boxglow 0.6.4 → 0.6.5

package/bin/boxglow.js

@@ -1135,7 +1135,11 @@ var parts = {
   "\u3002\u3046\u3061\u672A\u7740\u624B\u306E {n} \u7BB1\u306F\u6C7A\u307E\u308B\u307E\u3067\u5F85\u3061\u307E\u3059": "; {n} not-started boxes wait until it is decided",
   "\u672A\u6C7A\u5B9A": "Undecided",
   "\u6E08\u3093\u3060\u4F5C\u696D\u304C\u3053\u306E\u65B9\u91DD\u306B\u5408\u3063\u3066\u3044\u308B\u3053\u3068\u3092\u78BA\u304B\u3081\u305F (\u78BA\u304B\u3081\u76F4\u3057\u306E\u672D\u3092\u6D88\u3059)": "The finished work matches this policy (clears the check-again mark)",
-  "\u78BA\u304B\u3081\u305F": "Checked"
+  "\u78BA\u304B\u3081\u305F": "Checked",
+  "\u30A8\u30C7\u30A3\u30BF\u3067\u958B\u304F: {path}": "Open in the editor: {path}",
+  "\u65B0\u3057\u3044\u30BF\u30D6\u3067\u958B\u304F: {path}": "Open in a new tab: {path}",
+  "\u30D1\u30B9\u3092\u30B3\u30D4\u30FC: {path}": "Copy the path: {path}",
+  "\u8A18\u9332\u3057\u305F\u3068\u304D\u306E\u7248\u3092\u30D6\u30E9\u30A6\u30B6\u3067\u898B\u308B": "See the recorded version in the browser"
 };
 
 // src/i18n/en/canvas.ts
@@ -1652,7 +1656,10 @@ var app = {
   "\u300C{name}\u300D\u3092\u524A\u9664\u3057\u307E\u3057\u305F (Undo \u3067\u623B\u305B\u307E\u3059)": 'Removed "{name}" (Undo brings it back)',
   "\u81EA\u52D5\u4FDD\u5B58: \u30AA\u30F3 (\u5909\u66F4\u306E\u305F\u3073\u306B\u66F8\u304D\u8FBC\u307F\u307E\u3059\u3002\u62BC\u3059\u3068\u30AA\u30D5)": "Auto save: on (every change is written; click to turn off)",
   "\u81EA\u52D5\u4FDD\u5B58: \u30AA\u30D5 (Save \u304B Ctrl+S \u3067\u66F8\u304D\u8FBC\u307F\u307E\u3059\u3002\u62BC\u3059\u3068\u30AA\u30F3)": "Auto save: off (Save or Ctrl+S writes; click to turn on)",
-  "{file} \u306B\u4FDD\u5B58\u3057\u307E\u3059 (\u81EA\u52D5\u4FDD\u5B58\u306F\u30AA\u30D5: Save \u304B Ctrl+S \u3067\u66F8\u304D\u307E\u3059)": "Saves to {file} (auto save is off: Save or Ctrl+S writes)"
+  "{file} \u306B\u4FDD\u5B58\u3057\u307E\u3059 (\u81EA\u52D5\u4FDD\u5B58\u306F\u30AA\u30D5: Save \u304B Ctrl+S \u3067\u66F8\u304D\u307E\u3059)": "Saves to {file} (auto save is off: Save or Ctrl+S writes)",
+  "\u30D1\u30B9\u3092\u30B3\u30D4\u30FC\u3057\u307E\u3057\u305F: {path} (\u30D6\u30E9\u30A6\u30B6\u304B\u3089\u306F\u624B\u5143\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u958B\u3051\u307E\u305B\u3093\u3002VS Code \u62E1\u5F35\u304B serve \u3067\u958B\u304F\u3068\u3001\u62BC\u3059\u3060\u3051\u3067\u958B\u3051\u307E\u3059)": "Copied the path: {path} (a browser cannot open files on this computer; in the VS Code extension or serve, clicking opens the file)",
+  "\u3053\u306E\u30D5\u30A1\u30A4\u30EB\u306F\u30D6\u30E9\u30A6\u30B6\u304B\u3089\u306F\u958B\u3051\u307E\u305B\u3093: {path}": "This file cannot be opened from the browser: {path}",
+  "\u30D5\u30A1\u30A4\u30EB\u3092\u958B\u3051\u307E\u305B\u3093\u3067\u3057\u305F: {path}": "Could not open the file: {path}"
 };
 
 // src/i18n/en/cli.ts
@@ -2014,7 +2021,10 @@ var cli = {
   "\u65B9\u91DD\u306E\u7BC4\u56F2: all = \u8A08\u753B\u5168\u4F53\u3001<block> = \u305D\u306E\u7BB1\u306E\u4E2D\u3001\u7701\u7565 = \u540C\u3058\u89AA\u306E\u4E2D": "Policy scope: all = the whole plan, <block> = inside that box, omitted = within the same parent",
   "\u65B9\u91DD\u3092\u53C2\u8003\u306B\u3059\u308B (\u6C7A\u307E\u3063\u3066\u3044\u306A\u304F\u3066\u3082\u7740\u624B\u3092\u5F85\u305F\u305B\u306A\u3044)": "Make the policy advisory (boxes can start before it is decided)",
   "\u65B9\u91DD\u3092\u3084\u3081\u308B\u51FA\u529B\u306E\u540D\u524D": "Outputs that are no longer policies",
-  "\u3053\u306E\u7BB1\u3067\u306F\u53D7\u3051\u53D6\u3089\u306A\u3044\u65B9\u91DD (<\u7BB1>.<\u51FA\u529B\u540D>)": "Policies this box does not take (<box>.<output>)"
+  "\u3053\u306E\u7BB1\u3067\u306F\u53D7\u3051\u53D6\u3089\u306A\u3044\u65B9\u91DD (<\u7BB1>.<\u51FA\u529B\u540D>)": "Policies this box does not take (<box>.<output>)",
+  "\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: {path}": "File not found: {path}",
+  "\u8A08\u753B\u306E\u30D5\u30A9\u30EB\u30C0\u306E\u5916\u306E\u30D5\u30A1\u30A4\u30EB\u306F\u8868\u793A\u3067\u304D\u307E\u305B\u3093: {path}": "Files outside the plan's folder cannot be shown: {path}",
+  "\u30D5\u30A1\u30A4\u30EB\u304C\u5927\u304D\u3059\u304E\u3066\u8868\u793A\u3067\u304D\u307E\u305B\u3093: {path}": "The file is too large to show: {path}"
 };
 
 // src/i18n/en/model.ts
@@ -4209,7 +4219,7 @@ function splitBlock(p, parentId, spec, actor, makers) {
     if (Object.keys(scope2).length) q.blocks[r.blockId].scope = scope2;
     for (const name of b.inputs ?? []) q = addPort(q, { blockId: r.blockId, direction: "in", name }).project;
   }
-  const resolve7 = (ref, dir2) => {
+  const resolve8 = (ref, dir2) => {
     let why = t("\u30DC\u30C3\u30AF\u30B9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
     for (const { title, portName } of refSplits(ref)) {
       const isParent = title === "parent" || title === parent.title || title === parentId;
@@ -4226,8 +4236,8 @@ function splitBlock(p, parentId, spec, actor, makers) {
     return { ep: null, why };
   };
   for (const c of spec.connections ?? []) {
-    const from = resolve7(c.from, "out");
-    let to = resolve7(c.to, "in");
+    const from = resolve8(c.from, "out");
+    let to = resolve8(c.to, "in");
     if (!to.ep && from.ep && !c.to.includes(".")) {
       const tid = c.to === "parent" || c.to === parent.title || c.to === parentId ? null : made[c.to] ?? findBlock(q, c.to).block?.id;
       if (tid) {
@@ -4334,7 +4344,7 @@ function instantiateNode(p, parentId, node, origin, position) {
       made[c.title] = rc.blockId;
       y += 120;
     }
-    const resolve7 = (ref, dir2) => {
+    const resolve8 = (ref, dir2) => {
       for (const { title, portName } of refSplits(ref)) {
         const isParent = title === "parent";
         const blockId = isParent ? id : made[title];
@@ -4346,8 +4356,8 @@ function instantiateNode(p, parentId, node, origin, position) {
       return null;
     };
     for (const c of node.connections) {
-      const from = resolve7(c.from, "out");
-      const to = resolve7(c.to, "in");
+      const from = resolve8(c.from, "out");
+      const to = resolve8(c.to, "in");
       if (from && to) q = connect(q, from, to).project;
     }
   }
@@ -6019,7 +6029,7 @@ function resolveToken(server, allowEnvironmentToken = true) {
 import { hostname as hostname2 } from "node:os";
 
 // package.json
-var version = "0.6.4";
+var version = "0.6.5";
 
 // src/model/version.ts
 var APP_VERSION = version;
@@ -6994,7 +7004,7 @@ function groupConflicts(base, local, remote, conflicts2) {
     parents.set(key, root);
     return root;
   };
-  const join13 = (keys) => {
+  const join14 = (keys) => {
     const sorted = [...new Set(keys.length ? keys : [SETTINGS])].sort();
     const first = find(sorted[0]);
     for (const key of sorted.slice(1)) parents.set(find(key), first);
@@ -7032,9 +7042,9 @@ function groupConflicts(base, local, remote, conflicts2) {
     return [SETTINGS];
   };
   const items = conflicts2.filter((c) => !c.automatic);
-  for (const c of items) join13(owners(c));
+  for (const c of items) join14(owners(c));
   for (const p of projects) for (const port2 of Object.values(p.ports)) {
-    if (port2.promotedFrom) join13(portOwners(port2.id));
+    if (port2.promotedFrom) join14(portOwners(port2.id));
   }
   const ids = new Set(projects.flatMap((p) => Object.keys(p.blocks)));
   for (const id of ids) {
@@ -7066,7 +7076,7 @@ function groupConflicts(base, local, remote, conflicts2) {
         ))
           keys.push(...edgeOwners(e.id));
       }
-    join13(keys);
+    join14(keys);
     keys.forEach((key) => structural.add(key));
   }
   const grouped = /* @__PURE__ */ new Map();
@@ -8577,13 +8587,46 @@ async function startMcp(run2) {
 
 // cli/serve.ts
 import { createServer } from "node:http";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync5, watch, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename3, dirname as dirname6, extname, join as join8, relative, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync6, watch, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename as basename3, dirname as dirname7, extname, isAbsolute as isAbsolute2, join as join9, relative, resolve as resolve4 } from "node:path";
 import { spawn } from "node:child_process";
 
+// cli/attached-file.ts
+import { existsSync as existsSync5, statSync as statSync3 } from "node:fs";
+import { dirname as dirname4, isAbsolute, join as join6, resolve as resolve3 } from "node:path";
+function gitRootOf(dir2) {
+  let cur = resolve3(dir2);
+  for (let i = 0; i < 64; i++) {
+    if (existsSync5(join6(cur, ".git"))) return cur;
+    const up = dirname4(cur);
+    if (up === cur) return null;
+    cur = up;
+  }
+  return null;
+}
+function attachedFileBases(planFile) {
+  const planDir = dirname4(resolve3(planFile));
+  const root = gitRootOf(planDir);
+  return [.../* @__PURE__ */ new Set([planDir, ...root ? [root] : []])];
+}
+function resolveAttachedFile(planFile, path) {
+  let p = path.trim();
+  if (p.startsWith("file://")) p = decodeURIComponent(p.slice("file://".length));
+  p = p.replace(/[?#].*$/, "");
+  if (!p) return null;
+  const candidates = isAbsolute(p) ? [p] : attachedFileBases(planFile).map((base) => resolve3(base, p));
+  for (const c of candidates) {
+    try {
+      if (existsSync5(c) && statSync3(c).isFile()) return c;
+    } catch {
+    }
+  }
+  return null;
+}
+
 // cli/sync/host.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9, statSync as statSync5 } from "node:fs";
 
 // src/sync/billing.ts
 function parseBilling2(value) {
@@ -8670,9 +8713,9 @@ function parseSummary(v) {
 }
 
 // cli/sync/agent-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { dirname as dirname5, join as join7 } from "node:path";
 
 // node_modules/smol-toml/dist/error.js
 function getLineColFromPtr(string, ptr) {
@@ -9602,29 +9645,29 @@ function mergeCodexConfig(existing, server, token) {
 // cli/sync/agent-config.ts
 function writeAgentConfig(target, server, token, dir2) {
   if (target === "codex") {
-    const path2 = join6(homedir2(), ".codex", "config.toml");
-    mkdirSync5(dirname4(path2), { recursive: true });
-    writeFileSync4(path2, mergeCodexConfig(existsSync5(path2) ? readFileSync6(path2, "utf8") : null, server, token), { mode: 384 });
+    const path2 = join7(homedir2(), ".codex", "config.toml");
+    mkdirSync5(dirname5(path2), { recursive: true });
+    writeFileSync4(path2, mergeCodexConfig(existsSync6(path2) ? readFileSync6(path2, "utf8") : null, server, token), { mode: 384 });
     return { path: path2, gitignored: true };
   }
-  const path = join6(dir2, ".mcp.json");
-  writeFileSync4(path, mergeMcpJson(existsSync5(path) ? readFileSync6(path, "utf8") : null, server, token));
-  const gi = join6(dir2, ".gitignore");
-  if (!existsSync5(gi)) return { path, gitignored: false };
+  const path = join7(dir2, ".mcp.json");
+  writeFileSync4(path, mergeMcpJson(existsSync6(path) ? readFileSync6(path, "utf8") : null, server, token));
+  const gi = join7(dir2, ".gitignore");
+  if (!existsSync6(gi)) return { path, gitignored: false };
   const next = gitignoreWithMcpJson(readFileSync6(gi, "utf8"));
   if (next !== null) writeFileSync4(gi, next);
   return { path, gitignored: true };
 }
 
 // cli/sync/host.ts
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 
 // cli/sync/command.ts
 import { readFileSync as readFileSync8 } from "node:fs";
 
 // cli/sync/watch.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { join as join8 } from "node:path";
 var DEBOUNCE_MS = 2e3;
 var MAX_WAIT_MS = 1e4;
 var POLL_MS = 3e4;
@@ -9634,7 +9677,7 @@ var RETRY_MS = 5e3;
 var RETRY_MAX_MS = 6e4;
 function signature(file) {
   try {
-    const st = statSync3(file);
+    const st = statSync4(file);
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "none";
@@ -9648,7 +9691,7 @@ function contentHash(file) {
   }
 }
 function bindingsFor(server) {
-  const root = join7(configDir(), "sync");
+  const root = join8(configDir(), "sync");
   let names = [];
   try {
     names = readdirSync3(root);
@@ -9657,8 +9700,8 @@ function bindingsFor(server) {
   }
   const states = [], unreadable = [];
   for (const name of names) {
-    const dir2 = join7(root, name);
-    if (!existsSync6(join7(dir2, "state.json"))) continue;
+    const dir2 = join8(root, name);
+    if (!existsSync7(join8(dir2, "state.json"))) continue;
     try {
       const state = new StateStore(dir2).read();
       if (state && state.binding.server === normalizeServer(server)) states.push({ dir: dir2, state });
@@ -9669,9 +9712,9 @@ function bindingsFor(server) {
   return { states, unreadable };
 }
 function lockWatch(server) {
-  const root = join7(configDir(), "sync");
+  const root = join8(configDir(), "sync");
   mkdirSync6(root, { recursive: true, mode: 448 });
-  const path = join7(root, `watch-${hashOf(normalizeServer(server)).slice(0, 16)}`);
+  const path = join8(root, `watch-${hashOf(normalizeServer(server)).slice(0, 16)}`);
   try {
     return { unlock: lockFile(path, { waitMs: 0 }), path };
   } catch (e) {
@@ -10511,7 +10554,7 @@ var SyncHost = class {
     if (resolved?.source === "env") return "env:" + hashOf(resolved.token).slice(0, 16);
     const path = credentialsPath(this.server);
     try {
-      const st = statSync4(path);
+      const st = statSync5(path);
       return `stored:${st.mtimeMs}:${st.size}:${hashOf(readFileSync9(path, "utf8")).slice(0, 16)}`;
     } catch {
       return "none";
@@ -10989,7 +11032,7 @@ var SyncHost = class {
         state.connected = void 0;
         if (action.kind === "connectAgent") {
           try {
-            const written2 = writeAgentConfig(action.target, this.server, created.token, file ? dirname5(file) : process.cwd());
+            const written2 = writeAgentConfig(action.target, this.server, created.token, file ? dirname6(file) : process.cwd());
             state.newToken = void 0;
             state.connected = { target: action.target, wrote: true, path: written2.path, gitignored: written2.gitignored };
           } catch (e) {
@@ -11271,7 +11314,7 @@ var SyncHost = class {
         return;
       }
       const target = realFile(destination);
-      if (action.destination === "new" && (existsSync7(target) || bindingsOf(target).bindings.length))
+      if (action.destination === "new" && (existsSync8(target) || bindingsOf(target).bindings.length))
         throw new SyncDestinationError(t("\u4FDD\u5B58\u5148\u306B\u306F\u65E2\u306B\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u3059\u3002\u5225\u306E\u540D\u524D\u3092\u9078\u3093\u3067\u304F\u3060\u3055\u3044\u3002"));
       if (this.startups.get(file) !== op || this.stopping || this.stopped) return;
       if (op.credentials !== this.credentialsGeneration()) throw new Error("Credentials changed");
@@ -11809,6 +11852,8 @@ var HttpError = class extends Error {
   status;
 };
 var ASSETS_DIR = "boxglow.assets";
+var ATTACHED_MIME = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp", ".pdf": "application/pdf", ".mp4": "video/mp4", ".webm": "video/webm", ".mp3": "audio/mpeg", ".wav": "audio/wav" };
+var MAX_ATTACHED = 50 * 1024 * 1024;
 var ASSET_MIME = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp", ".svg": "image/svg+xml" };
 var MAX_ASSET = 10 * 1024 * 1024;
 function readRawBody(req, limit) {
@@ -11845,9 +11890,9 @@ function readBody(req, limit = MAX_BODY) {
 }
 function startServe(opts) {
   const { file, dist, log } = opts;
-  if (!existsSync8(join8(dist, "index.html"))) throw new Error(t("Web \u30A2\u30D7\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: {dist} (npm run build \u3067 dist/ \u3092\u4F5C\u3063\u3066\u304F\u3060\u3055\u3044)", { dist }));
-  if (!existsSync8(file)) {
-    if (!existsSync8(dirname6(file))) throw new Error(t("\u30D5\u30A9\u30EB\u30C0\u304C\u3042\u308A\u307E\u305B\u3093: {dir}", { dir: dirname6(file) }));
+  if (!existsSync9(join9(dist, "index.html"))) throw new Error(t("Web \u30A2\u30D7\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: {dist} (npm run build \u3067 dist/ \u3092\u4F5C\u3063\u3066\u304F\u3060\u3055\u3044)", { dist }));
+  if (!existsSync9(file)) {
+    if (!existsSync9(dirname7(file))) throw new Error(t("\u30D5\u30A9\u30EB\u30C0\u304C\u3042\u308A\u307E\u305B\u3093: {dir}", { dir: dirname7(file) }));
     log(t("\u30D5\u30A1\u30A4\u30EB\u306F\u307E\u3060\u3042\u308A\u307E\u305B\u3093: {file} (\u753B\u9762\u304B\u3089\u8A08\u753B\u3092\u4F5C\u308B\u304B\u3001\u30B5\u30FC\u30D0\u30FC\u306E\u8A08\u753B\u3092\u53D7\u3051\u53D6\u308B\u3068\u3001\u3053\u3053\u306B\u4FDD\u5B58\u3057\u307E\u3059)", { file }));
   }
   const children = [];
@@ -11873,7 +11918,7 @@ data: ${data}
       destinationPicker: "sibling",
       chooseDestination: async (source, name) => {
         if (!name || !/^[^./\\][^/\\:<>"|?*]*\.json$/.test(name) || /[\x00-\x1f]/.test(name) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])\./i.test(name)) throw new SyncDestinationError(t("\u4FDD\u5B58\u30D5\u30A1\u30A4\u30EB\u540D\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30D5\u30A9\u30EB\u30C0\u3092\u542B\u3081\u305A\u3001.json\u3067\u7D42\u308F\u308B\u540D\u524D\u3092\u6307\u5B9A\u3057\u307E\u3059\u3002"));
-        return join8(dirname6(source), name);
+        return join9(dirname7(source), name);
       },
       onOpened: async (target) => {
         const child = startServe({ file: target, port: 0, dist, open: false, log, sync: { server: opts.sync.server, allowEnvironmentToken: opts.sync.allowEnvironmentToken, autoEnable: false } });
@@ -11893,7 +11938,7 @@ data: ${data}
   let timer;
   let watcher;
   try {
-    watcher = watch(dirname6(file), (_ev, name) => {
+    watcher = watch(dirname7(file), (_ev, name) => {
       if (name && String(name) !== basename3(file)) return;
       clearTimeout(timer);
       timer = setTimeout(broadcast, 80);
@@ -11916,7 +11961,7 @@ data: ${data}
       const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
       if (url.pathname === "/api/project") {
         if (req.method === "GET") {
-          if (!existsSync8(file)) {
+          if (!existsSync9(file)) {
             send(404, JSON.stringify({ code: "no-file", file: basename3(file) }), "application/json; charset=utf-8", { "x-boxglow-file": encodeURIComponent(basename3(file)), "x-boxglow-version": APP_VERSION, "x-boxglow-protocol": String(SAVE_PROTOCOL) });
             return;
           }
@@ -11978,20 +12023,36 @@ data: ${JSON.stringify(lastSync ?? syncHost.status(file))}
         });
         return;
       }
+      if (url.pathname === "/api/file") {
+        if (req.method !== "GET" && req.method !== "HEAD") throw new HttpError(405, t("\u3053\u306E\u30E1\u30BD\u30C3\u30C9\u306F\u4F7F\u3048\u307E\u305B\u3093"));
+        const asked = url.searchParams.get("path") ?? "";
+        const found = resolveAttachedFile(file, asked);
+        if (!found) throw new HttpError(404, t("\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: {path}", { path: asked }));
+        const real = realpathSync3(found);
+        const inside2 = attachedFileBases(file).some((base2) => {
+          const rel = relative(realpathSync3(base2), real);
+          return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+        });
+        if (!inside2) throw new HttpError(403, t("\u8A08\u753B\u306E\u30D5\u30A9\u30EB\u30C0\u306E\u5916\u306E\u30D5\u30A1\u30A4\u30EB\u306F\u8868\u793A\u3067\u304D\u307E\u305B\u3093: {path}", { path: asked }));
+        if (statSync6(real).size > MAX_ATTACHED) throw new HttpError(413, t("\u30D5\u30A1\u30A4\u30EB\u304C\u5927\u304D\u3059\u304E\u3066\u8868\u793A\u3067\u304D\u307E\u305B\u3093: {path}", { path: asked }));
+        const type = ATTACHED_MIME[extname(real).toLowerCase()] ?? "text/plain; charset=utf-8";
+        send(200, req.method === "HEAD" ? "" : readFileSync10(real), type, type === "application/pdf" ? {} : { "content-security-policy": "sandbox; default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'" });
+        return;
+      }
       if (url.pathname.startsWith("/api/assets/")) {
-        const assetsDir = join8(dirname6(file), ASSETS_DIR);
+        const assetsDir = join9(dirname7(file), ASSETS_DIR);
         const name = decodeURIComponent(url.pathname.slice("/api/assets/".length)).replace(/^boxglow\.assets\//, "");
         if (!/^[^/\\]+$/.test(name) || name.startsWith(".") || !ASSET_MIME[extname(name).toLowerCase()]) throw new HttpError(400, t("\u3053\u306E\u540D\u524D\u306E\u753B\u50CF\u306F\u6271\u3048\u307E\u305B\u3093: {name}", { name }));
-        const target2 = join8(assetsDir, name);
+        const target2 = join9(assetsDir, name);
         if (req.method === "GET" || req.method === "HEAD") {
-          if (!existsSync8(target2) || !statSync5(target2).isFile()) throw new HttpError(404, t("\u753B\u50CF\u304C\u3042\u308A\u307E\u305B\u3093: {name}", { name }));
+          if (!existsSync9(target2) || !statSync6(target2).isFile()) throw new HttpError(404, t("\u753B\u50CF\u304C\u3042\u308A\u307E\u305B\u3093: {name}", { name }));
           send(200, req.method === "HEAD" ? "" : readFileSync10(target2), ASSET_MIME[extname(name).toLowerCase()], { "cache-control": "no-cache" });
           return;
         }
         if (req.method === "PUT") {
           const bytes = await readRawBody(req, MAX_ASSET);
           mkdirSync7(assetsDir, { recursive: true });
-          if (existsSync8(target2)) throw new HttpError(409, t("\u540C\u3058\u540D\u524D\u306E\u753B\u50CF\u304C\u3042\u308A\u307E\u3059: {name}", { name }));
+          if (existsSync9(target2)) throw new HttpError(409, t("\u540C\u3058\u540D\u524D\u306E\u753B\u50CF\u304C\u3042\u308A\u307E\u3059: {name}", { name }));
           writeFileSync5(target2, bytes);
           send(200, JSON.stringify({ ok: true, path: `${ASSETS_DIR}/${name}` }));
           return;
@@ -12000,13 +12061,13 @@ data: ${JSON.stringify(lastSync ?? syncHost.status(file))}
       }
       if (req.method !== "GET" && req.method !== "HEAD") throw new HttpError(405, t("\u3053\u306E\u30E1\u30BD\u30C3\u30C9\u306F\u4F7F\u3048\u307E\u305B\u3093"));
       const base = realpathSync3(dist);
-      const target = resolve3(base, "." + decodeURIComponent(url.pathname));
+      const target = resolve4(base, "." + decodeURIComponent(url.pathname));
       const inside = (path2) => {
         const rel = relative(base, path2);
         return rel !== ".." && !rel.startsWith("../") && !rel.startsWith("..\\");
       };
       if (!inside(target)) throw new HttpError(403, t("\u3053\u306E\u30D1\u30B9\u306F\u914D\u4FE1\u3067\u304D\u307E\u305B\u3093"));
-      const path = existsSync8(target) && statSync5(target).isFile() ? realpathSync3(target) : join8(base, "index.html");
+      const path = existsSync9(target) && statSync6(target).isFile() ? realpathSync3(target) : join9(base, "index.html");
       if (!inside(path)) throw new HttpError(403, t("\u3053\u306E\u30D1\u30B9\u306F\u914D\u4FE1\u3067\u304D\u307E\u305B\u3093"));
       send(200, req.method === "HEAD" ? "" : readFileSync10(path), MIME[extname(path)] ?? "application/octet-stream");
     } catch (e) {
@@ -12042,24 +12103,24 @@ data: ${JSON.stringify(lastSync ?? syncHost.status(file))}
 }
 
 // cli/plan-io.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname7, join as join9, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname8, join as join10, resolve as resolve5 } from "node:path";
 var filePlanIO = {
   locate(opt2, forInit) {
-    if (opt2) return resolve4(opt2);
-    if (process.env.BOXGLOW_FILE) return resolve4(process.env.BOXGLOW_FILE);
+    if (opt2) return resolve5(opt2);
+    if (process.env.BOXGLOW_FILE) return resolve5(process.env.BOXGLOW_FILE);
     let dir2 = process.cwd();
     for (let i = 0; i < 12; i++) {
-      const candidate = join9(dir2, "boxglow.json");
-      if (existsSync9(candidate)) return candidate;
-      const parent = dirname7(dir2);
+      const candidate = join10(dir2, "boxglow.json");
+      if (existsSync10(candidate)) return candidate;
+      const parent = dirname8(dir2);
       if (parent === dir2) break;
       dir2 = parent;
     }
-    if (forInit) return join9(process.cwd(), "boxglow.json");
+    if (forInit) return join10(process.cwd(), "boxglow.json");
     throw new Error(t("boxglow.json \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093 (--file \u3067\u6307\u5B9A\u3059\u308B\u304B\u3001`boxglow init` \u3067\u4F5C\u3063\u3066\u304F\u3060\u3055\u3044)"));
   },
-  exists: (path) => existsSync9(path),
+  exists: (path) => existsSync10(path),
   read: (path) => readFileSync11(path, "utf8"),
   commit: (path, text2, expected, opts) => commitFile(path, text2, expected, opts)
 };
@@ -12311,12 +12372,12 @@ function isCurrentToken(p, token) {
 }
 
 // cli/setup-agent.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname9, join as join11 } from "node:path";
 var BEGIN = "<!-- boxglow:begin -->";
 var END = "<!-- boxglow:end -->";
 function readObject(path) {
-  if (!existsSync10(path)) return {};
+  if (!existsSync11(path)) return {};
   const value = JSON.parse(readFileSync12(path, "utf8"));
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(t("\u8A2D\u5B9A\u306E\u5F62\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093: {where}", { where: path }));
   return value;
@@ -12399,8 +12460,8 @@ ${body}
 ${identity}
 ${END}
 `;
-    const path = join10(root, name);
-    const cur = existsSync10(path) ? readFileSync12(path, "utf8") : "";
+    const path = join11(root, name);
+    const cur = existsSync11(path) ? readFileSync12(path, "utf8") : "";
     const begin = cur.indexOf(BEGIN);
     const end = cur.indexOf(END);
     if (begin < 0 !== end < 0 || begin >= 0 && end < begin) throw new Error(t("Boxglow \u306E\u5370 (boxglow:begin / boxglow:end) \u304C\u6B63\u3057\u304F\u5BFE\u306B\u306A\u3063\u3066\u3044\u307E\u305B\u3093: {path}", { path }));
@@ -12420,8 +12481,8 @@ dependencies:
       value: boxglow
       transport: stdio
 `);
-    const tomlPath = join10(root, ".codex/config.toml");
-    const toml = existsSync10(tomlPath) ? readFileSync12(tomlPath, "utf8") : "";
+    const tomlPath = join11(root, ".codex/config.toml");
+    const toml = existsSync11(tomlPath) ? readFileSync12(tomlPath, "utf8") : "";
     let parsed;
     try {
       parsed = parse(toml);
@@ -12443,7 +12504,7 @@ default_tools_approval_mode = "auto"
       }
       files.set(".codex/config.toml", candidate);
     }
-    const hooksFile = readObject(join10(root, ".codex/hooks.json"));
+    const hooksFile = readObject(join11(root, ".codex/hooks.json"));
     const hooks = object(hooksFile.hooks, "hooks");
     if (mergeHooks(hooks, "codex")) {
       hooksFile.hooks = hooks;
@@ -12459,7 +12520,7 @@ ${r.body.replace(/"""/g, '\\"\\"\\"')}
   }
   if (claude) {
     files.set(".claude/skills/boxglow/SKILL.md", skill);
-    const settings = readObject(join10(root, ".claude/settings.json"));
+    const settings = readObject(join11(root, ".claude/settings.json"));
     const hooks = object(settings.hooks, "hooks");
     let changed2 = mergeHooks(hooks, "claude-code");
     if (changed2) settings.hooks = hooks;
@@ -12488,7 +12549,7 @@ tools: Bash, Read
 
 ${r.body}
 `);
-    const mcp = readObject(join10(root, ".mcp.json"));
+    const mcp = readObject(join11(root, ".mcp.json"));
     const servers = object(mcp.mcpServers, "mcpServers");
     if (!servers.boxglow) {
       servers.boxglow = { command: "npx", args: ["-y", "boxglow", "mcp", "--actor", "claude-code"] };
@@ -12498,9 +12559,9 @@ ${r.body}
   }
   const changed = [];
   for (const [name, text2] of files) {
-    const path = join10(root, name);
-    if (existsSync10(path) && readFileSync12(path, "utf8") === text2) continue;
-    mkdirSync8(dirname8(path), { recursive: true });
+    const path = join11(root, name);
+    if (existsSync11(path) && readFileSync12(path, "utf8") === text2) continue;
+    mkdirSync8(dirname9(path), { recursive: true });
     writeFileSync6(path, text2, "utf8");
     changed.push(name);
   }
@@ -12511,8 +12572,8 @@ function checkAgentSetup(root, agent) {
   const claude = agent !== "codex";
   const lines = [];
   const has = (rel, test) => {
-    const p = join10(root, rel);
-    if (!existsSync10(p)) return false;
+    const p = join11(root, rel);
+    if (!existsSync11(p)) return false;
     return test ? test(readFileSync12(p, "utf8")) : true;
   };
   const hooksOk = (rel, actor) => has(rel, (text2) => {
@@ -12730,16 +12791,16 @@ function resumeReport(project, options = {}) {
 }
 
 // cli/hooks.ts
-import { appendFileSync, existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join11 } from "node:path";
+import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join12 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 var sessionMark = (id) => id ? createHash4("sha256").update(id).digest("hex").slice(0, 8) : "";
-var hookLogPath = () => join11(configDir(), "hooks.log");
+var hookLogPath = () => join12(configDir(), "hooks.log");
 function recordHook(entry) {
   try {
     const path = hookLogPath();
     mkdirSync9(configDir(), { recursive: true });
-    const lines = existsSync11(path) ? readFileSync13(path, "utf8").split("\n").filter(Boolean) : [];
+    const lines = existsSync12(path) ? readFileSync13(path, "utf8").split("\n").filter(Boolean) : [];
     lines.push(JSON.stringify(entry));
     writeFileSync7(path, lines.slice(-200).join("\n") + "\n");
   } catch {
@@ -12748,7 +12809,7 @@ function recordHook(entry) {
 function readHookLog(cwd) {
   try {
     const path = hookLogPath();
-    if (!existsSync11(path)) return [];
+    if (!existsSync12(path)) return [];
     const all = readFileSync13(path, "utf8").split("\n").filter(Boolean).map((l) => {
       try {
         return JSON.parse(l);
@@ -13413,7 +13474,7 @@ function reviewable(p, blockId) {
 }
 
 // cli/main.ts
-import { existsSync as existsSync13, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
 import { execFileSync as execFileSync3 } from "node:child_process";
 
 // docs/AGENTS_SNIPPET.md
@@ -13719,7 +13780,7 @@ function terminalHeight(p, which) {
 }
 
 // cli/main.ts
-import { dirname as dirname10, join as join12, resolve as resolve6 } from "node:path";
+import { dirname as dirname11, join as join13, resolve as resolve7 } from "node:path";
 
 // src/model/report.ts
 var quoted = (title) => t("\u300C{title}\u300D", { title });
@@ -13937,8 +13998,8 @@ var STATUS_LABEL2 = {
 
 // cli/git.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync12, statSync as statSync6 } from "node:fs";
-import { dirname as dirname9, relative as relative2, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync13, statSync as statSync7 } from "node:fs";
+import { dirname as dirname10, relative as relative2, resolve as resolve6 } from "node:path";
 function git(args, cwd) {
   try {
     return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -13956,9 +14017,9 @@ function remoteToWeb(remote) {
   return null;
 }
 function gitRefFor(filePath) {
-  const abs = resolve5(filePath);
-  if (!existsSync12(abs) || !statSync6(abs).isFile()) return null;
-  const root = git(["rev-parse", "--show-toplevel"], dirname9(abs));
+  const abs = resolve6(filePath);
+  if (!existsSync13(abs) || !statSync7(abs).isFile()) return null;
+  const root = git(["rev-parse", "--show-toplevel"], dirname10(abs));
   if (!root) return null;
   const rel = relative2(root, abs).replace(/\\/g, "/");
   const commit = git(["rev-parse", "HEAD"], root) ?? "";
@@ -13972,14 +14033,14 @@ function gitRefFor(filePath) {
 }
 function findGitRef(recorded, bases) {
   for (const base of bases) {
-    const ref = gitRefFor(resolve5(base, recorded));
+    const ref = gitRefFor(resolve6(base, recorded));
     if (ref) return ref;
   }
   return null;
 }
 function currentRef(root, rel) {
   const commit = git(["rev-parse", "HEAD"], root) ?? "";
-  const blob = git(["hash-object", "--path", rel, "--", resolve5(root, rel)], root) ?? "";
+  const blob = git(["hash-object", "--path", rel, "--", resolve6(root, rel)], root) ?? "";
   const repo = git(["config", "--get", "remote.origin.url"], root) ?? "";
   const web = repo ? remoteToWeb(repo) : null;
   return { path: rel, commit, blob, url: web && commit ? `${web}/blob/${commit}/${rel}` : "" };
@@ -13987,7 +14048,7 @@ function currentRef(root, rel) {
 function checkGitRef(ref, cwd) {
   const root = git(["rev-parse", "--show-toplevel"], cwd);
   if (!root || !ref.path) return { state: "missing" };
-  if (existsSync12(resolve5(root, ref.path))) return { state: "ok", path: ref.path };
+  if (existsSync13(resolve6(root, ref.path))) return { state: "ok", path: ref.path };
   if (ref.blob) {
     const tree = git(["ls-tree", "-r", "HEAD"], root) ?? "";
     for (const line of tree.split("\n")) {
@@ -14005,7 +14066,7 @@ function checkGitRef(ref, cwd) {
         if (m && m[1] === cur) cur = m[2];
       }
     }
-    if (cur !== ref.path && existsSync12(resolve5(root, cur))) return { state: "moved", ...currentRef(root, cur) };
+    if (cur !== ref.path && existsSync13(resolve6(root, cur))) return { state: "moved", ...currentRef(root, cur) };
   }
   return { state: "missing" };
 }
@@ -14244,11 +14305,11 @@ var claimRequest;
 var CONFLICT_RETRIES = 8;
 function load(path) {
   const text2 = planIO().read(path);
-  readRevisions.set(resolve6(path), revisionOf(text2));
+  readRevisions.set(resolve7(path), revisionOf(text2));
   return fromJSON(text2);
 }
 function save(path, p) {
-  const expected = readRevisions.has(resolve6(path)) ? readRevisions.get(resolve6(path)) : null;
+  const expected = readRevisions.has(resolve7(path)) ? readRevisions.get(resolve7(path)) : null;
   const normalized = normalizePortNames(p).project;
   let text2 = toJSON(normalized) + "\n";
   const warnings = [];
@@ -14258,12 +14319,12 @@ function save(path, p) {
     return text2;
   } });
   for (const warning of warnings) out(warning);
-  readRevisions.set(resolve6(path), revision);
+  readRevisions.set(resolve7(path), revision);
   lastSavedText = text2;
 }
 function writeExport(target, text2) {
   let guarded = false;
-  if (existsSync13(target)) {
+  if (existsSync14(target)) {
     try {
       guarded = claimsEnabled(fromJSON(readFileSync14(target, "utf8")));
     } catch {
@@ -14731,7 +14792,7 @@ function main(argv) {
   if (cmd === "init") {
     const path2 = locateFile(str2(options.file), true);
     if (planIO().exists(path2) && !options.force) throw new Error(t("{path} \u306F\u65E2\u306B\u3042\u308A\u307E\u3059 (--force \u3067\u4E0A\u66F8\u304D)", { path: path2 }));
-    readRevisions.set(resolve6(path2), existsSync13(path2) ? revisionOf(readFileSync14(path2, "utf8")) : null);
+    readRevisions.set(resolve7(path2), existsSync14(path2) ? revisionOf(readFileSync14(path2, "utf8")) : null);
     const lang = explicitLang(options) ?? envLang();
     setLang(lang);
     const from = str2(options.from);
@@ -14746,7 +14807,7 @@ function main(argv) {
     if (!basePath || !oursPath || !theirsPath) throw new Error(t("merge <base> <ours> <theirs> \u306E 3 \u3064\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"));
     const read2 = (f) => {
       const text2 = readFileSync14(f, "utf8");
-      readRevisions.set(resolve6(f), revisionOf(text2));
+      readRevisions.set(resolve7(f), revisionOf(text2));
       return text2.trim() ? fromJSON(text2) : null;
     };
     const base = read2(basePath);
@@ -14763,7 +14824,7 @@ function main(argv) {
       const message = kept.includes(c) ? t("\u30DE\u30FC\u30B8\u3067\u7247\u65B9\u304C\u524A\u9664\u30FB\u7247\u65B9\u304C\u5909\u66F4: {path} (\u5909\u66F4\u3055\u308C\u305F\u5074\u3092\u6B8B\u3057\u307E\u3057\u305F\u3002\u524A\u9664\u3057\u305F\u5074: {side})", { path: c.path, side: c.ours === void 0 ? t("\u81EA\u5206") : t("\u76F8\u624B") }) : t("\u30DE\u30FC\u30B8\u3067\u4E21\u5074\u304C\u5909\u66F4: {path} (\u63A1\u7528: {ours} / \u76F8\u624B: {theirs})", { path: c.path, ours: JSON.stringify(c.ours), theirs: JSON.stringify(c.theirs) });
       q = { ...q, log: [...q.log, { id: `m${Math.random().toString(36).slice(2, 10)}`, at: (/* @__PURE__ */ new Date()).toISOString(), actor: "merge", kind: "note", message }] };
     }
-    commitFile(oursPath, toJSON(q) + "\n", readRevisions.get(resolve6(oursPath)));
+    commitFile(oursPath, toJSON(q) + "\n", readRevisions.get(resolve7(oursPath)));
     const both = r.conflicts.length - kept.length;
     out(
       t("\u30DE\u30FC\u30B8: \u76F8\u624B\u306E\u5909\u66F4 {count} \u4EF6\u3092\u53D6\u308A\u8FBC\u307F", { count: r.merged }) + (both ? t("\u3001\u4E21\u5074\u3067\u5909\u66F4\u304C {count} \u4EF6 (\u81EA\u5206\u306E\u5024\u3092\u63A1\u7528\u3057\u3001\u76F8\u624B\u306E\u5024\u306F\u30ED\u30B0\u306B\u8A18\u9332)", { count: both }) : "") + (kept.length ? t("\u3001\u524A\u9664\u3068\u5909\u66F4\u306E\u7AF6\u5408\u304C {count} \u4EF6 (\u5909\u66F4\u3055\u308C\u305F\u5074\u3092\u6B8B\u3057\u3001\u30ED\u30B0\u306B\u8A18\u9332)", { count: kept.length }) : "")
@@ -15021,7 +15082,7 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
       return;
     }
     case "setup-agent": {
-      const root = str2(options.dir) ? resolve6(str2(options.dir)) : dirname10(path);
+      const root = str2(options.dir) ? resolve7(str2(options.dir)) : dirname11(path);
       const agent = str2(options.agent) ?? "all";
       if (options.check) {
         out(checkAgentSetup(root, agent).join("\n"));
@@ -15154,10 +15215,10 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
       return;
     }
     case "git-setup": {
-      const root = dirname10(path);
-      const attrs = join12(root, ".gitattributes");
+      const root = dirname11(path);
+      const attrs = join13(root, ".gitattributes");
       const line = "boxglow.json merge=boxglow";
-      const cur = existsSync13(attrs) ? readFileSync14(attrs, "utf8") : "";
+      const cur = existsSync14(attrs) ? readFileSync14(attrs, "utf8") : "";
       if (!cur.split(/\r?\n/).includes(line)) writeFileSync8(attrs, (cur && !cur.endsWith("\n") ? cur + "\n" : cur) + line + "\n", "utf8");
       execFileSync3("git", ["config", "merge.boxglow.name", "Boxglow plan merge (box level)"], { cwd: root });
       execFileSync3("git", ["config", "merge.boxglow.driver", "npx boxglow merge %O %A %B"], { cwd: root });
@@ -15566,7 +15627,7 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
         for (const a of port2.artifacts) {
           const owner = p.blocks[port2.blockId]?.title ?? "?";
           if (a.kind === "file" && a.path) {
-            const ref = findGitRef(a.path, [dirname10(path), process.cwd()]);
+            const ref = findGitRef(a.path, [dirname11(path), process.cwd()]);
             if (ref) {
               a.kind = "git";
               a.repo = ref.repo;
@@ -15583,7 +15644,7 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
           }
           if (a.kind !== "git") continue;
           if (!a.commit && a.path) {
-            const ref = gitRefFor(resolve6(dirname10(path), a.path));
+            const ref = gitRefFor(resolve7(dirname11(path), a.path));
             if (ref?.commit) {
               a.commit = ref.commit;
               a.blob = ref.blob;
@@ -15595,7 +15656,7 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
               continue;
             }
           }
-          const r = checkGitRef(a, dirname10(path));
+          const r = checkGitRef(a, dirname11(path));
           if (r.state === "moved" && r.path) {
             lines.push(t("- [\u79FB\u52D5] {owner}.{port} \u300C{title}\u300D {from} -> {to}", { owner, port: port2.name, title: a.title, from: String(a.path), to: r.path }));
             a.path = r.path;
@@ -15759,7 +15820,7 @@ function runCommand(cmd, rest, options, actor, path, p, AGENTS_SNIPPET, SKILL_MD
 function cliMain(argv) {
   if (argv[0] === "mcp") {
     const { options } = parseArgs(argv.slice(1));
-    if (str2(options.file)) process.env.BOXGLOW_FILE = resolve6(str2(options.file));
+    if (str2(options.file)) process.env.BOXGLOW_FILE = resolve7(str2(options.file));
     if (str2(options.actor)) process.env.BOXGLOW_ACTOR = str2(options.actor);
     if (str2(options.lang)) process.env.BOXGLOW_LANG = str2(options.lang);
     const mcpFile = locateFile(str2(options.file));
@@ -15814,10 +15875,10 @@ function cliMain(argv) {
       claimRequest = claimCommand("combine", void 0, options, actorOf(str2(options.actor), process.env));
       const outPath = str2(options.out);
       if (positional.length < 2 || !outPath) throw new Error("boxglow combine <\u8A08\u753B\u30D5\u30A1\u30A4\u30EB> <\u8A08\u753B\u30D5\u30A1\u30A4\u30EB>... --out <path>");
-      if (existsSync13(outPath) && !options.force) throw new Error(t("{path} \u306F\u65E2\u306B\u3042\u308A\u307E\u3059 (--force \u3067\u4E0A\u66F8\u304D)", { path: outPath }));
+      if (existsSync14(outPath) && !options.force) throw new Error(t("{path} \u306F\u65E2\u306B\u3042\u308A\u307E\u3059 (--force \u3067\u4E0A\u66F8\u304D)", { path: outPath }));
       let merged = load(positional[0]);
       for (const file of positional.slice(1)) merged = combineProjects(merged, load(file), basename4(file));
-      readRevisions.set(resolve6(outPath), existsSync13(outPath) ? revisionOf(readFileSync14(outPath, "utf8")) : null);
+      readRevisions.set(resolve7(outPath), existsSync14(outPath) ? revisionOf(readFileSync14(outPath, "utf8")) : null);
       save(outPath, merged);
       console.log(t("\u7D50\u5408: {n} \u500B\u306E\u8A08\u753B\u3092 {path} \u306B\u307E\u3068\u3081\u307E\u3057\u305F (\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u7BB1 {m} \u500B)", { n: String(positional.length), path: outPath, m: String(projectBlocks(merged).length) }));
     } catch (e) {
@@ -15831,14 +15892,14 @@ function cliMain(argv) {
       claimRequest = claimCommand("split-file", void 0, options, actorOf(str2(options.actor), process.env));
       const outPath = str2(options.out);
       if (!positional[0] || !outPath) throw new Error("boxglow split-file <\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u7BB1> --out <path> [--file <\u8A08\u753B>]");
-      if (existsSync13(outPath) && !options.force) throw new Error(t("{path} \u306F\u65E2\u306B\u3042\u308A\u307E\u3059 (--force \u3067\u4E0A\u66F8\u304D)", { path: outPath }));
+      if (existsSync14(outPath) && !options.force) throw new Error(t("{path} \u306F\u65E2\u306B\u3042\u308A\u307E\u3059 (--force \u3067\u4E0A\u66F8\u304D)", { path: outPath }));
       const path = locateFile(str2(options.file));
       const p = load(path);
       const found = findBlock(p, positional[0]);
       if (!found.block) throw new Error(t("\u30D6\u30ED\u30C3\u30AF\u300C{ref}\u300D\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002", { ref: positional[0] }));
       const box = found.block;
       const { remaining, extracted } = splitProject(p, box.id, str2(options.name));
-      readRevisions.set(resolve6(outPath), existsSync13(outPath) ? revisionOf(readFileSync14(outPath, "utf8")) : null);
+      readRevisions.set(resolve7(outPath), existsSync14(outPath) ? revisionOf(readFileSync14(outPath, "utf8")) : null);
       save(outPath, extracted);
       save(path, remaining);
       console.log(t("\u5206\u5272: \u300C{title}\u300D\u3092 {out} \u306B\u5207\u308A\u51FA\u3057\u307E\u3057\u305F ({path} \u306B\u306F\u6B8B\u308A {m} \u500B\u306E\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u7BB1)", { title: box.title, out: outPath, path, m: String(projectBlocks(remaining).length) }));
@@ -15904,7 +15965,7 @@ function cliMain(argv) {
       }
       const command = positional[0] ?? "list";
       const write = command === "connect" ? !(options["read-only"] === true || options["read-only"] === "true") : options.write === true || options.write === "true";
-      process.exitCode = await runAgentToken({ server, out: (line) => console.log(line), command, name: str2(options.name), write, id: positional[1], target: command === "connect" ? positional[1] : void 0, projectId, dir: file ? dirname10(file) : process.cwd() });
+      process.exitCode = await runAgentToken({ server, out: (line) => console.log(line), command, name: str2(options.name), write, id: positional[1], target: command === "connect" ? positional[1] : void 0, projectId, dir: file ? dirname11(file) : process.cwd() });
     })().catch((e) => {
       console.error(`[boxglow agent-token] ${e instanceof Error ? e.message : String(e)}`);
       process.exitCode = 1;