codeam-cli 2.61.81 → 2.61.82

package/dist/index.js

@@ -2624,11 +2624,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path82) {
+function rmIfExistsQuiet(path84) {
   try {
-    fs2.rmSync(path82, { force: true });
+    fs2.rmSync(path84, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path82}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path84}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -2774,9 +2774,9 @@ var _default = makeConfig();
 var { getConfig, ensurePluginId, addSession, removeSession, setActiveSession, getActiveSession, getActiveSessionForAgent, setDisable1mContext, clearAll, saveCliConfig, loadCliConfig } = _default;
 
 // src/commands/pair-auto.ts
-var fs59 = __toESM(require("fs"));
+var fs61 = __toESM(require("fs"));
 var os49 = __toESM(require("os"));
-var path63 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 var import_crypto4 = require("crypto");
 
 // src/services/telemetry.service.ts
@@ -2812,8 +2812,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path82) {
-  return path82.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path84) {
+  return path84.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -5293,9 +5293,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path82, ranges, output) {
+function getContextLinesFromFile(path84, ranges, output) {
   return new Promise((resolve9) => {
-    const stream = (0, import_node_fs.createReadStream)(path82);
+    const stream = (0, import_node_fs.createReadStream)(path84);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -5310,7 +5310,7 @@ function getContextLinesFromFile(path82, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path82, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path84, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -5371,8 +5371,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path82) {
-  return path82.startsWith("node:") || path82.endsWith(".min.js") || path82.endsWith(".min.cjs") || path82.endsWith(".min.mjs") || path82.startsWith("data:");
+function shouldSkipContextLinesForFile(path84) {
+  return path84.startsWith("node:") || path84.endsWith(".min.js") || path84.endsWith(".min.cjs") || path84.endsWith(".min.mjs") || path84.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -7526,7 +7526,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.81" : "0.0.0-dev",
+    cliVersion: true ? "2.61.82" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7707,7 +7707,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.81",
+  version: "2.61.82",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7990,6 +7990,50 @@ async function postPreviewEvent(input) {
     };
   }
 }
+async function pushProjectEnv(input) {
+  try {
+    await _transport.postJsonAuthed(
+      `${API_BASE}/api/project-env/push`,
+      {
+        sessionId: input.sessionId,
+        pluginId: input.pluginId,
+        projectKey: input.projectKey,
+        projectLabel: input.projectLabel,
+        content: input.content,
+        keyCount: input.keyCount
+      },
+      input.pluginAuthToken
+    );
+    return { ok: true };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      status: typeof e.statusCode === "number" ? e.statusCode : 0,
+      message: e.message || "unknown"
+    };
+  }
+}
+async function pullProjectEnv(input) {
+  try {
+    const res = await _transport.postJsonAuthed(
+      `${API_BASE}/api/project-env/pull`,
+      {
+        sessionId: input.sessionId,
+        pluginId: input.pluginId,
+        projectKey: input.projectKey
+      },
+      input.pluginAuthToken
+    );
+    if (res && res.exists === true && typeof res.content === "string") {
+      const keyCount = typeof res.keyCount === "number" ? res.keyCount : 0;
+      return { content: res.content, keyCount };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 async function postBatonEvent(input) {
   try {
     await _transport.postJsonAuthed(
@@ -8939,7 +8983,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.81" ? { ideVersion: "2.61.81" } : {}
+      ..."2.61.82" ? { ideVersion: "2.61.82" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -10313,9 +10357,9 @@ function closeAllTerminals() {
 }
 
 // src/commands/start/handlers.ts
-var fs58 = __toESM(require("fs"));
+var fs60 = __toESM(require("fs"));
 var os48 = __toESM(require("os"));
-var path62 = __toESM(require("path"));
+var path64 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
 var import_child_process24 = require("child_process");
 
@@ -15548,8 +15592,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path82 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path82) return null;
+  const path84 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path84) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -15566,7 +15610,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path82.trim(),
+    path: path84.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -15649,10 +15693,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path82, lineNo, sevToken, message] = m;
-    if (!path82 || !lineNo || !message) continue;
+    const [, path84, lineNo, sevToken, message] = m;
+    if (!path84 || !lineNo || !message) continue;
     hunks.push({
-      path: path82.trim(),
+      path: path84.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -20053,7 +20097,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.81" : null;
+  const current = true ? "2.61.82" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -20070,7 +20114,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.81" : null;
+  const current = true ? "2.61.82" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -20090,7 +20134,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.81" : null;
+  return true ? "2.61.82" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -21750,9 +21794,213 @@ function reclaimOwnOrphanPort(port) {
   return true;
 }
 
+// src/services/preview/host-allow.ts
+var import_fs = require("fs");
+var path50 = __toESM(require("path"));
+var NEXT_ALLOWED_ORIGINS = [
+  "*.trycloudflare.com",
+  "*.preview.codeagent-mobile.com",
+  "*.codeagent-mobile.com"
+];
+var VITE_ALLOWED_HOSTS = [
+  ".trycloudflare.com",
+  ".preview.codeagent-mobile.com",
+  ".codeagent-mobile.com"
+];
+var CONFIG_BASENAMES = {
+  next: "next.config",
+  vite: "vite.config"
+};
+var CONFIG_EXTS = [".ts", ".mjs", ".js", ".cjs", ".mts"];
+var MARKER_DIR = ".codeam";
+var MARKER_FILE = "preview-host-allow.json";
+var ORIG_INFIX = ".codeam-orig";
+function markerPath(cwd) {
+  return path50.join(cwd, MARKER_DIR, MARKER_FILE);
+}
+async function fileExists(p2) {
+  try {
+    await import_fs.promises.access(p2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findConfigFile(cwd, framework) {
+  const base = CONFIG_BASENAMES[framework];
+  for (const ext of CONFIG_EXTS) {
+    if (await fileExists(path50.join(cwd, `${base}${ext}`))) return `${base}${ext}`;
+  }
+  return null;
+}
+async function dependsOn(cwd, pkgName) {
+  try {
+    const raw = await import_fs.promises.readFile(path50.join(cwd, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    return !!(pkg.dependencies?.[pkgName] ?? pkg.devDependencies?.[pkgName]);
+  } catch {
+    return false;
+  }
+}
+async function isEsmConfig(cwd, configFile) {
+  const ext = path50.extname(configFile);
+  if (ext === ".mjs" || ext === ".mts" || ext === ".ts") return true;
+  if (ext === ".cjs") return false;
+  try {
+    const raw = await import_fs.promises.readFile(path50.join(cwd, "package.json"), "utf8");
+    return JSON.parse(raw).type === "module";
+  } catch {
+    return false;
+  }
+}
+function nextShim(origBasename, esm) {
+  const list = JSON.stringify(NEXT_ALLOWED_ORIGINS);
+  const merge = `
+function __codeamWithAllow(cfg) {
+  var c = cfg && typeof cfg === 'object' ? Object.assign({}, cfg) : {};
+  var existing = Array.isArray(c.allowedDevOrigins) ? c.allowedDevOrigins : [];
+  c.allowedDevOrigins = Array.from(new Set(existing.concat(${list})));
+  return c;
+}
+function __codeamMerge(base) {
+  if (typeof base === 'function') {
+    return function () {
+      var r = base.apply(null, arguments);
+      return r && typeof r.then === 'function' ? r.then(__codeamWithAllow) : __codeamWithAllow(r);
+    };
+  }
+  return base && typeof base.then === 'function' ? base.then(__codeamWithAllow) : __codeamWithAllow(base);
+}`;
+  if (origBasename) {
+    return esm ? `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+import __codeamUser from './${origBasename}';
+${merge}
+export default __codeamMerge(__codeamUser);
+` : `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+var __codeamUser = require('./${origBasename}');
+${merge}
+module.exports = __codeamMerge(__codeamUser && __codeamUser.default ? __codeamUser.default : __codeamUser);
+`;
+  }
+  return esm ? `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+export default { allowedDevOrigins: ${list} };
+` : `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+module.exports = { allowedDevOrigins: ${list} };
+`;
+}
+function viteShim(origBasename, esm) {
+  const list = JSON.stringify(VITE_ALLOWED_HOSTS);
+  const merge = `
+function __codeamWithAllow(cfg) {
+  var c = cfg && typeof cfg === 'object' ? Object.assign({}, cfg) : {};
+  var server = Object.assign({}, c.server || {});
+  if (server.allowedHosts === true) { c.server = server; return c; }
+  var existing = Array.isArray(server.allowedHosts) ? server.allowedHosts : [];
+  server.allowedHosts = Array.from(new Set(existing.concat(${list})));
+  c.server = server;
+  return c;
+}
+function __codeamMerge(base) {
+  if (typeof base === 'function') {
+    return function () {
+      var r = base.apply(null, arguments);
+      return r && typeof r.then === 'function' ? r.then(__codeamWithAllow) : __codeamWithAllow(r);
+    };
+  }
+  return base && typeof base.then === 'function' ? base.then(__codeamWithAllow) : __codeamWithAllow(base);
+}`;
+  if (origBasename) {
+    return esm ? `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+import __codeamUser from './${origBasename}';
+${merge}
+export default __codeamMerge(__codeamUser);
+` : `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+var __codeamUser = require('./${origBasename}');
+${merge}
+module.exports = __codeamMerge(__codeamUser && __codeamUser.default ? __codeamUser.default : __codeamUser);
+`;
+  }
+  return esm ? `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+export default { server: { allowedHosts: ${list} } };
+` : `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+module.exports = { server: { allowedHosts: ${list} } };
+`;
+}
+function shimFor(framework, origBasename, esm) {
+  return framework === "next" ? nextShim(origBasename, esm) : viteShim(origBasename, esm);
+}
+async function writeMarker(cwd, marker) {
+  await import_fs.promises.mkdir(path50.join(cwd, MARKER_DIR), { recursive: true });
+  await import_fs.promises.writeFile(markerPath(cwd), JSON.stringify(marker, null, 2), "utf8");
+}
+async function readMarker(cwd) {
+  try {
+    const parsed = JSON.parse(await import_fs.promises.readFile(markerPath(cwd), "utf8"));
+    return parsed && parsed.configFile ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function restorePreviewHostAllow(cwd) {
+  const marker = await readMarker(cwd);
+  if (!marker) return;
+  try {
+    const configAbs = path50.join(cwd, marker.configFile);
+    if (marker.backupFile) {
+      const backupAbs = path50.join(cwd, marker.backupFile);
+      if (await fileExists(backupAbs)) {
+        await import_fs.promises.rm(configAbs, { force: true });
+        await import_fs.promises.rename(backupAbs, configAbs);
+      }
+    } else {
+      await import_fs.promises.rm(configAbs, { force: true });
+    }
+  } catch (err) {
+    log.warn("preview", `host-allow restore failed: ${err instanceof Error ? err.message : err}`);
+  } finally {
+    await import_fs.promises.rm(markerPath(cwd), { force: true }).catch(() => void 0);
+  }
+}
+async function applyPreviewHostAllow(cwd) {
+  try {
+    await restorePreviewHostAllow(cwd);
+    let framework = null;
+    let existing = null;
+    for (const f of ["next", "vite"]) {
+      const cfg = await findConfigFile(cwd, f);
+      if (cfg) {
+        framework = f;
+        existing = cfg;
+        break;
+      }
+    }
+    if (!framework) {
+      if (await dependsOn(cwd, "next")) framework = "next";
+      else if (await dependsOn(cwd, "vite")) framework = "vite";
+    }
+    if (!framework) return;
+    if (existing) {
+      const ext = path50.extname(existing);
+      const origBasename = `${CONFIG_BASENAMES[framework]}${ORIG_INFIX}${ext}`;
+      const esm = await isEsmConfig(cwd, existing);
+      await import_fs.promises.rename(path50.join(cwd, existing), path50.join(cwd, origBasename));
+      await import_fs.promises.writeFile(path50.join(cwd, existing), shimFor(framework, origBasename, esm), "utf8");
+      await writeMarker(cwd, { framework, configFile: existing, backupFile: origBasename });
+      log.info("preview", `host-allow: wrapped ${existing} (${framework}) for tunnel access`);
+    } else {
+      const configFile = `${CONFIG_BASENAMES[framework]}.mjs`;
+      await import_fs.promises.writeFile(path50.join(cwd, configFile), shimFor(framework, null, true), "utf8");
+      await writeMarker(cwd, { framework, configFile, backupFile: null });
+      log.info("preview", `host-allow: created ${configFile} (${framework}) for tunnel access`);
+    }
+  } catch (err) {
+    log.warn("preview", `host-allow apply skipped: ${err instanceof Error ? err.message : err}`);
+  }
+}
+
 // src/services/preview/cloudflared.ts
 var import_child_process15 = require("child_process");
-var import_fs = require("fs");
+var import_fs2 = require("fs");
 var import_promises = __toESM(require("fs/promises"));
 var import_os9 = __toESM(require("os"));
 var import_path4 = __toESM(require("path"));
@@ -21793,7 +22041,7 @@ async function downloadCloudflared(target) {
     const tmp = `${target}.download.tgz`;
     await (0, import_promises2.pipeline)(
       response.body,
-      (0, import_fs.createWriteStream)(tmp)
+      (0, import_fs2.createWriteStream)(tmp)
     );
     try {
       await extractTgz(tmp, import_path4.default.dirname(target));
@@ -21810,7 +22058,7 @@ async function downloadCloudflared(target) {
   }
   await (0, import_promises2.pipeline)(
     response.body,
-    (0, import_fs.createWriteStream)(target, { mode: 493 })
+    (0, import_fs2.createWriteStream)(target, { mode: 493 })
   );
 }
 async function isExecutableBinary(p2) {
@@ -22071,7 +22319,7 @@ async function waitForPortListening(port, opts) {
 }
 
 // src/services/preview/provision-deps.ts
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 var import_path6 = __toESM(require("path"));
 
 // src/services/preview/run-setup.ts
@@ -22219,7 +22467,7 @@ function pickMigrationScript(scripts) {
 }
 async function exists(p2) {
   try {
-    await import_fs2.promises.access(p2);
+    await import_fs3.promises.access(p2);
     return true;
   } catch {
     return false;
@@ -22236,20 +22484,20 @@ async function ensureEnvFile(cwd, generated) {
   }
   const sample = await firstExisting(cwd, ENV_SAMPLES);
   if (sample) {
-    const body = await import_fs2.promises.readFile(import_path6.default.join(cwd, sample), "utf8");
-    await import_fs2.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
+    const body = await import_fs3.promises.readFile(import_path6.default.join(cwd, sample), "utf8");
+    await import_fs3.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
     log.info("provision", `wrote .env from ${sample}`);
     return;
   }
   if (generated.length > 0) {
     const body = "# Generated by codeam \u2014 points at the auto-provisioned local services.\n" + generated.flatMap((s) => s.envLines).join("\n") + "\n";
-    await import_fs2.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
+    await import_fs3.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
     log.info("provision", `generated .env for ${generated.map((s) => s.name).join("+")}`);
   }
 }
 async function readPackageJson(cwd) {
   try {
-    return JSON.parse(await import_fs2.promises.readFile(import_path6.default.join(cwd, "package.json"), "utf8"));
+    return JSON.parse(await import_fs3.promises.readFile(import_path6.default.join(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -22290,9 +22538,9 @@ async function provisionProjectDependencies(cwd) {
       generated = detectServicesFromDeps(pkg);
       if (generated.length > 0) {
         const dir = import_path6.default.join(cwd, ".codeam", "provision");
-        await import_fs2.promises.mkdir(dir, { recursive: true });
+        await import_fs3.promises.mkdir(dir, { recursive: true });
         const file = import_path6.default.join(dir, "compose.generated.yaml");
-        await import_fs2.promises.writeFile(file, renderComposeYaml(generated));
+        await import_fs3.promises.writeFile(file, renderComposeYaml(generated));
         log.info(
           "provision",
           `no compose in repo \u2014 generated ${generated.map((s) => s.name).join("+")}`
@@ -22313,12 +22561,12 @@ async function provisionProjectDependencies(cwd) {
 }
 
 // src/services/preview/setup-deps.ts
-var import_fs3 = __toESM(require("fs"));
+var import_fs4 = __toESM(require("fs"));
 var import_path7 = __toESM(require("path"));
 function detectMissingNodeDeps(cwd) {
-  if (!import_fs3.default.existsSync(import_path7.default.join(cwd, "package.json"))) return null;
-  if (import_fs3.default.existsSync(import_path7.default.join(cwd, "node_modules"))) return null;
-  if (import_fs3.default.existsSync(import_path7.default.join(cwd, "yarn.lock"))) {
+  if (!import_fs4.default.existsSync(import_path7.default.join(cwd, "package.json"))) return null;
+  if (import_fs4.default.existsSync(import_path7.default.join(cwd, "node_modules"))) return null;
+  if (import_fs4.default.existsSync(import_path7.default.join(cwd, "yarn.lock"))) {
     return { cmd: "yarn", args: ["install"] };
   }
   return { cmd: "npm", args: ["install", "--legacy-peer-deps"] };
@@ -22410,6 +22658,7 @@ async function killPreview(sessionId) {
     if (preview.tunnel) killProcessTree(preview.tunnel, "SIGKILL");
   }, 250);
   sigkillTimer.unref?.();
+  await restorePreviewHostAllow(preview.cwd);
   activePreviews.delete(sessionId);
 }
 async function killAllPreviews() {
@@ -22421,10 +22670,153 @@ function activePreviewSessionIds() {
 }
 
 // src/services/preview/start-orchestrator.ts
-var import_child_process18 = require("child_process");
-var fs51 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
+var import_child_process19 = require("child_process");
+var fs54 = __toESM(require("fs"));
+var path57 = __toESM(require("path"));
 var import_which2 = __toESM(require("which"));
+
+// src/services/project-env/index.ts
+var import_fs5 = require("fs");
+var path56 = __toESM(require("path"));
+
+// src/beads/project-key.ts
+var import_child_process18 = require("child_process");
+var crypto2 = __toESM(require("crypto"));
+var fs52 = __toESM(require("fs"));
+var path55 = __toESM(require("path"));
+function normalizeOrigin(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  let host2;
+  let pathPart;
+  const scpLike = /^[^/@]+@([^:]+):(.+)$/.exec(trimmed);
+  if (scpLike && !trimmed.includes("://")) {
+    host2 = scpLike[1];
+    pathPart = scpLike[2];
+  } else {
+    let url2;
+    try {
+      url2 = new URL(trimmed);
+    } catch {
+      return null;
+    }
+    host2 = url2.hostname;
+    pathPart = url2.pathname;
+  }
+  host2 = host2.toLowerCase();
+  pathPart = pathPart.replace(/^\/+/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
+  if (!host2 || !pathPart) return null;
+  return `${host2}/${pathPart}`;
+}
+function findRepoRoot(cwd) {
+  let dir = path55.resolve(cwd);
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < 256; i++) {
+    if (seen.has(dir)) return null;
+    seen.add(dir);
+    try {
+      const stat3 = fs52.statSync(path55.join(dir, ".git"), { throwIfNoEntry: false });
+      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
+    } catch {
+    }
+    const parent = path55.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var _execSeam2 = {
+  exec: (file, args2, opts) => {
+    const out2 = (0, import_child_process18.execFileSync)(file, args2, opts);
+    return typeof out2 === "string" ? out2 : out2.toString("utf8");
+  },
+  realpath: (p2) => fs52.realpathSync(p2)
+};
+function readOrigin(cwd) {
+  try {
+    const raw = _execSeam2.exec("git", ["remote", "get-url", "origin"], {
+      cwd,
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8"
+    });
+    return raw.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function deriveProjectIdentity(cwd = process.cwd()) {
+  const repoRoot = findRepoRoot(cwd) ?? cwd;
+  const origin = readOrigin(repoRoot);
+  const normalized = origin ? normalizeOrigin(origin) : null;
+  if (normalized) {
+    const label = normalized.split("/").pop() || normalized;
+    return { projectKey: normalized, projectLabel: label };
+  }
+  let real = repoRoot;
+  try {
+    real = _execSeam2.realpath(repoRoot);
+  } catch {
+  }
+  const hash = crypto2.createHash("sha256").update(real).digest("hex");
+  return { projectKey: `path:${hash}`, projectLabel: path55.basename(real) || "project" };
+}
+
+// src/services/project-env/index.ts
+async function readIfExists(p2) {
+  try {
+    return await import_fs5.promises.readFile(p2, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function syncProjectEnvUp(cwd, ctx) {
+  if (!ctx.pluginAuthToken) return;
+  const content = await readIfExists(path56.join(cwd, ".env"));
+  if (content == null) return;
+  try {
+    const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
+    const keyCount = parseDotenv(content).length;
+    const res = await pushProjectEnv({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      projectKey,
+      projectLabel,
+      content,
+      keyCount
+    });
+    if (res.ok) log.info("project-env", `pushed .env (${keyCount} vars) for ${projectLabel}`);
+    else log.debug("project-env", `push .env failed (${res.status}) \u2014 non-fatal`);
+  } catch (err) {
+    log.debug("project-env", `push .env skipped: ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function restoreProjectEnvIfMissing(cwd, ctx) {
+  if (!ctx.pluginAuthToken) return false;
+  const envPath = path56.join(cwd, ".env");
+  if (await readIfExists(envPath) != null) return false;
+  try {
+    const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
+    const stored = await pullProjectEnv({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      projectKey
+    });
+    if (!stored) return false;
+    const tmp = path56.join(cwd, ".env.codeam-restore.tmp");
+    await import_fs5.promises.writeFile(tmp, stored.content, { encoding: "utf8", mode: 384 });
+    await import_fs5.promises.rename(tmp, envPath);
+    log.info("project-env", `restored .env (${stored.keyCount} vars) for ${projectLabel}`);
+    return true;
+  } catch (err) {
+    log.debug("project-env", `restore .env skipped: ${err instanceof Error ? err.message : err}`);
+    return false;
+  }
+}
+
+// src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
 var TUNNEL_REGISTER_DEADLINE_MS = 45e3;
@@ -22490,8 +22882,8 @@ function normalizeDetectionForSpawn(detection, cwd) {
   if (args2.length === 0) return detection;
   const binName = args2[0];
   if (binName.startsWith("-")) return detection;
-  const binPath = path54.join(cwd, "node_modules", ".bin", binName);
-  if (!fs51.existsSync(binPath)) return detection;
+  const binPath = path57.join(cwd, "node_modules", ".bin", binName);
+  if (!fs54.existsSync(binPath)) return detection;
   return {
     ...detection,
     command: binPath,
@@ -22537,7 +22929,8 @@ async function runPreviewStart(args2) {
     tunnel: tun.tunnel,
     url: tun.url,
     framework: detection.framework,
-    detection
+    detection,
+    cwd: ctx.cwd
   });
   recordPreviewPort(detection.port, dev.devServer.pid, sessionId, Date.now());
   log.info("preview", `ready: ${detection.framework} at ${tun.url}`);
@@ -22549,6 +22942,13 @@ async function runPreviewStart(args2) {
 }
 async function provisionDeps(ctx) {
   const { detection, cwd, emit: emit2, emitProgress } = ctx;
+  if (ctx.projectEnvAuth?.pluginAuthToken) {
+    await restoreProjectEnvIfMissing(cwd, {
+      sessionId: ctx.sessionId,
+      pluginId: ctx.projectEnvAuth.pluginId,
+      pluginAuthToken: ctx.projectEnvAuth.pluginAuthToken
+    });
+  }
   const missingDeps = detectMissingNodeDeps(cwd);
   let preflightRan = false;
   if (missingDeps) {
@@ -22696,9 +23096,10 @@ async function startDevServer(ctx) {
       return null;
     }
   }
+  await applyPreviewHostAllow(cwd);
   const spawnable = normalizeDetectionForSpawn(detection, cwd);
   emitProgress("BOOT_SEQUENCE", `${spawnable.command} ${spawnable.args.join(" ")}`);
-  const devServer = (0, import_child_process18.spawn)(spawnable.command, spawnable.args, {
+  const devServer = (0, import_child_process19.spawn)(spawnable.command, spawnable.args, {
     cwd,
     env: { ...process.env, ...spawnable.env ?? {} },
     stdio: ["ignore", "pipe", "pipe"],
@@ -22823,7 +23224,7 @@ async function establishTunnel(ctx, dev) {
         `cloudflared quick tunnel (retry ${attempt}/${MAX_TUNNEL_ATTEMPTS})`
       );
     }
-    const candidate = (0, import_child_process18.spawn)(
+    const candidate = (0, import_child_process19.spawn)(
       bin,
       ["tunnel", "--url", `http://localhost:${detection.port}`],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -22854,10 +23255,10 @@ async function establishTunnel(ctx, dev) {
 }
 
 // src/beads/bd-adapter.ts
-var import_child_process19 = require("child_process");
-var fs52 = __toESM(require("fs"));
+var import_child_process20 = require("child_process");
+var fs55 = __toESM(require("fs"));
 var os42 = __toESM(require("os"));
-var path55 = __toESM(require("path"));
+var path58 = __toESM(require("path"));
 var BD_PACKAGE = "@beads/bd";
 function resolveBundledBdBinary() {
   return _resolveSeam.resolveBundled();
@@ -22869,11 +23270,11 @@ function _defaultResolveBundled() {
   } catch {
     return null;
   }
-  const binDir = path55.join(path55.dirname(pkgJsonPath), "bin");
+  const binDir = path58.join(path58.dirname(pkgJsonPath), "bin");
   const binaryName = process.platform === "win32" ? "bd.exe" : "bd";
-  const binaryPath = path55.join(binDir, binaryName);
+  const binaryPath = path58.join(binDir, binaryName);
   try {
-    fs52.accessSync(binaryPath, fs52.constants.F_OK);
+    fs55.accessSync(binaryPath, fs55.constants.F_OK);
     return binaryPath;
   } catch {
     return null;
@@ -22883,13 +23284,13 @@ function resolveBdOnPath() {
   return _resolveSeam.resolveOnPath();
 }
 function _defaultResolveOnPath() {
-  const dirs = (process.env.PATH ?? "").split(path55.delimiter).filter(Boolean);
+  const dirs = (process.env.PATH ?? "").split(path58.delimiter).filter(Boolean);
   const candidates = process.platform === "win32" ? ["bd.exe", "bd.cmd", "bd"] : ["bd"];
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const full = path55.join(dir, candidate);
+      const full = path58.join(dir, candidate);
       try {
-        fs52.accessSync(full, fs52.constants.F_OK);
+        fs55.accessSync(full, fs55.constants.F_OK);
         return full;
       } catch {
       }
@@ -22908,7 +23309,7 @@ function _defaultSpawn(binaryPath, args2, opts) {
   return new Promise((resolve9) => {
     let proc;
     try {
-      proc = (0, import_child_process19.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
+      proc = (0, import_child_process20.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
     } catch (err) {
       resolve9({ code: -1, stdout: "", stderr: err.message });
       return;
@@ -23066,12 +23467,12 @@ function coerceIssue(row, projectKey) {
 
 // src/beads/provisioner.ts
 var import_child_process23 = require("child_process");
-var fs55 = __toESM(require("fs"));
+var fs57 = __toESM(require("fs"));
 var os44 = __toESM(require("os"));
-var path58 = __toESM(require("path"));
+var path60 = __toESM(require("path"));
 
 // src/beads/install-bd.ts
-var import_child_process20 = require("child_process");
+var import_child_process21 = require("child_process");
 var INSTALL_SH_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh";
 var INSTALL_PS1_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/install.ps1";
 function resolveInstallStrategy(platform3) {
@@ -23102,7 +23503,7 @@ function _defaultInstallSpawn(strategy) {
   return new Promise((resolve9) => {
     let proc;
     try {
-      proc = (0, import_child_process20.spawn)(strategy.command, strategy.args, { env: process.env });
+      proc = (0, import_child_process21.spawn)(strategy.command, strategy.args, { env: process.env });
     } catch (err) {
       resolve9({ ok: false, code: -1, stderr: err.message });
       return;
@@ -23132,10 +23533,10 @@ async function installBd(platform3 = process.platform) {
 }
 
 // src/beads/install-dolt.ts
-var import_child_process21 = require("child_process");
-var fs53 = __toESM(require("fs"));
+var import_child_process22 = require("child_process");
+var fs56 = __toESM(require("fs"));
 var os43 = __toESM(require("os"));
-var path56 = __toESM(require("path"));
+var path59 = __toESM(require("path"));
 var DOLT_INSTALL_SH_URL = "https://github.com/dolthub/dolt/releases/latest/download/install.sh";
 var DOLT_MSI_URL = "https://github.com/dolthub/dolt/releases/latest/download/dolt-windows-amd64.msi";
 function resolveDoltInstallStrategy(platform3) {
@@ -23231,7 +23632,7 @@ var _doltPathSeam = {
   },
   exists: (p2) => {
     try {
-      fs53.accessSync(p2, fs53.constants.F_OK);
+      fs56.accessSync(p2, fs56.constants.F_OK);
       return true;
     } catch {
       return false;
@@ -23242,7 +23643,7 @@ function doltBinaryNames(platform3) {
   return platform3 === "win32" ? ["dolt.exe", "dolt.cmd", "dolt"] : ["dolt"];
 }
 function knownDoltDirs(platform3) {
-  const P3 = platform3 === "win32" ? path56.win32 : path56.posix;
+  const P3 = platform3 === "win32" ? path59.win32 : path59.posix;
   const home = _doltPathSeam.homedir();
   if (platform3 === "win32") {
     return [
@@ -23258,7 +23659,7 @@ function knownDoltDirs(platform3) {
   ].filter(Boolean);
 }
 function ensureDoltResolvable(platform3 = process.platform) {
-  const P3 = platform3 === "win32" ? path56.win32 : path56.posix;
+  const P3 = platform3 === "win32" ? path59.win32 : path59.posix;
   const delim = platform3 === "win32" ? ";" : ":";
   const names = doltBinaryNames(platform3);
   const pathDirs = _doltPathSeam.getPath().split(delim).filter(Boolean);
@@ -23294,7 +23695,7 @@ function _defaultDoltInstallSpawn(strategy) {
     };
     let proc;
     try {
-      proc = (0, import_child_process21.spawn)(strategy.command, strategy.args, {
+      proc = (0, import_child_process22.spawn)(strategy.command, strategy.args, {
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -23391,89 +23792,6 @@ async function ensureSharedServer(adapter, options = {}) {
   return { up: false, started: false };
 }
 
-// src/beads/project-key.ts
-var import_child_process22 = require("child_process");
-var crypto2 = __toESM(require("crypto"));
-var fs54 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
-function normalizeOrigin(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  let host2;
-  let pathPart;
-  const scpLike = /^[^/@]+@([^:]+):(.+)$/.exec(trimmed);
-  if (scpLike && !trimmed.includes("://")) {
-    host2 = scpLike[1];
-    pathPart = scpLike[2];
-  } else {
-    let url2;
-    try {
-      url2 = new URL(trimmed);
-    } catch {
-      return null;
-    }
-    host2 = url2.hostname;
-    pathPart = url2.pathname;
-  }
-  host2 = host2.toLowerCase();
-  pathPart = pathPart.replace(/^\/+/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
-  if (!host2 || !pathPart) return null;
-  return `${host2}/${pathPart}`;
-}
-function findRepoRoot(cwd) {
-  let dir = path57.resolve(cwd);
-  const seen = /* @__PURE__ */ new Set();
-  for (let i = 0; i < 256; i++) {
-    if (seen.has(dir)) return null;
-    seen.add(dir);
-    try {
-      const stat3 = fs54.statSync(path57.join(dir, ".git"), { throwIfNoEntry: false });
-      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
-    } catch {
-    }
-    const parent = path57.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
-}
-var _execSeam2 = {
-  exec: (file, args2, opts) => {
-    const out2 = (0, import_child_process22.execFileSync)(file, args2, opts);
-    return typeof out2 === "string" ? out2 : out2.toString("utf8");
-  },
-  realpath: (p2) => fs54.realpathSync(p2)
-};
-function readOrigin(cwd) {
-  try {
-    const raw = _execSeam2.exec("git", ["remote", "get-url", "origin"], {
-      cwd,
-      timeout: 1e3,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-    return raw.trim() || null;
-  } catch {
-    return null;
-  }
-}
-function deriveProjectIdentity(cwd = process.cwd()) {
-  const repoRoot = findRepoRoot(cwd) ?? cwd;
-  const origin = readOrigin(repoRoot);
-  const normalized = origin ? normalizeOrigin(origin) : null;
-  if (normalized) {
-    const label = normalized.split("/").pop() || normalized;
-    return { projectKey: normalized, projectLabel: label };
-  }
-  let real = repoRoot;
-  try {
-    real = _execSeam2.realpath(repoRoot);
-  } catch {
-  }
-  const hash = crypto2.createHash("sha256").update(real).digest("hex");
-  return { projectKey: `path:${hash}`, projectLabel: path57.basename(real) || "project" };
-}
-
 // src/beads/project-prefix.ts
 var crypto3 = __toESM(require("crypto"));
 function prefixForProjectKey(projectKey) {
@@ -23521,14 +23839,14 @@ var _linkSeam = {
   homedir: () => os44.homedir(),
   isWritableDir: (dir) => {
     try {
-      fs55.accessSync(dir, fs55.constants.W_OK);
+      fs57.accessSync(dir, fs57.constants.W_OK);
       return true;
     } catch {
       return false;
     }
   },
   ensureDir: (dir) => {
-    fs55.mkdirSync(dir, { recursive: true });
+    fs57.mkdirSync(dir, { recursive: true });
   },
   /**
    * A directory to symlink `bd` into so the AGENT's shell + Claude Code's
@@ -23549,9 +23867,9 @@ var _linkSeam = {
    * which `linkBdOntoPath` creates if missing.
    */
   cliBinDir: () => {
-    const pathDirs = (process.env.PATH ?? "").split(path58.delimiter).filter(Boolean);
+    const pathDirs = (process.env.PATH ?? "").split(path60.delimiter).filter(Boolean);
     const home = _linkSeam.homedir();
-    const localBin = home ? path58.join(home, ".local", "bin") : null;
+    const localBin = home ? path60.join(home, ".local", "bin") : null;
     if (localBin) {
       try {
         _linkSeam.ensureDir(localBin);
@@ -23561,16 +23879,16 @@ var _linkSeam = {
     const candidates = [];
     if (localBin) candidates.push(localBin);
     try {
-      candidates.push(path58.dirname(process.execPath));
+      candidates.push(path60.dirname(process.execPath));
     } catch {
     }
     candidates.push("/usr/local/bin");
     const entry = process.argv[1];
     if (entry) {
       try {
-        candidates.push(path58.dirname(fs55.realpathSync(entry)));
+        candidates.push(path60.dirname(fs57.realpathSync(entry)));
       } catch {
-        candidates.push(path58.dirname(entry));
+        candidates.push(path60.dirname(entry));
       }
     }
     const onPathWritable = candidates.find(
@@ -23582,20 +23900,20 @@ var _linkSeam = {
   /** Current symlink target at `linkPath`, or null when absent / not a link. */
   readlink: (linkPath) => {
     try {
-      return fs55.readlinkSync(linkPath);
+      return fs57.readlinkSync(linkPath);
     } catch {
       return null;
     }
   },
-  unlink: (linkPath) => fs55.unlinkSync(linkPath),
-  symlink: (target, linkPath) => fs55.symlinkSync(target, linkPath)
+  unlink: (linkPath) => fs57.unlinkSync(linkPath),
+  symlink: (target, linkPath) => fs57.symlinkSync(target, linkPath)
 };
 function linkBdOntoPath(binaryPath) {
   if (_linkSeam.platform() === "win32") return;
   const binDir = _linkSeam.cliBinDir();
   if (!binDir) return;
   _linkSeam.ensureDir(binDir);
-  const linkPath = path58.join(binDir, "bd");
+  const linkPath = path60.join(binDir, "bd");
   if (linkPath === binaryPath) return;
   const current = _linkSeam.readlink(linkPath);
   if (current === binaryPath) return;
@@ -23790,7 +24108,7 @@ function dedupeRecipes(agents) {
 
 // src/beads/watcher.ts
 var crypto4 = __toESM(require("crypto"));
-var path59 = __toESM(require("path"));
+var path61 = __toESM(require("path"));
 var API_BASE6 = resolveApiBaseUrl();
 var DEBOUNCE_MS2 = 400;
 var ZERO_SUMMARY = {
@@ -23814,7 +24132,7 @@ var BeadsWatcher = class {
   constructor(opts) {
     this.opts = opts;
     this.bd = opts.adapter ?? new BdAdapter({ cwd: opts.cwd, beadsDir: opts.beadsDir });
-    this.feedPath = opts.feedPath ?? path59.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
+    this.feedPath = opts.feedPath ?? path61.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
     this.apiBase = opts.apiBaseUrl ?? API_BASE6;
   }
   opts;
@@ -24313,8 +24631,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path62.join(os48.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
-    fs58.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path64.join(os48.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
+    fs60.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -24526,9 +24844,10 @@ var listFiles = async (ctx, cmd, parsed) => {
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
 var envReadH = async (ctx, cmd) => {
-  const envPath = path62.join(process.cwd(), ".env");
+  const envPath = path64.join(process.cwd(), ".env");
+  await restoreProjectEnvIfMissing(process.cwd(), ctx);
   try {
-    const raw = await fs58.promises.readFile(envPath, "utf8");
+    const raw = await fs60.promises.readFile(envPath, "utf8");
     await ctx.relay.sendResult(cmd.id, "completed", {
       exists: true,
       vars: parseDotenv(raw)
@@ -24559,14 +24878,15 @@ var envWriteH = async (ctx, cmd, parsed) => {
     }
     seen.add(v.key);
   }
-  const envPath = path62.join(process.cwd(), ".env");
-  const tmpPath = path62.join(process.cwd(), ".env.codeam.tmp");
+  const envPath = path64.join(process.cwd(), ".env");
+  const tmpPath = path64.join(process.cwd(), ".env.codeam.tmp");
   try {
-    await fs58.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
-    await fs58.promises.rename(tmpPath, envPath);
+    await fs60.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
+    await fs60.promises.rename(tmpPath, envPath);
     await ctx.relay.sendResult(cmd.id, "completed", { ok: true, count: vars.length });
+    void syncProjectEnvUp(process.cwd(), ctx);
   } catch (err) {
-    await fs58.promises.rm(tmpPath, { force: true }).catch(() => void 0);
+    await fs60.promises.rm(tmpPath, { force: true }).catch(() => void 0);
     await ctx.relay.sendResult(cmd.id, "failed", { error: err.message });
   }
 };
@@ -24615,7 +24935,7 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
   let configuredAgent = rawAgentId;
   if (!configuredAgent) {
     try {
-      const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+      const raw = JSON.parse(fs60.readFileSync(headroomConfigPath(), "utf8"));
       configuredAgent = raw.agent ?? "";
     } catch {
     }
@@ -24649,7 +24969,7 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
     persist: persistHeadroomConfig,
     readEnabled: () => {
       try {
-        const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+        const raw = JSON.parse(fs60.readFileSync(headroomConfigPath(), "utf8"));
         return raw.enabled === true;
       } catch {
         return false;
@@ -24953,7 +25273,7 @@ var headroomBudgetH = async (ctx, cmd) => {
   }
   let headroomActive = false;
   try {
-    const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+    const raw = JSON.parse(fs60.readFileSync(headroomConfigPath(), "utf8"));
     headroomActive = raw.enabled === true;
   } catch {
   }
@@ -24963,7 +25283,7 @@ var headroomBudgetH = async (ctx, cmd) => {
   }
   let existingConfig = { enabled: true };
   try {
-    existingConfig = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+    existingConfig = JSON.parse(fs60.readFileSync(headroomConfigPath(), "utf8"));
   } catch {
   }
   if (payload.budgetEnabled && payload.budgetUsd != null) {
@@ -25076,9 +25396,9 @@ var CLI_UPDATE_MAX_ATTEMPTS = 3;
 function buildNpmInstallInvocation(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const execPath = opts?.execPath ?? process.execPath;
-  const exists2 = opts?.existsSync ?? fs58.existsSync;
+  const exists2 = opts?.existsSync ?? fs60.existsSync;
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path62.win32 : path62.posix;
+  const p2 = platform3 === "win32" ? path64.win32 : path64.posix;
   const normalized = entryScript.split(/[\\/]/).join("/");
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = normalized.indexOf(marker);
@@ -25100,7 +25420,7 @@ function isPermissionError(stderr) {
 function resolveGlobalNodeModulesDir(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path62.win32 : path62.posix;
+  const p2 = platform3 === "win32" ? path64.win32 : path64.posix;
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = entryScript.split(/[\\/]/).join("/").indexOf(marker);
   if (markerIdx <= 0) return null;
@@ -25110,9 +25430,9 @@ function resolveGlobalNodeModulesDir(opts) {
 var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
-  const readdirSync12 = deps?.readdirSync ?? fs58.readdirSync;
-  const statSync17 = deps?.statSync ?? fs58.statSync;
-  const rmSync8 = deps?.rmSync ?? fs58.rmSync;
+  const readdirSync12 = deps?.readdirSync ?? fs60.readdirSync;
+  const statSync17 = deps?.statSync ?? fs60.statSync;
+  const rmSync8 = deps?.rmSync ?? fs60.rmSync;
   let removed = 0;
   let entries;
   try {
@@ -25122,7 +25442,7 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   }
   for (const name of entries) {
     if (!/^\.codeam-cli-/.test(name)) continue;
-    const full = path62.join(nodeModulesDir, name);
+    const full = path64.join(nodeModulesDir, name);
     try {
       const st3 = statSync17(full);
       if (now - st3.mtimeMs < STALE_STAGING_AGE_MS) continue;
@@ -25611,7 +25931,12 @@ function startPreviewFromDetection(ctx, detection, pluginAuthToken) {
     sessionId: ctx.sessionId,
     detection,
     cwd: process.cwd(),
-    emit: emit2
+    emit: emit2,
+    // Auth for the per-repo `.env` vault restore, performed INSIDE the bring-up
+    // (provisionDeps stage, after the reuse short-circuit) so a fresh session of
+    // this repo picks up its saved `.env` before the dev server spawns. Optional
+    // — a caller without a token just skips the restore.
+    projectEnvAuth: { pluginId: ctx.pluginId, pluginAuthToken }
   }).catch((err) => {
     const message = err instanceof Error ? err.message : String(err);
     log.warn("preview", `start crashed before ready: ${message}`);
@@ -25984,11 +26309,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path82 = fileFlag.slice("--token-file=".length);
+    const path84 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs59.readFileSync(path82, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path82} is empty`);
-      rmIfExistsQuiet(path82);
+      const content = fs61.readFileSync(path84, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path84} is empty`);
+      rmIfExistsQuiet(path84);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -26078,7 +26403,7 @@ async function claim(token, pluginId, pluginSecretHash) {
   }
 }
 function pairAutoLockPath() {
-  return path63.join(os49.homedir(), ".codeam", "pair-auto.lock");
+  return path65.join(os49.homedir(), ".codeam", "pair-auto.lock");
 }
 function isLivePairAuto(pid) {
   if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
@@ -26088,7 +26413,7 @@ function isLivePairAuto(pid) {
     if (e.code !== "EPERM") return false;
   }
   try {
-    return fs59.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
+    return fs61.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
   } catch {
     return true;
   }
@@ -26098,24 +26423,24 @@ function isLiveCodeam(pid) {
 }
 function daemonLockPath(sessionId) {
   const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return path63.join(os49.homedir(), ".codeam", `daemon-${safe}.lock`);
+  return path65.join(os49.homedir(), ".codeam", `daemon-${safe}.lock`);
 }
 function acquireDaemonLock(sessionId) {
   const lockPath = daemonLockPath(sessionId);
   try {
-    fs59.mkdirSync(path63.dirname(lockPath), { recursive: true });
+    fs61.mkdirSync(path65.dirname(lockPath), { recursive: true });
     try {
-      fs59.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+      fs61.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      const holder = Number(fs59.readFileSync(lockPath, "utf8").trim());
+      const holder = Number(fs61.readFileSync(lockPath, "utf8").trim());
       if (holder && holder !== process.pid && isLiveCodeam(holder)) return false;
-      fs59.writeFileSync(lockPath, String(process.pid));
+      fs61.writeFileSync(lockPath, String(process.pid));
     }
     const release3 = () => {
       try {
-        if (fs59.existsSync(lockPath) && Number(fs59.readFileSync(lockPath, "utf8").trim()) === process.pid) {
-          fs59.unlinkSync(lockPath);
+        if (fs61.existsSync(lockPath) && Number(fs61.readFileSync(lockPath, "utf8").trim()) === process.pid) {
+          fs61.unlinkSync(lockPath);
         }
       } catch {
       }
@@ -26137,19 +26462,19 @@ function acquireDaemonLock(sessionId) {
 function acquireSingletonLock() {
   const lockPath = pairAutoLockPath();
   try {
-    fs59.mkdirSync(path63.dirname(lockPath), { recursive: true });
+    fs61.mkdirSync(path65.dirname(lockPath), { recursive: true });
     try {
-      fs59.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+      fs61.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      const holder = Number(fs59.readFileSync(lockPath, "utf8").trim());
+      const holder = Number(fs61.readFileSync(lockPath, "utf8").trim());
       if (isLivePairAuto(holder)) return false;
-      fs59.writeFileSync(lockPath, String(process.pid));
+      fs61.writeFileSync(lockPath, String(process.pid));
     }
     process.once("exit", () => {
       try {
-        if (fs59.existsSync(lockPath) && Number(fs59.readFileSync(lockPath, "utf8").trim()) === process.pid) {
-          fs59.unlinkSync(lockPath);
+        if (fs61.existsSync(lockPath) && Number(fs61.readFileSync(lockPath, "utf8").trim()) === process.pid) {
+          fs61.unlinkSync(lockPath);
         }
       } catch {
       }
@@ -26601,10 +26926,10 @@ var AgentService = class _AgentService {
 };
 
 // src/agents/acp/adapters.ts
-var path65 = __toESM(require("path"));
+var path67 = __toESM(require("path"));
 
 // src/agents/acp/agent-binary.ts
-var import_fs4 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_os11 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process26 = require("child_process");
@@ -26634,7 +26959,7 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs6.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
@@ -26692,7 +27017,7 @@ async function waitForCommandOnPath(cmd, opts = {}) {
   return check();
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs6.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
@@ -26891,13 +27216,13 @@ function resolveBin(pkgName, binName) {
   try {
     const manifestPath = require_.resolve(`${pkgName}/package.json`);
     const manifest = require_(`${pkgName}/package.json`);
-    const pkgDir = path65.dirname(manifestPath);
+    const pkgDir = path67.dirname(manifestPath);
     const bin = manifest.bin;
     if (!bin) return null;
-    if (typeof bin === "string") return path65.resolve(pkgDir, bin);
+    if (typeof bin === "string") return path67.resolve(pkgDir, bin);
     const target = binName ?? Object.keys(bin)[0];
     if (!target || !bin[target]) return null;
-    return path65.resolve(pkgDir, bin[target]);
+    return path67.resolve(pkgDir, bin[target]);
   } catch {
     return null;
   }
@@ -27047,8 +27372,8 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
 var import_node_crypto11 = require("crypto");
 
 // src/services/history.service.ts
-var fs61 = __toESM(require("fs"));
-var path66 = __toESM(require("path"));
+var fs63 = __toESM(require("fs"));
+var path68 = __toESM(require("path"));
 var os51 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
 var http6 = __toESM(require("http"));
@@ -27076,7 +27401,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs61.readFileSync(filePath, "utf8");
+    raw = fs63.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -27217,7 +27542,7 @@ var HistoryService = class _HistoryService {
     return this._quotaPercent === null || Date.now() - this._quotaFetchedAt > ttlMs;
   }
   get projectDir() {
-    return this.runtime.resolveHistoryDir(this.cwd) ?? path66.join(os51.homedir(), ".claude", "projects", encodeCwd(this.cwd));
+    return this.runtime.resolveHistoryDir(this.cwd) ?? path68.join(os51.homedir(), ".claude", "projects", encodeCwd(this.cwd));
   }
   /** Set the current Claude conversation ID (extracted from /cost command or session start) */
   setCurrentConversationId(id) {
@@ -27229,7 +27554,7 @@ var HistoryService = class _HistoryService {
   /** Return the current message count in the active conversation. */
   getCurrentMessageCount() {
     if (!this.currentConversationId) return 0;
-    const filePath = path66.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+    const filePath = path68.join(this.projectDir, `${this.currentConversationId}.jsonl`);
     return parseJsonl(filePath).length;
   }
   /**
@@ -27240,7 +27565,7 @@ var HistoryService = class _HistoryService {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.currentConversationId) return null;
-      const filePath = path66.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+      const filePath = path68.join(this.projectDir, `${this.currentConversationId}.jsonl`);
       const messages = parseJsonl(filePath);
       if (messages.length > previousCount) {
         for (let i = messages.length - 1; i >= previousCount; i--) {
@@ -27266,16 +27591,16 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs61.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs63.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs61.statSync(path66.join(dir, e.name));
+          const stat3 = fs63.statSync(path68.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
         }
       }).filter((f) => f.birthtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       if (files.length > 0) {
-        this.currentConversationId = path66.basename(files[0].name, ".jsonl");
+        this.currentConversationId = path68.basename(files[0].name, ".jsonl");
       }
     } catch {
     }
@@ -27309,13 +27634,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs61.readdirSync(dir, { withFileTypes: true });
+      entries = fs63.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs61.statSync(path66.join(dir, e.name));
+        const stat3 = fs63.statSync(path68.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -27324,12 +27649,12 @@ var HistoryService = class _HistoryService {
     if (files.length === 0) return null;
     const targetFile = this.currentConversationId ? `${this.currentConversationId}.jsonl` : files[0].name;
     if (!files.some((f) => f.name === targetFile)) return null;
-    return this.extractUsageFromFile(path66.join(dir, targetFile));
+    return this.extractUsageFromFile(path68.join(dir, targetFile));
   }
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs61.readFileSync(filePath, "utf8");
+      raw = fs63.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -27374,9 +27699,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs61.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs63.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs61.statSync(path66.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs63.statSync(path68.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -27387,7 +27712,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs61.readFileSync(path66.join(projectDir, file), "utf8");
+        raw = fs63.readFileSync(path68.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -27466,7 +27791,7 @@ var HistoryService = class _HistoryService {
     if (this.runtime.resolveHistoryFile) {
       return this.runtime.resolveHistoryFile(this.cwd, sessionId);
     }
-    return path66.join(this.projectDir, `${sessionId}.jsonl`);
+    return path68.join(this.projectDir, `${sessionId}.jsonl`);
   }
   /**
    * Parse a conversation's messages from disk, agent-aware. Claude uses the
@@ -27500,7 +27825,7 @@ var HistoryService = class _HistoryService {
         };
       });
     }
-    return parseJsonl(path66.join(this.projectDir, `${sessionId}.jsonl`));
+    return parseJsonl(path68.join(this.projectDir, `${sessionId}.jsonl`));
   }
   async loadConversation(sessionId) {
     const messages = this.readConversation(sessionId);
@@ -27568,7 +27893,7 @@ var HistoryService = class _HistoryService {
     if (!filePath) return false;
     let mtimeMs;
     try {
-      mtimeMs = fs61.statSync(filePath).mtimeMs;
+      mtimeMs = fs63.statSync(filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -27643,10 +27968,10 @@ var HistoryService = class _HistoryService {
 
 // src/agents/acp/client.ts
 var import_node_child_process29 = require("child_process");
-var fs62 = __toESM(require("fs/promises"));
+var fs64 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
 var os53 = __toESM(require("os"));
-var path68 = __toESM(require("path"));
+var path70 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -31672,7 +31997,7 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
 }
 
 // src/agents/acp/internal-paths.ts
-var path67 = __toESM(require("path"));
+var path69 = __toESM(require("path"));
 var os52 = __toESM(require("os"));
 var INTERNAL_TOKENS = [".codeam", "house-claude"];
 function textReferencesInternal(text) {
@@ -31681,10 +32006,10 @@ function textReferencesInternal(text) {
 }
 function pathIsInternal(p2, homeDir2 = os52.homedir()) {
   if (!p2) return false;
-  const abs = path67.resolve(p2);
-  const home = path67.resolve(homeDir2);
-  const within = (root) => abs === root || abs.startsWith(root + path67.sep);
-  return within(path67.join(home, ".codeam")) || within(path67.join(home, ".beads")) || abs === path67.join(home, ".codeam-host.log") || abs.includes(`${path67.sep}house-claude${path67.sep}`) || abs.endsWith(`${path67.sep}house-claude`);
+  const abs = path69.resolve(p2);
+  const home = path69.resolve(homeDir2);
+  const within = (root) => abs === root || abs.startsWith(root + path69.sep);
+  return within(path69.join(home, ".codeam")) || within(path69.join(home, ".beads")) || abs === path69.join(home, ".codeam-host.log") || abs.includes(`${path69.sep}house-claude${path69.sep}`) || abs.endsWith(`${path69.sep}house-claude`);
 }
 function toolCallReferencesInternal(call) {
   if (textReferencesInternal(call.title)) return true;
@@ -32513,7 +32838,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          const content = await fs62.readFile(params.path, "utf8");
+          const content = await fs64.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
         } catch (err) {
           const code = err.code;
@@ -32536,7 +32861,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          await fs62.writeFile(params.path, params.content, "utf8");
+          await fs64.writeFile(params.path, params.content, "utf8");
           return {};
         } catch (err) {
           const code = err.code;
@@ -32601,24 +32926,24 @@ function knownAgentBinaryDirs() {
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path68.join(home, ".nvm/versions/node")
+    path70.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path68.join(root, child, "bin"));
+        out2.push(path70.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path68.join(home, ".volta/bin"));
+  out2.push(path70.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path68.join(home, ".local/bin"));
-  out2.push(path68.join(home, "bin"));
+  out2.push(path70.join(home, ".local/bin"));
+  out2.push(path70.join(home, "bin"));
   if (process.platform === "win32") {
     const { LOCALAPPDATA, APPDATA } = process.env;
-    if (LOCALAPPDATA) out2.push(path68.join(LOCALAPPDATA, "cursor-agent"));
-    if (APPDATA) out2.push(path68.join(APPDATA, "npm"));
+    if (LOCALAPPDATA) out2.push(path70.join(LOCALAPPDATA, "cursor-agent"));
+    if (APPDATA) out2.push(path70.join(APPDATA, "npm"));
   }
   return out2.filter((p2) => {
     try {
@@ -32630,7 +32955,7 @@ function knownAgentBinaryDirs() {
 }
 function expandPathForAgentBinaries(existingPath) {
   const existing = new Set(
-    existingPath.split(path68.delimiter).filter((p2) => p2.length > 0)
+    existingPath.split(path70.delimiter).filter((p2) => p2.length > 0)
   );
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
@@ -32640,7 +32965,7 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path68.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path70.delimiter);
 }
 
 // src/agents/acp/headroom-budget-proxy.ts
@@ -33122,15 +33447,15 @@ function commonPrefixLength(a, b) {
 
 // src/agents/acp/onboarding.ts
 var import_child_process27 = require("child_process");
-var fs63 = __toESM(require("fs"));
+var fs65 = __toESM(require("fs"));
 var os54 = __toESM(require("os"));
-var path69 = __toESM(require("path"));
+var path71 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path69.join(os54.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
-  exists: (p2) => fs63.existsSync(p2),
+  markerPath: (sessionId) => path71.join(os54.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  exists: (p2) => fs65.existsSync(p2),
   write: (p2) => {
-    fs63.mkdirSync(path69.dirname(p2), { recursive: true });
-    fs63.writeFileSync(p2, "");
+    fs65.mkdirSync(path71.dirname(p2), { recursive: true });
+    fs65.writeFileSync(p2, "");
   },
   disabled: () => {
     const v = process.env.CODEAM_ONBOARDING_DISABLED;
@@ -33167,7 +33492,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path69.basename(cwd || "");
+  const base = path71.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -33425,13 +33750,13 @@ var import_crypto5 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process28 = require("child_process");
-var fs65 = __toESM(require("fs/promises"));
-var path71 = __toESM(require("path"));
+var fs67 = __toESM(require("fs/promises"));
+var path73 = __toESM(require("path"));
 
 // src/services/turn-files/review-ignore.ts
 var import_ignore2 = __toESM(require("ignore"));
-var fs64 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
+var fs66 = __toESM(require("fs"));
+var path72 = __toESM(require("path"));
 var CURATED_REVIEW_IGNORE = [
   // Google Cloud SDK (the incident) — installs a huge python tree.
   "google-cloud-sdk/",
@@ -33470,7 +33795,7 @@ var CURATED_REVIEW_IGNORE = [
 function makeReviewIgnore(repoRoot) {
   const ig = (0, import_ignore2.default)().add(CURATED_REVIEW_IGNORE);
   try {
-    const custom = fs64.readFileSync(path70.join(repoRoot, ".codeam", "reviewignore"), "utf8");
+    const custom = fs66.readFileSync(path72.join(repoRoot, ".codeam", "reviewignore"), "utf8");
     ig.add(custom);
   } catch {
   }
@@ -33515,7 +33840,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (!truncated && row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path71.join(opts.repoRoot, row.filePath)
+        path73.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -33546,7 +33871,7 @@ function readUntrackedLineCount(absPath) {
 }
 async function defaultReadUntrackedLineCount(absPath) {
   try {
-    const content = await fs65.readFile(absPath, "utf8");
+    const content = await fs67.readFile(absPath, "utf8");
     let count = 0;
     let pos = -1;
     while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
@@ -33638,7 +33963,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs72 = await import("fs/promises");
+  const fs74 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -33646,7 +33971,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs72.readdir(dir, { withFileTypes: true });
+      const dirents = await fs74.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -33657,8 +33982,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path71.relative(workingDir, dir),
-        repoName: path71.basename(dir)
+        repoPath: path73.relative(workingDir, dir),
+        repoName: path73.basename(dir)
       });
       return;
     }
@@ -33666,14 +33991,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path71.join(dir, entry.name), depth + 1);
+      await walk(path73.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs66 = __toESM(require("fs/promises"));
-var path72 = __toESM(require("path"));
+var fs68 = __toESM(require("fs/promises"));
+var path74 = __toESM(require("path"));
 var import_os12 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -33706,16 +34031,16 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path72.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path72.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path74.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path74.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs66.mkdir(path72.dirname(this.filePath), { recursive: true });
-    await fs66.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs68.mkdir(path74.dirname(this.filePath), { recursive: true });
+    await fs68.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -33806,7 +34131,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs66.readFile(this.filePath, "utf8");
+      raw = await fs68.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -33830,12 +34155,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs66.unlink(this.filePath).catch(() => void 0);
+      await fs68.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs66.writeFile(tmpPath, payload, "utf8");
-    await fs66.rename(tmpPath, this.filePath);
+    await fs68.writeFile(tmpPath, payload, "utf8");
+    await fs68.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -34580,11 +34905,13 @@ async function startTaskH(ctx) {
   }
   await streaming.beginTurn();
   history.appendUserPrompt(promptText);
+  let turnClosed = false;
   try {
     const reply = await client3.prompt(blocks);
     const finalText = streaming.getCurrentText();
     if (agentHooks(opts.agent)?.classifyCompletedReply?.(finalText) === "upgrade_required") {
       await streaming.closeWithBubble(CURSOR_UPGRADE_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(CURSOR_UPGRADE_MESSAGE);
       void history.flush();
       log.info("acpRunner", `start_task \u2190 cursor-plan-upgrade-required id=${cmd.id.slice(0, 8)}`);
@@ -34592,6 +34919,7 @@ async function startTaskH(ctx) {
     } else if (replyIsHouseAgentLimit(finalText)) {
       const houseBubble = houseAgentLimitMessage(finalText);
       await streaming.closeWithBubble(houseBubble);
+      turnClosed = true;
       history.appendAgentReply(houseBubble);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34603,6 +34931,7 @@ async function startTaskH(ctx) {
       });
     } else if (replyIsAuthFailure(finalText)) {
       await streaming.closeWithBubble(AUTH_FAILURE_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(AUTH_FAILURE_MESSAGE);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34613,6 +34942,7 @@ async function startTaskH(ctx) {
       await relay.sendResult(cmd.id, "failed", { error: "agent reply reported auth failure" });
     } else if (shouldOfferOneMRecovery({ detail: "", recentStderr: recentStderr.join("\n"), finalText })) {
       await streaming.closeWithBubble(ONE_M_CREDITS_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(ONE_M_CREDITS_MESSAGE);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34625,6 +34955,7 @@ async function startTaskH(ctx) {
       });
     } else {
       await streaming.closeTurnWithInteractiveDetection();
+      turnClosed = true;
       const replyLine = formatAgentReplyLine(finalText);
       if (replyLine.length > 0) {
         showInfo(replyLine);
@@ -34643,6 +34974,13 @@ async function startTaskH(ctx) {
       await relay.sendResult(cmd.id, "completed", { stopReason: reply.stopReason });
     }
   } catch (err) {
+    if (turnClosed) {
+      log.warn(
+        "acpRunner",
+        `post-close ack failed (turn already delivered) id=${cmd.id.slice(0, 8)}: ${describeError(err)}`
+      );
+      return;
+    }
     const hadText = streaming.hasVisibleProgress();
     const detail = describeError(err);
     log.warn("acpRunner", `prompt failed: ${detail}`);
@@ -37080,8 +37418,8 @@ function startClaudeCredentialSync(opts) {
 }
 
 // src/beads/workflow-hint.ts
-var fs68 = __toESM(require("fs"));
-var path74 = __toESM(require("path"));
+var fs70 = __toESM(require("fs"));
+var path76 = __toESM(require("path"));
 var os55 = __toESM(require("os"));
 var BEADS_HINT_MARKER = "<!-- codeam:beads-workflow -->";
 var BEADS_HINT = `${BEADS_HINT_MARKER}
@@ -37098,20 +37436,20 @@ This environment uses **bd (beads)** for issue/task tracking and persistent memo
 ${BEADS_HINT_MARKER}`;
 function ensureBeadsWorkflowHint(homeDir2 = os55.homedir()) {
   try {
-    const file = path74.join(homeDir2, ".claude", "CLAUDE.md");
+    const file = path76.join(homeDir2, ".claude", "CLAUDE.md");
     let existing = "";
     try {
-      existing = fs68.readFileSync(file, "utf8");
+      existing = fs70.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT_MARKER)) return;
-    fs68.mkdirSync(path74.dirname(file), { recursive: true });
+    fs70.mkdirSync(path76.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${BEADS_HINT}
 ` : `${BEADS_HINT}
 `;
-    fs68.writeFileSync(file, next);
+    fs70.writeFileSync(file, next);
   } catch {
   }
 }
@@ -37483,7 +37821,7 @@ var AcpDriver = class {
 };
 
 // src/baton/transcript-mirror.ts
-var fs69 = __toESM(require("fs"));
+var fs71 = __toESM(require("fs"));
 var TranscriptMirror = class {
   constructor(deps) {
     this.deps = deps;
@@ -37550,7 +37888,7 @@ var TranscriptMirror = class {
   }
 };
 function defaultWatch(file, onChange) {
-  const w3 = fs69.watch(file, { persistent: false }, () => onChange());
+  const w3 = fs71.watch(file, { persistent: false }, () => onChange());
   return () => w3.close();
 }
 
@@ -37812,16 +38150,16 @@ function toEpochMs(ts) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs70 = __toESM(require("fs"));
+var fs72 = __toESM(require("fs"));
 var os57 = __toESM(require("os"));
-var path75 = __toESM(require("path"));
+var path77 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path75.join(os57.homedir(), ".claude.json");
+    const file = path77.join(os57.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs70.readFileSync(file, "utf8"));
+      config = JSON.parse(fs72.readFileSync(file, "utf8"));
     } catch {
     }
     let changed = false;
@@ -37846,8 +38184,8 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs70.mkdirSync(path75.dirname(file), { recursive: true });
-    fs70.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs72.mkdirSync(path77.dirname(file), { recursive: true });
+    fs72.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
       `pre-completed Claude onboarding${cwd ? ` + trusted workspace ${cwd}` : ""}`
@@ -38574,7 +38912,7 @@ var import_picocolors11 = __toESM(require("picocolors"));
 var import_child_process29 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors9 = __toESM(require("picocolors"));
-var path76 = __toESM(require("path"));
+var path78 = __toESM(require("path"));
 var execFileP6 = (0, import_util4.promisify)(import_child_process29.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -39063,7 +39401,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path76.posix.dirname(remotePath);
+    const remoteDir = path78.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -39133,7 +39471,7 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process30 = require("child_process");
 var import_util5 = require("util");
-var path77 = __toESM(require("path"));
+var path79 = __toESM(require("path"));
 var import_picocolors10 = __toESM(require("picocolors"));
 var execFileP7 = (0, import_util5.promisify)(import_child_process30.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
@@ -39373,7 +39711,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path77.posix.dirname(remotePath);
+    const remoteDir = path79.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -39409,7 +39747,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process31 = require("child_process");
 var import_util6 = require("util");
-var path78 = __toESM(require("path"));
+var path80 = __toESM(require("path"));
 var execFileP8 = (0, import_util6.promisify)(import_child_process31.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -39669,7 +40007,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path78.posix.dirname(remotePath);
+    const remoteDir = path80.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -39737,7 +40075,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process32 = require("child_process");
 var import_util7 = require("util");
-var path79 = __toESM(require("path"));
+var path81 = __toESM(require("path"));
 var execFileP9 = (0, import_util7.promisify)(import_child_process32.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -39973,7 +40311,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path79.posix.dirname(remotePath);
+    const remoteDir = path81.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -40619,8 +40957,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto13 = require("crypto");
-var fs71 = __toESM(require("fs"));
-var path80 = __toESM(require("path"));
+var fs73 = __toESM(require("fs"));
+var path82 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -40676,13 +41014,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path80.join(require("os").homedir(), ".codeam");
+  const dir = path82.join(require("os").homedir(), ".codeam");
   try {
-    fs71.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path80.join(dir, ".doctor-probe");
-    fs71.writeFileSync(probe, "ok", { mode: 384 });
-    const read2 = fs71.readFileSync(probe, "utf8");
-    fs71.unlinkSync(probe);
+    fs73.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path82.join(dir, ".doctor-probe");
+    fs73.writeFileSync(probe, "ok", { mode: 384 });
+    const read2 = fs73.readFileSync(probe, "utf8");
+    fs73.unlinkSync(probe);
     if (read2 !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -40746,7 +41084,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path80.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path82.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -40788,7 +41126,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.81" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.82" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -41378,7 +41716,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.81" : "unknown";
+  const v = true ? "2.61.82" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }