codeam-cli 2.61.81 → 2.61.83

package/dist/index.js

@@ -2624,11 +2624,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path82) {
+function rmIfExistsQuiet(path85) {
   try {
-    fs2.rmSync(path82, { force: true });
+    fs2.rmSync(path85, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path82}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path85}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -2774,9 +2774,9 @@ var _default = makeConfig();
 var { getConfig, ensurePluginId, addSession, removeSession, setActiveSession, getActiveSession, getActiveSessionForAgent, setDisable1mContext, clearAll, saveCliConfig, loadCliConfig } = _default;
 
 // src/commands/pair-auto.ts
-var fs59 = __toESM(require("fs"));
-var os49 = __toESM(require("os"));
-var path63 = __toESM(require("path"));
+var fs62 = __toESM(require("fs"));
+var os50 = __toESM(require("os"));
+var path66 = __toESM(require("path"));
 var import_crypto4 = require("crypto");
 
 // src/services/telemetry.service.ts
@@ -2812,8 +2812,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path82) {
-  return path82.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path85) {
+  return path85.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -5293,9 +5293,9 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path82, ranges, output) {
+function getContextLinesFromFile(path85, ranges, output) {
   return new Promise((resolve9) => {
-    const stream = (0, import_node_fs.createReadStream)(path82);
+    const stream = (0, import_node_fs.createReadStream)(path85);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
@@ -5310,7 +5310,7 @@ function getContextLinesFromFile(path82, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path82, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path85, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -5371,8 +5371,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path82) {
-  return path82.startsWith("node:") || path82.endsWith(".min.js") || path82.endsWith(".min.cjs") || path82.endsWith(".min.mjs") || path82.startsWith("data:");
+function shouldSkipContextLinesForFile(path85) {
+  return path85.startsWith("node:") || path85.endsWith(".min.js") || path85.endsWith(".min.cjs") || path85.endsWith(".min.mjs") || path85.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -7526,7 +7526,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.81" : "0.0.0-dev",
+    cliVersion: true ? "2.61.83" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -7707,7 +7707,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.81",
+  version: "2.61.83",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7990,6 +7990,50 @@ async function postPreviewEvent(input) {
     };
   }
 }
+async function pushProjectEnv(input) {
+  try {
+    await _transport.postJsonAuthed(
+      `${API_BASE}/api/project-env/push`,
+      {
+        sessionId: input.sessionId,
+        pluginId: input.pluginId,
+        projectKey: input.projectKey,
+        projectLabel: input.projectLabel,
+        content: input.content,
+        keyCount: input.keyCount
+      },
+      input.pluginAuthToken
+    );
+    return { ok: true };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      status: typeof e.statusCode === "number" ? e.statusCode : 0,
+      message: e.message || "unknown"
+    };
+  }
+}
+async function pullProjectEnv(input) {
+  try {
+    const res = await _transport.postJsonAuthed(
+      `${API_BASE}/api/project-env/pull`,
+      {
+        sessionId: input.sessionId,
+        pluginId: input.pluginId,
+        projectKey: input.projectKey
+      },
+      input.pluginAuthToken
+    );
+    if (res && res.exists === true && typeof res.content === "string") {
+      const keyCount = typeof res.keyCount === "number" ? res.keyCount : 0;
+      return { content: res.content, keyCount };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 async function postBatonEvent(input) {
   try {
     await _transport.postJsonAuthed(
@@ -8939,7 +8983,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.81" ? { ideVersion: "2.61.81" } : {}
+      ..."2.61.83" ? { ideVersion: "2.61.83" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -9166,10 +9210,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir48) {
+function isUnsafeWindowsWatchRoot(dir, homedir49) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir48);
+  const home = norm(homedir49);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -10313,9 +10357,9 @@ function closeAllTerminals() {
 }
 
 // src/commands/start/handlers.ts
-var fs58 = __toESM(require("fs"));
-var os48 = __toESM(require("os"));
-var path62 = __toESM(require("path"));
+var fs61 = __toESM(require("fs"));
+var os49 = __toESM(require("os"));
+var path65 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
 var import_child_process24 = require("child_process");
 
@@ -13795,10 +13839,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os60 = createOsStrategy()) {
-  const found = os60.findInPath("claude") ?? os60.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os61 = createOsStrategy()) {
+  const found = os61.findInPath("claude") ?? os61.findInPath("claude-code");
   if (!found) return null;
-  return os60.buildLaunch(found, extraArgs);
+  return os61.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -14388,8 +14432,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -15169,8 +15213,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os60 = createOsStrategy();
-      return os60.findInPath("codex") !== null;
+      const os61 = createOsStrategy();
+      return os61.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process4.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -15193,8 +15237,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -15303,12 +15347,12 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os60) {
-  return os60.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os61) {
+  return os61.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os60) {
+async function installCodexViaNpm(os61) {
   return new Promise((resolve9, reject) => {
-    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os60), ["install", "-g", "@openai/codex"], {
+    const proc = (0, import_node_child_process5.spawn)(resolveNpm(os61), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -15325,16 +15369,16 @@ async function installCodexViaNpm(os60) {
     });
   });
 }
-function augmentNpmGlobalBin(os60) {
+function augmentNpmGlobalBin(os61) {
   try {
-    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os60), ["prefix", "-g"], {
+    const result = (0, import_node_child_process5.spawnSync)(resolveNpm(os61), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os60.id === "win32" ? prefix : path25.join(prefix, "bin");
-    os60.augmentPath([binDir]);
+    const binDir = os61.id === "win32" ? prefix : path25.join(prefix, "bin");
+    os61.augmentPath([binDir]);
   } catch {
   }
 }
@@ -15418,9 +15462,9 @@ var import_node_child_process8 = require("child_process");
 // src/agents/coderabbit/installer.ts
 var import_node_child_process6 = require("child_process");
 var INSTALL_URL = "https://cli.coderabbit.ai/install.sh";
-async function ensureCoderabbitInstalled(os60) {
-  if (os60.findInPath("coderabbit")) return true;
-  if (os60.id === "win32") {
+async function ensureCoderabbitInstalled(os61) {
+  if (os61.findInPath("coderabbit")) return true;
+  if (os61.id === "win32") {
     console.error(
       "\n  \u2717 CodeRabbit on Windows requires WSL.\n    Install the CLI inside your WSL distribution\n    (curl -fsSL https://cli.coderabbit.ai/install.sh | sh)\n    then re-run `codeam link coderabbit` from WSL.\n"
     );
@@ -15453,8 +15497,8 @@ async function ensureCoderabbitInstalled(os60) {
     proc.on("error", () => finish(false));
   });
   if (!ok) return false;
-  os60.augmentPath([`${os60.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  return os60.findInPath("coderabbit") !== null;
+  os61.augmentPath([`${os61.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  return os61.findInPath("coderabbit") !== null;
 }
 
 // src/agents/coderabbit/link.ts
@@ -15489,10 +15533,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os60) {
+function coderabbitLoginLauncher(os61) {
   return {
     async ensureInstalled() {
-      return ensureCoderabbitInstalled(os60);
+      return ensureCoderabbitInstalled(os61);
     },
     launch() {
       return (0, import_node_child_process7.spawn)("coderabbit", ["auth", "login"], { stdio: "inherit" });
@@ -15548,8 +15592,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path82 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path82) return null;
+  const path85 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path85) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -15566,7 +15610,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path82.trim(),
+    path: path85.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -15649,10 +15693,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path82, lineNo, sevToken, message] = m;
-    if (!path82 || !lineNo || !message) continue;
+    const [, path85, lineNo, sevToken, message] = m;
+    if (!path85 || !lineNo || !message) continue;
     hunks.push({
-      path: path82.trim(),
+      path: path85.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -15712,8 +15756,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -15984,10 +16028,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os60) {
+function cursorLoginLauncher(os61) {
   return {
     async ensureInstalled() {
-      if (os60.findInPath("cursor-agent")) return true;
+      if (os61.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -16051,8 +16095,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -16268,10 +16312,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os60) {
+function aiderLoginLauncher(os61) {
   return {
     async ensureInstalled() {
-      if (os60.findInPath("aider")) return true;
+      if (os61.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -16281,7 +16325,7 @@ function aiderLoginLauncher(os60) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process11.spawn)(os60.id === "win32" ? "cmd.exe" : "sh", os60.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process11.spawn)(os61.id === "win32" ? "cmd.exe" : "sh", os61.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -16353,8 +16397,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("aider");
@@ -16486,8 +16530,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os60 = createOsStrategy();
-      return os60.findInPath("gemini") !== null;
+      const os61 = createOsStrategy();
+      return os61.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process12.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -16677,8 +16721,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -16969,8 +17013,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -17112,8 +17156,8 @@ var OpencodeRuntimeStrategy = class {
   meta = getAgent("opencode");
   mode = "interactive";
   os;
-  constructor(os60) {
-    this.os = os60;
+  constructor(os61) {
+    this.os = os61;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("opencode");
@@ -17197,20 +17241,20 @@ var OpencodeRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os60) => new ClaudeRuntimeStrategy(os60),
-  codex: (os60) => new CodexRuntimeStrategy(os60),
-  coderabbit: (os60) => new CoderabbitRuntimeStrategy(os60),
-  cursor: (os60) => new CursorRuntimeStrategy(os60),
-  aider: (os60) => new AiderRuntimeStrategy(os60),
-  gemini: (os60) => new GeminiRuntimeStrategy(os60),
-  kimi: (os60) => new KimiRuntimeStrategy(os60),
-  opencode: (os60) => new OpencodeRuntimeStrategy(os60)
+  claude: (os61) => new ClaudeRuntimeStrategy(os61),
+  codex: (os61) => new CodexRuntimeStrategy(os61),
+  coderabbit: (os61) => new CoderabbitRuntimeStrategy(os61),
+  cursor: (os61) => new CursorRuntimeStrategy(os61),
+  aider: (os61) => new AiderRuntimeStrategy(os61),
+  gemini: (os61) => new GeminiRuntimeStrategy(os61),
+  kimi: (os61) => new KimiRuntimeStrategy(os61),
+  opencode: (os61) => new OpencodeRuntimeStrategy(os61)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os60 = createOsStrategy()) {
+function createAgentStrategy(agent, os61 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -17220,10 +17264,10 @@ function createAgentStrategy(agent, os60 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os60);
+  return build(os61);
 }
-function createInteractiveAgentStrategy(agent, os60 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os60);
+function createInteractiveAgentStrategy(agent, os61 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os61);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -17920,26 +17964,26 @@ function restoreCoderabbitOauthBlob(value) {
   (0, import_node_fs5.writeFileSync)(path37.join(dir, file), contents, { mode: 384 });
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os60 = deps.os ?? createOsStrategy();
+  const os61 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os60.homeDir();
-  os60.augmentPath(
-    os60.id === "win32" ? [
+  const home = os61.homeDir();
+  os61.augmentPath(
+    os61.id === "win32" ? [
       path37.join(home, ".local", "bin"),
       path37.join(process.env.APPDATA ?? path37.join(home, "AppData", "Roaming"), "npm"),
       path37.join(home, "scoop", "shims")
     ] : [path37.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os60.findInPath("coderabbit") !== null;
+  const installed2 = os61.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os60.findInPath("coderabbit") !== null,
+    installed: os61.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -17953,7 +17997,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const ok = await ensureInstalled(os60);
+      const ok = await ensureInstalled(os61);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -17977,7 +18021,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os60);
+      const ok = await ensureInstalled(os61);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -18007,7 +18051,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const ok = await ensureInstalled(os60);
+      const ok = await ensureInstalled(os61);
       res2.installed = ok;
       if (!ok) return { ...res2, error: "CodeRabbit CLI could not be installed" };
     }
@@ -18047,7 +18091,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const ok = await ensureInstalled(os60);
+    const ok = await ensureInstalled(os61);
     res.installed = ok;
     if (!ok) return { ...res, error: "CodeRabbit CLI is not installed" };
   }
@@ -18231,9 +18275,9 @@ function defaultRunGh(args2) {
 
 // src/commands/host-agent.ts
 var import_node_child_process25 = require("child_process");
-var os38 = __toESM(require("os"));
-var fs44 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
+var os39 = __toESM(require("os"));
+var fs45 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
 
 // src/integrations/manifest.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -19892,13 +19936,72 @@ async function setupHeadroomForSelfHosted(agent, runner = defaultHeadroomRunner,
   return true;
 }
 
+// src/commands/host/house-proxy-config.ts
+var fs42 = __toESM(require("fs"));
+var os37 = __toESM(require("os"));
+var path46 = __toESM(require("path"));
+function houseProxyConfigPath() {
+  return path46.join(os37.homedir(), ".codeam", "house-proxy.json");
+}
+function persistHouseProxyConfig(config) {
+  try {
+    const file = houseProxyConfigPath();
+    fs42.mkdirSync(path46.dirname(file), { recursive: true, mode: 448 });
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs42.writeFileSync(tmp, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+    fs42.renameSync(tmp, file);
+    restrictToOwner(file);
+  } catch (err) {
+    log.warn(
+      "host-agent",
+      `failed to persist house-proxy config (best-effort): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function clearHouseProxyConfig() {
+  try {
+    fs42.rmSync(houseProxyConfigPath(), { force: true });
+  } catch {
+  }
+}
+function readHouseProxyChildEnv() {
+  try {
+    const raw = fs42.readFileSync(houseProxyConfigPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const o = parsed;
+    if (typeof o.baseUrl !== "string" || !o.baseUrl) return {};
+    if (typeof o.token !== "string" || !o.token) return {};
+    const env = {
+      ANTHROPIC_BASE_URL: o.baseUrl,
+      ANTHROPIC_AUTH_TOKEN: o.token,
+      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "512000",
+      API_TIMEOUT_MS: "3000000"
+    };
+    if (o.openRouter === true) {
+      env.ANTHROPIC_API_KEY = "";
+    } else {
+      env.ANTHROPIC_MODEL = "MiniMax-M3";
+      env.ANTHROPIC_DEFAULT_SONNET_MODEL = "MiniMax-M3";
+      env.ANTHROPIC_DEFAULT_OPUS_MODEL = "MiniMax-M3";
+      env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "MiniMax-M3";
+    }
+    if (typeof o.claudeConfigDir === "string" && o.claudeConfigDir) {
+      env.CLAUDE_CONFIG_DIR = o.claudeConfigDir;
+    }
+    return env;
+  } catch {
+    return {};
+  }
+}
+
 // src/commands/host/self-update.ts
 var import_node_child_process23 = require("child_process");
 
 // src/lib/updateNotifier.ts
-var fs42 = __toESM(require("fs"));
-var os37 = __toESM(require("os"));
-var path46 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var os38 = __toESM(require("os"));
+var path47 = __toESM(require("path"));
 var https6 = __toESM(require("https"));
 var import_node_child_process22 = require("child_process");
 var import_picocolors3 = __toESM(require("picocolors"));
@@ -19907,12 +20010,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path46.join(os37.homedir(), ".codeam");
-  return path46.join(dir, "update-check.json");
+  const dir = path47.join(os38.homedir(), ".codeam");
+  return path47.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs42.readFileSync(cachePath(), "utf8");
+    const raw = fs43.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -19923,10 +20026,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs42.mkdirSync(path46.dirname(file), { recursive: true });
+    fs43.mkdirSync(path47.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs42.writeFileSync(tmp, JSON.stringify(cache));
-    fs42.renameSync(tmp, file);
+    fs43.writeFileSync(tmp, JSON.stringify(cache));
+    fs43.renameSync(tmp, file);
   } catch {
   }
 }
@@ -20000,8 +20103,8 @@ function isLinkedInstall() {
       timeout: 2e3
     }).trim();
     if (!root) return false;
-    const pkgPath = path46.join(root, PKG_NAME);
-    return fs42.lstatSync(pkgPath).isSymbolicLink();
+    const pkgPath = path47.join(root, PKG_NAME);
+    return fs43.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -20037,7 +20140,7 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs42.unlinkSync(cachePath());
+    fs43.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors3.default.green("\u2713")} Updated. Resuming session...
@@ -20053,7 +20156,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.81" : null;
+  const current = true ? "2.61.83" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -20070,7 +20173,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.81" : null;
+  const current = true ? "2.61.83" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -20090,7 +20193,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.81" : null;
+  return true ? "2.61.83" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve9) => {
@@ -20157,7 +20260,7 @@ async function runSelfUpdate() {
 
 // src/commands/host/teardown.ts
 var import_node_child_process24 = require("child_process");
-var fs43 = __toESM(require("fs"));
+var fs44 = __toESM(require("fs"));
 var defaultDisableService = () => {
   try {
     (0, import_node_child_process24.execFileSync)("systemctl", ["disable", "--now", "codeam-host-agent"], { stdio: "ignore" });
@@ -20166,7 +20269,7 @@ var defaultDisableService = () => {
 };
 var defaultTeardownHeadroom = () => {
   try {
-    const kind = JSON.parse(fs43.readFileSync(headroomConfigPath(), "utf8")).agent;
+    const kind = JSON.parse(fs44.readFileSync(headroomConfigPath(), "utf8")).agent;
     if (kind) {
       (0, import_node_child_process24.execFileSync)("headroom", ["unwrap", kind], { stdio: "ignore", timeout: 15e3 });
     }
@@ -20234,8 +20337,8 @@ function maybeResumeLocalHeadroomReporter(ctx) {
   if (process.env["HEADROOM_ENABLED"] === "1") return null;
   try {
     const file = headroomConfigPath();
-    if (!fs44.existsSync(file)) return null;
-    const cfg = JSON.parse(fs44.readFileSync(file, "utf8"));
+    if (!fs45.existsSync(file)) return null;
+    const cfg = JSON.parse(fs45.readFileSync(file, "utf8"));
     if (!cfg?.enabled) return null;
     const agent = cfg.agent ?? "claude";
     const ingestUrl = `${resolveApiBaseUrl()}/api/sessions/${ctx.sessionId}/headroom-savings`;
@@ -20820,13 +20923,13 @@ var HostAgentSupervisor = class {
     const relay = this.relay;
     if (!relay) return;
     const raw = cmd.payload?.path;
-    const target = typeof raw === "string" && raw.trim() ? path47.resolve(raw.trim()) : os38.homedir();
+    const target = typeof raw === "string" && raw.trim() ? path48.resolve(raw.trim()) : os39.homedir();
     try {
-      const dirents = await fs44.promises.readdir(target, { withFileTypes: true });
+      const dirents = await fs45.promises.readdir(target, { withFileTypes: true });
       const entries = dirents.filter((d3) => !d3.name.startsWith(".")).map((d3) => ({ name: d3.name, isDir: d3.isDirectory() })).sort(
         (a, b) => a.isDir === b.isDir ? a.name.localeCompare(b.name) : a.isDir ? -1 : 1
       );
-      const parent = path47.dirname(target);
+      const parent = path48.dirname(target);
       await relay.sendResult(cmd.id, "completed", {
         path: target,
         // null at the filesystem root so the UI can hide the ".." affordance.
@@ -21056,18 +21159,24 @@ var HostAgentSupervisor = class {
           API_TIMEOUT_MS: "3000000",
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        const houseConfigDir = path47.join(
-          os38.homedir(),
+        const houseConfigDir = path48.join(
+          os39.homedir(),
           ".codeam",
           "house-claude",
           payload.deployId
         );
         try {
-          fs44.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
+          fs45.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
         } catch {
         }
         childEnv.CLAUDE_CONFIG_DIR = houseConfigDir;
         extraArgs = [`--agent=${agentKind || "claude"}`];
+        persistHouseProxyConfig({
+          baseUrl,
+          token,
+          openRouter: !!openRouter,
+          claudeConfigDir: houseConfigDir
+        });
       } else {
         const auth = await this.resolveAgentAuth(this.identity, payload.sealedAgentAuth);
         const credEnv = provisionAgentCredentials(payload.agentId, auth, void 0);
@@ -21075,6 +21184,7 @@ var HostAgentSupervisor = class {
           ...credEnv,
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
+        clearHouseProxyConfig();
       }
       childEnv = { ...childEnv, CODEAM_AUTO_APPROVE: "1" };
       childEnv = { ...childEnv, CODEAM_HOST_AGENT_CHILD: "1" };
@@ -21082,7 +21192,7 @@ var HostAgentSupervisor = class {
         report("installing", "installing agent CLI");
         await this.runAgentInstall(payload.agentInstallScript);
       }
-      const home = process.env.HOME || os38.homedir();
+      const home = process.env.HOME || os39.homedir();
       childEnv.PATH = `${home}/.local/bin:${process.env.PATH ?? ""}`;
       if (payload.cloneToken) {
         try {
@@ -21090,13 +21200,13 @@ var HostAgentSupervisor = class {
           if ((payload.repoProvider ?? "github") === "gitlab") {
             const glabCmd = await ensureGlabCli(defaultGitToolingRunner);
             if (glabCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path47.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path48.delimiter}${childEnv.PATH}`;
               await ensureGlabAuth(defaultGitToolingRunner, glabCmd, payload.cloneToken);
             }
           } else {
             const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
             if (ghCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path47.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path48.delimiter}${childEnv.PATH}`;
               await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
             }
           }
@@ -21116,7 +21226,7 @@ var HostAgentSupervisor = class {
       }
       if (payload.headroomEnabled && payload.headroomAgent && payload.headroomSavingsIngestUrl && isHeadroomSupportedAgent(payload.headroomAgent)) {
         report("headroom", "setting up Headroom proxy");
-        const freeBytes = await this.getFreeDisk(os38.homedir());
+        const freeBytes = await this.getFreeDisk(os39.homedir());
         const alreadyInstalled = this.isHeadroomInstalled();
         if (!alreadyInstalled && freeBytes !== null && freeBytes < HEADROOM_MIN_FREE_DISK_BYTES) {
           const freeGb = (freeBytes / 1e9).toFixed(1);
@@ -21261,8 +21371,11 @@ var HostAgentSupervisor = class {
       if (this.children.size > 0) return;
       const session = getActiveSession();
       if (!session || !session.pluginId || !session.pollSecret || !session.agent) return;
-      const cwd = session.cwd && fs44.existsSync(session.cwd) ? session.cwd : process.cwd();
-      const proc = this.resumeSpawner({ ...readHeadroomChildEnv() }, cwd);
+      const cwd = session.cwd && fs45.existsSync(session.cwd) ? session.cwd : process.cwd();
+      const proc = this.resumeSpawner(
+        { ...readHeadroomChildEnv(), ...readHouseProxyChildEnv() },
+        cwd
+      );
       const child = {
         deployId: session.id,
         proc,
@@ -21307,7 +21420,7 @@ var HostAgentSupervisor = class {
    */
   runAgentInstall(script) {
     return new Promise((resolve9) => {
-      const home = process.env.HOME || os38.homedir();
+      const home = process.env.HOME || os39.homedir();
       const child = (0, import_node_child_process25.spawn)("sh", ["-c", script], {
         env: { ...process.env, HOME: home },
         stdio: ["ignore", "pipe", "pipe"]
@@ -21395,12 +21508,12 @@ var HostAgentSupervisor = class {
       this.children.delete(deployId);
     }
     const dirs = [
-      path47.join(selfHostedWorkspaceRoot(), deployId),
-      path47.join(os38.homedir(), ".codeam", "house-claude", deployId)
+      path48.join(selfHostedWorkspaceRoot(), deployId),
+      path48.join(os39.homedir(), ".codeam", "house-claude", deployId)
     ];
     for (const dir of dirs) {
       try {
-        fs44.rmSync(dir, { recursive: true, force: true });
+        fs45.rmSync(dir, { recursive: true, force: true });
       } catch (err) {
         log.warn(
           "host-agent",
@@ -21537,9 +21650,9 @@ async function configureHeadroom(action, ctx, deps) {
 }
 
 // src/services/headroom/budget-relaunch.ts
-var fs45 = __toESM(require("fs"));
-var os39 = __toESM(require("os"));
-var path48 = __toESM(require("path"));
+var fs46 = __toESM(require("fs"));
+var os40 = __toESM(require("os"));
+var path49 = __toESM(require("path"));
 var import_child_process13 = require("child_process");
 function amendDeploymentManifestBudget(manifest, budget) {
   const rawArgs = manifest.proxy_args ?? [];
@@ -21573,7 +21686,7 @@ function amendDeploymentManifestBudget(manifest, budget) {
   return { ...manifest, proxy_args: newArgs, base_env: newEnv };
 }
 function findHeadroomDeployments(homeDir2, deps) {
-  const deployDir = path48.join(homeDir2, ".headroom", "deploy");
+  const deployDir = path49.join(homeDir2, ".headroom", "deploy");
   let profiles;
   try {
     profiles = deps.readDir(deployDir);
@@ -21582,7 +21695,7 @@ function findHeadroomDeployments(homeDir2, deps) {
   }
   const results = [];
   for (const profile of profiles) {
-    const manifestPath = path48.join(deployDir, profile, "manifest.json");
+    const manifestPath = path49.join(deployDir, profile, "manifest.json");
     let raw;
     try {
       raw = deps.readJson(manifestPath);
@@ -21614,8 +21727,8 @@ async function applyBudgetToHeadroom(budget, deps) {
 }
 function writeManifestReal(manifestPath, manifest) {
   const tmp = manifestPath + ".codeam.tmp";
-  fs45.writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
-  fs45.renameSync(tmp, manifestPath);
+  fs46.writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
+  fs46.renameSync(tmp, manifestPath);
 }
 function restartDeploymentReal(profile) {
   try {
@@ -21650,11 +21763,11 @@ function spawnProxyReal2(_budget) {
   );
 }
 function makeRealApplyBudgetDeps() {
-  const homeDir2 = os39.homedir();
+  const homeDir2 = os40.homedir();
   return {
     findDeployments: () => findHeadroomDeployments(homeDir2, {
-      readDir: (dir) => fs45.readdirSync(dir),
-      readJson: (filePath) => JSON.parse(fs45.readFileSync(filePath, "utf8"))
+      readDir: (dir) => fs46.readdirSync(dir),
+      readJson: (filePath) => JSON.parse(fs46.readFileSync(filePath, "utf8"))
     }),
     writeManifest: writeManifestReal,
     restartDeployment: restartDeploymentReal,
@@ -21664,16 +21777,16 @@ function makeRealApplyBudgetDeps() {
 }
 
 // src/services/preview/port-registry.ts
-var fs46 = __toESM(require("fs"));
-var os40 = __toESM(require("os"));
-var path49 = __toESM(require("path"));
+var fs47 = __toESM(require("fs"));
+var os41 = __toESM(require("os"));
+var path50 = __toESM(require("path"));
 var import_child_process14 = require("child_process");
 function registryPath() {
-  return path49.join(os40.homedir(), ".codeam", "preview-ports.json");
+  return path50.join(os41.homedir(), ".codeam", "preview-ports.json");
 }
 function readRegistry() {
   try {
-    const raw = fs46.readFileSync(registryPath(), "utf8");
+    const raw = fs47.readFileSync(registryPath(), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object") return parsed;
   } catch {
@@ -21683,10 +21796,10 @@ function readRegistry() {
 function writeRegistry(reg) {
   try {
     const file = registryPath();
-    fs46.mkdirSync(path49.dirname(file), { recursive: true });
+    fs47.mkdirSync(path50.dirname(file), { recursive: true });
     const tmp = `${file}.tmp`;
-    fs46.writeFileSync(tmp, JSON.stringify(reg), "utf8");
-    fs46.renameSync(tmp, file);
+    fs47.writeFileSync(tmp, JSON.stringify(reg), "utf8");
+    fs47.renameSync(tmp, file);
   } catch (err) {
     log.warn("preview", `port-registry write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -21750,9 +21863,213 @@ function reclaimOwnOrphanPort(port) {
   return true;
 }
 
+// src/services/preview/host-allow.ts
+var import_fs = require("fs");
+var path51 = __toESM(require("path"));
+var NEXT_ALLOWED_ORIGINS = [
+  "*.trycloudflare.com",
+  "*.preview.codeagent-mobile.com",
+  "*.codeagent-mobile.com"
+];
+var VITE_ALLOWED_HOSTS = [
+  ".trycloudflare.com",
+  ".preview.codeagent-mobile.com",
+  ".codeagent-mobile.com"
+];
+var CONFIG_BASENAMES = {
+  next: "next.config",
+  vite: "vite.config"
+};
+var CONFIG_EXTS = [".ts", ".mjs", ".js", ".cjs", ".mts"];
+var MARKER_DIR = ".codeam";
+var MARKER_FILE = "preview-host-allow.json";
+var ORIG_INFIX = ".codeam-orig";
+function markerPath(cwd) {
+  return path51.join(cwd, MARKER_DIR, MARKER_FILE);
+}
+async function fileExists(p2) {
+  try {
+    await import_fs.promises.access(p2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findConfigFile(cwd, framework) {
+  const base = CONFIG_BASENAMES[framework];
+  for (const ext of CONFIG_EXTS) {
+    if (await fileExists(path51.join(cwd, `${base}${ext}`))) return `${base}${ext}`;
+  }
+  return null;
+}
+async function dependsOn(cwd, pkgName) {
+  try {
+    const raw = await import_fs.promises.readFile(path51.join(cwd, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    return !!(pkg.dependencies?.[pkgName] ?? pkg.devDependencies?.[pkgName]);
+  } catch {
+    return false;
+  }
+}
+async function isEsmConfig(cwd, configFile) {
+  const ext = path51.extname(configFile);
+  if (ext === ".mjs" || ext === ".mts" || ext === ".ts") return true;
+  if (ext === ".cjs") return false;
+  try {
+    const raw = await import_fs.promises.readFile(path51.join(cwd, "package.json"), "utf8");
+    return JSON.parse(raw).type === "module";
+  } catch {
+    return false;
+  }
+}
+function nextShim(origBasename, esm) {
+  const list = JSON.stringify(NEXT_ALLOWED_ORIGINS);
+  const merge = `
+function __codeamWithAllow(cfg) {
+  var c = cfg && typeof cfg === 'object' ? Object.assign({}, cfg) : {};
+  var existing = Array.isArray(c.allowedDevOrigins) ? c.allowedDevOrigins : [];
+  c.allowedDevOrigins = Array.from(new Set(existing.concat(${list})));
+  return c;
+}
+function __codeamMerge(base) {
+  if (typeof base === 'function') {
+    return function () {
+      var r = base.apply(null, arguments);
+      return r && typeof r.then === 'function' ? r.then(__codeamWithAllow) : __codeamWithAllow(r);
+    };
+  }
+  return base && typeof base.then === 'function' ? base.then(__codeamWithAllow) : __codeamWithAllow(base);
+}`;
+  if (origBasename) {
+    return esm ? `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+import __codeamUser from './${origBasename}';
+${merge}
+export default __codeamMerge(__codeamUser);
+` : `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+var __codeamUser = require('./${origBasename}');
+${merge}
+module.exports = __codeamMerge(__codeamUser && __codeamUser.default ? __codeamUser.default : __codeamUser);
+`;
+  }
+  return esm ? `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+export default { allowedDevOrigins: ${list} };
+` : `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+module.exports = { allowedDevOrigins: ${list} };
+`;
+}
+function viteShim(origBasename, esm) {
+  const list = JSON.stringify(VITE_ALLOWED_HOSTS);
+  const merge = `
+function __codeamWithAllow(cfg) {
+  var c = cfg && typeof cfg === 'object' ? Object.assign({}, cfg) : {};
+  var server = Object.assign({}, c.server || {});
+  if (server.allowedHosts === true) { c.server = server; return c; }
+  var existing = Array.isArray(server.allowedHosts) ? server.allowedHosts : [];
+  server.allowedHosts = Array.from(new Set(existing.concat(${list})));
+  c.server = server;
+  return c;
+}
+function __codeamMerge(base) {
+  if (typeof base === 'function') {
+    return function () {
+      var r = base.apply(null, arguments);
+      return r && typeof r.then === 'function' ? r.then(__codeamWithAllow) : __codeamWithAllow(r);
+    };
+  }
+  return base && typeof base.then === 'function' ? base.then(__codeamWithAllow) : __codeamWithAllow(base);
+}`;
+  if (origBasename) {
+    return esm ? `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+import __codeamUser from './${origBasename}';
+${merge}
+export default __codeamMerge(__codeamUser);
+` : `// codeam preview host-allow shim \u2014 auto-generated, restored on preview stop.
+var __codeamUser = require('./${origBasename}');
+${merge}
+module.exports = __codeamMerge(__codeamUser && __codeamUser.default ? __codeamUser.default : __codeamUser);
+`;
+  }
+  return esm ? `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+export default { server: { allowedHosts: ${list} } };
+` : `// codeam preview host-allow shim \u2014 auto-generated, removed on preview stop.
+module.exports = { server: { allowedHosts: ${list} } };
+`;
+}
+function shimFor(framework, origBasename, esm) {
+  return framework === "next" ? nextShim(origBasename, esm) : viteShim(origBasename, esm);
+}
+async function writeMarker(cwd, marker) {
+  await import_fs.promises.mkdir(path51.join(cwd, MARKER_DIR), { recursive: true });
+  await import_fs.promises.writeFile(markerPath(cwd), JSON.stringify(marker, null, 2), "utf8");
+}
+async function readMarker(cwd) {
+  try {
+    const parsed = JSON.parse(await import_fs.promises.readFile(markerPath(cwd), "utf8"));
+    return parsed && parsed.configFile ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function restorePreviewHostAllow(cwd) {
+  const marker = await readMarker(cwd);
+  if (!marker) return;
+  try {
+    const configAbs = path51.join(cwd, marker.configFile);
+    if (marker.backupFile) {
+      const backupAbs = path51.join(cwd, marker.backupFile);
+      if (await fileExists(backupAbs)) {
+        await import_fs.promises.rm(configAbs, { force: true });
+        await import_fs.promises.rename(backupAbs, configAbs);
+      }
+    } else {
+      await import_fs.promises.rm(configAbs, { force: true });
+    }
+  } catch (err) {
+    log.warn("preview", `host-allow restore failed: ${err instanceof Error ? err.message : err}`);
+  } finally {
+    await import_fs.promises.rm(markerPath(cwd), { force: true }).catch(() => void 0);
+  }
+}
+async function applyPreviewHostAllow(cwd) {
+  try {
+    await restorePreviewHostAllow(cwd);
+    let framework = null;
+    let existing = null;
+    for (const f of ["next", "vite"]) {
+      const cfg = await findConfigFile(cwd, f);
+      if (cfg) {
+        framework = f;
+        existing = cfg;
+        break;
+      }
+    }
+    if (!framework) {
+      if (await dependsOn(cwd, "next")) framework = "next";
+      else if (await dependsOn(cwd, "vite")) framework = "vite";
+    }
+    if (!framework) return;
+    if (existing) {
+      const ext = path51.extname(existing);
+      const origBasename = `${CONFIG_BASENAMES[framework]}${ORIG_INFIX}${ext}`;
+      const esm = await isEsmConfig(cwd, existing);
+      await import_fs.promises.rename(path51.join(cwd, existing), path51.join(cwd, origBasename));
+      await import_fs.promises.writeFile(path51.join(cwd, existing), shimFor(framework, origBasename, esm), "utf8");
+      await writeMarker(cwd, { framework, configFile: existing, backupFile: origBasename });
+      log.info("preview", `host-allow: wrapped ${existing} (${framework}) for tunnel access`);
+    } else {
+      const configFile = `${CONFIG_BASENAMES[framework]}.mjs`;
+      await import_fs.promises.writeFile(path51.join(cwd, configFile), shimFor(framework, null, true), "utf8");
+      await writeMarker(cwd, { framework, configFile, backupFile: null });
+      log.info("preview", `host-allow: created ${configFile} (${framework}) for tunnel access`);
+    }
+  } catch (err) {
+    log.warn("preview", `host-allow apply skipped: ${err instanceof Error ? err.message : err}`);
+  }
+}
+
 // src/services/preview/cloudflared.ts
 var import_child_process15 = require("child_process");
-var import_fs = require("fs");
+var import_fs2 = require("fs");
 var import_promises = __toESM(require("fs/promises"));
 var import_os9 = __toESM(require("os"));
 var import_path4 = __toESM(require("path"));
@@ -21793,7 +22110,7 @@ async function downloadCloudflared(target) {
     const tmp = `${target}.download.tgz`;
     await (0, import_promises2.pipeline)(
       response.body,
-      (0, import_fs.createWriteStream)(tmp)
+      (0, import_fs2.createWriteStream)(tmp)
     );
     try {
       await extractTgz(tmp, import_path4.default.dirname(target));
@@ -21810,7 +22127,7 @@ async function downloadCloudflared(target) {
   }
   await (0, import_promises2.pipeline)(
     response.body,
-    (0, import_fs.createWriteStream)(target, { mode: 493 })
+    (0, import_fs2.createWriteStream)(target, { mode: 493 })
   );
 }
 async function isExecutableBinary(p2) {
@@ -22071,7 +22388,7 @@ async function waitForPortListening(port, opts) {
 }
 
 // src/services/preview/provision-deps.ts
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 var import_path6 = __toESM(require("path"));
 
 // src/services/preview/run-setup.ts
@@ -22219,7 +22536,7 @@ function pickMigrationScript(scripts) {
 }
 async function exists(p2) {
   try {
-    await import_fs2.promises.access(p2);
+    await import_fs3.promises.access(p2);
     return true;
   } catch {
     return false;
@@ -22236,20 +22553,20 @@ async function ensureEnvFile(cwd, generated) {
   }
   const sample = await firstExisting(cwd, ENV_SAMPLES);
   if (sample) {
-    const body = await import_fs2.promises.readFile(import_path6.default.join(cwd, sample), "utf8");
-    await import_fs2.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
+    const body = await import_fs3.promises.readFile(import_path6.default.join(cwd, sample), "utf8");
+    await import_fs3.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
     log.info("provision", `wrote .env from ${sample}`);
     return;
   }
   if (generated.length > 0) {
     const body = "# Generated by codeam \u2014 points at the auto-provisioned local services.\n" + generated.flatMap((s) => s.envLines).join("\n") + "\n";
-    await import_fs2.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
+    await import_fs3.promises.writeFile(import_path6.default.join(cwd, ".env"), body);
     log.info("provision", `generated .env for ${generated.map((s) => s.name).join("+")}`);
   }
 }
 async function readPackageJson(cwd) {
   try {
-    return JSON.parse(await import_fs2.promises.readFile(import_path6.default.join(cwd, "package.json"), "utf8"));
+    return JSON.parse(await import_fs3.promises.readFile(import_path6.default.join(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -22290,9 +22607,9 @@ async function provisionProjectDependencies(cwd) {
       generated = detectServicesFromDeps(pkg);
       if (generated.length > 0) {
         const dir = import_path6.default.join(cwd, ".codeam", "provision");
-        await import_fs2.promises.mkdir(dir, { recursive: true });
+        await import_fs3.promises.mkdir(dir, { recursive: true });
         const file = import_path6.default.join(dir, "compose.generated.yaml");
-        await import_fs2.promises.writeFile(file, renderComposeYaml(generated));
+        await import_fs3.promises.writeFile(file, renderComposeYaml(generated));
         log.info(
           "provision",
           `no compose in repo \u2014 generated ${generated.map((s) => s.name).join("+")}`
@@ -22313,12 +22630,12 @@ async function provisionProjectDependencies(cwd) {
 }
 
 // src/services/preview/setup-deps.ts
-var import_fs3 = __toESM(require("fs"));
+var import_fs4 = __toESM(require("fs"));
 var import_path7 = __toESM(require("path"));
 function detectMissingNodeDeps(cwd) {
-  if (!import_fs3.default.existsSync(import_path7.default.join(cwd, "package.json"))) return null;
-  if (import_fs3.default.existsSync(import_path7.default.join(cwd, "node_modules"))) return null;
-  if (import_fs3.default.existsSync(import_path7.default.join(cwd, "yarn.lock"))) {
+  if (!import_fs4.default.existsSync(import_path7.default.join(cwd, "package.json"))) return null;
+  if (import_fs4.default.existsSync(import_path7.default.join(cwd, "node_modules"))) return null;
+  if (import_fs4.default.existsSync(import_path7.default.join(cwd, "yarn.lock"))) {
     return { cmd: "yarn", args: ["install"] };
   }
   return { cmd: "npm", args: ["install", "--legacy-peer-deps"] };
@@ -22410,6 +22727,7 @@ async function killPreview(sessionId) {
     if (preview.tunnel) killProcessTree(preview.tunnel, "SIGKILL");
   }, 250);
   sigkillTimer.unref?.();
+  await restorePreviewHostAllow(preview.cwd);
   activePreviews.delete(sessionId);
 }
 async function killAllPreviews() {
@@ -22421,10 +22739,153 @@ function activePreviewSessionIds() {
 }
 
 // src/services/preview/start-orchestrator.ts
-var import_child_process18 = require("child_process");
-var fs51 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
+var import_child_process19 = require("child_process");
+var fs55 = __toESM(require("fs"));
+var path58 = __toESM(require("path"));
 var import_which2 = __toESM(require("which"));
+
+// src/services/project-env/index.ts
+var import_fs5 = require("fs");
+var path57 = __toESM(require("path"));
+
+// src/beads/project-key.ts
+var import_child_process18 = require("child_process");
+var crypto2 = __toESM(require("crypto"));
+var fs53 = __toESM(require("fs"));
+var path56 = __toESM(require("path"));
+function normalizeOrigin(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  let host2;
+  let pathPart;
+  const scpLike = /^[^/@]+@([^:]+):(.+)$/.exec(trimmed);
+  if (scpLike && !trimmed.includes("://")) {
+    host2 = scpLike[1];
+    pathPart = scpLike[2];
+  } else {
+    let url2;
+    try {
+      url2 = new URL(trimmed);
+    } catch {
+      return null;
+    }
+    host2 = url2.hostname;
+    pathPart = url2.pathname;
+  }
+  host2 = host2.toLowerCase();
+  pathPart = pathPart.replace(/^\/+/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
+  if (!host2 || !pathPart) return null;
+  return `${host2}/${pathPart}`;
+}
+function findRepoRoot(cwd) {
+  let dir = path56.resolve(cwd);
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < 256; i++) {
+    if (seen.has(dir)) return null;
+    seen.add(dir);
+    try {
+      const stat3 = fs53.statSync(path56.join(dir, ".git"), { throwIfNoEntry: false });
+      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
+    } catch {
+    }
+    const parent = path56.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var _execSeam2 = {
+  exec: (file, args2, opts) => {
+    const out2 = (0, import_child_process18.execFileSync)(file, args2, opts);
+    return typeof out2 === "string" ? out2 : out2.toString("utf8");
+  },
+  realpath: (p2) => fs53.realpathSync(p2)
+};
+function readOrigin(cwd) {
+  try {
+    const raw = _execSeam2.exec("git", ["remote", "get-url", "origin"], {
+      cwd,
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8"
+    });
+    return raw.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function deriveProjectIdentity(cwd = process.cwd()) {
+  const repoRoot = findRepoRoot(cwd) ?? cwd;
+  const origin = readOrigin(repoRoot);
+  const normalized = origin ? normalizeOrigin(origin) : null;
+  if (normalized) {
+    const label = normalized.split("/").pop() || normalized;
+    return { projectKey: normalized, projectLabel: label };
+  }
+  let real = repoRoot;
+  try {
+    real = _execSeam2.realpath(repoRoot);
+  } catch {
+  }
+  const hash = crypto2.createHash("sha256").update(real).digest("hex");
+  return { projectKey: `path:${hash}`, projectLabel: path56.basename(real) || "project" };
+}
+
+// src/services/project-env/index.ts
+async function readIfExists(p2) {
+  try {
+    return await import_fs5.promises.readFile(p2, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function syncProjectEnvUp(cwd, ctx) {
+  if (!ctx.pluginAuthToken) return;
+  const content = await readIfExists(path57.join(cwd, ".env"));
+  if (content == null) return;
+  try {
+    const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
+    const keyCount = parseDotenv(content).length;
+    const res = await pushProjectEnv({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      projectKey,
+      projectLabel,
+      content,
+      keyCount
+    });
+    if (res.ok) log.info("project-env", `pushed .env (${keyCount} vars) for ${projectLabel}`);
+    else log.debug("project-env", `push .env failed (${res.status}) \u2014 non-fatal`);
+  } catch (err) {
+    log.debug("project-env", `push .env skipped: ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function restoreProjectEnvIfMissing(cwd, ctx) {
+  if (!ctx.pluginAuthToken) return false;
+  const envPath = path57.join(cwd, ".env");
+  if (await readIfExists(envPath) != null) return false;
+  try {
+    const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
+    const stored = await pullProjectEnv({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      projectKey
+    });
+    if (!stored) return false;
+    const tmp = path57.join(cwd, ".env.codeam-restore.tmp");
+    await import_fs5.promises.writeFile(tmp, stored.content, { encoding: "utf8", mode: 384 });
+    await import_fs5.promises.rename(tmp, envPath);
+    log.info("project-env", `restored .env (${stored.keyCount} vars) for ${projectLabel}`);
+    return true;
+  } catch (err) {
+    log.debug("project-env", `restore .env skipped: ${err instanceof Error ? err.message : err}`);
+    return false;
+  }
+}
+
+// src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
 var TUNNEL_REGISTER_DEADLINE_MS = 45e3;
@@ -22490,8 +22951,8 @@ function normalizeDetectionForSpawn(detection, cwd) {
   if (args2.length === 0) return detection;
   const binName = args2[0];
   if (binName.startsWith("-")) return detection;
-  const binPath = path54.join(cwd, "node_modules", ".bin", binName);
-  if (!fs51.existsSync(binPath)) return detection;
+  const binPath = path58.join(cwd, "node_modules", ".bin", binName);
+  if (!fs55.existsSync(binPath)) return detection;
   return {
     ...detection,
     command: binPath,
@@ -22537,7 +22998,8 @@ async function runPreviewStart(args2) {
     tunnel: tun.tunnel,
     url: tun.url,
     framework: detection.framework,
-    detection
+    detection,
+    cwd: ctx.cwd
   });
   recordPreviewPort(detection.port, dev.devServer.pid, sessionId, Date.now());
   log.info("preview", `ready: ${detection.framework} at ${tun.url}`);
@@ -22549,6 +23011,13 @@ async function runPreviewStart(args2) {
 }
 async function provisionDeps(ctx) {
   const { detection, cwd, emit: emit2, emitProgress } = ctx;
+  if (ctx.projectEnvAuth?.pluginAuthToken) {
+    await restoreProjectEnvIfMissing(cwd, {
+      sessionId: ctx.sessionId,
+      pluginId: ctx.projectEnvAuth.pluginId,
+      pluginAuthToken: ctx.projectEnvAuth.pluginAuthToken
+    });
+  }
   const missingDeps = detectMissingNodeDeps(cwd);
   let preflightRan = false;
   if (missingDeps) {
@@ -22696,9 +23165,10 @@ async function startDevServer(ctx) {
       return null;
     }
   }
+  await applyPreviewHostAllow(cwd);
   const spawnable = normalizeDetectionForSpawn(detection, cwd);
   emitProgress("BOOT_SEQUENCE", `${spawnable.command} ${spawnable.args.join(" ")}`);
-  const devServer = (0, import_child_process18.spawn)(spawnable.command, spawnable.args, {
+  const devServer = (0, import_child_process19.spawn)(spawnable.command, spawnable.args, {
     cwd,
     env: { ...process.env, ...spawnable.env ?? {} },
     stdio: ["ignore", "pipe", "pipe"],
@@ -22823,7 +23293,7 @@ async function establishTunnel(ctx, dev) {
         `cloudflared quick tunnel (retry ${attempt}/${MAX_TUNNEL_ATTEMPTS})`
       );
     }
-    const candidate = (0, import_child_process18.spawn)(
+    const candidate = (0, import_child_process19.spawn)(
       bin,
       ["tunnel", "--url", `http://localhost:${detection.port}`],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -22854,10 +23324,10 @@ async function establishTunnel(ctx, dev) {
 }
 
 // src/beads/bd-adapter.ts
-var import_child_process19 = require("child_process");
-var fs52 = __toESM(require("fs"));
-var os42 = __toESM(require("os"));
-var path55 = __toESM(require("path"));
+var import_child_process20 = require("child_process");
+var fs56 = __toESM(require("fs"));
+var os43 = __toESM(require("os"));
+var path59 = __toESM(require("path"));
 var BD_PACKAGE = "@beads/bd";
 function resolveBundledBdBinary() {
   return _resolveSeam.resolveBundled();
@@ -22869,11 +23339,11 @@ function _defaultResolveBundled() {
   } catch {
     return null;
   }
-  const binDir = path55.join(path55.dirname(pkgJsonPath), "bin");
+  const binDir = path59.join(path59.dirname(pkgJsonPath), "bin");
   const binaryName = process.platform === "win32" ? "bd.exe" : "bd";
-  const binaryPath = path55.join(binDir, binaryName);
+  const binaryPath = path59.join(binDir, binaryName);
   try {
-    fs52.accessSync(binaryPath, fs52.constants.F_OK);
+    fs56.accessSync(binaryPath, fs56.constants.F_OK);
     return binaryPath;
   } catch {
     return null;
@@ -22883,13 +23353,13 @@ function resolveBdOnPath() {
   return _resolveSeam.resolveOnPath();
 }
 function _defaultResolveOnPath() {
-  const dirs = (process.env.PATH ?? "").split(path55.delimiter).filter(Boolean);
+  const dirs = (process.env.PATH ?? "").split(path59.delimiter).filter(Boolean);
   const candidates = process.platform === "win32" ? ["bd.exe", "bd.cmd", "bd"] : ["bd"];
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const full = path55.join(dir, candidate);
+      const full = path59.join(dir, candidate);
       try {
-        fs52.accessSync(full, fs52.constants.F_OK);
+        fs56.accessSync(full, fs56.constants.F_OK);
         return full;
       } catch {
       }
@@ -22908,7 +23378,7 @@ function _defaultSpawn(binaryPath, args2, opts) {
   return new Promise((resolve9) => {
     let proc;
     try {
-      proc = (0, import_child_process19.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
+      proc = (0, import_child_process20.spawn)(binaryPath, args2, { cwd: opts.cwd, env: opts.env });
     } catch (err) {
       resolve9({ code: -1, stdout: "", stderr: err.message });
       return;
@@ -22974,7 +23444,7 @@ var BdAdapter = class {
     const env = { ...process.env };
     if (!env.HOME) {
       try {
-        const home = os42.homedir();
+        const home = os43.homedir();
         if (home) env.HOME = home;
       } catch {
       }
@@ -23066,12 +23536,12 @@ function coerceIssue(row, projectKey) {
 
 // src/beads/provisioner.ts
 var import_child_process23 = require("child_process");
-var fs55 = __toESM(require("fs"));
-var os44 = __toESM(require("os"));
-var path58 = __toESM(require("path"));
+var fs58 = __toESM(require("fs"));
+var os45 = __toESM(require("os"));
+var path61 = __toESM(require("path"));
 
 // src/beads/install-bd.ts
-var import_child_process20 = require("child_process");
+var import_child_process21 = require("child_process");
 var INSTALL_SH_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh";
 var INSTALL_PS1_URL = "https://raw.githubusercontent.com/gastownhall/beads/main/install.ps1";
 function resolveInstallStrategy(platform3) {
@@ -23102,7 +23572,7 @@ function _defaultInstallSpawn(strategy) {
   return new Promise((resolve9) => {
     let proc;
     try {
-      proc = (0, import_child_process20.spawn)(strategy.command, strategy.args, { env: process.env });
+      proc = (0, import_child_process21.spawn)(strategy.command, strategy.args, { env: process.env });
     } catch (err) {
       resolve9({ ok: false, code: -1, stderr: err.message });
       return;
@@ -23132,10 +23602,10 @@ async function installBd(platform3 = process.platform) {
 }
 
 // src/beads/install-dolt.ts
-var import_child_process21 = require("child_process");
-var fs53 = __toESM(require("fs"));
-var os43 = __toESM(require("os"));
-var path56 = __toESM(require("path"));
+var import_child_process22 = require("child_process");
+var fs57 = __toESM(require("fs"));
+var os44 = __toESM(require("os"));
+var path60 = __toESM(require("path"));
 var DOLT_INSTALL_SH_URL = "https://github.com/dolthub/dolt/releases/latest/download/install.sh";
 var DOLT_MSI_URL = "https://github.com/dolthub/dolt/releases/latest/download/dolt-windows-amd64.msi";
 function resolveDoltInstallStrategy(platform3) {
@@ -23175,11 +23645,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os60 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os61 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os60 === "windows" && a !== "amd64") return null;
-  return `${os60}-${a}`;
+  if (os61 === "windows" && a !== "amd64") return null;
+  return `${os61}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -23224,14 +23694,14 @@ async function installDoltToDir(targetDir, platform3 = process.platform, arch2 =
   return result;
 }
 var _doltPathSeam = {
-  homedir: () => os43.homedir(),
+  homedir: () => os44.homedir(),
   getPath: () => process.env.PATH ?? "",
   setPath: (p2) => {
     process.env.PATH = p2;
   },
   exists: (p2) => {
     try {
-      fs53.accessSync(p2, fs53.constants.F_OK);
+      fs57.accessSync(p2, fs57.constants.F_OK);
       return true;
     } catch {
       return false;
@@ -23242,7 +23712,7 @@ function doltBinaryNames(platform3) {
   return platform3 === "win32" ? ["dolt.exe", "dolt.cmd", "dolt"] : ["dolt"];
 }
 function knownDoltDirs(platform3) {
-  const P3 = platform3 === "win32" ? path56.win32 : path56.posix;
+  const P3 = platform3 === "win32" ? path60.win32 : path60.posix;
   const home = _doltPathSeam.homedir();
   if (platform3 === "win32") {
     return [
@@ -23258,7 +23728,7 @@ function knownDoltDirs(platform3) {
   ].filter(Boolean);
 }
 function ensureDoltResolvable(platform3 = process.platform) {
-  const P3 = platform3 === "win32" ? path56.win32 : path56.posix;
+  const P3 = platform3 === "win32" ? path60.win32 : path60.posix;
   const delim = platform3 === "win32" ? ";" : ":";
   const names = doltBinaryNames(platform3);
   const pathDirs = _doltPathSeam.getPath().split(delim).filter(Boolean);
@@ -23294,7 +23764,7 @@ function _defaultDoltInstallSpawn(strategy) {
     };
     let proc;
     try {
-      proc = (0, import_child_process21.spawn)(strategy.command, strategy.args, {
+      proc = (0, import_child_process22.spawn)(strategy.command, strategy.args, {
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -23391,89 +23861,6 @@ async function ensureSharedServer(adapter, options = {}) {
   return { up: false, started: false };
 }
 
-// src/beads/project-key.ts
-var import_child_process22 = require("child_process");
-var crypto2 = __toESM(require("crypto"));
-var fs54 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
-function normalizeOrigin(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  let host2;
-  let pathPart;
-  const scpLike = /^[^/@]+@([^:]+):(.+)$/.exec(trimmed);
-  if (scpLike && !trimmed.includes("://")) {
-    host2 = scpLike[1];
-    pathPart = scpLike[2];
-  } else {
-    let url2;
-    try {
-      url2 = new URL(trimmed);
-    } catch {
-      return null;
-    }
-    host2 = url2.hostname;
-    pathPart = url2.pathname;
-  }
-  host2 = host2.toLowerCase();
-  pathPart = pathPart.replace(/^\/+/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
-  if (!host2 || !pathPart) return null;
-  return `${host2}/${pathPart}`;
-}
-function findRepoRoot(cwd) {
-  let dir = path57.resolve(cwd);
-  const seen = /* @__PURE__ */ new Set();
-  for (let i = 0; i < 256; i++) {
-    if (seen.has(dir)) return null;
-    seen.add(dir);
-    try {
-      const stat3 = fs54.statSync(path57.join(dir, ".git"), { throwIfNoEntry: false });
-      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
-    } catch {
-    }
-    const parent = path57.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
-}
-var _execSeam2 = {
-  exec: (file, args2, opts) => {
-    const out2 = (0, import_child_process22.execFileSync)(file, args2, opts);
-    return typeof out2 === "string" ? out2 : out2.toString("utf8");
-  },
-  realpath: (p2) => fs54.realpathSync(p2)
-};
-function readOrigin(cwd) {
-  try {
-    const raw = _execSeam2.exec("git", ["remote", "get-url", "origin"], {
-      cwd,
-      timeout: 1e3,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-    return raw.trim() || null;
-  } catch {
-    return null;
-  }
-}
-function deriveProjectIdentity(cwd = process.cwd()) {
-  const repoRoot = findRepoRoot(cwd) ?? cwd;
-  const origin = readOrigin(repoRoot);
-  const normalized = origin ? normalizeOrigin(origin) : null;
-  if (normalized) {
-    const label = normalized.split("/").pop() || normalized;
-    return { projectKey: normalized, projectLabel: label };
-  }
-  let real = repoRoot;
-  try {
-    real = _execSeam2.realpath(repoRoot);
-  } catch {
-  }
-  const hash = crypto2.createHash("sha256").update(real).digest("hex");
-  return { projectKey: `path:${hash}`, projectLabel: path57.basename(real) || "project" };
-}
-
 // src/beads/project-prefix.ts
 var crypto3 = __toESM(require("crypto"));
 function prefixForProjectKey(projectKey) {
@@ -23518,17 +23905,17 @@ var _provisionSeam = {
 };
 var _linkSeam = {
   platform: () => process.platform,
-  homedir: () => os44.homedir(),
+  homedir: () => os45.homedir(),
   isWritableDir: (dir) => {
     try {
-      fs55.accessSync(dir, fs55.constants.W_OK);
+      fs58.accessSync(dir, fs58.constants.W_OK);
       return true;
     } catch {
       return false;
     }
   },
   ensureDir: (dir) => {
-    fs55.mkdirSync(dir, { recursive: true });
+    fs58.mkdirSync(dir, { recursive: true });
   },
   /**
    * A directory to symlink `bd` into so the AGENT's shell + Claude Code's
@@ -23549,9 +23936,9 @@ var _linkSeam = {
    * which `linkBdOntoPath` creates if missing.
    */
   cliBinDir: () => {
-    const pathDirs = (process.env.PATH ?? "").split(path58.delimiter).filter(Boolean);
+    const pathDirs = (process.env.PATH ?? "").split(path61.delimiter).filter(Boolean);
     const home = _linkSeam.homedir();
-    const localBin = home ? path58.join(home, ".local", "bin") : null;
+    const localBin = home ? path61.join(home, ".local", "bin") : null;
     if (localBin) {
       try {
         _linkSeam.ensureDir(localBin);
@@ -23561,16 +23948,16 @@ var _linkSeam = {
     const candidates = [];
     if (localBin) candidates.push(localBin);
     try {
-      candidates.push(path58.dirname(process.execPath));
+      candidates.push(path61.dirname(process.execPath));
     } catch {
     }
     candidates.push("/usr/local/bin");
     const entry = process.argv[1];
     if (entry) {
       try {
-        candidates.push(path58.dirname(fs55.realpathSync(entry)));
+        candidates.push(path61.dirname(fs58.realpathSync(entry)));
       } catch {
-        candidates.push(path58.dirname(entry));
+        candidates.push(path61.dirname(entry));
       }
     }
     const onPathWritable = candidates.find(
@@ -23582,20 +23969,20 @@ var _linkSeam = {
   /** Current symlink target at `linkPath`, or null when absent / not a link. */
   readlink: (linkPath) => {
     try {
-      return fs55.readlinkSync(linkPath);
+      return fs58.readlinkSync(linkPath);
     } catch {
       return null;
     }
   },
-  unlink: (linkPath) => fs55.unlinkSync(linkPath),
-  symlink: (target, linkPath) => fs55.symlinkSync(target, linkPath)
+  unlink: (linkPath) => fs58.unlinkSync(linkPath),
+  symlink: (target, linkPath) => fs58.symlinkSync(target, linkPath)
 };
 function linkBdOntoPath(binaryPath) {
   if (_linkSeam.platform() === "win32") return;
   const binDir = _linkSeam.cliBinDir();
   if (!binDir) return;
   _linkSeam.ensureDir(binDir);
-  const linkPath = path58.join(binDir, "bd");
+  const linkPath = path61.join(binDir, "bd");
   if (linkPath === binaryPath) return;
   const current = _linkSeam.readlink(linkPath);
   if (current === binaryPath) return;
@@ -23790,7 +24177,7 @@ function dedupeRecipes(agents) {
 
 // src/beads/watcher.ts
 var crypto4 = __toESM(require("crypto"));
-var path59 = __toESM(require("path"));
+var path62 = __toESM(require("path"));
 var API_BASE6 = resolveApiBaseUrl();
 var DEBOUNCE_MS2 = 400;
 var ZERO_SUMMARY = {
@@ -23814,7 +24201,7 @@ var BeadsWatcher = class {
   constructor(opts) {
     this.opts = opts;
     this.bd = opts.adapter ?? new BdAdapter({ cwd: opts.cwd, beadsDir: opts.beadsDir });
-    this.feedPath = opts.feedPath ?? path59.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
+    this.feedPath = opts.feedPath ?? path62.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
     this.apiBase = opts.apiBaseUrl ?? API_BASE6;
   }
   opts;
@@ -24313,8 +24700,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path62.join(os48.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
-    fs58.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path65.join(os49.tmpdir(), `codeam-${(0, import_crypto3.randomUUID)()}-${safeName}`);
+    fs61.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -24526,9 +24913,10 @@ var listFiles = async (ctx, cmd, parsed) => {
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
 var envReadH = async (ctx, cmd) => {
-  const envPath = path62.join(process.cwd(), ".env");
+  const envPath = path65.join(process.cwd(), ".env");
+  await restoreProjectEnvIfMissing(process.cwd(), ctx);
   try {
-    const raw = await fs58.promises.readFile(envPath, "utf8");
+    const raw = await fs61.promises.readFile(envPath, "utf8");
     await ctx.relay.sendResult(cmd.id, "completed", {
       exists: true,
       vars: parseDotenv(raw)
@@ -24559,14 +24947,15 @@ var envWriteH = async (ctx, cmd, parsed) => {
     }
     seen.add(v.key);
   }
-  const envPath = path62.join(process.cwd(), ".env");
-  const tmpPath = path62.join(process.cwd(), ".env.codeam.tmp");
+  const envPath = path65.join(process.cwd(), ".env");
+  const tmpPath = path65.join(process.cwd(), ".env.codeam.tmp");
   try {
-    await fs58.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
-    await fs58.promises.rename(tmpPath, envPath);
+    await fs61.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
+    await fs61.promises.rename(tmpPath, envPath);
     await ctx.relay.sendResult(cmd.id, "completed", { ok: true, count: vars.length });
+    void syncProjectEnvUp(process.cwd(), ctx);
   } catch (err) {
-    await fs58.promises.rm(tmpPath, { force: true }).catch(() => void 0);
+    await fs61.promises.rm(tmpPath, { force: true }).catch(() => void 0);
     await ctx.relay.sendResult(cmd.id, "failed", { error: err.message });
   }
 };
@@ -24615,7 +25004,7 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
   let configuredAgent = rawAgentId;
   if (!configuredAgent) {
     try {
-      const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+      const raw = JSON.parse(fs61.readFileSync(headroomConfigPath(), "utf8"));
       configuredAgent = raw.agent ?? "";
     } catch {
     }
@@ -24649,7 +25038,7 @@ var headroomConfigureH = async (ctx, cmd, parsed) => {
     persist: persistHeadroomConfig,
     readEnabled: () => {
       try {
-        const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+        const raw = JSON.parse(fs61.readFileSync(headroomConfigPath(), "utf8"));
         return raw.enabled === true;
       } catch {
         return false;
@@ -24906,7 +25295,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
   });
   const token = ctx.pluginAuthToken;
   void (async () => {
-    const os60 = createOsStrategy();
+    const os61 = createOsStrategy();
     try {
       const report = await reviewPullRequest(
         {
@@ -24915,7 +25304,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
           baseBranch: parsed.baseBranch
         },
         {
-          runReview: (input) => new CoderabbitRuntimeStrategy(os60).runOneShot(input),
+          runReview: (input) => new CoderabbitRuntimeStrategy(os61).runOneShot(input),
           runGh: (args2) => defaultRunGh(args2),
           postReport: async (r) => {
             if (!token) return;
@@ -24953,7 +25342,7 @@ var headroomBudgetH = async (ctx, cmd) => {
   }
   let headroomActive = false;
   try {
-    const raw = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+    const raw = JSON.parse(fs61.readFileSync(headroomConfigPath(), "utf8"));
     headroomActive = raw.enabled === true;
   } catch {
   }
@@ -24963,7 +25352,7 @@ var headroomBudgetH = async (ctx, cmd) => {
   }
   let existingConfig = { enabled: true };
   try {
-    existingConfig = JSON.parse(fs58.readFileSync(headroomConfigPath(), "utf8"));
+    existingConfig = JSON.parse(fs61.readFileSync(headroomConfigPath(), "utf8"));
   } catch {
   }
   if (payload.budgetEnabled && payload.budgetUsd != null) {
@@ -25076,9 +25465,9 @@ var CLI_UPDATE_MAX_ATTEMPTS = 3;
 function buildNpmInstallInvocation(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const execPath = opts?.execPath ?? process.execPath;
-  const exists2 = opts?.existsSync ?? fs58.existsSync;
+  const exists2 = opts?.existsSync ?? fs61.existsSync;
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path62.win32 : path62.posix;
+  const p2 = platform3 === "win32" ? path65.win32 : path65.posix;
   const normalized = entryScript.split(/[\\/]/).join("/");
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = normalized.indexOf(marker);
@@ -25100,7 +25489,7 @@ function isPermissionError(stderr) {
 function resolveGlobalNodeModulesDir(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path62.win32 : path62.posix;
+  const p2 = platform3 === "win32" ? path65.win32 : path65.posix;
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = entryScript.split(/[\\/]/).join("/").indexOf(marker);
   if (markerIdx <= 0) return null;
@@ -25110,9 +25499,9 @@ function resolveGlobalNodeModulesDir(opts) {
 var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
-  const readdirSync12 = deps?.readdirSync ?? fs58.readdirSync;
-  const statSync17 = deps?.statSync ?? fs58.statSync;
-  const rmSync8 = deps?.rmSync ?? fs58.rmSync;
+  const readdirSync12 = deps?.readdirSync ?? fs61.readdirSync;
+  const statSync17 = deps?.statSync ?? fs61.statSync;
+  const rmSync9 = deps?.rmSync ?? fs61.rmSync;
   let removed = 0;
   let entries;
   try {
@@ -25122,11 +25511,11 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   }
   for (const name of entries) {
     if (!/^\.codeam-cli-/.test(name)) continue;
-    const full = path62.join(nodeModulesDir, name);
+    const full = path65.join(nodeModulesDir, name);
     try {
       const st3 = statSync17(full);
       if (now - st3.mtimeMs < STALE_STAGING_AGE_MS) continue;
-      rmSync8(full, { recursive: true, force: true });
+      rmSync9(full, { recursive: true, force: true });
       removed++;
     } catch {
     }
@@ -25611,7 +26000,12 @@ function startPreviewFromDetection(ctx, detection, pluginAuthToken) {
     sessionId: ctx.sessionId,
     detection,
     cwd: process.cwd(),
-    emit: emit2
+    emit: emit2,
+    // Auth for the per-repo `.env` vault restore, performed INSIDE the bring-up
+    // (provisionDeps stage, after the reuse short-circuit) so a fresh session of
+    // this repo picks up its saved `.env` before the dev server spawns. Optional
+    // — a caller without a token just skips the restore.
+    projectEnvAuth: { pluginId: ctx.pluginId, pluginAuthToken }
   }).catch((err) => {
     const message = err instanceof Error ? err.message : String(err);
     log.warn("preview", `start crashed before ready: ${message}`);
@@ -25984,11 +26378,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path82 = fileFlag.slice("--token-file=".length);
+    const path85 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs59.readFileSync(path82, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path82} is empty`);
-      rmIfExistsQuiet(path82);
+      const content = fs62.readFileSync(path85, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path85} is empty`);
+      rmIfExistsQuiet(path85);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -26017,7 +26411,7 @@ async function claimOnce(token, pluginId, pluginSecretHash) {
     pluginId,
     ideName: "codeam-cli (codespace)",
     ideVersion: process.env.npm_package_version ?? "unknown",
-    hostname: os49.hostname(),
+    hostname: os50.hostname(),
     codespaceName: process.env.CODESPACE_NAME ?? "",
     // Current git branch of the codespace's working directory, so the
     // backend can populate `PairedSession.branch` for the codespace pair.
@@ -26078,7 +26472,7 @@ async function claim(token, pluginId, pluginSecretHash) {
   }
 }
 function pairAutoLockPath() {
-  return path63.join(os49.homedir(), ".codeam", "pair-auto.lock");
+  return path66.join(os50.homedir(), ".codeam", "pair-auto.lock");
 }
 function isLivePairAuto(pid) {
   if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
@@ -26088,7 +26482,7 @@ function isLivePairAuto(pid) {
     if (e.code !== "EPERM") return false;
   }
   try {
-    return fs59.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
+    return fs62.readFileSync(`/proc/${pid}/cmdline`, "utf8").includes("codeam");
   } catch {
     return true;
   }
@@ -26098,24 +26492,24 @@ function isLiveCodeam(pid) {
 }
 function daemonLockPath(sessionId) {
   const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return path63.join(os49.homedir(), ".codeam", `daemon-${safe}.lock`);
+  return path66.join(os50.homedir(), ".codeam", `daemon-${safe}.lock`);
 }
 function acquireDaemonLock(sessionId) {
   const lockPath = daemonLockPath(sessionId);
   try {
-    fs59.mkdirSync(path63.dirname(lockPath), { recursive: true });
+    fs62.mkdirSync(path66.dirname(lockPath), { recursive: true });
     try {
-      fs59.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+      fs62.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      const holder = Number(fs59.readFileSync(lockPath, "utf8").trim());
+      const holder = Number(fs62.readFileSync(lockPath, "utf8").trim());
       if (holder && holder !== process.pid && isLiveCodeam(holder)) return false;
-      fs59.writeFileSync(lockPath, String(process.pid));
+      fs62.writeFileSync(lockPath, String(process.pid));
     }
     const release3 = () => {
       try {
-        if (fs59.existsSync(lockPath) && Number(fs59.readFileSync(lockPath, "utf8").trim()) === process.pid) {
-          fs59.unlinkSync(lockPath);
+        if (fs62.existsSync(lockPath) && Number(fs62.readFileSync(lockPath, "utf8").trim()) === process.pid) {
+          fs62.unlinkSync(lockPath);
         }
       } catch {
       }
@@ -26137,19 +26531,19 @@ function acquireDaemonLock(sessionId) {
 function acquireSingletonLock() {
   const lockPath = pairAutoLockPath();
   try {
-    fs59.mkdirSync(path63.dirname(lockPath), { recursive: true });
+    fs62.mkdirSync(path66.dirname(lockPath), { recursive: true });
     try {
-      fs59.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+      fs62.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
-      const holder = Number(fs59.readFileSync(lockPath, "utf8").trim());
+      const holder = Number(fs62.readFileSync(lockPath, "utf8").trim());
       if (isLivePairAuto(holder)) return false;
-      fs59.writeFileSync(lockPath, String(process.pid));
+      fs62.writeFileSync(lockPath, String(process.pid));
     }
     process.once("exit", () => {
       try {
-        if (fs59.existsSync(lockPath) && Number(fs59.readFileSync(lockPath, "utf8").trim()) === process.pid) {
-          fs59.unlinkSync(lockPath);
+        if (fs62.existsSync(lockPath) && Number(fs62.readFileSync(lockPath, "utf8").trim()) === process.pid) {
+          fs62.unlinkSync(lockPath);
         }
       } catch {
       }
@@ -26601,10 +26995,10 @@ var AgentService = class _AgentService {
 };
 
 // src/agents/acp/adapters.ts
-var path65 = __toESM(require("path"));
+var path68 = __toESM(require("path"));
 
 // src/agents/acp/agent-binary.ts
-var import_fs4 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_os11 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process26 = require("child_process");
@@ -26634,7 +27028,7 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs6.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
@@ -26692,7 +27086,7 @@ async function waitForCommandOnPath(cmd, opts = {}) {
   return check();
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync27 = deps.existsSync ?? import_fs4.default.existsSync;
+  const existsSync27 = deps.existsSync ?? import_fs6.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
@@ -26891,13 +27285,13 @@ function resolveBin(pkgName, binName) {
   try {
     const manifestPath = require_.resolve(`${pkgName}/package.json`);
     const manifest = require_(`${pkgName}/package.json`);
-    const pkgDir = path65.dirname(manifestPath);
+    const pkgDir = path68.dirname(manifestPath);
     const bin = manifest.bin;
     if (!bin) return null;
-    if (typeof bin === "string") return path65.resolve(pkgDir, bin);
+    if (typeof bin === "string") return path68.resolve(pkgDir, bin);
     const target = binName ?? Object.keys(bin)[0];
     if (!target || !bin[target]) return null;
-    return path65.resolve(pkgDir, bin[target]);
+    return path68.resolve(pkgDir, bin[target]);
   } catch {
     return null;
   }
@@ -27047,9 +27441,9 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
 var import_node_crypto11 = require("crypto");
 
 // src/services/history.service.ts
-var fs61 = __toESM(require("fs"));
-var path66 = __toESM(require("path"));
-var os51 = __toESM(require("os"));
+var fs64 = __toESM(require("fs"));
+var path69 = __toESM(require("path"));
+var os52 = __toESM(require("os"));
 var https7 = __toESM(require("https"));
 var http6 = __toESM(require("http"));
 var import_zod2 = require("zod");
@@ -27076,7 +27470,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs61.readFileSync(filePath, "utf8");
+    raw = fs64.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -27217,7 +27611,7 @@ var HistoryService = class _HistoryService {
     return this._quotaPercent === null || Date.now() - this._quotaFetchedAt > ttlMs;
   }
   get projectDir() {
-    return this.runtime.resolveHistoryDir(this.cwd) ?? path66.join(os51.homedir(), ".claude", "projects", encodeCwd(this.cwd));
+    return this.runtime.resolveHistoryDir(this.cwd) ?? path69.join(os52.homedir(), ".claude", "projects", encodeCwd(this.cwd));
   }
   /** Set the current Claude conversation ID (extracted from /cost command or session start) */
   setCurrentConversationId(id) {
@@ -27229,7 +27623,7 @@ var HistoryService = class _HistoryService {
   /** Return the current message count in the active conversation. */
   getCurrentMessageCount() {
     if (!this.currentConversationId) return 0;
-    const filePath = path66.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+    const filePath = path69.join(this.projectDir, `${this.currentConversationId}.jsonl`);
     return parseJsonl(filePath).length;
   }
   /**
@@ -27240,7 +27634,7 @@ var HistoryService = class _HistoryService {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.currentConversationId) return null;
-      const filePath = path66.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+      const filePath = path69.join(this.projectDir, `${this.currentConversationId}.jsonl`);
       const messages = parseJsonl(filePath);
       if (messages.length > previousCount) {
         for (let i = messages.length - 1; i >= previousCount; i--) {
@@ -27266,16 +27660,16 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs61.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs64.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs61.statSync(path66.join(dir, e.name));
+          const stat3 = fs64.statSync(path69.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
         }
       }).filter((f) => f.birthtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       if (files.length > 0) {
-        this.currentConversationId = path66.basename(files[0].name, ".jsonl");
+        this.currentConversationId = path69.basename(files[0].name, ".jsonl");
       }
     } catch {
     }
@@ -27309,13 +27703,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs61.readdirSync(dir, { withFileTypes: true });
+      entries = fs64.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs61.statSync(path66.join(dir, e.name));
+        const stat3 = fs64.statSync(path69.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -27324,12 +27718,12 @@ var HistoryService = class _HistoryService {
     if (files.length === 0) return null;
     const targetFile = this.currentConversationId ? `${this.currentConversationId}.jsonl` : files[0].name;
     if (!files.some((f) => f.name === targetFile)) return null;
-    return this.extractUsageFromFile(path66.join(dir, targetFile));
+    return this.extractUsageFromFile(path69.join(dir, targetFile));
   }
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs61.readFileSync(filePath, "utf8");
+      raw = fs64.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -27374,9 +27768,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs61.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs64.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs61.statSync(path66.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs64.statSync(path69.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -27387,7 +27781,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs61.readFileSync(path66.join(projectDir, file), "utf8");
+        raw = fs64.readFileSync(path69.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -27466,7 +27860,7 @@ var HistoryService = class _HistoryService {
     if (this.runtime.resolveHistoryFile) {
       return this.runtime.resolveHistoryFile(this.cwd, sessionId);
     }
-    return path66.join(this.projectDir, `${sessionId}.jsonl`);
+    return path69.join(this.projectDir, `${sessionId}.jsonl`);
   }
   /**
    * Parse a conversation's messages from disk, agent-aware. Claude uses the
@@ -27500,7 +27894,7 @@ var HistoryService = class _HistoryService {
         };
       });
     }
-    return parseJsonl(path66.join(this.projectDir, `${sessionId}.jsonl`));
+    return parseJsonl(path69.join(this.projectDir, `${sessionId}.jsonl`));
   }
   async loadConversation(sessionId) {
     const messages = this.readConversation(sessionId);
@@ -27568,7 +27962,7 @@ var HistoryService = class _HistoryService {
     if (!filePath) return false;
     let mtimeMs;
     try {
-      mtimeMs = fs61.statSync(filePath).mtimeMs;
+      mtimeMs = fs64.statSync(filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -27643,10 +28037,10 @@ var HistoryService = class _HistoryService {
 
 // src/agents/acp/client.ts
 var import_node_child_process29 = require("child_process");
-var fs62 = __toESM(require("fs/promises"));
+var fs65 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
-var os53 = __toESM(require("os"));
-var path68 = __toESM(require("path"));
+var os54 = __toESM(require("os"));
+var path71 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -31672,19 +32066,19 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
 }
 
 // src/agents/acp/internal-paths.ts
-var path67 = __toESM(require("path"));
-var os52 = __toESM(require("os"));
+var path70 = __toESM(require("path"));
+var os53 = __toESM(require("os"));
 var INTERNAL_TOKENS = [".codeam", "house-claude"];
 function textReferencesInternal(text) {
   if (!text) return false;
   return INTERNAL_TOKENS.some((t2) => text.includes(t2));
 }
-function pathIsInternal(p2, homeDir2 = os52.homedir()) {
+function pathIsInternal(p2, homeDir2 = os53.homedir()) {
   if (!p2) return false;
-  const abs = path67.resolve(p2);
-  const home = path67.resolve(homeDir2);
-  const within = (root) => abs === root || abs.startsWith(root + path67.sep);
-  return within(path67.join(home, ".codeam")) || within(path67.join(home, ".beads")) || abs === path67.join(home, ".codeam-host.log") || abs.includes(`${path67.sep}house-claude${path67.sep}`) || abs.endsWith(`${path67.sep}house-claude`);
+  const abs = path70.resolve(p2);
+  const home = path70.resolve(homeDir2);
+  const within = (root) => abs === root || abs.startsWith(root + path70.sep);
+  return within(path70.join(home, ".codeam")) || within(path70.join(home, ".beads")) || abs === path70.join(home, ".codeam-host.log") || abs.includes(`${path70.sep}house-claude${path70.sep}`) || abs.endsWith(`${path70.sep}house-claude`);
 }
 function toolCallReferencesInternal(call) {
   if (textReferencesInternal(call.title)) return true;
@@ -32513,7 +32907,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          const content = await fs62.readFile(params.path, "utf8");
+          const content = await fs65.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
         } catch (err) {
           const code = err.code;
@@ -32536,7 +32930,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          await fs62.writeFile(params.path, params.content, "utf8");
+          await fs65.writeFile(params.path, params.content, "utf8");
           return {};
         } catch (err) {
           const code = err.code;
@@ -32596,29 +32990,29 @@ function applyLineRange(content, line, limit) {
   return { content: lines.slice(start2, end).join("\n") };
 }
 function knownAgentBinaryDirs() {
-  const home = os53.homedir();
+  const home = os54.homedir();
   const out2 = [];
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path68.join(home, ".nvm/versions/node")
+    path71.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path68.join(root, child, "bin"));
+        out2.push(path71.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path68.join(home, ".volta/bin"));
+  out2.push(path71.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path68.join(home, ".local/bin"));
-  out2.push(path68.join(home, "bin"));
+  out2.push(path71.join(home, ".local/bin"));
+  out2.push(path71.join(home, "bin"));
   if (process.platform === "win32") {
     const { LOCALAPPDATA, APPDATA } = process.env;
-    if (LOCALAPPDATA) out2.push(path68.join(LOCALAPPDATA, "cursor-agent"));
-    if (APPDATA) out2.push(path68.join(APPDATA, "npm"));
+    if (LOCALAPPDATA) out2.push(path71.join(LOCALAPPDATA, "cursor-agent"));
+    if (APPDATA) out2.push(path71.join(APPDATA, "npm"));
   }
   return out2.filter((p2) => {
     try {
@@ -32630,7 +33024,7 @@ function knownAgentBinaryDirs() {
 }
 function expandPathForAgentBinaries(existingPath) {
   const existing = new Set(
-    existingPath.split(path68.delimiter).filter((p2) => p2.length > 0)
+    existingPath.split(path71.delimiter).filter((p2) => p2.length > 0)
   );
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
@@ -32640,7 +33034,7 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path68.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path71.delimiter);
 }
 
 // src/agents/acp/headroom-budget-proxy.ts
@@ -33122,15 +33516,15 @@ function commonPrefixLength(a, b) {
 
 // src/agents/acp/onboarding.ts
 var import_child_process27 = require("child_process");
-var fs63 = __toESM(require("fs"));
-var os54 = __toESM(require("os"));
-var path69 = __toESM(require("path"));
+var fs66 = __toESM(require("fs"));
+var os55 = __toESM(require("os"));
+var path72 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path69.join(os54.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
-  exists: (p2) => fs63.existsSync(p2),
+  markerPath: (sessionId) => path72.join(os55.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  exists: (p2) => fs66.existsSync(p2),
   write: (p2) => {
-    fs63.mkdirSync(path69.dirname(p2), { recursive: true });
-    fs63.writeFileSync(p2, "");
+    fs66.mkdirSync(path72.dirname(p2), { recursive: true });
+    fs66.writeFileSync(p2, "");
   },
   disabled: () => {
     const v = process.env.CODEAM_ONBOARDING_DISABLED;
@@ -33167,7 +33561,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path69.basename(cwd || "");
+  const base = path72.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -33425,13 +33819,13 @@ var import_crypto5 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process28 = require("child_process");
-var fs65 = __toESM(require("fs/promises"));
-var path71 = __toESM(require("path"));
+var fs68 = __toESM(require("fs/promises"));
+var path74 = __toESM(require("path"));
 
 // src/services/turn-files/review-ignore.ts
 var import_ignore2 = __toESM(require("ignore"));
-var fs64 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
+var fs67 = __toESM(require("fs"));
+var path73 = __toESM(require("path"));
 var CURATED_REVIEW_IGNORE = [
   // Google Cloud SDK (the incident) — installs a huge python tree.
   "google-cloud-sdk/",
@@ -33470,7 +33864,7 @@ var CURATED_REVIEW_IGNORE = [
 function makeReviewIgnore(repoRoot) {
   const ig = (0, import_ignore2.default)().add(CURATED_REVIEW_IGNORE);
   try {
-    const custom = fs64.readFileSync(path70.join(repoRoot, ".codeam", "reviewignore"), "utf8");
+    const custom = fs67.readFileSync(path73.join(repoRoot, ".codeam", "reviewignore"), "utf8");
     ig.add(custom);
   } catch {
   }
@@ -33515,7 +33909,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (!truncated && row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path71.join(opts.repoRoot, row.filePath)
+        path74.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -33546,7 +33940,7 @@ function readUntrackedLineCount(absPath) {
 }
 async function defaultReadUntrackedLineCount(absPath) {
   try {
-    const content = await fs65.readFile(absPath, "utf8");
+    const content = await fs68.readFile(absPath, "utf8");
     let count = 0;
     let pos = -1;
     while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
@@ -33638,7 +34032,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs72 = await import("fs/promises");
+  const fs75 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -33646,7 +34040,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs72.readdir(dir, { withFileTypes: true });
+      const dirents = await fs75.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -33657,8 +34051,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path71.relative(workingDir, dir),
-        repoName: path71.basename(dir)
+        repoPath: path74.relative(workingDir, dir),
+        repoName: path74.basename(dir)
       });
       return;
     }
@@ -33666,14 +34060,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path71.join(dir, entry.name), depth + 1);
+      await walk(path74.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs66 = __toESM(require("fs/promises"));
-var path72 = __toESM(require("path"));
+var fs69 = __toESM(require("fs/promises"));
+var path75 = __toESM(require("path"));
 var import_os12 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -33706,16 +34100,16 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path72.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path72.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path75.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path75.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs66.mkdir(path72.dirname(this.filePath), { recursive: true });
-    await fs66.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs69.mkdir(path75.dirname(this.filePath), { recursive: true });
+    await fs69.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -33806,7 +34200,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs66.readFile(this.filePath, "utf8");
+      raw = await fs69.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -33830,12 +34224,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs66.unlink(this.filePath).catch(() => void 0);
+      await fs69.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs66.writeFile(tmpPath, payload, "utf8");
-    await fs66.rename(tmpPath, this.filePath);
+    await fs69.writeFile(tmpPath, payload, "utf8");
+    await fs69.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -34580,11 +34974,13 @@ async function startTaskH(ctx) {
   }
   await streaming.beginTurn();
   history.appendUserPrompt(promptText);
+  let turnClosed = false;
   try {
     const reply = await client3.prompt(blocks);
     const finalText = streaming.getCurrentText();
     if (agentHooks(opts.agent)?.classifyCompletedReply?.(finalText) === "upgrade_required") {
       await streaming.closeWithBubble(CURSOR_UPGRADE_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(CURSOR_UPGRADE_MESSAGE);
       void history.flush();
       log.info("acpRunner", `start_task \u2190 cursor-plan-upgrade-required id=${cmd.id.slice(0, 8)}`);
@@ -34592,6 +34988,7 @@ async function startTaskH(ctx) {
     } else if (replyIsHouseAgentLimit(finalText)) {
       const houseBubble = houseAgentLimitMessage(finalText);
       await streaming.closeWithBubble(houseBubble);
+      turnClosed = true;
       history.appendAgentReply(houseBubble);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34603,6 +35000,7 @@ async function startTaskH(ctx) {
       });
     } else if (replyIsAuthFailure(finalText)) {
       await streaming.closeWithBubble(AUTH_FAILURE_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(AUTH_FAILURE_MESSAGE);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34613,6 +35011,7 @@ async function startTaskH(ctx) {
       await relay.sendResult(cmd.id, "failed", { error: "agent reply reported auth failure" });
     } else if (shouldOfferOneMRecovery({ detail: "", recentStderr: recentStderr.join("\n"), finalText })) {
       await streaming.closeWithBubble(ONE_M_CREDITS_MESSAGE);
+      turnClosed = true;
       history.appendAgentReply(ONE_M_CREDITS_MESSAGE);
       void history.flush();
       turnFiles.flushTurn().catch((err) => {
@@ -34625,6 +35024,7 @@ async function startTaskH(ctx) {
       });
     } else {
       await streaming.closeTurnWithInteractiveDetection();
+      turnClosed = true;
       const replyLine = formatAgentReplyLine(finalText);
       if (replyLine.length > 0) {
         showInfo(replyLine);
@@ -34643,6 +35043,13 @@ async function startTaskH(ctx) {
       await relay.sendResult(cmd.id, "completed", { stopReason: reply.stopReason });
     }
   } catch (err) {
+    if (turnClosed) {
+      log.warn(
+        "acpRunner",
+        `post-close ack failed (turn already delivered) id=${cmd.id.slice(0, 8)}: ${describeError(err)}`
+      );
+      return;
+    }
     const hadText = streaming.hasVisibleProgress();
     const detail = describeError(err);
     log.warn("acpRunner", `prompt failed: ${detail}`);
@@ -37080,9 +37487,9 @@ function startClaudeCredentialSync(opts) {
 }
 
 // src/beads/workflow-hint.ts
-var fs68 = __toESM(require("fs"));
-var path74 = __toESM(require("path"));
-var os55 = __toESM(require("os"));
+var fs71 = __toESM(require("fs"));
+var path77 = __toESM(require("path"));
+var os56 = __toESM(require("os"));
 var BEADS_HINT_MARKER = "<!-- codeam:beads-workflow -->";
 var BEADS_HINT = `${BEADS_HINT_MARKER}
 # Beads (bd) \u2014 task tracking + persistent memory (ALWAYS use it)
@@ -37096,22 +37503,22 @@ This environment uses **bd (beads)** for issue/task tracking and persistent memo
 - \`bd ready\` (available work) \xB7 \`bd show <id>\` \xB7 \`bd update <id> --claim\` \xB7 \`bd close <id>\`.
 - Use \`bd remember "..."\` for persistent knowledge \u2014 do NOT use MEMORY.md files.
 ${BEADS_HINT_MARKER}`;
-function ensureBeadsWorkflowHint(homeDir2 = os55.homedir()) {
+function ensureBeadsWorkflowHint(homeDir2 = os56.homedir()) {
   try {
-    const file = path74.join(homeDir2, ".claude", "CLAUDE.md");
+    const file = path77.join(homeDir2, ".claude", "CLAUDE.md");
     let existing = "";
     try {
-      existing = fs68.readFileSync(file, "utf8");
+      existing = fs71.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT_MARKER)) return;
-    fs68.mkdirSync(path74.dirname(file), { recursive: true });
+    fs71.mkdirSync(path77.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${BEADS_HINT}
 ` : `${BEADS_HINT}
 `;
-    fs68.writeFileSync(file, next);
+    fs71.writeFileSync(file, next);
   } catch {
   }
 }
@@ -37483,7 +37890,7 @@ var AcpDriver = class {
 };
 
 // src/baton/transcript-mirror.ts
-var fs69 = __toESM(require("fs"));
+var fs72 = __toESM(require("fs"));
 var TranscriptMirror = class {
   constructor(deps) {
     this.deps = deps;
@@ -37550,7 +37957,7 @@ var TranscriptMirror = class {
   }
 };
 function defaultWatch(file, onChange) {
-  const w3 = fs69.watch(file, { persistent: false }, () => onChange());
+  const w3 = fs72.watch(file, { persistent: false }, () => onChange());
   return () => w3.close();
 }
 
@@ -37812,16 +38219,16 @@ function toEpochMs(ts) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs70 = __toESM(require("fs"));
-var os57 = __toESM(require("os"));
-var path75 = __toESM(require("path"));
+var fs73 = __toESM(require("fs"));
+var os58 = __toESM(require("os"));
+var path78 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path75.join(os57.homedir(), ".claude.json");
+    const file = path78.join(os58.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs70.readFileSync(file, "utf8"));
+      config = JSON.parse(fs73.readFileSync(file, "utf8"));
     } catch {
     }
     let changed = false;
@@ -37846,8 +38253,8 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs70.mkdirSync(path75.dirname(file), { recursive: true });
-    fs70.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs73.mkdirSync(path78.dirname(file), { recursive: true });
+    fs73.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
       `pre-completed Claude onboarding${cwd ? ` + trusted workspace ${cwd}` : ""}`
@@ -38574,7 +38981,7 @@ var import_picocolors11 = __toESM(require("picocolors"));
 var import_child_process29 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors9 = __toESM(require("picocolors"));
-var path76 = __toESM(require("path"));
+var path79 = __toESM(require("path"));
 var execFileP6 = (0, import_util4.promisify)(import_child_process29.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -39063,7 +39470,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path76.posix.dirname(remotePath);
+    const remoteDir = path79.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -39133,7 +39540,7 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process30 = require("child_process");
 var import_util5 = require("util");
-var path77 = __toESM(require("path"));
+var path80 = __toESM(require("path"));
 var import_picocolors10 = __toESM(require("picocolors"));
 var execFileP7 = (0, import_util5.promisify)(import_child_process30.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
@@ -39373,7 +39780,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path77.posix.dirname(remotePath);
+    const remoteDir = path80.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -39409,7 +39816,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process31 = require("child_process");
 var import_util6 = require("util");
-var path78 = __toESM(require("path"));
+var path81 = __toESM(require("path"));
 var execFileP8 = (0, import_util6.promisify)(import_child_process31.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -39669,7 +40076,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path78.posix.dirname(remotePath);
+    const remoteDir = path81.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -39737,7 +40144,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process32 = require("child_process");
 var import_util7 = require("util");
-var path79 = __toESM(require("path"));
+var path82 = __toESM(require("path"));
 var execFileP9 = (0, import_util7.promisify)(import_child_process32.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -39973,7 +40380,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path79.posix.dirname(remotePath);
+    const remoteDir = path82.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -40619,8 +41026,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util5 = require("util");
 var import_node_crypto13 = require("crypto");
-var fs71 = __toESM(require("fs"));
-var path80 = __toESM(require("path"));
+var fs74 = __toESM(require("fs"));
+var path83 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util5.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -40676,13 +41083,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path80.join(require("os").homedir(), ".codeam");
+  const dir = path83.join(require("os").homedir(), ".codeam");
   try {
-    fs71.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path80.join(dir, ".doctor-probe");
-    fs71.writeFileSync(probe, "ok", { mode: 384 });
-    const read2 = fs71.readFileSync(probe, "utf8");
-    fs71.unlinkSync(probe);
+    fs74.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path83.join(dir, ".doctor-probe");
+    fs74.writeFileSync(probe, "ok", { mode: 384 });
+    const read2 = fs74.readFileSync(probe, "utf8");
+    fs74.unlinkSync(probe);
     if (read2 !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -40722,9 +41129,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os60 = createOsStrategy();
+  const os61 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os60.findInPath(meta.binaryName);
+    const found = os61.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -40746,7 +41153,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path80.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path83.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -40788,7 +41195,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.81" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.83" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -41378,7 +41785,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.81" : "unknown";
+  const v = true ? "2.61.83" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -41527,10 +41934,10 @@ var EXIT_CODE_NAMES = {
 };
 
 // src/index.ts
-var os59 = __toESM(require("os"));
+var os60 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os59.homedir();
+    const home = os60.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }