autopilot-ai 2.1.0 → 2.2.0

package/dist/index.js

@@ -75,8 +75,8 @@ async function flushAndCloseForTesting() {
   const s = currentStream;
   currentStream = null;
   currentDate = null;
-  await new Promise((resolve21) => {
-    s.end(() => resolve21());
+  await new Promise((resolve22) => {
+    s.end(() => resolve22());
   });
 }
 function isLogSinkEnabled() {
@@ -1067,10 +1067,10 @@ async function tokenFromFile(file, fetchImpl2, now2) {
   return { token: t.access_token, expiresAt: now2 + (t.expires_in ?? 3600) * 1e3 };
 }
 function gcloudToken() {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     execFile("gcloud", ["auth", "print-access-token"], { timeout: 15e3 }, (err, stdout) => {
       if (err) reject(new Error("No Google credentials found. Run `gcloud auth application-default login`, or set GOOGLE_APPLICATION_CREDENTIALS."));
-      else resolve21(stdout.trim());
+      else resolve22(stdout.trim());
     });
   });
 }
@@ -2322,8 +2322,8 @@ function onShutdown(name, task, phase = SHUTDOWN_PHASE.sessions) {
 }
 function withDeadline(work, ms) {
   let timer2;
-  const deadline = new Promise((resolve21) => {
-    timer2 = setTimeout(() => resolve21("timeout"), Math.max(0, ms));
+  const deadline = new Promise((resolve22) => {
+    timer2 = setTimeout(() => resolve22("timeout"), Math.max(0, ms));
   });
   return Promise.race([work, deadline]).finally(() => clearTimeout(timer2));
 }
@@ -3782,8 +3782,8 @@ var init_copilot = __esm({
     COPILOT_API_VERSION = "2026-08-01";
     USER_API_VERSION = "2025-04-01";
     COPILOT_DEFAULT_BASE = "https://api.githubcopilot.com";
-    sleep = (ms, signal) => new Promise((resolve21, reject) => {
-      const t = setTimeout(resolve21, ms);
+    sleep = (ms, signal) => new Promise((resolve22, reject) => {
+      const t = setTimeout(resolve22, ms);
       signal?.addEventListener("abort", () => {
         clearTimeout(t);
         reject(new DOMException("aborted", "AbortError"));
@@ -3874,10 +3874,10 @@ async function startChatGPTSignIn(opts2) {
   const { verifier, challenge } = pkce();
   const state = randomBytes(32).toString("base64url");
   const nonce = randomBytes(32).toString("base64url");
-  let resolve21;
+  let resolve22;
   let reject;
   const done = new Promise((res, rej) => {
-    resolve21 = res;
+    resolve22 = res;
     reject = rej;
   });
   done.catch(() => void 0);
@@ -3900,7 +3900,7 @@ async function startChatGPTSignIn(opts2) {
     }
     if (!clientId) return finish("No client id returned"), reject(new Error("ChatGPT sign-in did not return a client id. Try again."));
     completeSignIn(code, clientId, redirect, verifier, nonce, opts2.fetchImpl).then(
-      (s) => (finish(), resolve21(s)),
+      (s) => (finish(), resolve22(s)),
       (e) => (finish(e.message), reject(e))
     );
   });
@@ -4608,8 +4608,8 @@ async function* runKimi(opts2) {
       if (isAbortError(fetchErr)) throw fetchErr;
       logger.warn("runKimi:fetch_error", { requestId, attempt, error: msg });
       if (attempt < MAX_ATTEMPTS - 1) {
-        const delay = Math.random() * (500 * 2 ** attempt);
-        await sleep2(delay, opts2.signal);
+        const delay2 = Math.random() * (500 * 2 ** attempt);
+        await sleep2(delay2, opts2.signal);
         continue;
       }
       const local = customEndpoint?.providerId && !preset.keyRequired;
@@ -4652,9 +4652,9 @@ Is ${preset.name} running at ${customEndpoint.baseUrl}? Start it, or set provide
         const isRateLimit = apiErr.httpStatus === 429;
         const baseDelay = isRateLimit ? 2e3 : 500;
         const retryAfterSec = Number(res.headers.get("retry-after"));
-        const delay = Number.isFinite(retryAfterSec) && retryAfterSec > 0 ? Math.min(retryAfterSec * 1e3, 3e4) : Math.random() * (baseDelay * 2 ** attempt);
-        logger.warn("runKimi:retrying", { requestId, attempt, code: apiErr.code, httpStatus: apiErr.httpStatus, delay });
-        await sleep2(delay, opts2.signal);
+        const delay2 = Number.isFinite(retryAfterSec) && retryAfterSec > 0 ? Math.min(retryAfterSec * 1e3, 3e4) : Math.random() * (baseDelay * 2 ** attempt);
+        logger.warn("runKimi:retrying", { requestId, attempt, code: apiErr.code, httpStatus: apiErr.httpStatus, delay: delay2 });
+        await sleep2(delay2, opts2.signal);
         continue;
       }
       throw apiErr;
@@ -5106,11 +5106,11 @@ function extractApiError(parsed, rawText) {
   return null;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     if (signal?.aborted) return reject(new DOMException("aborted", "AbortError"));
     const t = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve21();
+      resolve22();
     }, ms);
     const onAbort = () => {
       clearTimeout(t);
@@ -5260,7 +5260,7 @@ var init_worker_registry = __esm({
               delivered: false
             };
             if (done.background) this.finished.set(info.id, done);
-            for (const resolve21 of this.waiters.get(info.id) ?? []) resolve21(done);
+            for (const resolve22 of this.waiters.get(info.id) ?? []) resolve22(done);
             this.waiters.delete(info.id);
             for (const l of this.finishListeners) {
               try {
@@ -5292,14 +5292,14 @@ var init_worker_registry = __esm({
         if (!found) return Promise.reject(new Error(`No subagent ${ref}`));
         if (found.finished) return Promise.resolve(found.finished);
         const id = found.running.id;
-        return new Promise((resolve21, reject) => {
+        return new Promise((resolve22, reject) => {
           const onAbort = () => reject(new DOMException("aborted", "AbortError"));
           if (signal?.aborted) return onAbort();
           signal?.addEventListener("abort", onAbort, { once: true });
           const list = this.waiters.get(id) ?? [];
           list.push((w) => {
             signal?.removeEventListener("abort", onAbort);
-            resolve21(w);
+            resolve22(w);
           });
           this.waiters.set(id, list);
         });
@@ -5547,7 +5547,7 @@ async function pruneFiles(files, maxAgeDays, maxCount) {
   return removed;
 }
 async function rotateJsonl(path, maxBytes, rotations) {
-  const { rename: rename4 } = await import("fs/promises");
+  const { rename: rename5 } = await import("fs/promises");
   let s;
   try {
     s = await stat(path);
@@ -5559,7 +5559,7 @@ async function rotateJsonl(path, maxBytes, rotations) {
     const src = i === 1 ? path : `${path}.${i - 1}`;
     const dst = `${path}.${i}`;
     try {
-      await rename4(src, dst);
+      await rename5(src, dst);
     } catch {
     }
   }
@@ -6610,7 +6610,7 @@ function truncateForEmbedding(text3) {
   return text3.slice(0, MAX_EMBED_CHARS);
 }
 async function sleep3(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 async function fetchWithRetry(url, init, retries = 3) {
   let lastError;
@@ -6619,8 +6619,8 @@ async function fetchWithRetry(url, init, retries = 3) {
       const res = await fetch(url, init);
       if (res.ok) return res;
       if (res.status === 429 || res.status >= 500) {
-        const delay = 1e3 * 2 ** i;
-        await sleep3(delay);
+        const delay2 = 1e3 * 2 ** i;
+        await sleep3(delay2);
         continue;
       }
       const errText = await res.text().catch(() => "unknown error");
@@ -8050,15 +8050,15 @@ async function gitNumstat(cwd, opts2 = {}) {
   if (opts2.includeUntracked) {
     try {
       const { stdout } = await execFileAsync("git", ["ls-files", "--others", "--exclude-standard"], { cwd, timeout: 5e3 });
-      const { readFile: readFile40, stat: stat14 } = await import("fs/promises");
-      const { join: join62 } = await import("path");
+      const { readFile: readFile42, stat: stat15 } = await import("fs/promises");
+      const { join: join64 } = await import("path");
       for (const file of stdout.split("\n").filter(Boolean)) {
         let lines = 0;
         try {
-          const path = join62(cwd, file);
-          const size = (await stat14(path)).size;
+          const path = join64(cwd, file);
+          const size = (await stat15(path)).size;
           if (size > 0 && size <= 1024 * 1024) {
-            const text3 = await readFile40(path, "utf8");
+            const text3 = await readFile42(path, "utf8");
             lines = text3.split("\n").length - (text3.endsWith("\n") ? 1 : 0);
           }
         } catch {
@@ -8177,6 +8177,146 @@ var init_git_delta = __esm({
   }
 });
 
+// src/util/line-diff.ts
+function splitLines(text3) {
+  if (text3 === "") return [];
+  const lines = text3.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  return lines;
+}
+function myers(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const max = n + m;
+  if (max === 0) return [];
+  const offset = max;
+  let v = new Int32Array(2 * max + 2);
+  const trace = [];
+  for (let d = 0; d <= max; d++) {
+    if ((n + m) * d > MAX_MYERS_COST) return null;
+    trace.push(v.slice());
+    const next = v;
+    for (let k = -d; k <= d; k += 2) {
+      let x;
+      if (k === -d || k !== d && next[offset + k - 1] < next[offset + k + 1]) x = next[offset + k + 1];
+      else x = next[offset + k - 1] + 1;
+      let y = x - k;
+      while (x < n && y < m && a[x] === b[y]) {
+        x++;
+        y++;
+      }
+      next[offset + k] = x;
+      if (x >= n && y >= m) {
+        trace.push(next.slice());
+        return backtrack(trace, a, b, offset);
+      }
+    }
+    v = next;
+  }
+  return null;
+}
+function backtrack(trace, a, b, offset) {
+  const ops = [];
+  let x = a.length;
+  let y = b.length;
+  for (let d = trace.length - 2; d >= 0; d--) {
+    const v = trace[d];
+    const k = x - y;
+    let prevK;
+    if (k === -d || k !== d && v[offset + k - 1] < v[offset + k + 1]) prevK = k + 1;
+    else prevK = k - 1;
+    const prevX = d === 0 ? 0 : v[offset + prevK];
+    const prevY = prevX - prevK;
+    while (x > prevX && y > prevY) {
+      ops.push({ kind: " ", text: a[x - 1] });
+      x--;
+      y--;
+    }
+    if (d === 0) break;
+    if (x === prevX) ops.push({ kind: "+", text: b[y - 1] });
+    else ops.push({ kind: "-", text: a[x - 1] });
+    x = prevX;
+    y = prevY;
+  }
+  while (x > 0 && y > 0) {
+    ops.push({ kind: " ", text: a[x - 1] });
+    x--;
+    y--;
+  }
+  return ops.reverse();
+}
+function editScript(a, b) {
+  let pre = 0;
+  while (pre < a.length && pre < b.length && a[pre] === b[pre]) pre++;
+  let suf = 0;
+  while (suf < a.length - pre && suf < b.length - pre && a[a.length - 1 - suf] === b[b.length - 1 - suf]) suf++;
+  const midA = a.slice(pre, a.length - suf);
+  const midB = b.slice(pre, b.length - suf);
+  const mid = myers(midA, midB) ?? [
+    ...midA.map((text3) => ({ kind: "-", text: text3 })),
+    ...midB.map((text3) => ({ kind: "+", text: text3 }))
+  ];
+  return [
+    ...a.slice(0, pre).map((text3) => ({ kind: " ", text: text3 })),
+    ...mid,
+    ...a.slice(a.length - suf).map((text3) => ({ kind: " ", text: text3 }))
+  ];
+}
+function structuredPatch(oldText, newText, context = DEFAULT_CONTEXT) {
+  const ops = editScript(splitLines(oldText), splitLines(newText));
+  const hunks = [];
+  let oldNo = 1;
+  let newNo = 1;
+  const pos = ops.map((op) => {
+    const at = { old: oldNo, new: newNo };
+    if (op.kind !== "+") oldNo++;
+    if (op.kind !== "-") newNo++;
+    return at;
+  });
+  let i = 0;
+  while (i < ops.length) {
+    if (ops[i].kind === " ") {
+      i++;
+      continue;
+    }
+    const start = Math.max(0, i - context);
+    let end = i;
+    for (; ; ) {
+      while (end < ops.length && ops[end].kind !== " ") end++;
+      let gap = end;
+      while (gap < ops.length && ops[gap].kind === " ") gap++;
+      if (gap < ops.length && gap - end <= 2 * context) {
+        end = gap;
+        continue;
+      }
+      end = Math.min(ops.length, end + context);
+      break;
+    }
+    const slice = ops.slice(start, end);
+    const oldLines = slice.filter((o) => o.kind !== "+").length;
+    const newLines = slice.filter((o) => o.kind !== "-").length;
+    const first = pos[start];
+    hunks.push({
+      // jsdiff's convention: a hunk with no old (or new) lines starts one line earlier.
+      oldStart: oldLines === 0 ? first.old - 1 : first.old,
+      oldLines,
+      newStart: newLines === 0 ? first.new - 1 : first.new,
+      newLines,
+      lines: slice.map((o) => o.kind + o.text)
+    });
+    i = end;
+  }
+  return hunks;
+}
+var DEFAULT_CONTEXT, MAX_MYERS_COST;
+var init_line_diff = __esm({
+  "src/util/line-diff.ts"() {
+    "use strict";
+    DEFAULT_CONTEXT = 3;
+    MAX_MYERS_COST = 4e6;
+  }
+});
+
 // src/hooks/claude-compat.ts
 function claudeToolName(tool, args) {
   if (tool === "edit" && Array.isArray(args.edits)) return "MultiEdit";
@@ -8261,9 +8401,35 @@ function claudeToolResponse(tool, args, cwd, result2) {
   }
   if ((tool === "write" || tool === "edit") && isStr(args.path) && !failed) {
     response.filePath = resolvePath(cwd, args.path);
+    if (result2.fileChange) Object.assign(response, claudeFileChangeFields(tool, args, result2.fileChange));
   }
   return response;
 }
+function claudeFileChangeFields(tool, args, change) {
+  const fields = {};
+  if (tool === "write") {
+    fields.type = change.existed ? "update" : "create";
+    if (isStr(args.content)) fields.content = args.content;
+  } else if (Array.isArray(args.edits)) {
+    fields.edits = editPairs(args);
+  } else {
+    fields.oldString = args.old_string;
+    fields.newString = args.new_string;
+    fields.replaceAll = args.replace_all === true;
+  }
+  if (!change.existed) {
+    fields.originalFile = null;
+    fields.structuredPatch = [];
+  } else {
+    if (change.original !== null && Buffer.byteLength(change.original, "utf8") <= ORIGINAL_FILE_CAP_BYTES) {
+      fields.originalFile = change.original;
+    }
+    if (change.original !== null && change.updated !== null) {
+      fields.structuredPatch = structuredPatch(change.original, change.updated);
+    }
+  }
+  return fields;
+}
 function claudeError(result2) {
   if (isNum(result2.exitCode) && result2.exitCode !== 0) {
     const output = [result2.stdout, result2.stderr].filter((s) => s && s.trim()).map((s) => s.trimEnd()).join("\n");
@@ -8296,12 +8462,13 @@ function claudeToolFields(payload) {
   }
   return { tool_name: toolName, ...fields };
 }
-var CLAUDE_TOOL_NAMES, FILE_EDIT_NAMES, isStr, isNum;
+var CLAUDE_TOOL_NAMES, FILE_EDIT_NAMES, isStr, isNum, ORIGINAL_FILE_CAP_BYTES;
 var init_claude_compat = __esm({
   "src/hooks/claude-compat.ts"() {
     "use strict";
     init_edit();
     init_paths();
+    init_line_diff();
     CLAUDE_TOOL_NAMES = {
       bash: "Bash",
       edit: "Edit",
@@ -8316,6 +8483,7 @@ var init_claude_compat = __esm({
     FILE_EDIT_NAMES = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit"]);
     isStr = (v) => typeof v === "string";
     isNum = (v) => typeof v === "number";
+    ORIGINAL_FILE_CAP_BYTES = 256 * 1024;
   }
 });
 
@@ -10125,8 +10293,8 @@ function applyConfirmedCost(log2, session, turn, snapshot) {
   session.gatewayLogs = logs.slice(-100);
 }
 async function reconcileTurnCost(sessionId, turnId, lookup, fetchImpl2 = fetch, delaysMs = RECONCILE_DELAYS_MS) {
-  for (const delay of delaysMs) {
-    await new Promise((r) => setTimeout(r, delay));
+  for (const delay2 of delaysMs) {
+    await new Promise((r) => setTimeout(r, delay2));
     let snapshot;
     try {
       snapshot = await fetchGenerationSnapshot(lookup, fetchImpl2);
@@ -10606,15 +10774,15 @@ function makeErrorOutput(message2) {
   return { content: message2, rawBytes: bytes, reducedBytes: bytes };
 }
 async function execOnce(command, cwd) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const child = spawn("bash", ["-lc", command], { cwd });
     let out = "";
     child.stdout.on("data", (d) => {
       out += d.toString("utf8");
     });
     child.on("close", (code) => {
-      if (code !== 0) return resolve21(void 0);
-      resolve21(out.trim() || void 0);
+      if (code !== 0) return resolve22(void 0);
+      resolve22(out.trim() || void 0);
     });
   });
 }
@@ -10768,7 +10936,7 @@ async function runBash(args, ctx) {
   if (pushGuard) return pushGuard;
   const { shell, args: shellArgs, isPosix } = getShellCommand(ctx.shell);
   const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
     const child = spawn(shell, [...shellArgs, command], {
       cwd: ctx.cwd,
@@ -10833,7 +11001,7 @@ ${stderr}`
         if (hint) parts.push(hint);
       }
       const raw = parts.join("\n");
-      resolve21({
+      resolve22({
         content: raw,
         rawBytes: Buffer.byteLength(raw, "utf8"),
         reducedBytes: Buffer.byteLength(raw, "utf8"),
@@ -12231,7 +12399,7 @@ import { tmpdir as tmpdir2 } from "os";
 import { join as join22, dirname as dirname9 } from "path";
 async function autoScroll(page) {
   await page.evaluate(async () => {
-    await new Promise((resolve21) => {
+    await new Promise((resolve22) => {
       let totalHeight = 0;
       const distance = 300;
       const timer2 = setInterval(() => {
@@ -12240,12 +12408,12 @@ async function autoScroll(page) {
         totalHeight += distance;
         if (totalHeight >= scrollHeight) {
           clearInterval(timer2);
-          resolve21();
+          resolve22();
         }
       }, 100);
       setTimeout(() => {
         clearInterval(timer2);
-        resolve21();
+        resolve22();
       }, 1e4);
     });
   });
@@ -14494,8 +14662,8 @@ function waitForProcessStartTime(pid, jobId, exitPath) {
 function readProcessStartTime(pid) {
   if (process.platform === "linux") {
     try {
-      const stat14 = readFileSync6(`/proc/${pid}/stat`, "utf8");
-      const fieldsAfterCommand = stat14.slice(stat14.lastIndexOf(")") + 1).trim().split(/\s+/);
+      const stat15 = readFileSync6(`/proc/${pid}/stat`, "utf8");
+      const fieldsAfterCommand = stat15.slice(stat15.lastIndexOf(")") + 1).trim().split(/\s+/);
       return fieldsAfterCommand[19] ? `linux:${fieldsAfterCommand[19]}` : null;
     } catch {
       return null;
@@ -15501,8 +15669,8 @@ var init_store = __esm({
           if (timer2.attempts >= timer2.maxAttempts) {
             this.db.prepare("UPDATE run_timers SET status = 'failed', lease_until = NULL, last_error = ? WHERE id = ?").run(error.slice(0, 1e3), id);
           } else {
-            const delay = Math.min(MAX_RETRY_MS, DEFAULT_RETRY_MS * 2 ** Math.max(0, timer2.attempts - 1));
-            this.db.prepare("UPDATE run_timers SET status = 'scheduled', wake_at = ?, lease_until = NULL, last_error = ? WHERE id = ?").run(now2 + delay, error.slice(0, 1e3), id);
+            const delay2 = Math.min(MAX_RETRY_MS, DEFAULT_RETRY_MS * 2 ** Math.max(0, timer2.attempts - 1));
+            this.db.prepare("UPDATE run_timers SET status = 'scheduled', wake_at = ?, lease_until = NULL, last_error = ? WHERE id = ?").run(now2 + delay2, error.slice(0, 1e3), id);
           }
         });
       }
@@ -15675,7 +15843,7 @@ var init_wait_for = __esm({
 });
 
 // src/tools/executor.ts
-import { realpath as realpath4 } from "fs/promises";
+import { readFile as readFile17, realpath as realpath4, stat as stat7 } from "fs/promises";
 import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5, sep as sep3 } from "path";
 function getWorkerTools(profile) {
   return profile === "research" ? ALL_TOOLS.filter((tool) => RESEARCH_WORKER_TOOL_NAMES.has(tool.name) && tool.isReadOnly === true).map(restrictResearchTool) : ALL_TOOLS;
@@ -15744,6 +15912,16 @@ function toPermissionResult(d) {
   }
   return d;
 }
+async function snapshotForHook(abs) {
+  try {
+    const st = await stat7(abs);
+    if (!st.isFile()) return { existed: true, content: null };
+    if (st.size > HOOK_FILE_SNAPSHOT_MAX_BYTES) return { existed: true, content: null };
+    return { existed: true, content: await readFile17(abs, "utf8") };
+  } catch {
+    return { existed: false, content: null };
+  }
+}
 function shellResultForHook(meta) {
   if (!meta || meta.exitCode === void 0) return {};
   return {
@@ -15762,6 +15940,15 @@ function capContentForHook(s) {
   return `${cut}
 [\u2026truncated for hook payload]`;
 }
+async function fileChangeAfter(tool, args, cwd, before) {
+  let updated = null;
+  if (tool === "write" && typeof args.content === "string") {
+    updated = Buffer.byteLength(args.content, "utf8") <= HOOK_FILE_SNAPSHOT_MAX_BYTES ? args.content : null;
+  } else {
+    updated = (await snapshotForHook(resolvePath(cwd, args.path))).content;
+  }
+  return { existed: before.existed, original: before.content, updated };
+}
 function tracePermissionDecision(result2) {
   if (result2.decision === "deny") return "deny";
   if (result2.scope === "session") return "allow_session";
@@ -15785,7 +15972,7 @@ function normalizeToolOutput(result2) {
   }
   return result2;
 }
-var ALL_TOOLS, RESEARCH_WORKER_TOOL_NAMES, SENSITIVE_RESEARCH_PATHS, HOOK_RESULT_CONTENT_CAP_BYTES, ToolExecutor, TRACE_ARGS_INLINE_MAX, ToolTrace;
+var ALL_TOOLS, RESEARCH_WORKER_TOOL_NAMES, SENSITIVE_RESEARCH_PATHS, HOOK_RESULT_CONTENT_CAP_BYTES, HOOK_FILE_SNAPSHOT_MAX_BYTES, ToolExecutor, TRACE_ARGS_INLINE_MAX, ToolTrace;
 var init_executor = __esm({
   "src/tools/executor.ts"() {
     "use strict";
@@ -15815,6 +16002,7 @@ var init_executor = __esm({
     init_jobs();
     init_wait_for();
     init_workers();
+    init_paths();
     init_store();
     ALL_TOOLS = [
       { ...readTool, isReadOnly: true },
@@ -15869,6 +16057,7 @@ var init_executor = __esm({
       ".git-credentials"
     ]);
     HOOK_RESULT_CONTENT_CAP_BYTES = 4 * 1024;
+    HOOK_FILE_SNAPSHOT_MAX_BYTES = 1024 * 1024;
     ToolExecutor = class {
       sessionAllowed = /* @__PURE__ */ new Set();
       tools;
@@ -16046,8 +16235,10 @@ var init_executor = __esm({
             runStore.recordToolIntent(ctx.runId, call.id, call.name, args);
             intentRecorded = true;
           }
+          const before = this.wantsFileChange(call.name, args) ? await snapshotForHook(resolvePath(ctx.cwd, args.path)) : void 0;
           const result2 = await tool.run(args, ctx);
           toolCompleted = true;
+          const fileChange = before ? await fileChangeAfter(call.name, args, ctx.cwd, before) : void 0;
           const normalized = normalizeToolOutput(result2);
           tr?.raw(normalized);
           if (runStore && ctx.runId) {
@@ -16099,7 +16290,7 @@ var init_executor = __esm({
             artifactId: reduced.artifactId,
             ...normalized.waitRequest ? { waitRequest: normalized.waitRequest } : {}
           };
-          this.firePostToolUse(call, args, success, ctx, normalized.meta);
+          this.firePostToolUse(call, args, success, ctx, normalized.meta, fileChange);
           return success;
         } catch (e) {
           if (e instanceof RunToolBudgetExceededError) ctx.onRunBudgetExceeded?.(e.reason);
@@ -16170,7 +16361,7 @@ var init_executor = __esm({
        * `content` field is capped via `capContentForHook` to keep large tool
        * outputs from blowing the OS env-var limits on `KIMIFLARE_HOOK_PAYLOAD`.
        */
-      firePostToolUse(call, args, result2, ctx, meta) {
+      firePostToolUse(call, args, result2, ctx, meta, fileChange) {
         const hooks = this.hooks;
         if (!hooks) return;
         const post = hooks.hasEnabledHooks("PostToolUse");
@@ -16180,7 +16371,8 @@ var init_executor = __esm({
           ok: result2.ok,
           content: capContentForHook(result2.content),
           errorCode: result2.errorCode,
-          ...shellResultForHook(meta)
+          ...shellResultForHook(meta),
+          ...fileChange ? { fileChange } : {}
         };
         const base = {
           session_id: ctx.sessionId ?? null,
@@ -16198,6 +16390,11 @@ var init_executor = __esm({
           void hooks.fire("PostToolUseFailure", { event: "PostToolUseFailure", ...base, error: claudeError(resultFields) }, call.name, ctx.signal).catch(swallow2);
         }
       }
+      /** True when a PostToolUse hook would get this write / edit call's diff. */
+      wantsFileChange(tool, args) {
+        if (tool !== "write" && tool !== "edit" || typeof args.path !== "string" || !args.path) return false;
+        return !!this.hooks && (this.hooks.hasEnabledHooks("PostToolUse") || this.hooks.hasEnabledHooks("PostToolUseFailure"));
+      }
       permissionKey(tool, args) {
         if (tool.name === "bash" && typeof args.command === "string") {
           const firstToken = args.command.trim().split(/\s+/)[0] ?? "";
@@ -16324,8 +16521,106 @@ var init_executor = __esm({
   }
 });
 
+// src/intent/classify.ts
+function classifyIntent(prompt) {
+  let intentScore = 0;
+  let matchedIntent = "other";
+  for (const [intent, pattern] of Object.entries(INTENT_PATTERNS)) {
+    const matches = (prompt.match(pattern) || []).length;
+    if (matches > intentScore) {
+      intentScore = matches;
+      matchedIntent = intent;
+    }
+  }
+  const hasFileMentions = (prompt.match(/@\w+|\b[\w/-]+\.(ts|tsx|js|jsx|py|go|rs)\b/g) || []).length;
+  const hasMutatingVerb = /\b(add|create|write|edit|delete|remove|rename|migrate|implement)\b/i.test(prompt);
+  const isQuestion = prompt.trim().endsWith("?") || /\b(what|how|why|is|does|can)\b/i.test(prompt.split(" ")[0] || "");
+  const hasHeavySignal = HEAVY_SIGNAL.test(prompt);
+  const rawScore = Math.min(
+    1,
+    intentScore * 0.25 + (hasFileMentions > 2 ? 0.3 : hasFileMentions * 0.1) + (hasMutatingVerb ? 0.25 : 0) + (isQuestion ? 0 : 0.1) + (hasHeavySignal ? 0.6 : 0)
+  );
+  const tier = rawScore < 0.3 ? "light" : rawScore < 0.65 ? "medium" : "heavy";
+  return {
+    intent: hasHeavySignal && matchedIntent === "other" ? "explore" : matchedIntent,
+    rawScore,
+    tier,
+    confidence: 0.5 + (intentScore > 0 || hasHeavySignal ? 0.3 : 0) + (hasFileMentions > 0 ? 0.1 : 0)
+  };
+}
+var INTENT_PATTERNS, HEAVY_SIGNAL;
+var init_classify = __esm({
+  "src/intent/classify.ts"() {
+    "use strict";
+    INTENT_PATTERNS = {
+      qa: /\b(what|how|why|explain|describe|what's|what is)\b/i,
+      diagnose: /\b(broken|failing|error|bug|crash|why.*fail|not working)\b/i,
+      verify: /\b(correct|right|verify|review|check|is this|does this)\b/i,
+      polish: /\b(rename|refactor|extract|move|clean|lint|format)\b/i,
+      small_edit: /\b(add|change|update|fix|remove|delete)\b.+\b(line|here|this|variable|function)\b/i,
+      feature_bounded: /\b(add|implement|create|support)\b.+\b(flag|option|param|arg|field)\b/i,
+      feature_exploratory: /\b(add|implement|migrate|integrate|build)\b.+\b(module|system|auth|oauth|framework|service)\b/i,
+      explore: /\b(how.*work|architecture|structure|where.*used|find.*all|understand)\b/i,
+      meta: /\b(plan|design|strategy|ontology|roadmap|approach)\b/i
+    };
+    HEAVY_SIGNAL = /\b(research|investigat\w*|audit|deep[\s-]?(dive|thinking)|explorat\w*|comprehensive|end[\s-]?to[\s-]?end|entire\s+(code\s?base|repo\w*|project|app)|whole\s+(code\s?base|repo\w*|project|app)|across\s+the\s+(code\s?base|repo\w*|project)|security|vulnerab\w*|loophole|exploit\w*|threat\s?model|attack\s+surface|penetration)\b/i;
+  }
+});
+
+// src/hooks/prompt-submit.ts
+async function submitUserPrompt(info) {
+  let provider;
+  try {
+    provider = info.auth ? providerPresetOf(info.auth).id : void 0;
+  } catch {
+    provider = void 0;
+  }
+  await noteSessionStart({
+    ...info.hooks ? { hooks: info.hooks } : {},
+    sessionId: info.sessionId,
+    cwd: info.cwd,
+    resumed: info.resumed,
+    model: info.model,
+    ...provider ? { provider } : {}
+  });
+  if (!info.hooks?.hasEnabledHooks("UserPromptSubmit")) return { blocked: false };
+  const outcome = await info.hooks.fire(
+    "UserPromptSubmit",
+    {
+      event: "UserPromptSubmit",
+      session_id: info.sessionId,
+      cwd: info.cwd,
+      prompt: info.prompt,
+      tier: info.tier ?? classifyIntent(info.prompt).tier
+    },
+    null
+  );
+  if (!outcome.vetoed) return { blocked: false };
+  return { blocked: true, reason: outcome.vetoReason || PROMPT_BLOCKED_DEFAULT_REASON };
+}
+var PROMPT_BLOCKED_EXIT_CODE, PROMPT_BLOCKED_DEFAULT_REASON, PromptBlockedError;
+var init_prompt_submit = __esm({
+  "src/hooks/prompt-submit.ts"() {
+    "use strict";
+    init_session_lifecycle();
+    init_classify();
+    init_llm_auth();
+    PROMPT_BLOCKED_EXIT_CODE = 44;
+    PROMPT_BLOCKED_DEFAULT_REASON = "UserPromptSubmit hook blocked the prompt";
+    PromptBlockedError = class extends Error {
+      reason;
+      code = "prompt_blocked";
+      constructor(reason) {
+        super(`prompt blocked by a UserPromptSubmit hook: ${reason}`);
+        this.name = "PromptBlockedError";
+        this.reason = reason;
+      }
+    };
+  }
+});
+
 // src/util/image.ts
-import { readFile as readFile17 } from "fs/promises";
+import { readFile as readFile18 } from "fs/promises";
 import { basename as basename3 } from "path";
 import jpeg from "jpeg-js";
 import { PNG } from "pngjs";
@@ -16404,7 +16699,7 @@ function imageNote(path, change) {
   return `[Attached image ${basename3(path)} was downscaled to ${change.width}\xD7${change.height} for upload; the full-resolution original is at ${path}]`;
 }
 async function encodeImageFile(filePath, opts2 = {}) {
-  const buf = await readFile17(filePath);
+  const buf = await readFile18(filePath);
   if (buf.byteLength > MAX_IMAGE_BYTES) {
     throw new Error(
       `image too large (${(buf.byteLength / 1024 / 1024).toFixed(1)} MB); max is ${MAX_IMAGE_BYTES / 1024 / 1024} MB`
@@ -16448,7 +16743,7 @@ var init_image = __esm({
 });
 
 // src/util/attachments.ts
-import { readFile as readFile18 } from "fs/promises";
+import { readFile as readFile19 } from "fs/promises";
 import { basename as basename4 } from "path";
 async function buildAttachmentMessage(prompt, files, cwd, imageOptions2 = {}) {
   let text3 = prompt;
@@ -16471,7 +16766,7 @@ async function buildAttachmentMessage(prompt, files, cwd, imageOptions2 = {}) {
       }
     } else {
       try {
-        const content = await readFile18(filePath, "utf8");
+        const content = await readFile19(filePath, "utf8");
         const relPath = filePath.startsWith(cwd) ? filePath.slice(cwd.length + 1) : filePath;
         fileContents.push(`
 --- ${relPath} ---
@@ -16571,52 +16866,6 @@ var init_permissions_evaluator = __esm({
   }
 });
 
-// src/intent/classify.ts
-function classifyIntent(prompt) {
-  let intentScore = 0;
-  let matchedIntent = "other";
-  for (const [intent, pattern] of Object.entries(INTENT_PATTERNS)) {
-    const matches = (prompt.match(pattern) || []).length;
-    if (matches > intentScore) {
-      intentScore = matches;
-      matchedIntent = intent;
-    }
-  }
-  const hasFileMentions = (prompt.match(/@\w+|\b[\w/-]+\.(ts|tsx|js|jsx|py|go|rs)\b/g) || []).length;
-  const hasMutatingVerb = /\b(add|create|write|edit|delete|remove|rename|migrate|implement)\b/i.test(prompt);
-  const isQuestion = prompt.trim().endsWith("?") || /\b(what|how|why|is|does|can)\b/i.test(prompt.split(" ")[0] || "");
-  const hasHeavySignal = HEAVY_SIGNAL.test(prompt);
-  const rawScore = Math.min(
-    1,
-    intentScore * 0.25 + (hasFileMentions > 2 ? 0.3 : hasFileMentions * 0.1) + (hasMutatingVerb ? 0.25 : 0) + (isQuestion ? 0 : 0.1) + (hasHeavySignal ? 0.6 : 0)
-  );
-  const tier = rawScore < 0.3 ? "light" : rawScore < 0.65 ? "medium" : "heavy";
-  return {
-    intent: hasHeavySignal && matchedIntent === "other" ? "explore" : matchedIntent,
-    rawScore,
-    tier,
-    confidence: 0.5 + (intentScore > 0 || hasHeavySignal ? 0.3 : 0) + (hasFileMentions > 0 ? 0.1 : 0)
-  };
-}
-var INTENT_PATTERNS, HEAVY_SIGNAL;
-var init_classify = __esm({
-  "src/intent/classify.ts"() {
-    "use strict";
-    INTENT_PATTERNS = {
-      qa: /\b(what|how|why|explain|describe|what's|what is)\b/i,
-      diagnose: /\b(broken|failing|error|bug|crash|why.*fail|not working)\b/i,
-      verify: /\b(correct|right|verify|review|check|is this|does this)\b/i,
-      polish: /\b(rename|refactor|extract|move|clean|lint|format)\b/i,
-      small_edit: /\b(add|change|update|fix|remove|delete)\b.+\b(line|here|this|variable|function)\b/i,
-      feature_bounded: /\b(add|implement|create|support)\b.+\b(flag|option|param|arg|field)\b/i,
-      feature_exploratory: /\b(add|implement|migrate|integrate|build)\b.+\b(module|system|auth|oauth|framework|service)\b/i,
-      explore: /\b(how.*work|architecture|structure|where.*used|find.*all|understand)\b/i,
-      meta: /\b(plan|design|strategy|ontology|roadmap|approach)\b/i
-    };
-    HEAVY_SIGNAL = /\b(research|investigat\w*|audit|deep[\s-]?(dive|thinking)|explorat\w*|comprehensive|end[\s-]?to[\s-]?end|entire\s+(code\s?base|repo\w*|project|app)|whole\s+(code\s?base|repo\w*|project|app)|across\s+the\s+(code\s?base|repo\w*|project)|security|vulnerab\w*|loophole|exploit\w*|threat\s?model|attack\s+surface|penetration)\b/i;
-  }
-});
-
 // src/agent/session-core.ts
 function lastUserText(messages) {
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -16707,7 +16956,7 @@ __export(retention_exports, {
   listTraceSessions: () => listTraceSessions,
   pruneTraces: () => pruneTraces
 });
-import { readdir as readdir5, rm as rm4, stat as stat7 } from "fs/promises";
+import { readdir as readdir5, rm as rm4, stat as stat8 } from "fs/promises";
 import { join as join29 } from "path";
 async function dirSize(path) {
   let total = 0;
@@ -16717,7 +16966,7 @@ async function dirSize(path) {
     if (entry.isDirectory()) total += await dirSize(p);
     else if (entry.isFile()) {
       try {
-        total += (await stat7(p)).size;
+        total += (await stat8(p)).size;
       } catch {
       }
     }
@@ -16736,11 +16985,11 @@ async function listTraceSessions(root) {
   for (const name of names) {
     const path = join29(base, name);
     try {
-      const s = await stat7(path);
+      const s = await stat8(path);
       if (!s.isDirectory()) continue;
       let mtime = s.mtime;
       try {
-        mtime = (await stat7(join29(path, TRACE_FILE_NAME))).mtime;
+        mtime = (await stat8(join29(path, TRACE_FILE_NAME))).mtime;
       } catch {
       }
       sessions.push({ sessionId: name, path, mtime, bytes: await dirSize(path) });
@@ -17343,6 +17592,10 @@ function hookWirePayload(payload) {
   if (payload.session_id) Object.assign(wire, hookTranscriptFields(payload.session_id));
   if (isToolEventPayload(payload)) {
     Object.assign(wire, claudeToolFields(payload));
+    if ((payload.event === "PostToolUse" || payload.event === "PostToolUseFailure") && payload.result.fileChange) {
+      const { fileChange: _fileChange, ...result2 } = payload.result;
+      wire.result = result2;
+    }
     if (payload.tool_call_id) wire.tool_use_id = payload.tool_call_id;
     if (payload.event === "PermissionRequest") wire.permission_mode = claudePermissionMode(payload.mode);
   }
@@ -17514,7 +17767,7 @@ var init_runner = __esm({
     DECISION_STDOUT_CAP_BYTES = 64 * 1024;
     HOOK_ENV_PAYLOAD_MAX_BYTES = 32 * 1024;
     HOOK_BLOCK_EXIT_CODE = 2;
-    defaultSpawn = (command, payloadJson, env, cwd, timeoutMs, signal) => new Promise((resolve21) => {
+    defaultSpawn = (command, payloadJson, env, cwd, timeoutMs, signal) => new Promise((resolve22) => {
       const child = spawn5(command, {
         shell: true,
         cwd,
@@ -17529,7 +17782,7 @@ var init_runner = __esm({
         settled = true;
         clearTimeout(timer2);
         signal?.removeEventListener("abort", onAbort);
-        resolve21({ exitCode, stdout, stderr, timedOut });
+        resolve22({ exitCode, stdout, stderr, timedOut });
       };
       const onAbort = () => {
         child.kill("SIGTERM");
@@ -17677,7 +17930,7 @@ var init_manager2 = __esm({
 });
 
 // src/util/state.ts
-import { readFile as readFile19, writeFile as writeFile11, mkdir as mkdir12 } from "fs/promises";
+import { readFile as readFile20, writeFile as writeFile11, mkdir as mkdir12 } from "fs/promises";
 import { homedir as homedir19 } from "os";
 import { join as join32 } from "path";
 function statePath() {
@@ -17686,7 +17939,7 @@ function statePath() {
 }
 async function readState() {
   try {
-    const raw = await readFile19(statePath(), "utf8");
+    const raw = await readFile20(statePath(), "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -17766,11 +18019,11 @@ var init_notices = __esm({
 });
 
 // src/eval/config.ts
-import { readFile as readFile20 } from "fs/promises";
+import { readFile as readFile21 } from "fs/promises";
 import { basename as basename6, resolve as resolve8 } from "path";
 async function loadEvalConfig(file) {
   const path = resolve8(file);
-  const raw = JSON.parse(await readFile20(path, "utf8"));
+  const raw = JSON.parse(await readFile21(path, "utf8"));
   if (!raw || typeof raw !== "object") throw new Error(`${file}: config must be a JSON object`);
   const config2 = raw.config ?? {};
   if (typeof config2 !== "object" || Array.isArray(config2)) throw new Error(`${file}: "config" must be an object`);
@@ -17790,7 +18043,7 @@ var init_config2 = __esm({
 });
 
 // src/eval/tasks.ts
-import { readdir as readdir6, readFile as readFile21, stat as stat8 } from "fs/promises";
+import { readdir as readdir6, readFile as readFile22, stat as stat9 } from "fs/promises";
 import { basename as basename7, join as join33, resolve as resolve9 } from "path";
 function isNonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
@@ -17825,7 +18078,7 @@ async function loadTasks(dir, filter) {
   const seen = /* @__PURE__ */ new Set();
   for (const name of names) {
     const file = join33(root, name);
-    const task = validateTask(JSON.parse(await readFile21(file, "utf8")), name);
+    const task = validateTask(JSON.parse(await readFile22(file, "utf8")), name);
     if (task.id !== basename7(name, ".json")) throw new Error(`${name}: "id" (${task.id}) must match the file name`);
     if (seen.has(task.id)) throw new Error(`duplicate task id ${task.id}`);
     seen.add(task.id);
@@ -17834,7 +18087,7 @@ async function loadTasks(dir, filter) {
     for (const [dest, src] of Object.entries(task.files ?? {})) {
       const abs = resolve9(root, src);
       if (!abs.startsWith(root)) throw new Error(`${name}: files["${dest}"] escapes the task directory`);
-      await stat8(abs).catch(() => {
+      await stat9(abs).catch(() => {
         throw new Error(`${name}: files["${dest}"] -> ${src} does not exist`);
       });
       resolvedFiles[dest] = abs;
@@ -17855,7 +18108,7 @@ var init_tasks2 = __esm({
 // src/eval/workspace.ts
 import { execFile as execFile8 } from "child_process";
 import { createHash as createHash6 } from "crypto";
-import { mkdir as mkdir13, rm as rm5, stat as stat9 } from "fs/promises";
+import { mkdir as mkdir13, rm as rm5, stat as stat10 } from "fs/promises";
 import { isAbsolute as isAbsolute4, join as join34, resolve as resolve10 } from "path";
 import { promisify as promisify7 } from "util";
 async function git3(args, cwd, timeoutMs = 6e5) {
@@ -17883,7 +18136,7 @@ async function prepareSourceRepoUncached(repo, cacheDir) {
   const slug = `${repo.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(-60)}-${createHash6("sha1").update(repo).digest("hex").slice(0, 8)}`;
   const dir = join34(cacheDir, slug);
   await mkdir13(cacheDir, { recursive: true });
-  const exists = await stat9(join34(dir, ".git")).then(() => true).catch(() => false);
+  const exists = await stat10(join34(dir, ".git")).then(() => true).catch(() => false);
   if (!exists) {
     await git3(["clone", "--quiet", "--no-checkout", repo, dir], cacheDir);
   } else {
@@ -19155,7 +19408,7 @@ var init_connection = __esm({
         if (this.child) {
           throw new Error("LSP connection already started");
         }
-        return new Promise((resolve21, reject) => {
+        return new Promise((resolve22, reject) => {
           const abortController = new AbortController();
           const spawnTimer = setTimeout(() => {
             abortController.abort();
@@ -19194,7 +19447,7 @@ var init_connection = __esm({
               if (child.pid) {
                 clearTimeout(spawnTimer);
                 this.child = child;
-                resolve21();
+                resolve22();
               }
             });
           } catch (err) {
@@ -19209,12 +19462,12 @@ var init_connection = __esm({
         }
         const id = this.nextId++;
         const msg = { jsonrpc: "2.0", id, method, params };
-        return new Promise((resolve21, reject) => {
+        return new Promise((resolve22, reject) => {
           const timer2 = setTimeout(() => {
             this.pending.delete(id);
             reject(toolTimeoutError(`LSP request '${method}'`, this.requestTimeoutMs));
           }, this.requestTimeoutMs);
-          const pending = { resolve: resolve21, reject, signal, timer: timer2 };
+          const pending = { resolve: resolve22, reject, signal, timer: timer2 };
           this.pending.set(id, pending);
           if (signal) {
             const onAbort = () => {
@@ -20118,7 +20371,7 @@ __export(openrouter_catalog_exports, {
   loadOpenRouterCatalog: () => loadOpenRouterCatalog,
   mapOpenRouterModel: () => mapOpenRouterModel
 });
-import { readFile as readFile22, writeFile as writeFile12, mkdir as mkdir14 } from "fs/promises";
+import { readFile as readFile23, writeFile as writeFile12, mkdir as mkdir14 } from "fs/promises";
 import { homedir as homedir20 } from "os";
 import { join as join36, dirname as dirname17 } from "path";
 function catalogCachePath() {
@@ -20174,7 +20427,7 @@ async function fetchOpenRouterCatalog(fetchImpl2 = fetch) {
 }
 async function readCache3() {
   try {
-    const raw = await readFile22(catalogCachePath(), "utf8");
+    const raw = await readFile23(catalogCachePath(), "utf8");
     const parsed = JSON.parse(raw);
     return parsed.version === CACHE_VERSION ? parsed : null;
   } catch {
@@ -20233,7 +20486,7 @@ __export(requesty_catalog_exports, {
   loadRequestyCatalog: () => loadRequestyCatalog,
   mapRequestyModel: () => mapRequestyModel
 });
-import { readFile as readFile23, writeFile as writeFile13, mkdir as mkdir15 } from "fs/promises";
+import { readFile as readFile24, writeFile as writeFile13, mkdir as mkdir15 } from "fs/promises";
 import { homedir as homedir21 } from "os";
 import { join as join37, dirname as dirname18 } from "path";
 function catalogCachePath2() {
@@ -20294,7 +20547,7 @@ async function fetchRequestyCatalog(fetchImpl2 = fetch) {
 }
 async function readCache4() {
   try {
-    const raw = await readFile23(catalogCachePath2(), "utf8");
+    const raw = await readFile24(catalogCachePath2(), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== CACHE_VERSION2) return null;
     return {
@@ -20372,7 +20625,7 @@ __export(provider_catalog_exports, {
   mapModelsDevModel: () => mapModelsDevModel,
   mapModelsDevProvider: () => mapModelsDevProvider
 });
-import { readFile as readFile24, writeFile as writeFile14, mkdir as mkdir16 } from "fs/promises";
+import { readFile as readFile25, writeFile as writeFile14, mkdir as mkdir16 } from "fs/promises";
 import { homedir as homedir22 } from "os";
 import { join as join38, dirname as dirname19 } from "path";
 function mapModelsDevModel(m) {
@@ -20412,7 +20665,7 @@ function cachePath2() {
 }
 async function readCache5() {
   try {
-    const parsed = JSON.parse(await readFile24(cachePath2(), "utf8"));
+    const parsed = JSON.parse(await readFile25(cachePath2(), "utf8"));
     return parsed.version === CACHE_VERSION3 ? parsed : null;
   } catch {
     return null;
@@ -20787,6 +21040,7 @@ var init_session = __esm({
     "use strict";
     init_image();
     init_session_lifecycle();
+    init_prompt_submit();
     init_process_exit();
     init_loop();
     init_system_prompt();
@@ -20930,6 +21184,16 @@ var init_session = __esm({
           return;
         }
         const mode = options?.mode ?? this.currentMode;
+        const gate = await submitUserPrompt({
+          ...this.hooks ? { hooks: this.hooks } : {},
+          sessionId: this.sessionId,
+          cwd: this.cwd,
+          prompt: text3,
+          resumed: this.messages.some((m) => m.role === "assistant"),
+          model: this.model,
+          auth: llmAuthFromConfig(this.config)
+        });
+        if (gate.blocked) throw new PromptBlockedError(gate.reason);
         const messageId = `msg_${this.nextMessageId++}`;
         let userContent2 = text3;
         if (options?.images && options.images.length > 0) {
@@ -21209,12 +21473,12 @@ ${notes.join("\n")}` };
               toolName: req.tool.name,
               args: req.args
             });
-            const decision = await new Promise((resolve21) => {
-              this.permissionResolvers.set(requestId, resolve21);
+            const decision = await new Promise((resolve22) => {
+              this.permissionResolvers.set(requestId, resolve22);
               setTimeout(() => {
                 if (this.permissionResolvers.has(requestId)) {
                   this.permissionResolvers.delete(requestId);
-                  resolve21("deny");
+                  resolve22("deny");
                 }
               }, 3e5);
             });
@@ -21275,7 +21539,7 @@ ${notes.join("\n")}` };
               this.lspManager?.notifyChange(path, content);
             } else {
               void import("fs/promises").then(
-                ({ readFile: readFile40 }) => readFile40(path, "utf8").then((c) => this.lspManager?.notifyChange(path, c)).catch(() => {
+                ({ readFile: readFile42 }) => readFile42(path, "utf8").then((c) => this.lspManager?.notifyChange(path, c)).catch(() => {
                 })
               ).catch(() => {
               });
@@ -21307,7 +21571,7 @@ __export(run_exports, {
   summarizeTrace: () => summarizeTrace
 });
 import { spawn as spawn7 } from "child_process";
-import { appendFile as appendFile3, copyFile, mkdir as mkdir17, readFile as readFile25, writeFile as writeFile15 } from "fs/promises";
+import { appendFile as appendFile3, copyFile, mkdir as mkdir17, readFile as readFile26, writeFile as writeFile15 } from "fs/promises";
 import { dirname as dirname20, join as join40, resolve as resolve12 } from "path";
 import { performance as performance2 } from "perf_hooks";
 function runShell(command, cwd, timeoutMs) {
@@ -21350,7 +21614,7 @@ async function summarizeTrace(traceFile) {
   const out = { cost_usd: 0, prompt_tokens: 0, completion_tokens: 0, turns: 0, tool_calls: 0, overflow: false };
   let raw;
   try {
-    raw = await readFile25(traceFile, "utf8");
+    raw = await readFile26(traceFile, "utf8");
   } catch {
     return out;
   }
@@ -21546,9 +21810,9 @@ __export(compare_exports, {
   perTask: () => perTask,
   summarizeArm: () => summarizeArm
 });
-import { readFile as readFile26 } from "fs/promises";
+import { readFile as readFile27 } from "fs/promises";
 async function loadResults(file) {
-  const raw = await readFile26(file, "utf8");
+  const raw = await readFile27(file, "utf8");
   return raw.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
 }
 function median(values) {
@@ -21681,7 +21945,7 @@ __export(cost_verify_exports, {
   verifySession: () => verifySession,
   verifyTurn: () => verifyTurn
 });
-import { readFile as readFile27 } from "fs/promises";
+import { readFile as readFile28 } from "fs/promises";
 import { homedir as homedir24 } from "os";
 import { join as join41 } from "path";
 function usagePath2() {
@@ -21690,7 +21954,7 @@ function usagePath2() {
 }
 async function loadSessions() {
   try {
-    return JSON.parse(await readFile27(usagePath2(), "utf8")).sessions ?? [];
+    return JSON.parse(await readFile28(usagePath2(), "utf8")).sessions ?? [];
   } catch {
     return [];
   }
@@ -22221,7 +22485,7 @@ var init_heuristic = __esm({
 });
 
 // src/cost-attribution/classify-from-session.ts
-import { readFile as readFile28 } from "fs/promises";
+import { readFile as readFile29 } from "fs/promises";
 import { join as join42 } from "path";
 import { homedir as homedir25 } from "os";
 function sessionsDir2() {
@@ -22240,7 +22504,7 @@ function parseToolCalls(calls) {
 }
 async function classifyFromSessionFile(sessionId) {
   try {
-    const raw = await readFile28(join42(sessionsDir2(), `${sessionId}.json`), "utf8");
+    const raw = await readFile29(join42(sessionsDir2(), `${sessionId}.json`), "utf8");
     const session = JSON.parse(raw);
     const messages = session.messages ?? [];
     const turns = [];
@@ -22273,7 +22537,7 @@ var cli_exports = {};
 __export(cli_exports, {
   runCostCommand: () => runCostCommand
 });
-import { readFile as readFile29 } from "fs/promises";
+import { readFile as readFile30 } from "fs/promises";
 import { join as join43 } from "path";
 import { homedir as homedir26 } from "os";
 function usageDir2() {
@@ -22293,7 +22557,7 @@ function daysAgo(n) {
 }
 async function loadLog2() {
   try {
-    const raw = await readFile29(usagePath3(), "utf8");
+    const raw = await readFile30(usagePath3(), "utf8");
     return JSON.parse(raw);
   } catch {
     return { version: 1, days: [], sessions: [] };
@@ -22377,6 +22641,661 @@ var init_cli = __esm({
   }
 });
 
+// src/remote/client.ts
+async function* parseEventStream(body) {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for await (const chunk of body) {
+    buffer += decoder.decode(chunk, { stream: true }).replace(/\r\n/g, "\n");
+    let boundary;
+    while ((boundary = buffer.indexOf("\n\n")) >= 0) {
+      const frame = buffer.slice(0, boundary);
+      buffer = buffer.slice(boundary + 2);
+      const event = parseFrame(frame);
+      if (event) yield event;
+    }
+  }
+}
+function parseFrame(frame) {
+  let id;
+  let type = "message";
+  const data = [];
+  for (const line of frame.split("\n")) {
+    if (!line || line.startsWith(":")) continue;
+    const colon = line.indexOf(":");
+    const field = colon < 0 ? line : line.slice(0, colon);
+    const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+    if (field === "id" && /^\d+$/.test(value)) id = Number(value);
+    else if (field === "event") type = value;
+    else if (field === "data") data.push(value);
+  }
+  if (id === void 0) return void 0;
+  let parsed = {};
+  try {
+    parsed = data.length ? JSON.parse(data.join("\n")) : {};
+  } catch {
+    return void 0;
+  }
+  return { id, type, data: parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {} };
+}
+async function toApiError(response) {
+  let code = `http_${response.status}`;
+  let message2 = `Server returned ${response.status}`;
+  try {
+    const body = await response.json();
+    if (body.error?.code) code = body.error.code;
+    if (body.error?.message) message2 = body.error.message;
+  } catch {
+  }
+  return new RemoteApiError(response.status, code, message2);
+}
+function delay(ms, signal) {
+  return new Promise((resolve22, reject) => {
+    if (signal?.aborted) return reject(signal.reason);
+    const timer2 = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve22();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer2);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var TERMINAL_STATUSES, RemoteApiError, RemoteClient;
+var init_client3 = __esm({
+  "src/remote/client.ts"() {
+    "use strict";
+    TERMINAL_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "interrupted", "merged", "destroyed"]);
+    RemoteApiError = class extends Error {
+      constructor(status, code, message2) {
+        super(message2);
+        this.status = status;
+        this.code = code;
+        this.name = "RemoteApiError";
+      }
+      status;
+      code;
+    };
+    RemoteClient = class {
+      constructor(baseUrl, token, fetchImpl2 = fetch) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+        this.fetchImpl = fetchImpl2;
+      }
+      baseUrl;
+      token;
+      fetchImpl;
+      startDeviceAuthorization(clientName2) {
+        return this.request("POST", "/auth/device", { body: { clientName: clientName2 }, auth: false });
+      }
+      /** Polls until the owner decides; resolves with the credential, rejects on denial or expiry. */
+      async waitForCredential(device, options = {}) {
+        const sleep6 = options.sleep ?? ((ms) => delay(ms, options.signal));
+        let intervalMs = Math.max(1, device.interval) * 1e3;
+        const deadline = Date.now() + device.expiresIn * 1e3;
+        while (Date.now() < deadline) {
+          await sleep6(intervalMs);
+          try {
+            return await this.request("POST", "/auth/device/token", { body: { deviceCode: device.deviceCode }, auth: false, signal: options.signal });
+          } catch (error) {
+            if (!(error instanceof RemoteApiError)) throw error;
+            if (error.code === "authorization_pending") continue;
+            if (error.code === "slow_down") {
+              intervalMs += 5e3;
+              continue;
+            }
+            throw error;
+          }
+        }
+        throw new RemoteApiError(400, "expired_token", "The pairing code expired before it was approved; run the command again");
+      }
+      health() {
+        return this.request("GET", "/health");
+      }
+      async workspaces() {
+        return (await this.request("GET", "/workspaces")).workspaces;
+      }
+      async models() {
+        return (await this.request("GET", "/models")).models;
+      }
+      createCodeConversation(input) {
+        const { idempotencyKey, ...body } = input;
+        return this.withRetries(() => this.request("POST", "/conversations", {
+          body: { ...body, kind: "code" },
+          headers: { "Idempotency-Key": idempotencyKey }
+        }));
+      }
+      submitTurn(conversationId, text3, clientTurnId) {
+        return this.withRetries(() => this.request("POST", `/conversations/${encodeURIComponent(conversationId)}/turns`, { body: { clientTurnId, text: text3 } }));
+      }
+      getConversation(conversationId) {
+        return this.request("GET", `/conversations/${encodeURIComponent(conversationId)}`);
+      }
+      async listConversations(limit = 50) {
+        return (await this.request("GET", `/conversations?limit=${limit}`)).conversations;
+      }
+      cancel(conversationId) {
+        return this.request("POST", `/conversations/${encodeURIComponent(conversationId)}/cancel`);
+      }
+      /**
+       * Events after `cursor`, reconnecting with the last seen ID when the stream drops,
+       * until the caller stops iterating or the signal aborts.
+       */
+      async *events(conversationId, cursor, signal) {
+        let last = cursor;
+        let failures = 0;
+        while (!signal?.aborted) {
+          try {
+            const response = await this.fetchImpl(this.url(`/conversations/${encodeURIComponent(conversationId)}/events`), {
+              headers: { ...this.authHeaders(), Accept: "text/event-stream", "Last-Event-ID": String(last) },
+              signal
+            });
+            if (!response.ok || !response.body) throw await toApiError(response);
+            failures = 0;
+            for await (const event of parseEventStream(response.body)) {
+              if (event.id <= last) continue;
+              last = event.id;
+              yield event;
+            }
+          } catch (error) {
+            if (signal?.aborted) return;
+            if (error instanceof RemoteApiError && error.status < 500) throw error;
+            if (++failures > 30) throw error;
+          }
+          await delay(Math.min(1e3 * failures, 1e4), signal).catch(() => {
+          });
+        }
+      }
+      async request(method, path, options = {}) {
+        const response = await this.fetchImpl(this.url(path), {
+          method,
+          headers: {
+            ...options.auth === false ? {} : this.authHeaders(),
+            ...options.body === void 0 ? {} : { "Content-Type": "application/json" },
+            ...options.headers
+          },
+          ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) },
+          ...options.signal ? { signal: options.signal } : {}
+        });
+        if (!response.ok) throw await toApiError(response);
+        return await response.json();
+      }
+      /** Retries network failures and 5xx; safe only for requests carrying an idempotency key. */
+      async withRetries(attempt) {
+        for (let tries = 1; ; tries++) {
+          try {
+            return await attempt();
+          } catch (error) {
+            const retryable = !(error instanceof RemoteApiError) || error.status >= 500;
+            if (!retryable || tries >= 3) throw error;
+            await delay(1e3 * tries);
+          }
+        }
+      }
+      url(path) {
+        return `${this.baseUrl}/api/v1${path}`;
+      }
+      authHeaders() {
+        return this.token ? { Authorization: `Bearer ${this.token}` } : {};
+      }
+    };
+  }
+});
+
+// src/remote/config.ts
+import { chmod as chmod4, mkdir as mkdir18, readFile as readFile31, rename as rename4, writeFile as writeFile16 } from "fs/promises";
+import { homedir as homedir27 } from "os";
+import { dirname as dirname21, join as join44 } from "path";
+function remotesPath(env = process.env) {
+  if (env.AUTOPILOT_REMOTES_FILE) return env.AUTOPILOT_REMOTES_FILE;
+  const configHome2 = env.XDG_CONFIG_HOME?.trim() || join44(homedir27(), ".config");
+  return join44(configHome2, "autopilot", "remotes.json");
+}
+async function loadRemotes(path = remotesPath()) {
+  let raw;
+  try {
+    raw = await readFile31(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const parsed = JSON.parse(raw);
+  return Array.isArray(parsed.remotes) ? parsed.remotes.filter(isRemote) : [];
+}
+async function saveRemote(remote, path = remotesPath()) {
+  const remotes = (await loadRemotes(path)).filter((entry) => entry.name !== remote.name);
+  remotes.push(remote);
+  await writeRemotes(remotes, path);
+}
+async function removeRemote(name, path = remotesPath()) {
+  const remotes = await loadRemotes(path);
+  const kept = remotes.filter((entry) => entry.name !== name);
+  if (kept.length === remotes.length) return false;
+  await writeRemotes(kept, path);
+  return true;
+}
+async function resolveRemote(name, path = remotesPath()) {
+  const remotes = await loadRemotes(path);
+  if (remotes.length === 0) throw new Error("No servers paired yet. Run: autopilot remote add https://your-server");
+  if (name === void 0) {
+    if (remotes.length === 1) return remotes[0];
+    throw new Error(`Several servers are paired; pick one with --on (${remotes.map((entry) => entry.name).join(", ")})`);
+  }
+  const remote = remotes.find((entry) => entry.name === name);
+  if (!remote) throw new Error(`No server named "${name}". Paired: ${remotes.map((entry) => entry.name).join(", ")}`);
+  return remote;
+}
+function defaultRemoteName(url) {
+  const host = new URL(url).hostname.toLowerCase();
+  const label = /^\d+(\.\d+){3}$/.test(host) ? host.replace(/\./g, "-") : host.split(".")[0] ?? "server";
+  const name = label.replace(/[^a-z0-9-]/g, "-").replace(/^-+/, "").slice(0, 40);
+  return REMOTE_NAME_RE.test(name) ? name : "server";
+}
+function normalizeServerUrl(input) {
+  let url;
+  try {
+    url = new URL(/^[a-z]+:\/\//i.test(input) ? input : `https://${input}`);
+  } catch {
+    throw new Error(`Not a URL: ${input}`);
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname.startsWith("127.");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new Error("Use an https:// server URL (http:// is only allowed for localhost)");
+  }
+  if (url.username || url.password || url.search || url.hash) throw new Error("The server URL must not include credentials, a query, or a fragment");
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+async function writeRemotes(remotes, path) {
+  await mkdir18(dirname21(path), { recursive: true, mode: 448 });
+  const temp = `${path}.${process.pid}.tmp`;
+  await writeFile16(temp, `${JSON.stringify({ version: 1, remotes }, null, 2)}
+`, { mode: 384 });
+  await chmod4(temp, 384);
+  await rename4(temp, path);
+}
+function isRemote(value) {
+  if (!value || typeof value !== "object") return false;
+  const entry = value;
+  return ["name", "url", "token", "credentialId", "expiresAt", "addedAt"].every((key) => typeof entry[key] === "string");
+}
+var REMOTE_NAME_RE;
+var init_config4 = __esm({
+  "src/remote/config.ts"() {
+    "use strict";
+    REMOTE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,39}$/;
+  }
+});
+
+// src/remote/git.ts
+import { execFile as execFile9 } from "child_process";
+import { mkdtemp as mkdtemp3, rm as rm6, copyFile as copyFile2 } from "fs/promises";
+import { tmpdir as tmpdir5 } from "os";
+import { join as join45, resolve as resolve13 } from "path";
+import { promisify as promisify8 } from "util";
+function parseGitHubRemote(url) {
+  const match = url.trim().match(/^(?:https:\/\/(?:[^@/]+@)?github\.com\/|ssh:\/\/git@github\.com(?::\d+)?\/|git@github\.com:)([A-Za-z0-9-]{1,39})\/([A-Za-z0-9._-]{1,100}?)(?:\.git)?\/?$/);
+  return match ? `${match[1]}/${match[2]}` : void 0;
+}
+async function detectGitHubRepository(cwd, remote = "origin") {
+  let url;
+  try {
+    url = await git4(cwd, ["remote", "get-url", remote]);
+  } catch {
+    throw new Error(`This directory has no "${remote}" git remote; pass --repo owner/name`);
+  }
+  const repository = parseGitHubRemote(url);
+  if (!repository) throw new Error(`The "${remote}" remote is not a GitHub repository (${url}); pass --repo owner/name`);
+  return repository;
+}
+async function snapshotWorkingTree(cwd) {
+  const root = await git4(cwd, ["rev-parse", "--show-toplevel"]).catch(() => {
+    throw new Error("Not inside a git repository");
+  });
+  await git4(root, ["rev-parse", "--verify", "HEAD"]).catch(() => {
+    throw new Error("This repository has no commits yet; push a first commit before running remotely");
+  });
+  const baseRef = await upstreamRef(root);
+  const baseCommit = await git4(root, ["merge-base", "HEAD", baseRef]).catch(() => {
+    throw new Error(`HEAD shares no history with ${baseRef}`);
+  });
+  const scratch = await mkdtemp3(join45(tmpdir5(), "autopilot-snapshot-"));
+  try {
+    const index = join45(scratch, "index");
+    const realIndex = resolve13(root, await git4(root, ["rev-parse", "--git-path", "index"]));
+    await copyFile2(realIndex, index).catch(() => {
+    });
+    const env = { ...process.env, GIT_INDEX_FILE: index };
+    await git4(root, ["add", "--all"], env);
+    const patch = await git4(root, ["diff", "--cached", "--binary", "--no-color", "--no-ext-diff", baseCommit], env, false);
+    if (patch.length > MAX_PATCH_CHARS) {
+      throw new Error(`Local changes are ${(patch.length / 1024 / 1024).toFixed(1)} MiB, over the 3 MiB limit; commit and push some of them first`);
+    }
+    const files = (await git4(root, ["diff", "--cached", "--name-only", "--no-renames", baseCommit], env)).split("\n").filter(Boolean);
+    return { baseCommit, patch, baseRef, files };
+  } finally {
+    await rm6(scratch, { recursive: true, force: true });
+  }
+}
+async function upstreamRef(root) {
+  const upstream = await git4(root, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]).catch(() => "");
+  if (upstream.startsWith("origin/")) return upstream;
+  const originHead = await git4(root, ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]).catch(() => "");
+  if (originHead) return originHead;
+  for (const candidate of ["origin/main", "origin/master"]) {
+    if (await git4(root, ["rev-parse", "--verify", "--quiet", candidate]).then(() => true, () => false)) return candidate;
+  }
+  throw new Error("Can't find this branch on origin; run `git fetch origin` (or push the branch) first");
+}
+async function git4(cwd, args, env, trim = true) {
+  const { stdout } = await execFileAsync6("git", ["-C", cwd, ...args], { env: env ?? process.env, maxBuffer: 64 * 1024 * 1024 });
+  return trim ? stdout.trim() : stdout;
+}
+var execFileAsync6, MAX_PATCH_CHARS;
+var init_git = __esm({
+  "src/remote/git.ts"() {
+    "use strict";
+    execFileAsync6 = promisify8(execFile9);
+    MAX_PATCH_CHARS = 3 * 1024 * 1024;
+  }
+});
+
+// src/remote/cli.ts
+var cli_exports2 = {};
+__export(cli_exports2, {
+  cancelRun: () => cancelRun,
+  describeError: () => describeError,
+  listRuns: () => listRuns,
+  pullRun: () => pullRun,
+  remoteAdd: () => remoteAdd,
+  remoteList: () => remoteList,
+  remoteRemove: () => remoteRemove,
+  runOnRemote: () => runOnRemote,
+  watchRun: () => watchRun
+});
+import { execFile as execFile10 } from "child_process";
+import { randomUUID as randomUUID8 } from "crypto";
+import { hostname } from "os";
+import { promisify as promisify9 } from "util";
+async function remoteAdd(input, io = processIO) {
+  const url = normalizeServerUrl(input.url);
+  const name = input.name ?? defaultRemoteName(url);
+  if (!REMOTE_NAME_RE.test(name)) throw new Error("Server names are 1-40 lowercase letters, digits, or dashes");
+  const anonymous = new RemoteClient(url, void 0);
+  const device = await anonymous.startDeviceAuthorization(clientName());
+  io.out(`To pair this machine with ${url}, approve code ${device.userCode} at:
+  ${device.verificationUriComplete}
+`);
+  if (input.open !== false && openBrowser(device.verificationUriComplete)) io.out("(opened in your browser)\n");
+  io.out("Waiting for approval\u2026\n");
+  const credential = await anonymous.waitForCredential(device, {
+    ...input.signal ? { signal: input.signal } : {},
+    ...input.sleep ? { sleep: input.sleep } : {}
+  });
+  const remote = {
+    name,
+    url,
+    token: credential.token,
+    credentialId: credential.credentialId,
+    expiresAt: credential.expiresAt,
+    addedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await new RemoteClient(url, remote.token).health();
+  await saveRemote(remote);
+  io.out(`\u2713 Paired as "${name}" (credential expires ${remote.expiresAt.slice(0, 10)}).
+  Try: autopilot --on ${name} "fix the flaky test"
+`);
+  return remote;
+}
+async function remoteList(io = processIO) {
+  const remotes = await loadRemotes();
+  if (remotes.length === 0) {
+    io.out("No servers paired. Run: autopilot remote add https://your-server\n");
+    return;
+  }
+  for (const remote of remotes) io.out(`${remote.name}	${remote.url}	expires ${remote.expiresAt.slice(0, 10)}
+`);
+}
+async function remoteRemove(name, io = processIO) {
+  const removed = await removeRemote(name);
+  if (removed) io.out(`Removed "${name}". To revoke its credential on the server: autopilot aster token revoke <id>
+`);
+  else io.err(`No server named "${name}".
+`);
+  return removed;
+}
+async function runOnRemote(input, io = processIO) {
+  const remote = await resolveRemote(input.remote);
+  const client = new RemoteClient(remote.url, remote.token);
+  const repository = input.repository ?? await detectGitHubRepository(input.cwd);
+  const snapshot = await snapshotWorkingTree(input.cwd);
+  const [workspaces, models] = await Promise.all([client.workspaces(), client.models()]);
+  const workspace = workspaces[0];
+  if (!workspace) throw new Error(`${remote.name} has no workspace this credential can use`);
+  const model = pickModel(models, input.model, input.preferredModel);
+  io.err(`Starting on ${remote.name}: ${repository} from ${snapshot.baseCommit.slice(0, 7)} (${snapshot.baseRef})${snapshot.files.length ? `, with ${snapshot.files.length} changed file${snapshot.files.length === 1 ? "" : "s"}` : ""} \xB7 ${model}
+`);
+  const conversation = await client.createCodeConversation({
+    workspaceId: workspace.id,
+    model,
+    repository,
+    baseCommit: snapshot.baseCommit,
+    ...snapshot.patch ? { patch: snapshot.patch } : {},
+    idempotencyKey: `cli-${randomUUID8()}`
+  });
+  await client.submitTurn(conversation.conversationId, input.task, `cli-${randomUUID8()}`);
+  const shortId = conversation.conversationId.slice(0, 8);
+  io.err(`Run ${shortId} \xB7 branch ${conversation.branch ?? "?"}
+`);
+  if (input.detach) {
+    io.err(`Detached. Follow it with: autopilot runs watch ${shortId}
+`);
+    return 0;
+  }
+  io.err(`Ctrl-C detaches; the run keeps going on the server (autopilot runs watch ${shortId}).
+
+`);
+  return watchConversation(client, remote, conversation.conversationId, conversation.lastEventId, input.signal, io);
+}
+async function listRuns(input, io = processIO) {
+  const remotes = input.remote ? [await resolveRemote(input.remote)] : await loadRemotes();
+  if (remotes.length === 0) throw new Error("No servers paired yet. Run: autopilot remote add https://your-server");
+  const rows = [];
+  for (const remote of remotes) {
+    try {
+      const runs = await new RemoteClient(remote.url, remote.token).listConversations();
+      rows.push(...runs.filter((run) => run.kind === "code").map((run) => ({ ...run, remote: remote.name })));
+    } catch (error) {
+      io.err(`${remote.name}: ${describeError(error)}
+`);
+    }
+  }
+  rows.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  if (input.json) {
+    io.out(`${JSON.stringify(rows, null, 2)}
+`);
+    return;
+  }
+  if (rows.length === 0) {
+    io.out("No runs yet.\n");
+    return;
+  }
+  for (const run of rows) {
+    io.out([
+      run.conversationId.slice(0, 8),
+      run.remote,
+      run.status.padEnd(16),
+      run.repository ?? "",
+      run.pullRequestURL ?? run.branch ?? "",
+      run.createdAt.slice(0, 16).replace("T", " ")
+    ].join("  ") + "\n");
+  }
+}
+async function watchRun(input, io = processIO) {
+  const { remote, run } = await findRun(input.id, input.remote);
+  const client = new RemoteClient(remote.url, remote.token);
+  const finished = TERMINAL_STATUSES.has(run.status) && !run.activeRunId;
+  return watchConversation(client, remote, run.conversationId, 0, input.signal, io, finished ? run.lastEventId : void 0);
+}
+async function cancelRun(input, io = processIO) {
+  const { remote, run } = await findRun(input.id, input.remote);
+  const cancelled = await new RemoteClient(remote.url, remote.token).cancel(run.conversationId);
+  io.out(`${run.conversationId.slice(0, 8)}: ${cancelled.status}
+`);
+}
+async function pullRun(input, io = processIO) {
+  const { run } = await findRun(input.id, input.remote);
+  const branch = run.branch;
+  if (!branch) throw new Error("That run has no branch");
+  if (run.activeRunId) io.err("The run is still going; you'll get what it has pushed so far.\n");
+  const git5 = (args) => execFileAsync7("git", ["-C", input.cwd, ...args]);
+  try {
+    await git5(["fetch", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+  } catch {
+    throw new Error(`Branch ${branch} isn't on origin yet (the run pushes it when a turn finishes)`);
+  }
+  const exists = await git5(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]).then(() => true, () => false);
+  if (exists) {
+    await git5(["switch", branch]);
+    await git5(["merge", "--ff-only", `origin/${branch}`]);
+  } else {
+    await git5(["switch", "-c", branch, "--track", `origin/${branch}`]);
+  }
+  io.out(`On ${branch}${run.pullRequestURL ? ` \xB7 ${run.pullRequestURL}` : ""}
+`);
+}
+async function watchConversation(client, remote, conversationId, cursor, signal, io, replayUntil) {
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  signal?.addEventListener("abort", stop, { once: true });
+  const renderer = new EventRenderer(io);
+  let outcome;
+  try {
+    if (replayUntil === void 0 || replayUntil > cursor) {
+      for await (const event of client.events(conversationId, cursor, controller.signal)) {
+        renderer.render(event);
+        if (RUN_EVENT_TYPES.has(event.type)) outcome = event.type;
+        if (replayUntil === void 0 ? RUN_EVENT_TYPES.has(event.type) : event.id >= replayUntil) break;
+      }
+    }
+    if (replayUntil !== void 0 && !controller.signal.aborted) outcome ??= "completed";
+  } finally {
+    signal?.removeEventListener("abort", stop);
+    controller.abort();
+  }
+  renderer.finish();
+  const shortId = conversationId.slice(0, 8);
+  if (!outcome) {
+    io.err(`
+Detached from ${shortId}; it keeps running on ${remote.name}. Follow it with: autopilot runs watch ${shortId}
+`);
+    return 0;
+  }
+  const final = await client.getConversation(conversationId);
+  if (outcome === "completed") {
+    io.err(`
+\u2713 ${shortId} completed${final.pullRequestURL ? `: ${final.pullRequestURL}` : " (no changes, so no pull request)"}
+`);
+    if (final.pullRequestURL) io.err(`  Check it out locally: autopilot pull ${shortId}
+`);
+    return 0;
+  }
+  io.err(`
+\u2717 ${shortId} ${outcome}
+`);
+  return 1;
+}
+async function findRun(id, remoteName) {
+  const needle = id.trim().toLowerCase();
+  if (!/^[0-9a-f-]{4,36}$/.test(needle)) throw new Error("Run IDs are the hex IDs `autopilot runs` shows");
+  const remotes = remoteName ? [await resolveRemote(remoteName)] : await loadRemotes();
+  const matches = [];
+  for (const remote of remotes) {
+    const runs = await new RemoteClient(remote.url, remote.token).listConversations(200).catch(() => []);
+    for (const run of runs) if (run.conversationId.startsWith(needle)) matches.push({ remote, run });
+  }
+  if (matches.length === 0) throw new Error(`No run ${id} on ${remoteName ?? "any paired server"}`);
+  if (matches.length > 1) throw new Error(`${id} matches several runs; use more characters`);
+  return matches[0];
+}
+function pickModel(models, requested, preferred) {
+  if (requested) {
+    if (!models.includes(requested)) throw new Error(`The server doesn't offer ${requested}`);
+    return requested;
+  }
+  if (preferred && models.includes(preferred)) return preferred;
+  const first = models[0];
+  if (!first) throw new Error("The server offers no models");
+  return first;
+}
+function clientName() {
+  const host = hostname().replace(/\.local$/, "").replace(/[^\p{L}\p{N} ._'()@-]/gu, "-").slice(0, 40) || "laptop";
+  return `${host} (autopilot)`;
+}
+function oneLine(text3, max) {
+  const flat = text3.replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+function describeError(error) {
+  if (error instanceof RemoteApiError) return `${error.message} (${error.code})`;
+  return error instanceof Error ? error.message : String(error);
+}
+var execFileAsync7, RUN_EVENT_TYPES, processIO, EventRenderer;
+var init_cli2 = __esm({
+  "src/remote/cli.ts"() {
+    "use strict";
+    init_open_browser();
+    init_client3();
+    init_config4();
+    init_git();
+    execFileAsync7 = promisify9(execFile10);
+    RUN_EVENT_TYPES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "interrupted"]);
+    processIO = {
+      out: (text3) => process.stdout.write(text3),
+      err: (text3) => process.stderr.write(text3)
+    };
+    EventRenderer = class {
+      constructor(io) {
+        this.io = io;
+      }
+      io;
+      midLine = false;
+      render(event) {
+        const data = event.data;
+        if (event.type === "assistant.delta") {
+          const text3 = typeof data.text === "string" ? data.text : typeof data.delta === "string" ? data.delta : "";
+          if (!text3) return;
+          this.io.out(text3);
+          this.midLine = !text3.endsWith("\n");
+          return;
+        }
+        if (event.type === "tool.activity" && data.activity === "started") {
+          const input = typeof data.input === "string" ? ` ${oneLine(data.input, 120)}` : "";
+          this.line(`  \u203A ${String(data.tool ?? "tool")}${input}`);
+          return;
+        }
+        if (event.type === "tool.activity" && data.activity === "failed") {
+          this.line(`  \u2717 ${String(data.tool ?? "tool")} failed`);
+          return;
+        }
+        if (event.type === "checkpoint.created" && typeof data.message === "string") {
+          this.line(`  \u25CF ${oneLine(data.message, 100)}`);
+        }
+      }
+      finish() {
+        if (this.midLine) this.io.out("\n");
+        this.midLine = false;
+      }
+      line(text3) {
+        this.finish();
+        this.io.out(`${text3}
+`);
+      }
+    };
+  }
+});
+
 // src/server/aster-workspaces.ts
 var aster_workspaces_exports = {};
 __export(aster_workspaces_exports, {
@@ -22387,23 +23306,23 @@ __export(aster_workspaces_exports, {
   resolveAsterServerConfigPath: () => resolveAsterServerConfigPath
 });
 import { existsSync as existsSync11 } from "fs";
-import { readFile as readFile30, realpath as realpath5, stat as stat10 } from "fs/promises";
-import { homedir as homedir27 } from "os";
-import { isAbsolute as isAbsolute5, join as join44, relative as relative8, resolve as resolve13, sep as sep4 } from "path";
+import { readFile as readFile32, realpath as realpath5, stat as stat11 } from "fs/promises";
+import { homedir as homedir28 } from "os";
+import { isAbsolute as isAbsolute5, join as join46, relative as relative8, resolve as resolve14, sep as sep4 } from "path";
 function localAsterConfigPath(env = process.env) {
-  const configHome2 = env.XDG_CONFIG_HOME?.trim() || join44(homedir27(), ".config");
-  return resolve13(configHome2, "autopilot", "aster.json");
+  const configHome2 = env.XDG_CONFIG_HOME?.trim() || join46(homedir28(), ".config");
+  return resolve14(configHome2, "autopilot", "aster.json");
 }
 function resolveAsterServerConfigPath(env = process.env) {
   const configuredPath = env.AUTOPILOT_ASTER_CONFIG?.trim();
-  if (configuredPath) return resolve13(configuredPath);
+  if (configuredPath) return resolve14(configuredPath);
   const userConfigPath = localAsterConfigPath(env);
   return existsSync11(userConfigPath) ? userConfigPath : SYSTEM_ASTER_CONFIG_PATH;
 }
 async function loadAsterServerConfig(configPath2 = resolveAsterServerConfigPath()) {
   let raw;
   try {
-    raw = JSON.parse(await readFile30(configPath2, "utf8"));
+    raw = JSON.parse(await readFile32(configPath2, "utf8"));
   } catch {
     throw new AsterConfigError();
   }
@@ -22440,7 +23359,7 @@ async function loadAsterServerConfig(configPath2 = resolveAsterServerConfigPath(
     let rootPath;
     try {
       rootPath = await realpath5(workspace.rootPath);
-      if (!(await stat10(rootPath)).isDirectory()) throw new Error("not a directory");
+      if (!(await stat11(rootPath)).isDirectory()) throw new Error("not a directory");
     } catch {
       throw new AsterConfigError();
     }
@@ -22480,10 +23399,10 @@ __export(aster_setup_exports, {
   setupLocalAsterConfig: () => setupLocalAsterConfig
 });
 import { execFileSync as execFileSync3 } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { existsSync as existsSync12 } from "fs";
-import { chmod as chmod4, link, mkdir as mkdir18, realpath as realpath6, rm as rm6, stat as stat11, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename9, dirname as dirname21, resolve as resolve14 } from "path";
+import { chmod as chmod5, link, mkdir as mkdir19, realpath as realpath6, rm as rm7, stat as stat12, writeFile as writeFile17 } from "fs/promises";
+import { basename as basename9, dirname as dirname22, resolve as resolve15 } from "path";
 async function setupLocalAsterConfig(options) {
   if (options.workspacePaths.length === 0 || options.workspacePaths.length > 100) {
     throw new Error("provide between 1 and 100 Git workspace roots");
@@ -22495,7 +23414,7 @@ async function setupLocalAsterConfig(options) {
   const requestedWorkspaces = await createWorkspaceEntries(options.workspacePaths);
   const env = options.env ?? process.env;
   const requestedPath = options.configPath?.trim() || env.AUTOPILOT_ASTER_CONFIG?.trim() || localAsterConfigPath(env);
-  const path = resolve14(requestedPath);
+  const path = resolve15(requestedPath);
   if (existsSync12(path)) {
     const config3 = await loadAsterServerConfig(path);
     const selectedWorkspaces = requestedWorkspaces.map((requested) => {
@@ -22511,21 +23430,21 @@ async function setupLocalAsterConfig(options) {
     models: models.length > 0 ? models : "openrouter",
     workspaces: requestedWorkspaces
   };
-  const directory = dirname21(path);
-  await mkdir18(directory, { recursive: true, mode: 448 });
-  await chmod4(directory, 448).catch(() => {
+  const directory = dirname22(path);
+  await mkdir19(directory, { recursive: true, mode: 448 });
+  await chmod5(directory, 448).catch(() => {
   });
-  const temporaryPath = `${path}.tmp-${randomUUID8()}`;
+  const temporaryPath = `${path}.tmp-${randomUUID9()}`;
   try {
-    await writeFile16(temporaryPath, `${JSON.stringify(config2, null, 2)}
+    await writeFile17(temporaryPath, `${JSON.stringify(config2, null, 2)}
 `, { encoding: "utf8", mode: 384, flag: "wx" });
-    await chmod4(temporaryPath, 384);
+    await chmod5(temporaryPath, 384);
     const validated = await loadAsterServerConfig(temporaryPath);
     await link(temporaryPath, path);
-    await rm6(temporaryPath);
+    await rm7(temporaryPath);
     return { path, config: validated, selectedWorkspaces: validated.workspaces };
   } catch (error) {
-    await rm6(temporaryPath, { force: true }).catch(() => {
+    await rm7(temporaryPath, { force: true }).catch(() => {
     });
     if (isAlreadyExists(error)) {
       return setupLocalAsterConfig(options);
@@ -22537,11 +23456,11 @@ async function createWorkspaceEntries(paths) {
   const usedIds = /* @__PURE__ */ new Set();
   const workspaces = [];
   for (const input of paths) {
-    const requested = resolve14(input);
+    const requested = resolve15(input);
     let root;
     try {
       root = await realpath6(requested);
-      if (!(await stat11(root)).isDirectory()) throw new Error("not a directory");
+      if (!(await stat12(root)).isDirectory()) throw new Error("not a directory");
       const output = execFileSync3("git", ["-C", root, "rev-parse", "--show-toplevel"], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
@@ -22588,13 +23507,13 @@ __export(aster_store_exports, {
   normalizeUserCode: () => normalizeUserCode
 });
 import Database4 from "better-sqlite3";
-import { createHash as createHash7, randomBytes as randomBytes3, randomInt, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes3, randomInt, randomUUID as randomUUID10 } from "crypto";
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync10 } from "fs";
-import { homedir as homedir28 } from "os";
-import { dirname as dirname22, join as join45 } from "path";
+import { homedir as homedir29 } from "os";
+import { dirname as dirname23, join as join47 } from "path";
 function defaultAsterDbPath() {
-  const root = process.env.XDG_STATE_HOME || join45(homedir28(), ".local", "state");
-  return process.env.AUTOPILOT_ASTER_DB || join45(root, "autopilot", "aster.db");
+  const root = process.env.XDG_STATE_HOME || join47(homedir29(), ".local", "state");
+  return process.env.AUTOPILOT_ASTER_DB || join47(root, "autopilot", "aster.db");
 }
 function hashToken(token) {
   return createHash7("sha256").update(token).digest("hex");
@@ -22681,9 +23600,9 @@ var init_aster_store = __esm({
     AsterStore = class {
       db;
       constructor(dbPath = defaultAsterDbPath()) {
-        mkdirSync10(dirname22(dbPath), { recursive: true, mode: 448 });
+        mkdirSync10(dirname23(dbPath), { recursive: true, mode: 448 });
         try {
-          chmodSync2(dirname22(dbPath), 448);
+          chmodSync2(dirname23(dbPath), 448);
         } catch {
         }
         this.db = new Database4(dbPath);
@@ -22898,7 +23817,7 @@ var init_aster_store = __esm({
         const scopes = [...new Set(input.scopes)];
         if (scopes.length === 0 || scopes.some((scope) => !VALID_SCOPES.has(scope))) throw new Error("credential scopes are invalid");
         if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= Date.now()) throw new Error("credential expiry must be in the future");
-        const id = randomUUID9();
+        const id = randomUUID10();
         const token = `aster_${randomBytes3(32).toString("base64url")}`;
         const now2 = Date.now();
         this.db.prepare(`INSERT INTO aster_credentials
@@ -22952,7 +23871,7 @@ var init_aster_store = __esm({
       }
       /** The owner's decision on a user code. An approval fixes the credential the client will receive. */
       resolveDeviceAuthorization(userCode, decision, grant, now2 = Date.now()) {
-        const resolve21 = this.db.transaction(() => {
+        const resolve22 = this.db.transaction(() => {
           const row = this.db.prepare("SELECT * FROM aster_device_authorizations WHERE user_code = ?").get(normalizeUserCode(userCode));
           if (!row) return "not_found";
           if (row.status !== "pending") return "already_resolved";
@@ -22965,7 +23884,7 @@ var init_aster_store = __esm({
         SET status = 'approved', workspace_ids_json = ?, credential_ttl_ms = ?, resolved_at = ? WHERE user_code = ?`).run(JSON.stringify(grant.workspaceIds), grant.credentialTtlMs, now2, row.user_code);
           return "approved";
         });
-        return resolve21.immediate();
+        return resolve22.immediate();
       }
       /** The client's poll. An approved code is exchanged for its credential exactly once. */
       redeemDeviceAuthorization(deviceCode, now2 = Date.now()) {
@@ -23212,7 +24131,7 @@ var init_aster_store = __esm({
         }));
       }
       createApproval(input) {
-        const id = randomUUID9();
+        const id = randomUUID10();
         const now2 = Date.now();
         this.db.prepare(`INSERT INTO aster_approvals
       (id, conversation_id, run_id, tool_name, explanation, arguments_json, status, expires_at, created_at)
@@ -23315,9 +24234,9 @@ async function handleAsterPairing(req, res, url, store) {
   const method = req.method ?? "GET";
   if (path === `${AUTH_PREFIX}/device` && method === "POST") {
     const body = await readJsonBody(req);
-    const clientName = typeof body.clientName === "string" ? body.clientName.trim() : "Autopilot CLI";
-    if (!CLIENT_NAME_RE.test(clientName)) return sendError(res, 400, "invalid_client_name", "clientName must be 1-60 letters, digits, spaces, or ._'()@-");
-    const started2 = store.createDeviceAuthorization({ clientName, ttlMs: DEVICE_CODE_TTL_MS, maxPending: MAX_PENDING_DEVICE_CODES });
+    const clientName2 = typeof body.clientName === "string" ? body.clientName.trim() : "Autopilot CLI";
+    if (!CLIENT_NAME_RE.test(clientName2)) return sendError(res, 400, "invalid_client_name", "clientName must be 1-60 letters, digits, spaces, or ._'()@-");
+    const started2 = store.createDeviceAuthorization({ clientName: clientName2, ttlMs: DEVICE_CODE_TTL_MS, maxPending: MAX_PENDING_DEVICE_CODES });
     if (!started2) return sendError(res, 429, "too_many_pending", "Too many pairings are waiting for approval; try again later");
     const verificationUri = `${publicBaseUrl(req)}${AUTH_PREFIX}/approve`;
     return json(res, 200, {
@@ -23464,9 +24383,9 @@ function notOwnerBody(code) {
     <p>You can also approve from the server directly:</p>
     <pre>autopilot aster pair approve ${escapeHtml2(code ?? "<code>")}</pre>`;
 }
-function approvalForm(userCode, clientName) {
+function approvalForm(userCode, clientName2) {
   return `
-    <p><strong>${escapeHtml2(clientName)}</strong> wants to use this server.</p>
+    <p><strong>${escapeHtml2(clientName2)}</strong> wants to use this server.</p>
     <p class="code">${escapeHtml2(userCode)}</p>
     <p class="muted">Approve only if this matches the code shown on your device.</p>
     <form method="post" action="${AUTH_PREFIX}/approve">
@@ -23587,7 +24506,7 @@ __export(keys_exports, {
   saveProviderKey: () => saveProviderKey,
   switchProvider: () => switchProvider
 });
-import { readFile as readFile31 } from "fs/promises";
+import { readFile as readFile33 } from "fs/promises";
 function looksLikeProviderKey(id, key) {
   if (id === "openrouter") return looksLikeOpenRouterKey(key);
   return key.length >= 8 && !/\s/.test(key);
@@ -23670,7 +24589,7 @@ async function checkProviderKey(id, key, baseUrl, fetchImpl2 = fetch) {
 }
 async function persistedProviders() {
   try {
-    const raw = JSON.parse(await readFile31(configPath(), "utf8"));
+    const raw = JSON.parse(await readFile33(configPath(), "utf8"));
     return raw.providers ?? {};
   } catch {
     return {};
@@ -23948,7 +24867,7 @@ __export(github_auth_exports, {
   authGitHubForTui: () => authGitHubForTui
 });
 function sleep4(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 async function* authGitHubForTui() {
   yield { message: "Starting GitHub OAuth device flow..." };
@@ -24955,13 +25874,13 @@ var init_openapi = __esm({
 });
 
 // src/runs/worktrees.ts
-import { execFile as execFile9 } from "child_process";
-import { access as access2, chmod as chmod5, mkdir as mkdir19, realpath as realpath7 } from "fs/promises";
-import { homedir as homedir29 } from "os";
-import { isAbsolute as isAbsolute6, join as join46, parse, relative as relative9, resolve as resolve15, sep as sep5 } from "path";
+import { execFile as execFile11 } from "child_process";
+import { access as access2, chmod as chmod6, mkdir as mkdir20, realpath as realpath7 } from "fs/promises";
+import { homedir as homedir30 } from "os";
+import { isAbsolute as isAbsolute6, join as join48, parse, relative as relative9, resolve as resolve16, sep as sep5 } from "path";
 function defaultWorktreesDir() {
-  const dataHome = process.env.XDG_DATA_HOME || join46(homedir29(), ".local", "share");
-  return join46(dataHome, "autopilot", "worktrees");
+  const dataHome = process.env.XDG_DATA_HOME || join48(homedir30(), ".local", "share");
+  return join48(dataHome, "autopilot", "worktrees");
 }
 function isOutside(path) {
   return path === ".." || path.startsWith(`..${sep5}`) || isAbsolute6(path);
@@ -24972,7 +25891,7 @@ function isWithin3(parent, candidate) {
 }
 function runGit(args, cwd) {
   return new Promise((resolveOutput, reject) => {
-    execFile9("git", args, { cwd, encoding: "utf8", timeout: 3e4, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+    execFile11("git", args, { cwd, encoding: "utf8", timeout: 3e4, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
       if (error) {
         const detail = stderr.trim();
         reject(new Error(`git ${args[0]} failed${detail ? `: ${detail}` : ""}`, { cause: error }));
@@ -25002,17 +25921,17 @@ var init_worktrees = __esm({
         if (isOutside(sourceRelativePath)) {
           throw new Error("sourceCwd must be inside the Git repository");
         }
-        const configuredRoot = resolve15(this.rootDir);
+        const configuredRoot = resolve16(this.rootDir);
         if (configuredRoot === parse(configuredRoot).root || isWithin3(repository, configuredRoot)) {
           throw new Error("worktree root must be outside the source repository and not the filesystem root");
         }
-        await mkdir19(configuredRoot, { recursive: true, mode: 448 });
+        await mkdir20(configuredRoot, { recursive: true, mode: 448 });
         const worktreesRoot = await realpath7(configuredRoot);
         if (isWithin3(repository, worktreesRoot)) {
           throw new Error("worktree root must be outside the source repository");
         }
-        await chmod5(worktreesRoot, 448);
-        const worktreePath = join46(worktreesRoot, runId);
+        await chmod6(worktreesRoot, 448);
+        const worktreePath = join48(worktreesRoot, runId);
         try {
           await access2(worktreePath);
           throw new Error(`worktree path already exists for run ${runId}`);
@@ -25026,7 +25945,7 @@ var init_worktrees = __esm({
           repositoryRoot: repository,
           sourceCwd: source,
           worktreePath,
-          cwd: resolve15(worktreePath, sourceRelativePath),
+          cwd: resolve16(worktreePath, sourceRelativePath),
           branch
         };
       }
@@ -25108,10 +26027,10 @@ var init_wake_scheduler = __esm({
       scheduleNextTick() {
         if (!this.running || this.disposed) return;
         const nextAt = this.store.nextTimerAt();
-        const delay = nextAt === null ? IDLE_RECHECK_MS : Math.max(0, Math.min(MAX_NODE_TIMEOUT_MS, nextAt - Date.now()));
+        const delay2 = nextAt === null ? IDLE_RECHECK_MS : Math.max(0, Math.min(MAX_NODE_TIMEOUT_MS, nextAt - Date.now()));
         this.timer = setTimeout(() => {
           void this.tick();
-        }, delay);
+        }, delay2);
         this.timer.unref();
       }
       async processTimer(timer2, now2) {
@@ -25473,9 +26392,9 @@ var init_aster_tools = __esm({
 
 // src/server/aster-memory.ts
 import Database5 from "better-sqlite3";
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname23 } from "path";
+import { dirname as dirname24 } from "path";
 function rowToItem(row) {
   return {
     id: row.id,
@@ -25528,7 +26447,7 @@ var init_aster_memory = __esm({
     AsterMemory = class {
       constructor(dbPath = defaultAsterDbPath(), options = {}) {
         this.options = options;
-        mkdirSync11(dirname23(dbPath), { recursive: true, mode: 448 });
+        mkdirSync11(dirname24(dbPath), { recursive: true, mode: 448 });
         this.db = new Database5(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("busy_timeout = 5000");
@@ -25592,7 +26511,7 @@ var init_aster_memory = __esm({
           this.db.prepare("UPDATE aster_memories SET title = ?, content = ?, pinned = ?, updated_at = ? WHERE id = ?").run(title, content, existing.pinned || input.pinned ? 1 : 0, now2, existing.id);
           return { item: this.get(existing.id), change: "updated" };
         }
-        const id = randomUUID10();
+        const id = randomUUID11();
         this.db.prepare(`INSERT INTO aster_memories (id, kind, key, title, content, pinned, source_conversation_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, input.kind, input.key ?? null, title, content, input.pinned ? 1 : 0, input.sourceConversationId ?? null, now2, now2);
         return { item: this.get(id), change: "added" };
@@ -25780,14 +26699,14 @@ function parseReceivePackCommands(data) {
 function isSafeBranch(branch) {
   return /^[A-Za-z0-9._/-]{1,200}$/.test(branch) && !branch.startsWith("-") && !branch.endsWith("/") && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && branch.split("/").every((part) => part !== "" && part !== "." && part !== ".." && !part.endsWith(".lock"));
 }
-function upstreamHeaders(req, token, git4) {
+function upstreamHeaders(req, token, git5) {
   const headers = {};
   for (const name of FORWARDED_REQUEST_HEADERS) {
     const value = req.headers[name];
     if (typeof value === "string") headers[name] = value;
   }
   headers["user-agent"] ??= "autopilot-aster";
-  headers.authorization = git4 ? "Basic " + Buffer.from(`x-access-token:${token}`).toString("base64") : `Bearer ${token}`;
+  headers.authorization = git5 ? "Basic " + Buffer.from(`x-access-token:${token}`).toString("base64") : `Bearer ${token}`;
   return headers;
 }
 function pipeResponse(upstreamRes, res) {
@@ -25837,9 +26756,9 @@ var init_aster_github_proxy = __esm({
       gitUpstream;
       async listen(port, host) {
         this.server = createServer2((req, res) => this.handle(req, res));
-        await new Promise((resolve21, reject) => {
+        await new Promise((resolve22, reject) => {
           this.server.once("error", reject);
-          this.server.listen(port, host, () => resolve21());
+          this.server.listen(port, host, () => resolve22());
         });
         const address = this.server.address();
         return typeof address === "object" && address ? address.port : port;
@@ -25850,8 +26769,8 @@ var init_aster_github_proxy = __esm({
       }
       handle(req, res, pathOverride) {
         const url = new URL(pathOverride ?? req.url ?? "/", "http://proxy.local");
-        const git4 = url.pathname.match(GIT_PATH_RE);
-        if (!git4) return deny(res, 404, "Only Git Smart HTTP is available through this proxy");
+        const git5 = url.pathname.match(GIT_PATH_RE);
+        if (!git5) return deny(res, 404, "Only Git Smart HTTP is available through this proxy");
         const grantToken = extractToken(req);
         if (!grantToken) {
           res.writeHead(401, { "www-authenticate": 'Basic realm="aster-github"', "content-type": "text/plain" });
@@ -25860,7 +26779,7 @@ var init_aster_github_proxy = __esm({
         }
         const grant = this.options.resolveGrant(grantToken);
         if (!grant) return deny(res, 403, "This repository grant is invalid or was revoked");
-        const [, owner, name, service] = git4;
+        const [, owner, name, service] = git5;
         if (`${owner}/${name}`.toLowerCase() !== grant.repository.toLowerCase()) {
           return deny(res, 403, `This conversation can only access ${grant.repository}`);
         }
@@ -26021,7 +26940,7 @@ var init_aster_push = __esm({
         };
         if (this.options.deliver) return this.options.deliver({ host, token, headers, payload });
         const session = this.session(host);
-        return await new Promise((resolve21, reject) => {
+        return await new Promise((resolve22, reject) => {
           const stream = session.request({ ":method": "POST", ":path": `/3/device/${token}`, ...headers, "content-type": "application/json" });
           let status = 0;
           stream.setTimeout(15e3, () => stream.close());
@@ -26029,7 +26948,7 @@ var init_aster_push = __esm({
             status = Number(responseHeaders[":status"]) || 0;
           });
           stream.on("error", reject);
-          stream.on("close", () => resolve21(status));
+          stream.on("close", () => resolve22(status));
           stream.resume();
           stream.end(payload);
         });
@@ -26060,9 +26979,9 @@ var init_aster_push = __esm({
 });
 
 // src/server/aster-api.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 import { unlink as unlink3 } from "fs/promises";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 function parseCursor(header, query) {
   const value = (Array.isArray(header) ? header[0] : header) ?? query ?? "0";
   if (!/^\d{1,16}$/.test(value)) return void 0;
@@ -26164,7 +27083,7 @@ function json2(res, status, data) {
   res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
   res.end(JSON.stringify(data));
 }
-var API_PREFIX, MAX_BODY_BYTES, MAX_USER_TURN_CHARS, CLIENT_TURN_ID_RE, CREATE_IDEMPOTENCY_KEY_RE, MAX_APPROVAL_ARG_BYTES, CONVERSATION_ID_RE, ALLOWED_ASTER_TOOLS, BASE_COMMIT_RE, MAX_PATCH_CHARS, MAX_LISTED_CONVERSATIONS, AsterApi;
+var API_PREFIX, MAX_BODY_BYTES, MAX_USER_TURN_CHARS, CLIENT_TURN_ID_RE, CREATE_IDEMPOTENCY_KEY_RE, MAX_APPROVAL_ARG_BYTES, CONVERSATION_ID_RE, ALLOWED_ASTER_TOOLS, BASE_COMMIT_RE, MAX_PATCH_CHARS2, MAX_LISTED_CONVERSATIONS, AsterApi;
 var init_aster_api = __esm({
   "src/server/aster-api.ts"() {
     "use strict";
@@ -26190,7 +27109,7 @@ var init_aster_api = __esm({
     CONVERSATION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     ALLOWED_ASTER_TOOLS = ["read", "write", "edit"];
     BASE_COMMIT_RE = /^[0-9a-f]{40}$/;
-    MAX_PATCH_CHARS = 3 * 1024 * 1024;
+    MAX_PATCH_CHARS2 = 3 * 1024 * 1024;
     MAX_LISTED_CONVERSATIONS = 200;
     AsterApi = class {
       store;
@@ -26310,7 +27229,7 @@ var init_aster_api = __esm({
             if (body.baseCommit !== void 0 && (typeof body.baseCommit !== "string" || !BASE_COMMIT_RE.test(body.baseCommit))) {
               return sendError2(res, 400, "invalid_base_commit", "baseCommit must be a full 40-character commit SHA");
             }
-            if (body.patch !== void 0 && (typeof body.patch !== "string" || body.patch.length > MAX_PATCH_CHARS)) {
+            if (body.patch !== void 0 && (typeof body.patch !== "string" || body.patch.length > MAX_PATCH_CHARS2)) {
               return sendError2(res, 400, "invalid_patch", "patch must be a git diff of at most 3 MiB");
             }
             if (typeof body.patch === "string" && containsLikelyProviderSecret(body.patch)) {
@@ -26675,8 +27594,8 @@ var init_aster_api = __esm({
         };
       }
       async createConversation(res, store, principal, workspace, model, idempotencyKey, kind, repository, changes) {
-        const candidateId = randomUUID11();
-        const candidateSessionId = randomUUID11();
+        const candidateId = randomUUID12();
+        const candidateSessionId = randomUUID12();
         const reservation = store.reserveCellConversation({
           conversationId: candidateId,
           credentialId: principal.credentialId,
@@ -26817,12 +27736,12 @@ var init_aster_api = __esm({
           sendError2(res, 409, "conversation_cell_unavailable", "Conversation cell is not available");
           return;
         }
-        const runId = randomUUID11();
+        const runId = randomUUID12();
         if (!idempotent && !store.beginTurn(conversation.id, runId)) {
           sendError2(res, 409, "conversation_busy", "A turn is already active for this conversation");
           return;
         }
-        const sessionPath = resolve16(sessionsDir(), conversation.sessionId + ".json");
+        const sessionPath = resolve17(sessionsDir(), conversation.sessionId + ".json");
         let sessionFile;
         try {
           sessionFile = await loadSession(sessionPath);
@@ -27132,7 +28051,7 @@ var init_aster_api = __esm({
         }
         try {
           if (mapping.cellId) await this.runtime.destroyCell(mapping.cellId);
-          await unlink3(resolve16(sessionsDir(), mapping.sessionId + ".json")).catch(() => {
+          await unlink3(resolve17(sessionsDir(), mapping.sessionId + ".json")).catch(() => {
           });
           store.setCellStatus(conversation.id, "destroyed");
           store.setConversationStatus(conversation.id, "destroyed");
@@ -27179,7 +28098,7 @@ var init_aster_api = __esm({
           return void 0;
         }
         try {
-          const sessionPath = resolve16(sessionsDir(), conversation.sessionId + ".json");
+          const sessionPath = resolve17(sessionsDir(), conversation.sessionId + ".json");
           const sessionFile = await loadSession(sessionPath);
           sessionFile.model = model;
           await saveSession(sessionFile);
@@ -27318,10 +28237,10 @@ data: ${JSON.stringify(event.data)}
 });
 
 // src/server/aster-cell-runtime.ts
-import { execFile as execFile10 } from "child_process";
-import { readFile as readFile32 } from "fs/promises";
-import { promisify as promisify8 } from "util";
-import { randomUUID as randomUUID12 } from "crypto";
+import { execFile as execFile12 } from "child_process";
+import { readFile as readFile34 } from "fs/promises";
+import { promisify as promisify10 } from "util";
+import { randomUUID as randomUUID13 } from "crypto";
 async function writeCellFileChunked(cell, path, content) {
   if (Buffer.byteLength(content, "utf8") <= CELL_FILE_WRITE_CHUNK_CHARS) {
     await cell.writeFile(path, content, { mode: "0600" });
@@ -27349,14 +28268,14 @@ async function writeCellFileChunked(cell, path, content) {
 async function readBundledCellSdkBundle() {
   for (const url of [new URL("./sdk/index.js", import.meta.url), new URL("../sdk/index.js", import.meta.url)]) {
     try {
-      return await readFile32(url, "utf8");
+      return await readFile34(url, "utf8");
     } catch {
     }
   }
   throw new Error("cell_runtime_bundle_unavailable");
 }
 async function defaultArchiveWorkspace(workspaceRoot) {
-  const { stdout } = await execFileAsync6("git", ["-C", workspaceRoot, "archive", "--format=tar", "HEAD"], {
+  const { stdout } = await execFileAsync8("git", ["-C", workspaceRoot, "archive", "--format=tar", "HEAD"], {
     encoding: "buffer",
     maxBuffer: 512 * 1024 * 1024
   });
@@ -27402,15 +28321,15 @@ function boundedToolText(text3, limit) {
 ${redacted.slice(-half)}`;
 }
 function sleep5(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
-var execFileAsync6, CELL_WORKSPACE, CELL_STATE_DIR, CHECKPOINT_MESSAGE_FILE, CELL_RUNTIME_DIR, INSTALLED_RUNTIME_PACKAGE, CELL_RUNTIME_SDK_ENTRY, NOTES_FILE, MEMORY_FILE, MEMORY_EXTRACTION_TIMEOUT_MS, LIVENESS_CHECK_MS, ARTIFACTS_DIR, MAX_ARTIFACTS, MAX_ARTIFACT_BYTES, BRANCH_RE2, REPOSITORY_RE, GIT, COMMIT_SHA_RE, FULL_COMMIT_SHA_RE, LOCAL_CHANGES_PATCH, MAX_TOOL_OUTPUT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_CHECKPOINTS, CELL_CONTROL_DIR, BRIDGE_MARKER, CONTROL_RUNNER, BRIDGE_RUNNER, HEALTH_TIMEOUT_MS, EVENT_POLL_MS, AsterHotcellRuntime, CELL_FILE_WRITE_CHUNK_CHARS, ARTIFACT_MIME_TYPES;
+var execFileAsync8, CELL_WORKSPACE, CELL_STATE_DIR, CHECKPOINT_MESSAGE_FILE, CELL_RUNTIME_DIR, INSTALLED_RUNTIME_PACKAGE, CELL_RUNTIME_SDK_ENTRY, NOTES_FILE, MEMORY_FILE, MEMORY_EXTRACTION_TIMEOUT_MS, LIVENESS_CHECK_MS, ARTIFACTS_DIR, MAX_ARTIFACTS, MAX_ARTIFACT_BYTES, BRANCH_RE2, REPOSITORY_RE, GIT, COMMIT_SHA_RE, FULL_COMMIT_SHA_RE, LOCAL_CHANGES_PATCH, MAX_TOOL_OUTPUT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_CHECKPOINTS, CELL_CONTROL_DIR, BRIDGE_MARKER, CONTROL_RUNNER, BRIDGE_RUNNER, HEALTH_TIMEOUT_MS, EVENT_POLL_MS, AsterHotcellRuntime, CELL_FILE_WRITE_CHUNK_CHARS, ARTIFACT_MIME_TYPES;
 var init_aster_cell_runtime = __esm({
   "src/server/aster-cell-runtime.ts"() {
     "use strict";
     init_version();
     init_aster_tools();
-    execFileAsync6 = promisify8(execFile10);
+    execFileAsync8 = promisify10(execFile12);
     CELL_WORKSPACE = "/workspace";
     CELL_STATE_DIR = "/workspace/.aster";
     CHECKPOINT_MESSAGE_FILE = `${CELL_STATE_DIR}/checkpoint-message`;
@@ -27519,7 +28438,7 @@ var init_aster_cell_runtime = __esm({
         await this.installRuntime(cell);
         await this.ensureBridge(cell);
         await this.control(cell, "POST", "/rpc", {
-          id: randomUUID12(),
+          id: randomUUID13(),
           type: "new_session",
           sessionId: input.sessionId,
           config: { model: input.model, cwd: CELL_WORKSPACE }
@@ -27538,7 +28457,7 @@ var init_aster_cell_runtime = __esm({
       /** Switch the cell session's model between turns. The bridge persists it for session restore. */
       async setModel(cellId, model) {
         await this.ensureReady(cellId);
-        await this.controlById(cellId, "POST", "/rpc", { id: randomUUID12(), type: "set_model", modelId: model });
+        await this.controlById(cellId, "POST", "/rpc", { id: randomUUID13(), type: "set_model", modelId: model });
       }
       /** Reinstall the runtime if the cell's image lost it and restart the bridge if it isn't running. */
       async ensureReady(cellId) {
@@ -27636,7 +28555,7 @@ var init_aster_cell_runtime = __esm({
         const active = this.activeRuns.get(runId);
         if (!active) return;
         active.stop();
-        void this.controlById(active.cellId, "POST", "/rpc", { id: randomUUID12(), type: "abort" }).catch(() => {
+        void this.controlById(active.cellId, "POST", "/rpc", { id: randomUUID13(), type: "abort" }).catch(() => {
         });
       }
       async runTurn(turn, options = {}) {
@@ -27736,7 +28655,7 @@ ${turn.userText}` : turn.userText;
                   args: event.args ?? {}
                 });
                 await this.controlById(cellId, "POST", "/rpc", {
-                  id: randomUUID12(),
+                  id: randomUUID13(),
                   type: "resolve_permission",
                   requestId: event.requestId,
                   decision
@@ -27917,9 +28836,9 @@ ${turn.userText}` : turn.userText;
         if (!isSafeArtifactPath(path)) throw new Error("invalid_artifact_path");
         const cell = await this.provider.getCell(cellId);
         const file = shellQuote2(`${ARTIFACTS_DIR}/${path}`);
-        const stat14 = await cell.exec(`[ -f ${file} ] && [ ! -L ${file} ] && stat -c %s -- ${file}`);
-        if (stat14.exitCode !== 0) throw new Error("artifact_not_found");
-        if (Number(stat14.stdout.trim()) > MAX_ARTIFACT_BYTES) throw new Error("artifact_too_large");
+        const stat15 = await cell.exec(`[ -f ${file} ] && [ ! -L ${file} ] && stat -c %s -- ${file}`);
+        if (stat15.exitCode !== 0) throw new Error("artifact_not_found");
+        if (Number(stat15.stdout.trim()) > MAX_ARTIFACT_BYTES) throw new Error("artifact_too_large");
         const encoded = await cell.exec(`base64 -w0 -- ${file}`);
         if (encoded.exitCode !== 0) throw new Error("artifact_not_found");
         return { data: Buffer.from(encoded.stdout.trim(), "base64"), mimeType: artifactMimeType(path), name: path.split("/").pop() ?? path };
@@ -27998,7 +28917,7 @@ ${text3}` : text3, { mode: "0600" });
         }
       }
       async control(cell, method, path, body) {
-        const requestId = randomUUID12();
+        const requestId = randomUUID13();
         await cell.mkdir(CELL_CONTROL_DIR, { parents: true });
         await writeCellFileChunked(cell, `${CELL_CONTROL_DIR}/${requestId}.json`, JSON.stringify({ method, path, body }));
         const result2 = await cell.exec(`${CONTROL_RUNNER} ${requestId}`);
@@ -28214,11 +29133,11 @@ var init_hotcell_provider = __esm({
 });
 
 // src/server/routes.ts
-import { randomUUID as randomUUID13 } from "crypto";
-import { hostname } from "os";
+import { randomUUID as randomUUID14 } from "crypto";
+import { hostname as hostname2 } from "os";
 import { URL as URL2 } from "url";
 import { unlink as unlink4 } from "fs/promises";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 function createHotcellAsterRuntime() {
   try {
     const idlePauseMs = Number(process.env.AUTOPILOT_ASTER_IDLE_PAUSE_MS ?? 15 * 60 * 1e3);
@@ -28282,6 +29201,9 @@ function json3(res, status, data) {
 function badRequest(res, message2) {
   json3(res, 400, { error: message2 });
 }
+function promptBlocked(res, reason) {
+  json3(res, 403, { error: "prompt_blocked", reason, message: `prompt blocked by a UserPromptSubmit hook: ${reason}` });
+}
 function notFound(res, message2) {
   json3(res, 404, { error: message2 });
 }
@@ -28301,9 +29223,9 @@ async function resolveFiles2(filePatterns, cwd) {
   const resolved = /* @__PURE__ */ new Set();
   for (const pattern of filePatterns) {
     try {
-      const stat14 = await import("fs/promises").then((m) => m.stat(resolve17(cwd, pattern)));
-      if (stat14.isFile()) {
-        resolved.add(resolve17(cwd, pattern));
+      const stat15 = await import("fs/promises").then((m) => m.stat(resolve18(cwd, pattern)));
+      if (stat15.isFile()) {
+        resolved.add(resolve18(cwd, pattern));
         continue;
       }
     } catch {
@@ -28353,7 +29275,7 @@ function setupRoutes(config2, options = {}) {
     if (!run.sessionId) throw new Error("Cannot restore run without a session id: " + run.id);
     const existing = activeRuns.get(run.id) ?? activeSessions.get(run.sessionId);
     if (existing) return existing;
-    const sessionFile = await loadSession(resolve17(sessionsDir(), run.sessionId + ".json"));
+    const sessionFile = await loadSession(resolve18(sessionsDir(), run.sessionId + ".json"));
     const allowedTools = new Set(run.allowedTools);
     allowedTools.add("wait_for");
     const tools = ALL_TOOLS.filter((tool) => allowedTools.has(tool.name));
@@ -28405,7 +29327,7 @@ function setupRoutes(config2, options = {}) {
     }
   });
   const notificationSettings = notificationSettingsFromConfig(config2);
-  const stopNotifications = notificationSettings ? startNotificationDispatcher(() => new RunStore(), notificationSettings, { host: hostname() }) : () => {
+  const stopNotifications = notificationSettings ? startNotificationDispatcher(() => new RunStore(), notificationSettings, { host: hostname2() }) : () => {
   };
   const imapSettings = notificationSettings?.decisionsReplyTo ? imapSettingsFromEnv() : null;
   const stopDecisions = imapSettings && notificationSettings ? startDecisionPoller(imapSettings, async (mail) => {
@@ -28420,7 +29342,7 @@ function setupRoutes(config2, options = {}) {
         },
         modelExists: (id) => listModels().some((m) => m.id === id),
         confirm: async (to, subject, text3) => {
-          await notificationSettings.transport.send({ to: [to], from: notificationSettings.from, subject, text: text3, idempotencyKey: `confirm_${randomUUID13()}` });
+          await notificationSettings.transport.send({ to: [to], from: notificationSettings.from, subject, text: text3, idempotencyKey: `confirm_${randomUUID14()}` });
         }
       }, { allowedSenders: notificationSettings.to, requireAuthentication: process.env.AUTOPILOT_DECISIONS_REQUIRE_AUTH !== "0" });
     } finally {
@@ -28556,7 +29478,7 @@ function setupRoutes(config2, options = {}) {
         const task = typeof body.task === "string" ? body.task.trim() : "";
         let cwd;
         try {
-          cwd = typeof body.cwd === "string" ? resolve17(body.cwd) : process.cwd();
+          cwd = typeof body.cwd === "string" ? resolve18(body.cwd) : process.cwd();
         } catch {
           badRequest(res, "cwd must be a valid path");
           return;
@@ -28620,7 +29542,7 @@ function setupRoutes(config2, options = {}) {
         const executor = new ToolExecutor(tools);
         const { makeSessionId: makeSessionId2 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
         const sessionId = makeSessionId2(task);
-        const runId = randomUUID13();
+        const runId = randomUUID14();
         const worktreeManager = new RunWorktreeManager();
         let worktree;
         if (useWorktree) {
@@ -28669,7 +29591,7 @@ function setupRoutes(config2, options = {}) {
             store.close();
           }
         } catch (error) {
-          await unlink4(resolve17(sessionsDir(), `${sessionId}.json`)).catch(() => {
+          await unlink4(resolve18(sessionsDir(), `${sessionId}.json`)).catch(() => {
           });
           if (worktree) {
             await worktreeManager.discard(worktree).catch((cleanupError) => {
@@ -28812,7 +29734,7 @@ function setupRoutes(config2, options = {}) {
           return;
         }
         try {
-          const file = await loadSession(resolve17(sessionsDir(), `${sessionId}.json`));
+          const file = await loadSession(resolve18(sessionsDir(), `${sessionId}.json`));
           json3(res, 200, {
             id: file.id,
             cwd: file.cwd,
@@ -28832,7 +29754,7 @@ function setupRoutes(config2, options = {}) {
         activeSessions.delete(sessionId);
         try {
           const { unlink: unlink7 } = await import("fs/promises");
-          await unlink7(resolve17(sessionsDir(), `${sessionId}.json`));
+          await unlink7(resolve18(sessionsDir(), `${sessionId}.json`));
         } catch {
         }
         json3(res, 200, { deleted: sessionId });
@@ -28862,6 +29784,12 @@ function setupRoutes(config2, options = {}) {
           title
         };
         const hooks = new HooksManager(cwd);
+        const gate = await submitUserPrompt({ hooks, sessionId, cwd, prompt, resumed: false, model, auth: llmAuthFromConfig(config2) });
+        if (gate.blocked) {
+          await endSession(sessionId, "exit");
+          promptBlocked(res, gate.reason);
+          return;
+        }
         const executor = new ToolExecutor(ALL_TOOLS, { hooks });
         const messages = [
           {
@@ -28914,6 +29842,19 @@ function setupRoutes(config2, options = {}) {
           badRequest(res, "prompt is required");
           return;
         }
+        const gate = await submitUserPrompt({
+          ...active.hooks ? { hooks: active.hooks } : {},
+          sessionId,
+          cwd: active.sessionFile.cwd,
+          prompt,
+          resumed: active.messages.some((m) => m.role === "assistant"),
+          model: active.sessionFile.model,
+          auth: llmAuthFromConfig(config2)
+        });
+        if (gate.blocked) {
+          promptBlocked(res, gate.reason);
+          return;
+        }
         const resolvedFiles = await resolveFiles2(files, active.sessionFile.cwd);
         const { content: userContent2 } = await buildAttachmentMessage(prompt, resolvedFiles, active.sessionFile.cwd, imageOptions(config2));
         active.messages.push({ role: "user", content: userContent2 });
@@ -29237,6 +30178,7 @@ var init_routes = __esm({
     "use strict";
     init_session_core();
     init_session_lifecycle();
+    init_prompt_submit();
     init_manager2();
     init_exit();
     init_registry();
@@ -29328,7 +30270,7 @@ async function startServer(opts2) {
   server.keepAliveTimeout = 5e3;
   const unregisterShutdown = onShutdown("server", async () => {
     const ended = cleanup();
-    const closed = new Promise((resolve21) => server.close(() => resolve21()));
+    const closed = new Promise((resolve22) => server.close(() => resolve22()));
     server.closeAllConnections();
     await Promise.all([ended, closed]);
   });
@@ -29337,13 +30279,13 @@ async function startServer(opts2) {
     void cleanup();
   });
   installExitHandlers({ signals: ["SIGINT", "SIGTERM"], exitCode: () => 0, crashes: true });
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     server.listen(opts2.port, opts2.hostname, () => {
       logger.info("server: listening", { hostname: opts2.hostname, port: opts2.port });
       console.log(`kimiflare serve: http://${opts2.hostname}:${opts2.port}`);
       console.log(`  API docs: http://${opts2.hostname}:${opts2.port}/doc`);
       console.log(`  SSE stream: http://${opts2.hostname}:${opts2.port}/event`);
-      resolve21(server);
+      resolve22(server);
     });
     server.on("error", reject);
   });
@@ -29677,8 +30619,8 @@ async function runEmitMode(opts2) {
   async function nextFollowUp() {
     if (followUpQueue.length > 0) return followUpQueue.shift();
     if (stdinClosed) return null;
-    return new Promise((resolve21) => {
-      followUpResolver = resolve21;
+    return new Promise((resolve22) => {
+      followUpResolver = resolve22;
     });
   }
   const cwd = process.cwd();
@@ -29708,6 +30650,25 @@ async function runEmitMode(opts2) {
   process.on("SIGINT", sigintHandler);
   async function runTurn(text3) {
     emit("UserMessageCreated", { text: text3 });
+    const gate = await submitUserPrompt({
+      hooks,
+      sessionId,
+      cwd,
+      prompt: text3,
+      resumed: messages.some((m) => m.role === "assistant"),
+      model: opts2.model,
+      auth: llmAuthFromConfig(opts2)
+    });
+    if (gate.blocked) {
+      emit("RuntimeError", {
+        message: `prompt blocked by a UserPromptSubmit hook: ${gate.reason}`,
+        source: "hooks",
+        kind: "generic",
+        severity: "error"
+      });
+      if (!opts2.multiTurn) exitCode = PROMPT_BLOCKED_EXIT_CODE;
+      return;
+    }
     messages.push({ role: "user", content: text3 });
     try {
       const policy = await resolveTurnPolicy({ cfg: opts2, prompt: text3, tools: ALL_TOOLS, signal: controller.signal });
@@ -29830,8 +30791,8 @@ async function runEmitMode(opts2) {
               return fromHook;
             }
             if (opts2.multiTurn) {
-              const choice = await new Promise((resolve21) => {
-                pendingPermissions.set(reqId, resolve21);
+              const choice = await new Promise((resolve22) => {
+                pendingPermissions.set(reqId, resolve22);
               });
               if (choice === "allow" || choice === "allow_session") {
                 emit("PermissionGranted", { request_id: reqId });
@@ -29931,6 +30892,7 @@ var init_emit_mode = __esm({
     init_executor();
     init_errors();
     init_session_lifecycle();
+    init_prompt_submit();
     init_sessions();
   }
 });
@@ -29958,7 +30920,7 @@ async function runAttachMode(opts2) {
   if (!response.ok) {
     const text3 = await response.text().catch(() => "unknown error");
     console.error(`kimiflare attach: ${response.status} ${text3}`);
-    process.exit(1);
+    process.exit(response.status === 403 && text3.includes('"prompt_blocked"') ? PROMPT_BLOCKED_EXIT_CODE : 1);
   }
   const result2 = await response.json();
   const sessionId = result2.sessionId;
@@ -29971,7 +30933,7 @@ async function runAttachMode(opts2) {
 async function streamSse(url, sessionId, format) {
   const eventSource = new EventSource(`${url}/event`);
   let done = false;
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     eventSource.onmessage = (event) => {
       try {
         const data = JSON.parse(event.data);
@@ -30018,7 +30980,7 @@ async function streamSse(url, sessionId, format) {
             done = true;
             eventSource.close();
             if (format === "text") process.stdout.write("\n");
-            resolve21(void 0);
+            resolve22(void 0);
             break;
           case "error":
             done = true;
@@ -30031,7 +30993,7 @@ async function streamSse(url, sessionId, format) {
               process.stdout.write(JSON.stringify({ event: "error", message: data.message }) + "\n");
             }
             process.exitCode = 1;
-            resolve21(void 0);
+            resolve22(void 0);
             break;
         }
       } catch {
@@ -30057,7 +31019,7 @@ async function streamSseJson(url, sessionId) {
   const toolResults = [];
   let usage;
   const eventSource = new EventSource(`${url}/event`);
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     eventSource.onmessage = (event) => {
       try {
         const data = JSON.parse(event.data);
@@ -30094,7 +31056,7 @@ async function streamSseJson(url, sessionId) {
                 2
               ) + "\n"
             );
-            resolve21(void 0);
+            resolve22(void 0);
             break;
           case "error":
             eventSource.close();
@@ -30102,7 +31064,7 @@ async function streamSseJson(url, sessionId) {
               JSON.stringify({ error: data.message, sessionId }, null, 2) + "\n"
             );
             process.exitCode = 1;
-            resolve21(void 0);
+            resolve22(void 0);
             break;
         }
       } catch {
@@ -30122,6 +31084,7 @@ var EventSource;
 var init_attach_mode = __esm({
   "src/attach-mode.ts"() {
     "use strict";
+    init_prompt_submit();
     EventSource = class {
       url;
       controller;
@@ -30279,7 +31242,7 @@ __export(openrouter_oauth_exports, {
 });
 import { createHash as createHash8, randomBytes as randomBytes4 } from "crypto";
 import { createServer as createServer4 } from "http";
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 function createPkce() {
   const verifier = randomBytes4(32).toString("base64url");
   return { verifier, challenge: pkceChallenge(verifier) };
@@ -30291,7 +31254,7 @@ function openRouterAuthPageUrl() {
   return (process.env.OPENROUTER_AUTH_URL?.trim() || "https://openrouter.ai/auth").replace(/\/+$/, "");
 }
 function defaultKeyLabel() {
-  return `autopilot (${hostname2()})`.slice(0, 60);
+  return `autopilot (${hostname3()})`.slice(0, 60);
 }
 function buildAuthUrl(opts2) {
   const params = new URLSearchParams();
@@ -30368,9 +31331,9 @@ async function startLoopbackListener(opts2 = {}) {
     rejectCode(e);
     finish();
   }
-  await new Promise((resolve21, reject) => {
+  await new Promise((resolve22, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve21());
+    server.listen(0, "127.0.0.1", () => resolve22());
   });
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : 0;
@@ -30517,11 +31480,11 @@ async function chatgptSignIn(onUrl, signal) {
 }
 function untilAborted(p, signal) {
   if (!signal) return p;
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     const abort = () => reject(new DOMException("sign-in cancelled", "AbortError"));
     if (signal.aborted) return abort();
     signal.addEventListener("abort", abort, { once: true });
-    p.then(resolve21, reject).finally(() => signal.removeEventListener("abort", abort));
+    p.then(resolve22, reject).finally(() => signal.removeEventListener("abort", abort));
   });
 }
 async function openRouterSignIn(io) {
@@ -30767,20 +31730,20 @@ var init_help_catalog = __esm({
 
 // src/ui/bang-command.ts
 import { spawn as spawn8 } from "child_process";
-import { mkdtemp as mkdtemp3, readFile as readFile34, rm as rm7 } from "fs/promises";
-import { tmpdir as tmpdir5, platform as platform5 } from "os";
-import { join as join47 } from "path";
+import { mkdtemp as mkdtemp4, readFile as readFile36, rm as rm8 } from "fs/promises";
+import { tmpdir as tmpdir6, platform as platform5 } from "os";
+import { join as join49 } from "path";
 function registerTerminalHandoff(h) {
   terminalHandoff = h;
 }
 function runCaptured(inv, cwd) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const child = spawn8(inv.file, inv.args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: inv.env ?? process.env });
     let output = "";
     child.stdout?.on("data", (c) => output += c.toString("utf8"));
     child.stderr?.on("data", (c) => output += c.toString("utf8"));
-    child.once("error", (e) => resolve21({ code: 127, signal: null, output: `failed to start: ${e.message}` }));
-    child.once("exit", (code, signal) => resolve21({ code, signal, output }));
+    child.once("error", (e) => resolve22({ code: 127, signal: null, output: `failed to start: ${e.message}` }));
+    child.once("exit", (code, signal) => resolve22({ code, signal, output }));
   });
 }
 function isTerminalHandedOff() {
@@ -30848,10 +31811,10 @@ function swallow() {
   });
 }
 function spawnInherit(inv, cwd) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve22, reject) => {
     const child = spawn8(inv.file, inv.args, { cwd, stdio: "inherit", env: inv.env ?? process.env });
     child.once("error", reject);
-    child.once("exit", (code, signal) => resolve21({ code, signal }));
+    child.once("exit", (code, signal) => resolve22({ code, signal }));
   });
 }
 async function runBangCommand(command, cwd) {
@@ -30869,8 +31832,8 @@ async function runBangCommand(command, cwd) {
   const origErr = stderr.write;
   const readable = stdin.listeners("readable");
   const wasRaw = stdin.isTTY ? stdin.isRaw : false;
-  const logDir2 = isWindows ? null : await mkdtemp3(join47(tmpdir5(), "autopilot-bang-"));
-  const logPath = logDir2 ? join47(logDir2, "out.log") : null;
+  const logDir2 = isWindows ? null : await mkdtemp4(join49(tmpdir6(), "autopilot-bang-"));
+  const logPath = logDir2 ? join49(logDir2, "out.log") : null;
   const viaScript = logPath ? scriptInvocation(command, shell, logPath) : null;
   origOut.call(stdout, `
 $ ${command}
@@ -30911,9 +31874,9 @@ $ ${command}
   }
   let output = spawnError ? `failed to start: ${spawnError}` : null;
   if (captured && logPath) {
-    output = cleanTerminalOutput(await readFile34(logPath, "utf8").catch(() => ""));
+    output = cleanTerminalOutput(await readFile36(logPath, "utf8").catch(() => ""));
   }
-  if (logDir2) await rm7(logDir2, { recursive: true, force: true }).catch(() => {
+  if (logDir2) await rm8(logDir2, { recursive: true, force: true }).catch(() => {
   });
   return { command, exitCode: result2.code, signal: result2.signal, output };
 }
@@ -31150,8 +32113,8 @@ function activityFromSubagent(worker) {
   };
 }
 function activityTaskPreview(task) {
-  const oneLine2 = task.replace(/\s+/g, " ").trim();
-  return oneLine2.length > 72 ? `${oneLine2.slice(0, 71)}\u2026` : oneLine2;
+  const oneLine3 = task.replace(/\s+/g, " ").trim();
+  return oneLine3.length > 72 ? `${oneLine3.slice(0, 71)}\u2026` : oneLine3;
 }
 function diffActivityItems(previous, current, snapshotSent) {
   if (!snapshotSent) return [{ type: "ActivitySnapshot", payload: { items: [...current] } }];
@@ -31188,14 +32151,14 @@ __export(camouflage_launch_exports, {
   runWithCrashRestarts: () => runWithCrashRestarts
 });
 import { accessSync, constants, existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
-import { homedir as homedir30 } from "os";
-import { delimiter, dirname as dirname24, isAbsolute as isAbsolute8, join as join48, resolve as resolve18, sep as sep7 } from "path";
+import { homedir as homedir31 } from "os";
+import { delimiter, dirname as dirname25, isAbsolute as isAbsolute8, join as join50, resolve as resolve19, sep as sep7 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function defaultPackageDir() {
   try {
-    let dir = dirname24(fileURLToPath5(import.meta.resolve("camouflage-tui")));
-    while (!existsSync14(join48(dir, "package.json")) && dirname24(dir) !== dir) dir = dirname24(dir);
-    return existsSync14(join48(dir, "package.json")) ? dir : null;
+    let dir = dirname25(fileURLToPath5(import.meta.resolve("camouflage-tui")));
+    while (!existsSync14(join50(dir, "package.json")) && dirname25(dir) !== dir) dir = dirname25(dir);
+    return existsSync14(join50(dir, "package.json")) ? dir : null;
   } catch {
     return null;
   }
@@ -31209,11 +32172,11 @@ function defaultIsExecutable(path) {
   }
 }
 function findOnPath(bin, env, platform7, isExecutable) {
-  if (isAbsolute8(bin) || bin.includes("/") || bin.includes(sep7)) return isExecutable(resolve18(bin));
+  if (isAbsolute8(bin) || bin.includes("/") || bin.includes(sep7)) return isExecutable(resolve19(bin));
   const exts = platform7 === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
   for (const dir of (env.PATH ?? "").split(delimiter)) {
     if (!dir) continue;
-    for (const ext of exts) if (isExecutable(join48(dir, bin + ext))) return true;
+    for (const ext of exts) if (isExecutable(join50(dir, bin + ext))) return true;
   }
   return false;
 }
@@ -31222,21 +32185,21 @@ function diagnoseRenderer(deps = {}) {
   const platform7 = deps.platform ?? process.platform;
   const arch = deps.arch ?? process.arch;
   const isExecutable = deps.isExecutable ?? defaultIsExecutable;
-  const readFile40 = deps.readFile ?? ((p) => readFileSync9(p, "utf8"));
+  const readFile42 = deps.readFile ?? ((p) => readFileSync9(p, "utf8"));
   const packageDir = (deps.packageDir ?? defaultPackageDir)();
   let packageVersion = null;
   let packageBin = null;
   if (packageDir) {
     try {
-      packageVersion = JSON.parse(readFile40(join48(packageDir, "package.json"))).version ?? null;
+      packageVersion = JSON.parse(readFile42(join50(packageDir, "package.json"))).version ?? null;
     } catch {
     }
-    packageBin = join48(packageDir, "bin", platform7 === "win32" ? "camouflage-tui.exe" : "camouflage-tui");
+    packageBin = join50(packageDir, "bin", platform7 === "win32" ? "camouflage-tui.exe" : "camouflage-tui");
   }
-  const installErrorPath = join48(deps.home ?? homedir30(), ".camouflage", "install-error.txt");
+  const installErrorPath = join50(deps.home ?? homedir31(), ".camouflage", "install-error.txt");
   let installError = null;
   try {
-    installError = readFile40(installErrorPath).trim() || null;
+    installError = readFile42(installErrorPath).trim() || null;
   } catch {
   }
   const envBin = env.CAMOUFLAGE_BIN || null;
@@ -31283,7 +32246,7 @@ function formatUnavailable(d, reason) {
   if (d.envBin) lines.push(`  - point CAMOUFLAGE_BIN at an existing camouflage-tui binary, or unset it to use the bundled one`);
   if (d.packageDir) {
     lines.push(
-      `  - download the renderer again:  node "${join48(d.packageDir, "scripts", "install.js")}"`,
+      `  - download the renderer again:  node "${join50(d.packageDir, "scripts", "install.js")}"`,
       `    (or run \`npm rebuild camouflage-tui\` where autopilot-ai is installed; \`npm rebuild -g camouflage-tui\` for a global install)`
     );
   }
@@ -31332,7 +32295,7 @@ async function runWithCrashRestarts(run, opts2 = {}) {
 function crashGiveUpMessage(outcome, windowMs = 6e4) {
   const lines = [
     `autopilot: the Camouflage renderer crashed ${outcome.crashes} times within ${Math.round(windowMs / 1e3)} seconds, so autopilot stopped restarting it.`,
-    `Crash reports: ${join48(homedir30(), ".camouflage")} (crash-*.txt). Please attach one to an issue: https://github.com/sinameraji/autopilot/issues`
+    `Crash reports: ${join50(homedir31(), ".camouflage")} (crash-*.txt). Please attach one to an issue: https://github.com/sinameraji/autopilot/issues`
   ];
   if (outcome.sessionId) {
     lines.push(
@@ -31414,11 +32377,11 @@ __export(interactive_resume_exports, {
   resumeHint: () => resumeHint
 });
 import { existsSync as existsSync15 } from "fs";
-import { join as join49 } from "path";
+import { join as join51 } from "path";
 async function resolveInteractiveResume(req, cwd = process.cwd()) {
   if (req.sessionId !== void 0) {
     const id = req.sessionId.trim().replace(/\.json$/, "");
-    if (!SESSION_ID.test(id) || !existsSync15(join49(sessionsDir(), `${id}.json`))) {
+    if (!SESSION_ID.test(id) || !existsSync15(join51(sessionsDir(), `${id}.json`))) {
       return { kind: "error", message: `no saved conversation with id "${req.sessionId}". Run \`autopilot resume\` to pick one.` };
     }
     return { kind: "session", sessionId: id };
@@ -31431,7 +32394,7 @@ async function resolveInteractiveResume(req, cwd = process.cwd()) {
   return { kind: "picker" };
 }
 function resumeHint(sessionId) {
-  if (!sessionId || !SESSION_ID.test(sessionId) || !existsSync15(join49(sessionsDir(), `${sessionId}.json`))) return null;
+  if (!sessionId || !SESSION_ID.test(sessionId) || !existsSync15(join51(sessionsDir(), `${sessionId}.json`))) return null;
   return `Resume this conversation with: autopilot resume ${sessionId}
 `;
 }
@@ -31471,8 +32434,8 @@ __export(camouflage_view_exports, {
 import { execFileSync as execFileSync4, spawn as spawn9 } from "child_process";
 import { readdir as readdir7 } from "fs/promises";
 import { existsSync as existsSync16, readFileSync as readFileSync10 } from "fs";
-import { homedir as homedir31 } from "os";
-import { dirname as dirname25, join as join50, resolve as resolve19 } from "path";
+import { homedir as homedir32 } from "os";
+import { dirname as dirname26, join as join52, resolve as resolve20 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function noticeSeverity(e) {
   return e.kind === "info" && e.tone === "warn" ? "warn" : "info";
@@ -31493,10 +32456,10 @@ function rendererInfo(env = process.env) {
   let packageVersion = null;
   let packageBin = "camouflage-tui";
   try {
-    let dir = dirname25(fileURLToPath6(import.meta.resolve("camouflage-tui")));
-    while (!existsSync16(join50(dir, "package.json")) && dirname25(dir) !== dir) dir = dirname25(dir);
-    packageVersion = JSON.parse(readFileSync10(join50(dir, "package.json"), "utf8")).version ?? null;
-    const local = join50(dir, "bin", process.platform === "win32" ? "camouflage-tui.exe" : "camouflage-tui");
+    let dir = dirname26(fileURLToPath6(import.meta.resolve("camouflage-tui")));
+    while (!existsSync16(join52(dir, "package.json")) && dirname26(dir) !== dir) dir = dirname26(dir);
+    packageVersion = JSON.parse(readFileSync10(join52(dir, "package.json"), "utf8")).version ?? null;
+    const local = join52(dir, "bin", process.platform === "win32" ? "camouflage-tui.exe" : "camouflage-tui");
     packageBin = local;
   } catch {
   }
@@ -31624,7 +32587,7 @@ async function runCamouflageView(opts2) {
       if (process.stdin.isTTY) process.stdin.setRawMode?.(false);
       process.stderr.write(
         `
-The Camouflage renderer stopped unexpectedly (${signal ?? `exit code ${code}`}). Its crash report is in ${join50(homedir31(), ".camouflage")} (crash-*.txt).
+The Camouflage renderer stopped unexpectedly (${signal ?? `exit code ${code}`}). Its crash report is in ${join52(homedir32(), ".camouflage")} (crash-*.txt).
 ` + (view.busy ? "Finishing the current turn first\u2026\n" : "")
       );
       await view.settle();
@@ -31635,7 +32598,7 @@ The Camouflage renderer stopped unexpectedly (${signal ?? `exit code ${code}`}).
   let endBeforeApp = () => {
   };
   let quitBeforeApp = false;
-  const beforeApp = new Promise((resolve21) => endBeforeApp = resolve21);
+  const beforeApp = new Promise((resolve22) => endBeforeApp = resolve22);
   let setup = null;
   try {
     let cfg = opts2.cfg;
@@ -31680,14 +32643,14 @@ The Camouflage renderer stopped unexpectedly (${signal ?? `exit code ${code}`}).
   return "done";
 }
 function runShell2(command) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const { shell, args } = getShellCommand();
     const child = spawn9(shell, [...args, command], { env: process.env });
     let out = "";
     child.stdout?.on("data", (c) => out += c.toString("utf8"));
     child.stderr?.on("data", (c) => out += c.toString("utf8"));
-    child.on("close", (code) => resolve21({ ok: code === 0, output: out || (code === 0 ? "" : `Exit code: ${code}`) }));
-    child.on("error", (err) => resolve21({ ok: false, output: err.message }));
+    child.on("close", (code) => resolve22({ ok: code === 0, output: out || (code === 0 ? "" : `Exit code: ${code}`) }));
+    child.on("error", (err) => resolve22({ ok: false, output: err.message }));
   });
 }
 function syncSlashCommands(custom, lastKey, send) {
@@ -31770,8 +32733,8 @@ function truncateText(s, max) {
 async function listMentionDir(cwd, query) {
   const exact = query === "~" || query === "." || query === ".." || query.endsWith("/..");
   const dir = exact ? `${query}/` : query.slice(0, query.lastIndexOf("/") + 1);
-  const expanded = dir.startsWith("~") ? join50(homedir31(), dir.slice(1)) : dir;
-  const target = resolve19(cwd, expanded || ".");
+  const expanded = dir.startsWith("~") ? join52(homedir32(), dir.slice(1)) : dir;
+  const target = resolve20(cwd, expanded || ".");
   try {
     const items = await readdir7(target, { withFileTypes: true });
     const entries = items.filter((d) => !d.name.startsWith(".")).map((d) => ({ name: d.name, isDir: d.isDirectory() })).sort((a, b) => a.isDir !== b.isDir ? a.isDir ? -1 : 1 : a.name.localeCompare(b.name)).slice(0, 300).map((d) => `${dir}${d.name}${d.isDir ? "/" : ""}`);
@@ -31910,7 +32873,7 @@ function shortModel(id) {
   return id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
 }
 function shortPath(p) {
-  const home = homedir31();
+  const home = homedir32();
   return p === home ? "~" : p.startsWith(home + "/") ? `~${p.slice(home.length)}` : p;
 }
 function gitBranch(cwd) {
@@ -32032,15 +32995,15 @@ var init_camouflage_view = __esm({
       /** Resolves once the App is idle (no turn running). */
       settle(maxWaitMs = 12e4) {
         if (!this.busy) return Promise.resolve();
-        return new Promise((resolve21) => {
-          this.idleWaiters.push(resolve21);
-          setTimeout(resolve21, maxWaitMs).unref();
+        return new Promise((resolve22) => {
+          this.idleWaiters.push(resolve22);
+          setTimeout(resolve22, maxWaitMs).unref();
         });
       }
       sync(s) {
         this.busy = s.turnRunning;
         this.sessionId = s.sessionId;
-        if (!s.turnRunning) for (const resolve21 of this.idleWaiters.splice(0)) resolve21();
+        if (!s.turnRunning) for (const resolve22 of this.idleWaiters.splice(0)) resolve22();
         if (this.disposed) {
           if (s.permission) this.actions?.decidePermission("deny");
           return;
@@ -32337,7 +33300,7 @@ var init_camouflage_view = __esm({
        */
       async denyFeedback(given, escaped) {
         if (given?.trim()) return given.trim();
-        await new Promise((resolve21) => setTimeout(resolve21, 50));
+        await new Promise((resolve22) => setTimeout(resolve22, 50));
         if (escaped() || this.disposed) return "";
         const r = await this.sdk.form(this.cam, {
           id: `deny-${Date.now()}`,
@@ -33447,9 +34410,9 @@ function usePermissionController(getMode, onPlanModeBlocked) {
   const askPermission = useCallback(
     (req, askOpts) => resolvePermission(req, getModeRef.current(), askOpts, {
       onPlanModeBlocked: (toolName) => onPlanModeBlockedRef.current(toolName),
-      prompt: () => new Promise((resolve21) => {
-        resolveRef.current = resolve21;
-        setPending({ tool: req.tool, args: req.args, resolve: resolve21 });
+      prompt: () => new Promise((resolve22) => {
+        resolveRef.current = resolve22;
+        setPending({ tool: req.tool, args: req.args, resolve: resolve22 });
       })
     }),
     []
@@ -33830,14 +34793,14 @@ var init_frontmatter = __esm({
 
 // src/commands/loader.ts
 import { open as open2, realpath as realpath9 } from "fs/promises";
-import { homedir as homedir32 } from "os";
-import { join as join51, relative as relative11, sep as sep8 } from "path";
+import { homedir as homedir33 } from "os";
+import { join as join53, relative as relative11, sep as sep8 } from "path";
 function projectCommandsDir(cwd = process.cwd()) {
-  return join51(cwd, ".kimiflare", "commands");
+  return join53(cwd, ".kimiflare", "commands");
 }
 function globalCommandsDir() {
-  const xdg = process.env.XDG_CONFIG_HOME || join51(homedir32(), ".config");
-  return join51(xdg, "kimiflare", "commands");
+  const xdg = process.env.XDG_CONFIG_HOME || join53(homedir33(), ".config");
+  return join53(xdg, "kimiflare", "commands");
 }
 async function loadCustomCommands(cwd = process.cwd()) {
   const warnings = [];
@@ -33991,7 +34954,7 @@ var init_loader = __esm({
 import { exec } from "child_process";
 import { open as open3, realpath as realpath10 } from "fs/promises";
 import { isAbsolute as isAbsolute9, relative as relative12, resolve as resolvePathJoin, basename as pathBasename } from "path";
-import { promisify as promisify9 } from "util";
+import { promisify as promisify11 } from "util";
 function tokenizeArgs(s) {
   return [...s.matchAll(ARG_TOKEN_RE)].map((match) => {
     const token = match[0];
@@ -34144,7 +35107,7 @@ var init_renderer2 = __esm({
   "src/commands/renderer.ts"() {
     "use strict";
     init_paths();
-    execAsync = promisify9(exec);
+    execAsync = promisify11(exec);
     ARG_TOKEN_RE = /(?:"[^"]*"|'[^']*'|[^\s"']+)/g;
     POSITIONAL_RE = /\$(\d+)/g;
     HAS_POSITIONAL = /\$\d+/;
@@ -34453,6 +35416,9 @@ Rules:
 
 // src/ui/use-session-manager.ts
 import React, { useCallback as useCallback2, useRef as useRef2, useState as useState4 } from "react";
+function sessionNameText(messages, firstPrompt) {
+  return firstPrompt?.trim() || extractFirstUserText(messages);
+}
 function extractFirstUserText(messages) {
   const firstUser = messages.find((m) => m.role === "user");
   if (!firstUser) return "session";
@@ -34485,9 +35451,9 @@ function useSessionManager(deps) {
   const [checkpointList, setCheckpointList] = useState4([]);
   const depsRef = useRef2(deps);
   depsRef.current = deps;
-  const ensureSessionId = useCallback2(() => {
+  const ensureSessionId = useCallback2((firstPrompt) => {
     if (sessionIdRef.current) return sessionIdRef.current;
-    const text3 = extractFirstUserText(depsRef.current.messagesRef.current);
+    const text3 = sessionNameText(depsRef.current.messagesRef.current, firstPrompt);
     sessionIdRef.current = makeSessionId(text3);
     setLogSessionId(sessionIdRef.current);
     return sessionIdRef.current;
@@ -34986,8 +35952,8 @@ var init_terminal_qr = __esm({
 
 // src/agent/jev-context.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { readFile as readFile35 } from "fs/promises";
-import { basename as basename11, join as join52, resolve as resolve20 } from "path";
+import { readFile as readFile37 } from "fs/promises";
+import { basename as basename11, join as join54, resolve as resolve21 } from "path";
 function messageText(message2) {
   if (typeof message2.content === "string") return message2.content.trim();
   if (!Array.isArray(message2.content)) return "";
@@ -35004,12 +35970,12 @@ function projectRoot(cwd) {
       timeout: 1e3
     }).trim();
   } catch {
-    return resolve20(cwd);
+    return resolve21(cwd);
   }
 }
 async function readPackageMetadata(root) {
   try {
-    const parsed = JSON.parse(await readFile35(join52(root, "package.json"), "utf8"));
+    const parsed = JSON.parse(await readFile37(join54(root, "package.json"), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const pkg = parsed;
     const metadata = {};
@@ -35026,7 +35992,7 @@ async function readPackageMetadata(root) {
 async function readLicenseEvidence(root) {
   for (const name of ["LICENSE", "LICENSE.md", "LICENSE.txt", "LICENCE", "COPYING"]) {
     try {
-      const content = (await readFile35(join52(root, name), "utf8")).trim();
+      const content = (await readFile37(join54(root, name), "utf8")).trim();
       if (content) return { source: `project license (${name})`, content: content.slice(0, 700) };
     } catch {
     }
@@ -35059,7 +36025,7 @@ async function buildJevContext(question, messages, cwd = process.cwd()) {
       conversationRemaining -= source.length + content.length + 2;
     }
   }
-  const currentDirectory = basename11(resolve20(cwd));
+  const currentDirectory = basename11(resolve21(cwd));
   const escapedDirectory = currentDirectory.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const namesCurrentDirectory = currentDirectory.length >= 5 && !/^(?:agent|app|code|lib|project|repo|src|test|tests|workspace)$/i.test(currentDirectory) && new RegExp(`\\b${escapedDirectory}\\b`, "i").test(question);
   if (CURRENT_PROJECT_REFERENCE.test(question) || namesCurrentDirectory) {
@@ -35282,8 +36248,8 @@ var init_frontmatter2 = __esm({
 });
 
 // src/skills/loader.ts
-import { readFile as readFile36, readdir as readdir8, stat as stat12 } from "fs/promises";
-import { join as join53, extname } from "path";
+import { readFile as readFile38, readdir as readdir8, stat as stat13 } from "fs/promises";
+import { join as join55, extname } from "path";
 function normalizeManifest(raw, filePath) {
   const name = typeof raw.name === "string" ? raw.name : "";
   const description = typeof raw.description === "string" ? raw.description : "";
@@ -35297,7 +36263,7 @@ function normalizeManifest(raw, filePath) {
   return { name, description, match, scope, priority, enabled: enabled2 };
 }
 async function loadSkillFile(filePath) {
-  const raw = await readFile36(filePath, "utf-8");
+  const raw = await readFile38(filePath, "utf-8");
   const parsed = parseFrontmatter2(raw);
   const manifest = normalizeManifest(parsed.data, filePath);
   const body = parsed.content.trim();
@@ -35319,8 +36285,8 @@ async function loadSkillsFromDir(dirPath) {
     const entries = await readdir8(dirPath);
     const files = [];
     for (const entry of entries) {
-      const full = join53(dirPath, entry);
-      const s = await stat12(full);
+      const full = join55(dirPath, entry);
+      const s = await stat13(full);
       if (s.isFile() && extname(entry) === ".md") {
         files.push(full);
       }
@@ -35347,12 +36313,12 @@ var init_loader2 = __esm({
 });
 
 // src/skills/manager.ts
-import { mkdir as mkdir20, writeFile as writeFile17, unlink as unlink5, readFile as readFile37 } from "fs/promises";
-import { join as join54 } from "path";
+import { mkdir as mkdir21, writeFile as writeFile18, unlink as unlink5, readFile as readFile39 } from "fs/promises";
+import { join as join56 } from "path";
 function getSkillDirs(cwd) {
   return {
-    projectDir: join54(cwd, ".kimiflare", "skills"),
-    globalDir: join54(process.env.HOME ?? "", ".config", "kimiflare", "skills")
+    projectDir: join56(cwd, ".kimiflare", "skills"),
+    globalDir: join56(process.env.HOME ?? "", ".config", "kimiflare", "skills")
   };
 }
 async function listAllSkills(cwd) {
@@ -35366,7 +36332,7 @@ async function listAllSkills(cwd) {
 async function createSkill(opts2) {
   const dirs = getSkillDirs(opts2.cwd);
   const dir = opts2.scope === "project" ? dirs.projectDir : dirs.globalDir;
-  const filepath = join54(dir, `${opts2.name}.md`);
+  const filepath = join56(dir, `${opts2.name}.md`);
   const frontmatter = {
     name: opts2.name,
     enabled: true,
@@ -35387,8 +36353,8 @@ ${yaml}
 
 Add your instructions here.
 `;
-  await mkdir20(dir, { recursive: true });
-  await writeFile17(filepath, content, "utf8");
+  await mkdir21(dir, { recursive: true });
+  await writeFile18(filepath, content, "utf8");
   return { filepath };
 }
 async function deleteSkill(name, cwd) {
@@ -35402,7 +36368,7 @@ async function setSkillEnabled(name, enabled2, cwd) {
   const all = await listAllSkills(cwd);
   const skill = all.project.find((s) => s.name === name) ?? all.global.find((s) => s.name === name);
   if (!skill) throw new Error(`skill "${name}" not found`);
-  const raw = await readFile37(skill.filePath, "utf-8");
+  const raw = await readFile39(skill.filePath, "utf-8");
   const parsed = parseFrontmatter2(raw);
   parsed.data.enabled = enabled2;
   const yaml = Object.entries(parsed.data).map(([k, v]) => {
@@ -35414,7 +36380,7 @@ ${v.map((item) => `  - ${item}`).join("\n")}`;
 ${yaml}
 ---
 ${parsed.content}`;
-  await writeFile17(skill.filePath, content, "utf8");
+  await writeFile18(skill.filePath, content, "utf8");
   return { filepath: skill.filePath };
 }
 async function findSkillFile(name, cwd) {
@@ -35495,15 +36461,15 @@ var tui_report_exports = {};
 __export(tui_report_exports, {
   getCategoryReportText: () => getCategoryReportText
 });
-import { readFile as readFile38 } from "fs/promises";
-import { join as join55 } from "path";
-import { homedir as homedir33 } from "os";
+import { readFile as readFile40 } from "fs/promises";
+import { join as join57 } from "path";
+import { homedir as homedir34 } from "os";
 function usageDir3() {
-  const xdg = process.env.XDG_DATA_HOME || join55(homedir33(), ".local", "share");
-  return join55(xdg, "kimiflare");
+  const xdg = process.env.XDG_DATA_HOME || join57(homedir34(), ".local", "share");
+  return join57(xdg, "kimiflare");
 }
 function usagePath4() {
-  return join55(usageDir3(), "usage.json");
+  return join57(usageDir3(), "usage.json");
 }
 function today3() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -35515,7 +36481,7 @@ function daysAgo2(n) {
 }
 async function loadLog3() {
   try {
-    const raw = await readFile38(usagePath4(), "utf8");
+    const raw = await readFile40(usagePath4(), "utf8");
     return JSON.parse(raw);
   } catch {
     return { version: 1, days: [], sessions: [] };
@@ -35572,7 +36538,7 @@ var init_tui_report = __esm({
 });
 
 // src/ui/slash-commands.ts
-import { join as join56 } from "path";
+import { join as join58 } from "path";
 function executeFreshStart(ctx, planText, overrideMode, opts2 = {}) {
   const oldSessionId = ctx.sessionIdRef.current;
   if (ctx.cacheStableRef.current && ctx.messagesRef.current.length >= 2) {
@@ -35624,7 +36590,7 @@ function formatRunningSubagents(now2 = Date.now()) {
   if (workers.length === 0) return "no subagents running";
   return [
     `${workers.length} subagent${workers.length === 1 ? "" : "s"} running:`,
-    ...workers.map((w) => `  #${w.index}  ${formatElapsed2(now2 - w.startedAt)}  ${w.status === "cancelling" ? "(cancelling) " : ""}${oneLine(w.task, 90)}`),
+    ...workers.map((w) => `  #${w.index}  ${formatElapsed2(now2 - w.startedAt)}  ${w.status === "cancelling" ? "(cancelling) " : ""}${oneLine2(w.task, 90)}`),
     "cancel one with /subagents cancel <n>, or all with /subagents cancel all \u2014 the turn keeps going"
   ].join("\n");
 }
@@ -35637,7 +36603,7 @@ function cancelSubagents(target) {
   const ref = target.replace(/^#/, "");
   const cancelled = workerRegistry.cancel(/^\d+$/.test(ref) ? Number(ref) : ref);
   if (!cancelled) return `no running subagent #${ref} (see /subagents list)`;
-  return `cancelling subagent #${cancelled.index} (${oneLine(cancelled.task, 60)}); the turn continues`;
+  return `cancelling subagent #${cancelled.index} (${oneLine2(cancelled.task, 60)}); the turn continues`;
 }
 function formatElapsed2(ms) {
   const total = Math.max(0, Math.floor(ms / 1e3));
@@ -35645,7 +36611,7 @@ function formatElapsed2(ms) {
   const sec = total % 60;
   return m > 0 ? `${m}m${String(sec).padStart(2, "0")}s` : `${sec}s`;
 }
-function oneLine(text3, max) {
+function oneLine2(text3, max) {
   const single = text3.replace(/\s+/g, " ").trim();
   return single.length > max ? `${single.slice(0, max - 1)}\u2026` : single;
 }
@@ -36044,7 +37010,7 @@ auto (default) lets the coordinator assess substantial tasks and delegate indepe
         const context = noContext ? [] : await buildJevContext(question.prompt, ctx.messagesRef.current, process.cwd());
         const receipt = formatJevContextReceipt(context, showContext);
         setResult(eventKey, { kind: "info", key: eventKey, text: `Jev is evaluating \xB7 ${receipt}`, pending: true });
-        await new Promise((resolve21) => setTimeout(resolve21, 0));
+        await new Promise((resolve22) => setTimeout(resolve22, 0));
         const answer = await askJev(apiKey, question, { context });
         const presentation = presentJevAnswer(question, answer);
         setResult(eventKey, {
@@ -36542,7 +37508,7 @@ ${lines.join("\n")}` }]);
         void (async () => {
           try {
             const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-            const file = await loadSession(join56(sessionsDir3(), `${currentId}.json`));
+            const file = await loadSession(join58(sessionsDir3(), `${currentId}.json`));
             const cps = file.checkpoints ?? [];
             if (cps.length === 0) {
               setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: "no checkpoints in this session" }]);
@@ -36587,7 +37553,7 @@ ${lines.join("\n")}` }]);
         try {
           ctx.ensureSessionId();
           const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-          const filePath = join56(sessionsDir3(), `${ctx.sessionIdRef.current}.json`);
+          const filePath = join58(sessionsDir3(), `${ctx.sessionIdRef.current}.json`);
           await addCheckpoint(filePath, cp);
           setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: `checkpoint saved: "${label}"` }]);
         } catch (e) {
@@ -37087,12 +38053,12 @@ also read (legacy): ${legacyGlobalSettingsPath()}, ${legacyProjectSettingsPath(c
 
 // src/init/context-generator.ts
 import { existsSync as existsSync17, statSync as statSync6 } from "fs";
-import { join as join57 } from "path";
+import { join as join59 } from "path";
 function detectFlavor(cwd) {
   for (const [flavor, signatures] of Object.entries(FLAVOR_SIGNATURES)) {
     if (flavor === "generic") continue;
     for (const sig of signatures) {
-      const path = join57(cwd, sig);
+      const path = join59(cwd, sig);
       if (sig.includes("*")) {
         try {
           const parts = sig.split("*");
@@ -37113,14 +38079,14 @@ function detectFlavor(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (existsSync17(join57(cwd, c))) return c;
+    if (existsSync17(join59(cwd, c))) return c;
   }
   return null;
 }
 function findSourceRoots(cwd) {
   const roots = [];
   for (const r of SOURCE_ROOT_CANDIDATES) {
-    const p = join57(cwd, r);
+    const p = join59(cwd, r);
     try {
       const s = statSync6(p);
       if (s.isDirectory()) roots.push(r);
@@ -37131,9 +38097,9 @@ function findSourceRoots(cwd) {
 }
 function findCiConfig(cwd) {
   for (const c of CI_PATHS) {
-    if (existsSync17(join57(cwd, c))) {
+    if (existsSync17(join59(cwd, c))) {
       try {
-        const s = statSync6(join57(cwd, c));
+        const s = statSync6(join59(cwd, c));
         return s.isDirectory() ? c : c;
       } catch {
       }
@@ -37270,7 +38236,7 @@ function analyzeProject(cwd) {
     ciConfig: findCiConfig(cwd),
     readme: findFile(cwd, ["README.md", "README.rst", "README.txt", "Readme.md"]),
     sourceRoots: findSourceRoots(cwd),
-    hasGit: existsSync17(join57(cwd, ".git"))
+    hasGit: existsSync17(join59(cwd, ".git"))
   };
 }
 function bashDiscoveryCommands(profile) {
@@ -37445,7 +38411,7 @@ function buildInitTasks(targetFilename) {
 }
 function buildInitPrompt(cwd) {
   const existingName = ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].find(
-    (n) => existsSync17(join57(cwd, n))
+    (n) => existsSync17(join59(cwd, n))
   );
   const isRefresh = existingName !== void 0;
   const targetFilename = existingName ?? "AGENTS.md";
@@ -37533,7 +38499,7 @@ var init_context_generator = __esm({
 
 // src/init/run-init.ts
 import { existsSync as existsSync18 } from "fs";
-import { join as join58 } from "path";
+import { join as join60 } from "path";
 async function runInit(deps) {
   const {
     cfg,
@@ -37629,7 +38595,7 @@ async function runInit(deps) {
           lspManagerRef.current.notifyChange(path, content);
         } else {
           void import("fs/promises").then(
-            ({ readFile: readFile40 }) => readFile40(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
+            ({ readFile: readFile42 }) => readFile42(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
             })
           );
         }
@@ -37730,7 +38696,7 @@ async function runInit(deps) {
         }
       }
     } }));
-    if (existsSync18(join58(cwd, targetFilename))) {
+    if (existsSync18(join60(cwd, targetFilename))) {
       if (cacheStableRef.current) {
         messagesRef.current[1] = {
           role: "system",
@@ -37824,11 +38790,11 @@ var init_run_init = __esm({
 });
 
 // src/skills/discovery.ts
-import { readdir as readdir9, stat as stat13, readFile as readFile39 } from "fs/promises";
-import { join as join59, extname as extname2 } from "path";
+import { readdir as readdir9, stat as stat14, readFile as readFile41 } from "fs/promises";
+import { join as join61, extname as extname2 } from "path";
 async function dirExists(path) {
   try {
-    const s = await stat13(path);
+    const s = await stat14(path);
     return s.isDirectory();
   } catch {
     return false;
@@ -37836,7 +38802,7 @@ async function dirExists(path) {
 }
 async function fileExists(path) {
   try {
-    const s = await stat13(path);
+    const s = await stat14(path);
     return s.isFile();
   } catch {
     return false;
@@ -37849,20 +38815,20 @@ async function scanSkillDir(dirPath, source) {
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (!SKILL_EXTENSIONS.has(extname2(entry.name))) continue;
-    files.push({ filePath: join59(dirPath, entry.name), source });
+    files.push({ filePath: join61(dirPath, entry.name), source });
   }
   return files;
 }
 async function discoverSkills(cwd) {
-  const agentsSkills = await scanSkillDir(join59(cwd, ".agents", "skills"), "agents");
-  const agentsMd = await fileExists(join59(cwd, "AGENTS.md")) ? [{ filePath: join59(cwd, "AGENTS.md"), source: "agents-md" }] : [];
-  const githubSkills = await scanSkillDir(join59(cwd, ".github", "skills"), "github");
-  const kimiflareSkills = await scanSkillDir(join59(cwd, ".kimiflare", "skills"), "kimiflare");
+  const agentsSkills = await scanSkillDir(join61(cwd, ".agents", "skills"), "agents");
+  const agentsMd = await fileExists(join61(cwd, "AGENTS.md")) ? [{ filePath: join61(cwd, "AGENTS.md"), source: "agents-md" }] : [];
+  const githubSkills = await scanSkillDir(join61(cwd, ".github", "skills"), "github");
+  const kimiflareSkills = await scanSkillDir(join61(cwd, ".kimiflare", "skills"), "kimiflare");
   const ordered = [...agentsSkills, ...agentsMd, ...githubSkills, ...kimiflareSkills];
   return ordered;
 }
 async function readSkillFile(filePath) {
-  const bytes = await readFile39(filePath);
+  const bytes = await readFile41(filePath);
   return { bytes, text: bytes.toString("utf-8") };
 }
 var SKILL_EXTENSIONS;
@@ -38069,7 +39035,7 @@ var init_skills = __esm({
 
 // src/ui/run-startup-tasks.ts
 import { existsSync as existsSync19 } from "fs";
-import { join as join60 } from "path";
+import { join as join62 } from "path";
 function runStartupTasks(deps) {
   const {
     cfg,
@@ -38092,7 +39058,7 @@ function runStartupTasks(deps) {
     }
   });
   if (cfg.memoryEnabled) {
-    const dbPath = cfg.memoryDbPath ?? join60(process.cwd(), ".kimiflare", "memory.db");
+    const dbPath = cfg.memoryDbPath ?? join62(process.cwd(), ".kimiflare", "memory.db");
     const manager = new MemoryManager({
       dbPath,
       ...auth,
@@ -38125,7 +39091,7 @@ function runStartupTasks(deps) {
     });
     const cwd = process.cwd();
     sessionStartRecallRef.current = manager.recall({ text: cwd, repoPath: cwd, limit: 5 });
-    if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync19(join60(cwd, name)))) {
+    if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync19(join62(cwd, name)))) {
       const lastRefresh = manager.getLastKimiMdRefreshTime(cwd);
       const driftCount = manager.countHighSignalMemoriesSince(cwd, lastRefresh);
       if (driftCount >= 5) {
@@ -38136,7 +39102,7 @@ function runStartupTasks(deps) {
     memoryManagerRef.current?.close();
     memoryManagerRef.current = null;
   }
-  const skillDbPath = cfg.memoryDbPath ?? join60(process.cwd(), ".kimiflare", "memory.db");
+  const skillDbPath = cfg.memoryDbPath ?? join62(process.cwd(), ".kimiflare", "memory.db");
   const skillDb = getMemoryDb() ?? openMemoryDb(skillDbPath);
   initSkillsSchema(skillDb);
   void indexSkills({
@@ -38812,8 +39778,8 @@ var init_turn_nudges = __esm({
 });
 
 // src/commands/save.ts
-import { mkdir as mkdir21, writeFile as writeFile18, unlink as unlink6 } from "fs/promises";
-import { dirname as dirname27 } from "path";
+import { mkdir as mkdir22, writeFile as writeFile19, unlink as unlink6 } from "fs/promises";
+import { dirname as dirname28 } from "path";
 async function saveCustomCommand(opts2) {
   const dir = opts2.source === "project" ? projectCommandsDir(opts2.cwd) : globalCommandsDir();
   const filepath = `${dir}/${opts2.name}.md`;
@@ -38824,8 +39790,8 @@ async function saveCustomCommand(opts2) {
   if (opts2.effort) data.effort = opts2.effort;
   const frontmatter = serializeFrontmatter(data);
   const content = frontmatter + opts2.template;
-  await mkdir21(dirname27(filepath), { recursive: true });
-  await writeFile18(filepath, content, "utf8");
+  await mkdir22(dirname28(filepath), { recursive: true });
+  await writeFile19(filepath, content, "utf8");
   return { filepath };
 }
 async function deleteCustomCommand(cmd) {
@@ -38924,7 +39890,7 @@ __export(app_exports, {
 import { useState as useState6, useRef as useRef4, useEffect as useEffect2, useCallback as useCallback4, useMemo } from "react";
 import { useApp, render } from "ink";
 import { existsSync as existsSync20 } from "fs";
-import { join as join61 } from "path";
+import { join as join63 } from "path";
 import { jsx } from "react/jsx-runtime";
 function App({
   initialCfg,
@@ -39178,7 +40144,7 @@ function App({
     void (async () => {
       const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
       try {
-        await doResumeSession(join61(sessionsDir3(), `${initialResumeSessionId}.json`));
+        await doResumeSession(join63(sessionsDir3(), `${initialResumeSessionId}.json`));
         if (initialResumeReason === "crash") {
           setEvents((e) => [
             ...e,
@@ -39411,7 +40377,7 @@ function App({
     saveCheckpoint: async (checkpoint) => {
       ensureSessionId();
       const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-      await addCheckpoint(join61(sessionsDir3(), `${sessionIdRef.current}.json`), checkpoint);
+      await addCheckpoint(join63(sessionsDir3(), `${sessionIdRef.current}.json`), checkpoint);
     },
     summarize: () => generateContinuationSummary({
       messages: messagesRef.current,
@@ -39930,27 +40896,20 @@ ${result2.output ?? "(output not captured)"}`,
         setEvents((e) => [...e, { kind: "info", key: mkKey(), text: nudge }]);
       }
       const classification = classifyIntent(trimmed);
-      if (hooksManagerRef.current.hasEnabledHooks("UserPromptSubmit")) {
-        const promptOutcome = await hooksManagerRef.current.fire(
-          "UserPromptSubmit",
-          {
-            event: "UserPromptSubmit",
-            session_id: sessionIdRef.current,
-            cwd: process.cwd(),
-            prompt: opts2?.userPromptForHooks ?? display,
-            tier: classification.tier
-          },
-          null
-        );
-        if (promptOutcome.vetoed) {
-          const reason = promptOutcome.vetoReason || "UserPromptSubmit hook blocked the prompt";
-          setEvents((e) => [
-            ...e,
-            { kind: "info", key: mkKey(), text: `hook blocked the prompt: ${reason}` }
-          ]);
-          endTurn();
-          return;
-        }
+      const promptGate = await submitUserPrompt({
+        hooks: hooksManagerRef.current,
+        sessionId: ensureSessionId(trimmed),
+        cwd: process.cwd(),
+        prompt: opts2?.userPromptForHooks ?? display,
+        tier: classification.tier,
+        resumed: messagesRef.current.some((m) => m.role === "assistant"),
+        model: overrideModel ?? cfg.model,
+        auth: llmAuthFromConfig(cfg)
+      });
+      if (promptGate.blocked) {
+        setEvents((e) => [...e, { kind: "info", key: mkKey(), text: `hook blocked the prompt: ${promptGate.reason}` }]);
+        endTurn();
+        return;
       }
       messagesRef.current.push({ role: "user", content });
       const traceUserSource = denyFeedbackRef.current ? "deny_feedback" : "typed";
@@ -39970,7 +40929,7 @@ ${result2.output ?? "(output not captured)"}`,
       turnCounterRef.current += 1;
       const nudges = turnNudges({
         turn: turnCounterRef.current,
-        hasContextFile: ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync20(join61(process.cwd(), name))),
+        hasContextFile: ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync20(join63(process.cwd(), name))),
         contextStale: kimiMdStale,
         mode: modeRef.current,
         freshAfterTurns: cfg?.autoFreshSuggestionTurns ?? DEFAULT_AUTO_FRESH_SUGGESTION_TURNS,
@@ -40147,7 +41106,7 @@ ${result2.output ?? "(output not captured)"}`,
               lspManagerRef.current.notifyChange(path, content2);
             } else {
               void import("fs/promises").then(
-                ({ readFile: readFile40 }) => readFile40(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
+                ({ readFile: readFile42 }) => readFile42(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
                 })
               );
             }
@@ -40655,7 +41614,7 @@ ${result2.output ?? "(output not captured)"}`,
       lsp: {
         servers: cfg?.lspServers ?? {},
         scope: lspScope,
-        hasProjectDir: existsSync20(join61(process.cwd(), ".kimiflare"))
+        hasProjectDir: existsSync20(join63(process.cwd(), ".kimiflare"))
       }
     });
   });
@@ -40747,6 +41706,7 @@ var init_app = __esm({
     init_run_init();
     init_connect();
     init_session_lifecycle();
+    init_prompt_submit();
     init_run_startup_tasks();
     init_manager_init();
     init_run_compact();
@@ -40786,6 +41746,7 @@ init_sessions();
 init_context_budget();
 init_subagent_stats();
 init_session_lifecycle();
+init_prompt_submit();
 init_attachments();
 init_glob();
 init_permissions_evaluator();
@@ -40830,8 +41791,8 @@ async function resolveFiles(filePatterns, cwd) {
   const resolved = /* @__PURE__ */ new Set();
   for (const pattern of filePatterns) {
     try {
-      const stat14 = await import("fs/promises").then((m) => m.stat(resolve7(cwd, pattern)));
-      if (stat14.isFile()) {
+      const stat15 = await import("fs/promises").then((m) => m.stat(resolve7(cwd, pattern)));
+      if (stat15.isFile()) {
         resolved.add(resolve7(cwd, pattern));
         continue;
       }
@@ -40959,6 +41920,33 @@ async function runPrintMode(opts2) {
   });
   const usageWrites = [];
   const auth = llmAuthFromConfig(opts2);
+  const gate = await submitUserPrompt({
+    hooks,
+    sessionId: sessionFile.id,
+    cwd,
+    prompt: opts2.prompt,
+    tier: policy.classification.tier,
+    resumed: messages.some((m) => m.role === "assistant"),
+    model: opts2.model,
+    auth
+  });
+  if (gate.blocked) {
+    const msg = `prompt blocked by a UserPromptSubmit hook: ${gate.reason}`;
+    if (format === "text") {
+      process.stderr.write(`\x1B[31mautopilot: ${msg}\x1B[0m
+`);
+    } else if (format === "json") {
+      jsonOutput.durationMs = Date.now() - startMs;
+      process.stdout.write(JSON.stringify({ ...jsonOutput, error: msg, blocked: { reason: gate.reason } }, null, 2) + "\n");
+    } else {
+      emitStreamJson("error", { message: msg, code: PROMPT_BLOCKED_EXIT_CODE, reason: "prompt_blocked" });
+    }
+    process.exitCode = PROMPT_BLOCKED_EXIT_CODE;
+    await endSessions("exit");
+    trace.emit("session_end", { reason: "exit" }, null);
+    await trace.flush();
+    return;
+  }
   const callbacks = {
     onUsageFinal: (u, meta) => {
       const lookup = opts2.openrouterApiKey && !auth.customEndpoint && meta?.generationId ? { apiKey: opts2.openrouterApiKey, meta } : void 0;
@@ -41204,7 +42192,7 @@ function registerEvalCommand(program2) {
 // src/index.tsx
 var resumeCommand = null;
 var program = new Command();
-program.name("autopilot").description("Terminal coding agent. Bring your own provider: OpenRouter, OpenAI, DeepSeek, Kimi, Z.ai, Ollama, any OpenAI-compatible endpoint.").version(getAppVersion()).option("-p, --print <prompt>", "one-shot mode: send prompt, stream reply to stdout, exit").option("-m, --model <id>", "model id for the active provider (defaults to its configured model)").addOption(new Option("--cloud", "(retired) KimiFlare Cloud").hideHelp()).option("--dangerously-allow-all", "auto-approve every permission prompt (print mode only)").addOption(new Option("--worker-profile <profile>", "internal worker permission profile").hideHelp()).option("--reasoning", "include reasoning in stdout (print mode only)").option("--thinking", "alias for --reasoning").option("--continue-on-limit", "reset tool-call counter and continue when the 200-call limit is hit (print mode only)").option("--max-total-tool-iterations <n>", "hard ceiling on tool iterations per turn across --continue-on-limit resets (default 1000)", (v) => parseInt(v, 10)).option("--max-input-tokens <n>", "cumulative prompt token budget; exits 42 when exhausted (print mode only)", (v) => parseInt(v, 10)).option("--emit-events", "emit Camouflage NDJSON events to stdout; requires -p (for initial prompt)").option("--multi-turn", "with --emit-events: keep reading stdin for UserInputSubmitted follow-ups after the initial turn").option("--mode <mode>", "run mode: interactive (default), print, rpc").option("-c, --continue", "continue the most recent session in the current working directory").option("-S, --session <id>", "resume a specific session by id").option("-f, --file <path>", "attach file(s) to the prompt; repeatable, supports globs (print mode only)", (v, prev) => (prev ?? []).concat(v)).option("--format <mode>", "output format for print mode: text (default), json, stream-json").option("--dir <path>", "run in the specified directory instead of the current one (print mode only)").option("--title <title>", "override the auto-generated session title (print mode only)").option("--attach <url>", "attach to a running autopilot serve instance (print mode only)");
+program.name("autopilot").description("Terminal coding agent. Bring your own provider: OpenRouter, OpenAI, DeepSeek, Kimi, Z.ai, Ollama, any OpenAI-compatible endpoint.").version(getAppVersion()).option("-p, --print <prompt>", "one-shot mode: send prompt, stream reply to stdout, exit").option("-m, --model <id>", "model id for the active provider (defaults to its configured model)").addOption(new Option("--cloud", "(retired) KimiFlare Cloud").hideHelp()).option("--dangerously-allow-all", "auto-approve every permission prompt (print mode only)").addOption(new Option("--worker-profile <profile>", "internal worker permission profile").hideHelp()).option("--reasoning", "include reasoning in stdout (print mode only)").option("--thinking", "alias for --reasoning").option("--continue-on-limit", "reset tool-call counter and continue when the 200-call limit is hit (print mode only)").option("--max-total-tool-iterations <n>", "hard ceiling on tool iterations per turn across --continue-on-limit resets (default 1000)", (v) => parseInt(v, 10)).option("--max-input-tokens <n>", "cumulative prompt token budget; exits 42 when exhausted (print mode only)", (v) => parseInt(v, 10)).option("--emit-events", "emit Camouflage NDJSON events to stdout; requires -p (for initial prompt)").option("--multi-turn", "with --emit-events: keep reading stdin for UserInputSubmitted follow-ups after the initial turn").option("--mode <mode>", "run mode: interactive (default), print, rpc").option("-c, --continue", "continue the most recent session in the current working directory").option("-S, --session <id>", "resume a specific session by id").option("-f, --file <path>", "attach file(s) to the prompt; repeatable, supports globs (print mode only)", (v, prev) => (prev ?? []).concat(v)).option("--format <mode>", "output format for print mode: text (default), json, stream-json").option("--dir <path>", "run in the specified directory instead of the current one (print mode only)").option("--title <title>", "override the auto-generated session title (print mode only)").option("--attach <url>", "attach to a running autopilot serve instance (print mode only)").option("--on <server>", "run the task on a paired server (autopilot remote add) instead of this machine").option("--local", "run on this machine (the default)").option("--repo <owner/name>", "with --on: GitHub repository (default: this checkout's origin)").option("--detach", "with --on: start the task and return without streaming its output").argument("[task...]", "with --on: the task to run on the server");
 program.command("cost").description("Show cost attribution by task type (requires costAttribution enabled)").option("-w, --week", "last 7 days (default)").option("-m, --month", "last 30 days").option("-d, --day", "today only").option("-s, --session <id>", "single session detail").option("-c, --category <name>", "filter by category").option("--json", "machine-readable output").option("--reclassify", "re-run classification on all sessions").option("--local-only", "skip OpenRouter reconciliation (no network)").option("--verify", "check recorded tokens and cost against OpenRouter's generation records (latest session, or -s <id>)").action(async (cmdOpts) => {
   const cfg = await loadConfig();
   if (cmdOpts.verify) {
@@ -41235,10 +42223,51 @@ program.command("cost").description("Show cost attribution by task type (require
   const { runCostCommand: runCostCommand2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCostCommand2({ ...cmdOpts, config: cfg });
 });
-program.command("remote").description("Retired: remote sessions on Cloudflare").allowUnknownOption().argument("[args...]").action(() => {
-  console.error('autopilot remote was retired. For unattended work use local subagents (/subagents) or a headless run: autopilot -p "\u2026".');
-  process.exit(2);
-});
+async function runRemoteCommand(fn) {
+  const controller = new AbortController();
+  const onInterrupt = () => controller.abort();
+  process.once("SIGINT", onInterrupt);
+  try {
+    const code = await fn(controller.signal);
+    if (typeof code === "number") process.exitCode = code;
+  } catch (error) {
+    if (controller.signal.aborted) return;
+    const { describeError: describeError2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+    console.error(`autopilot: ${describeError2(error)}`);
+    process.exitCode = 1;
+  } finally {
+    process.off("SIGINT", onInterrupt);
+  }
+}
+var remoteCommand = program.command("remote").description("Pair this machine with Autopilot servers that run tasks for you");
+remoteCommand.command("add").description("Pair with a server: approve the code it shows in your browser (no keys copied)").argument("<url>", "server URL, e.g. https://acme.example.com").option("-n, --name <name>", "short name for --on (default: the host's first label)").option("--no-open", "print the approval link instead of opening a browser").action((url, cmdOpts) => runRemoteCommand(async (signal) => {
+  const { remoteAdd: remoteAdd2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  await remoteAdd2({ url, open: cmdOpts.open, signal, ...cmdOpts.name ? { name: cmdOpts.name } : {} });
+}));
+remoteCommand.command("list").description("List paired servers").action(() => runRemoteCommand(async () => {
+  const { remoteList: remoteList2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  await remoteList2();
+}));
+remoteCommand.command("remove").description("Forget a paired server").argument("<name>").action((name) => runRemoteCommand(async () => {
+  const { remoteRemove: remoteRemove2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  return await remoteRemove2(name) ? 0 : 1;
+}));
+var runsCommand = program.command("runs").description("List tasks running or finished on your servers").option("--on <server>", "only this server").option("--json", "machine-readable output").action((cmdOpts) => runRemoteCommand(async () => {
+  const { listRuns: listRuns2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  await listRuns2({ ...cmdOpts.on ? { remote: cmdOpts.on } : {}, json: !!cmdOpts.json });
+}));
+runsCommand.command("watch").description("Show a run's output and follow it until it ends (Ctrl-C detaches)").argument("<run>", "run ID or prefix").option("--on <server>", "server the run is on").action((id, cmdOpts) => runRemoteCommand(async (signal) => {
+  const { watchRun: watchRun2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  return watchRun2({ id, signal, ...cmdOpts.on ? { remote: cmdOpts.on } : {} });
+}));
+runsCommand.command("cancel").description("Stop a running task").argument("<run>", "run ID or prefix").option("--on <server>", "server the run is on").action((id, cmdOpts) => runRemoteCommand(async () => {
+  const { cancelRun: cancelRun2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  await cancelRun2({ id, ...cmdOpts.on ? { remote: cmdOpts.on } : {} });
+}));
+program.command("pull").description("Check out a run's branch in this repository").argument("<run>", "run ID or prefix").option("--on <server>", "server the run is on").action((id, cmdOpts) => runRemoteCommand(async () => {
+  const { pullRun: pullRun2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+  await pullRun2({ id, cwd: process.cwd(), ...cmdOpts.on ? { remote: cmdOpts.on } : {} });
+}));
 registerEvalCommand(program);
 var asterCommand = program.command("aster").description("Manage the Aster mobile API");
 asterCommand.command("setup").description("Configure Aster for one or more local Git workspaces").requiredOption("-w, --workspace <path>", "Local Git repository root (repeatable)", (value, previous = []) => [...previous, value]).option("--json", "Print the selected workspace IDs as JSON").action(async (options) => {
@@ -41639,7 +42668,9 @@ program.command("serve").description("Start a headless HTTP server for API acces
     process.exit(1);
   }
 });
-program.action(async () => {
+var positionalTask = [];
+program.action(async (task = []) => {
+  positionalTask = task;
   await main();
   const { runShutdownTasks: runShutdownTasks2 } = await Promise.resolve().then(() => (init_exit(), exit_exports));
   await runShutdownTasks2();
@@ -41654,10 +42685,43 @@ async function initOtel() {
     onShutdown2("otel-flush", shutdownOtelSink2, SHUTDOWN_PHASE2.flush);
   }
 }
+async function runRemoteTask() {
+  if (opts.on === void 0) {
+    console.error(`autopilot: unknown command "${positionalTask[0]}". To run a task here use -p "\u2026"; on a server, --on <server> "\u2026".`);
+    process.exit(2);
+  }
+  if (opts.local) {
+    console.error("autopilot: --on and --local can't be combined.");
+    process.exit(2);
+  }
+  const task = (positionalTask.join(" ") || opts.print || "").trim();
+  if (!task) {
+    console.error(`autopilot: --on needs a task, e.g. autopilot --on ${opts.on} "fix the flaky checkout test"`);
+    process.exit(2);
+  }
+  const cfg = await loadConfig().catch(() => null);
+  await runRemoteCommand(async (signal) => {
+    const { runOnRemote: runOnRemote2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
+    return runOnRemote2({
+      remote: opts.on,
+      task,
+      cwd: opts.dir ?? process.cwd(),
+      signal,
+      detach: !!opts.detach,
+      ...opts.model ? { model: opts.model } : {},
+      ...cfg?.model ? { preferredModel: cfg.model } : {},
+      ...opts.repo ? { repository: opts.repo } : {}
+    });
+  });
+}
 async function main() {
   await initOtel();
   const { installExitHandlers: installExitHandlers2 } = await Promise.resolve().then(() => (init_exit(), exit_exports));
   installExitHandlers2({ crashes: true });
+  if (opts.on !== void 0 || positionalTask.length > 0) {
+    await runRemoteTask();
+    return;
+  }
   const globalCfg = await loadConfig();
   const updateResult = await checkForUpdate();
   let cfg = globalCfg;
@@ -41836,12 +42900,12 @@ function requireModel(model) {
   process.exit(2);
 }
 async function noCredentialsMessage() {
-  const { readFile: readFile40 } = await import("fs/promises");
+  const { readFile: readFile42 } = await import("fs/promises");
   const { configPath: configPath2 } = await Promise.resolve().then(() => (init_config(), config_exports));
   const { resolveActiveProvider: resolveActiveProvider2 } = await Promise.resolve().then(() => (init_resolve(), resolve_exports));
   let persisted = {};
   try {
-    persisted = JSON.parse(await readFile40(configPath2(), "utf8"));
+    persisted = JSON.parse(await readFile42(configPath2(), "utf8"));
   } catch {
   }
   const { id, preset } = resolveActiveProvider2(persisted);
@@ -41869,11 +42933,11 @@ async function promptHidden(question) {
     }
   });
   const rl = createInterface4({ input: process.stdin, output, terminal: true });
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     rl.question(question, (answer) => {
       rl.close();
       process.stdout.write("\n");
-      resolve21(answer);
+      resolve22(answer);
     });
     muted = true;
   });