codeam-cli 2.61.68 → 2.61.69

package/dist/index.js

@@ -119,7 +119,7 @@ async function runHttpRelay(delivery, client3, id) {
     requestInit: { headers: buildHttpHeaders(delivery.httpHeaders, token) }
   });
   const stdioTransport = new StdioServerTransport();
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     let done = false;
     const finish = (err) => {
       if (done) return;
@@ -127,7 +127,7 @@ async function runHttpRelay(delivery, client3, id) {
       void httpTransport.close().catch(() => void 0);
       void stdioTransport.close().catch(() => void 0);
       if (err) reject(err);
-      else resolve8();
+      else resolve9();
     };
     stdioTransport.onmessage = (msg) => {
       void httpTransport.send(msg).catch((e) => {
@@ -1882,8 +1882,8 @@ var HEADROOM_MODELS = [
   }
 ];
 function headroomSnapshotDownloadLine(model, opts = {}) {
-  const sep6 = opts.spaceAfterComma ? ", " : ",";
-  const patterns = model.allowPatterns.map((p2) => `"${p2}"`).join(sep6);
+  const sep7 = opts.spaceAfterComma ? ", " : ",";
+  const patterns = model.allowPatterns.map((p2) => `"${p2}"`).join(sep7);
   return `snapshot_download("${model.repo}", allow_patterns=[${patterns}])`;
 }
 function headroomModelPredownloadScript(opts = {}) {
@@ -2172,11 +2172,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path79) {
+function rmIfExistsQuiet(path80) {
   try {
-    fs2.rmSync(path79, { force: true });
+    fs2.rmSync(path80, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path79}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path80}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -2360,8 +2360,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path79) {
-  return path79.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path80) {
+  return path80.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -4841,15 +4841,15 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path79, ranges, output) {
-  return new Promise((resolve8) => {
-    const stream = (0, import_node_fs.createReadStream)(path79);
+function getContextLinesFromFile(path80, ranges, output) {
+  return new Promise((resolve9) => {
+    const stream = (0, import_node_fs.createReadStream)(path80);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
     function destroyStreamAndResolve() {
       stream.destroy();
-      resolve8();
+      resolve9();
     }
     let lineNumber = 0;
     let currentRangeIndex = 0;
@@ -4858,7 +4858,7 @@ function getContextLinesFromFile(path79, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path79, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path80, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -4919,8 +4919,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path79) {
-  return path79.startsWith("node:") || path79.endsWith(".min.js") || path79.endsWith(".min.cjs") || path79.endsWith(".min.mjs") || path79.startsWith("data:");
+function shouldSkipContextLinesForFile(path80) {
+  return path80.startsWith("node:") || path80.endsWith(".min.js") || path80.endsWith(".min.cjs") || path80.endsWith(".min.mjs") || path80.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -6136,9 +6136,9 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     if (!waitUntil) return;
     if (this.disabled || this.optedOut) return;
     if (!this._waitUntilCycle) {
-      let resolve8;
+      let resolve9;
       const promise = new Promise((r) => {
-        resolve8 = r;
+        resolve9 = r;
       });
       try {
         waitUntil(promise);
@@ -6146,7 +6146,7 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
         return;
       }
       this._waitUntilCycle = {
-        resolve: resolve8,
+        resolve: resolve9,
         startedAt: Date.now(),
         timer: void 0
       };
@@ -6170,12 +6170,12 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     return cycle?.resolve;
   }
   async resolveWaitUntilFlush() {
-    const resolve8 = this._consumeWaitUntilCycle();
+    const resolve9 = this._consumeWaitUntilCycle();
     try {
       await super.flush();
     } catch {
     } finally {
-      resolve8?.();
+      resolve9?.();
     }
   }
   getPersistedProperty(key) {
@@ -6267,15 +6267,15 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
   async waitForLocalEvaluationReady(timeoutMs = THIRTY_SECONDS) {
     if (this.isLocalEvaluationReady()) return true;
     if (void 0 === this.featureFlagsPoller) return false;
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const timeout = setTimeout(() => {
         cleanup();
-        resolve8(false);
+        resolve9(false);
       }, timeoutMs);
       const cleanup = this._events.on("localEvaluationFlagsLoaded", (count) => {
         clearTimeout(timeout);
         cleanup();
-        resolve8(count > 0);
+        resolve9(count > 0);
       });
     });
   }
@@ -6712,13 +6712,13 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     this.context?.enter(data, options);
   }
   async _shutdown(shutdownTimeoutMs) {
-    const resolve8 = this._consumeWaitUntilCycle();
+    const resolve9 = this._consumeWaitUntilCycle();
     await this.featureFlagsPoller?.stopPoller(shutdownTimeoutMs);
     this.errorTracking.shutdown();
     try {
       return await super._shutdown(shutdownTimeoutMs);
     } finally {
-      resolve8?.();
+      resolve9?.();
     }
   }
   async _requestRemoteConfigPayload(flagKey) {
@@ -7074,7 +7074,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.68" : "0.0.0-dev",
+    cliVersion: true ? "2.61.69" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7221,10 +7221,10 @@ var _execSeam = {
   }
 };
 var _execSeamAsync = {
-  exec: (file, args2, opts) => new Promise((resolve8, reject) => {
+  exec: (file, args2, opts) => new Promise((resolve9, reject) => {
     (0, import_child_process.execFile)(file, args2, opts, (err, stdout) => {
       if (err) reject(err);
-      else resolve8(typeof stdout === "string" ? stdout : stdout.toString("utf8"));
+      else resolve9(typeof stdout === "string" ? stdout : stdout.toString("utf8"));
     });
   })
 };
@@ -7255,7 +7255,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.68",
+  version: "2.61.69",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7381,8 +7381,8 @@ async function requestCode(pluginId, pluginSecretHash) {
     });
     let timer;
     const timeoutSentinel = /* @__PURE__ */ Symbol("request-code-timeout");
-    const timeoutPromise = new Promise((resolve8) => {
-      timer = setTimeout(() => resolve8(timeoutSentinel), REQUEST_CODE_TIMEOUT_MS);
+    const timeoutPromise = new Promise((resolve9) => {
+      timer = setTimeout(() => resolve9(timeoutSentinel), REQUEST_CODE_TIMEOUT_MS);
     });
     const result = await Promise.race([post2, timeoutPromise]);
     clearTimeout(timer);
@@ -7713,7 +7713,7 @@ async function postBeadsProvisioning(input) {
   }
 }
 async function _postJsonAuthed(url2, body, pluginAuthToken) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url2);
     const transport = u2.protocol === "https:" ? https : http;
@@ -7745,9 +7745,9 @@ async function _postJsonAuthed(url2, body, pluginAuthToken) {
             return;
           }
           try {
-            resolve8(JSON.parse(responseBody));
+            resolve9(JSON.parse(responseBody));
           } catch {
-            resolve8(null);
+            resolve9(null);
           }
         });
       }
@@ -7772,7 +7772,7 @@ function makeHttpError(statusCode, retryAfterHeader, responseBody) {
   return err;
 }
 async function _postJson(url2, body, extraHeaders) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url2);
     const transport = u2.protocol === "https:" ? https : http;
@@ -7802,9 +7802,9 @@ async function _postJson(url2, body, extraHeaders) {
             return;
           }
           try {
-            resolve8(JSON.parse(body2));
+            resolve9(JSON.parse(body2));
           } catch {
-            resolve8(null);
+            resolve9(null);
           }
         });
       }
@@ -7819,7 +7819,7 @@ async function _postJson(url2, body, extraHeaders) {
   });
 }
 async function _getJson(url2, extraHeaders) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const u2 = new URL(url2);
     const transport = u2.protocol === "https:" ? https : http;
     const req = transport.request(
@@ -7843,9 +7843,9 @@ async function _getJson(url2, extraHeaders) {
             return;
           }
           try {
-            resolve8(JSON.parse(body));
+            resolve9(JSON.parse(body));
           } catch {
-            resolve8(null);
+            resolve9(null);
           }
         });
       }
@@ -8427,7 +8427,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.68" ? { ideVersion: "2.61.68" } : {}
+      ..."2.61.69" ? { ideVersion: "2.61.69" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -8591,7 +8591,7 @@ var _transport2 = {
   post: _post
 };
 function _post(url2, headers, payload) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     const u2 = new URL(url2);
     const lib = u2.protocol === "https:" ? https3 : http3;
@@ -8616,7 +8616,7 @@ function _post(url2, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve8({ statusCode: res.statusCode ?? 0, body });
+          resolve9({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -8654,10 +8654,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir47) {
+function isUnsafeWindowsWatchRoot(dir, homedir48) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir47);
+  const home = norm(homedir48);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -9304,12 +9304,12 @@ var _gitSeam = {
   run: _runGitImpl
 };
 async function _runGitImpl(cwd, args2, opts = {}) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let proc;
     try {
       proc = (0, import_child_process3.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve8(null);
+      resolve9(null);
       return;
     }
     let stdout = "";
