiltinSourceRoot();
-var REPO_ROOT = path32.resolve(PACKAGE_ROOT, "../..");
-var BUILTIN_CATALOG_PATH = path32.join(BUILTIN_SOURCE_ROOT, "catalog.json");
-function readJsonFile(filePath) {
-  return JSON.parse(readFileSync4(filePath, "utf8"));
-}
-function resolveRepoPath(relPath) {
-  return path32.resolve(REPO_ROOT, relPath);
-}
-var builtinScenarioCatalog = readJsonFile(BUILTIN_CATALOG_PATH);
-var builtinScenarioPackages = Object.freeze(Object.fromEntries(builtinScenarioCatalog.map((entry) => [entry.package_id, readJsonFile(resolveRepoPath(entry.package_path))])));
-function getBuiltinScenarioPackage(id5) {
-  const pkg = builtinScenarioPackages[id5];
-  if (!pkg) {
-    throw new Error(`Unknown builtin scenario package: ${id5}`);
-  }
-  return pkg;
-}
-function getBuiltinScenarioPackageSourcePath(id5) {
-  const entry = builtinScenarioCatalog.find((item) => item.package_id === id5);
-  if (!entry) {
-    throw new Error(`Unknown builtin scenario source: ${id5}`);
-  }
-  return resolveRepoPath(entry.package_path);
-}
-
 // src/lib/scenario-shared/index.ts
 class ScenarioSharedError extends Error {
   code;
@@ -108680,34 +109490,34 @@ class ScenarioSharedError extends Error {
 function isRecord4(value8) {
   return value8 !== null && typeof value8 === "object" && !Array.isArray(value8);
 }
-function addDiagnostic(diagnostics, errors3, level, path33, message2) {
-  diagnostics.push({ level, path: path33, message: message2 });
+function addDiagnostic(diagnostics, errors3, level, path36, message2) {
+  diagnostics.push({ level, path: path36, message: message2 });
   if (level === "error")
     errors3.push(message2);
 }
-function addChange(changes2, path33, kind2, before2, after3) {
-  changes2.push({ path: path33, kind: kind2, before: before2, after: after3 });
+function addChange(changes2, path36, kind2, before2, after3) {
+  changes2.push({ path: path36, kind: kind2, before: before2, after: after3 });
 }
-function expectRecord(value8, path33, diagnostics, errors3) {
+function expectRecord(value8, path36, diagnostics, errors3) {
   if (isRecord4(value8))
     return value8;
-  addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must be an object`);
+  addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must be an object`);
   return {};
 }
-function expectString(value8, path33, diagnostics, errors3, fallback = "") {
+function expectString(value8, path36, diagnostics, errors3, fallback = "") {
   if (typeof value8 === "string" && value8.trim())
     return value8.trim();
-  addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must be a non-empty string`);
+  addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must be a non-empty string`);
   return fallback;
 }
-function expectStringArray(value8, path33, diagnostics, errors3) {
+function expectStringArray(value8, path36, diagnostics, errors3) {
   if (!Array.isArray(value8)) {
-    addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must be an array`);
+    addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must be an array`);
     return [];
   }
   const out = value8.map((item) => typeof item === "string" ? item.trim() : "").filter((item) => item.length > 0);
   if (out.length !== value8.length) {
-    addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must contain only non-empty strings`);
+    addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must contain only non-empty strings`);
   }
   return out;
 }
@@ -108730,21 +109540,21 @@ function normalizePowerupValue2(value8) {
     return "t";
   return trimmed2;
 }
-function normalizeQuerySelector(raw4, path33, diagnostics, errors3, changes2) {
-  const input = expectRecord(raw4, path33, diagnostics, errors3);
+function normalizeQuerySelector(raw4, path36, diagnostics, errors3, changes2) {
+  const input = expectRecord(raw4, path36, diagnostics, errors3);
   let query2 = input;
   if (isRecord4(input.query)) {
     query2 = input.query;
   } else if (isRecord4(input.queryObj)) {
     query2 = input.queryObj;
-    addChange(changes2, `${path33}.queryObj`, "normalized", input.queryObj, query2);
+    addChange(changes2, `${path36}.queryObj`, "normalized", input.queryObj, query2);
   }
   if (isRecord4(query2.query)) {
     query2 = query2.query;
   }
   const version = 2;
-  const root = expectRecord(query2.root ?? query2, `${path33}.root`, diagnostics, errors3);
-  const normalizedRoot = normalizeQueryRoot2(root, `${path33}.root`, diagnostics, errors3, changes2);
+  const root = expectRecord(query2.root ?? query2, `${path36}.root`, diagnostics, errors3);
+  const normalizedRoot = normalizeQueryRoot2(root, `${path36}.root`, diagnostics, errors3, changes2);
   return {
     version,
     root: normalizedRoot,
@@ -108753,31 +109563,31 @@ function normalizeQuerySelector(raw4, path33, diagnostics, errors3, changes2) {
     ...isRecord4(query2.sort) ? { sort: query2.sort } : {}
   };
 }
-function normalizeQueryRoot2(raw4, path33, diagnostics, errors3, changes2) {
-  const type2 = expectString(raw4.type, `${path33}.type`, diagnostics, errors3);
+function normalizeQueryRoot2(raw4, path36, diagnostics, errors3, changes2) {
+  const type2 = expectString(raw4.type, `${path36}.type`, diagnostics, errors3);
   if (type2 === "text") {
-    const value8 = expectString(raw4.value, `${path33}.value`, diagnostics, errors3);
+    const value8 = expectString(raw4.value, `${path36}.value`, diagnostics, errors3);
     const mode = typeof raw4.mode === "string" && raw4.mode.trim() ? raw4.mode.trim() : "contains";
     if (raw4.mode === undefined) {
-      addChange(changes2, `${path33}.mode`, "defaulted", undefined, mode);
+      addChange(changes2, `${path36}.mode`, "defaulted", undefined, mode);
     }
     return { type: type2, value: value8, mode };
   }
   if (type2 === "powerup") {
-    const powerup3 = expectRecord(raw4.powerup, `${path33}.powerup`, diagnostics, errors3);
+    const powerup3 = expectRecord(raw4.powerup, `${path36}.powerup`, diagnostics, errors3);
     let by = typeof powerup3.by === "string" ? powerup3.by.trim().toLowerCase() : "";
     if (by !== "id" && by !== "rcrt") {
       if (!by) {
         by = "rcrt";
-        addChange(changes2, `${path33}.powerup.by`, "defaulted", powerup3.by, by);
+        addChange(changes2, `${path36}.powerup.by`, "defaulted", powerup3.by, by);
       } else {
-        addDiagnostic(diagnostics, errors3, "error", `${path33}.powerup.by`, "powerup.by must be one of: id, rcrt");
+        addDiagnostic(diagnostics, errors3, "error", `${path36}.powerup.by`, "powerup.by must be one of: id, rcrt");
       }
     }
-    const rawValue = expectString(powerup3.value, `${path33}.powerup.value`, diagnostics, errors3);
+    const rawValue = expectString(powerup3.value, `${path36}.powerup.value`, diagnostics, errors3);
     const value8 = by === "rcrt" ? normalizePowerupValue2(rawValue) : rawValue;
     if (value8 !== rawValue) {
-      addChange(changes2, `${path33}.powerup.value`, "normalized", rawValue, value8);
+      addChange(changes2, `${path36}.powerup.value`, "normalized", rawValue, value8);
     }
     return {
       type: type2,
@@ -108790,45 +109600,45 @@ function normalizeQueryRoot2(raw4, path33, diagnostics, errors3, changes2) {
   if ((type2 === "and" || type2 === "or") && Array.isArray(raw4.nodes)) {
     return {
       type: type2,
-      nodes: raw4.nodes.map((child, index) => normalizeQueryRoot2(expectRecord(child, `${path33}.nodes[${index}]`, diagnostics, errors3), `${path33}.nodes[${index}]`, diagnostics, errors3, changes2))
+      nodes: raw4.nodes.map((child, index) => normalizeQueryRoot2(expectRecord(child, `${path36}.nodes[${index}]`, diagnostics, errors3), `${path36}.nodes[${index}]`, diagnostics, errors3, changes2))
     };
   }
   if (type2 === "not") {
     return {
       type: type2,
-      node: normalizeQueryRoot2(expectRecord(raw4.node, `${path33}.node`, diagnostics, errors3), `${path33}.node`, diagnostics, errors3, changes2)
+      node: normalizeQueryRoot2(expectRecord(raw4.node, `${path36}.node`, diagnostics, errors3), `${path36}.node`, diagnostics, errors3, changes2)
     };
   }
   return raw4;
 }
-function normalizeVars(raw4, path33, diagnostics, errors3, changes2) {
+function normalizeVars(raw4, path36, diagnostics, errors3, changes2) {
   if (Array.isArray(raw4)) {
-    return raw4.map((item, index) => normalizeVar(item, `${path33}[${index}]`, diagnostics, errors3));
+    return raw4.map((item, index) => normalizeVar(item, `${path36}[${index}]`, diagnostics, errors3));
   }
   if (isRecord4(raw4)) {
-    const vars = Object.entries(raw4).map(([name, value8]) => normalizeVar({ ...isRecord4(value8) ? value8 : {}, name }, `${path33}.${name}`, diagnostics, errors3));
-    addChange(changes2, path33, "normalized", raw4, vars);
+    const vars = Object.entries(raw4).map(([name, value8]) => normalizeVar({ ...isRecord4(value8) ? value8 : {}, name }, `${path36}.${name}`, diagnostics, errors3));
+    addChange(changes2, path36, "normalized", raw4, vars);
     return vars;
   }
   if (raw4 === undefined)
     return [];
-  addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must be an array or object`);
+  addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must be an array or object`);
   return [];
 }
-function normalizeVar(raw4, path33, diagnostics, errors3) {
-  const value8 = expectRecord(raw4, path33, diagnostics, errors3);
+function normalizeVar(raw4, path36, diagnostics, errors3) {
+  const value8 = expectRecord(raw4, path36, diagnostics, errors3);
   return {
-    name: expectString(value8.name, `${path33}.name`, diagnostics, errors3),
-    type: expectString(value8.type, `${path33}.type`, diagnostics, errors3, "string"),
+    name: expectString(value8.name, `${path36}.name`, diagnostics, errors3),
+    type: expectString(value8.type, `${path36}.type`, diagnostics, errors3, "string"),
     required: asBoolean(value8.required, false),
     ...value8.default !== undefined ? { default: value8.default } : {},
     ...typeof value8.description === "string" && value8.description.trim() ? { description: value8.description.trim() } : {}
   };
 }
-function normalizeCapabilities(raw4, path33, changes2) {
+function normalizeCapabilities(raw4, path36, changes2) {
   if (Array.isArray(raw4)) {
     const out = Object.fromEntries(raw4.map((item) => String(item ?? "").trim()).filter(Boolean).map((item) => [item.replace(/^requires\./, ""), true]));
-    addChange(changes2, path33, "normalized", raw4, { requires: out });
+    addChange(changes2, path36, "normalized", raw4, { requires: out });
     return Object.keys(out).length > 0 ? { requires: out } : {};
   }
   if (!isRecord4(raw4))
@@ -108836,7 +109646,7 @@ function normalizeCapabilities(raw4, path33, changes2) {
   const requires = raw4.requires;
   if (Array.isArray(requires)) {
     const out = Object.fromEntries(requires.map((item) => String(item ?? "").trim()).filter(Boolean).map((item) => [item.replace(/^requires\./, ""), true]));
-    addChange(changes2, `${path33}.requires`, "normalized", requires, out);
+    addChange(changes2, `${path36}.requires`, "normalized", requires, out);
     return Object.keys(out).length > 0 ? { requires: out } : {};
   }
   if (isRecord4(requires)) {
@@ -108845,8 +109655,8 @@ function normalizeCapabilities(raw4, path33, changes2) {
   }
   return {};
 }
-function normalizePolicy(raw4, path33, diagnostics, errors3) {
-  const value8 = expectRecord(raw4, path33, diagnostics, errors3);
+function normalizePolicy(raw4, path36, diagnostics, errors3) {
+  const value8 = expectRecord(raw4, path36, diagnostics, errors3);
   const fallbackStrategy = value8.fallback_strategy === "allow_empty_selection" || value8.fallback_strategy === "skip_optional_outputs" || value8.fallback_strategy === "fail" ? value8.fallback_strategy : undefined;
   return {
     wait: asBoolean(value8.wait, false),
@@ -108856,10 +109666,10 @@ function normalizePolicy(raw4, path33, diagnostics, errors3) {
     ...fallbackStrategy ? { fallback_strategy: fallbackStrategy } : {}
   };
 }
-function normalizeScheduling(raw4, path33, diagnostics, errors3) {
+function normalizeScheduling(raw4, path36, diagnostics, errors3) {
   if (raw4 === undefined)
     return;
-  const value8 = expectRecord(raw4, path33, diagnostics, errors3);
+  const value8 = expectRecord(raw4, path36, diagnostics, errors3);
   const batching = value8.batching === "off" || value8.batching === "auto" ? value8.batching : undefined;
   const mergeStrategy = value8.merge_strategy === "off" || value8.merge_strategy === "safe_dedupe" ? value8.merge_strategy : undefined;
   const parallelism = value8.parallelism === "serial" || value8.parallelism === "auto" ? value8.parallelism : undefined;
@@ -108873,13 +109683,13 @@ function normalizeScheduling(raw4, path33, diagnostics, errors3) {
     ...dispatchMode7 ? { dispatch_mode: dispatchMode7 } : {}
   };
 }
-function normalizeNodes(raw4, path33, diagnostics, errors3, changes2) {
+function normalizeNodes(raw4, path36, diagnostics, errors3, changes2) {
   if (!Array.isArray(raw4)) {
-    addDiagnostic(diagnostics, errors3, "error", path33, `${path33} must be an array`);
+    addDiagnostic(diagnostics, errors3, "error", path36, `${path36} must be an array`);
     return [];
   }
   return raw4.map((item, index) => {
-    const nodePath = `${path33}[${index}]`;
+    const nodePath = `${path36}[${index}]`;
     const value8 = expectRecord(item, nodePath, diagnostics, errors3);
     const id5 = expectString(value8.id, `${nodePath}.id`, diagnostics, errors3);
     const kind2 = expectString(value8.kind, `${nodePath}.kind`, diagnostics, errors3);
@@ -108931,18 +109741,18 @@ function normalizeNodes(raw4, path33, diagnostics, errors3, changes2) {
     };
   });
 }
-function scanStructuredReferences(value8, onRef, path33) {
+function scanStructuredReferences(value8, onRef, path36) {
   if (Array.isArray(value8)) {
-    value8.forEach((item, index) => scanStructuredReferences(item, onRef, `${path33}[${index}]`));
+    value8.forEach((item, index) => scanStructuredReferences(item, onRef, `${path36}[${index}]`));
     return;
   }
   if (!isRecord4(value8))
     return;
   if (value8.kind === "node_output" && typeof value8.node === "string" && typeof value8.output === "string") {
-    onRef(value8, path33);
+    onRef(value8, path36);
   }
   for (const [key, child] of Object.entries(value8)) {
-    scanStructuredReferences(child, onRef, `${path33}.${key}`);
+    scanStructuredReferences(child, onRef, `${path36}.${key}`);
   }
 }
 function validateGraph(pkg, diagnostics, errors3) {
@@ -109250,7 +110060,7 @@ function generateScenarioPackage(input) {
 
 // src/lib/scenario-store/index.ts
 function defaultUserScenarioDir() {
-  return path33.join(homeDir(), ".agent-remnote", "scenarios");
+  return path36.join(homeDir(), ".agent-remnote", "scenarios");
 }
 function resolveUserScenarioDir(input) {
   if (typeof input === "string" && input.trim()) {
@@ -109281,7 +110091,7 @@ function canonicalScenarioId(input, fieldName) {
   return id5;
 }
 function userScenarioFilePath(id5, installDir) {
-  return path33.join(resolveUserScenarioDir(installDir), `${canonicalScenarioId(id5, "Scenario id")}.json`);
+  return path36.join(resolveUserScenarioDir(installDir), `${canonicalScenarioId(id5, "Scenario id")}.json`);
 }
 async function readUserScenarioPackageById(id5, installDir) {
   const canonicalId = canonicalScenarioId(id5, "Scenario id");
@@ -111446,7 +112256,7 @@ var stackEnsureCommand = exports_Command.make("ensure", {
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/stack/status.ts
-import path34 from "node:path";
+import path37 from "node:path";
 var stackStatusCommand = exports_Command.make("status", {}, () => gen2(function* () {
   const cfg = yield* AppConfig;
   const daemonFiles = yield* DaemonFiles;
@@ -111467,7 +112277,7 @@ var stackStatusCommand = exports_Command.make("status", {}, () => gen2(function*
   const apiBaseUrl = apiLocalBaseUrl(apiPidInfo?.port ?? cfg.apiPort ?? 3000, apiBasePath);
   const apiStatus = yield* api.status({ baseUrl: apiBaseUrl, timeoutMs: 2000 }).pipe(either3);
   const queueStats2 = yield* queue.stats({ dbPath: cfg.storeDb }).pipe(either3);
-  const stateFilePath = resolveUserFilePath(daemonPidInfo?.state_file ?? path34.join(path34.dirname(daemonPidFile), "ws.state.json"));
+  const stateFilePath = resolveUserFilePath(daemonPidInfo?.state_file ?? path37.join(path37.dirname(daemonPidFile), "ws.state.json"));
   const activeWorkerRuntime = clients._tag === "Right" && typeof clients.right.activeWorkerConnId === "string" ? clients.right.clients.find((client) => client.connId === clients.right.activeWorkerConnId)?.runtime ?? null : null;
   const data = {
     runtime: currentRuntimeBuildInfo(),
@@ -111529,7 +112339,7 @@ var stackStatusCommand = exports_Command.make("status", {}, () => gen2(function*
 }).pipe(catchAll2(writeFailure)));
 
 // src/commands/stack/stop.ts
-import path35 from "node:path";
+import path38 from "node:path";
 var stackStopCommand = exports_Command.make("stop", {}, () => gen2(function* () {
   const apiFiles = yield* ApiDaemonFiles;
   const daemonFiles = yield* DaemonFiles;
@@ -111537,8 +112347,14 @@ var stackStopCommand = exports_Command.make("stop", {}, () => gen2(function* ()
   const supervisorState = yield* SupervisorState;
   const apiPidFile = resolveUserFilePath(apiFiles.defaultPidFile());
   const apiPidInfo = yield* apiFiles.readPidFile(apiPidFile);
-  let apiStopped = true;
+  const apiStateFile = resolveManagedStateFile({
+    pidFilePath: apiPidFile,
+    defaultStateFilePath: apiFiles.defaultStateFile(),
+    candidate: apiPidInfo?.state_file
+  });
+  let apiStopped = false;
   if (apiPidInfo && (yield* proc.isPidRunning(apiPidInfo.pid))) {
+    yield* requireTrustedPidRecord({ record: apiPidInfo, pidFilePath: apiPidFile });
     yield* proc.kill(apiPidInfo.pid, "SIGTERM");
     const exited = yield* proc.waitForExit({ pid: apiPidInfo.pid, timeoutMs: API_STOP_WAIT_DEFAULT_MS });
     if (!exited) {
@@ -111548,13 +112364,22 @@ var stackStopCommand = exports_Command.make("stop", {}, () => gen2(function* ()
         return yield* fail8(new CliError({ code: "INTERNAL", message: "Failed to stop api process", exitCode: 1 }));
       }
     }
+    apiStopped = true;
+  } else {
+    apiStopped = true;
   }
   yield* apiFiles.deletePidFile(apiPidFile).pipe(catchAll2(() => _void));
-  yield* apiFiles.deleteStateFile(apiPidInfo?.state_file ?? apiFiles.defaultStateFile()).pipe(catchAll2(() => _void));
+  yield* apiFiles.deleteStateFile(apiStateFile).pipe(catchAll2(() => _void));
   const daemonPidFile = resolveUserFilePath(daemonFiles.defaultPidFile());
   const daemonPidInfo = yield* daemonFiles.readPidFile(daemonPidFile);
-  let daemonStopped = true;
+  const daemonStateFile = resolveManagedStateFile({
+    pidFilePath: daemonPidFile,
+    defaultStateFilePath: resolveUserFilePath(path38.join(path38.dirname(daemonPidFile), "ws.state.json")),
+    candidate: daemonPidInfo?.state_file
+  });
+  let daemonStopped = false;
   if (daemonPidInfo && (yield* proc.isPidRunning(daemonPidInfo.pid))) {
+    yield* requireTrustedPidRecord({ record: daemonPidInfo, pidFilePath: daemonPidFile });
     yield* proc.kill(daemonPidInfo.pid, "SIGTERM");
     const exited = yield* proc.waitForExit({ pid: daemonPidInfo.pid, timeoutMs: WS_STOP_WAIT_DEFAULT_MS });
     if (!exited) {
@@ -111564,9 +112389,12 @@ var stackStopCommand = exports_Command.make("stop", {}, () => gen2(function* ()
         return yield* fail8(new CliError({ code: "INTERNAL", message: "Failed to stop daemon process", exitCode: 1 }));
       }
     }
+    daemonStopped = true;
+  } else {
+    daemonStopped = true;
   }
   yield* daemonFiles.deletePidFile(daemonPidFile).pipe(catchAll2(() => _void));
-  yield* supervisorState.deleteStateFile(resolveUserFilePath(daemonPidInfo?.state_file ?? path35.join(path35.dirname(daemonPidFile), "ws.state.json"))).pipe(catchAll2(() => _void));
+  yield* supervisorState.deleteStateFile(daemonStateFile).pipe(catchAll2(() => _void));
   yield* writeSuccess({
     data: { stopped: true, api_stopped: apiStopped, daemon_stopped: daemonStopped },
     md: `- stopped: true
@@ -111769,8 +112597,6 @@ var cli = exports_Command.run(rootCommand, {
   name: "agent-remnote",
   version
 });
-var jsonRequested = process.argv.includes("--json");
-var debugRequested = process.argv.includes("--debug");
 function canonicalizeArgv(argv) {
   const out = [...argv];
   for (let i = 0;i < out.length; i += 1) {
@@ -111840,6 +112666,9 @@ var ROOT_VALUE_FLAGS2 = new Set([
   "--config-file",
   ...BUILTIN_VALUE_FLAGS2
 ]);
+var rootCliConfig = parseRootConfigFromArgv(argv);
+var jsonRequested = rootCliConfig.get("json") === "true";
+var debugRequested = rootCliConfig.get("debug") === "true";
 function parseRootConfigFromArgv(argv2) {
   const tokens = argv2.slice(2);
   const out = new Map;
@@ -112292,72 +113121,77 @@ function strictCommandPreflightOrExit(argv2) {
   process.exit(error4.exitCode);
 }
 strictCommandPreflightOrExit(argv);
-var configProvider = buildCliEnvConfigProvider({ cli: parseRootConfigFromArgv(argv), env: process.env });
-cli(argv).pipe(withConfigProvider2(configProvider), provide2(mergeAll5(exports_NodeContext.layer, setConsole2(makeCliConsole()))), scoped2, exit2, flatMap9((exit3) => sync3(() => {
-  process.exitCode = exitCodeFromExit(exit3);
-  if (isSuccess(exit3))
-    return;
-  const failure = failureOption2(exit3.cause);
-  if (isNone2(failure)) {
-    if (jsonRequested) {
-      process.stdout.write(`${JSON.stringify(fail21({
-        code: "INTERNAL",
-        message: "Unknown runtime error (defect)",
-        details: debugRequested ? { cause: pretty2(exit3.cause) } : undefined
-      }))}
+var isSearchWorkerThread = !isMainThread2 && workerData2?.kind === "search_rem_overview";
+if (isSearchWorkerThread && parentPort3) {
+  runSearchRemOverviewWorkerJob(workerData2, parentPort3);
+} else {
+  const configProvider = buildCliEnvConfigProvider({ cli: parseRootConfigFromArgv(argv), env: process.env });
+  cli(argv).pipe(withConfigProvider2(configProvider), provide2(mergeAll5(exports_NodeContext.layer, setConsole2(makeCliConsole()))), scoped2, exit2, flatMap9((exit3) => sync3(() => {
+    process.exitCode = exitCodeFromExit(exit3);
+    if (isSuccess(exit3))
+      return;
+    const failure = failureOption2(exit3.cause);
+    if (isNone2(failure)) {
+      if (jsonRequested) {
+        process.stdout.write(`${JSON.stringify(fail21({
+          code: "INTERNAL",
+          message: "Unknown runtime error (defect)",
+          details: debugRequested ? { cause: pretty2(exit3.cause) } : undefined
+        }))}
 `);
-    } else if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
-      globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
-      process.stderr.write(`${formatHumanErrorLine2("Unknown runtime error (defect)")}
+      } else if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
+        globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
+        process.stderr.write(`${formatHumanErrorLine2("Unknown runtime error (defect)")}
 `);
-      if (debugRequested)
-        process.stderr.write(pretty2(exit3.cause) + `
+        if (debugRequested)
+          process.stderr.write(pretty2(exit3.cause) + `
 `);
-    }
-    return;
-  }
-  const error4 = failure.value;
-  if (isValidationError2(error4)) {
-    if (!jsonRequested)
+      }
       return;
-    const cliError = cliErrorFromValidationError(error4);
-    process.stdout.write(`${JSON.stringify(fail21(toJsonError(cliError), cliError.hint))}
-`);
-    return;
-  }
-  if (isCliError(error4)) {
-    if (jsonRequested) {
-      process.stdout.write(`${JSON.stringify(fail21(toJsonError(error4), error4.hint))}
+    }
+    const error4 = failure.value;
+    if (isValidationError2(error4)) {
+      if (!jsonRequested)
+        return;
+      const cliError = cliErrorFromValidationError(error4);
+      process.stdout.write(`${JSON.stringify(fail21(toJsonError(cliError), cliError.hint))}
 `);
       return;
     }
-    if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
-      globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
-      process.stderr.write(`${formatHumanErrorLine2(error4.message)}
-`);
-      if (debugRequested && error4.details !== undefined) {
-        process.stderr.write(`${JSON.stringify(error4.details, null, 2)}
+    if (isCliError(error4)) {
+      if (jsonRequested) {
+        process.stdout.write(`${JSON.stringify(fail21(toJsonError(error4), error4.hint))}
 `);
+        return;
       }
-      if (error4.hint && error4.hint.length > 0) {
-        process.stderr.write(`Hint:
+      if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
+        globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
+        process.stderr.write(`${formatHumanErrorLine2(error4.message)}
+`);
+        if (debugRequested && error4.details !== undefined) {
+          process.stderr.write(`${JSON.stringify(error4.details, null, 2)}
 `);
-        for (const h of error4.hint)
-          process.stderr.write(`- ${h}
+        }
+        if (error4.hint && error4.hint.length > 0) {
+          process.stderr.write(`Hint:
+`);
+          for (const h of error4.hint)
+            process.stderr.write(`- ${h}
 `);
+        }
       }
+      return;
     }
-    return;
-  }
-  if (jsonRequested) {
-    process.stdout.write(`${JSON.stringify(fail21({
-      code: "INTERNAL",
-      message: String(error4?.message || error4 || "Unknown error")
-    }))}
+    if (jsonRequested) {
+      process.stdout.write(`${JSON.stringify(fail21({
+        code: "INTERNAL",
+        message: String(error4?.message || error4 || "Unknown error")
+      }))}
 `);
-  } else if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
-    globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
-    process.stderr.write(`${formatHumanErrorLine2(String(error4?.message || error4 || "Unknown error"))}
+    } else if (!globalThis.__REMNOTE_CLI_ERROR_REPORTED__) {
+      globalThis.__REMNOTE_CLI_ERROR_REPORTED__ = true;
+      process.stderr.write(`${formatHumanErrorLine2(String(error4?.message || error4 || "Unknown error"))}
 `);
-  }
-}))).pipe(exports_NodeRuntime.runMain);
+    }
+  }))).pipe(exports_NodeRuntime.runMain);
+}