archal 0.9.15 → 0.9.17

package/dist/cli.cjs

@@ -55007,33 +55007,33 @@ function resolveRuntimeDir(moduleUrl) {
     }
     return process.cwd();
   }
-  return (0, import_node_path17.dirname)((0, import_node_url4.fileURLToPath)(moduleUrl));
+  return (0, import_node_path18.dirname)((0, import_node_url4.fileURLToPath)(moduleUrl));
 }
 function resolveAncestorDirs(moduleUrl, maxParentDepth) {
   const dir = resolveRuntimeDir(moduleUrl);
   const dirs = [dir];
   for (let depth = 1; depth <= maxParentDepth; depth += 1) {
-    dirs.push((0, import_node_path17.resolve)(dir, ...Array(depth).fill("..")));
+    dirs.push((0, import_node_path18.resolve)(dir, ...Array(depth).fill("..")));
   }
   return dirs;
 }
 function resolveLocalTwinAssetCandidates(moduleUrl, twinName, ...segments) {
   const dirs = resolveAncestorDirs(moduleUrl, 5);
   const candidates = [
-    ...dirs.map((dir) => (0, import_node_path17.resolve)(dir, "clone-assets", twinName, ...segments)),
-    ...dirs.map((dir) => (0, import_node_path17.resolve)(dir, "twins", twinName, ...segments))
+    ...dirs.map((dir) => (0, import_node_path18.resolve)(dir, "clone-assets", twinName, ...segments)),
+    ...dirs.map((dir) => (0, import_node_path18.resolve)(dir, "twins", twinName, ...segments))
   ];
   return [...new Set(candidates)];
 }
 function findFirstExistingLocalTwinAssetPath(moduleUrl, twinName, ...segments) {
   return resolveLocalTwinAssetCandidates(moduleUrl, twinName, ...segments).find((candidate) => (0, import_node_fs18.existsSync)(candidate)) ?? null;
 }
-var import_node_fs18, import_node_path17, import_node_url4;
+var import_node_fs18, import_node_path18, import_node_url4;
 var init_bundled_assets = __esm({
   "../packages/seedgen/src/utils/bundled-assets.ts"() {
     "use strict";
     import_node_fs18 = require("fs");
-    import_node_path17 = require("path");
+    import_node_path18 = require("path");
     import_node_url4 = require("url");
   }
 });
@@ -55258,7 +55258,7 @@ function parseSqlSeed(sql) {
   return seed;
 }
 function loadSeedStateFromPath(seedRoot, seedName) {
-  const jsonPath = (0, import_node_path18.resolve)(seedRoot, `${seedName}.json`);
+  const jsonPath = (0, import_node_path19.resolve)(seedRoot, `${seedName}.json`);
   if ((0, import_node_fs19.existsSync)(jsonPath)) {
     try {
       return JSON.parse((0, import_node_fs19.readFileSync)(jsonPath, "utf-8"));
@@ -55267,7 +55267,7 @@ function loadSeedStateFromPath(seedRoot, seedName) {
       throw new Error(`Failed to parse seed file ${jsonPath}: ${detail}`, { cause: err });
     }
   }
-  const sqlPath = (0, import_node_path18.resolve)(seedRoot, `${seedName}.sql`);
+  const sqlPath = (0, import_node_path19.resolve)(seedRoot, `${seedName}.sql`);
   if ((0, import_node_fs19.existsSync)(sqlPath)) {
     try {
       return parseSqlSeed((0, import_node_fs19.readFileSync)(sqlPath, "utf-8"));
@@ -55299,17 +55299,17 @@ function loadBaseSeedFromDisk(twinName, seedName) {
 }
 function findBaseSeedFilePath(twinName, seedName) {
   for (const seedRoot of resolveLocalTwinAssetCandidates(void 0, twinName, "seeds")) {
-    const jsonPath = (0, import_node_path18.resolve)(seedRoot, `${seedName}.json`);
+    const jsonPath = (0, import_node_path19.resolve)(seedRoot, `${seedName}.json`);
     if ((0, import_node_fs19.existsSync)(jsonPath)) return jsonPath;
   }
   return null;
 }
-var import_node_fs19, import_node_path18;
+var import_node_fs19, import_node_path19;
 var init_state_helpers = __esm({
   "../packages/seedgen/src/runner/seed/state-helpers.ts"() {
     "use strict";
     import_node_fs19 = require("fs");
-    import_node_path18 = require("path");
+    import_node_path19 = require("path");
     init_src();
     init_bundled_assets();
   }
@@ -55347,18 +55347,18 @@ __export(catalog_exports, {
 });
 function localScenarioDirCandidates() {
   return [
-    (0, import_node_path32.resolve)("scenarios"),
-    (0, import_node_path32.resolve)("scenario"),
-    (0, import_node_path32.resolve)("test", "scenarios"),
-    (0, import_node_path32.resolve)("tests", "scenarios"),
-    (0, import_node_path32.resolve)(".archal", "scenarios")
+    (0, import_node_path33.resolve)("scenarios"),
+    (0, import_node_path33.resolve)("scenario"),
+    (0, import_node_path33.resolve)("test", "scenarios"),
+    (0, import_node_path33.resolve)("tests", "scenarios"),
+    (0, import_node_path33.resolve)(".archal", "scenarios")
   ];
 }
 function hostedScenarioCacheRoot() {
-  return (0, import_node_path32.resolve)(".archal", "cache", "hosted-scenarios");
+  return (0, import_node_path33.resolve)(".archal", "cache", "hosted-scenarios");
 }
 function workspaceScenarioCacheRoot() {
-  return (0, import_node_path32.resolve)(".archal", "cache", "workspace-scenarios");
+  return (0, import_node_path33.resolve)(".archal", "cache", "workspace-scenarios");
 }
 function findScenarioFiles(dir) {
   if (!(0, import_node_fs35.existsSync)(dir)) {
@@ -55367,12 +55367,12 @@ function findScenarioFiles(dir) {
   const files = [];
   const entries = (0, import_node_fs35.readdirSync)(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = (0, import_node_path32.join)(dir, entry.name);
+    const fullPath = (0, import_node_path33.join)(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...findScenarioFiles(fullPath));
       continue;
     }
-    if (entry.isFile() && (0, import_node_path32.extname)(entry.name) === ".md") {
+    if (entry.isFile() && (0, import_node_path33.extname)(entry.name) === ".md") {
       files.push(fullPath);
     }
   }
@@ -55386,12 +55386,12 @@ function findLocalScenariosDir() {
     }
   }
   return {
-    dir: (0, import_node_path32.resolve)("scenarios"),
+    dir: (0, import_node_path33.resolve)("scenarios"),
     candidates
   };
 }
 function resolveLocalScenario(nameOrPath) {
-  const directPath = (0, import_node_path32.resolve)(nameOrPath);
+  const directPath = (0, import_node_path33.resolve)(nameOrPath);
   if ((0, import_node_fs35.existsSync)(directPath)) {
     return directPath;
   }
@@ -55400,7 +55400,7 @@ function resolveLocalScenario(nameOrPath) {
     if (!(0, import_node_fs35.existsSync)(candidate)) {
       continue;
     }
-    const rootCandidate = (0, import_node_path32.join)(candidate, needle);
+    const rootCandidate = (0, import_node_path33.join)(candidate, needle);
     if ((0, import_node_fs35.existsSync)(rootCandidate)) {
       return rootCandidate;
     }
@@ -55429,28 +55429,28 @@ function normalizeScenarioSlug(input) {
   return segments.join("/");
 }
 function deriveScenarioSlugWithinRoot(root, scenarioPath) {
-  const relativePath = (0, import_node_path32.relative)(root, scenarioPath).replace(/\\/gu, "/");
+  const relativePath = (0, import_node_path33.relative)(root, scenarioPath).replace(/\\/gu, "/");
   if (!relativePath || relativePath === ".." || relativePath.startsWith("../")) {
     return null;
   }
   return normalizeScenarioSlug(relativePath);
 }
 function deriveScenarioSlugFromPath(scenarioPath) {
-  const resolvedPath = (0, import_node_path32.resolve)(scenarioPath);
+  const resolvedPath = (0, import_node_path33.resolve)(scenarioPath);
   const hostedSlug = deriveScenarioSlugWithinRoot(hostedScenarioCacheRoot(), resolvedPath);
   if (hostedSlug) {
     return hostedSlug;
   }
   const { dir } = findLocalScenariosDir();
-  return deriveScenarioSlugWithinRoot((0, import_node_path32.resolve)(dir), resolvedPath);
+  return deriveScenarioSlugWithinRoot((0, import_node_path33.resolve)(dir), resolvedPath);
 }
 function cacheHostedScenario(slug2, content) {
   const normalizedSlug = normalizeScenarioSlug(slug2);
   if (!normalizedSlug) {
     throw new Error(`Invalid hosted scenario slug: ${slug2}`);
   }
-  const cachedPath = (0, import_node_path32.resolve)(hostedScenarioCacheRoot(), `${normalizedSlug}.md`);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path32.dirname)(cachedPath), { recursive: true });
+  const cachedPath = (0, import_node_path33.resolve)(hostedScenarioCacheRoot(), `${normalizedSlug}.md`);
+  (0, import_node_fs35.mkdirSync)((0, import_node_path33.dirname)(cachedPath), { recursive: true });
   (0, import_node_fs35.writeFileSync)(cachedPath, content, "utf8");
   return cachedPath;
 }
@@ -55459,8 +55459,8 @@ function cacheWorkspaceScenario(scenario) {
   if (!normalizedSlug) {
     throw new Error(`Invalid workspace scenario slug: ${scenario.slug || scenario.id}`);
   }
-  const cachedPath = (0, import_node_path32.resolve)(workspaceScenarioCacheRoot(), `${normalizedSlug}.md`);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path32.dirname)(cachedPath), { recursive: true });
+  const cachedPath = (0, import_node_path33.resolve)(workspaceScenarioCacheRoot(), `${normalizedSlug}.md`);
+  (0, import_node_fs35.mkdirSync)((0, import_node_path33.dirname)(cachedPath), { recursive: true });
   (0, import_node_fs35.writeFileSync)(cachedPath, scenario.markdown, "utf8");
   return cachedPath;
 }
@@ -55527,12 +55527,12 @@ async function resolveWorkspaceScenarioToCachedPath(token, input) {
     launch: result.data
   };
 }
-var import_node_fs35, import_node_path32;
+var import_node_fs35, import_node_path33;
 var init_catalog = __esm({
   "src/scenarios/catalog.ts"() {
     "use strict";
     import_node_fs35 = require("fs");
-    import_node_path32 = require("path");
+    import_node_path33 = require("path");
     init_api_client();
   }
 });
@@ -55817,7 +55817,7 @@ function importedSpecifiersInSource(source) {
   return specifiers;
 }
 function readEntryFile(harnessDir, candidate) {
-  const filePath = (0, import_node_path47.resolve)(harnessDir, candidate);
+  const filePath = (0, import_node_path48.resolve)(harnessDir, candidate);
   if (!(0, import_node_fs51.existsSync)(filePath)) return void 0;
   try {
     return (0, import_node_fs51.readFileSync)(filePath, "utf-8");
@@ -55840,7 +55840,7 @@ function detectTwinsFromHarnessDir(harnessDir) {
       twins.add(envSegmentToCloneName(envMatch[1] ?? ""));
     }
   }
-  for (const dep of readPackageJsonDeps((0, import_node_path47.resolve)(harnessDir, "package.json"))) {
+  for (const dep of readPackageJsonDeps((0, import_node_path48.resolve)(harnessDir, "package.json"))) {
     const twinName = PACKAGE_TO_CLONE[dep];
     if (twinName) twins.add(twinName);
   }
@@ -55859,17 +55859,17 @@ function harnessUsesLlm(harnessDir) {
       if (LLM_SDK_PACKAGES.has(root)) return true;
     }
   }
-  for (const dep of readPackageJsonDeps((0, import_node_path47.resolve)(harnessDir, "package.json"))) {
+  for (const dep of readPackageJsonDeps((0, import_node_path48.resolve)(harnessDir, "package.json"))) {
     if (LLM_SDK_PACKAGES.has(dep)) return true;
   }
   return false;
 }
-var import_node_fs51, import_node_path47, TWIN_ENTRY_CANDIDATES, LLM_ENTRY_CANDIDATES, IMPORT_PATTERNS, ENV_VAR_PATTERN, LLM_SDK_PACKAGES;
+var import_node_fs51, import_node_path48, TWIN_ENTRY_CANDIDATES, LLM_ENTRY_CANDIDATES, IMPORT_PATTERNS, ENV_VAR_PATTERN, LLM_SDK_PACKAGES;
 var init_harness_detect = __esm({
   "src/runner/harness-detect.ts"() {
     "use strict";
     import_node_fs51 = require("fs");
-    import_node_path47 = require("path");
+    import_node_path48 = require("path");
     init_package_clone_map();
     TWIN_ENTRY_CANDIDATES = [
       "harness.ts",
@@ -55925,19 +55925,19 @@ var init_harness_detect = __esm({
 function buildCloneToolsSnapshotCandidates(cloneId) {
   const candidates = [];
   if (typeof __dirname === "string" && __dirname.length > 0) {
-    candidates.push((0, import_node_path50.resolve)(__dirname, "..", "clone-assets", cloneId, "tools.json"));
-    candidates.push((0, import_node_path50.resolve)(__dirname, "..", "..", "clone-assets", cloneId, "tools.json"));
+    candidates.push((0, import_node_path51.resolve)(__dirname, "..", "clone-assets", cloneId, "tools.json"));
+    candidates.push((0, import_node_path51.resolve)(__dirname, "..", "..", "clone-assets", cloneId, "tools.json"));
   }
   const metaUrl = import_meta4.url;
   if (typeof metaUrl === "string" && metaUrl.length > 0) {
     try {
-      const here = (0, import_node_path50.dirname)((0, import_node_url6.fileURLToPath)(metaUrl));
-      candidates.push((0, import_node_path50.resolve)(here, "..", "..", "clone-assets", cloneId, "tools.json"));
-      candidates.push((0, import_node_path50.resolve)(here, "..", "clone-assets", cloneId, "tools.json"));
+      const here = (0, import_node_path51.dirname)((0, import_node_url6.fileURLToPath)(metaUrl));
+      candidates.push((0, import_node_path51.resolve)(here, "..", "..", "clone-assets", cloneId, "tools.json"));
+      candidates.push((0, import_node_path51.resolve)(here, "..", "clone-assets", cloneId, "tools.json"));
     } catch {
     }
   }
-  candidates.push((0, import_node_path50.resolve)(process.cwd(), "clone-assets", cloneId, "tools.json"));
+  candidates.push((0, import_node_path51.resolve)(process.cwd(), "clone-assets", cloneId, "tools.json"));
   return [...new Set(candidates)];
 }
 async function loadCloneToolDefinitions(cloneId) {
@@ -55979,12 +55979,12 @@ async function loadCloneToolDefinitions(cloneId) {
   }
   return parsed.tools;
 }
-var import_node_fs56, import_node_path50, import_node_url6, import_meta4;
+var import_node_fs56, import_node_path51, import_node_url6, import_meta4;
 var init_clone_tool_loaders = __esm({
   "src/clone/clone-tool-loaders.ts"() {
     "use strict";
     import_node_fs56 = require("fs");
-    import_node_path50 = require("path");
+    import_node_path51 = require("path");
     import_node_url6 = require("url");
     init_src2();
     init_errors6();
@@ -61098,7 +61098,7 @@ function readFlag(path2) {
   return {};
 }
 function writeFlag(path2, value) {
-  (0, import_node_fs64.mkdirSync)((0, import_node_path57.dirname)(path2), { recursive: true, mode: 448 });
+  (0, import_node_fs64.mkdirSync)((0, import_node_path58.dirname)(path2), { recursive: true, mode: 448 });
   const tmp = `${path2}.${Math.random().toString(36).slice(2, 10)}.tmp`;
   (0, import_node_fs64.writeFileSync)(tmp, `${JSON.stringify(value, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
@@ -61111,7 +61111,7 @@ function shouldEmitLegacyTokenWarning(token) {
   const claim = payload["workspaceId"];
   const hasClaim = typeof claim === "string" && claim.trim().length > 0;
   if (hasClaim) return { warned: false };
-  const flagPath = (0, import_node_path57.join)(getArchalDir2(), FLAG_FILE);
+  const flagPath = (0, import_node_path58.join)(getArchalDir2(), FLAG_FILE);
   const flag = readFlag(flagPath);
   const tokenHash = hashToken(token);
   const seen = flag.tokenHashes ?? [];
@@ -61125,13 +61125,13 @@ function shouldEmitLegacyTokenWarning(token) {
   }
   return { warned: true };
 }
-var import_node_crypto31, import_node_fs64, import_node_path57, FLAG_FILE;
+var import_node_crypto31, import_node_fs64, import_node_path58, FLAG_FILE;
 var init_legacy_token_warning = __esm({
   "src/auth/legacy-token-warning.ts"() {
     "use strict";
     import_node_crypto31 = require("crypto");
     import_node_fs64 = require("fs");
-    import_node_path57 = require("path");
+    import_node_path58 = require("path");
     init_credential_store2();
     FLAG_FILE = "legacy-token-warned.flag";
   }
@@ -61165,7 +61165,7 @@ init_logger();
 init_src();
 var import_node_crypto25 = require("crypto");
 var import_node_fs49 = require("fs");
-var import_node_path45 = require("path");
+var import_node_path46 = require("path");
 
 // src/runner/orchestrator.ts
 init_config_merger();
@@ -64995,6 +64995,7 @@ var GENERATED_SEEDS = {
 
 // ../packages/route-runtime-core/src/runtime.ts
 var import_node_module = require("module");
+var import_node_path14 = require("path");
 init_errors();
 
 // ../packages/route-runtime-core/src/service-profiles.ts
@@ -65030,7 +65031,7 @@ var discordRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Discord traffic to ${url2}. Declare discord in archalVitestProject({ services: { discord: { mode: "route" } } }) before calling the Discord REST API in Vitest.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Discord escape to ${url2}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Discord escape to ${url2}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Discord domain ${url2}. Archal did not reroute this request because it is outside the approved Discord REST route surface.`
   },
   sdkIdentifiers: ["discord.js", "@discordjs/rest"],
@@ -65078,7 +65079,7 @@ var githubRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked GitHub traffic to ${url2}. Declare github in archalVitestProject({ services: { github: { mode: "route" } } }) before using the official GitHub SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked GitHub escape to ${url2}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked GitHub escape to ${url2}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface.`,
     warning: ({ url: url2 }) => `Observed adjacent GitHub domain ${url2}. Archal did not reroute this request because it is outside the primary GitHub API route surface.`
   },
   sdkIdentifiers: ["@octokit/rest"],
@@ -65106,7 +65107,7 @@ var googleWorkspaceRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Google Workspace traffic to ${url2}. Declare google-workspace in archalVitestProject({ services: { 'google-workspace': { mode: "route" } } }) before using the official Google client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Google Workspace escape to ${url2}. Google Workspace route mode is configured, but this domain is outside the primary routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Google Workspace escape to ${url2}. Google Workspace route mode is configured, but this domain is outside the primary routed surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Google Workspace domain ${url2}. Archal did not reroute this request because it is outside the primary Google Workspace API route surface.`
   },
   sdkIdentifiers: ["googleapis"],
@@ -65128,7 +65129,7 @@ var apifyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Apify traffic to ${url2}. Declare apify before using the official Apify client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Apify escape to ${url2}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Apify escape to ${url2}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Apify domain ${url2}. Archal did not reroute this request because it is outside the primary Apify API route surface.`
   },
   sdkIdentifiers: ["apify-client", "apify"],
@@ -65153,7 +65154,7 @@ var jiraRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Jira traffic to ${url2}. Declare jira in archalVitestProject({ services: { jira: { mode: "route" } } }) before using the official Jira SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Jira escape to ${url2}. Jira route mode is configured, but this domain is outside the primary routed Jira surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Jira escape to ${url2}. Jira route mode is configured, but this domain is outside the primary routed Jira surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Jira domain ${url2}. Archal did not reroute this request because it is outside the primary Jira route surface.`
   },
   sdkIdentifiers: ["jira.js"],
@@ -65174,7 +65175,7 @@ var linearRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Linear traffic to ${url2}. Declare linear in archalVitestProject({ services: { linear: { mode: "route" } } }) before using the official Linear SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Linear escape to ${url2}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Linear escape to ${url2}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Linear domain ${url2}. Archal did not reroute this request because it is outside the primary Linear API route surface.`
   },
   sdkIdentifiers: ["@linear/sdk"],
@@ -65196,7 +65197,7 @@ var rampRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Ramp traffic to ${url2}. Declare ramp in archalVitestProject({ services: { ramp: { mode: "route" } } }) before using the official Ramp client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Ramp escape to ${url2}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Ramp escape to ${url2}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Ramp domain ${url2}. Archal did not reroute this request because it is outside the primary Ramp API route surface.`
   },
   sdkIdentifiers: ["ramp"],
@@ -65229,7 +65230,7 @@ var slackRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Slack traffic to ${url2}. Declare slack in archalVitestProject({ services: { slack: { mode: "route" } } }) before using the official Slack SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Slack escape to ${url2}. Slack route mode is configured, but this domain is outside the primary routed Slack surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Slack escape to ${url2}. Slack route mode is configured, but this domain is outside the primary routed Slack surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Slack domain ${url2}. Archal did not reroute this request because it is outside the primary Slack API route surface.`
   },
   sdkIdentifiers: ["@slack/web-api"],
@@ -65297,7 +65298,7 @@ var stripeRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Stripe traffic to ${url2}. Declare stripe in archalVitestProject({ services: { stripe: { mode: "route" } } }) before using the official Stripe SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Stripe escape to ${url2}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Stripe escape to ${url2}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Stripe domain ${url2}. Archal did not reroute this request because it is outside the primary Stripe API route surface.`
   },
   runtimeSurface: stripeRuntimeSurface,
@@ -65320,7 +65321,7 @@ var supabaseRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Supabase traffic to ${url2}. Declare supabase in archalVitestProject({ services: { supabase: { mode: "route" } } }) before using the official Supabase SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Supabase escape to ${url2}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Supabase escape to ${url2}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Supabase domain ${url2}. Archal did not reroute this request because it is outside the primary Supabase route surface.`
   },
   sdkIdentifiers: ["@supabase/supabase-js"],
@@ -65342,7 +65343,7 @@ var tavilyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Tavily traffic to ${url2}. Declare tavily before using the official Tavily client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Tavily escape to ${url2}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Tavily escape to ${url2}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Tavily domain ${url2}. Archal did not reroute this request because it is outside the primary Tavily API route surface.`
   },
   sdkIdentifiers: ["@tavily/core", "tavily"],
@@ -65384,7 +65385,9 @@ function buildServiceCompatibilityProfile(manifest) {
 
 // ../packages/route-runtime-core/src/runtime.ts
 var import_meta2 = {};
-var require2 = (0, import_node_module.createRequire)(typeof __filename === "string" ? __filename : import_meta2.url);
+var require2 = (0, import_node_module.createRequire)(
+  typeof __filename === "string" && (0, import_node_path14.isAbsolute)(__filename) ? __filename : import_meta2.url
+);
 var httpModule = require2("node:http");
 var httpsModule = require2("node:https");
 var SHARED_SERVICE_PROFILES = listSharedRouteManifests().map(buildServiceCompatibilityProfile);
@@ -66381,7 +66384,7 @@ function getAvailableSeeds(cloneName) {
 
 // src/runner/seed-snapshot.ts
 var import_node_fs14 = require("fs");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 init_src();
 init_zod();
 var seedSnapshotEntryDiskSchema = external_exports3.object({
@@ -66401,7 +66404,7 @@ var seedSnapshotSchema = external_exports3.object({
   seeds: external_exports3.array(seedSnapshotEntrySchema).min(1)
 });
 function loadSeedSnapshot(pathInput) {
-  const resolvedPath = (0, import_node_path14.resolve)(pathInput);
+  const resolvedPath = (0, import_node_path15.resolve)(pathInput);
   let parsedJson;
   try {
     parsedJson = JSON.parse((0, import_node_fs14.readFileSync)(resolvedPath, "utf-8"));
@@ -66419,8 +66422,8 @@ function loadSeedSnapshot(pathInput) {
   return parsed.data;
 }
 function saveSeedSnapshot(pathInput, input) {
-  const resolvedPath = (0, import_node_path14.resolve)(pathInput);
-  (0, import_node_fs14.mkdirSync)((0, import_node_path14.dirname)(resolvedPath), { recursive: true });
+  const resolvedPath = (0, import_node_path15.resolve)(pathInput);
+  (0, import_node_fs14.mkdirSync)((0, import_node_path15.dirname)(resolvedPath), { recursive: true });
   const payload = {
     version: 1,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -66441,7 +66444,7 @@ init_src();
 
 // src/runner/execution/agent-executor.ts
 var import_node_fs17 = require("fs");
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 var import_node_os5 = require("os");
 var import_node_crypto16 = require("crypto");
 init_src();
@@ -66538,7 +66541,7 @@ init_logger();
 
 // src/utils/resolve-command.ts
 var import_node_fs15 = require("fs");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 function getEnvValue(env, key) {
   if (env && Object.prototype.hasOwnProperty.call(env, key)) return env[key];
   if (process.platform !== "win32" || !env) return void 0;
@@ -66567,12 +66570,12 @@ function getWindowsExecutableCandidates(command, env) {
   return [...extensions.flatMap((suffix) => [`${command}${suffix.toLowerCase()}`, `${command}${suffix.toUpperCase()}`]), command];
 }
 function findWindowsCommand(command, cwd, env) {
-  const hasPathSegment = command.includes("/") || command.includes("\\") || (0, import_node_path15.isAbsolute)(command);
+  const hasPathSegment = command.includes("/") || command.includes("\\") || (0, import_node_path16.isAbsolute)(command);
   const candidates = getWindowsExecutableCandidates(command, env);
   if (hasPathSegment) {
     const baseDir = cwd ?? process.cwd();
     for (const candidate of candidates) {
-      const fullPath = (0, import_node_path15.isAbsolute)(candidate) ? candidate : (0, import_node_path15.resolve)(baseDir, candidate);
+      const fullPath = (0, import_node_path16.isAbsolute)(candidate) ? candidate : (0, import_node_path16.resolve)(baseDir, candidate);
       if ((0, import_node_fs15.existsSync)(fullPath) && isExecutable(fullPath)) {
         return fullPath;
       }
@@ -66580,11 +66583,11 @@ function findWindowsCommand(command, cwd, env) {
     return null;
   }
   const pathValue = getEnvValue(env, "PATH") ?? process.env["PATH"] ?? "";
-  for (const segment of pathValue.split(import_node_path15.delimiter)) {
+  for (const segment of pathValue.split(import_node_path16.delimiter)) {
     const dir = segment.trim();
     if (!dir) continue;
     for (const candidate of candidates) {
-      const fullPath = (0, import_node_path15.join)(dir, candidate);
+      const fullPath = (0, import_node_path16.join)(dir, candidate);
       if ((0, import_node_fs15.existsSync)(fullPath) && isExecutable(fullPath)) {
         return fullPath;
       }
@@ -66600,7 +66603,7 @@ function resolveCommandForSpawn(command, args, cwd, env) {
   if (!resolvedCommand) {
     return { command, args };
   }
-  const extension = (0, import_node_path15.extname)(resolvedCommand).toLowerCase();
+  const extension = (0, import_node_path16.extname)(resolvedCommand).toLowerCase();
   if (extension === ".cmd" || extension === ".bat") {
     const shell = getEnvValue(env, "COMSPEC") || process.env["COMSPEC"] || "cmd.exe";
     return {
@@ -66883,6 +66886,10 @@ var AGENT_TASK_ENV = "AGENT_TASK";
 var AGENT_MODEL_ENV = "AGENT_MODEL";
 var AGENT_METRICS_FILE_ENV = "AGENT_METRICS_FILE";
 var AGENT_TRACE_FILE_ENV = "AGENT_TRACE_FILE";
+var AGENT_CLONE_URLS_ENV = "AGENT_CLONE_URLS";
+var AGENT_ROUTE_AUTHORIZATION_ENV = "AGENT_ROUTE_AUTHORIZATION";
+var AGENT_ROUTE_AUTHORIZATION_HEADER_ENV = "AGENT_ROUTE_AUTHORIZATION_HEADER";
+var AGENT_ROUTE_HEADERS_ENV = "AGENT_ROUTE_HEADERS";
 function shouldExposeLegacyAgentEnv(env) {
   return TRUE_ENV_VALUES.has(env?.[LEGACY_AGENT_ENV_COMPAT]?.trim().toLowerCase() ?? "");
 }
@@ -67346,6 +67353,10 @@ function maybeSetEnv(env, key, value) {
     env[key] = trimmed;
   }
 }
+function toAgentServiceEnvVarName(serviceName, suffix) {
+  const segment = toServiceEnvSegment(serviceName);
+  return segment ? `${segment}_${suffix}` : null;
+}
 function buildTrustedCloneRoutingEnv(input) {
   const env = {};
   const restUrls = {};
@@ -67356,26 +67367,38 @@ function buildTrustedCloneRoutingEnv(input) {
     if (!rawUrl) {
       continue;
     }
-    if (!includeHostedRuntimeUrls && isArchalHostedRuntimeUrl(rawUrl)) {
-      continue;
-    }
     const restUrl = toTwinRestUrl(rawUrl);
     const mcpUrl = toTwinMcpUrl(rawUrl);
     restUrls[cloneName] = restUrl;
-    maybeSetEnv(env, toServiceEnvVarName(cloneName, "BASE_URL"), restUrl);
-    maybeSetEnv(env, toServiceEnvVarName(cloneName, "URL"), restUrl);
-    maybeSetEnv(env, toServiceEnvVarName(cloneName, "REST_URL"), restUrl);
-    maybeSetEnv(env, toServiceEnvVarName(cloneName, "MCP_URL"), mcpUrl);
-    maybeSetEnv(env, toCloneServiceEnvVarName(cloneName, "CLONE_URL"), restUrl);
+    maybeSetEnv(env, toAgentServiceEnvVarName(cloneName, "BASE_URL"), restUrl);
+    maybeSetEnv(env, toAgentServiceEnvVarName(cloneName, "URL"), restUrl);
+    maybeSetEnv(env, toAgentServiceEnvVarName(cloneName, "REST_URL"), restUrl);
+    maybeSetEnv(env, toAgentServiceEnvVarName(cloneName, "MCP_URL"), mcpUrl);
+    if (includeHostedRuntimeUrls || !isArchalHostedRuntimeUrl(rawUrl)) {
+      maybeSetEnv(env, toServiceEnvVarName(cloneName, "BASE_URL"), restUrl);
+      maybeSetEnv(env, toServiceEnvVarName(cloneName, "URL"), restUrl);
+      maybeSetEnv(env, toServiceEnvVarName(cloneName, "REST_URL"), restUrl);
+      maybeSetEnv(env, toServiceEnvVarName(cloneName, "MCP_URL"), mcpUrl);
+      maybeSetEnv(env, toCloneServiceEnvVarName(cloneName, "CLONE_URL"), restUrl);
+    }
   }
   const routedCloneNames = Object.keys(restUrls);
   if (routedCloneNames.length === 0) {
     return env;
   }
   const cloneNamesCsv = routedCloneNames.join(",");
-  env[ARCHAL_CLONE_NAMES_ENV] = cloneNamesCsv;
-  env[ARCHAL_CLONE_URLS_ENV] = JSON.stringify(restUrls);
+  env[AGENT_CLONE_URLS_ENV] = JSON.stringify(restUrls);
+  const bearerToken = input.bearerToken?.trim();
+  if (bearerToken) {
+    const routeAuthorization = `Bearer ${bearerToken}`;
+    const routeHeaders = { "x-route-authorization": routeAuthorization };
+    env[AGENT_ROUTE_AUTHORIZATION_HEADER_ENV] = "x-route-authorization";
+    env[AGENT_ROUTE_AUTHORIZATION_ENV] = routeAuthorization;
+    env[AGENT_ROUTE_HEADERS_ENV] = JSON.stringify(routeHeaders);
+  }
   if (includeHostedRuntimeUrls) {
+    env[ARCHAL_CLONE_NAMES_ENV] = cloneNamesCsv;
+    env[ARCHAL_CLONE_URLS_ENV] = JSON.stringify(restUrls);
     maybeSetEnv(env, "ARCHAL_MCP_CONFIG", input.mcpConfigPath);
     maybeSetEnv(env, "MCP_CONFIG_PATH", input.mcpConfigPath);
     maybeSetEnv(env, "ARCHAL_MCP_SERVERS", input.mcpServersJson);
@@ -67509,8 +67532,8 @@ async function executeAgent(params) {
     timeoutMs
   } = params;
   const uniqueSuffix = (0, import_node_crypto16.randomUUID)();
-  const metricsFilePath = (0, import_node_path16.join)((0, import_node_os5.tmpdir)(), `agent-metrics-${uniqueSuffix}.json`);
-  const agentTraceFilePath = (0, import_node_path16.join)((0, import_node_os5.tmpdir)(), `agent-trace-${uniqueSuffix}.json`);
+  const metricsFilePath = (0, import_node_path17.join)((0, import_node_os5.tmpdir)(), `agent-metrics-${uniqueSuffix}.json`);
+  const agentTraceFilePath = (0, import_node_path17.join)((0, import_node_os5.tmpdir)(), `agent-trace-${uniqueSuffix}.json`);
   const includeLegacyArchalEnv = params.includeLegacyArchalEnv ?? false;
   const trustedCloneRoutingEnv = buildTrustedCloneRoutingEnv({
     cloneNames: params.cloneNames,
@@ -68475,7 +68498,7 @@ function asSeedFamily(value) {
 }
 
 // src/runner/engine-context.ts
-var import_node_path23 = require("path");
+var import_node_path24 = require("path");
 init_logger();
 
 // src/runner/execution/agent-command.ts
@@ -68550,13 +68573,13 @@ function injectDetectedApiKey(env, key) {
 // src/runner/harness.ts
 init_src();
 var import_node_fs22 = require("fs");
-var import_node_path20 = require("path");
+var import_node_path21 = require("path");
 init_zod();
 init_logger();
 
 // src/runner/harness-paths.ts
 var import_node_fs21 = require("fs");
-var import_node_path19 = require("path");
+var import_node_path20 = require("path");
 var MANIFEST_FILE = "harness.json";
 var HARNESS_ENTRY_CANDIDATES = [
   "harness.ts",
@@ -68576,16 +68599,16 @@ var PROJECT_ROOT_MARKERS = [
 ];
 function isProperAncestor(candidate, target) {
   if (candidate === target) return false;
-  const withSep = candidate.endsWith(import_node_path19.sep) ? candidate : candidate + import_node_path19.sep;
+  const withSep = candidate.endsWith(import_node_path20.sep) ? candidate : candidate + import_node_path20.sep;
   return target.startsWith(withSep);
 }
 function isProjectArchalHarnessFile(entryPath) {
-  return (0, import_node_path19.basename)((0, import_node_path19.dirname)(entryPath)) === ".archal" && PROJECT_ARCHAL_HARNESS_FILENAMES.has((0, import_node_path19.basename)(entryPath).toLowerCase());
+  return (0, import_node_path20.basename)((0, import_node_path20.dirname)(entryPath)) === ".archal" && PROJECT_ARCHAL_HARNESS_FILENAMES.has((0, import_node_path20.basename)(entryPath).toLowerCase());
 }
 function resolveHarnessExecutionRootFromPath(entryPath) {
-  const entryDir = (0, import_node_path19.dirname)(entryPath);
+  const entryDir = (0, import_node_path20.dirname)(entryPath);
   if (isProjectArchalHarnessFile(entryPath)) {
-    return (0, import_node_path19.dirname)(entryDir);
+    return (0, import_node_path20.dirname)(entryDir);
   }
   return entryDir;
 }
@@ -68593,18 +68616,18 @@ function resolveHarnessProjectRoot(startPath, fallback, stopAt) {
   let current2;
   try {
     const stats = (0, import_node_fs21.statSync)(startPath);
-    current2 = stats.isDirectory() ? startPath : (0, import_node_path19.dirname)(startPath);
+    current2 = stats.isDirectory() ? startPath : (0, import_node_path20.dirname)(startPath);
   } catch {
-    current2 = (0, import_node_path19.dirname)(startPath);
+    current2 = (0, import_node_path20.dirname)(startPath);
   }
   const effectiveFallback = fallback ?? current2;
   while (true) {
     for (const marker of PROJECT_ROOT_MARKERS) {
-      if ((0, import_node_fs21.existsSync)((0, import_node_path19.resolve)(current2, marker))) {
+      if ((0, import_node_fs21.existsSync)((0, import_node_path20.resolve)(current2, marker))) {
         return current2;
       }
     }
-    const parent = (0, import_node_path19.dirname)(current2);
+    const parent = (0, import_node_path20.dirname)(current2);
     if (parent === current2 || stopAt !== void 0 && isProperAncestor(current2, stopAt)) {
       return effectiveFallback;
     }
@@ -68616,12 +68639,12 @@ function normalizeHarnessDiscoveryStart(startPath) {
   if (!trimmed) {
     return void 0;
   }
-  const resolvedPath = (0, import_node_path19.resolve)(trimmed);
+  const resolvedPath = (0, import_node_path20.resolve)(trimmed);
   try {
     const stats = (0, import_node_fs21.statSync)(resolvedPath);
-    return stats.isDirectory() ? resolvedPath : (0, import_node_path19.dirname)(resolvedPath);
+    return stats.isDirectory() ? resolvedPath : (0, import_node_path20.dirname)(resolvedPath);
   } catch {
-    return (0, import_node_path19.dirname)(resolvedPath);
+    return (0, import_node_path20.dirname)(resolvedPath);
   }
 }
 function resolveHarnessReference(input) {
@@ -68629,7 +68652,7 @@ function resolveHarnessReference(input) {
   if (!requested) {
     throw new Error("Harness must be a non-empty name or path.");
   }
-  const localPath = (0, import_node_path19.resolve)(requested);
+  const localPath = (0, import_node_path20.resolve)(requested);
   if ((0, import_node_fs21.existsSync)(localPath)) {
     const stats = (0, import_node_fs21.statSync)(localPath);
     const executionRoot = stats.isDirectory() ? localPath : resolveHarnessExecutionRootFromPath(localPath);
@@ -68656,12 +68679,12 @@ function discoverRepoLocalHarness(...startPaths) {
     while (!visited.has(current2)) {
       visited.add(current2);
       for (const candidate of HARNESS_ENTRY_CANDIDATES) {
-        if ((0, import_node_fs21.existsSync)((0, import_node_path19.resolve)(current2, candidate))) {
+        if ((0, import_node_fs21.existsSync)((0, import_node_path20.resolve)(current2, candidate))) {
           return { harnessDir: current2 };
         }
       }
-      const reachedBoundary = HARNESS_DISCOVERY_BOUNDARY_FILES.some((file2) => (0, import_node_fs21.existsSync)((0, import_node_path19.resolve)(current2, file2)));
-      const parent = (0, import_node_path19.dirname)(current2);
+      const reachedBoundary = HARNESS_DISCOVERY_BOUNDARY_FILES.some((file2) => (0, import_node_fs21.existsSync)((0, import_node_path20.resolve)(current2, file2)));
+      const parent = (0, import_node_path20.dirname)(current2);
       if (reachedBoundary || parent === current2) {
         break;
       }
@@ -68671,7 +68694,7 @@ function discoverRepoLocalHarness(...startPaths) {
   return void 0;
 }
 function resolveHarnessLocation(harnessInput, visited = /* @__PURE__ */ new Set()) {
-  const resolvedInput = (0, import_node_path19.resolve)(harnessInput);
+  const resolvedInput = (0, import_node_path20.resolve)(harnessInput);
   if (!(0, import_node_fs21.existsSync)(resolvedInput)) {
     throw new Error(`Harness path not found: ${resolvedInput}`);
   }
@@ -68684,26 +68707,26 @@ function resolveHarnessLocation(harnessInput, visited = /* @__PURE__ */ new Set(
     const executionRoot = resolveHarnessExecutionRootFromPath(resolvedInput);
     return {
       executionRoot,
-      manifestPath: (0, import_node_path19.resolve)(executionRoot, MANIFEST_FILE),
+      manifestPath: (0, import_node_path20.resolve)(executionRoot, MANIFEST_FILE),
       entryPath: resolvedInput,
       projectRoot: resolveHarnessProjectRoot(resolvedInput, executionRoot)
     };
   }
   for (const candidate of HARNESS_ENTRY_CANDIDATES) {
-    const candidatePath = (0, import_node_path19.resolve)(resolvedInput, candidate);
+    const candidatePath = (0, import_node_path20.resolve)(resolvedInput, candidate);
     if (!(0, import_node_fs21.existsSync)(candidatePath)) {
       continue;
     }
     return {
       executionRoot: resolvedInput,
-      manifestPath: (0, import_node_path19.resolve)(resolvedInput, MANIFEST_FILE),
+      manifestPath: (0, import_node_path20.resolve)(resolvedInput, MANIFEST_FILE),
       entryPath: candidatePath,
       projectRoot: resolvedInput
     };
   }
   return {
     executionRoot: resolvedInput,
-    manifestPath: (0, import_node_path19.resolve)(resolvedInput, MANIFEST_FILE),
+    manifestPath: (0, import_node_path20.resolve)(resolvedInput, MANIFEST_FILE),
     projectRoot: resolvedInput
   };
 }
@@ -68716,7 +68739,7 @@ var LEGACY_AGENT_ENTRY_CANDIDATES = [
   { file: "agent.ts", command: "npx", args: ["tsx", "agent.ts"] }
 ];
 function readPackageJson2(harnessDir) {
-  const packageJsonPath = (0, import_node_path20.resolve)(harnessDir, "package.json");
+  const packageJsonPath = (0, import_node_path21.resolve)(harnessDir, "package.json");
   if (!(0, import_node_fs22.existsSync)(packageJsonPath)) {
     return void 0;
   }
@@ -68728,13 +68751,13 @@ function readPackageJson2(harnessDir) {
 }
 function inferPackageRunner(harnessDir, packageManager) {
   const packageManagerName = packageManager?.trim().split("@")[0];
-  if (packageManagerName === "pnpm" || (0, import_node_fs22.existsSync)((0, import_node_path20.resolve)(harnessDir, "pnpm-lock.yaml"))) {
+  if (packageManagerName === "pnpm" || (0, import_node_fs22.existsSync)((0, import_node_path21.resolve)(harnessDir, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (packageManagerName === "yarn" || (0, import_node_fs22.existsSync)((0, import_node_path20.resolve)(harnessDir, "yarn.lock"))) {
+  if (packageManagerName === "yarn" || (0, import_node_fs22.existsSync)((0, import_node_path21.resolve)(harnessDir, "yarn.lock"))) {
     return "yarn";
   }
-  if (packageManagerName === "bun" || (0, import_node_fs22.existsSync)((0, import_node_path20.resolve)(harnessDir, "bun.lockb"))) {
+  if (packageManagerName === "bun" || (0, import_node_fs22.existsSync)((0, import_node_path21.resolve)(harnessDir, "bun.lockb"))) {
     return "bun";
   }
   return "npm";
@@ -68764,7 +68787,7 @@ function inferLocalCommandFromDirectory(harnessDir) {
   const packageScript = inferPackageScriptCommand(harnessDir);
   if (packageScript) return packageScript;
   for (const candidate of LEGACY_AGENT_ENTRY_CANDIDATES) {
-    if (!(0, import_node_fs22.existsSync)((0, import_node_path20.resolve)(harnessDir, candidate.file))) continue;
+    if (!(0, import_node_fs22.existsSync)((0, import_node_path21.resolve)(harnessDir, candidate.file))) continue;
     return {
       localCommand: { command: candidate.command, args: [...candidate.args] },
       source: candidate.file
@@ -68825,12 +68848,12 @@ function loadPromptContext(harnessDir, promptFiles) {
     if (!relativePath) {
       throw new Error("Harness promptFiles entries must be non-empty strings");
     }
-    if ((0, import_node_path20.isAbsolute)(relativePath)) {
+    if ((0, import_node_path21.isAbsolute)(relativePath)) {
       throw new Error(`Harness prompt file must be relative to the harness directory: ${relativePath}`);
     }
-    const absolutePath = (0, import_node_path20.resolve)(harnessDir, relativePath);
-    const relativeToHarness = (0, import_node_path20.relative)(harnessDir, absolutePath);
-    if (relativeToHarness.startsWith("..") || (0, import_node_path20.isAbsolute)(relativeToHarness)) {
+    const absolutePath = (0, import_node_path21.resolve)(harnessDir, relativePath);
+    const relativeToHarness = (0, import_node_path21.relative)(harnessDir, absolutePath);
+    if (relativeToHarness.startsWith("..") || (0, import_node_path21.isAbsolute)(relativeToHarness)) {
       throw new Error(`Harness prompt file escapes the harness directory: ${relativePath}`);
     }
     if (!(0, import_node_fs22.existsSync)(absolutePath)) {
@@ -68838,8 +68861,8 @@ function loadPromptContext(harnessDir, promptFiles) {
     }
     const realHarnessDir = (0, import_node_fs22.realpathSync)(harnessDir);
     const realPromptPath = (0, import_node_fs22.realpathSync)(absolutePath);
-    const realRelativeToHarness = (0, import_node_path20.relative)(realHarnessDir, realPromptPath);
-    if (realRelativeToHarness.startsWith("..") || (0, import_node_path20.isAbsolute)(realRelativeToHarness)) {
+    const realRelativeToHarness = (0, import_node_path21.relative)(realHarnessDir, realPromptPath);
+    if (realRelativeToHarness.startsWith("..") || (0, import_node_path21.isAbsolute)(realRelativeToHarness)) {
       throw new Error(`Harness prompt file resolves outside the harness directory: ${relativePath}`);
     }
     const content = (0, import_node_fs22.readFileSync)(absolutePath, "utf-8").trim();
@@ -68856,7 +68879,7 @@ function loadPromptContextFromMarkdownDirectory(harnessDir) {
   if (markdownFiles.length === 0) return void 0;
   const sections = [];
   for (const markdownFile of markdownFiles) {
-    const absolutePath = (0, import_node_path20.resolve)(harnessDir, markdownFile);
+    const absolutePath = (0, import_node_path21.resolve)(harnessDir, markdownFile);
     const content = (0, import_node_fs22.readFileSync)(absolutePath, "utf-8").trim();
     if (!content) {
       warn(`Harness markdown prompt file is empty and will be skipped: ${absolutePath}`);
@@ -68884,13 +68907,13 @@ var DIRECT_FILE_RUNNERS = {
   ".cjs": { command: "node", args: [] }
 };
 function inferLocalCommandFromEntryPath(spawnCwd, entryPath) {
-  const runner = DIRECT_FILE_RUNNERS[(0, import_node_path20.extname)(entryPath).toLowerCase()];
+  const runner = DIRECT_FILE_RUNNERS[(0, import_node_path21.extname)(entryPath).toLowerCase()];
   if (!runner) {
     throw new Error(
       `Unsupported harness entrypoint extension for ${entryPath}. Use .ts, .js, .mjs, or .cjs.`
     );
   }
-  const relativeEntryPath = (0, import_node_path20.relative)(spawnCwd, entryPath) || entryPath;
+  const relativeEntryPath = (0, import_node_path21.relative)(spawnCwd, entryPath) || entryPath;
   return {
     command: runner.command,
     args: [...runner.args, relativeEntryPath]
@@ -69431,14 +69454,14 @@ function planApiTimeoutSeconds(plan) {
 
 // src/runner/config-resolver.ts
 var import_node_fs25 = require("fs");
-var import_node_path22 = require("path");
+var import_node_path23 = require("path");
 init_config_merger();
 init_config_loader();
 
 // src/runner/openclaw-shared.ts
 var import_node_fs24 = require("fs");
 var import_node_os6 = require("os");
-var import_node_path21 = require("path");
+var import_node_path22 = require("path");
 var OPENCLAW_HARNESS_ALIASES = /* @__PURE__ */ new Set(["openclaw"]);
 function isOpenClawHarnessName(name) {
   return OPENCLAW_HARNESS_ALIASES.has(name.trim().toLowerCase());
@@ -69447,7 +69470,7 @@ function resolveDefaultOpenClawHome(opts, homeDir = (0, import_node_os6.homedir)
   if (opts.openclawHome?.trim() || opts.openclawWorkspace?.trim() || opts.openclawConfig?.trim()) {
     return void 0;
   }
-  const defaultHome = (0, import_node_path21.join)(homeDir, ".openclaw");
+  const defaultHome = (0, import_node_path22.join)(homeDir, ".openclaw");
   return (0, import_node_fs24.existsSync)(defaultHome) ? defaultHome : void 0;
 }
 function resolveOpenClawHomePath(opts, homeDir) {
@@ -69479,7 +69502,7 @@ function isUserHarnessResolvable(value) {
     return true;
   }
   try {
-    const path2 = (0, import_node_path22.resolve)(value);
+    const path2 = (0, import_node_path23.resolve)(value);
     if (!(0, import_node_fs25.existsSync)(path2)) return false;
     (0, import_node_fs25.statSync)(path2);
     return true;
@@ -69493,13 +69516,13 @@ var DEFAULT_MODEL = "gemini-2.5-pro";
 function findNearestProjectRoot(...startPaths) {
   for (const start of startPaths) {
     if (!start || !start.trim()) continue;
-    let current2 = (0, import_node_path22.resolve)(start);
+    let current2 = (0, import_node_path23.resolve)(start);
     while (true) {
-      const candidate = (0, import_node_path22.join)(current2, ".archal.json");
+      const candidate = (0, import_node_path23.join)(current2, ".archal.json");
       if ((0, import_node_fs25.existsSync)(candidate)) {
         return current2;
       }
-      const parent = (0, import_node_path22.dirname)(current2);
+      const parent = (0, import_node_path23.dirname)(current2);
       if (parent === current2) {
         break;
       }
@@ -69509,7 +69532,7 @@ function findNearestProjectRoot(...startPaths) {
   return null;
 }
 function loadProjectConfigForScenario(scenarioPath) {
-  const root = findNearestProjectRoot((0, import_node_path22.dirname)((0, import_node_path22.resolve)(scenarioPath)), process.cwd());
+  const root = findNearestProjectRoot((0, import_node_path23.dirname)((0, import_node_path23.resolve)(scenarioPath)), process.cwd());
   if (!root) {
     return {
       root: null,
@@ -69519,7 +69542,7 @@ function loadProjectConfigForScenario(scenarioPath) {
   }
   return {
     root,
-    configPath: (0, import_node_path22.join)(root, ".archal.json"),
+    configPath: (0, import_node_path23.join)(root, ".archal.json"),
     config: loadProjectConfig(root)
   };
 }
@@ -70240,7 +70263,7 @@ function resolveRunConfigWithSources(scenarioPath, opts, sources, preloaded) {
     { value: void 0, source: "unset", detail: "(not set)" }
   );
   return {
-    scenarioPath: (0, import_node_path22.resolve)(scenarioPath),
+    scenarioPath: (0, import_node_path23.resolve)(scenarioPath),
     projectRoot: project.root,
     projectConfigPath: project.configPath,
     invalidExplicitRuns,
@@ -70607,7 +70630,7 @@ function resolveEngineConfiguration(scenario, options, timeoutSeconds, env = cap
     validateRemoteApiEngineTopology(apiEngine.url, scenario.config.twins, remoteTwinUrlOverrides);
   }
   if (localEngine) {
-    info(`Agent harness: ${getHarnessDisplayName((0, import_node_path23.basename)(localEngine.cwd))}`, { path: localEngine.cwd });
+    info(`Agent harness: ${getHarnessDisplayName((0, import_node_path24.basename)(localEngine.cwd))}`, { path: localEngine.cwd });
   }
   if (resolvedSandbox && !apiEngine && !localEngine) {
     info("OpenClaw sandbox mode enabled");
@@ -70644,7 +70667,7 @@ init_logger();
 // ../packages/sandbox-runtime/src/docker-harness/runner.ts
 var import_node_fs30 = require("fs");
 var import_node_os8 = require("os");
-var import_node_path26 = require("path");
+var import_node_path27 = require("path");
 init_src();
 
 // ../packages/sandbox-runtime/src/sandbox/route-domains.ts
@@ -70832,7 +70855,7 @@ var import_node_child_process5 = require("child_process");
 var import_node_crypto17 = require("crypto");
 var import_node_fs27 = require("fs");
 var import_node_os7 = require("os");
-var import_node_path24 = require("path");
+var import_node_path25 = require("path");
 var import_node_url5 = require("url");
 
 // ../packages/sandbox-runtime/src/agent-artifacts.ts
@@ -70922,27 +70945,27 @@ function formatExecError(err) {
   return String(err);
 }
 function resolveLocalSandboxBuildTarget() {
-  const runtimeDir = typeof __dirname !== "undefined" && typeof __dirname === "string" && __dirname.length > 0 ? __dirname : (0, import_node_path24.dirname)((0, import_node_url5.fileURLToPath)(import_meta3.url));
+  const runtimeDir = typeof __dirname !== "undefined" && typeof __dirname === "string" && __dirname.length > 0 ? __dirname : (0, import_node_path25.dirname)((0, import_node_url5.fileURLToPath)(import_meta3.url));
   const candidates = [
     {
-      dockerfile: (0, import_node_path24.resolve)(process.cwd(), "packages/sandbox-runtime/docker/sandbox/Dockerfile"),
-      contextDir: (0, import_node_path24.resolve)(process.cwd(), "packages/sandbox-runtime")
+      dockerfile: (0, import_node_path25.resolve)(process.cwd(), "packages/sandbox-runtime/docker/sandbox/Dockerfile"),
+      contextDir: (0, import_node_path25.resolve)(process.cwd(), "packages/sandbox-runtime")
     },
     {
-      dockerfile: (0, import_node_path24.resolve)(process.cwd(), "cli/docker/sandbox/Dockerfile"),
-      contextDir: (0, import_node_path24.resolve)(process.cwd(), "cli")
+      dockerfile: (0, import_node_path25.resolve)(process.cwd(), "cli/docker/sandbox/Dockerfile"),
+      contextDir: (0, import_node_path25.resolve)(process.cwd(), "cli")
     },
     {
-      dockerfile: (0, import_node_path24.resolve)(process.cwd(), "docker/sandbox/Dockerfile"),
+      dockerfile: (0, import_node_path25.resolve)(process.cwd(), "docker/sandbox/Dockerfile"),
       contextDir: process.cwd()
     },
     {
-      dockerfile: (0, import_node_path24.resolve)(runtimeDir, "../docker/sandbox/Dockerfile"),
-      contextDir: (0, import_node_path24.resolve)(runtimeDir, "..")
+      dockerfile: (0, import_node_path25.resolve)(runtimeDir, "../docker/sandbox/Dockerfile"),
+      contextDir: (0, import_node_path25.resolve)(runtimeDir, "..")
     },
     {
-      dockerfile: (0, import_node_path24.resolve)(runtimeDir, "../../docker/sandbox/Dockerfile"),
-      contextDir: (0, import_node_path24.resolve)(runtimeDir, "../..")
+      dockerfile: (0, import_node_path25.resolve)(runtimeDir, "../../docker/sandbox/Dockerfile"),
+      contextDir: (0, import_node_path25.resolve)(runtimeDir, "../..")
     }
   ];
   return candidates.find((candidate) => (0, import_node_fs27.existsSync)(candidate.dockerfile));
@@ -70950,23 +70973,23 @@ function resolveLocalSandboxBuildTarget() {
 function getSandboxRuntimeDependencyPaths(target) {
   const twinAuthContractPath = findWorkspaceSiblingPackage("twin-auth-contract", target);
   const twinAuthContractDependencies = twinAuthContractPath ? [
-    (0, import_node_path24.resolve)(twinAuthContractPath, "package.json"),
-    (0, import_node_path24.resolve)(twinAuthContractPath, "src/index.ts"),
-    (0, import_node_path24.resolve)(twinAuthContractPath, "src/bootstrap-tokens.ts")
+    (0, import_node_path25.resolve)(twinAuthContractPath, "package.json"),
+    (0, import_node_path25.resolve)(twinAuthContractPath, "src/index.ts"),
+    (0, import_node_path25.resolve)(twinAuthContractPath, "src/bootstrap-tokens.ts")
   ] : [];
   return [
     target.dockerfile,
-    (0, import_node_path24.resolve)(target.contextDir, "docker/sandbox/entrypoint.sh"),
-    (0, import_node_path24.resolve)(target.contextDir, "docker/sandbox/package.json"),
-    (0, import_node_path24.resolve)(target.contextDir, "docker/sandbox/route-domains.sh"),
-    (0, import_node_path24.resolve)(target.contextDir, "docker/sandbox/AGENTS.md"),
-    (0, import_node_path24.resolve)(target.contextDir, "docker/sandbox/TOOLS.md"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/proxy-entry.ts"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/llm-config.ts"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/proxy.ts"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/twins.ts"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/route-domains.ts"),
-    (0, import_node_path24.resolve)(target.contextDir, "src/sandbox/certs.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "docker/sandbox/entrypoint.sh"),
+    (0, import_node_path25.resolve)(target.contextDir, "docker/sandbox/package.json"),
+    (0, import_node_path25.resolve)(target.contextDir, "docker/sandbox/route-domains.sh"),
+    (0, import_node_path25.resolve)(target.contextDir, "docker/sandbox/AGENTS.md"),
+    (0, import_node_path25.resolve)(target.contextDir, "docker/sandbox/TOOLS.md"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/proxy-entry.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/llm-config.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/proxy.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/twins.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/route-domains.ts"),
+    (0, import_node_path25.resolve)(target.contextDir, "src/sandbox/certs.ts"),
     ...twinAuthContractDependencies
   ].filter((path2) => (0, import_node_fs27.existsSync)(path2));
 }
@@ -71042,14 +71065,14 @@ function shouldRebuildManagedSandboxImage(image, target) {
   return getNewestSandboxRuntimeMtimeMs(target) > imageCreatedAtMs;
 }
 function findWorkspaceSiblingPackage(packageName, target) {
-  const dockerfileDir = (0, import_node_path24.resolve)(target.dockerfile, "..");
+  const dockerfileDir = (0, import_node_path25.resolve)(target.dockerfile, "..");
   const candidates = [
-    (0, import_node_path24.resolve)(dockerfileDir, "..", "..", "..", packageName),
-    (0, import_node_path24.resolve)(target.contextDir, "..", packageName),
-    (0, import_node_path24.resolve)(target.contextDir, "packages", packageName),
-    (0, import_node_path24.resolve)(target.contextDir, packageName)
+    (0, import_node_path25.resolve)(dockerfileDir, "..", "..", "..", packageName),
+    (0, import_node_path25.resolve)(target.contextDir, "..", packageName),
+    (0, import_node_path25.resolve)(target.contextDir, "packages", packageName),
+    (0, import_node_path25.resolve)(target.contextDir, packageName)
   ];
-  return candidates.find((c) => (0, import_node_fs27.existsSync)(c) && (0, import_node_fs27.existsSync)((0, import_node_path24.resolve)(c, "package.json")));
+  return candidates.find((c) => (0, import_node_fs27.existsSync)(c) && (0, import_node_fs27.existsSync)((0, import_node_path25.resolve)(c, "package.json")));
 }
 function buildSandboxImage(image, target, openclawVersion) {
   try {
@@ -71129,12 +71152,12 @@ async function ensureSandboxImage(image, openclawVersion) {
 }
 function launchSandbox(config2) {
   const image = config2.image ?? DEFAULT_SANDBOX_IMAGE;
-  const artifactsDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path24.join)((0, import_node_os7.tmpdir)(), "archal-sandbox-"));
-  const proxyEventsHostPath = (0, import_node_path24.join)(artifactsDir, "proxy-events.ndjson");
-  const twinUrlsHostPath = (0, import_node_path24.join)(artifactsDir, "twin-urls.json");
-  const metricsHostPath = (0, import_node_path24.join)(artifactsDir, "metrics.json");
-  const agentTraceHostPath = (0, import_node_path24.join)(artifactsDir, "agent-trace.json");
-  const workspaceFilesHostPath = (0, import_node_path24.join)(artifactsDir, "workspace-files.json");
+  const artifactsDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path25.join)((0, import_node_os7.tmpdir)(), "archal-sandbox-"));
+  const proxyEventsHostPath = (0, import_node_path25.join)(artifactsDir, "proxy-events.ndjson");
+  const twinUrlsHostPath = (0, import_node_path25.join)(artifactsDir, "twin-urls.json");
+  const metricsHostPath = (0, import_node_path25.join)(artifactsDir, "metrics.json");
+  const agentTraceHostPath = (0, import_node_path25.join)(artifactsDir, "agent-trace.json");
+  const workspaceFilesHostPath = (0, import_node_path25.join)(artifactsDir, "workspace-files.json");
   const proxyEventsContainerPath = "/archal-artifacts/proxy-events.ndjson";
   const twinUrlsContainerPath = "/archal-artifacts/twin-urls.json";
   const metricsContainerPath = "/archal-artifacts/metrics.json";
@@ -71425,7 +71448,7 @@ var BOOTSTRAP_SERVICE_CREDENTIALS2 = buildBootstrapServiceCredentialsEnv();
 
 // ../packages/sandbox-runtime/src/docker-harness/dockerfile.ts
 var import_node_fs29 = require("fs");
-var import_node_path25 = require("path");
+var import_node_path26 = require("path");
 var DockerfileError = class extends Error {
   kind;
   suggestion;
@@ -71467,7 +71490,7 @@ function readPackageJson3(path2) {
   };
 }
 function hasFile(repoPath, relativePath) {
-  return (0, import_node_fs29.existsSync)((0, import_node_path25.join)(repoPath, relativePath));
+  return (0, import_node_fs29.existsSync)((0, import_node_path26.join)(repoPath, relativePath));
 }
 function quoteJsonCommand(parts) {
   return `[${parts.map((part) => JSON.stringify(part)).join(", ")}]`;
@@ -71523,7 +71546,7 @@ function resolveNodeLaunchCommand(repoPath, pkg, packageManager) {
   return void 0;
 }
 function maybeGenerateNodeDockerfile(repoPath) {
-  const packageJsonPath = (0, import_node_path25.join)(repoPath, "package.json");
+  const packageJsonPath = (0, import_node_path26.join)(repoPath, "package.json");
   const pkg = readPackageJson3(packageJsonPath);
   if (!pkg) return void 0;
   const packageManager = detectPackageManager(pkg, repoPath);
@@ -71551,12 +71574,12 @@ function maybeGenerateNodeDockerfile(repoPath) {
   };
 }
 function maybeGenerateSharedLibNodeDockerfile(repoPath) {
-  const packageJsonPath = (0, import_node_path25.join)(repoPath, "package.json");
+  const packageJsonPath = (0, import_node_path26.join)(repoPath, "package.json");
   const pkg = readPackageJson3(packageJsonPath);
   if (!pkg) return void 0;
-  const harnessDirName = (0, import_node_path25.basename)(repoPath);
-  const parentDir = (0, import_node_path25.dirname)(repoPath);
-  const sharedLibDir = (0, import_node_path25.join)(parentDir, "_lib");
+  const harnessDirName = (0, import_node_path26.basename)(repoPath);
+  const parentDir = (0, import_node_path26.dirname)(repoPath);
+  const sharedLibDir = (0, import_node_path26.join)(parentDir, "_lib");
   if (!(0, import_node_fs29.existsSync)(sharedLibDir)) return void 0;
   let hasSharedLibFiles;
   try {
@@ -71671,7 +71694,7 @@ function generateDockerfile(repoPath) {
 }
 function resolveExplicitDockerfile(repoPath, rawPath) {
   const trimmed = rawPath.trim();
-  const dockerfilePath = (0, import_node_path25.resolve)(repoPath, trimmed);
+  const dockerfilePath = (0, import_node_path26.resolve)(repoPath, trimmed);
   if (!(0, import_node_fs29.existsSync)(dockerfilePath) || !(0, import_node_fs29.statSync)(dockerfilePath).isFile()) {
     throw new DockerfileError(
       "invalid_path",
@@ -71682,7 +71705,7 @@ function resolveExplicitDockerfile(repoPath, rawPath) {
   return dockerfilePath;
 }
 function resolveDockerfile(repoPathInput, options) {
-  const repoPath = (0, import_node_path25.resolve)(repoPathInput);
+  const repoPath = (0, import_node_path26.resolve)(repoPathInput);
   if (options?.explicitDockerfile?.trim()) {
     const dockerfilePath = resolveExplicitDockerfile(repoPath, options.explicitDockerfile);
     return {
@@ -71692,7 +71715,7 @@ function resolveDockerfile(repoPathInput, options) {
       summary: `using explicit Dockerfile ${dockerfilePath}`
     };
   }
-  const rootDockerfile = (0, import_node_path25.join)(repoPath, "Dockerfile");
+  const rootDockerfile = (0, import_node_path26.join)(repoPath, "Dockerfile");
   if ((0, import_node_fs29.existsSync)(rootDockerfile) && (0, import_node_fs29.statSync)(rootDockerfile).isFile()) {
     return {
       source: "existing",
@@ -71716,7 +71739,7 @@ function resolveDockerfile(repoPathInput, options) {
       "Pass a generatedDockerfilePath to resolveDockerfile."
     );
   }
-  const generatedPath = (0, import_node_path25.resolve)(options.generatedDockerfilePath);
+  const generatedPath = (0, import_node_path26.resolve)(options.generatedDockerfilePath);
   (0, import_node_fs29.writeFileSync)(generatedPath, generated.contents, "utf-8");
   return {
     source: "generated",
@@ -71728,36 +71751,36 @@ function resolveDockerfile(repoPathInput, options) {
 }
 
 // ../packages/sandbox-runtime/src/sandbox/llm-config.ts
-var OPENAI_PLACEHOLDER_KEY = "sk-proj-XaBcdEfGhIjKlMnOpQrStUvWxYz0123456789abcdefABCDEFghijKL";
-var ANTHROPIC_PLACEHOLDER_KEY = "sk-ant-api03-XaBcdEfGhIjKlMnOpQrStUvWxYz0123456789abcdefABCDEFghijKL";
-var GOOGLE_PLACEHOLDER_KEY = "AIzaSyAaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPqRsTuVw";
-var OPENROUTER_PLACEHOLDER_KEY = "sk-or-v1-AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv";
+var SANDBOX_OPENAI_PLACEHOLDER_API_KEY = "sk-proj-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+var SANDBOX_ANTHROPIC_PLACEHOLDER_API_KEY = "sk-ant-api03-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+var SANDBOX_GOOGLE_PLACEHOLDER_API_KEY = "AIzaSyAaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+var SANDBOX_OPENROUTER_PLACEHOLDER_API_KEY = "sk-or-v1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
 var PROVIDER_SPECS = {
   anthropic: {
     archalEnv: "ARCHAL_LLM_ANTHROPIC_KEY",
-    fallbacks: [{ env: "ANTHROPIC_API_KEY", placeholder: ANTHROPIC_PLACEHOLDER_KEY }],
+    fallbacks: [{ env: "ANTHROPIC_API_KEY", placeholder: SANDBOX_ANTHROPIC_PLACEHOLDER_API_KEY }],
     defaultModel: "anthropic/claude-sonnet-4-6",
-    authPlaceholder: ANTHROPIC_PLACEHOLDER_KEY
+    authPlaceholder: SANDBOX_ANTHROPIC_PLACEHOLDER_API_KEY
   },
   openai: {
     archalEnv: "ARCHAL_LLM_OPENAI_KEY",
-    fallbacks: [{ env: "OPENAI_API_KEY", placeholder: OPENAI_PLACEHOLDER_KEY }],
+    fallbacks: [{ env: "OPENAI_API_KEY", placeholder: SANDBOX_OPENAI_PLACEHOLDER_API_KEY }],
     defaultModel: "openai/gpt-4.1",
-    authPlaceholder: OPENAI_PLACEHOLDER_KEY
+    authPlaceholder: SANDBOX_OPENAI_PLACEHOLDER_API_KEY
   },
   google: {
     archalEnv: "ARCHAL_LLM_GOOGLE_KEY",
     fallbacks: [
-      { env: "GOOGLE_API_KEY", placeholder: GOOGLE_PLACEHOLDER_KEY },
-      { env: "GEMINI_API_KEY", placeholder: GOOGLE_PLACEHOLDER_KEY }
+      { env: "GOOGLE_API_KEY", placeholder: SANDBOX_GOOGLE_PLACEHOLDER_API_KEY },
+      { env: "GEMINI_API_KEY", placeholder: SANDBOX_GOOGLE_PLACEHOLDER_API_KEY }
     ],
     defaultModel: "google/gemini-2.5-flash",
-    authPlaceholder: GOOGLE_PLACEHOLDER_KEY
+    authPlaceholder: SANDBOX_GOOGLE_PLACEHOLDER_API_KEY
   },
   openrouter: {
     archalEnv: "ARCHAL_LLM_OPENROUTER_KEY",
-    fallbacks: [{ env: "OPENROUTER_API_KEY", placeholder: OPENROUTER_PLACEHOLDER_KEY }],
-    authPlaceholder: OPENROUTER_PLACEHOLDER_KEY
+    fallbacks: [{ env: "OPENROUTER_API_KEY", placeholder: SANDBOX_OPENROUTER_PLACEHOLDER_API_KEY }],
+    authPlaceholder: SANDBOX_OPENROUTER_PLACEHOLDER_API_KEY
   }
 };
 function readConfiguredKey(env, archalEnv, fallbacks) {
@@ -72002,12 +72025,12 @@ async function cleanupDockerImage(imageName) {
   await runDockerCommand(["image", "rm", "-f", imageName], 1e4);
 }
 async function buildDockerHarnessImage(repoPath, dockerfilePath, timeoutMs) {
-  const resolvedRepoPath = (0, import_node_path26.resolve)(repoPath);
+  const resolvedRepoPath = (0, import_node_path27.resolve)(repoPath);
   const dockerIdSuffix = `${Date.now().toString(36)}-${process.pid}`;
   const imageName = `archal/harness-${dockerIdSuffix}`;
-  const buildDir = (0, import_node_fs30.mkdtempSync)((0, import_node_path26.join)((0, import_node_os8.tmpdir)(), "archal-harness-build-"));
+  const buildDir = (0, import_node_fs30.mkdtempSync)((0, import_node_path27.join)((0, import_node_os8.tmpdir)(), "archal-harness-build-"));
   try {
-    const generatedDockerfilePath = (0, import_node_path26.join)(buildDir, "Dockerfile.generated");
+    const generatedDockerfilePath = (0, import_node_path27.join)(buildDir, "Dockerfile.generated");
     let dockerfile;
     try {
       dockerfile = resolveDockerfile(resolvedRepoPath, {
@@ -72052,24 +72075,24 @@ async function runDockerHarness(config2) {
       "Install Docker Desktop or Docker Engine before using the Docker harness."
     ));
   }
-  const repoPath = (0, import_node_path26.resolve)(config2.repoPath);
-  const runDir = (0, import_node_fs30.mkdtempSync)((0, import_node_path26.join)((0, import_node_os8.tmpdir)(), "archal-harness-"));
-  const generatedDockerfilePath = (0, import_node_path26.join)(runDir, "Dockerfile.generated");
+  const repoPath = (0, import_node_path27.resolve)(config2.repoPath);
+  const runDir = (0, import_node_fs30.mkdtempSync)((0, import_node_path27.join)((0, import_node_os8.tmpdir)(), "archal-harness-"));
+  const generatedDockerfilePath = (0, import_node_path27.join)(runDir, "Dockerfile.generated");
   const dockerIdSuffix = `${Date.now().toString(36)}-${process.pid}`;
   const imageName = config2.prebuiltImage ?? `archal/harness-${dockerIdSuffix}`;
   const containerName = `archal-harness-${dockerIdSuffix}`;
   const proxyContainerName = `archal-harness-proxy-${dockerIdSuffix}`;
   const networkName = `archal-harness-net-${dockerIdSuffix}`;
   const proxyEgressNetworkName = `archal-harness-egress-${dockerIdSuffix}`;
-  const mountedConfigDir = (0, import_node_path26.join)(runDir, "out");
-  const envFilePath = (0, import_node_path26.join)(runDir, ".env");
-  const proxyEnvFilePath = (0, import_node_path26.join)(runDir, ".proxy.env");
-  const cloneUrlsHostPath = (0, import_node_path26.join)(mountedConfigDir, "clone-urls.json");
+  const mountedConfigDir = (0, import_node_path27.join)(runDir, "out");
+  const envFilePath = (0, import_node_path27.join)(runDir, ".env");
+  const proxyEnvFilePath = (0, import_node_path27.join)(runDir, ".proxy.env");
+  const cloneUrlsHostPath = (0, import_node_path27.join)(mountedConfigDir, "clone-urls.json");
   const cloneUrlsContainerPath = `${OUTPUT_DIR_IN_CONTAINER}/clone-urls.json`;
-  const proxyCaPath = (0, import_node_path26.join)(mountedConfigDir, "ca.crt");
-  const proxyEventsPath = (0, import_node_path26.join)(mountedConfigDir, "proxy-events.ndjson");
-  const metricsPath = (0, import_node_path26.join)(mountedConfigDir, "metrics.json");
-  const agentTracePath = (0, import_node_path26.join)(mountedConfigDir, "agent-trace.json");
+  const proxyCaPath = (0, import_node_path27.join)(mountedConfigDir, "ca.crt");
+  const proxyEventsPath = (0, import_node_path27.join)(mountedConfigDir, "proxy-events.ndjson");
+  const metricsPath = (0, import_node_path27.join)(mountedConfigDir, "metrics.json");
+  const agentTracePath = (0, import_node_path27.join)(mountedConfigDir, "agent-trace.json");
   const ownImage = !config2.prebuiltImage;
   let cleanupDocker = false;
   const cleanupHandlers = registerDockerCleanupHandlers(containerName, imageName, ownImage, {
@@ -72367,7 +72390,7 @@ function buildSupervisorMcpConfig(twinUrls, authToken) {
     if (authToken) {
       entry.headers = { Authorization: `Bearer ${authToken}` };
     }
-    mcpServers[`archal-${twinName}`] = entry;
+    mcpServers[twinName] = entry;
   }
   return mcpServers;
 }
@@ -72599,18 +72622,18 @@ ${buildModelBackendHint()}` : `OpenClaw error: ${parsed.error.message}`,
 
 // ../packages/sandbox-runtime/src/sandbox/sandbox-proxy.ts
 var import_node_fs33 = require("fs");
-var import_node_path30 = require("path");
+var import_node_path31 = require("path");
 
 // ../packages/sandbox-runtime/src/sandbox/local-proxy-runner.ts
 var import_node_child_process7 = require("child_process");
 var import_node_crypto19 = require("crypto");
 var import_node_fs32 = require("fs");
-var import_node_path28 = require("path");
+var import_node_path29 = require("path");
 
 // ../packages/sandbox-runtime/src/sandbox/certs.ts
 var import_node_crypto18 = require("crypto");
 var import_node_fs31 = require("fs");
-var import_node_path27 = require("path");
+var import_node_path28 = require("path");
 var import_node_os9 = require("os");
 var CA_COMMON_NAME = "GlobalSign Atlas R3 DV TLS CA 2025 Q4";
 var CERT_VALIDITY_DAYS = 90;
@@ -72620,9 +72643,9 @@ function generateCertAuthority() {
   });
   const certPem = generateSelfSignedCert(publicKey, privateKey, CA_COMMON_NAME, true);
   const keyPem = privateKey.export({ type: "pkcs8", format: "pem" });
-  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path27.join)((0, import_node_os9.tmpdir)(), "tls-trust-store-"));
-  const certPath = (0, import_node_path27.join)(dir, "ca.crt");
-  const keyPath = (0, import_node_path27.join)(dir, "ca.key");
+  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path28.join)((0, import_node_os9.tmpdir)(), "tls-trust-store-"));
+  const certPath = (0, import_node_path28.join)(dir, "ca.crt");
+  const keyPath = (0, import_node_path28.join)(dir, "ca.key");
   (0, import_node_fs31.writeFileSync)(certPath, certPem);
   (0, import_node_fs31.writeFileSync)(keyPath, keyPem);
   return { certPem, keyPem, certPath, keyPath, dir };
@@ -73043,6 +73066,7 @@ function writeEgressBlockedResponse(res) {
 function endSocketWithEgressBlockedResponse(socket) {
   endSocketWithPlainTextResponse(socket, 403, "Forbidden", EGRESS_BLOCKED_MESSAGE);
 }
+var GITHUB_API_REQUEST_FAILED_MESSAGE = "GitHub API request failed";
 function forwardToSandboxProxyProvider(clientReq, clientRes, provider, path2, keys, onIntercept, captureBodyPreview) {
   const config2 = LLM_PROVIDER_DOMAINS2[provider];
   const authHeaders = buildLlmAuthHeaders(provider, keys);
@@ -73469,7 +73493,7 @@ async function handleIssueList(targetUrl, owner, name, authHeaders) {
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       logGraphQL(`REST error: status=${response.status} body=${text.slice(0, 500)}`);
-      return { data: {}, errors: [{ message: `API request failed with status ${response.status}` }] };
+      return { data: {}, errors: [{ message: `${GITHUB_API_REQUEST_FAILED_MESSAGE}: ${response.status}` }] };
     }
     const rawBody = await response.json();
     const issues = Array.isArray(rawBody) ? rawBody : [];
@@ -73517,7 +73541,7 @@ async function handleIssueList(targetUrl, owner, name, authHeaders) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logGraphQL(`Issue list fetch failed: ${msg}`);
-    return { data: {}, errors: [{ message: "API request failed." }] };
+    return { data: {}, errors: [{ message: GITHUB_API_REQUEST_FAILED_MESSAGE }] };
   }
 }
 async function handleIssueView(targetUrl, owner, name, number4, authHeaders) {
@@ -73528,7 +73552,7 @@ async function handleIssueView(targetUrl, owner, name, number4, authHeaders) {
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       logGraphQL(`REST error: status=${response.status} body=${text.slice(0, 500)}`);
-      return { data: {}, errors: [{ message: `API request failed with status ${response.status}` }] };
+      return { data: {}, errors: [{ message: `${GITHUB_API_REQUEST_FAILED_MESSAGE}: ${response.status}` }] };
     }
     const issue2 = await response.json();
     const formatted = formatGraphQLIssue(issue2, owner, name);
@@ -73549,7 +73573,7 @@ async function handleIssueView(targetUrl, owner, name, number4, authHeaders) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logGraphQL(`Issue view fetch failed: ${msg}`);
-    return { data: {}, errors: [{ message: "API request failed." }] };
+    return { data: {}, errors: [{ message: GITHUB_API_REQUEST_FAILED_MESSAGE }] };
   }
 }
 async function handlePrList(targetUrl, owner, name, authHeaders) {
@@ -73560,7 +73584,7 @@ async function handlePrList(targetUrl, owner, name, authHeaders) {
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       logGraphQL(`REST error: status=${response.status} body=${text.slice(0, 500)}`);
-      return { data: {}, errors: [{ message: `API request failed with status ${response.status}` }] };
+      return { data: {}, errors: [{ message: `${GITHUB_API_REQUEST_FAILED_MESSAGE}: ${response.status}` }] };
     }
     const rawBody = await response.json();
     const prs = Array.isArray(rawBody) ? rawBody : [];
@@ -73623,7 +73647,7 @@ async function handlePrList(targetUrl, owner, name, authHeaders) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logGraphQL(`PR list fetch failed: ${msg}`);
-    return { data: {}, errors: [{ message: "API request failed." }] };
+    return { data: {}, errors: [{ message: GITHUB_API_REQUEST_FAILED_MESSAGE }] };
   }
 }
 async function handleRepoView(targetUrl, owner, name, authHeaders) {
@@ -73634,7 +73658,7 @@ async function handleRepoView(targetUrl, owner, name, authHeaders) {
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       logGraphQL(`REST error: status=${response.status} body=${text.slice(0, 500)}`);
-      return { data: {}, errors: [{ message: `API request failed with status ${response.status}` }] };
+      return { data: {}, errors: [{ message: `${GITHUB_API_REQUEST_FAILED_MESSAGE}: ${response.status}` }] };
     }
     const repo = await response.json();
     const defaultBranch = typeof repo["default_branch"] === "string" ? repo["default_branch"] : "main";
@@ -73690,7 +73714,7 @@ async function handleRepoView(targetUrl, owner, name, authHeaders) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logGraphQL(`Repo view fetch failed: ${msg}`);
-    return { data: {}, errors: [{ message: "API request failed." }] };
+    return { data: {}, errors: [{ message: GITHUB_API_REQUEST_FAILED_MESSAGE }] };
   }
 }
 function extractInlineArg(query, name) {
@@ -73823,7 +73847,7 @@ function forwardToCloudTwin(clientReq, clientRes, targetBaseUrl, path2, authHead
   proxyReq.on("error", () => {
     if (!clientRes.headersSent) {
       clientRes.writeHead(502);
-      clientRes.end("Bad Gateway");
+      clientRes.end(SERVICE_UNAVAILABLE_MESSAGE);
     }
   });
   clientReq.pipe(proxyReq);
@@ -74075,7 +74099,7 @@ async function runLocalProxy(config2, task, canaryFiles) {
     if (hostsEntries) {
       status("NOTE: For full interception in local mode, add these to /etc/hosts:\n" + hostsEntries);
     }
-    const workspace = config2.workspacePath ?? (0, import_node_path28.join)(process.env["HOME"] ?? "/root", ".openclaw");
+    const workspace = config2.workspacePath ?? (0, import_node_path29.join)(process.env["HOME"] ?? "/root", ".openclaw");
     const noProxyHosts = "127.0.0.1,localhost,.archal.ai";
     const openclawAgentName = process.env["ARCHAL_OPENCLAW_AGENT"]?.trim() || "main";
     const INFRA_ALLOWLIST = /* @__PURE__ */ new Set([
@@ -74164,14 +74188,17 @@ async function runLocalProxy(config2, task, canaryFiles) {
       SSL_CERT_FILE: ca.certPath,
       REQUESTS_CA_BUNDLE: ca.certPath,
       CURL_CA_BUNDLE: ca.certPath,
-      // Dummy API keys + proxy base URLs so SDKs don't complain about missing keys.
+      ...config2.engineModel ? { AGENT_MODEL: config2.engineModel } : {},
+      ...config2.openclawEvalMode ? { AGENT_EVAL_MODE: config2.openclawEvalMode } : {},
+      ...config2.openclawEvalMode === "isolated" ? { AGENT_DISABLE_PLUGINS: "1" } : {},
+      // Provider-shaped placeholders + routed base URLs so SDKs don't complain about missing keys.
       // The proxy intercepts these requests and injects the real key.
-      OPENAI_API_KEY: "sk-proxy",
+      OPENAI_API_KEY: SANDBOX_OPENAI_PLACEHOLDER_API_KEY,
       OPENAI_BASE_URL: `${proxyBase}/openai`,
-      ANTHROPIC_API_KEY: "sk-ant-proxy",
+      ANTHROPIC_API_KEY: SANDBOX_ANTHROPIC_PLACEHOLDER_API_KEY,
       ANTHROPIC_BASE_URL: `${proxyBase}/anthropic`,
-      GOOGLE_API_KEY: "proxy-key",
-      OPENROUTER_API_KEY: "sk-or-proxy",
+      GOOGLE_API_KEY: SANDBOX_GOOGLE_PLACEHOLDER_API_KEY,
+      OPENROUTER_API_KEY: SANDBOX_OPENROUTER_PLACEHOLDER_API_KEY,
       OPENCLAW_AGENT_SESSION_ID: `session-${(0, import_node_crypto19.randomUUID)()}`,
       OPENCLAW_DISABLE_BONJOUR: "1"
     };
@@ -74190,13 +74217,13 @@ async function runLocalProxy(config2, task, canaryFiles) {
   }
 }
 function writeCanaryFiles(workspace, canaryFiles) {
-  const resolvedWorkspace = (0, import_node_path28.resolve)(workspace);
+  const resolvedWorkspace = (0, import_node_path29.resolve)(workspace);
   for (const [relativePath, content] of Object.entries(canaryFiles)) {
-    const filePath = (0, import_node_path28.resolve)(workspace, relativePath);
-    if (filePath !== resolvedWorkspace && !filePath.startsWith(resolvedWorkspace + import_node_path28.sep)) {
+    const filePath = (0, import_node_path29.resolve)(workspace, relativePath);
+    if (filePath !== resolvedWorkspace && !filePath.startsWith(resolvedWorkspace + import_node_path29.sep)) {
       throw new Error(`Canary path escapes sandbox root: ${relativePath}`);
     }
-    (0, import_node_fs32.mkdirSync)((0, import_node_path28.dirname)(filePath), { recursive: true });
+    (0, import_node_fs32.mkdirSync)((0, import_node_path29.dirname)(filePath), { recursive: true });
     (0, import_node_fs32.writeFileSync)(filePath, content);
   }
 }
@@ -74286,16 +74313,16 @@ function spawnAgent(workspace, task, env, timeoutMs, agentName) {
 }
 
 // ../packages/sandbox-runtime/src/sandbox/red-team-alpha.ts
-var import_node_path29 = require("path");
+var import_node_path30 = require("path");
 var SANDBOX_CANARY_TAG = "openclaw-secret-exfil-alpha";
 var CANARY_LEAK_ERROR_CODE = "CANARY_LEAK_DETECTED";
 var CANARY_VALUE_PATTERN = /\barchal_canary_[a-z0-9._:-]+\b/gi;
 var SANDBOX_FILES_BLOCK_PATTERN = /```archal-sandbox-files\s*\n([\s\S]*?)```/i;
 var SNIPPET_RADIUS = 80;
 function confinePath(root, relativePath) {
-  const resolvedRoot = (0, import_node_path29.resolve)(root);
-  const resolved = (0, import_node_path29.resolve)(root, relativePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path29.sep)) {
+  const resolvedRoot = (0, import_node_path30.resolve)(root);
+  const resolved = (0, import_node_path30.resolve)(root, relativePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path30.sep)) {
     throw new Error(`Canary path escapes sandbox root: ${relativePath}`);
   }
   return resolved;
@@ -74474,7 +74501,7 @@ function readOpenClawProviderKeys(homePath) {
   if (!homePath?.trim()) {
     return {};
   }
-  const authPath = (0, import_node_path30.join)(homePath, "agents", "main", "agent", "auth-profiles.json");
+  const authPath = (0, import_node_path31.join)(homePath, "agents", "main", "agent", "auth-profiles.json");
   if (!(0, import_node_fs33.existsSync)(authPath)) {
     return {};
   }
@@ -74601,14 +74628,14 @@ async function runDockerSandbox(config2) {
       ...process.env["ANTHROPIC_API_KEY"] ?? mountedOpenClawProviderKeys.anthropic ? { ARCHAL_LLM_ANTHROPIC_KEY: process.env["ANTHROPIC_API_KEY"] ?? mountedOpenClawProviderKeys.anthropic } : {},
       ...process.env["GOOGLE_API_KEY"] ?? process.env["GEMINI_API_KEY"] ?? mountedOpenClawProviderKeys.google ? { ARCHAL_LLM_GOOGLE_KEY: process.env["GOOGLE_API_KEY"] ?? process.env["GEMINI_API_KEY"] ?? mountedOpenClawProviderKeys.google } : {},
       ...process.env["OPENROUTER_API_KEY"] ?? mountedOpenClawProviderKeys.openrouter ? { ARCHAL_LLM_OPENROUTER_KEY: process.env["OPENROUTER_API_KEY"] ?? mountedOpenClawProviderKeys.openrouter } : {},
-      // Dummy keys so the SDK/auth-profiles don't complain about missing values.
+      // Provider-shaped placeholders so SDK/auth-profiles don't complain about missing values.
       // These never reach the real provider — the proxy strips and replaces them.
-      OPENAI_API_KEY: "sk-proj-XaBcdEfGhIjKlMnOpQrStUvWxYz0123456789abcdefABCDEFghijKL",
+      OPENAI_API_KEY: SANDBOX_OPENAI_PLACEHOLDER_API_KEY,
       OPENAI_BASE_URL: "http://host.docker.internal:9100/openai",
-      ANTHROPIC_API_KEY: "sk-ant-api03-XaBcdEfGhIjKlMnOpQrStUvWxYz0123456789abcdefABCDEFghijKL",
+      ANTHROPIC_API_KEY: SANDBOX_ANTHROPIC_PLACEHOLDER_API_KEY,
       ANTHROPIC_BASE_URL: "http://host.docker.internal:9100/anthropic",
-      GOOGLE_API_KEY: "AIzaSyAaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPqRsTuVw",
-      OPENROUTER_API_KEY: "sk-or-v1-AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv",
+      GOOGLE_API_KEY: SANDBOX_GOOGLE_PLACEHOLDER_API_KEY,
+      OPENROUTER_API_KEY: SANDBOX_OPENROUTER_PLACEHOLDER_API_KEY,
       ARCHAL_BLOCK_EGRESS: "1",
       ...process.env["ARCHAL_ENGINE_API_KEY"] ? { ARCHAL_ENGINE_API_KEY: process.env["ARCHAL_ENGINE_API_KEY"] } : {},
       ...process.env["OPENCLAW_AGENT_ID"] ? { AGENT_ID: process.env["OPENCLAW_AGENT_ID"] } : {}
@@ -79031,7 +79058,7 @@ function formatCloneRoutingDiagnostic(message) {
   const snippet = trimSnippet(redactEvidenceString(message));
   const observed = snippet ? `
 Observed output/log signal: ${snippet}` : "";
-  return "Your local harness did not talk to the clone. It appears to have reached a real service endpoint and failed authentication." + observed + "\nFix: use sandbox or Docker routing when your SDK calls normal service URLs, or wire the SDK to the clone REST URL pattern for local harness runs. For GitHub REST clients, start from the Octokit pattern shown by `archal clone start github` / `archal clone status`: set the client base URL to the clone REST URL and authenticate that request with `ARCHAL_TOKEN`.";
+  return "Your local harness did not talk to the clone. It appears to have reached a real service endpoint and failed authentication." + observed + "\nFix: use sandbox or Docker routing when your SDK calls normal service URLs, or read AGENT_CLONE_URLS for clone REST URLs and add AGENT_ROUTE_HEADERS to clone requests in local harness runs.";
 }
 function classifyLocalHarnessFailure(message) {
   if (/Cannot determine intended module format|ERR_AMBIGUOUS_MODULE_SYNTAX|require is not defined|require\.resolve|top-level await are present/i.test(message)) {
@@ -79579,7 +79606,7 @@ function logProxyTraffic(count) {
 
 // src/runner/lifecycle/agent-lifecycle.ts
 var import_node_fs34 = require("fs");
-var import_node_path31 = require("path");
+var import_node_path32 = require("path");
 var import_node_os10 = require("os");
 init_src();
 
@@ -79746,7 +79773,7 @@ function writeAgentConfigs(runId, cloudCloneUrls, _authToken) {
       }
     }
   };
-  const mcpConfigPath = (0, import_node_path31.join)((0, import_node_os10.tmpdir)(), `${runId}-mcp-config.json`);
+  const mcpConfigPath = (0, import_node_path32.join)((0, import_node_os10.tmpdir)(), `${runId}-mcp-config.json`);
   const mcpTmpPath = `${mcpConfigPath}.tmp`;
   (0, import_node_fs34.writeFileSync)(mcpTmpPath, JSON.stringify({ mcpServers: aggregateServer }, null, 2), { mode: 384 });
   (0, import_node_fs34.chmodSync)(mcpTmpPath, 384);
@@ -81747,11 +81774,11 @@ init_logger();
 
 // src/runner/file-seed-loader.ts
 var import_node_fs40 = require("fs");
-var import_node_path36 = require("path");
+var import_node_path37 = require("path");
 
 // ../packages/runtime/src/auth-lease.ts
 var import_node_fs37 = require("fs");
-var import_node_path33 = require("path");
+var import_node_path34 = require("path");
 init_src4();
 
 // ../packages/runtime/src/session-provider.ts
@@ -81805,16 +81832,37 @@ var SESSION_POLL_INTERVAL_MS = 2e3;
 var ARCHAL_WORKSPACE_HEADER2 = "x-archal-workspace";
 var SESSION_RESPONSE_SCOPE_HEADER2 = "x-archal-session-response";
 var CLI_SESSION_TRANSPORT_SCOPE2 = "cli-transport";
+var INFRASTRUCTURE_DETAIL_PATTERN = /(?:archal[-_\s]?(?:proxy|runtime|control[-_\s]?plane|service[-_\s]?gateway|openclaw[-_\s]?gateway)|control[-_\s]?plane|CLI_JWT_SECRET|CONTROL_PLANE|JWT_SECRET|ARCHAL_|runtime provider|runtime\/session|worker[-_\s]?endpoint|x[-_]?archal|service[-_\s]?gateway|service[-_\s]?runtime|provider[-_\s]?gateway|graphql[-_\s]?gateway|workflow[-_\s]?(?:runtime|harness|session)|harness[-_\s]?bootstrap|service_mcp_servers|\/service-gateway|tls intercept|sidecar|openclaw[-_\s]?gateway|credential_issuance_seed|hosted\s+clone|cloud(?:Clone|Twin)Urls|(?:clone|twin)[-_]access[-_]denied|twin[-_]not[-_]in[-_]catalog|pre[-_\s]?migration|stale[-_\s]?data)/i;
+function publicHostedSessionDetail(detail) {
+  if (!detail?.trim()) {
+    return "";
+  }
+  return INFRASTRUCTURE_DETAIL_PATTERN.test(detail) ? "service routing failed to prepare the requested services." : detail;
+}
+function hostedSessionRequestErrorMessage(method, path2, status, detail) {
+  const publicDetail = publicHostedSessionDetail(detail);
+  return `Hosted session request failed (${method} ${path2}, HTTP ${status}${publicDetail ? `: ${publicDetail}` : ""}).`;
+}
 var HostedSessionRequestError = class extends Error {
   constructor(method, path2, status, detail) {
-    super(
-      `Hosted session request failed (${method} ${path2}, HTTP ${status}${detail ? `: ${detail}` : ""}).`
-    );
+    super(hostedSessionRequestErrorMessage(method, path2, status, detail));
     this.method = method;
     this.path = path2;
     this.status = status;
-    this.detail = detail;
     this.name = "HostedSessionRequestError";
+    this.detail = publicHostedSessionDetail(detail);
+    Object.defineProperty(this, "internalDetail", {
+      value: detail,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+  }
+  detail;
+  internalDetail;
+  /** @internal */
+  getInternalDetailForRetry() {
+    return this.internalDetail;
   }
 };
 function trimEnv(name) {
@@ -81918,7 +81966,7 @@ function isTransientHostedSessionStartError(error49) {
     if (error49.status === 401 || error49.status === 429 || error49.status === 500 || error49.status === 502 || error49.status === 503 || error49.status === 504) {
       return true;
     }
-    return detailLooksTransient(error49.detail);
+    return detailLooksTransient(error49.getInternalDetailForRetry());
   }
   if (error49 instanceof Error) {
     if (error49.message.startsWith("Hosted session timed out waiting for readiness")) {
@@ -82148,7 +82196,7 @@ function adoptLatestStoredCredentials(credentials) {
 }
 async function withStoredCredentialsLock(action) {
   const archalDir = getArchalDir2();
-  const lockDirectory = (0, import_node_path33.join)(archalDir, "archal-auth-validation.lock");
+  const lockDirectory = (0, import_node_path34.join)(archalDir, "archal-auth-validation.lock");
   const deadline = Date.now() + STORED_CREDENTIALS_LOCK_TIMEOUT_MS;
   await import_node_fs37.promises.mkdir(archalDir, { recursive: true });
   while (true) {
@@ -82273,21 +82321,21 @@ async function createHostedAuthLease(options = {}) {
 
 // ../packages/runtime/src/seed-loader.ts
 var import_node_fs38 = require("fs");
-var import_node_path35 = require("path");
+var import_node_path36 = require("path");
 init_src6();
 
 // ../packages/runtime/src/temp-artifacts.ts
-var import_node_path34 = require("path");
+var import_node_path35 = require("path");
 var import_node_os11 = require("os");
 function normalizeSessionKey(sessionKey) {
   const value = sessionKey?.trim() || "default";
   return value.replace(/[^A-Za-z0-9._-]+/g, "_");
 }
 function getSeedLoadingMarkerPath(sessionKey) {
-  return (0, import_node_path34.join)((0, import_node_os11.tmpdir)(), "archal-runtime-seed-markers", `${normalizeSessionKey(sessionKey)}.loading`);
+  return (0, import_node_path35.join)((0, import_node_os11.tmpdir)(), "archal-runtime-seed-markers", `${normalizeSessionKey(sessionKey)}.loading`);
 }
 function getSeedLoadedMarkerPath(sessionKey) {
-  return (0, import_node_path34.join)((0, import_node_os11.tmpdir)(), "archal-runtime-seed-markers", `${normalizeSessionKey(sessionKey)}.seeded`);
+  return (0, import_node_path35.join)((0, import_node_os11.tmpdir)(), "archal-runtime-seed-markers", `${normalizeSessionKey(sessionKey)}.seeded`);
 }
 
 // ../packages/runtime/src/seed-loader.ts
@@ -82300,7 +82348,7 @@ async function loadFileSeedsIntoTwins(config2, fetchTwin2, options = {}) {
   const sessionKey = config2.sessionKey;
   const loadingMarkerPath = getSeedLoadingMarkerPath(sessionKey);
   const loadedMarkerPath = getSeedLoadedMarkerPath(sessionKey);
-  const markerDir = (0, import_node_path35.dirname)(loadedMarkerPath);
+  const markerDir = (0, import_node_path36.dirname)(loadedMarkerPath);
   (0, import_node_fs38.mkdirSync)(markerDir, { recursive: true, mode: 448 });
   while (true) {
     if ((0, import_node_fs38.existsSync)(loadedMarkerPath)) {
@@ -82424,7 +82472,7 @@ var HOSTED_SEED_WARMUP_BACKOFF_MS = [1500, 2500, 3500, 5e3, 6e3, 7e3];
 var HOSTED_SEED_WARMUP_RETRIES = 6;
 var DEFAULT_WARMUP_BACKOFF_MS2 = 5e3;
 function toSeedFormat(seedPath) {
-  const extension = (0, import_node_path36.extname)(seedPath).toLowerCase();
+  const extension = (0, import_node_path37.extname)(seedPath).toLowerCase();
   if (extension === ".json") return "json";
   if (extension === ".md") return "markdown";
   throw new Error(`Unsupported seed file extension for ${seedPath}. Expected .json or .md.`);
@@ -82502,7 +82550,7 @@ async function loadFileSeedsIntoHostedTwins(fileSeedPaths, cloudCloneUrls, beare
 // src/runner/runtime-prereqs.ts
 var import_node_fs41 = require("fs");
 var import_node_os12 = require("os");
-var import_node_path37 = require("path");
+var import_node_path38 = require("path");
 var MIN_SANDBOX_TMP_BYTES = 8 * 1024 * 1024 * 1024;
 function listCommandCandidates(command) {
   if (process.platform !== "win32") {
@@ -82533,11 +82581,11 @@ function isCommandAvailable(command) {
     return false;
   }
   const candidates = listCommandCandidates(command);
-  for (const segment of pathValue.split(import_node_path37.delimiter)) {
+  for (const segment of pathValue.split(import_node_path38.delimiter)) {
     const dir = segment.trim();
     if (!dir) continue;
     for (const candidate of candidates) {
-      const fullPath = (0, import_node_path37.join)(dir, candidate);
+      const fullPath = (0, import_node_path38.join)(dir, candidate);
       if (!(0, import_node_fs41.existsSync)(fullPath)) continue;
       if (isExecutable2(fullPath)) {
         return true;
@@ -82621,7 +82669,7 @@ init_config_loader();
 
 // src/runner/auth-seeds.ts
 var import_node_fs42 = require("fs");
-var import_node_path38 = require("path");
+var import_node_path39 = require("path");
 init_src4();
 init_auth();
 init_request_metadata2();
@@ -82659,7 +82707,7 @@ async function resolveHostedScenarioPath(scenarioArg) {
   return result.path;
 }
 async function resolveScenarioPath(scenarioArg) {
-  const unresolvedPath = (0, import_node_path38.resolve)(scenarioArg);
+  const unresolvedPath = (0, import_node_path39.resolve)(scenarioArg);
   let scenarioPath = resolveLocalScenario(scenarioArg);
   if (!scenarioPath) {
     const hostedScenario = await resolveHostedScenarioPath(scenarioArg);
@@ -82711,7 +82759,7 @@ async function resolveCredentialsAndEntitlements(scenarioArg, scenario, opts, _e
 }
 
 // src/runner/engine-plan.ts
-var import_node_path39 = require("path");
+var import_node_path40 = require("path");
 init_src();
 init_logger();
 function selectEnvFallback(hasResolved, reader, key) {
@@ -82887,7 +82935,7 @@ function resolveHarnessAndEngine(opts, timeout, resolved, env = captureEnvSnapsh
       }
     } else {
       const inferredHarness = discoverRepoLocalHarness(
-        (0, import_node_path39.dirname)(resolved?.scenarioPath ?? process.cwd()),
+        (0, import_node_path40.dirname)(resolved?.scenarioPath ?? process.cwd()),
         resolved?.projectRoot ?? "",
         process.cwd()
       );
@@ -83148,7 +83196,7 @@ Docs: https://archal.ai/docs/cli/config#config-file-format` : 'Set GEMINI_API_KE
 
 // src/runner/managed-run-state.ts
 var import_node_fs43 = require("fs");
-var import_node_path40 = require("path");
+var import_node_path41 = require("path");
 function getManagedRunStatusPath(reader) {
   return reader.get("ARCHAL_WEB_RUN_STATUS_PATH");
 }
@@ -83168,7 +83216,7 @@ function writeManagedRunStatusAt(statusPath, patch) {
       } catch {
       }
     }
-    (0, import_node_fs43.mkdirSync)((0, import_node_path40.dirname)(statusPath), { recursive: true });
+    (0, import_node_fs43.mkdirSync)((0, import_node_path41.dirname)(statusPath), { recursive: true });
     const next = { ...existing, ...patch };
     const stage = typeof next["stage"] === "string" ? next["stage"] : null;
     if (stage && stage !== "failed") {
@@ -83193,7 +83241,7 @@ function createManagedRunStatusWriter(reader, statusPath = getManagedRunStatusPa
 }
 
 // src/runner/hosted-session-provisioning.ts
-var import_node_path44 = require("path");
+var import_node_path45 = require("path");
 init_auth();
 init_api_client();
 
@@ -83222,7 +83270,7 @@ init_logger();
 
 // src/telemetry/posthog.ts
 var import_node_fs45 = require("fs");
-var import_node_path41 = require("path");
+var import_node_path42 = require("path");
 var import_node_crypto23 = require("crypto");
 
 // ../node_modules/.pnpm/posthog-node@5.26.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
@@ -87143,8 +87191,8 @@ var userPlan = null;
 var anonymousId = null;
 function getAnonymousId() {
   if (anonymousId) return anonymousId;
-  const archalDir = (0, import_node_path41.join)(process.env["HOME"] ?? process.env["USERPROFILE"] ?? ".", ".archal");
-  const idPath = (0, import_node_path41.join)(archalDir, "anonymous-id");
+  const archalDir = (0, import_node_path42.join)(process.env["HOME"] ?? process.env["USERPROFILE"] ?? ".", ".archal");
+  const idPath = (0, import_node_path42.join)(archalDir, "anonymous-id");
   try {
     anonymousId = (0, import_node_fs45.readFileSync)(idPath, "utf-8").trim();
     if (anonymousId) return anonymousId;
@@ -87349,15 +87397,15 @@ init_errors6();
 // src/clone/session-store.ts
 var import_node_fs46 = require("fs");
 var import_node_os13 = require("os");
-var import_node_path42 = require("path");
+var import_node_path43 = require("path");
 init_auth();
 init_config_loader();
 var SESSION_FILE_NAME = "twin-session.json";
 function getSessionFilePath() {
-  return (0, import_node_path42.join)(getArchalDir(), SESSION_FILE_NAME);
+  return (0, import_node_path43.join)(getArchalDir(), SESSION_FILE_NAME);
 }
 function getLegacySessionFilePath() {
-  return (0, import_node_path42.join)((0, import_node_os13.homedir)(), ".archal", SESSION_FILE_NAME);
+  return (0, import_node_path43.join)((0, import_node_os13.homedir)(), ".archal", SESSION_FILE_NAME);
 }
 function toTrimmedRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -87933,6 +87981,13 @@ Run 'archal usage' to inspect the workspace pool, or open https://www.archal.ai/
 }
 
 // src/runner/hosted-session/readiness.ts
+function isHostedSessionRequestError(error49) {
+  return error49 instanceof HostedSessionRequestError || error49 instanceof Error && typeof error49.method === "string" && typeof error49.path === "string" && typeof error49.status === "number" && typeof error49.detail === "string";
+}
+function getHostedSessionErrorDetail(error49) {
+  const internalDetail = typeof error49.getInternalDetailForRetry === "function" ? error49.getInternalDetailForRetry() : void 0;
+  return internalDetail ?? error49.detail;
+}
 async function waitForSessionReady(opts) {
   if (!opts.quiet) process.stderr.write("Starting cloud session...\n");
   const startedAt = Date.now();
@@ -87950,11 +88005,11 @@ async function waitForSessionReady(opts) {
       environment.auth.stop();
     }
   } catch (error49) {
-    if (error49 instanceof HostedSessionRequestError) {
+    if (isHostedSessionRequestError(error49)) {
       let details;
       let code;
       try {
-        const parsed = JSON.parse(error49.detail);
+        const parsed = JSON.parse(getHostedSessionErrorDetail(error49));
         if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
           details = parsed;
           if (typeof parsed["code"] === "string") code = parsed["code"];
@@ -87989,7 +88044,7 @@ async function waitForSessionReady(opts) {
 
 // src/runner/hosted-session/cleanup.ts
 var import_node_fs48 = require("fs");
-var import_node_path43 = require("path");
+var import_node_path44 = require("path");
 init_src();
 init_api_client();
 init_auth();
@@ -88344,7 +88399,7 @@ async function writeEvidenceFilePhase(ctx, sessionId, credentials, requestOption
         warnCleanup("failed to build trace payload", traceErr);
       }
     }
-    (0, import_node_fs48.mkdirSync)((0, import_node_path43.dirname)(ctx.evidenceOutputPath), { recursive: true });
+    (0, import_node_fs48.mkdirSync)((0, import_node_path44.dirname)(ctx.evidenceOutputPath), { recursive: true });
     (0, import_node_fs48.writeFileSync)(
       ctx.evidenceOutputPath,
       JSON.stringify(
@@ -88692,7 +88747,7 @@ async function provisionHostedRunSession(input) {
   }
   const enginePlan = engine.plan;
   if (!ctx.runFailureMessage && enginePlan.kind === "api" && !enginePlan.twinUrlsPath) {
-    ctx.generatedTwinUrlMapPath = (0, import_node_path44.resolve)(
+    ctx.generatedTwinUrlMapPath = (0, import_node_path45.resolve)(
       `.archal-session-${ctx.backendSessionId}-engine-twin-urls.json`
     );
     const result = writeTempJsonMap(
@@ -88910,9 +88965,9 @@ function emitExplicitSaveTip(input) {
 // src/runner/execute-scenario.ts
 function resolveCliFileSeedPaths(seed, scenario) {
   if (!seed) return void 0;
-  const extension = (0, import_node_path45.extname)(seed).toLowerCase();
+  const extension = (0, import_node_path46.extname)(seed).toLowerCase();
   if (extension !== ".json" && extension !== ".md") return void 0;
-  const seedPath = (0, import_node_path45.resolve)(seed);
+  const seedPath = (0, import_node_path46.resolve)(seed);
   if (!(0, import_node_fs49.existsSync)(seedPath)) return void 0;
   if (scenario.config.twins.length !== 1) {
     validationError(
@@ -89038,7 +89093,7 @@ async function executeRunForScenario(scenarioArg, opts, command, configDefaults,
       userConfig: configDefaults,
       projectConfig: archalFile ? {
         root: archalFile.configDir,
-        configPath: (0, import_node_path45.resolve)(archalFile.configDir, ".archal.json"),
+        configPath: (0, import_node_path46.resolve)(archalFile.configDir, ".archal.json"),
         config: loadProjectConfig(archalFile.configDir)
       } : void 0,
       env: envSnapshot
@@ -89089,6 +89144,15 @@ async function executeRunForScenario(scenarioArg, opts, command, configDefaults,
   if (runOpts.dockerfile && isNoDockerRequested(runOpts)) {
     validationError("--dockerfile and --no-docker are mutually exclusive");
   }
+  const engine = resolveHarnessAndEngine(runOpts, timeout, resolved, envSnapshot);
+  const enginePlan = engine.plan;
+  emitExplicitSaveTip({ enginePlan, runOpts });
+  const dockerHarness = isDockerHarnessPlan(enginePlan);
+  const sandbox = isSandboxPlan(enginePlan);
+  const agentModel = planAgentModel(enginePlan);
+  const harnessName = planHarnessName(enginePlan);
+  const openclawHomePath = planOpenclawHomePath(enginePlan);
+  const openclawEvalMode = planOpenclawEvalMode(enginePlan);
   let credentials = await resolveCredentialsAndEntitlements(
     scenarioArg,
     scenario,
@@ -89123,15 +89187,6 @@ async function executeRunForScenario(scenarioArg, opts, command, configDefaults,
     env: envSnapshot,
     requiresManagedJudge
   });
-  const engine = resolveHarnessAndEngine(runOpts, timeout, resolved, envSnapshot);
-  const enginePlan = engine.plan;
-  emitExplicitSaveTip({ enginePlan, runOpts });
-  const dockerHarness = isDockerHarnessPlan(enginePlan);
-  const sandbox = isSandboxPlan(enginePlan);
-  const agentModel = planAgentModel(enginePlan);
-  const harnessName = planHarnessName(enginePlan);
-  const openclawHomePath = planOpenclawHomePath(enginePlan);
-  const openclawEvalMode = planOpenclawEvalMode(enginePlan);
   try {
     const prereqOutcome = await validateLocalRuntimePrereqs({
       sandbox,
@@ -89358,11 +89413,11 @@ async function executeRunForScenario(scenarioArg, opts, command, configDefaults,
 
 // src/runner/command-scenarios.ts
 var import_node_fs52 = require("fs");
-var import_node_path48 = require("path");
+var import_node_path49 = require("path");
 
 // src/commands/task-scenario.ts
 var import_node_fs50 = require("fs");
-var import_node_path46 = require("path");
+var import_node_path47 = require("path");
 var import_node_os14 = require("os");
 var import_node_crypto26 = require("crypto");
 function deriveTitle(task) {
@@ -89544,10 +89599,10 @@ function generateTaskScenario(options) {
     "tags: inline",
     ""
   ].join("\n");
-  const dir = (0, import_node_path46.join)((0, import_node_os14.tmpdir)(), "archal-task-scenarios");
+  const dir = (0, import_node_path47.join)((0, import_node_os14.tmpdir)(), "archal-task-scenarios");
   (0, import_node_fs50.mkdirSync)(dir, { recursive: true });
   const filename = `task-${(0, import_node_crypto26.randomUUID)()}.md`;
-  const filepath = (0, import_node_path46.join)(dir, filename);
+  const filepath = (0, import_node_path47.join)(dir, filename);
   (0, import_node_fs50.writeFileSync)(filepath, markdown, "utf-8");
   return filepath;
 }
@@ -89568,15 +89623,15 @@ function resolveConfigOwnedFilePath(configDir, rawPath, label) {
   if (!trimmed) {
     validationError(`Invalid .archal.json ${label} path.`, "Use a non-empty relative path.");
   }
-  if ((0, import_node_path48.isAbsolute)(trimmed)) {
+  if ((0, import_node_path49.isAbsolute)(trimmed)) {
     validationError(
       `Invalid .archal.json ${label} path "${rawPath}".`,
       `${label} file paths in .archal.json must be relative to the config directory.`
     );
   }
-  const resolvedPath = (0, import_node_path48.resolve)(configDir, trimmed);
-  const relativeToConfig = (0, import_node_path48.relative)(configDir, resolvedPath);
-  if (relativeToConfig.startsWith("..") || (0, import_node_path48.isAbsolute)(relativeToConfig)) {
+  const resolvedPath = (0, import_node_path49.resolve)(configDir, trimmed);
+  const relativeToConfig = (0, import_node_path49.relative)(configDir, resolvedPath);
+  if (relativeToConfig.startsWith("..") || (0, import_node_path49.isAbsolute)(relativeToConfig)) {
     validationError(
       `Invalid .archal.json ${label} path "${rawPath}".`,
       `${label} file paths in .archal.json must stay inside the config directory.`
@@ -89598,8 +89653,8 @@ function resolveConfigOwnedFilePath(configDir, rawPath, label) {
     }
     const realConfigDir = (0, import_node_fs52.realpathSync)(configDir);
     const realFilePath = (0, import_node_fs52.realpathSync)(resolvedPath);
-    const realRelativeToConfig = (0, import_node_path48.relative)(realConfigDir, realFilePath);
-    if (realRelativeToConfig.startsWith("..") || (0, import_node_path48.isAbsolute)(realRelativeToConfig)) {
+    const realRelativeToConfig = (0, import_node_path49.relative)(realConfigDir, realFilePath);
+    if (realRelativeToConfig.startsWith("..") || (0, import_node_path49.isAbsolute)(realRelativeToConfig)) {
       validationError(
         `Invalid .archal.json ${label} path "${rawPath}".`,
         `${label} file paths in .archal.json must resolve inside the config directory.`
@@ -89650,7 +89705,7 @@ async function resolveRunCommandScenarios(scenarioArg, opts, command) {
           generatedConfig["_comment"] = 'agentModel "none" disables the agent-side LLM check. Set this when the harness does not call an LLM (bash + curl, urllib, plain fetch). Remove or change to a model name (e.g. "claude-sonnet-4-6") if your harness calls an LLM directly.';
           generatedConfig["agentModel"] = "none";
         }
-        const configPath = (0, import_node_path48.resolve)(process.cwd(), ".archal.json");
+        const configPath = (0, import_node_path49.resolve)(process.cwd(), ".archal.json");
         const tmpPath = `${configPath}.tmp`;
         writeFileSync30(tmpPath, JSON.stringify(generatedConfig, null, 2) + "\n", "utf-8");
         renameSync7(tmpPath, configPath);
@@ -89715,7 +89770,7 @@ async function resolveRunCommandScenarios(scenarioArg, opts, command) {
     const { config: archalConfig, configDir } = archalFile;
     if (scenariosToRun.length === 0 && archalConfig.scenarios && archalConfig.scenarios.length > 0) {
       scenariosToRun.push(
-        ...archalConfig.scenarios.map((scenarioPath) => (0, import_node_path48.resolve)(configDir, scenarioPath))
+        ...archalConfig.scenarios.map((scenarioPath) => (0, import_node_path49.resolve)(configDir, scenarioPath))
       );
       if (archalConfig.scenarios.length === 1) {
         info(`Using scenario from .archal: ${archalConfig.scenarios[0]}`);
@@ -89744,7 +89799,7 @@ async function resolveRunCommandScenarios(scenarioArg, opts, command) {
       const seedOverrides = {};
       for (const [twinName, seedPath] of Object.entries(archalConfig.seeds)) {
         const resolvedSeedPath = resolveConfigOwnedFilePath(configDir, seedPath, "seed");
-        const seedExt = (0, import_node_path48.extname)(resolvedSeedPath).toLowerCase();
+        const seedExt = (0, import_node_path49.extname)(resolvedSeedPath).toLowerCase();
         if (seedExt === ".json" || seedExt === ".md") {
           fileSeedPaths[twinName] = resolvedSeedPath;
         } else {
@@ -89846,7 +89901,7 @@ function resolveStarterHarnessStubPath(agentConfig, cwd) {
     return null;
   }
   try {
-    const harnessPath = (0, import_node_path48.resolve)(agentConfig.cwd ?? cwd, harnessArg);
+    const harnessPath = (0, import_node_path49.resolve)(agentConfig.cwd ?? cwd, harnessArg);
     return isStarterHarnessStubFile(harnessPath) ? harnessPath : null;
   } catch {
     return null;
@@ -89858,7 +89913,7 @@ function resolveExplicitStarterHarnessStubPath(harnessPathInput, cwd) {
     return null;
   }
   try {
-    const harnessPath = (0, import_node_path48.resolve)(cwd, trimmed);
+    const harnessPath = (0, import_node_path49.resolve)(cwd, trimmed);
     return isStarterHarnessStubFile(harnessPath) ? harnessPath : null;
   } catch {
     return null;
@@ -91088,7 +91143,7 @@ ${CYAN}${BOLD}Archal CLI${RESET}  ${DIM}v${CLI_VERSION}${RESET}
 }
 
 // src/commands/scenario.ts
-var import_node_path49 = require("path");
+var import_node_path50 = require("path");
 var import_node_fs53 = require("fs");
 init_errors6();
 init_auth();
@@ -91159,7 +91214,7 @@ function toLocalScenarioRows(opts) {
       }
       rows.push({
         scenario: scenario.title,
-        slug: (0, import_node_path49.relative)(localDir, file2).replace(/\\/gu, "/").replace(/\.md$/u, "") || (0, import_node_path49.basename)(file2, ".md"),
+        slug: (0, import_node_path50.relative)(localDir, file2).replace(/\\/gu, "/").replace(/\.md$/u, "") || (0, import_node_path50.basename)(file2, ".md"),
         clones: scenario.config.twins,
         description: describeLocalScenario(
           scenario.prompt,
@@ -91251,7 +91306,7 @@ function parsePositiveCommandInt(value, label) {
   return parsed;
 }
 function readScenarioUpload(path2, titleOverride) {
-  const scenarioPath = (0, import_node_path49.resolve)(path2);
+  const scenarioPath = (0, import_node_path50.resolve)(path2);
   if (!(0, import_node_fs53.existsSync)(scenarioPath)) {
     throw new CliRuntimeError(`Scenario file not found: ${path2}`);
   }
@@ -91278,15 +91333,15 @@ function scenarioOutputName(scenario) {
   return `${candidate || "workspace-scenario"}.md`;
 }
 function writePulledScenario(scenario, opts) {
-  const destination = (0, import_node_path49.resolve)(
-    opts.output?.trim() || (0, import_node_path49.resolve)(DEFAULT_SCENARIOS_DIR, scenarioOutputName(scenario))
+  const destination = (0, import_node_path50.resolve)(
+    opts.output?.trim() || (0, import_node_path50.resolve)(DEFAULT_SCENARIOS_DIR, scenarioOutputName(scenario))
   );
   if ((0, import_node_fs53.existsSync)(destination) && !opts.force) {
     throw new CliRuntimeError(
-      `Scenario already exists: ${(0, import_node_path49.relative)(process.cwd(), destination) || destination}. Use --force to overwrite it.`
+      `Scenario already exists: ${(0, import_node_path50.relative)(process.cwd(), destination) || destination}. Use --force to overwrite it.`
     );
   }
-  (0, import_node_fs53.mkdirSync)((0, import_node_path49.dirname)(destination), { recursive: true });
+  (0, import_node_fs53.mkdirSync)((0, import_node_path50.dirname)(destination), { recursive: true });
   (0, import_node_fs53.writeFileSync)(destination, scenario.markdown, "utf8");
   return destination;
 }
@@ -91316,12 +91371,12 @@ function titleFromName(name) {
 }
 function resolveScenarioNewPath(name, outputPath) {
   if (outputPath?.trim()) {
-    return (0, import_node_path49.resolve)(outputPath.trim());
+    return (0, import_node_path50.resolve)(outputPath.trim());
   }
   const archalFile = loadArchalFile();
   const configured = archalFile?.config.scenarios?.find((entry) => entry.trim().length > 0);
-  const baseDir = archalFile && configured ? (0, import_node_path49.resolve)(archalFile.configDir, (0, import_node_path49.dirname)(configured)) : (0, import_node_path49.resolve)(process.cwd(), DEFAULT_SCENARIOS_DIR);
-  return (0, import_node_path49.resolve)(baseDir, `${slugifyScenarioName(name)}.md`);
+  const baseDir = archalFile && configured ? (0, import_node_path50.resolve)(archalFile.configDir, (0, import_node_path50.dirname)(configured)) : (0, import_node_path50.resolve)(process.cwd(), DEFAULT_SCENARIOS_DIR);
+  return (0, import_node_path50.resolve)(baseDir, `${slugifyScenarioName(name)}.md`);
 }
 function renderScenarioTemplate(name, clone2, seed) {
   const configLines = [
@@ -91354,10 +91409,10 @@ function createScenarioFile(name, opts) {
   const destination = resolveScenarioNewPath(name, opts.output);
   if ((0, import_node_fs53.existsSync)(destination) && !opts.force) {
     throw new CliRuntimeError(
-      `Scenario already exists: ${(0, import_node_path49.relative)(process.cwd(), destination) || destination}. Use --force to overwrite it.`
+      `Scenario already exists: ${(0, import_node_path50.relative)(process.cwd(), destination) || destination}. Use --force to overwrite it.`
     );
   }
-  (0, import_node_fs53.mkdirSync)((0, import_node_path49.dirname)(destination), { recursive: true });
+  (0, import_node_fs53.mkdirSync)((0, import_node_path50.dirname)(destination), { recursive: true });
   (0, import_node_fs53.writeFileSync)(destination, renderScenarioTemplate(name, opts.clone, opts.seed), "utf8");
   return destination;
 }
@@ -91421,7 +91476,7 @@ async function pullWorkspaceScenario(scenarioRef, opts) {
   const destination = writePulledScenario(scenario, opts);
   emitJsonOrInfo(
     { path: destination, scenario },
-    `Pulled ${scenario.title} to ${(0, import_node_path49.relative)(process.cwd(), destination) || destination}.`,
+    `Pulled ${scenario.title} to ${(0, import_node_path50.relative)(process.cwd(), destination) || destination}.`,
     opts.json
   );
   return destination;
@@ -91646,7 +91701,7 @@ function createScenarioCommand() {
   scenario.command("new").description("Create a runnable markdown scenario scaffold").argument("<name>", "Scenario name").option("--clone <name>", "Clone to include in ## Config (default 'github')").option("--seed <name>", "Named seed to include in ## Config").option("--output <path>", "Write to a specific markdown path").option("--force", "Overwrite an existing scenario file").action(
     (name, opts) => {
       const destination = createScenarioFile(name, opts);
-      const relativePath = (0, import_node_path49.relative)(process.cwd(), destination) || destination;
+      const relativePath = (0, import_node_path50.relative)(process.cwd(), destination) || destination;
       info(`Created ${relativePath}`);
       info(`Next: edit ${relativePath}, then run \`archal run ${relativePath}\`.`);
     }
@@ -92078,13 +92133,17 @@ function toPositiveInteger2(raw, label) {
   }
   return parsed;
 }
-function parseSeeds(raw) {
+function parseSeeds(raw, requestedClones = []) {
   if (!raw || raw.length === 0) {
     return {};
   }
   const seeds = {};
   for (const entry of raw) {
     const [twin, seedName, ...rest] = entry.split(":");
+    if (twin && !seedName && rest.length === 0 && requestedClones.length === 1) {
+      seeds[requestedClones[0]] = twin;
+      continue;
+    }
     if (!twin || !seedName || rest.length > 0) {
       throw new CliUsageError(`Invalid --seed value "${entry}". Use clone:seed-name.`);
     }
@@ -92461,7 +92520,6 @@ init_errors6();
 init_ansi();
 function registerResetSubcommand(parent) {
   parent.command("reset").argument("[clone]", "Clone to reset, or all session clones if omitted").option("--json", "Output result as JSON").description("Reset clone state to clean").action(async (clone2, opts) => {
-    const token = requireToken();
     const saved = loadSession();
     if (!saved) {
       if (opts.json) {
@@ -92472,15 +92530,17 @@ function registerResetSubcommand(parent) {
             2
           ) + "\n"
         );
+        process.exitCode = 1;
         return;
       }
       throw new CliRuntimeError("No active clone session.");
     }
+    const token = requireToken();
     const targets = clone2 ? [clone2] : saved.twins;
     const failures = [];
     const successes = [];
     for (const target of targets) {
-      const cloneUrl = saved.apiBaseUrls[target];
+      const cloneUrl = resolveTwinSeedTargetUrl(saved, target);
       if (!cloneUrl) {
         const msg = `no endpoint for '${target}'`;
         if (!opts.json) {
@@ -92495,7 +92555,7 @@ function registerResetSubcommand(parent) {
 `);
       }
       try {
-        const { status } = await twinWorkerCall("POST", `${twinBasePath(cloneUrl)}/state/reset`, void 0, token);
+        const { status } = await twinWorkerCall("POST", `${cloneUrl}/state/reset`, void 0, token);
         if (status < 400) {
           successes.push(target);
           if (!opts.json) {
@@ -92528,6 +92588,7 @@ function registerResetSubcommand(parent) {
             2
           ) + "\n"
         );
+        process.exitCode = 1;
       } else {
         process.stdout.write(
           JSON.stringify(
@@ -92747,7 +92808,6 @@ async function loadSeedDescription(session, clone2, description, token) {
 }
 function registerSeedSubcommand(parent) {
   parent.command("seed").argument("<clone>", "Clone to seed").argument("[seed-name]", "Named seed to apply").option("--file <path>", "Load a JSON seed file").option("--setup <description>", "Describe desired state in natural language and seed the clone from it").option("--json", "Output result as JSON").description("Load a seed into a running clone").action(async (clone2, seedName, opts) => {
-    const token = requireToken();
     const saved = loadSession();
     if (!saved) {
       if (opts.json) {
@@ -92758,10 +92818,12 @@ function registerSeedSubcommand(parent) {
             2
           ) + "\n"
         );
+        process.exitCode = 1;
         return;
       }
       throw new CliRuntimeError("No active clone session.");
     }
+    const token = requireToken();
     if (opts.file) {
       if (opts.json) {
         try {
@@ -92774,6 +92836,7 @@ function registerSeedSubcommand(parent) {
               2
             ) + "\n"
           );
+          process.exitCode = 1;
           return;
         }
         process.stdout.write(
@@ -92800,6 +92863,7 @@ function registerSeedSubcommand(parent) {
               2
             ) + "\n"
           );
+          process.exitCode = 1;
           return;
         }
         process.stdout.write(
@@ -92814,7 +92878,7 @@ function registerSeedSubcommand(parent) {
       }
       return;
     }
-    const cloneUrl = saved.apiBaseUrls[clone2];
+    const cloneUrl = resolveTwinSeedTargetUrl(saved, clone2);
     if (!cloneUrl) {
       if (opts.json) {
         process.stdout.write(
@@ -92824,6 +92888,7 @@ function registerSeedSubcommand(parent) {
             2
           ) + "\n"
         );
+        process.exitCode = 1;
         return;
       }
       throw new CliRuntimeError(`No endpoint found for clone '${clone2}'.`);
@@ -92845,6 +92910,7 @@ function registerSeedSubcommand(parent) {
             2
           ) + "\n"
         );
+        process.exitCode = 1;
         return;
       }
       throw new CliRuntimeError(`Seed load failed: HTTP ${status}${detail ? ` - ${detail}` : ""}`);
@@ -93413,7 +93479,7 @@ Run 'archal clone' to see available clones.`
             quiet
           );
         }
-        const seeds = parseSeeds(opts.seed);
+        const seeds = parseSeeds(opts.seed, requestedClones);
         const ttlSeconds = opts.ttlSeconds ? toPositiveInteger2(opts.ttlSeconds, "--ttl-seconds") : void 0;
         writeProgress(
           `${DIM}Starting ${requestedClones.join(", ")} clones...${RESET}
@@ -96123,20 +96189,20 @@ ${BOLD}Archal Doctor${RESET} ${DIM}session ${saved.sessionId}${RESET}
 // src/commands/init.ts
 var import_node_child_process10 = require("child_process");
 var import_node_fs60 = require("fs");
-var import_node_path54 = require("path");
+var import_node_path55 = require("path");
 
 // src/skills/installer.ts
 var import_node_fs58 = require("fs");
-var import_node_path52 = require("path");
+var import_node_path53 = require("path");
 var import_prompts3 = __toESM(require_prompts3(), 1);
 
 // src/skills/manifest.ts
 var import_node_crypto30 = require("crypto");
 var import_node_fs57 = require("fs");
-var import_node_path51 = require("path");
+var import_node_path52 = require("path");
 var MANIFEST_FILE2 = ".archal-manifest.json";
 function readManifest2(skillsPath) {
-  const path2 = (0, import_node_path51.join)(skillsPath, MANIFEST_FILE2);
+  const path2 = (0, import_node_path52.join)(skillsPath, MANIFEST_FILE2);
   if (!(0, import_node_fs57.existsSync)(path2)) return null;
   try {
     return JSON.parse((0, import_node_fs57.readFileSync)(path2, "utf8"));
@@ -96145,7 +96211,7 @@ function readManifest2(skillsPath) {
   }
 }
 function writeManifest(skillsPath, data2) {
-  const path2 = (0, import_node_path51.join)(skillsPath, MANIFEST_FILE2);
+  const path2 = (0, import_node_path52.join)(skillsPath, MANIFEST_FILE2);
   (0, import_node_fs57.writeFileSync)(path2, `${JSON.stringify(data2, null, 2)}
 `);
 }
@@ -96157,7 +96223,7 @@ function checksumDir(dir) {
   );
   for (const entry of entries) {
     if (entry.name === MANIFEST_FILE2) continue;
-    const p = (0, import_node_path51.join)(dir, entry.name);
+    const p = (0, import_node_path52.join)(dir, entry.name);
     const nameBytes = Buffer.from(entry.name, "utf8");
     if (entry.isDirectory()) {
       const sub = checksumDir(p) ?? "";
@@ -96258,7 +96324,7 @@ async function runInstaller({
   const skipped = [];
   const sourceDestNames = new Set(skillDirs.map((s) => `${ARCHAL_SKILL_PREFIX}${s}`));
   for (const target of selected) {
-    const platformDir = (0, import_node_path52.join)(cwd, target.skillsPath);
+    const platformDir = (0, import_node_path53.join)(cwd, target.skillsPath);
     (0, import_node_fs58.mkdirSync)(platformDir, { recursive: true });
     const manifest = readManifest2(platformDir);
     const nextManifest = {
@@ -96267,9 +96333,9 @@ async function runInstaller({
       skills: {}
     };
     for (const skill of skillDirs) {
-      const src = (0, import_node_path52.join)(skillsDir, skill);
+      const src = (0, import_node_path53.join)(skillsDir, skill);
       const destName = `${ARCHAL_SKILL_PREFIX}${skill}`;
-      const dest = (0, import_node_path52.join)(platformDir, destName);
+      const dest = (0, import_node_path53.join)(platformDir, destName);
       const sourceChecksum = checksumDir(src);
       const existingChecksum = checksumDir(dest);
       const manifestEntry = manifest?.skills?.[destName];
@@ -96329,7 +96395,7 @@ async function runInstaller({
         }
         const entry = rawEntry;
         if (sourceDestNames.has(destName)) continue;
-        const dest = (0, import_node_path52.join)(platformDir, destName);
+        const dest = (0, import_node_path53.join)(platformDir, destName);
         if (!(0, import_node_fs58.existsSync)(dest)) continue;
         const existingChecksum = checksumDir(dest);
         const userEdited = existingChecksum !== entry.checksum;
@@ -96404,7 +96470,7 @@ async function resolveTargets({
   if (requested && requested.length > 0) {
     return requested.map((id) => findTarget(id)).filter((t) => Boolean(t));
   }
-  const detected = TARGETS.filter((t) => (0, import_node_fs58.existsSync)((0, import_node_path52.join)(cwd, t.dir)));
+  const detected = TARGETS.filter((t) => (0, import_node_fs58.existsSync)((0, import_node_path53.join)(cwd, t.dir)));
   if (nonInteractive || !process.stdin.isTTY) {
     if (detected.length > 0) return [...detected];
     const claude = findTarget("claude");
@@ -96444,7 +96510,7 @@ ${BOLD}Install Archal skills${RESET} ${DIM}(v${version4})${RESET}
 
 // src/skills/vitest-wire.ts
 var import_node_fs59 = require("fs");
-var import_node_path53 = require("path");
+var import_node_path54 = require("path");
 function wireVitestConfig(cwd) {
   const detected = detectVitestPresence(cwd);
   if (!detected.hasVitest) {
@@ -96454,7 +96520,7 @@ function wireVitestConfig(cwd) {
   if (!configPath) {
     const usesTypeScript = projectUsesTypeScript(cwd);
     const targetName = usesTypeScript ? "vitest.config.ts" : "vitest.config.js";
-    const targetPath = (0, import_node_path53.join)(cwd, targetName);
+    const targetPath = (0, import_node_path54.join)(cwd, targetName);
     (0, import_node_fs59.writeFileSync)(targetPath, buildStarterConfig(usesTypeScript), { mode: 420 });
     return { kind: "created", path: targetPath };
   }
@@ -96472,7 +96538,7 @@ function wireVitestConfig(cwd) {
   return { kind: "skipped-unsafe", path: configPath, reason: wrapped.reason };
 }
 function detectVitestPresence(cwd) {
-  const pkgPath = (0, import_node_path53.join)(cwd, "package.json");
+  const pkgPath = (0, import_node_path54.join)(cwd, "package.json");
   if (!(0, import_node_fs59.existsSync)(pkgPath)) return { hasVitest: false };
   try {
     const pkg = JSON.parse((0, import_node_fs59.readFileSync)(pkgPath, "utf-8"));
@@ -96492,19 +96558,19 @@ var VITEST_CONFIG_NAMES = [
   "vitest.config.cjs"
 ];
 function inferVitestConfigModuleFormat(configPath) {
-  return (0, import_node_path53.basename)(configPath).endsWith(".cjs") ? "cjs" : "esm";
+  return (0, import_node_path54.basename)(configPath).endsWith(".cjs") ? "cjs" : "esm";
 }
 function findVitestConfig(cwd) {
   for (const name of VITEST_CONFIG_NAMES) {
-    const candidate = (0, import_node_path53.join)(cwd, name);
+    const candidate = (0, import_node_path54.join)(cwd, name);
     if ((0, import_node_fs59.existsSync)(candidate)) return candidate;
   }
   return null;
 }
 function projectUsesTypeScript(cwd) {
-  if ((0, import_node_fs59.existsSync)((0, import_node_path53.join)(cwd, "tsconfig.json"))) return true;
+  if ((0, import_node_fs59.existsSync)((0, import_node_path54.join)(cwd, "tsconfig.json"))) return true;
   try {
-    const pkg = JSON.parse((0, import_node_fs59.readFileSync)((0, import_node_path53.join)(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs59.readFileSync)((0, import_node_path54.join)(cwd, "package.json"), "utf-8"));
     return Boolean(
       pkg.dependencies?.["typescript"] || pkg.devDependencies?.["typescript"]
     );
@@ -96803,14 +96869,14 @@ init_errors6();
 function detectPackageManager2(cwd) {
   const fromPackageManager = readPackageManagerField(cwd);
   if (fromPackageManager) return fromPackageManager;
-  if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(cwd, "bun.lockb")) || (0, import_node_fs60.existsSync)((0, import_node_path54.join)(cwd, "bun.lock"))) return "bun";
-  if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(cwd, "yarn.lock"))) return "yarn";
+  if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(cwd, "bun.lockb")) || (0, import_node_fs60.existsSync)((0, import_node_path55.join)(cwd, "bun.lock"))) return "bun";
+  if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function readPackageManagerField(cwd) {
   try {
-    const pkg = JSON.parse((0, import_node_fs60.readFileSync)((0, import_node_path54.join)(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs60.readFileSync)((0, import_node_path55.join)(cwd, "package.json"), "utf8"));
     const raw = typeof pkg.packageManager === "string" ? pkg.packageManager : "";
     const name = raw.split("@")[0];
     if (name === "pnpm" || name === "yarn" || name === "bun" || name === "npm") {
@@ -96870,9 +96936,9 @@ const ARCHAL_INIT_STUB_HARNESS = true;
 //   - If your agent uses normal SDK URLs like https://api.github.com, run it
 //     with Archal sandbox/Docker routing so those calls are captured by the
 //     clone.
-//   - For an uncontainerized local harness, configure the SDK's base URL to
-//     the clone REST URL pattern shown by \`archal clone start <service>\` or
-//     \`archal clone status\`, and authenticate that request with ARCHAL_TOKEN.
+//   - For an uncontainerized local harness, read AGENT_CLONE_URLS for clone
+//     REST URLs and AGENT_ROUTE_HEADERS for the route auth headers to include
+//     on those clone requests.
 // See https://docs.archal.ai/guides/first-harness for the full guide.
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
@@ -96942,18 +97008,18 @@ function telemetryErrorType(error49) {
   return message.replace(/https?:\/\/\S+/g, "[url]").replace(/\/[\w./-]+/g, "[path]").slice(0, 120);
 }
 function hasPackageJson(cwd) {
-  return (0, import_node_fs60.existsSync)((0, import_node_path54.join)(cwd, "package.json"));
+  return (0, import_node_fs60.existsSync)((0, import_node_path55.join)(cwd, "package.json"));
 }
 function alreadyHasArchalDep(cwd) {
   try {
-    const pkg = JSON.parse((0, import_node_fs60.readFileSync)((0, import_node_path54.join)(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs60.readFileSync)((0, import_node_path55.join)(cwd, "package.json"), "utf8"));
     return Boolean(pkg.dependencies?.archal) || Boolean(pkg.devDependencies?.archal);
   } catch {
     return false;
   }
 }
 function writeStarterConfigIfMissing(cwd) {
-  const configPath = (0, import_node_path54.join)(cwd, ARCHAL_CONFIG_FILENAME);
+  const configPath = (0, import_node_path55.join)(cwd, ARCHAL_CONFIG_FILENAME);
   if ((0, import_node_fs60.existsSync)(configPath)) {
     process.stdout.write(`(${ARCHAL_CONFIG_FILENAME} already present, leaving it alone)
 `);
@@ -96963,8 +97029,8 @@ function writeStarterConfigIfMissing(cwd) {
   return "created";
 }
 function writeStarterHarnessIfMissing(cwd) {
-  const archalDir = (0, import_node_path54.join)(cwd, ARCHAL_DIR);
-  const harnessPath = (0, import_node_path54.join)(archalDir, HARNESS_FILENAME);
+  const archalDir = (0, import_node_path55.join)(cwd, ARCHAL_DIR);
+  const harnessPath = (0, import_node_path55.join)(archalDir, HARNESS_FILENAME);
   if ((0, import_node_fs60.existsSync)(harnessPath)) {
     process.stdout.write(
       `(${ARCHAL_DIR}/${HARNESS_FILENAME} already present, leaving it alone)
@@ -96977,8 +97043,8 @@ function writeStarterHarnessIfMissing(cwd) {
   return "created";
 }
 function writeStarterScenarioIfMissing(cwd) {
-  const scenariosDir = (0, import_node_path54.join)(cwd, SCENARIOS_DIR);
-  const scenarioPath = (0, import_node_path54.join)(scenariosDir, STARTER_SCENARIO_FILENAME);
+  const scenariosDir = (0, import_node_path55.join)(cwd, SCENARIOS_DIR);
+  const scenarioPath = (0, import_node_path55.join)(scenariosDir, STARTER_SCENARIO_FILENAME);
   if ((0, import_node_fs60.existsSync)(scenarioPath)) {
     process.stdout.write(
       `(${SCENARIOS_DIR}/${STARTER_SCENARIO_FILENAME} already present, leaving it alone)
@@ -96999,10 +97065,10 @@ function looksLikeSkillsDir(candidate) {
     return false;
   }
   for (const name of entries) {
-    const child = (0, import_node_path54.join)(candidate, name);
+    const child = (0, import_node_path55.join)(candidate, name);
     try {
       if (!(0, import_node_fs60.statSync)(child).isDirectory()) continue;
-      if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(child, "SKILL.md"))) return true;
+      if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(child, "SKILL.md"))) return true;
     } catch {
     }
   }
@@ -97011,8 +97077,8 @@ function looksLikeSkillsDir(candidate) {
 function findPnpmWorkspaceRoot(start) {
   let dir = start;
   for (let i = 0; i < 10; i++) {
-    if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(dir, "pnpm-workspace.yaml"))) return dir;
-    const parent = (0, import_node_path54.dirname)(dir);
+    if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(dir, "pnpm-workspace.yaml"))) return dir;
+    const parent = (0, import_node_path55.dirname)(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -97021,8 +97087,8 @@ function findPnpmWorkspaceRoot(start) {
 function findRepoRoot(start) {
   let dir = start;
   for (let i = 0; i < 10; i++) {
-    if ((0, import_node_fs60.existsSync)((0, import_node_path54.join)(dir, "pnpm-workspace.yaml"))) return dir;
-    const parent = (0, import_node_path54.dirname)(dir);
+    if ((0, import_node_fs60.existsSync)((0, import_node_path55.join)(dir, "pnpm-workspace.yaml"))) return dir;
+    const parent = (0, import_node_path55.dirname)(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -97032,10 +97098,10 @@ function resolveSkillsDir() {
   const here = typeof __dirname === "string" ? __dirname : process.cwd();
   const repoRoot = findRepoRoot(here) ?? findRepoRoot(process.cwd());
   const candidates = [
-    (0, import_node_path54.resolve)(here, "..", "skills"),
-    ...repoRoot ? [(0, import_node_path54.resolve)(repoRoot, "packages", "archal", "skills")] : [],
-    (0, import_node_path54.resolve)(process.cwd(), "packages", "archal", "skills"),
-    (0, import_node_path54.resolve)(process.cwd(), "skills")
+    (0, import_node_path55.resolve)(here, "..", "skills"),
+    ...repoRoot ? [(0, import_node_path55.resolve)(repoRoot, "packages", "archal", "skills")] : [],
+    (0, import_node_path55.resolve)(process.cwd(), "packages", "archal", "skills"),
+    (0, import_node_path55.resolve)(process.cwd(), "skills")
   ];
   for (const candidate of candidates) {
     if (looksLikeSkillsDir(candidate)) return candidate;
@@ -97299,7 +97365,7 @@ init_version();
 
 // src/utils/update-check.ts
 var import_node_fs62 = require("fs");
-var import_node_path55 = require("path");
+var import_node_path56 = require("path");
 init_config_loader();
 init_version();
 init_ansi();
@@ -97308,7 +97374,7 @@ var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 3e3;
 var MIN_PLAUSIBLE_CHECKED_AT_MS = 1e12;
 function getCachePath() {
-  return (0, import_node_path55.join)(ensureArchalDir(), UPDATE_CHECK_FILE);
+  return (0, import_node_path56.join)(ensureArchalDir(), UPDATE_CHECK_FILE);
 }
 function readCache() {
   try {
@@ -97401,7 +97467,7 @@ async function fetchLatestVersionWithDeadline() {
 
 // src/utils/skill-drift-check.ts
 var import_node_fs63 = require("fs");
-var import_node_path56 = require("path");
+var import_node_path57 = require("path");
 init_version();
 init_ansi();
 function readManifestAt(path2) {
@@ -97429,7 +97495,7 @@ function maybePrintSkillDriftBanner(cwd = process.cwd()) {
   try {
     const stale = [];
     for (const target of TARGETS) {
-      const manifestPath = (0, import_node_path56.join)(cwd, target.skillsPath, MANIFEST_FILE2);
+      const manifestPath = (0, import_node_path57.join)(cwd, target.skillsPath, MANIFEST_FILE2);
       if (!(0, import_node_fs63.existsSync)(manifestPath)) continue;
       const manifest = readManifestAt(manifestPath);
       if (!manifest?.version) continue;