@@ -9320,13 +9320,13 @@ async function _runGitImpl(cwd, args2, opts = {}) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve8(null));
+    proc.on("error", () => resolve9(null));
     proc.on("close", (code) => {
       if (code === 0 || opts.allowNonZeroExit) {
-        resolve8(stdout);
+        resolve9(stdout);
       } else {
         log.trace("fileWatcher", `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`);
-        resolve8(null);
+        resolve9(null);
       }
     });
   });
@@ -9412,7 +9412,7 @@ var ChunkEmitter = class {
     if (this.pairingInvalid) {
       return Promise.resolve({ dead: true });
     }
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       let refreshedOnce = false;
       const attempt = (attemptsLeft) => {
         _transport3.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
@@ -9420,13 +9420,13 @@ var ChunkEmitter = class {
           if (statusCode === 410 || statusCode === 404 && /SESSION_NOT_FOUND|SESSION_GONE/.test(resBody)) {
             process.stderr.write("[codeam] session was deleted/disconnected \u2014 stopping output stream.\n");
             log.info("chunkEmitter", `dead status=${statusCode} took=${tookMs}ms`);
-            resolve8({ dead: true });
+            resolve9({ dead: true });
             return;
           }
           if (statusCode === 401 || statusCode === 403) {
             if (refreshedOnce) {
               this.markPairingInvalid(statusCode, tookMs);
-              resolve8({ dead: true });
+              resolve9({ dead: true });
               return;
             }
             log.warn("chunkEmitter", `auth ${statusCode} took=${tookMs}ms \u2014 attempting silent refresh`);
@@ -9442,10 +9442,10 @@ var ChunkEmitter = class {
               }
               if (refresh.kind === "gone") {
                 this.markPairingInvalid(statusCode, tookMs);
-                resolve8({ dead: true });
+                resolve9({ dead: true });
                 return;
               }
-              resolve8({ dead: false });
+              resolve9({ dead: false });
             })();
             return;
           }
@@ -9456,7 +9456,7 @@ var ChunkEmitter = class {
           } else {
             log.info("chunkEmitter", `ok status=${statusCode} took=${tookMs}ms`);
           }
-          resolve8({ dead: false });
+          resolve9({ dead: false });
         }).catch((err) => {
           log.warn(
             "chunkEmitter",
@@ -9467,7 +9467,7 @@ var ChunkEmitter = class {
             const delay = 200 * (maxRetries - attemptsLeft + 1);
             setTimeout(() => attempt(attemptsLeft - 1), delay);
           } else {
-            resolve8({ dead: false });
+            resolve9({ dead: false });
           }
         });
       };
@@ -9490,7 +9490,7 @@ var _transport3 = {
   post: _post2
 };
 function _post2(url2, headers, payload) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     const u2 = new URL(url2);
     const transport = u2.protocol === "https:" ? https4 : http4;
@@ -9514,7 +9514,7 @@ function _post2(url2, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve8({ statusCode: res.statusCode ?? 0, body: resData });
+          resolve9({ statusCode: res.statusCode ?? 0, body: resData });
         });
       }
     );
@@ -10589,12 +10589,12 @@ async function applyFileReview(workingDir, filePath, action) {
   return { ok: true, action, filePath, repoRoot };
 }
 function runGit2(cwd, args2) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let proc;
     try {
       proc = (0, import_child_process6.spawn)("git", args2, { cwd, env: process.env });
     } catch (err) {
-      resolve8({ ok: false, code: -1, stdout: "", stderr: err.message });
+      resolve9({ ok: false, code: -1, stdout: "", stderr: err.message });
       return;
     }
     let stdout = "";
@@ -10607,11 +10607,11 @@ function runGit2(cwd, args2) {
     });
     proc.on(
       "error",
-      (err) => resolve8({ ok: false, code: -1, stdout, stderr: stderr + err.message })
+      (err) => resolve9({ ok: false, code: -1, stdout, stderr: stderr + err.message })
     );
     proc.on(
       "close",
-      (code) => resolve8({ ok: code === 0, code: code ?? -1, stdout, stderr })
+      (code) => resolve9({ ok: code === 0, code: code ?? -1, stdout, stderr })
     );
   });
 }
@@ -13283,10 +13283,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os59 = createOsStrategy()) {
-  const found = os59.findInPath("claude") ?? os59.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os60 = createOsStrategy()) {
+  const found = os60.findInPath("claude") ?? os60.findInPath("claude-code");
   if (!found) return null;
-  return os59.buildLaunch(found, extraArgs);
+  return os60.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -13313,12 +13313,12 @@ function isAvailable() {
 }
 function augmentPath() {
   const dirs = probeInstallDirs();
-  const sep6 = path16.delimiter;
+  const sep7 = path16.delimiter;
   const current = process.env.PATH ?? "";
-  const existing = new Set(current.split(sep6).filter(Boolean));
+  const existing = new Set(current.split(sep7).filter(Boolean));
   const additions = dirs.filter((d3) => !existing.has(d3));
   if (additions.length === 0) return;
-  process.env.PATH = additions.join(sep6) + sep6 + current;
+  process.env.PATH = additions.join(sep7) + sep7 + current;
 }
 function runInstaller() {
   const isWindows = process.platform === "win32";
@@ -13330,15 +13330,15 @@ function runInstaller() {
     "-Command",
     "irm https://claude.ai/install.ps1 | iex"
   ] : ["-c", "curl -fsSL https://claude.ai/install.sh | bash"];
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const proc = (0, import_child_process9.spawn)(cmd, args2, { stdio: "inherit" });
     proc.on("error", (err) => {
       console.error(`
   \u2717 Installer failed to launch: ${err.message}`);
-      resolve8(false);
+      resolve9(false);
     });
     proc.on("exit", (code) => {
-      resolve8(code === 0);
+      resolve9(code === 0);
     });
   });
 }
@@ -13471,7 +13471,7 @@ function extractSetupTokenFromOutput(output) {
   return m ? m[0] : null;
 }
 function captureClaudeSetupToken() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = (0, import_node_child_process3.spawn)("claude", ["setup-token"], {
       stdio: ["inherit", "pipe", "inherit"]
     });
@@ -13485,7 +13485,7 @@ function captureClaudeSetupToken() {
     child.on("exit", (code) => {
       const token = extractSetupTokenFromOutput(out2);
       if (token) {
-        resolve8({ method: "setup_token", credential: token, source: "setup-token" });
+        resolve9({ method: "setup_token", credential: token, source: "setup-token" });
         return;
       }
       reject(
@@ -13571,17 +13571,17 @@ function parseUsageOutput(raw) {
   return { percent, resetAt };
 }
 async function fetchClaudeQuota() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const claudeCmd = findInPath("claude") ? "claude" : "claude-code";
     if (!claudeCmd) {
-      resolve8(null);
+      resolve9(null);
       return;
     }
     const helperPath = path18.join(os13.tmpdir(), "codeam-quota-helper.py");
     fs15.writeFileSync(helperPath, HELPER_SCRIPT, { mode: 420 });
     const python = findInPath("python3") ?? findInPath("python");
     if (!python) {
-      resolve8(null);
+      resolve9(null);
       return;
     }
     const proc = (0, import_child_process10.spawn)(python, [helperPath, claudeCmd, "--tools", ""], {
@@ -13608,13 +13608,13 @@ async function fetchClaudeQuota() {
           fs15.unlinkSync(helperPath);
         } catch {
         }
-        resolve8(result);
+        resolve9(result);
       }, 5e3);
     }, 8e3);
     setTimeout(() => {
       if (!resolved) {
         resolved = true;
-        resolve8(null);
+        resolve9(null);
       }
       try {
         proc.kill();
@@ -13639,12 +13639,12 @@ function killActiveSpawnAndCaptureChildren() {
 }
 async function spawnAndCapture(cmd, args2, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 6e4;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     const settle = (value) => {
       if (settled) return;
       settled = true;
-      resolve8(value);
+      resolve9(value);
     };
     let child;
     try {
@@ -13876,8 +13876,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -14555,7 +14555,7 @@ function newestRolloutIdSince(sessionsRoot, resolvedCwd, floorMs) {
   return bestId;
 }
 function sleep2(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function getCurrentUsage2(historyDir) {
   if (!import_node_fs3.default.existsSync(historyDir)) return null;
@@ -14657,8 +14657,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os59 = createOsStrategy();
-      return os59.findInPath("codex") !== null;
+      const os60 = createOsStrategy();
+      return os60.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process4.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -14681,8 +14681,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -14791,16 +14791,16 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os59) {
-  return os59.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os60) {
+  return os60.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os59) {
-  return new Promise((resolve8, reject) => {
-    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os59), ["install", "-g", "@openai/codex"], {
+async function installCodexViaNpm(os60) {
+  return new Promise((resolve9, reject) => {
+    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os60), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
-      if (code === 0) resolve8();
+      if (code === 0) resolve9();
       else reject(new Error(`npm install -g @openai/codex exited ${code}`));
     });
     proc.on("error", (err) => {
@@ -14813,16 +14813,16 @@ async function installCodexViaNpm(os59) {
     });
   });
 }
-function augmentNpmGlobalBin(os59) {
+function augmentNpmGlobalBin(os60) {
   try {
-    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os59), ["prefix", "-g"], {
+    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os60), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os59.id === "win32" ? prefix : path24.join(prefix, "bin");
-    os59.augmentPath([binDir]);
+    const binDir = os60.id === "win32" ? prefix : path24.join(prefix, "bin");
+    os60.augmentPath([binDir]);
   } catch {
   }
 }
@@ -14906,16 +14906,16 @@ var import_node_child_process8 = require("child_process");
 // src/agents/coderabbit/installer.ts
 var import_node_child_process6 = require("child_process");
 var INSTALL_URL = "https://cli.coderabbit.ai/install.sh";
-async function ensureCoderabbitInstalled(os59) {
-  if (os59.findInPath("coderabbit")) return true;
-  if (os59.id === "win32") {
+async function ensureCoderabbitInstalled(os60) {
+  if (os60.findInPath("coderabbit")) return true;
+  if (os60.id === "win32") {
     console.error(
       "\n  \u2717 CodeRabbit on Windows requires WSL.\n    Install the CLI inside your WSL distribution\n    (curl -fsSL https://cli.coderabbit.ai/install.sh | sh)\n    then re-run `codeam link coderabbit` from WSL.\n"
     );
     return false;
   }
   console.log("\n  CodeRabbit CLI not found \u2014 installing via the official script\u2026\n");
-  const ok = await new Promise((resolve8) => {
+  const ok = await new Promise((resolve9) => {
     const INSTALL_TIMEOUT_MS2 = 15e4;
     const proc = (0, import_node_child_process6.spawn)(
       "sh",
@@ -14927,7 +14927,7 @@ async function ensureCoderabbitInstalled(os59) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve8(v);
+      resolve9(v);
     };
     const timer = setTimeout(() => {
       console.error("\n  \u2717 CodeRabbit install timed out \u2014 check network egress and retry.\n");
@@ -14941,8 +14941,8 @@ async function ensureCoderabbitInstalled(os59) {
     proc.on("error", () => finish(false));
   });
   if (!ok) return false;
-  os59.augmentPath([`${os59.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  return os59.findInPath("coderabbit") !== null;
+  os60.augmentPath([`${os60.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  return os60.findInPath("coderabbit") !== null;
 }
 
 // src/agents/coderabbit/link.ts
@@ -14977,10 +14977,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os59) {
+function coderabbitLoginLauncher(os60) {
   return {
     async ensureInstalled() {
-      return ensureCoderabbitInstalled(os59);
+      return ensureCoderabbitInstalled(os60);
     },
     launch() {
       return (0, import_node_child_process7.spawn)("coderabbit", ["auth", "login"], { stdio: "inherit" });
@@ -15036,8 +15036,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path79 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path79) return null;
+  const path80 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path80) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -15054,7 +15054,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path79.trim(),
+    path: path80.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -15137,10 +15137,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path79, lineNo, sevToken, message] = m;
-    if (!path79 || !lineNo || !message) continue;
+    const [, path80, lineNo, sevToken, message] = m;
+    if (!path80 || !lineNo || !message) continue;
     hunks.push({
-      path: path79.trim(),
+      path: path80.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -15200,8 +15200,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -15237,7 +15237,7 @@ var CoderabbitRuntimeStrategy = class {
   }
   async runOneShot(input) {
     const launch = await this.prepareInvocation(input);
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const stdoutBuf = [];
       const stderrBuf = [];
       const proc = (0, import_node_child_process8.spawn)(launch.cmd, launch.args, {
@@ -15249,7 +15249,7 @@ var CoderabbitRuntimeStrategy = class {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve8(out2);
+        resolve9(out2);
       };
       const timer = setTimeout(() => {
         if (settled) return;
@@ -15472,10 +15472,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os59) {
+function cursorLoginLauncher(os60) {
   return {
     async ensureInstalled() {
-      if (os59.findInPath("cursor-agent")) return true;
+      if (os60.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -15539,8 +15539,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -15756,10 +15756,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os59) {
+function aiderLoginLauncher(os60) {
   return {
     async ensureInstalled() {
-      if (os59.findInPath("aider")) return true;
+      if (os60.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -15769,7 +15769,7 @@ function aiderLoginLauncher(os59) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process11.spawn)(os59.id === "win32" ? "cmd.exe" : "sh", os59.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process11.spawn)(os60.id === "win32" ? "cmd.exe" : "sh", os60.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -15841,8 +15841,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("aider");
@@ -15974,8 +15974,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os59 = createOsStrategy();
-      return os59.findInPath("gemini") !== null;
+      const os60 = createOsStrategy();
+      return os60.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process12.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -16165,8 +16165,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -16380,7 +16380,7 @@ function newestSessionSince(bucket, floorMs) {
   return bestId;
 }
 function sleep3(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function joinTextParts(parts) {
   if (!Array.isArray(parts)) return "";
@@ -16457,8 +16457,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -16600,8 +16600,8 @@ var OpencodeRuntimeStrategy = class {
   meta = getAgent("opencode");
   mode = "interactive";
   os;
-  constructor(os59) {
-    this.os = os59;
+  constructor(os60) {
+    this.os = os60;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("opencode");
@@ -16685,20 +16685,20 @@ var OpencodeRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os59) => new ClaudeRuntimeStrategy(os59),
-  codex: (os59) => new CodexRuntimeStrategy(os59),
-  coderabbit: (os59) => new CoderabbitRuntimeStrategy(os59),
-  cursor: (os59) => new CursorRuntimeStrategy(os59),
-  aider: (os59) => new AiderRuntimeStrategy(os59),
-  gemini: (os59) => new GeminiRuntimeStrategy(os59),
-  kimi: (os59) => new KimiRuntimeStrategy(os59),
-  opencode: (os59) => new OpencodeRuntimeStrategy(os59)
+  claude: (os60) => new ClaudeRuntimeStrategy(os60),
+  codex: (os60) => new CodexRuntimeStrategy(os60),
+  coderabbit: (os60) => new CoderabbitRuntimeStrategy(os60),
+  cursor: (os60) => new CursorRuntimeStrategy(os60),
+  aider: (os60) => new AiderRuntimeStrategy(os60),
+  gemini: (os60) => new GeminiRuntimeStrategy(os60),
+  kimi: (os60) => new KimiRuntimeStrategy(os60),
+  opencode: (os60) => new OpencodeRuntimeStrategy(os60)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os59 = createOsStrategy()) {
+function createAgentStrategy(agent, os60 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -16708,10 +16708,10 @@ function createAgentStrategy(agent, os59 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os59);
+  return build(os60);
 }
-function createInteractiveAgentStrategy(agent, os59 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os59);
+function createInteractiveAgentStrategy(agent, os60 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os60);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -16827,7 +16827,7 @@ async function link(args2 = []) {
   waitSpin.start(waitMsg());
   const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
   countdown.unref?.();
-  const paired = await new Promise((resolve8, reject) => {
+  const paired = await new Promise((resolve9, reject) => {
     let stopPoll = null;
     const sigint = () => {
       clearInterval(countdown);
@@ -16840,7 +16840,7 @@ async function link(args2 = []) {
         process.removeListener("SIGINT", sigint);
         clearInterval(countdown);
         waitSpin.stop("Paired");
-        resolve8(info);
+        resolve9(info);
       },
       () => {
         clearInterval(countdown);
@@ -16998,14 +16998,14 @@ async function captureFreshCredentials(ctx) {
     }
   };
   try {
-    const token = await new Promise((resolve8, reject) => {
+    const token = await new Promise((resolve9, reject) => {
       let settled = false;
       const tryExtract = async () => {
         if (settled) return;
         const t2 = await ctx.locator.extract();
         if (t2 && !settled) {
           settled = true;
-          resolve8(t2);
+          resolve9(t2);
         }
       };
       watcher.on("add", () => void tryExtract());
@@ -17214,7 +17214,7 @@ function deliverPendingCoderabbitCallback(callbackUrl) {
 function runCoderabbitOAuthLogin(deps) {
   const timeoutMs = deps.timeoutMs ?? 18e4;
   const spawnProc = deps.spawn ?? spawnCoderabbitLoginProc;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     let stdout = "";
     let last = null;
@@ -17227,13 +17227,13 @@ function runCoderabbitOAuthLogin(deps) {
         child.kill("SIGKILL");
       } catch {
       }
-      resolve8(r);
+      resolve9(r);
     };
     let child;
     try {
       child = spawnProc("coderabbit", ["auth", "login", "--agent"]);
     } catch (err) {
-      resolve8({ ok: false, error: err instanceof Error ? err.message : "spawn failed" });
+      resolve9({ ok: false, error: err instanceof Error ? err.message : "spawn failed" });
       return;
     }
     const timer = setTimeout(
@@ -17408,26 +17408,26 @@ function restoreCoderabbitOauthBlob(value) {
   (0, import_node_fs5.writeFileSync)(path36.join(dir, file), contents, { mode: 384 });
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os59 = deps.os ?? createOsStrategy();
+  const os60 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os59.homeDir();
-  os59.augmentPath(
-    os59.id === "win32" ? [
+  const home = os60.homeDir();
+  os60.augmentPath(
+    os60.id === "win32" ? [
       path36.join(home, ".local", "bin"),
       path36.join(process.env.APPDATA ?? path36.join(home, "AppData", "Roaming"), "npm"),
       path36.join(home, "scoop", "shims")
     ] : [path36.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os59.findInPath("coderabbit") !== null;
+  const installed2 = os60.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os59.findInPath("coderabbit") !== null,
+    installed: os60.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -17441,7 +17441,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const ok = await ensureInstalled(os59);
+      const ok = await ensureInstalled(os60);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -17465,7 +17465,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os59);
+      const ok = await ensureInstalled(os60);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -17495,7 +17495,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os59);
+      const ok = await ensureInstalled(os60);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -17535,7 +17535,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const ok = await ensureInstalled(os59);
+    const ok = await ensureInstalled(os60);
     res.installed = ok;
     if (!ok) return { ...res, error: "CodeRabbit CLI is not installed" };
   }
@@ -17692,23 +17692,23 @@ async function reviewPullRequest(params, deps) {
   return report;
 }
 function defaultRunGh(args2) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const stdout = [];
     const stderr = [];
     let proc;
     try {
       proc = (0, import_node_child_process17.spawn)("gh", args2, { stdio: ["ignore", "pipe", "pipe"] });
     } catch (err) {
-      resolve8({ code: -1, stdout: "", stderr: err instanceof Error ? err.message : String(err) });
+      resolve9({ code: -1, stdout: "", stderr: err instanceof Error ? err.message : String(err) });
       return;
     }
     proc.stdout?.on("data", (b) => stdout.push(b));
     proc.stderr?.on("data", (b) => stderr.push(b));
     proc.on("error", (err) => {
-      resolve8({ code: -1, stdout: "", stderr: err.message });
+      resolve9({ code: -1, stdout: "", stderr: err.message });
     });
     proc.on("close", (code) => {
-      resolve8({
+      resolve9({
         code: code ?? 0,
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8")
@@ -18680,7 +18680,7 @@ var defaultGitToolingRunner = {
     }
   },
   run(cmd, args2, opts = {}) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const child = (0, import_node_child_process20.spawn)(cmd, args2, {
         stdio: [opts.input !== void 0 ? "pipe" : "ignore", "ignore", "pipe"]
       });
@@ -18689,7 +18689,7 @@ var defaultGitToolingRunner = {
       const done = (code) => {
         if (settled) return;
         settled = true;
-        resolve8({ code, stderr });
+        resolve9({ code, stderr });
       };
       child.stderr?.on("data", (b) => {
         stderr += b.toString();
@@ -18847,7 +18847,7 @@ var defaultHeadroomRunner = {
     }
   },
   run(cmd, args2, opts = {}) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const spawnEnv = opts.env ?? process.env;
       const child = (0, import_node_child_process21.spawn)(cmd, args2, { stdio: ["ignore", "pipe", "pipe"], env: spawnEnv });
       let stderrBuf = "";
@@ -18856,7 +18856,7 @@ var defaultHeadroomRunner = {
       const done = (code) => {
         if (settled) return;
         settled = true;
-        resolve8({ code, stderr: stderrBuf, stdout: stdoutBuf });
+        resolve9({ code, stderr: stderrBuf, stdout: stdoutBuf });
       };
       child.stdout?.on("data", (b) => {
         const chunk = b.toString();
@@ -19427,14 +19427,14 @@ function compareSemver(a, b) {
   return 0;
 }
 function fetchLatest() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const req = https6.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve8(null);
+          resolve9(null);
           return;
         }
         let buf = "";
@@ -19446,21 +19446,21 @@ function fetchLatest() {
           try {
             const json = JSON.parse(buf);
             if (typeof json.version === "string") {
-              resolve8(json.version);
+              resolve9(json.version);
             } else {
-              resolve8(null);
+              resolve9(null);
             }
           } catch {
-            resolve8(null);
+            resolve9(null);
           }
         });
       }
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve8(null);
+      resolve9(null);
     });
-    req.on("error", () => resolve8(null));
+    req.on("error", () => resolve9(null));
   });
 }
 function notifyIfStale(currentVersion, latest) {
@@ -19536,7 +19536,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.68" : null;
+  const current = true ? "2.61.69" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19553,7 +19553,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.68" : null;
+  const current = true ? "2.61.69" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -19573,13 +19573,13 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.68" : null;
+  return true ? "2.61.69" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     (0, import_node_child_process23.execFile)(cmd, args2, { timeout: timeoutMs }, (err, stdout, stderr) => {
       const code = err && typeof err.code === "number" ? err.code : err ? null : 0;
-      resolve8({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
+      resolve9({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
     });
   });
 }
@@ -19902,7 +19902,7 @@ function buildFleetBoxRunArgs(p2) {
 var DOCKER_RUN_TIMEOUT_MS = 12e4;
 var defaultDockerRunner = {
   run(args2, opts = {}) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const child = (0, import_node_child_process25.spawn)("docker", args2, {
         stdio: ["ignore", "pipe", "pipe"],
         env: { ...process.env, ...opts.env }
@@ -19921,7 +19921,7 @@ var defaultDockerRunner = {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve8({ code, stderr: stderrBuf, stdout: stdoutBuf });
+        resolve9({ code, stderr: stderrBuf, stdout: stdoutBuf });
       };
       child.stdout?.on("data", (b) => {
         stdoutBuf += b.toString();
@@ -20772,7 +20772,7 @@ var HostAgentSupervisor = class {
    * host-agent whose env may lack it.
    */
   runAgentInstall(script) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const home = process.env.HOME || os38.homedir();
       const child = (0, import_node_child_process25.spawn)("sh", ["-c", script], {
         env: { ...process.env, HOME: home },
@@ -20788,7 +20788,7 @@ var HostAgentSupervisor = class {
       const done = () => {
         if (settled) return;
         settled = true;
-        resolve8();
+        resolve9();
       };
       const timer = setTimeout(() => {
         log.warn(
@@ -21250,12 +21250,12 @@ async function isExecutableBinary(p2) {
   }
 }
 function extractTgz(tgzPath, destDir) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = (0, import_child_process15.spawn)("tar", ["-xzf", tgzPath, "-C", destDir], { stdio: "ignore" });
     child.on("error", (err) => reject(err));
     child.on(
       "exit",
-      (code) => code === 0 ? resolve8() : reject(new Error(`tar exited with code ${code} while extracting cloudflared`))
+      (code) => code === 0 ? resolve9() : reject(new Error(`tar exited with code ${code} while extracting cloudflared`))
     );
   });
 }
@@ -21469,12 +21469,12 @@ function parseExpoUrl(stdout) {
 // src/services/preview/port-ready.ts
 var net = __toESM(require("net"));
 function isPortListening(port, host2 = "127.0.0.1") {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const socket = new net.Socket();
     const done = (result) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve8(result);
+      resolve9(result);
     };
     socket.setTimeout(1e3);
     socket.once("connect", () => done(true));
@@ -21500,7 +21500,7 @@ var import_path6 = __toESM(require("path"));
 // src/services/preview/run-setup.ts
 var import_child_process17 = require("child_process");
 function runSetupCommand(cmd, args2, cwd, env, opts) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = (0, import_child_process17.spawn)(cmd, args2, {
       cwd,
       env: { ...process.env, ...env ?? {} },
@@ -21520,20 +21520,20 @@ function runSetupCommand(cmd, args2, cwd, env, opts) {
       settled = true;
       log.info("preview", `${tag}: timed out after ${opts.timeoutMs}ms \u2014 killing`);
       killQuiet(child);
-      resolve8({ status: "timeout", code: null });
+      resolve9({ status: "timeout", code: null });
     }, opts.timeoutMs);
     child.once("exit", (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (code === 0) resolve8({ status: "ok", code: 0 });
-      else resolve8({ status: "failed", code });
+      if (code === 0) resolve9({ status: "ok", code: 0 });
+      else resolve9({ status: "failed", code });
     });
     child.once("error", () => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve8({ status: "failed", code: null });
+      resolve9({ status: "failed", code: null });
     });
   });
 }
@@ -21775,23 +21775,23 @@ async function awaitTunnelRegistered(candidate, hostname4, deadlineMs) {
     ac.signal.addEventListener("abort", detach, { once: true });
   };
   try {
-    return await new Promise((resolve8) => {
+    return await new Promise((resolve9) => {
       const onChunk = (chunk) => {
         const s = chunk.toString();
         if (!url2) url2 = parseCloudflaredUrl(s);
         if (TUNNEL_REGISTERED_RE.test(s)) registered = true;
         const trimmed = s.replace(/\n+$/g, "");
         if (trimmed.length > 0) log.info("preview", `cloudflared: ${trimmed}`);
-        if (url2 && registered) resolve8({ kind: "registered", url: url2 });
+        if (url2 && registered) resolve9({ kind: "registered", url: url2 });
       };
       const onExit = (code) => {
-        resolve8({ kind: "exited", sawUrl: url2 != null, code });
+        resolve9({ kind: "exited", sawUrl: url2 != null, code });
       };
       const { stdout, stderr } = candidate;
       if (stdout) scoped(() => stdout.on("data", onChunk), () => stdout.off("data", onChunk));
       if (stderr) scoped(() => stderr.on("data", onChunk), () => stderr.off("data", onChunk));
       scoped(() => candidate.on("exit", onExit), () => candidate.off("exit", onExit));
-      timer = setTimeout(() => resolve8({ kind: "timeout", sawUrl: url2 != null }), deadlineMs);
+      timer = setTimeout(() => resolve9({ kind: "timeout", sawUrl: url2 != null }), deadlineMs);
     });
   } finally {
     ac.abort();
@@ -22328,12 +22328,12 @@ var _spawnSeam = {
   run: _defaultSpawn
 };
 function _defaultSpawn(binaryPath, args2, opts) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let proc;
     try {
       proc = (0, import_child_process19.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
     } catch (err) {
-      resolve8({ code: -1, stdout: "", stderr: err.message });
+      resolve9({ code: -1, stdout: "", stderr: err.message });
       return;
     }
     let stdout = "";
@@ -22344,8 +22344,8 @@ function _defaultSpawn(binaryPath, args2, opts) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", (err) => resolve8({ code: -1, stdout, stderr: err.message }));
-    proc.on("close", (code) => resolve8({ code: code ?? -1, stdout, stderr }));
+    proc.on("error", (err) => resolve9({ code: -1, stdout, stderr: err.message }));
+    proc.on("close", (code) => resolve9({ code: code ?? -1, stdout, stderr }));
   });
 }
 var _adapterSeam = {
@@ -22522,22 +22522,22 @@ var _installSpawnSeam = {
   run: _defaultInstallSpawn
 };
 function _defaultInstallSpawn(strategy) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let proc;
     try {
       proc = (0, import_child_process20.spawn)(strategy.command, strategy.args, { env: process.env });
     } catch (err) {
-      resolve8({ ok: false, code: -1, stderr: err.message });
+      resolve9({ ok: false, code: -1, stderr: err.message });
       return;
     }
     let stderr = "";
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", (err) => resolve8({ ok: false, code: -1, stderr: err.message }));
+    proc.on("error", (err) => resolve9({ ok: false, code: -1, stderr: err.message }));
     proc.on(
       "close",
-      (code) => resolve8({ ok: code === 0, code: code ?? -1, stderr })
+      (code) => resolve9({ ok: code === 0, code: code ?? -1, stderr })
     );
   });
 }
@@ -22598,11 +22598,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os59 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os60 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os59 === "windows" && a !== "amd64") return null;
-  return `${os59}-${a}`;
+  if (os60 === "windows" && a !== "amd64") return null;
+  return `${os60}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -22706,14 +22706,14 @@ var _doltInstallSpawnSeam = {
 };
 var DOLT_INSTALL_TIMEOUT_MS = 12e4;
 function _defaultDoltInstallSpawn(strategy) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     let timer;
     const finish = (r) => {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      resolve8(r);
+      resolve9(r);
     };
     let proc;
     try {
@@ -24329,7 +24329,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
   });
   const token = ctx.pluginAuthToken;
   void (async () => {
-    const os59 = createOsStrategy();
+    const os60 = createOsStrategy();
     try {
       const report = await reviewPullRequest(
         {
@@ -24338,7 +24338,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
           baseBranch: parsed.baseBranch
         },
         {
-          runReview: (input) => new CoderabbitRuntimeStrategy(os59).runOneShot(input),
+          runReview: (input) => new CoderabbitRuntimeStrategy(os60).runOneShot(input),
           runGh: (args2) => defaultRunGh(args2),
           postReport: async (r) => {
             if (!token) return;
@@ -24570,16 +24570,16 @@ async function runNpmInstallLatest() {
     const invocation = buildNpmInstallInvocation({ sudo: useSudo });
     const useShell = process.platform === "win32";
     const command2 = useShell && invocation.command.includes(" ") ? `"${invocation.command}"` : invocation.command;
-    const result = await new Promise((resolve8) => {
+    const result = await new Promise((resolve9) => {
       (0, import_child_process24.execFile)(
         command2,
         invocation.args,
         { timeout: CLI_UPDATE_INSTALL_TIMEOUT_MS, shell: useShell },
         (err, _stdout, stderr) => {
           if (!err) {
-            resolve8({ ok: true });
+            resolve9({ ok: true });
           } else {
-            resolve8({ ok: false, error: (stderr || err.message).slice(0, 300) });
+            resolve9({ ok: false, error: (stderr || err.message).slice(0, 300) });
           }
         }
       );
@@ -25174,7 +25174,7 @@ function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
-    await new Promise((resolve8) => {
+    await new Promise((resolve9) => {
       const proc = (0, import_child_process25.spawn)(
         "gh",
         [
@@ -25188,8 +25188,8 @@ function buildKeepAlive(ctx) {
         { stdio: "ignore", detached: true }
       );
       proc.unref();
-      proc.on("exit", () => resolve8());
-      proc.on("error", () => resolve8());
+      proc.on("exit", () => resolve9());
+      proc.on("error", () => resolve9());
     });
   }
   return {
@@ -25407,11 +25407,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path79 = fileFlag.slice("--token-file=".length);
+    const path80 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs58.readFileSync(path79, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path79} is empty`);
-      rmIfExistsQuiet(path79);
+      const content = fs58.readFileSync(path80, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path80} is empty`);
+      rmIfExistsQuiet(path80);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -25668,10 +25668,10 @@ function wrapWithHeadroom(launch, opts) {
 var _present;
 function headroomPresent() {
   if (_present !== void 0) return Promise.resolve(_present);
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     (0, import_node_child_process26.execFile)("headroom", ["--version"], (err) => {
       _present = !err;
-      resolve8(_present);
+      resolve9(_present);
     });
   });
 }
@@ -26061,7 +26061,7 @@ function resolveClaudeNativeBinary(deps = {}) {
   const candidate = import_path8.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
   return existsSync27(candidate) ? candidate : null;
 }
-var realSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var realSleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 async function waitForClaudeNativeBinary(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
   const pollMs = opts.pollMs ?? 500;
@@ -26142,7 +26142,7 @@ var PERMANENT_ADAPTER_STARTUP_RE = /IneligibleTierError|UNSUPPORTED_CLIENT|no lo
 function probeAdapterModuleGraph(command2, args2, opts = {}) {
   const livenessMs = opts.livenessMs ?? 400;
   const spawnFn = opts.spawnFn ?? import_child_process26.spawn;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     let stderr = "";
     let timer;
@@ -26155,12 +26155,12 @@ function probeAdapterModuleGraph(command2, args2, opts = {}) {
         child?.kill("SIGKILL");
       } catch {
       }
-      resolve8(r);
+      resolve9(r);
     };
     try {
       child = spawnFn(command2, [...args2], { stdio: ["pipe", "ignore", "pipe"] });
     } catch {
-      resolve8("ok");
+      resolve9("ok");
       return;
     }
     child.stderr?.on("data", (d3) => {
@@ -26211,10 +26211,10 @@ function augmentPath2() {
   if (!parts.includes(dir)) process.env.PATH = `${dir}:${process.env.PATH ?? ""}`;
 }
 async function runInstaller2() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const proc = (0, import_node_child_process27.spawn)("sh", ["-c", `curl -fsSL ${INSTALL_URL2} | bash`], { stdio: "inherit" });
-    proc.on("close", (code) => resolve8(code === 0));
-    proc.on("error", () => resolve8(false));
+    proc.on("close", (code) => resolve9(code === 0));
+    proc.on("error", () => resolve9(false));
   });
 }
 async function ensureKimiInstalled() {
@@ -26263,10 +26263,10 @@ function augmentPath3() {
   if (!parts.includes(dir)) process.env.PATH = `${dir}:${process.env.PATH ?? ""}`;
 }
 async function runInstaller3() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const proc = (0, import_node_child_process28.spawn)("sh", ["-c", `curl -fsSL ${INSTALL_URL3} | bash`], { stdio: "inherit" });
-    proc.on("close", (code) => resolve8(code === 0));
-    proc.on("error", () => resolve8(false));
+    proc.on("close", (code) => resolve9(code === 0));
+    proc.on("error", () => resolve9(false));
   });
 }
 async function ensureOpencodeInstalled() {
@@ -26441,11 +26441,11 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_ADAPTER_RETRY_TIMEOUT_MS;
   const pollMs = opts.pollMs ?? DEFAULT_ADAPTER_RETRY_POLL_MS;
   const now = opts.now ?? Date.now;
-  const sleep5 = opts.sleep ?? ((ms) => new Promise((resolve9) => setTimeout(resolve9, ms)));
-  const resolve8 = opts.resolve ?? getAcpAdapter;
+  const sleep5 = opts.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+  const resolve9 = opts.resolve ?? getAcpAdapter;
   const attempt = () => {
     try {
-      return resolve8(agent);
+      return resolve9(agent);
     } catch {
       return null;
     }
@@ -26531,7 +26531,7 @@ function parseJsonl(filePath) {
   return messages;
 }
 function post(endpoint, body, pluginAuthToken) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE8}${endpoint}`);
     const transport = u2.protocol === "https:" ? https7 : http6;
@@ -26556,17 +26556,17 @@ function post(endpoint, body, pluginAuthToken) {
         res.resume();
         const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
         if (!ok) log.warn("history:post", `${endpoint} \u2192 HTTP ${res.statusCode}`);
-        resolve8(ok);
+        resolve9(ok);
       }
     );
     req.on("error", (err) => {
       log.warn("history:post", `${endpoint} network error`, err);
-      resolve8(false);
+      resolve9(false);
     });
     req.on("timeout", () => {
       log.warn("history:post", `${endpoint} timeout after 15s`);
       req.destroy();
-      resolve8(false);
+      resolve9(false);
     });
     req.write(payload);
     req.end();
@@ -27063,8 +27063,8 @@ var HistoryService = class _HistoryService {
 var import_node_child_process29 = require("child_process");
 var fs61 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
-var os52 = __toESM(require("os"));
-var path66 = __toESM(require("path"));
+var os53 = __toESM(require("os"));
+var path67 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -29103,12 +29103,12 @@ var Connection = class {
     const id = this.nextRequestId++;
     let cancel = () => {
     };
-    const responsePromise = new Promise((resolve8, reject) => {
+    const responsePromise = new Promise((resolve9, reject) => {
       const pendingResponse = {
         resolve: (response) => {
           try {
             const value = mapResponse ? mapResponse(response) : response;
-            resolve8(value);
+            resolve9(value);
           } catch (error) {
             reject(error);
           }
@@ -29186,8 +29186,8 @@ var Connection = class {
   initialize(stream, handlers2) {
     this.stream = stream;
     this.staticHandlers = handlers2;
-    this.closedPromise = new Promise((resolve8) => {
-      this.abortController.signal.addEventListener("abort", () => resolve8());
+    this.closedPromise = new Promise((resolve9) => {
+      this.abortController.signal.addEventListener("abort", () => resolve9());
     });
     void this.receive();
   }
@@ -29975,8 +29975,8 @@ var AsyncQueue = class {
     if (this.failed) {
       return Promise.reject(this.failure);
     }
-    return new Promise((resolve8, reject) => {
-      this.waiters.push({ resolve: resolve8, reject });
+    return new Promise((resolve9, reject) => {
+      this.waiters.push({ resolve: resolve9, reject });
     });
   }
 };
@@ -31089,6 +31089,40 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
   };
 }
 
+// src/agents/acp/internal-paths.ts
+var path66 = __toESM(require("path"));
+var os52 = __toESM(require("os"));
+var INTERNAL_TOKENS = [".codeam", "house-claude"];
+function textReferencesInternal(text) {
+  if (!text) return false;
+  return INTERNAL_TOKENS.some((t2) => text.includes(t2));
+}
+function pathIsInternal(p2, homeDir2 = os52.homedir()) {
+  if (!p2) return false;
+  const abs = path66.resolve(p2);
+  const home = path66.resolve(homeDir2);
+  const within = (root) => abs === root || abs.startsWith(root + path66.sep);
+  return within(path66.join(home, ".codeam")) || within(path66.join(home, ".beads")) || abs === path66.join(home, ".codeam-host.log") || abs.includes(`${path66.sep}house-claude${path66.sep}`) || abs.endsWith(`${path66.sep}house-claude`);
+}
+function toolCallReferencesInternal(call) {
+  if (textReferencesInternal(call.title)) return true;
+  if (call.rawInput != null) {
+    try {
+      return textReferencesInternal(JSON.stringify(call.rawInput));
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function internalPathPermissionOutcome(request) {
+  if (!toolCallReferencesInternal(request.toolCall)) return null;
+  const reject = request.options.find((o) => o.kind === "reject_always") ?? request.options.find((o) => o.kind === "reject_once");
+  if (reject) return { outcome: { outcome: "selected", optionId: reject.optionId } };
+  return { outcome: { outcome: "cancelled" } };
+}
+var INTERNAL_BLOCK_REASON = "This path is a CodeAgent platform internal (CodeAgent's own runtime plumbing, not part of the user's project) and is off-limits. Continue with the user's own project files.";
+
 // src/agents/acp/client.ts
 var TRANSIENT_ADAPTER_SPAWN_RE = /ETXTBSY|ENOENT/;
 var MAX_START_ATTEMPTS = 5;
@@ -31780,14 +31814,14 @@ var AcpClient = class {
     this.sessionId = null;
     try {
       child.kill("SIGTERM");
-      const grace = new Promise((resolve8) => {
+      const grace = new Promise((resolve9) => {
         const t2 = setTimeout(() => {
           killQuiet(child, "SIGKILL");
-          resolve8();
+          resolve9();
         }, 2e3);
         child.once("exit", () => {
           clearTimeout(t2);
-          resolve8();
+          resolve9();
         });
       });
       await grace;
@@ -31848,6 +31882,9 @@ var AcpClient = class {
         }
       },
       readTextFile: async (params) => {
+        if (!isLocalSession() && pathIsInternal(params.path)) {
+          throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
+        }
         try {
           const content = await fs61.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
@@ -31868,6 +31905,9 @@ var AcpClient = class {
         }
       },
       writeTextFile: async (params) => {
+        if (!isLocalSession() && pathIsInternal(params.path)) {
+          throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
+        }
         try {
           await fs61.writeFile(params.path, params.content, "utf8");
           return {};
@@ -31929,29 +31969,29 @@ function applyLineRange(content, line, limit) {
   return { content: lines.slice(start2, end).join("\n") };
 }
 function knownAgentBinaryDirs() {
-  const home = os52.homedir();
+  const home = os53.homedir();
   const out2 = [];
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path66.join(home, ".nvm/versions/node")
+    path67.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path66.join(root, child, "bin"));
+        out2.push(path67.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path66.join(home, ".volta/bin"));
+  out2.push(path67.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path66.join(home, ".local/bin"));
-  out2.push(path66.join(home, "bin"));
+  out2.push(path67.join(home, ".local/bin"));
+  out2.push(path67.join(home, "bin"));
   if (process.platform === "win32") {
     const { LOCALAPPDATA, APPDATA } = process.env;
-    if (LOCALAPPDATA) out2.push(path66.join(LOCALAPPDATA, "cursor-agent"));
-    if (APPDATA) out2.push(path66.join(APPDATA, "npm"));
+    if (LOCALAPPDATA) out2.push(path67.join(LOCALAPPDATA, "cursor-agent"));
+    if (APPDATA) out2.push(path67.join(APPDATA, "npm"));
   }
   return out2.filter((p2) => {
     try {
@@ -31963,7 +32003,7 @@ function knownAgentBinaryDirs() {
 }
 function expandPathForAgentBinaries(existingPath) {
   const existing = new Set(
-    existingPath.split(path66.delimiter).filter((p2) => p2.length > 0)
+    existingPath.split(path67.delimiter).filter((p2) => p2.length > 0)
   );
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
@@ -31973,7 +32013,7 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path66.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path67.delimiter);
 }
 
 // src/agents/acp/headroom-budget-proxy.ts
@@ -32016,7 +32056,7 @@ var _transport4 = {
   get: _get
 };
 function _post3(url2, headers, payload) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     const u2 = new URL(url2);
     const lib = u2.protocol === "https:" ? https8 : http7;
@@ -32041,7 +32081,7 @@ function _post3(url2, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve8({ statusCode: res.statusCode ?? 0, body });
+          resolve9({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -32058,7 +32098,7 @@ function _post3(url2, headers, payload) {
   });
 }
 function _get(url2, headers) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     const u2 = new URL(url2);
     const lib = u2.protocol === "https:" ? https8 : http7;
@@ -32082,7 +32122,7 @@ function _get(url2, headers) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve8({ statusCode: res.statusCode ?? 0, body });
+          resolve9({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -32456,13 +32496,13 @@ function commonPrefixLength(a, b) {
 // src/agents/acp/onboarding.ts
 var import_child_process27 = require("child_process");
 var fs62 = __toESM(require("fs"));
-var os53 = __toESM(require("os"));
-var path67 = __toESM(require("path"));
+var os54 = __toESM(require("os"));
+var path68 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path67.join(os53.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  markerPath: (sessionId) => path68.join(os54.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
   exists: (p2) => fs62.existsSync(p2),
   write: (p2) => {
-    fs62.mkdirSync(path67.dirname(p2), { recursive: true });
+    fs62.mkdirSync(path68.dirname(p2), { recursive: true });
     fs62.writeFileSync(p2, "");
   },
   disabled: () => {
@@ -32500,7 +32540,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path67.basename(cwd || "");
+  const base = path68.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -32753,12 +32793,12 @@ var import_crypto5 = require("crypto");
 // src/services/turn-files/git-changeset.ts
 var import_child_process28 = require("child_process");
 var fs64 = __toESM(require("fs/promises"));
-var path69 = __toESM(require("path"));
+var path70 = __toESM(require("path"));
 
 // src/services/turn-files/review-ignore.ts
 var import_ignore2 = __toESM(require("ignore"));
 var fs63 = __toESM(require("fs"));
-var path68 = __toESM(require("path"));
+var path69 = __toESM(require("path"));
 var CURATED_REVIEW_IGNORE = [
   // Google Cloud SDK (the incident) — installs a huge python tree.
   "google-cloud-sdk/",
@@ -32797,7 +32837,7 @@ var CURATED_REVIEW_IGNORE = [
 function makeReviewIgnore(repoRoot) {
   const ig = (0, import_ignore2.default)().add(CURATED_REVIEW_IGNORE);
   try {
-    const custom = fs63.readFileSync(path68.join(repoRoot, ".codeam", "reviewignore"), "utf8");
+    const custom = fs63.readFileSync(path69.join(repoRoot, ".codeam", "reviewignore"), "utf8");
     ig.add(custom);
   } catch {
   }
@@ -32842,7 +32882,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (!truncated && row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path69.join(opts.repoRoot, row.filePath)
+        path70.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -32934,12 +32974,12 @@ function runGit3(cwd, args2) {
   return _runGitImpl2.run(cwd, args2);
 }
 function defaultRunGit(cwd, args2) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let proc;
     try {
       proc = (0, import_child_process28.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve8(null);
+      resolve9(null);
       return;
     }
     let stdout = "";
@@ -32950,16 +32990,16 @@ function defaultRunGit(cwd, args2) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve8(null));
+    proc.on("error", () => resolve9(null));
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve8(stdout);
+        resolve9(stdout);
       } else {
         log.trace(
           "turnFiles",
           `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`
         );
-        resolve8(null);
+        resolve9(null);
       }
     });
   });
@@ -32984,8 +33024,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path69.relative(workingDir, dir),
-        repoName: path69.basename(dir)
+        repoPath: path70.relative(workingDir, dir),
+        repoName: path70.basename(dir)
       });
       return;
     }
@@ -32993,14 +33033,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path69.join(dir, entry.name), depth + 1);
+      await walk(path70.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
 var fs65 = __toESM(require("fs/promises"));
-var path70 = __toESM(require("path"));
+var path71 = __toESM(require("path"));
 var import_os12 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -33033,15 +33073,15 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path70.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path70.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path71.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path71.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs65.mkdir(path70.dirname(this.filePath), { recursive: true });
+    await fs65.mkdir(path71.dirname(this.filePath), { recursive: true });
     await fs65.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
@@ -33347,25 +33387,25 @@ function baselineKey(entry) {
 
 // src/agents/acp/withTimeout.ts
 function withTimeout(p2, ms) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
-      resolve8(void 0);
+      resolve9(void 0);
     }, ms);
     p2.then(
       (v) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve8(v);
+        resolve9(v);
       },
       () => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve8(void 0);
+        resolve9(void 0);
       }
     );
   });
@@ -34304,7 +34344,7 @@ var StreamingState = class {
    * default-reject. Caller is the SDK's `onRequestPermission`.
    */
   registerPermission(args2) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const timeoutTimer = setTimeout(() => {
         if (this.pending?.kind === "permission" && this.pending.questionId === args2.questionId) {
           log.warn(
@@ -34312,7 +34352,7 @@ var StreamingState = class {
             `permission ${args2.questionId.slice(0, 8)} TTL expired \u2014 auto-cancel`
           );
           this.pending = null;
-          resolve8({ outcome: { outcome: "cancelled" } });
+          resolve9({ outcome: { outcome: "cancelled" } });
         }
       }, PERMISSION_TIMEOUT_MS);
       this.pending = {
@@ -34320,7 +34360,7 @@ var StreamingState = class {
         questionId: args2.questionId,
         labels: args2.labels,
         optionIdByLabel: args2.optionIdByLabel,
-        resolve: resolve8,
+        resolve: resolve9,
         timeoutTimer
       };
     });
@@ -34352,14 +34392,14 @@ var StreamingState = class {
       const label = this.pending.labels[index];
       const optionId = label ? this.pending.optionIdByLabel[label] : void 0;
       clearTimeout(this.pending.timeoutTimer);
-      const resolve8 = this.pending.resolve;
+      const resolve9 = this.pending.resolve;
       this.pending = null;
       if (!optionId) {
         log.warn("acpRunner", `select_option index=${index} out of bounds \u2014 cancel`);
-        resolve8({ outcome: { outcome: "cancelled" } });
+        resolve9({ outcome: { outcome: "cancelled" } });
         return { kind: "resolved" };
       }
-      resolve8({ outcome: { outcome: "selected", optionId } });
+      resolve9({ outcome: { outcome: "selected", optionId } });
       return { kind: "resolved" };
     }
     const text = this.pending.options[index];
@@ -34799,6 +34839,16 @@ async function runAcpSession(opts) {
     beginLoadReplay: () => streaming.beginLoadReplay(),
     endLoadReplay: () => streaming.endLoadReplay(),
     onRequestPermission: async (request) => {
+      if (!isLocalSession()) {
+        const denied = internalPathPermissionOutcome(request);
+        if (denied) {
+          log.warn(
+            "acpRunner",
+            "internal-path guard \u2014 denying tool call referencing a CodeAgent platform internal"
+          );
+          return denied;
+        }
+      }
       if (opts.autoApprovePermissions) {
         const allow = pickAllowOption(request.options);
         if (allow) {
@@ -36077,8 +36127,8 @@ function fetchQuotaUsage(runtime, historySvc) {
 
 // src/beads/workflow-hint.ts
 var fs66 = __toESM(require("fs"));
-var path71 = __toESM(require("path"));
-var os54 = __toESM(require("os"));
+var path72 = __toESM(require("path"));
+var os55 = __toESM(require("os"));
 var BEADS_HINT_MARKER = "<!-- codeam:beads-workflow -->";
 var BEADS_HINT = `${BEADS_HINT_MARKER}
 # Beads (bd) \u2014 task tracking + persistent memory (ALWAYS use it)
@@ -36092,16 +36142,16 @@ This environment uses **bd (beads)** for issue/task tracking and persistent memo
 - \`bd ready\` (available work) \xB7 \`bd show <id>\` \xB7 \`bd update <id> --claim\` \xB7 \`bd close <id>\`.
 - Use \`bd remember "..."\` for persistent knowledge \u2014 do NOT use MEMORY.md files.
 ${BEADS_HINT_MARKER}`;
-function ensureBeadsWorkflowHint(homeDir2 = os54.homedir()) {
+function ensureBeadsWorkflowHint(homeDir2 = os55.homedir()) {
   try {
-    const file = path71.join(homeDir2, ".claude", "CLAUDE.md");
+    const file = path72.join(homeDir2, ".claude", "CLAUDE.md");
     let existing = "";
     try {
       existing = fs66.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT_MARKER)) return;
-    fs66.mkdirSync(path71.dirname(file), { recursive: true });
+    fs66.mkdirSync(path72.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${BEADS_HINT}
@@ -36369,10 +36419,10 @@ var NativeTuiDriver = class _NativeTuiDriver {
     this.lastOutput = this.now();
   }
   whenSafeToYield() {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const tick = () => {
         const quietFor = this.now() - this.lastOutput;
-        if (quietFor >= this.idleMs) resolve8();
+        if (quietFor >= this.idleMs) resolve9();
         else setTimeout(tick, this.idleMs - quietFor);
       };
       tick();
@@ -36507,11 +36557,11 @@ var AcpDriver = class {
     this.turnActive = false;
     const waiters = this.waiters;
     this.waiters = [];
-    waiters.forEach((resolve8) => resolve8());
+    waiters.forEach((resolve9) => resolve9());
   }
   whenSafeToYield() {
     if (!this.turnActive) return Promise.resolve();
-    return new Promise((resolve8) => this.waiters.push(resolve8));
+    return new Promise((resolve9) => this.waiters.push(resolve9));
   }
 };
 
@@ -36846,12 +36896,12 @@ function toEpochMs(ts) {
 
 // src/agents/claude/onboarding.ts
 var fs68 = __toESM(require("fs"));
-var os56 = __toESM(require("os"));
-var path72 = __toESM(require("path"));
+var os57 = __toESM(require("os"));
+var path73 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path72.join(os56.homedir(), ".claude.json");
+    const file = path73.join(os57.homedir(), ".claude.json");
     let config = {};
     try {
       config = JSON.parse(fs68.readFileSync(file, "utf8"));
@@ -36879,7 +36929,7 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs68.mkdirSync(path72.dirname(file), { recursive: true });
+    fs68.mkdirSync(path73.dirname(file), { recursive: true });
     fs68.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
@@ -37006,8 +37056,8 @@ async function start(requestedAgent, presetSession) {
     let gateTimer;
     await Promise.race([
       Promise.all([depsReady, agentBinaryReady]),
-      new Promise((resolve8) => {
-        gateTimer = setTimeout(resolve8, GATE_TIMEOUT_MS);
+      new Promise((resolve9) => {
+        gateTimer = setTimeout(resolve9, GATE_TIMEOUT_MS);
       })
     ]);
     if (gateTimer) clearTimeout(gateTimer);
@@ -37362,7 +37412,7 @@ async function pair(args2 = []) {
     waitSpin.message(waitMessage());
   }, 1e3);
   countdownInterval.unref?.();
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     let stopPolling = null;
     function sigintHandler() {
       clearInterval(countdownInterval);
@@ -37413,7 +37463,7 @@ async function pair(args2 = []) {
             pluginAuthToken: info.pluginAuthToken
           });
         }
-        resolve8();
+        resolve9();
       },
       () => {
         clearInterval(countdownInterval);
@@ -37598,7 +37648,7 @@ var import_picocolors11 = __toESM(require("picocolors"));
 var import_child_process29 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors9 = __toESM(require("picocolors"));
-var path73 = __toESM(require("path"));
+var path74 = __toESM(require("path"));
 var execFileP6 = (0, import_util4.promisify)(import_child_process29.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -37642,12 +37692,12 @@ var GitHubCodespacesProvider = class {
     }
     if (!isAuthed) {
       resetStdinForChild();
-      await new Promise((resolve8, reject) => {
+      await new Promise((resolve9, reject) => {
         const proc = (0, import_child_process29.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
-          if (code === 0) resolve8();
+          if (code === 0) resolve9();
           else reject(new Error("gh auth login failed."));
         });
         proc.on("error", reject);
@@ -37676,13 +37726,13 @@ var GitHubCodespacesProvider = class {
       }
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
-      const refreshCode = await new Promise((resolve8, reject) => {
+      const refreshCode = await new Promise((resolve9, reject) => {
         const proc = (0, import_child_process29.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
         );
-        proc.on("exit", (code) => resolve8(code ?? 1));
+        proc.on("exit", (code) => resolve9(code ?? 1));
         proc.on("error", reject);
       });
       if (refreshCode !== 0) {
@@ -37826,10 +37876,10 @@ var GitHubCodespacesProvider = class {
     if (q(proceed) || !proceed) return;
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
-    const ok = await new Promise((resolve8) => {
+    const ok = await new Promise((resolve9) => {
       const proc = (0, import_child_process29.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
-      proc.on("exit", (code) => resolve8(code === 0));
-      proc.on("error", () => resolve8(false));
+      proc.on("exit", (code) => resolve9(code === 0));
+      proc.on("error", () => resolve9(false));
     });
     if (ok) O2.success("gh installed");
     else O2.error("gh install failed");
@@ -37853,14 +37903,14 @@ var GitHubCodespacesProvider = class {
       "Expanding GitHub scopes"
     );
     resetStdinForChild();
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process29.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(
           "gh auth refresh failed. Re-run `gh auth refresh -h github.com -s repo,read:org` manually."
         ));
@@ -38031,13 +38081,13 @@ var GitHubCodespacesProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const proc = (0, import_child_process29.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve8({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve9({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -38058,7 +38108,7 @@ var GitHubCodespacesProvider = class {
       "--",
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const tar = (0, import_child_process29.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -38078,7 +38128,7 @@ var GitHubCodespacesProvider = class {
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
         if (code === 0) {
-          resolve8();
+          resolve9();
         } else {
           const reason = (sshErr || tarErr || `exit ${code}`).trim().slice(0, 500);
           reject(new Error(`Remote tar failed: ${reason}`));
@@ -38087,7 +38137,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path73.posix.dirname(remotePath);
+    const remoteDir = path74.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -38096,7 +38146,7 @@ var GitHubCodespacesProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process29.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
@@ -38108,7 +38158,7 @@ var GitHubCodespacesProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -38157,7 +38207,7 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process30 = require("child_process");
 var import_util5 = require("util");
-var path74 = __toESM(require("path"));
+var path75 = __toESM(require("path"));
 var import_picocolors10 = __toESM(require("picocolors"));
 var execFileP7 = (0, import_util5.promisify)(import_child_process30.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
@@ -38198,10 +38248,10 @@ var GitpodProvider = class {
       "Authenticating Gitpod"
     );
     resetStdinForChild2();
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process30.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error("gitpod login failed."));
       });
       proc.on("error", reject);
@@ -38350,13 +38400,13 @@ var GitpodProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const proc = (0, import_child_process30.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve8({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve9({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -38370,7 +38420,7 @@ var GitpodProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const tar = (0, import_child_process30.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
@@ -38391,13 +38441,13 @@ var GitpodProvider = class {
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path74.posix.dirname(remotePath);
+    const remoteDir = path75.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -38406,7 +38456,7 @@ var GitpodProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process30.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
@@ -38418,7 +38468,7 @@ var GitpodProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -38433,7 +38483,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process31 = require("child_process");
 var import_util6 = require("util");
-var path75 = __toESM(require("path"));
+var path76 = __toESM(require("path"));
 var execFileP8 = (0, import_util6.promisify)(import_child_process31.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -38475,14 +38525,14 @@ var GitLabWorkspacesProvider = class {
       "Authenticating GitLab"
     );
     resetStdinForChild3();
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process31.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error("glab auth login failed."));
       });
       proc.on("error", reject);
@@ -38647,13 +38697,13 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async streamCommand(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const proc = (0, import_child_process31.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve8({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve9({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -38668,7 +38718,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const tar = (0, import_child_process31.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const ssh = (0, import_child_process31.spawn)(
         "ssh",
@@ -38686,20 +38736,20 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path75.posix.dirname(remotePath);
+    const remoteDir = path76.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process31.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
@@ -38711,7 +38761,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -38761,7 +38811,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process32 = require("child_process");
 var import_util7 = require("util");
-var path76 = __toESM(require("path"));
+var path77 = __toESM(require("path"));
 var execFileP9 = (0, import_util7.promisify)(import_child_process32.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -38802,10 +38852,10 @@ var RailwayProvider = class {
       "Authenticating Railway"
     );
     resetStdinForChild4();
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process32.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error("railway login failed."));
       });
       proc.on("error", reject);
@@ -38945,13 +38995,13 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     resetStdinForChild4();
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const proc = (0, import_child_process32.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve8({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve9({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -38969,7 +39019,7 @@ var RailwayProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const tar = (0, import_child_process32.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
       const sh = (0, import_child_process32.spawn)(
         "railway",
@@ -38987,7 +39037,7 @@ var RailwayProvider = class {
       tar.on("error", reject);
       sh.on("error", reject);
       sh.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -38997,13 +39047,13 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path76.posix.dirname(remotePath);
+    const remoteDir = path77.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       const proc = (0, import_child_process32.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
@@ -39015,7 +39065,7 @@ var RailwayProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve8();
+        if (code === 0) resolve9();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -39644,7 +39694,7 @@ var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto13 = require("crypto");
 var fs69 = __toESM(require("fs"));
-var path77 = __toESM(require("path"));
+var path78 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -39700,10 +39750,10 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path77.join(require("os").homedir(), ".codeam");
+  const dir = path78.join(require("os").homedir(), ".codeam");
   try {
     fs69.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path77.join(dir, ".doctor-probe");
+    const probe = path78.join(dir, ".doctor-probe");
     fs69.writeFileSync(probe, "ok", { mode: 384 });
     const read2 = fs69.readFileSync(probe, "utf8");
     fs69.unlinkSync(probe);
@@ -39746,9 +39796,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os59 = createOsStrategy();
+  const os60 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os59.findInPath(meta.binaryName);
+    const found = os60.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -39770,7 +39820,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path77.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path78.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -39812,7 +39862,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.68" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.69" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -40091,11 +40141,11 @@ var RestartableStdioProxy = class {
     rl.on("close", () => this.child?.stdin?.end());
     const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);
     timer.unref();
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       this.ended = (code) => {
         clearInterval(timer);
         process.exitCode = code;
-        resolve8();
+        resolve9();
       };
     });
   }
@@ -40334,7 +40384,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.68" : "unknown";
+  const v = true ? "2.61.69" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -40483,10 +40533,10 @@ var EXIT_CODE_NAMES = {
 };
 
 // src/index.ts
-var os58 = __toESM(require("os"));
+var os59 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os58.homedir();
+    const home = os59.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }