codeam-cli 2.75.25 → 2.75.27

package/dist/index.js

@@ -357,8 +357,8 @@ function defaultSpawn(timeoutMs) {
   });
 }
 function resolveConvexBin(cwd) {
-  const local = path94.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
-  if (fs80.existsSync(local)) return { cmd: local, args: [] };
+  const local = path95.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
+  if (fs81.existsSync(local)) return { cmd: local, args: [] };
   return { cmd: "npx", args: ["--yes", "convex"] };
 }
 function redact(text, key) {
@@ -489,13 +489,13 @@ async function runConvexAdminMcp(client3, id) {
   });
   await server.connect(new StdioServerTransport());
 }
-var import_node_child_process32, fs80, path94, TOOLS;
+var import_node_child_process32, fs81, path95, TOOLS;
 var init_convex_admin_mcp = __esm({
   "src/integrations/convex-admin-mcp.ts"() {
     "use strict";
     import_node_child_process32 = require("child_process");
-    fs80 = __toESM(require("fs"));
-    path94 = __toESM(require("path"));
+    fs81 = __toESM(require("fs"));
+    path95 = __toESM(require("path"));
     TOOLS = [
       {
         name: "tables",
@@ -3248,6 +3248,9 @@ var USER_EVENTS = {
   PREVIEW_STOPPED: "preview_stopped",
   PREVIEW_ERROR: "preview_error",
   PREVIEW_PROGRESS: "preview_progress",
+  /** The agent points at an element of the running preview (`highlight_element`
+   *  MCP tool) — the inspector client draws the agent's mark over it. */
+  PREVIEW_AGENT_HIGHLIGHT: "preview_agent_highlight",
   BEADS_STATE_CHANGED: "beads_state_changed",
   BEADS_PROVISIONING: "beads_provisioning",
   BEADS_TEAM_MEMORY_CHANGED: "beads_team_memory_changed",
@@ -3428,6 +3431,9 @@ function maybeRotate() {
   } catch {
     return;
   }
+  rotateNow();
+}
+function rotateNow() {
   const archivePath = (n) => n === 0 ? `${debugFilePath}.old` : `${debugFilePath}.${n}`;
   for (let i = MAX_ARCHIVES - 1; i >= 0; i--) {
     const src = archivePath(i);
@@ -3451,6 +3457,7 @@ function appendToFile(line) {
   try {
     if (!fileInitialized) {
       fs.mkdirSync(path.dirname(debugFilePath), { recursive: true, mode: 448 });
+      if (fs.existsSync(debugFilePath)) rotateNow();
       const header = jsonMode ? `${JSON.stringify({
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         level: "info",
@@ -3525,11 +3532,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path96) {
+function rmIfExistsQuiet(path97) {
   try {
-    fs2.rmSync(path96, { force: true });
+    fs2.rmSync(path97, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path96}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path97}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -3733,8 +3740,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path96) {
-  return path96.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path97) {
+  return path97.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/error-tracking/index.mjs
@@ -6467,13 +6474,13 @@ var PostHogCoreStateless = class {
       sentFromRoute += batchMessages.length;
     }
   }
-  async _sendOtlpBatch({ path: path96, payload }) {
+  async _sendOtlpBatch({ path: path97, payload }) {
     if (this.disabled) return {
       kind: "fatal",
       error: new Error("The client is disabled")
     };
     const serialized = JSON.stringify(payload);
-    const url2 = `${this.host}/i/v1/${path96}?token=${encodeURIComponent(this.apiKey)}`;
+    const url2 = `${this.host}/i/v1/${path97}?token=${encodeURIComponent(this.apiKey)}`;
     const gzippedPayload = this.disableCompression ? null : await this.compressPayload(serialized);
     const fetchOptions = {
       method: "POST",
@@ -7713,14 +7720,14 @@ async function addSourceContext(frames, openSourceFile = import_promises.open, l
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-async function openRegularSourceFile(path96, openSourceFile, logger) {
+async function openRegularSourceFile(path97, openSourceFile, logger) {
   let fileHandle;
   let isValid = false;
   try {
-    fileHandle = await openSourceFile(path96, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
+    fileHandle = await openSourceFile(path97, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
     const fileStat = await fileHandle.stat();
     if (!fileStat.isFile()) return;
-    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path96}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
+    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path97}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
     isValid = true;
     return fileHandle;
   } catch {
@@ -7730,8 +7737,8 @@ async function openRegularSourceFile(path96, openSourceFile, logger) {
     });
   }
 }
-async function getContextLinesFromFile(path96, ranges, output, cacheKey, openSourceFile, logger) {
-  const fileHandle = await openRegularSourceFile(path96, openSourceFile, logger);
+async function getContextLinesFromFile(path97, ranges, output, cacheKey, openSourceFile, logger) {
+  const fileHandle = await openRegularSourceFile(path97, openSourceFile, logger);
   if (void 0 === fileHandle) return void LRU_FILE_CONTENTS_FS_READ_FAILED.set(cacheKey, 1);
   const openedFileHandle = fileHandle;
   return new Promise((resolve12) => {
@@ -7833,22 +7840,22 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path96) {
-  return path96.startsWith("node:") || path96.endsWith(".min.js") || path96.endsWith(".min.cjs") || path96.endsWith(".min.mjs") || path96.startsWith("data:");
+function shouldSkipContextLinesForFile(path97) {
+  return path97.startsWith("node:") || path97.endsWith(".min.js") || path97.endsWith(".min.cjs") || path97.endsWith(".min.mjs") || path97.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
   if (void 0 !== frame.colno && frame.colno > MAX_CONTEXTLINES_COLNO) return true;
   return false;
 }
-function makeSourceCacheKey(path96, basePath) {
-  if ((0, import_node_path.isAbsolute)(path96)) return JSON.stringify([
+function makeSourceCacheKey(path97, basePath) {
+  if ((0, import_node_path.isAbsolute)(path97)) return JSON.stringify([
     null,
-    path96
+    path97
   ]);
   return void 0 === basePath ? void 0 : JSON.stringify([
     basePath,
-    path96
+    path97
   ]);
 }
 function rangeExistsInContentCache(cacheKey, range) {
@@ -10509,7 +10516,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.25" : "0.0.0-dev",
+    cliVersion: true ? "2.75.27" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10751,7 +10758,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.25",
+  version: "2.75.27",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12081,7 +12088,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.25" ? { ideVersion: "2.75.25" } : {}
+      ..."2.75.27" ? { ideVersion: "2.75.27" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -12387,10 +12394,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir51) {
+function isUnsafeWindowsWatchRoot(dir, homedir52) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir51);
+  const home = norm(homedir52);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -17120,10 +17127,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os65 = createOsStrategy()) {
-  const found = os65.findInPath("claude") ?? os65.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os66 = createOsStrategy()) {
+  const found = os66.findInPath("claude") ?? os66.findInPath("claude-code");
   if (!found) return null;
-  return os65.buildLaunch(found, extraArgs);
+  return os66.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -17901,8 +17908,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -18996,8 +19003,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os65 = createOsStrategy();
-      return os65.findInPath("codex") !== null;
+      const os66 = createOsStrategy();
+      return os66.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process3.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -19020,8 +19027,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -19131,12 +19138,12 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os65) {
-  return os65.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os66) {
+  return os66.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os65) {
+async function installCodexViaNpm(os66) {
   return new Promise((resolve12, reject) => {
-    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os65), ["install", "-g", "@openai/codex"], {
+    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os66), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -19153,16 +19160,16 @@ async function installCodexViaNpm(os65) {
     });
   });
 }
-function augmentNpmGlobalBin(os65) {
+function augmentNpmGlobalBin(os66) {
   try {
-    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os65), ["prefix", "-g"], {
+    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os66), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os65.id === "win32" ? prefix : path24.join(prefix, "bin");
-    os65.augmentPath([binDir]);
+    const binDir = os66.id === "win32" ? prefix : path24.join(prefix, "bin");
+    os66.augmentPath([binDir]);
   } catch {
   }
 }
@@ -19356,10 +19363,10 @@ function manualInstallHint(runner, tools) {
   const argv = osPackageInstallArgv(detectPackageManager(runner), [...tools]);
   return argv ? `\`sudo ${argv.join(" ")}\`` : `your package manager (e.g. \`${pkgs}\`)`;
 }
-function writeUnzipShim(os65, runner) {
+function writeUnzipShim(os66, runner) {
   const python = ["python3", "python"].find((p2) => runner.which(p2));
   if (!python) return null;
-  const dir = os65.scratchPath("codeam-cr-prereq");
+  const dir = os66.scratchPath("codeam-cr-prereq");
   const shim = path26.join(dir, "unzip");
   const script = `#!/bin/sh
 set -e
@@ -19381,9 +19388,9 @@ exec ${python} -m zipfile -e "$archive" "$dest"
   (0, import_node_fs5.chmodSync)(shim, 448);
   return dir;
 }
-async function ensureInstallPrerequisites(os65, deps = {}) {
+async function ensureInstallPrerequisites(os66, deps = {}) {
   const runner = deps.runner ?? defaultOsRunner;
-  const missing = REQUIRED_TOOLS.filter((t2) => os65.findInPath(t2) === null);
+  const missing = REQUIRED_TOOLS.filter((t2) => os66.findInPath(t2) === null);
   if (missing.length === 0) return { ok: true, extraPath: [] };
   log.info(
     "coderabbit",
@@ -19402,10 +19409,10 @@ async function ensureInstallPrerequisites(os65, deps = {}) {
       );
     }
   }
-  const stillMissing = REQUIRED_TOOLS.filter((t2) => os65.findInPath(t2) === null);
+  const stillMissing = REQUIRED_TOOLS.filter((t2) => os66.findInPath(t2) === null);
   if (stillMissing.length === 0) return { ok: true, extraPath: [] };
   if (stillMissing.length === 1 && stillMissing[0] === "unzip") {
-    const shimDir = writeUnzipShim(os65, runner);
+    const shimDir = writeUnzipShim(os66, runner);
     if (shimDir) {
       log.info("coderabbit", "unzip is unavailable \u2014 using a scoped python zipfile shim");
       return { ok: true, extraPath: [shimDir] };
@@ -19468,15 +19475,15 @@ function summarizeInstallFailure(output) {
   }
   return lines.length > 0 ? lines[lines.length - 1] : null;
 }
-async function ensureCoderabbitInstalled(os65, deps = {}) {
-  if (os65.findInPath("coderabbit")) return { ok: true };
-  if (os65.id === "win32") {
+async function ensureCoderabbitInstalled(os66, deps = {}) {
+  if (os66.findInPath("coderabbit")) return { ok: true };
+  if (os66.id === "win32") {
     return {
       ok: false,
       error: "CodeRabbit on Windows requires WSL. Install the CLI inside your WSL distribution (curl -fsSL https://cli.coderabbit.ai/install.sh | sh), then try again."
     };
   }
-  const prereq = await ensureInstallPrerequisites(os65, deps);
+  const prereq = await ensureInstallPrerequisites(os66, deps);
   if (!prereq.ok) return { ok: false, error: prereq.error };
   const env = { ...process.env };
   if (prereq.extraPath.length > 0) {
@@ -19485,8 +19492,8 @@ async function ensureCoderabbitInstalled(os65, deps = {}) {
   log.info("coderabbit", "CodeRabbit CLI not found \u2014 installing via the official script");
   const run = deps.runInstallScript ?? defaultRunInstallScript;
   const { code, output } = await run(env);
-  os65.augmentPath([`${os65.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  const binary = os65.findInPath("coderabbit");
+  os66.augmentPath([`${os66.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  const binary = os66.findInPath("coderabbit");
   const detail = summarizeInstallFailure(output);
   if (binary !== null) {
     if (code === 0) return { ok: true };
@@ -19540,10 +19547,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os65) {
+function coderabbitLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      const result = await ensureCoderabbitInstalled(os65);
+      const result = await ensureCoderabbitInstalled(os66);
       if (!result.ok && result.error) console.error(`
   \u2717 ${result.error}
 `);
@@ -19603,8 +19610,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path96 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path96) return null;
+  const path97 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path97) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -19621,7 +19628,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path96.trim(),
+    path: path97.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -19704,10 +19711,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path96, lineNo, sevToken, message] = m;
-    if (!path96 || !lineNo || !message) continue;
+    const [, path97, lineNo, sevToken, message] = m;
+    if (!path97 || !lineNo || !message) continue;
     hunks.push({
-      path: path96.trim(),
+      path: path97.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -19767,8 +19774,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -20039,10 +20046,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os65) {
+function cursorLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      if (os65.findInPath("cursor-agent")) return true;
+      if (os66.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -20106,8 +20113,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -20324,10 +20331,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os65) {
+function aiderLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      if (os65.findInPath("aider")) return true;
+      if (os66.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -20337,7 +20344,7 @@ function aiderLoginLauncher(os65) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process11.spawn)(os65.id === "win32" ? "cmd.exe" : "sh", os65.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process11.spawn)(os66.id === "win32" ? "cmd.exe" : "sh", os66.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -20426,14 +20433,14 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync28 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync30 = deps.existsSync ?? import_fs.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
   const scopeDir = import_path4.default.dirname(sdkDir);
   const binName = platformKey.startsWith("win32-") ? "claude.exe" : "claude";
   const candidate = import_path4.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
-  return existsSync28(candidate) ? candidate : null;
+  return existsSync30(candidate) ? candidate : null;
 }
 var realSleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
 async function waitForClaudeNativeBinary(opts = {}) {
@@ -20515,18 +20522,18 @@ function augmentUserLocalBinPaths(deps = {}) {
   env.PATH = [...additions, ...parts].join(p2.delimiter);
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync28 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync30 = deps.existsSync ?? import_fs.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
     const localAppData = env.LOCALAPPDATA;
     if (!localAppData) return null;
     const exe = import_path4.default.win32.join(localAppData, "cursor-agent", "cursor-agent.exe");
-    return existsSync28(exe) ? exe : null;
+    return existsSync30(exe) ? exe : null;
   }
   const home = deps.homedir ?? import_os4.default.homedir();
   const unix = import_path4.default.posix.join(home, ".local", "bin", "cursor-agent");
-  return existsSync28(unix) ? unix : null;
+  return existsSync30(unix) ? unix : null;
 }
 async function waitForCursorAgent(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
@@ -20612,8 +20619,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     augmentUserLocalBinPaths();
@@ -20746,8 +20753,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os65 = createOsStrategy();
-      return os65.findInPath("gemini") !== null;
+      const os66 = createOsStrategy();
+      return os66.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process12.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -20937,8 +20944,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -21230,8 +21237,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -21374,8 +21381,8 @@ var OpencodeRuntimeStrategy = class {
   meta = getAgent("opencode");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("opencode");
@@ -21460,20 +21467,20 @@ var OpencodeRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os65) => new ClaudeRuntimeStrategy(os65),
-  codex: (os65) => new CodexRuntimeStrategy(os65),
-  coderabbit: (os65) => new CoderabbitRuntimeStrategy(os65),
-  cursor: (os65) => new CursorRuntimeStrategy(os65),
-  aider: (os65) => new AiderRuntimeStrategy(os65),
-  gemini: (os65) => new GeminiRuntimeStrategy(os65),
-  kimi: (os65) => new KimiRuntimeStrategy(os65),
-  opencode: (os65) => new OpencodeRuntimeStrategy(os65)
+  claude: (os66) => new ClaudeRuntimeStrategy(os66),
+  codex: (os66) => new CodexRuntimeStrategy(os66),
+  coderabbit: (os66) => new CoderabbitRuntimeStrategy(os66),
+  cursor: (os66) => new CursorRuntimeStrategy(os66),
+  aider: (os66) => new AiderRuntimeStrategy(os66),
+  gemini: (os66) => new GeminiRuntimeStrategy(os66),
+  kimi: (os66) => new KimiRuntimeStrategy(os66),
+  opencode: (os66) => new OpencodeRuntimeStrategy(os66)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os65 = createOsStrategy()) {
+function createAgentStrategy(agent, os66 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -21483,10 +21490,10 @@ function createAgentStrategy(agent, os65 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os65);
+  return build(os66);
 }
-function createInteractiveAgentStrategy(agent, os65 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os65);
+function createInteractiveAgentStrategy(agent, os66 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os66);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -22196,8 +22203,8 @@ function collectChangedFiles(cwd) {
   }
   return [...byPath.values()];
 }
-function restoreCoderabbitOauthBlob(os65, value) {
-  const dir = path38.join(os65.homeDir(), ".coderabbit");
+function restoreCoderabbitOauthBlob(os66, value) {
+  const dir = path38.join(os66.homeDir(), ".coderabbit");
   (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
   let file = "auth.json";
   let contents = value.trim();
@@ -22217,26 +22224,26 @@ function installFailureMessage(result) {
   return result.error ?? "CodeRabbit CLI could not be installed";
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os65 = deps.os ?? createOsStrategy();
+  const os66 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os65.homeDir();
-  os65.augmentPath(
-    os65.id === "win32" ? [
+  const home = os66.homeDir();
+  os66.augmentPath(
+    os66.id === "win32" ? [
       path38.join(home, ".local", "bin"),
       path38.join(process.env.APPDATA ?? path38.join(home, "AppData", "Roaming"), "npm"),
       path38.join(home, "scoop", "shims")
     ] : [path38.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os65.findInPath("coderabbit") !== null;
+  const installed2 = os66.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os65.findInPath("coderabbit") !== null,
+    installed: os66.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -22250,7 +22257,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22274,7 +22281,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22291,7 +22298,7 @@ async function configureCoderabbit(input, deps = {}) {
       return { ...res2, loggedIn: true, linked: true };
     }
     try {
-      restoreCoderabbitOauthBlob(os65, cred.credential);
+      restoreCoderabbitOauthBlob(os66, cred.credential);
     } catch (err) {
       return {
         ...res2,
@@ -22315,7 +22322,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22355,7 +22362,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const inst = await ensureInstalled(os65);
+    const inst = await ensureInstalled(os66);
     res.installed = inst.ok;
     if (!inst.ok) return { ...res, error: installFailureMessage(inst) };
   }
@@ -24628,6 +24635,145 @@ function inspectorClientSource(opts) {
       redrawMarks();
     }
 
+    /**
+     * Las marcas del AGENTE \u2014 la herramienta highlight_element.
+     *
+     * Van aparte de las del usuario a proposito: no se numeran, no se pueden
+     * borrar desde el composer y no dependen de que el modo inspector este
+     * encendido. Son el agente SE\xD1ALANDO algo, y el usuario las ve aunque no
+     * haya tocado nada: un cursor que viaja hasta el elemento, lo centra en
+     * pantalla y deja una caja con su etiqueta.
+     *
+     * Mismo anclaje que las marcas fijadas (coordenadas de documento), asi que
+     * acompa\xF1an al scroll. Un selector que no encuentra nada no pinta nada: el
+     * agente ya sabe por la herramienta que puede fallar.
+     */
+    var AGENT = '#22d3ee';
+    var agentMarks = [];
+    var agentHost = null;
+    var agentCursor = null;
+    var agentStyle = null;
+    var agentListening = false;
+
+    function ensureAgentStyle() {
+      if (agentStyle && agentStyle.parentNode) return;
+      agentStyle = document.createElement('style');
+      agentStyle.setAttribute('data-codeam', 'agent-style');
+      agentStyle.textContent =
+        '@keyframes codeam-agent-pulse{0%{box-shadow:0 0 0 0 rgba(34,211,238,.55)}' +
+        '70%{box-shadow:0 0 0 10px rgba(34,211,238,0)}100%{box-shadow:0 0 0 0 rgba(34,211,238,0)}}' +
+        '@keyframes codeam-agent-in{from{opacity:0;transform:scale(1.06)}to{opacity:1;transform:scale(1)}}';
+      (document.head || document.documentElement).appendChild(agentStyle);
+    }
+
+    function ensureAgentCursor() {
+      if (agentCursor && agentCursor.parentNode) return agentCursor;
+      agentCursor = document.createElement('div');
+      agentCursor.setAttribute('data-codeam', 'agent-cursor');
+      agentCursor.style.cssText = [
+        'position:fixed', 'pointer-events:none', 'z-index:2147483647',
+        'left:' + Math.round(window.innerWidth / 2) + 'px', 'top:' + Math.round(window.innerHeight - 40) + 'px',
+        'transition:left .6s cubic-bezier(.22,1,.36,1),top .6s cubic-bezier(.22,1,.36,1),opacity .3s',
+        'opacity:0'
+      ].join(';');
+      agentCursor.innerHTML =
+        '<svg width="22" height="22" viewBox="0 0 24 24" style="display:block;filter:drop-shadow(0 1px 2px rgba(0,0,0,.5))">' +
+        '<path d="M4 2l15 8.5-6.6 1.6L9 18.5z" fill="' + AGENT + '" stroke="#000" stroke-width="1.2"/></svg>' +
+        '<div style="margin:2px 0 0 14px;background:' + AGENT + ';color:#000;font:700 10px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;' +
+        'padding:1px 6px;border-radius:8px;white-space:nowrap">Agent</div>';
+      document.body.appendChild(agentCursor);
+      return agentCursor;
+    }
+
+    function redrawAgentMarks() {
+      if (agentMarks.length === 0) {
+        if (agentHost && agentHost.parentNode) agentHost.parentNode.removeChild(agentHost);
+        agentHost = null;
+        return;
+      }
+      if (!agentHost || !agentHost.parentNode) {
+        agentHost = document.createElement('div');
+        agentHost.setAttribute('data-codeam', 'agent-marks');
+        agentHost.style.cssText = 'position:absolute;left:0;top:0;width:0;height:0;z-index:2147483646';
+        document.body.appendChild(agentHost);
+      }
+      agentHost.innerHTML = '';
+      var sx = window.scrollX || window.pageXOffset || 0;
+      var sy = window.scrollY || window.pageYOffset || 0;
+      for (var i = 0; i < agentMarks.length; i++) {
+        var m = agentMarks[i];
+        if (!m.el.isConnected) continue;
+        var r = m.el.getBoundingClientRect();
+        var box = document.createElement('div');
+        box.setAttribute('data-codeam', 'agent-mark');
+        box.style.cssText = [
+          'position:absolute', 'pointer-events:none', 'box-sizing:border-box',
+          'border:2px solid ' + AGENT, 'background:rgba(34,211,238,0.10)', 'border-radius:4px',
+          'left:' + (r.left + sx - 3) + 'px', 'top:' + (r.top + sy - 3) + 'px',
+          'width:' + (r.width + 6) + 'px', 'height:' + (r.height + 6) + 'px',
+          'animation:codeam-agent-in .25s ease-out,codeam-agent-pulse 1.6s ease-out 3'
+        ].join(';');
+        if (m.label) {
+          var tag = document.createElement('div');
+          tag.setAttribute('data-codeam', 'agent-mark-label');
+          tag.style.cssText = [
+            'position:absolute', 'left:-2px', (r.top >= 22 ? 'top:-22px' : 'bottom:-22px'),
+            'background:' + AGENT, 'color:#000', 'font:700 11px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace',
+            'padding:0 6px', 'border-radius:3px', 'white-space:nowrap', 'max-width:260px',
+            'overflow:hidden', 'text-overflow:ellipsis'
+          ].join(';');
+          tag.textContent = m.label;
+          box.appendChild(tag);
+        }
+        agentHost.appendChild(box);
+      }
+    }
+
+    function listenAgentLayout() {
+      if (agentListening) return;
+      agentListening = true;
+      window.addEventListener('scroll', redrawAgentMarks, true);
+      window.addEventListener('resize', redrawAgentMarks);
+    }
+
+    function agentHighlight(selector, labelText) {
+      var el = null;
+      try { el = document.querySelector(String(selector)); } catch (e) { el = null; }
+      if (!el || !el.getBoundingClientRect) return false;
+      ensureAgentStyle();
+      listenAgentLayout();
+      try { el.scrollIntoView({ block: 'center', inline: 'nearest', behavior: 'smooth' }); } catch (e) { /* viejo */ }
+      var cursor = ensureAgentCursor();
+      // Tras el scroll suave: el cursor viaja al centro del elemento y, al
+      // llegar, aparece la caja. El orden es lo que se lee como \xABel agente
+      // lo esta se\xF1alando\xBB y no como un recuadro que salta.
+      setTimeout(function () {
+        var r = el.getBoundingClientRect();
+        cursor.style.opacity = '1';
+        cursor.style.left = Math.round(r.left + Math.min(r.width / 2, 40)) + 'px';
+        cursor.style.top = Math.round(r.top + Math.min(r.height / 2, 24)) + 'px';
+        setTimeout(function () {
+          agentMarks.push({ el: el, label: labelText ? String(labelText).slice(0, 80) : '' });
+          redrawAgentMarks();
+        }, 620);
+      }, 380);
+      return true;
+    }
+
+    function agentClear() {
+      agentMarks = [];
+      redrawAgentMarks();
+      if (agentCursor && agentCursor.parentNode) agentCursor.parentNode.removeChild(agentCursor);
+      agentCursor = null;
+      if (agentStyle && agentStyle.parentNode) agentStyle.parentNode.removeChild(agentStyle);
+      agentStyle = null;
+      if (agentListening) {
+        window.removeEventListener('scroll', redrawAgentMarks, true);
+        window.removeEventListener('resize', redrawAgentMarks);
+        agentListening = false;
+      }
+    }
+
     function enable(origin) {
       if (enabled) return;
       enabled = true;
@@ -24661,6 +24807,8 @@ function inspectorClientSource(opts) {
       if (data.type === 'enable') enable(e.origin);
       else if (data.type === 'disable') disable();
       else if (data.type === 'marks' && data.ids) syncMarks(data.ids);
+      else if (data.type === 'agent-highlight' && data.selector) agentHighlight(data.selector, data.label);
+      else if (data.type === 'agent-clear') agentClear();
     });
 
     /**
@@ -24679,6 +24827,11 @@ function inspectorClientSource(opts) {
       window.__codeamInspector = {
         enable: function () { enable('react-native'); },
         disable: disable,
+        // La app movil ya llamaba \`marks\` al borrar un chip y no existia:
+        // la marca se quedaba pintada en la pagina.
+        marks: function (ids) { if (ids && ids.length !== undefined) syncMarks(ids); },
+        highlight: function (selector, text) { return agentHighlight(selector, text); },
+        clear: agentClear,
       };
     }
   } catch (e) {
@@ -25518,11 +25671,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os65 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os66 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os65 === "windows" && a !== "amd64") return null;
-  return `${os65}-${a}`;
+  if (os66 === "windows" && a !== "amd64") return null;
+  return `${os66}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -26518,9 +26671,9 @@ async function configureBeads(action, ctx, deps) {
       return { enabled: false, running: false };
     }
     const p3 = await deps.probe();
-    const running2 = p3.serverUp && p3.bdAvailable;
-    deps.emit({ type: "beads_status", state: running2 ? "enabled" : "disabled", running: running2, ...p3 });
-    return { enabled: running2, running: running2, ...p3 };
+    const running3 = p3.serverUp && p3.bdAvailable;
+    deps.emit({ type: "beads_status", state: running3 ? "enabled" : "disabled", running: running3, ...p3 });
+    return { enabled: running3, running: running3, ...p3 };
   }
   if (action === "disable") {
     deps.persist({ enabled: false });
@@ -26537,9 +26690,9 @@ async function configureBeads(action, ctx, deps) {
     return { enabled: false, ...p2 };
   }
   await deps.startWatcher().catch(() => void 0);
-  const running = true;
-  deps.emit({ type: "beads_status", state: "enabled", running, ...p2 });
-  return { enabled: true, running, ...p2 };
+  const running2 = true;
+  deps.emit({ type: "beads_status", state: "enabled", running: running2, ...p2 });
+  return { enabled: true, running: running2, ...p2 };
 }
 
 // src/skills/configure.ts
@@ -27211,7 +27364,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
   });
   const token = ctx.pluginAuthToken;
   void (async () => {
-    const os65 = createOsStrategy();
+    const os66 = createOsStrategy();
     try {
       const report = await reviewPullRequest(
         {
@@ -27220,7 +27373,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
           baseBranch: parsed.baseBranch
         },
         {
-          runReview: (input) => new CoderabbitRuntimeStrategy(os65).runOneShot(input),
+          runReview: (input) => new CoderabbitRuntimeStrategy(os66).runOneShot(input),
           runGh: (args2) => defaultRunGh(args2),
           postReport: async (r) => {
             if (!token) return;
@@ -27358,13 +27511,13 @@ function resolveGlobalNodeModulesDir(opts) {
 var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
-  const readdirSync13 = deps?.readdirSync ?? fs51.readdirSync;
+  const readdirSync14 = deps?.readdirSync ?? fs51.readdirSync;
   const statSync15 = deps?.statSync ?? fs51.statSync;
   const rmSync9 = deps?.rmSync ?? fs51.rmSync;
   let removed = 0;
   let entries;
   try {
-    entries = readdirSync13(nodeModulesDir);
+    entries = readdirSync14(nodeModulesDir);
   } catch {
     return 0;
   }
@@ -27759,105 +27912,88 @@ async function runDetectOneShot(generate, timeoutMs = PREVIEW_DETECT_TIMEOUT_MS)
     if (timer) clearTimeout(timer);
   }
 }
-var requestPreviewDetectH = (ctx) => {
-  if (!ctx.pluginAuthToken) {
-    log.info("preview", "no pluginAuthToken \u2014 skipping detect");
-    return;
-  }
-  if (typeof ctx.runtime.generateOneShot !== "function") {
-    log.info("preview", `runtime ${ctx.runtime.id} has no generateOneShot \u2014 emitting unsupported`);
+function originPayload(payload, origin) {
+  if (origin !== "agent") return payload;
+  return { ...payload ?? {}, origin };
+}
+async function resolvePreviewDetection(args2) {
+  const { ctx, runtime, pluginAuthToken, origin } = args2;
+  const emit2 = (type, payload) => {
     emitPreviewEvent({
       sessionId: ctx.sessionId,
       pluginId: ctx.pluginId,
-      pluginAuthToken: ctx.pluginAuthToken,
-      type: USER_EVENTS.PREVIEW_ERROR,
-      payload: {
-        stage: "detection",
-        message: `Preview detection isn't available on ${ctx.runtime.id} sessions yet \u2014 link a Claude or Codex agent.`
-      }
+      pluginAuthToken,
+      type,
+      payload: originPayload(payload, origin)
     });
-    return;
+  };
+  if (typeof runtime.generateOneShot !== "function") {
+    log.info("preview", `runtime ${runtime.id} has no generateOneShot \u2014 emitting unsupported`);
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "detection",
+      message: `Preview detection isn't available on ${runtime.id} sessions yet \u2014 link a Claude or Codex agent.`
+    });
+    return null;
   }
-  const pluginAuthToken = ctx.pluginAuthToken;
-  const generateOneShot = ctx.runtime.generateOneShot.bind(ctx.runtime);
-  void (async () => {
-    const fromFile = await readPreviewConfig(process.cwd());
-    if (fromFile) {
-      log.info("preview", `detect: using .codeam/preview.json (${fromFile.framework})`);
-      emitPreviewEvent({
-        sessionId: ctx.sessionId,
-        pluginId: ctx.pluginId,
-        pluginAuthToken,
-        type: USER_EVENTS.PREVIEW_DETECTION_READY,
-        payload: { detection: withScriptCandidates(fromFile) }
-      });
-      return;
-    }
-    emitPreviewEvent({
-      sessionId: ctx.sessionId,
-      pluginId: ctx.pluginId,
-      pluginAuthToken,
-      type: USER_EVENTS.PREVIEW_DETECTION_PENDING
+  const generateOneShot = runtime.generateOneShot.bind(runtime);
+  const fromFile = await readPreviewConfig(process.cwd());
+  if (fromFile) {
+    log.info("preview", `detect: using .codeam/preview.json (${fromFile.framework})`);
+    return fromFile;
+  }
+  emit2(USER_EVENTS.PREVIEW_DETECTION_PENDING);
+  log.info("preview", "detect: invoking generateOneShot");
+  const startedAt = Date.now();
+  const { raw, timedOut, stderr } = await runDetectOneShot(generateOneShot);
+  const tookMs = Date.now() - startedAt;
+  if (timedOut) {
+    log.info("preview", `detect: timed out after ${tookMs}ms \u2014 emitting preview_error`);
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "detection",
+      message: `Project detection timed out after ${Math.round(PREVIEW_DETECT_TIMEOUT_MS / 1e3)} s \u2014 the agent did not answer. Try again, or add a .codeam/preview.json override.`
     });
-    log.info("preview", "detect: invoking generateOneShot");
-    const startedAt = Date.now();
-    const { raw, timedOut, stderr } = await runDetectOneShot(generateOneShot);
-    const tookMs = Date.now() - startedAt;
-    if (timedOut) {
-      log.info("preview", `detect: timed out after ${tookMs}ms \u2014 emitting preview_error`);
-      emitPreviewEvent({
-        sessionId: ctx.sessionId,
-        pluginId: ctx.pluginId,
-        pluginAuthToken,
-        type: USER_EVENTS.PREVIEW_ERROR,
-        payload: {
-          stage: "detection",
-          message: `Project detection timed out after ${Math.round(PREVIEW_DETECT_TIMEOUT_MS / 1e3)} s \u2014 the agent did not answer. Try again, or add a .codeam/preview.json override.`
-        }
-      });
-      return;
-    }
-    const detection = safeParseDetection(raw);
-    if (!detection) {
-      const failure = describeDetectionFailure(raw);
-      log.info(
-        "preview",
-        `detect: failed after ${tookMs}ms reason=${failure?.reason ?? "unknown"}` + (failure?.missing ? ` missing=${failure.missing.join(",")}` : "") + `
+    return null;
+  }
+  const detection = safeParseDetection(raw);
+  if (!detection) {
+    const failure = describeDetectionFailure(raw);
+    log.info(
+      "preview",
+      `detect: failed after ${tookMs}ms reason=${failure?.reason ?? "unknown"}` + (failure?.missing ? ` missing=${failure.missing.join(",")}` : "") + `
 --- salida cruda del agente (acotada) ---
 ${failure?.rawExcerpt ?? ""}`
-      );
-      emitPreviewEvent({
-        sessionId: ctx.sessionId,
-        pluginId: ctx.pluginId,
-        pluginAuthToken,
-        type: USER_EVENTS.PREVIEW_ERROR,
-        payload: {
-          stage: "detection",
-          // El mensaje sale del diagnostico: decir "JSON invalido" cuando el
-          // agente no contesto manda al usuario a mirar un JSON que no existe.
-          message: (failure?.reason === "no_output" ? describeOneShotAgentError(stderr) : null) ?? failure?.message ?? "Agent returned invalid JSON. Try again, or add a .codeam/preview.json override."
-        }
-      });
-      return;
-    }
-    if (isUnsupportedDetection(detection)) {
-      log.info("preview", "detect: framework=unsupported");
-      emitPreviewEvent({
-        sessionId: ctx.sessionId,
-        pluginId: ctx.pluginId,
-        pluginAuthToken,
-        type: USER_EVENTS.PREVIEW_ERROR,
-        payload: {
-          stage: "unsupported",
-          message: detection.notes ?? "No dev server applies to this project."
-        }
-      });
-      return;
-    }
-    log.info("preview", `detect: ${detection.framework} on :${detection.port} (took ${tookMs}ms)`);
-    void writePreviewConfig(process.cwd(), detection).catch((err) => {
-      log.info("preview", `detect: writePreviewConfig failed (non-fatal): ${String(err)}`);
+    );
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "detection",
+      // El mensaje sale del diagnostico: decir "JSON invalido" cuando el
+      // agente no contesto manda al usuario a mirar un JSON que no existe.
+      message: (failure?.reason === "no_output" ? describeOneShotAgentError(stderr) : null) ?? failure?.message ?? "Agent returned invalid JSON. Try again, or add a .codeam/preview.json override."
+    });
+    return null;
+  }
+  if (isUnsupportedDetection(detection)) {
+    log.info("preview", "detect: framework=unsupported");
+    emit2(USER_EVENTS.PREVIEW_ERROR, {
+      stage: "unsupported",
+      message: detection.notes ?? "No dev server applies to this project."
     });
+    return null;
+  }
+  log.info("preview", `detect: ${detection.framework} on :${detection.port} (took ${tookMs}ms)`);
+  void writePreviewConfig(process.cwd(), detection).catch((err) => {
+    log.info("preview", `detect: writePreviewConfig failed (non-fatal): ${String(err)}`);
+  });
+  return detection;
+}
+var requestPreviewDetectH = (ctx) => {
+  if (!ctx.pluginAuthToken) {
+    log.info("preview", "no pluginAuthToken \u2014 skipping detect");
+    return;
+  }
+  const pluginAuthToken = ctx.pluginAuthToken;
+  void (async () => {
+    const detection = await resolvePreviewDetection({ ctx, runtime: ctx.runtime, pluginAuthToken });
+    if (!detection) return;
     emitPreviewEvent({
       sessionId: ctx.sessionId,
       pluginId: ctx.pluginId,
@@ -27940,19 +28076,21 @@ var previewStartH = (ctx, _cmd, parsed) => {
     log.info("preview", "start: no detection in payload");
     return;
   }
-  startPreviewFromDetection(ctx, rawDetection, ctx.pluginAuthToken);
+  void startPreviewFromDetection(ctx, rawDetection, ctx.pluginAuthToken);
 };
-function startPreviewFromDetection(ctx, detection, pluginAuthToken) {
+function startPreviewFromDetection(ctx, detection, pluginAuthToken, opts = {}) {
   const emit2 = (type, payload) => {
+    const tagged = originPayload(payload, opts.origin) ?? {};
+    opts.onEvent?.(type, tagged);
     emitPreviewEvent({
       sessionId: ctx.sessionId,
       pluginId: ctx.pluginId,
       pluginAuthToken,
       type,
-      payload
+      payload: tagged
     });
   };
-  runPreviewStart({
+  return runPreviewStart({
     sessionId: ctx.sessionId,
     detection,
     cwd: process.cwd(),
@@ -27983,7 +28121,7 @@ function maybeAttachBuildHeal(ctx, pluginAuthToken) {
         if (!activePreviews.has(ctx.sessionId)) return;
         await killPreview(ctx.sessionId);
         await new Promise((r) => setTimeout(r, 150));
-        startPreviewFromDetection(ctx, preview.detection, pluginAuthToken);
+        void startPreviewFromDetection(ctx, preview.detection, pluginAuthToken);
       })();
     },
     notify: (message) => {
@@ -28029,7 +28167,7 @@ var previewRestartH = async (ctx, cmd) => {
   }
   await killPreview(ctx.sessionId);
   await new Promise((r) => setTimeout(r, 150));
-  startPreviewFromDetection(ctx, preview.detection, ctx.pluginAuthToken);
+  void startPreviewFromDetection(ctx, preview.detection, ctx.pluginAuthToken);
   await ctx.relay.sendResult(cmd.id, "completed", { restarted: true });
 };
 var savePreviewConfigH = (_ctx, _cmd, parsed) => {
@@ -28402,11 +28540,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path96 = fileFlag.slice("--token-file=".length);
+    const path97 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs52.readFileSync(path96, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path96} is empty`);
-      rmIfExistsQuiet(path96);
+      const content = fs52.readFileSync(path97, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path97} is empty`);
+      rmIfExistsQuiet(path97);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -29338,32 +29476,200 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
   return null;
 }
 
+// src/commands/host/workspace.ts
+var fs53 = __toESM(require("fs"));
+var os41 = __toESM(require("os"));
+var path62 = __toESM(require("path"));
+var import_node_child_process21 = require("child_process");
+var import_node_util5 = require("util");
+var execFileP5 = (0, import_node_util5.promisify)(import_node_child_process21.execFile);
+function isAbsolutePathTarget(target) {
+  return path62.isAbsolute(target);
+}
+function selfHostedWorkspaceRoot() {
+  return path62.join(os41.homedir(), ".codeam", "self-hosted");
+}
+function deployIdFromWorkspace(cwd) {
+  if (!cwd) return null;
+  const root = selfHostedWorkspaceRoot();
+  const resolved = path62.resolve(cwd);
+  const rel = path62.relative(root, resolved);
+  if (!rel || rel.startsWith("..") || path62.isAbsolute(rel)) return null;
+  const parts = rel.split(path62.sep).filter(Boolean);
+  if (parts.length !== 1) return null;
+  return parts[0];
+}
+function nonInteractiveGitEnv() {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    GCM_INTERACTIVE: "never"
+  };
+}
+function githubOwnerRepo(repoRef) {
+  const trimmed = repoRef.trim();
+  const shorthand = /^([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+  if (shorthand && !/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@")) {
+    return { owner: shorthand[1], repo: shorthand[2] };
+  }
+  const httpsMatch = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(trimmed);
+  if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
+  return null;
+}
+function gitlabProjectPath(repoRef) {
+  const trimmed = repoRef.trim();
+  const https9 = /^https?:\/\/gitlab\.com\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
+  if (https9) return https9[1];
+  if (!/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@") && trimmed.includes("/")) {
+    return trimmed.replace(/\.git$/, "");
+  }
+  return null;
+}
+function repoCloneUrl(repoRef, cloneToken, provider = "github") {
+  const trimmed = repoRef.trim();
+  if (provider === "gitlab") {
+    const glPath = gitlabProjectPath(trimmed);
+    if (glPath) {
+      return cloneToken ? `https://oauth2:${cloneToken}@gitlab.com/${glPath}.git` : `https://gitlab.com/${glPath}.git`;
+    }
+    if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  }
+  if (cloneToken) {
+    const gh = githubOwnerRepo(trimmed);
+    if (gh) {
+      return `https://x-access-token:${cloneToken}@github.com/${gh.owner}/${gh.repo}.git`;
+    }
+  }
+  if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  return `https://github.com/${trimmed.replace(/\.git$/, "")}.git`;
+}
+function maskCloneUrl(url2) {
+  return url2.replace(/(https?:\/\/)[^@/]+@/, "$1***@");
+}
+async function fetchGithubIdentity(token) {
+  try {
+    const res = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "codeam-cli",
+        Accept: "application/vnd.github+json"
+      }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return { login: body.login, email: body.email ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+async function configureGitCredentials(dest, repoRef, cloneToken, provider = "github") {
+  const isGitlab = provider === "gitlab";
+  if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
+  if (!cloneToken) return;
+  const credFile = path62.join(dest, ".git", "codeam-credentials");
+  const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
+` : `https://x-access-token:${cloneToken}@github.com
+`;
+  fs53.writeFileSync(credFile, credLine, { mode: 384 });
+  restrictToOwner(credFile);
+  const env = nonInteractiveGitEnv();
+  const git2 = (args2) => execFileP5("git", ["-C", dest, ...args2], { timeout: 3e4, env });
+  const credFilePosix = credFile.split(path62.sep).join("/");
+  await git2(["config", "--local", "--replace-all", "credential.helper", ""]).catch(() => {
+  });
+  await git2([
+    "config",
+    "--local",
+    "--add",
+    "credential.helper",
+    `store --file=${credFilePosix}`
+  ]).catch(() => {
+  });
+  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef, void 0, provider)]).catch(() => {
+  });
+  const hasIdentity = await git2(["config", "user.email"]).then(() => true).catch(() => false);
+  if (!hasIdentity) {
+    const who = isGitlab ? null : await fetchGithubIdentity(cloneToken);
+    const login = who?.login ?? "CodeAgent";
+    await git2(["config", "--local", "user.name", login]).catch(() => {
+    });
+    const email = who?.email ?? (isGitlab ? "agent@codeagent-mobile.com" : `${login}@users.noreply.github.com`);
+    await git2(["config", "--local", "user.email", email]).catch(() => {
+    });
+  }
+}
+function maskToken(text, cloneToken) {
+  const masked = maskCloneUrl(text);
+  if (cloneToken && cloneToken.length > 0) {
+    return masked.split(cloneToken).join("***");
+  }
+  return masked;
+}
+async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github", branch) {
+  if (isAbsolutePathTarget(repoOrPath)) {
+    if (!fs53.existsSync(repoOrPath)) {
+      throw new Error(`deploy target path does not exist: ${repoOrPath}`);
+    }
+    return repoOrPath;
+  }
+  const dest = path62.join(selfHostedWorkspaceRoot(), deployId);
+  if (fs53.existsSync(path62.join(dest, ".git"))) {
+    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
+    return dest;
+  }
+  fs53.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
+  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
+  const cloneArgs = branch ? ["clone", "--depth", "1", "--branch", branch, cloneUrl, dest] : ["clone", "--depth", "1", cloneUrl, dest];
+  try {
+    await execFileP5("git", cloneArgs, {
+      timeout: 12e4,
+      maxBuffer: 16 * 1024 * 1024,
+      env: nonInteractiveGitEnv()
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`git clone failed for ${maskCloneUrl(cloneUrl)}: ${maskToken(reason, cloneToken)}`);
+  }
+  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
+  return dest;
+}
+
 // src/agents/acp/runner.ts
-var import_node_crypto10 = require("crypto");
-var fs69 = __toESM(require("fs"));
-var os53 = __toESM(require("os"));
-var path80 = __toESM(require("path"));
+var import_node_crypto11 = require("crypto");
+var fs71 = __toESM(require("fs"));
+var os55 = __toESM(require("os"));
+var path82 = __toESM(require("path"));
 
 // src/lib/provider-routing.ts
+var fs55 = __toESM(require("fs"));
+var os43 = __toESM(require("os"));
+var path64 = __toESM(require("path"));
+
+// src/commands/host/house-proxy-config.ts
 var fs54 = __toESM(require("fs"));
 var os42 = __toESM(require("os"));
 var path63 = __toESM(require("path"));
-
-// src/commands/host/house-proxy-config.ts
-var fs53 = __toESM(require("fs"));
-var os41 = __toESM(require("os"));
-var path62 = __toESM(require("path"));
 function houseProxyConfigPath() {
-  return path62.join(os41.homedir(), ".codeam", "house-proxy.json");
+  return path63.join(os42.homedir(), ".codeam", "house-proxy.json");
+}
+var DEPLOY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function deployHouseProxyConfigPath(deployId) {
+  if (!DEPLOY_ID_RE.test(deployId) || deployId.includes("..")) return null;
+  return path63.join(os42.homedir(), ".codeam", "house-proxy", `${deployId}.json`);
+}
+function writeJson0600(file, value) {
+  fs54.mkdirSync(path63.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs54.writeFileSync(tmp, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 384 });
+  fs54.renameSync(tmp, file);
+  restrictToOwner(file);
 }
-function persistHouseProxyConfig(config) {
+function persistHouseProxyConfig(config, deployId) {
   try {
-    const file = houseProxyConfigPath();
-    fs53.mkdirSync(path62.dirname(file), { recursive: true, mode: 448 });
-    const tmp = `${file}.tmp-${process.pid}`;
-    fs53.writeFileSync(tmp, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
-    fs53.renameSync(tmp, file);
-    restrictToOwner(file);
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, config);
+    writeJson0600(houseProxyConfigPath(), config);
   } catch (err) {
     log.warn(
       "host-agent",
@@ -29371,18 +29677,23 @@ function persistHouseProxyConfig(config) {
     );
   }
 }
-function clearHouseProxyConfig() {
+function clearHouseProxyConfig(deployId) {
   try {
-    fs53.rmSync(houseProxyConfigPath(), { force: true });
+    fs54.rmSync(houseProxyConfigPath(), { force: true });
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, { none: true });
   } catch {
   }
 }
-function readHouseProxyChildEnv() {
+function readHouseProxyChildEnv(deployId) {
   try {
-    const raw = fs53.readFileSync(houseProxyConfigPath(), "utf8");
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    const file = perDeploy && fs54.existsSync(perDeploy) ? perDeploy : houseProxyConfigPath();
+    const raw = fs54.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null) return {};
     const o = parsed;
+    if (o.none === true) return {};
     if (typeof o.baseUrl !== "string" || !o.baseUrl) return {};
     if (typeof o.token !== "string" || !o.token) return {};
     return buildHouseProxyChildEnv({
@@ -29505,15 +29816,15 @@ function redactUrlToOrigin(raw) {
   }
 }
 function readOpencodeProviderOrigins(opts = {}) {
-  const home = opts.homeDir ?? os42.homedir();
-  const readFile7 = opts.readFile ?? ((f) => fs54.readFileSync(f, "utf8"));
+  const home = opts.homeDir ?? os43.homedir();
+  const readFile7 = opts.readFile ?? ((f) => fs55.readFileSync(f, "utf8"));
   const candidates = [];
   if (opts.cwd) {
-    candidates.push(path63.join(opts.cwd, "opencode.json"), path63.join(opts.cwd, "opencode.jsonc"));
+    candidates.push(path64.join(opts.cwd, "opencode.json"), path64.join(opts.cwd, "opencode.jsonc"));
   }
   candidates.push(
-    path63.join(home, ".config", "opencode", "opencode.json"),
-    path63.join(home, ".config", "opencode", "opencode.jsonc")
+    path64.join(home, ".config", "opencode", "opencode.json"),
+    path64.join(home, ".config", "opencode", "opencode.jsonc")
   );
   const out2 = [];
   const seen2 = /* @__PURE__ */ new Set();
@@ -29620,9 +29931,9 @@ function noteProviderBillingSignal(opts) {
 }
 
 // src/services/history.service.ts
-var fs55 = __toESM(require("fs"));
-var path64 = __toESM(require("path"));
-var os43 = __toESM(require("os"));
+var fs56 = __toESM(require("fs"));
+var path65 = __toESM(require("path"));
+var os44 = __toESM(require("os"));
 var https6 = __toESM(require("https"));
 var http9 = __toESM(require("http"));
 var import_zod2 = require("zod");
@@ -29683,7 +29994,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs55.readFileSync(filePath, "utf8");
+    raw = fs56.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -29837,7 +30148,7 @@ var HistoryService = class _HistoryService {
     return this._quotaPercent === null || Date.now() - this._quotaFetchedAt > ttlMs;
   }
   get projectDir() {
-    return this.runtime.resolveHistoryDir(this.cwd) ?? path64.join(os43.homedir(), ".claude", "projects", encodeCwd(this.cwd));
+    return this.runtime.resolveHistoryDir(this.cwd) ?? path65.join(os44.homedir(), ".claude", "projects", encodeCwd(this.cwd));
   }
   /** Set the current Claude conversation ID (extracted from /cost command or session start) */
   setCurrentConversationId(id) {
@@ -29849,7 +30160,7 @@ var HistoryService = class _HistoryService {
   /** Return the current message count in the active conversation. */
   getCurrentMessageCount() {
     if (!this.currentConversationId) return 0;
-    const filePath = path64.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+    const filePath = path65.join(this.projectDir, `${this.currentConversationId}.jsonl`);
     return parseJsonl(filePath).length;
   }
   /**
@@ -29860,7 +30171,7 @@ var HistoryService = class _HistoryService {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.currentConversationId) return null;
-      const filePath = path64.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+      const filePath = path65.join(this.projectDir, `${this.currentConversationId}.jsonl`);
       const messages = parseJsonl(filePath);
       if (messages.length > previousCount) {
         for (let i = messages.length - 1; i >= previousCount; i--) {
@@ -29886,16 +30197,16 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs55.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs56.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs55.statSync(path64.join(dir, e.name));
+          const stat3 = fs56.statSync(path65.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
         }
       }).filter((f) => f.birthtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       if (files.length > 0) {
-        this.currentConversationId = path64.basename(files[0].name, ".jsonl");
+        this.currentConversationId = path65.basename(files[0].name, ".jsonl");
       }
     } catch {
     }
@@ -29929,13 +30240,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs55.readdirSync(dir, { withFileTypes: true });
+      entries = fs56.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs55.statSync(path64.join(dir, e.name));
+        const stat3 = fs56.statSync(path65.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -29944,12 +30255,12 @@ var HistoryService = class _HistoryService {
     if (files.length === 0) return null;
     const targetFile = this.currentConversationId ? `${this.currentConversationId}.jsonl` : files[0].name;
     if (!files.some((f) => f.name === targetFile)) return null;
-    return this.extractUsageFromFile(path64.join(dir, targetFile));
+    return this.extractUsageFromFile(path65.join(dir, targetFile));
   }
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs55.readFileSync(filePath, "utf8");
+      raw = fs56.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -30001,9 +30312,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs55.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs56.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs55.statSync(path64.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs56.statSync(path65.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -30014,7 +30325,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs55.readFileSync(path64.join(projectDir, file), "utf8");
+        raw = fs56.readFileSync(path65.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -30093,7 +30404,7 @@ var HistoryService = class _HistoryService {
     if (this.runtime.resolveHistoryFile) {
       return this.runtime.resolveHistoryFile(this.cwd, sessionId);
     }
-    return path64.join(this.projectDir, `${sessionId}.jsonl`);
+    return path65.join(this.projectDir, `${sessionId}.jsonl`);
   }
   /**
    * Parse a conversation's messages from disk, agent-aware. Claude uses the
@@ -30131,7 +30442,7 @@ var HistoryService = class _HistoryService {
         };
       });
     }
-    return parseJsonl(path64.join(this.projectDir, `${sessionId}.jsonl`));
+    return parseJsonl(path65.join(this.projectDir, `${sessionId}.jsonl`));
   }
   /** One in-flight full upload per conversation — the baton mirror and a
    *  `get_conversation` used to upload the same transcript concurrently. */
@@ -30213,7 +30524,7 @@ var HistoryService = class _HistoryService {
     if (!filePath) return false;
     let mtimeMs;
     try {
-      mtimeMs = fs55.statSync(filePath).mtimeMs;
+      mtimeMs = fs56.statSync(filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -30287,11 +30598,11 @@ var HistoryService = class _HistoryService {
 };
 
 // src/agents/acp/client.ts
-var import_node_child_process21 = require("child_process");
-var fs56 = __toESM(require("fs/promises"));
+var import_node_child_process22 = require("child_process");
+var fs57 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
-var os45 = __toESM(require("os"));
-var path66 = __toESM(require("path"));
+var os46 = __toESM(require("os"));
+var path67 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -34317,8 +34628,8 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
 }
 
 // src/agents/acp/internal-paths.ts
-var path65 = __toESM(require("path"));
-var os44 = __toESM(require("os"));
+var path66 = __toESM(require("path"));
+var os45 = __toESM(require("os"));
 var INTERNAL_TOKENS = [".codeam", "house-claude"];
 var PROSE_ONLY_TOOL_KINDS = /* @__PURE__ */ new Set(["think", "switch_mode"]);
 function isProseOnlyToolKind(kind) {
@@ -34330,13 +34641,13 @@ function textReferencesInternal(text) {
   const scrubbed = text.replace(SELF_HOSTED_WORKSPACE_RE, " ");
   return INTERNAL_TOKENS.some((t2) => scrubbed.includes(t2));
 }
-function pathIsInternal(p2, homeDir2 = os44.homedir()) {
+function pathIsInternal(p2, homeDir2 = os45.homedir()) {
   if (!p2) return false;
-  const abs = path65.resolve(p2);
-  const home = path65.resolve(homeDir2);
-  const within = (root) => abs === root || abs.startsWith(root + path65.sep);
-  if (within(path65.join(home, ".codeam", "self-hosted"))) return false;
-  return within(path65.join(home, ".codeam")) || within(path65.join(home, ".beads")) || abs === path65.join(home, ".codeam-host.log") || abs.includes(`${path65.sep}house-claude${path65.sep}`) || abs.endsWith(`${path65.sep}house-claude`);
+  const abs = path66.resolve(p2);
+  const home = path66.resolve(homeDir2);
+  const within = (root) => abs === root || abs.startsWith(root + path66.sep);
+  if (within(path66.join(home, ".codeam", "self-hosted"))) return false;
+  return within(path66.join(home, ".codeam")) || within(path66.join(home, ".beads")) || abs === path66.join(home, ".codeam-host.log") || abs.includes(`${path66.sep}house-claude${path66.sep}`) || abs.endsWith(`${path66.sep}house-claude`);
 }
 function toolCallReferencesInternal(call, homeDir2) {
   if (call.locations?.some((l) => pathIsInternal(l.path, homeDir2))) return true;
@@ -34664,7 +34975,7 @@ var AcpClient = class {
       "acpClient",
       `provider routing ${formatProviderRouting(describeProviderRouting(childEnv, { cwd }), adapter.command)}`
     );
-    const child = (0, import_node_child_process21.spawn)(adapter.command, adapter.args, {
+    const child = (0, import_node_child_process22.spawn)(adapter.command, adapter.args, {
       cwd,
       env: childEnv,
       stdio: ["pipe", "pipe", "pipe"],
@@ -35349,7 +35660,7 @@ var AcpClient = class {
     try {
       const pid = child.pid;
       if (process.platform === "win32") {
-        if (pid) (0, import_node_child_process21.spawnSync)("taskkill", ["/F", "/T", "/PID", String(pid)], { stdio: "ignore" });
+        if (pid) (0, import_node_child_process22.spawnSync)("taskkill", ["/F", "/T", "/PID", String(pid)], { stdio: "ignore" });
       } else if (pid) {
         killQuiet(-pid, "SIGTERM");
       } else {
@@ -35431,7 +35742,7 @@ var AcpClient = class {
           throw new RequestError(-32002, GUARDRAIL_SECRET_READ_BLOCK_REASON, { uri: params.path });
         }
         try {
-          const content = await fs56.readFile(params.path, "utf8");
+          const content = await fs57.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
         } catch (err) {
           const code = err.code;
@@ -35452,7 +35763,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          await fs56.writeFile(params.path, params.content, "utf8");
+          await fs57.writeFile(params.path, params.content, "utf8");
           return {};
         } catch (err) {
           const code = err.code;
@@ -35540,30 +35851,30 @@ function applyLineRange(content, line, limit) {
   return { content: lines.slice(start2, end).join("\n") };
 }
 function knownAgentBinaryDirs() {
-  const home = os45.homedir();
+  const home = os46.homedir();
   const out2 = [];
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path66.join(home, ".nvm/versions/node")
+    path67.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path66.join(root, child, "bin"));
+        out2.push(path67.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path66.join(home, ".volta/bin"));
+  out2.push(path67.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path66.join(home, ".local/bin"));
-  out2.push(path66.join(home, "bin"));
+  out2.push(path67.join(home, ".local/bin"));
+  out2.push(path67.join(home, "bin"));
   out2.push(...agentInstallBinDirs());
   if (process.platform === "win32") {
     const { LOCALAPPDATA, APPDATA } = process.env;
-    if (LOCALAPPDATA) out2.push(path66.join(LOCALAPPDATA, "cursor-agent"));
-    if (APPDATA) out2.push(path66.join(APPDATA, "npm"));
+    if (LOCALAPPDATA) out2.push(path67.join(LOCALAPPDATA, "cursor-agent"));
+    if (APPDATA) out2.push(path67.join(APPDATA, "npm"));
   }
   return out2.filter((p2) => {
     try {
@@ -35574,7 +35885,7 @@ function knownAgentBinaryDirs() {
   });
 }
 function expandPathForAgentBinaries(existingPath) {
-  const existing = new Set(existingPath.split(path66.delimiter).filter((p2) => p2.length > 0));
+  const existing = new Set(existingPath.split(path67.delimiter).filter((p2) => p2.length > 0));
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
     if (!existing.has(dir)) {
@@ -35583,17 +35894,17 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path66.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path67.delimiter);
 }
 
 // src/commands/host/agent-install.ts
 var import_child_process27 = require("child_process");
-var os46 = __toESM(require("os"));
+var os47 = __toESM(require("os"));
 function runAgentInstallScript(script, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
   const scope = opts.logScope ?? "agent-install";
   return new Promise((resolve12) => {
-    const home = process.env.HOME || os46.homedir();
+    const home = process.env.HOME || os47.homedir();
     const child = (0, import_child_process27.spawn)("sh", ["-c", script], {
       env: { ...process.env, HOME: home },
       stdio: ["ignore", "pipe", "pipe"]
@@ -35855,9 +36166,9 @@ async function performAgentSwitch(deps, rawAgentId, fastPath = {}) {
 }
 
 // src/commands/host/agent-provisioning.ts
-var fs57 = __toESM(require("fs"));
-var os47 = __toESM(require("os"));
-var path67 = __toESM(require("path"));
+var fs58 = __toESM(require("fs"));
+var os48 = __toESM(require("os"));
+var path68 = __toESM(require("path"));
 var PUBLIC_TO_INTERNAL_AGENT = {
   claude_code: "claude",
   claude: "claude",
@@ -35874,22 +36185,22 @@ function toInternalAgentId(publicAgentId) {
   return PUBLIC_TO_INTERNAL_AGENT[publicAgentId] ?? null;
 }
 function ensureDir(dir) {
-  fs57.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs58.mkdirSync(dir, { recursive: true, mode: 448 });
 }
 function writeFile0600(filePath, contents) {
-  ensureDir(path67.dirname(filePath));
-  fs57.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
+  ensureDir(path68.dirname(filePath));
+  fs58.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
   restrictToOwner(filePath);
 }
 function rmIfExists(filePath) {
   try {
-    fs57.rmSync(filePath, { force: true });
+    fs58.rmSync(filePath, { force: true });
   } catch {
   }
 }
 var claudeProvisioner = {
   write(auth, home) {
-    const credentialsJson = path67.join(home, ".claude", ".credentials.json");
+    const credentialsJson = path68.join(home, ".claude", ".credentials.json");
     if (auth.kind === "api_key") {
       rmIfExists(credentialsJson);
       return { ANTHROPIC_API_KEY: auth.value };
@@ -35901,8 +36212,8 @@ var claudeProvisioner = {
     } else {
       rmIfExists(credentialsJson);
     }
-    const claudeJson = path67.join(home, ".claude.json");
-    if (!fs57.existsSync(claudeJson)) {
+    const claudeJson = path68.join(home, ".claude.json");
+    if (!fs58.existsSync(claudeJson)) {
       writeFile0600(
         claudeJson,
         JSON.stringify({ hasCompletedOnboarding: true, customApiKeyResponses: { approved: [] } })
@@ -35913,7 +36224,7 @@ var claudeProvisioner = {
 };
 var codexProvisioner = {
   write(auth, home) {
-    const authJson = path67.join(home, ".codex", "auth.json");
+    const authJson = path68.join(home, ".codex", "auth.json");
     if (auth.kind === "api_key") {
       writeFile0600(authJson, JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: auth.value }));
       return { OPENAI_API_KEY: auth.value };
@@ -35924,8 +36235,8 @@ var codexProvisioner = {
 };
 var geminiProvisioner = {
   write(auth, home) {
-    const settingsJson = path67.join(home, ".gemini", "settings.json");
-    const oauthCreds = path67.join(home, ".gemini", "oauth_creds.json");
+    const settingsJson = path68.join(home, ".gemini", "settings.json");
+    const oauthCreds = path68.join(home, ".gemini", "oauth_creds.json");
     if (auth.kind === "api_key") {
       rmIfExists(oauthCreds);
       writeFile0600(settingsJson, '{"security":{"auth":{"selectedType":"gemini-api-key"}}}');
@@ -35938,7 +36249,7 @@ var geminiProvisioner = {
 };
 var cursorProvisioner = {
   write(auth, home) {
-    const authJson = path67.join(home, ".config", "cursor", "auth.json");
+    const authJson = path68.join(home, ".config", "cursor", "auth.json");
     if (auth.kind === "api_key") {
       rmIfExists(authJson);
       return { CURSOR_API_KEY: auth.value };
@@ -35980,22 +36291,22 @@ max_context_size = 262144
 var kimiProvisioner = {
   write(auth, home) {
     const credentialsFiles = [
-      path67.join(home, ".kimi", "credentials", "kimi-code.json"),
-      path67.join(home, ".kimi-code", "credentials", "kimi-code.json")
+      path68.join(home, ".kimi", "credentials", "kimi-code.json"),
+      path68.join(home, ".kimi-code", "credentials", "kimi-code.json")
     ];
     if (auth.kind === "api_key") {
       credentialsFiles.forEach(rmIfExists);
       return { KIMI_API_KEY: auth.value };
     }
     credentialsFiles.forEach((f) => writeFile0600(f, auth.value));
-    writeFile0600(path67.join(home, ".kimi-code", "config.toml"), KIMI_MANAGED_CONFIG_TOML);
+    writeFile0600(path68.join(home, ".kimi-code", "config.toml"), KIMI_MANAGED_CONFIG_TOML);
     return {};
   }
 };
 var coderabbitProvisioner = {
   write(auth, home) {
-    const dir = path67.join(home, ".coderabbit");
-    const authJson = path67.join(dir, "auth.json");
+    const dir = path68.join(home, ".coderabbit");
+    const authJson = path68.join(dir, "auth.json");
     if (auth.kind === "api_key") {
       rmIfExists(authJson);
       return { CODERABBIT_API_KEY: auth.value };
@@ -36007,13 +36318,13 @@ var coderabbitProvisioner = {
       try {
         const parsed = JSON.parse(value);
         if (typeof parsed.file === "string" && typeof parsed.contents === "string") {
-          file = path67.basename(parsed.file);
+          file = path68.basename(parsed.file);
           contents = parsed.contents;
         }
       } catch {
       }
     }
-    writeFile0600(path67.join(dir, file), contents);
+    writeFile0600(path68.join(dir, file), contents);
     return {};
   }
 };
@@ -36041,7 +36352,7 @@ var UnsupportedAgentError = class extends Error {
     this.agentId = agentId;
   }
 };
-function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os47.homedir()) {
+function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os48.homedir()) {
   const internal = toInternalAgentId(publicAgentId);
   if (!internal) throw new UnsupportedAgentError(publicAgentId);
   const provisioner = PROVISIONERS[internal];
@@ -36050,16 +36361,16 @@ function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os47.homedir(
 }
 
 // src/beads/workflow-hint.ts
-var fs58 = __toESM(require("fs"));
-var path69 = __toESM(require("path"));
+var fs59 = __toESM(require("fs"));
+var path70 = __toESM(require("path"));
 
 // src/agents/claude-memory-file.ts
-var os48 = __toESM(require("os"));
-var path68 = __toESM(require("path"));
+var os49 = __toESM(require("os"));
+var path69 = __toESM(require("path"));
 function claudeMemoryFile(homeDir2, env = process.env) {
-  if (homeDir2) return path68.join(homeDir2, ".claude", "CLAUDE.md");
+  if (homeDir2) return path69.join(homeDir2, ".claude", "CLAUDE.md");
   const configDir = env.CLAUDE_CONFIG_DIR?.trim();
-  return configDir ? path68.join(configDir, "CLAUDE.md") : path68.join(os48.homedir(), ".claude", "CLAUDE.md");
+  return configDir ? path69.join(configDir, "CLAUDE.md") : path69.join(os49.homedir(), ".claude", "CLAUDE.md");
 }
 
 // src/beads/workflow-hint.ts
@@ -36089,11 +36400,11 @@ function ensureBeadsWorkflowHint(homeDir2, file = claudeMemoryFile(homeDir2)) {
   try {
     let existing = "";
     try {
-      existing = fs58.readFileSync(file, "utf8");
+      existing = fs59.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT)) return;
-    fs58.mkdirSync(path69.dirname(file), { recursive: true });
+    fs59.mkdirSync(path70.dirname(file), { recursive: true });
     let next;
     const open = existing.indexOf(BEADS_HINT_MARKER);
     const close = open === -1 ? -1 : existing.indexOf(BEADS_HINT_MARKER, open + BEADS_HINT_MARKER.length);
@@ -36106,40 +36417,40 @@ ${BEADS_HINT}
 ` : `${BEADS_HINT}
 `;
     }
-    fs58.writeFileSync(file, next);
+    fs59.writeFileSync(file, next);
   } catch {
   }
 }
 
 // src/agents/agent-standard.ts
-var fs59 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
-var os49 = __toESM(require("os"));
+var fs60 = __toESM(require("fs"));
+var path71 = __toESM(require("path"));
+var os50 = __toESM(require("os"));
 function ensureAgentStandard(homeDir2, file = claudeMemoryFile(homeDir2)) {
   try {
     let existing = "";
     try {
-      existing = fs59.readFileSync(file, "utf8");
+      existing = fs60.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(AGENT_STANDARD_MARKER)) return;
-    fs59.mkdirSync(path70.dirname(file), { recursive: true });
+    fs60.mkdirSync(path71.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${AGENT_STANDARD_BLOCK}
 ` : `${AGENT_STANDARD_BLOCK}
 `;
-    fs59.writeFileSync(file, next);
+    fs60.writeFileSync(file, next);
   } catch {
   }
 }
 var _agentStandardSeam = {
   isLocalSession: () => isLocalSession(),
-  markerPath: (sessionId) => path70.join(os49.homedir(), ".codeam", "agent-standard", `${sessionId}.done`),
-  exists: (p2) => fs59.existsSync(p2),
+  markerPath: (sessionId) => path71.join(os50.homedir(), ".codeam", "agent-standard", `${sessionId}.done`),
+  exists: (p2) => fs60.existsSync(p2),
   write: (p2) => {
-    fs59.mkdirSync(path70.dirname(p2), { recursive: true });
-    fs59.writeFileSync(p2, "");
+    fs60.mkdirSync(path71.dirname(p2), { recursive: true });
+    fs60.writeFileSync(p2, "");
   }
 };
 function isClaude(agent) {
@@ -36832,15 +37143,15 @@ function withholdTrailingPartialFenceMarker(text) {
 
 // src/agents/acp/onboarding.ts
 var import_child_process28 = require("child_process");
-var fs60 = __toESM(require("fs"));
-var os50 = __toESM(require("os"));
-var path71 = __toESM(require("path"));
+var fs61 = __toESM(require("fs"));
+var os51 = __toESM(require("os"));
+var path72 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path71.join(os50.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
-  exists: (p2) => fs60.existsSync(p2),
+  markerPath: (sessionId) => path72.join(os51.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  exists: (p2) => fs61.existsSync(p2),
   write: (p2) => {
-    fs60.mkdirSync(path71.dirname(p2), { recursive: true });
-    fs60.writeFileSync(p2, "");
+    fs61.mkdirSync(path72.dirname(p2), { recursive: true });
+    fs61.writeFileSync(p2, "");
   },
   disabled: () => {
     const v = process.env.CODEAM_ONBOARDING_DISABLED;
@@ -36877,7 +37188,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path71.basename(cwd || "");
+  const base = path72.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -37269,13 +37580,13 @@ var import_crypto4 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process29 = require("child_process");
-var fs62 = __toESM(require("fs/promises"));
-var path73 = __toESM(require("path"));
+var fs63 = __toESM(require("fs/promises"));
+var path74 = __toESM(require("path"));
 
 // src/services/turn-files/review-ignore.ts
 var import_ignore2 = __toESM(require("ignore"));
-var fs61 = __toESM(require("fs"));
-var path72 = __toESM(require("path"));
+var fs62 = __toESM(require("fs"));
+var path73 = __toESM(require("path"));
 var CURATED_REVIEW_IGNORE = [
   // Google Cloud SDK (the incident) — installs a huge python tree.
   "google-cloud-sdk/",
@@ -37314,7 +37625,7 @@ var CURATED_REVIEW_IGNORE = [
 function makeReviewIgnore(repoRoot) {
   const ig = (0, import_ignore2.default)().add(CURATED_REVIEW_IGNORE);
   try {
-    const custom = fs61.readFileSync(path72.join(repoRoot, ".codeam", "reviewignore"), "utf8");
+    const custom = fs62.readFileSync(path73.join(repoRoot, ".codeam", "reviewignore"), "utf8");
     ig.add(custom);
   } catch {
   }
@@ -37359,7 +37670,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (!truncated && row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path73.join(opts.repoRoot, row.filePath)
+        path74.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -37390,7 +37701,7 @@ function readUntrackedLineCount(absPath) {
 }
 async function defaultReadUntrackedLineCount(absPath) {
   try {
-    const content = await fs62.readFile(absPath, "utf8");
+    const content = await fs63.readFile(absPath, "utf8");
     let count = 0;
     let pos = -1;
     while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
@@ -37482,7 +37793,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs81 = await import("fs/promises");
+  const fs82 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -37490,7 +37801,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs81.readdir(dir, { withFileTypes: true });
+      const dirents = await fs82.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -37501,8 +37812,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path73.relative(workingDir, dir),
-        repoName: path73.basename(dir)
+        repoPath: path74.relative(workingDir, dir),
+        repoName: path74.basename(dir)
       });
       return;
     }
@@ -37510,14 +37821,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path73.join(dir, entry.name), depth + 1);
+      await walk(path74.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs63 = __toESM(require("fs/promises"));
-var path74 = __toESM(require("path"));
+var fs64 = __toESM(require("fs/promises"));
+var path75 = __toESM(require("path"));
 var import_os12 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -37550,16 +37861,16 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path74.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path74.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path75.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path75.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs63.mkdir(path74.dirname(this.filePath), { recursive: true });
-    await fs63.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs64.mkdir(path75.dirname(this.filePath), { recursive: true });
+    await fs64.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -37650,7 +37961,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs63.readFile(this.filePath, "utf8");
+      raw = await fs64.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -37674,12 +37985,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs63.unlink(this.filePath).catch(() => void 0);
+      await fs64.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs63.writeFile(tmpPath, payload, "utf8");
-    await fs63.rename(tmpPath, this.filePath);
+    await fs64.writeFile(tmpPath, payload, "utf8");
+    await fs64.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -38226,11 +38537,11 @@ async function postCredentialSync(opts, fetchImpl = fetch) {
 }
 
 // src/packs/gates.ts
-var import_node_child_process22 = require("child_process");
-var fs64 = __toESM(require("fs"));
-var path75 = __toESM(require("path"));
+var import_node_child_process23 = require("child_process");
+var fs65 = __toESM(require("fs"));
+var path76 = __toESM(require("path"));
 var defaultCommandRunner = (file, args2, cwd, timeoutMs, env) => new Promise((resolve12) => {
-  (0, import_node_child_process22.execFile)(
+  (0, import_node_child_process23.execFile)(
     file,
     args2,
     {
@@ -38278,7 +38589,7 @@ async function changedFiles(run, cwd, from, to) {
 }
 function readWorkspaceFile(cwd, relPath) {
   try {
-    return fs64.readFileSync(path75.join(cwd, relPath), "utf8");
+    return fs65.readFileSync(path76.join(cwd, relPath), "utf8");
   } catch {
     return null;
   }
@@ -38287,14 +38598,14 @@ var NO_TEST_PLACEHOLDER = 'echo "Error: no test specified"';
 var CHECKS_TIMEOUT_MS = 5 * 6e4;
 function detectChecksCommand(cwd) {
   try {
-    const cfg = JSON.parse(fs64.readFileSync(path75.join(cwd, ".codeam", "pack.json"), "utf8"));
+    const cfg = JSON.parse(fs65.readFileSync(path76.join(cwd, ".codeam", "pack.json"), "utf8"));
     if (typeof cfg.checksCommand === "string" && cfg.checksCommand.trim().length > 0) {
       return cfg.checksCommand.trim();
     }
   } catch {
   }
   try {
-    const pkg = JSON.parse(fs64.readFileSync(path75.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs65.readFileSync(path76.join(cwd, "package.json"), "utf8"));
     const test = pkg.scripts?.test;
     if (typeof test === "string" && test.trim().length > 0 && !test.includes(NO_TEST_PLACEHOLDER)) {
       return "npm test";
@@ -38312,39 +38623,39 @@ ${res.stderr}`.trim();
 }
 
 // src/packs/run-store.ts
-var fs65 = __toESM(require("fs"));
-var path76 = __toESM(require("path"));
+var fs66 = __toESM(require("fs"));
+var path77 = __toESM(require("path"));
 var crypto5 = __toESM(require("crypto"));
 function packsDir(cwd) {
-  return path76.join(cwd, ".codeam", "packs");
+  return path77.join(cwd, ".codeam", "packs");
 }
 function runDir(cwd, runId) {
-  return path76.join(packsDir(cwd), runId);
+  return path77.join(packsDir(cwd), runId);
 }
 function newRunId() {
   return `pk_${Date.now().toString(36)}_${crypto5.randomBytes(4).toString("hex")}`;
 }
 function writeJsonAtomic(file, value) {
-  fs65.mkdirSync(path76.dirname(file), { recursive: true });
+  fs66.mkdirSync(path77.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs65.writeFileSync(tmp, JSON.stringify(value, null, 2));
-  fs65.renameSync(tmp, file);
+  fs66.writeFileSync(tmp, JSON.stringify(value, null, 2));
+  fs66.renameSync(tmp, file);
 }
 function saveRun(cwd, state) {
-  writeJsonAtomic(path76.join(runDir(cwd, state.runId), "run.json"), state);
+  writeJsonAtomic(path77.join(runDir(cwd, state.runId), "run.json"), state);
 }
 function saveStageHandoff(cwd, runId, stageIndex, role, handoff) {
   const name = `${String(stageIndex + 1).padStart(2, "0")}-${role}.json`;
-  writeJsonAtomic(path76.join(runDir(cwd, runId), name), handoff);
+  writeJsonAtomic(path77.join(runDir(cwd, runId), name), handoff);
 }
 function loadLatestRun(cwd) {
   try {
     const dir = packsDir(cwd);
-    const entries = fs65.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    const entries = fs66.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
     for (let i = entries.length - 1; i >= 0; i--) {
-      const file = path76.join(dir, entries[i], "run.json");
+      const file = path77.join(dir, entries[i], "run.json");
       try {
-        const parsed = JSON.parse(fs65.readFileSync(file, "utf8"));
+        const parsed = JSON.parse(fs66.readFileSync(file, "utf8"));
         if (parsed && typeof parsed.runId === "string") return parsed;
       } catch {
       }
@@ -38355,17 +38666,17 @@ function loadLatestRun(cwd) {
 }
 function ensureLedgerIgnored(cwd) {
   try {
-    const gitDir = path76.join(cwd, ".git");
-    if (!fs65.existsSync(gitDir)) return;
-    const exclude = path76.join(gitDir, "info", "exclude");
+    const gitDir = path77.join(cwd, ".git");
+    if (!fs66.existsSync(gitDir)) return;
+    const exclude = path77.join(gitDir, "info", "exclude");
     let existing = "";
     try {
-      existing = fs65.readFileSync(exclude, "utf8");
+      existing = fs66.readFileSync(exclude, "utf8");
     } catch {
     }
     if (existing.includes(".codeam/packs/")) return;
-    fs65.mkdirSync(path76.dirname(exclude), { recursive: true });
-    fs65.writeFileSync(exclude, `${existing.trimEnd()}
+    fs66.mkdirSync(path77.dirname(exclude), { recursive: true });
+    fs66.writeFileSync(exclude, `${existing.trimEnd()}
 .codeam/packs/
 `.trimStart());
   } catch {
@@ -39345,8 +39656,267 @@ async function mcpRouter() {
   });
 }
 
+// src/integrations/mcp-secrets.ts
+var fs68 = __toESM(require("fs"));
+var os53 = __toESM(require("os"));
+var path79 = __toESM(require("path"));
+var MCP_SECRETS_FILE_ENV = "CODEAM_MCP_SECRETS_FILE";
+function mcpSecretsDir() {
+  return path79.join(os53.homedir(), ".codeam", "mcp-secrets");
+}
+function mcpSecretsPath(scope, pid = process.pid) {
+  return path79.join(mcpSecretsDir(), `${pid}-${scope}.json`);
+}
+var registeredForCleanup = /* @__PURE__ */ new Set();
+function readFileVars(file) {
+  try {
+    const parsed = JSON.parse(fs68.readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object") return {};
+    const out2 = {};
+    for (const [k2, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out2[k2] = v;
+    }
+    return out2;
+  } catch {
+    return {};
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function pruneStale(dir) {
+  let names = [];
+  try {
+    names = fs68.readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const m = /^(\d+)-[a-z]+\.json$/.exec(name);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    if (pid === process.pid || pidAlive(pid)) continue;
+    try {
+      fs68.unlinkSync(path79.join(dir, name));
+    } catch {
+    }
+  }
+}
+function writeMcpSecrets(vars, file) {
+  try {
+    const dir = path79.dirname(file);
+    fs68.mkdirSync(dir, { recursive: true, mode: 448 });
+    pruneStale(dir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs68.writeFileSync(tmp, JSON.stringify(vars), { mode: 384 });
+    fs68.renameSync(tmp, file);
+    fs68.chmodSync(file, 384);
+    if (!registeredForCleanup.has(file)) {
+      registeredForCleanup.add(file);
+      process.once("exit", () => {
+        try {
+          fs68.unlinkSync(file);
+        } catch {
+        }
+      });
+    }
+    return file;
+  } catch {
+    return null;
+  }
+}
+function mcpSecretEnv(scope, vars) {
+  const file = writeMcpSecrets(vars, mcpSecretsPath(scope));
+  if (file) return [{ name: MCP_SECRETS_FILE_ENV, value: file }];
+  return Object.entries(vars).map(([name, value]) => ({ name, value }));
+}
+function loadMcpSecrets(env = process.env) {
+  const file = env[MCP_SECRETS_FILE_ENV];
+  if (!file) return;
+  for (const [k2, v] of Object.entries(readFileVars(file))) {
+    if (env[k2] === void 0) env[k2] = v;
+  }
+}
+
+// src/commands/preview-mcp.ts
+var PREVIEW_MCP_SERVER_NAME = "codeagent_preview";
+var PREVIEW_IPC_URL_ENV = "CODEAM_PREVIEW_IPC_URL";
+var PREVIEW_IPC_TOKEN_ENV = "CODEAM_PREVIEW_IPC_TOKEN";
+var START_TIMEOUT_MS = 27e4;
+var SHORT_TIMEOUT_MS = 2e4;
+var PREVIEW_TOOLS = [
+  {
+    name: "start_preview",
+    description: "Open this project's live Preview in the user's CodeAgent app \u2014 the same thing as their Preview button: it installs dependencies if needed, starts the dev server, publishes it on a public URL and switches the user's screen to it. Use it after you change anything visual (UI, styles, layout, copy) so you and the user can check the result, or whenever the user asks to see the app. Returns the public URL (you can curl it) or the exact error. Reuses a preview that is already running. Usually leave the arguments out: the project is detected automatically. Pass command/args/port only if you know the exact dev command.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: { type: "string", description: 'Dev server executable, e.g. "npm". Optional.' },
+        args: { type: "array", items: { type: "string" }, description: 'e.g. ["run","dev"]. Optional.' },
+        port: { type: "number", description: "Port the dev server listens on. Required with command." },
+        framework: { type: "string", description: 'Label shown to the user, e.g. "next". Optional.' }
+      },
+      additionalProperties: false
+    }
+  },
+  {
+    name: "preview_status",
+    description: "Current state of the Preview: running (with its URL), starting, error (with the reason) or idle. Use it when start_preview answered that the preview is still starting.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    name: "highlight_element",
+    description: 'Point at an element in the running Preview: the user sees your cursor move to it and a labelled box drawn around it, scrolled into view. Use it to show the user exactly what you changed or what you are talking about ("this button", "the header spacing"). Takes a CSS selector (prefer ids, data-testid or specific classes you saw in the code). Several calls add several marks; clear_highlights removes them.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        selector: { type: "string", description: 'CSS selector, e.g. "#checkout" or "[data-testid=hero-cta]".' },
+        label: { type: "string", description: 'Short caption on the mark, e.g. "New CTA". Optional.' }
+      },
+      required: ["selector"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "clear_highlights",
+    description: "Remove every mark you drew in the Preview with highlight_element.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    name: "stop_preview",
+    description: "Stop the Preview (dev server + public URL). Only when the user asks, or to restart it cleanly.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  }
+];
+function previewMcpServer(bridge) {
+  if (!bridge) return null;
+  return {
+    name: PREVIEW_MCP_SERVER_NAME,
+    // Same runtime + entrypoint as this CLI — never trust the agent's PATH.
+    command: process.execPath,
+    args: [process.argv[1], "preview-mcp"],
+    // The token rides the owner-only secrets file, never this env: the
+    // claude ACP adapter copies MCP env onto argv (codeagent-5bew).
+    env: [{ name: PREVIEW_IPC_URL_ENV, value: bridge.url }, ...mcpSecretEnv("preview", { [PREVIEW_IPC_TOKEN_ENV]: bridge.token })]
+  };
+}
+function httpCall(baseUrl, token) {
+  return async (path97, method, body, timeoutMs) => {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${baseUrl}${path97}`, {
+        method,
+        headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+        ...method === "POST" ? { body: JSON.stringify(body ?? {}) } : {},
+        signal: ac.signal
+      });
+      return await res.json();
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+async function runPreviewTool(name, args2, call) {
+  switch (name) {
+    case "start_preview":
+      return describeResult(await call("/preview/start", "POST", args2, START_TIMEOUT_MS));
+    case "preview_status":
+      return describeResult(await call("/preview/status", "GET", void 0, SHORT_TIMEOUT_MS));
+    case "highlight_element":
+      return describeAck(await call("/preview/highlight", "POST", args2, SHORT_TIMEOUT_MS));
+    case "clear_highlights":
+      return describeAck(await call("/preview/highlight", "POST", { clear: true }, SHORT_TIMEOUT_MS));
+    case "stop_preview":
+      return describeAck(await call("/preview/stop", "POST", {}, SHORT_TIMEOUT_MS));
+    default:
+      return { text: `Unknown tool: ${name}`, isError: true };
+  }
+}
+function describeResult(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  switch (r.status) {
+    case "running": {
+      const inspector = r.inspector ? " You can point at elements with highlight_element." : " (No element highlighting for this framework.)";
+      return {
+        text: `Preview ${r.reused ? "already running" : "is live"}: ${String(r.url)} (${String(r.framework)}). The user's app is showing it now.${inspector}`,
+        isError: false
+      };
+    }
+    case "starting":
+      return { text: String(r.message ?? "The preview is starting."), isError: false };
+    case "idle":
+      return { text: "No preview is running.", isError: false };
+    case "error":
+      return {
+        text: `Preview failed at ${String(r.stage)}: ${String(r.message)}`,
+        isError: true
+      };
+    default:
+      return { text: `Unexpected answer from the preview bridge: ${JSON.stringify(raw)}`, isError: true };
+  }
+}
+function describeAck(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  return { text: String(r.message ?? r.error ?? "done"), isError: r.ok !== true };
+}
+async function previewMcp() {
+  const url2 = process.env[PREVIEW_IPC_URL_ENV];
+  const token = process.env[PREVIEW_IPC_TOKEN_ENV];
+  const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { ListToolsRequestSchema, CallToolRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
+  const call = url2 && token ? httpCall(url2, token) : null;
+  const server = new Server({ name: PREVIEW_MCP_SERVER_NAME, version: "1.0.0" }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: PREVIEW_TOOLS }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    if (!call) {
+      return {
+        content: [{ type: "text", text: "Preview is not available in this session." }],
+        isError: true
+      };
+    }
+    try {
+      const { text, isError: isError2 } = await runPreviewTool(
+        req.params.name,
+        req.params.arguments ?? {},
+        call
+      );
+      return { content: [{ type: "text", text }], isError: isError2 };
+    } catch (err) {
+      const aborted = err instanceof Error && err.name === "AbortError";
+      return {
+        content: [
+          {
+            type: "text",
+            text: aborted ? "The preview is taking long \u2014 it keeps going in the background; call preview_status shortly." : `Preview bridge unreachable: ${err instanceof Error ? err.message : String(err)}`
+          }
+        ],
+        isError: !aborted
+      };
+    }
+  });
+  await server.connect(new StdioServerTransport());
+}
+
 // src/integrations/provision.ts
+function secretVars(ctx) {
+  return {
+    ...ctx.pluginAuthToken ? { CODEAM_MCP_PLUGIN_TOKEN: ctx.pluginAuthToken } : {},
+    ...ctx.pollSecret ? { CODEAM_MCP_POLL_SECRET: ctx.pollSecret } : {}
+  };
+}
 function buildMcpServersForStart(ctx) {
+  const servers = buildIntegrationMcpServers(ctx);
+  const preview = previewMcpServer(ctx.preview ?? null);
+  return preview ? [...servers, preview] : servers;
+}
+function buildIntegrationMcpServers(ctx) {
   const manifest = readIntegrationsManifest();
   if (!manifest || manifest.integrations.length === 0) return [];
   if (!ctx.pluginAuthToken) {
@@ -39360,9 +39930,10 @@ function buildMcpServersForStart(ctx) {
       { name: "CODEAM_MCP_INTEGRATION_ID", value: entry.id },
       { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
       { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
-      // Plugin token in ENV, never argv — argv is visible via `ps`.
-      { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
-      ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+      // ⚠️ Secrets via an owner-only FILE, not env values: the claude ACP
+      // adapter copies this env onto the agent's argv (`--mcp-config`), where
+      // `ps` shows it (codeagent-5bew). See `mcp-secrets.ts`.
+      ...mcpSecretEnv("integrations", secretVars(ctx))
     ];
     servers.push({
       name: entry.id,
@@ -39391,8 +39962,7 @@ function buildMcpServersForStart(ctx) {
         env: [
           { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
           { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
-          { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
-          ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+          ...mcpSecretEnv("integrations", secretVars(ctx))
         ]
       }
     ];
@@ -39518,6 +40088,299 @@ function mergeWithLocalMcpServers(integrationServers) {
   return merged;
 }
 
+// src/commands/start/agent-preview-bridge.ts
+var http11 = __toESM(require("http"));
+var import_node_crypto10 = require("crypto");
+var START_WAIT_MS = 24e4;
+var MAX_SELECTOR = 500;
+var MAX_LABEL = 80;
+var AgentPreviewBridge = class {
+  server = null;
+  listening = null;
+  token = (0, import_node_crypto10.randomBytes)(24).toString("hex");
+  ctx = null;
+  /** The bring-up in flight, so two tool calls never start two dev servers. */
+  inflight = null;
+  lastError = null;
+  bound = null;
+  /** Start the loopback server once. `null` when it could not bind — the
+   *  preview tools are then simply absent, never a failed session. */
+  listen() {
+    if (this.listening) return this.listening;
+    this.listening = new Promise((resolve12) => {
+      const server = http11.createServer((req, res) => {
+        void this.handle(req, res);
+      });
+      server.on("error", (err) => {
+        log.warn("agent-preview", `bridge failed to listen: ${String(err)}`);
+        resolve12(null);
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const addr = server.address();
+        if (!addr || typeof addr === "string") {
+          resolve12(null);
+          return;
+        }
+        server.unref();
+        this.server = server;
+        this.bound = { url: `http://127.0.0.1:${addr.port}`, token: this.token };
+        resolve12(this.bound);
+      });
+    });
+    return this.listening;
+  }
+  /** The bound address once {@link listen} resolved, else null (sync, for
+   *  the MCP list rebuilds that happen mid-session). */
+  address() {
+    return this.bound;
+  }
+  /** Bind the live session. Tool calls before this answer "still starting". */
+  attach(ctx) {
+    this.ctx = ctx;
+  }
+  close() {
+    this.server?.close();
+    this.server = null;
+  }
+  // ─── Operations (public for tests) ─────────────────────────────────────
+  async start(override, waitMs = START_WAIT_MS) {
+    const ctx = this.ctx;
+    if (!ctx?.pluginAuthToken) {
+      return {
+        status: "error",
+        stage: "session",
+        message: "The session is still starting (or has no pairing token) \u2014 try again in a few seconds."
+      };
+    }
+    if (!this.inflight) {
+      const run = this.launch(ctx, ctx.pluginAuthToken, override);
+      this.inflight = run;
+      void run.finally(() => {
+        if (this.inflight === run) this.inflight = null;
+      });
+    }
+    const inflight = this.inflight;
+    let timer;
+    const pending = new Promise((resolve12) => {
+      timer = setTimeout(
+        () => resolve12({
+          status: "starting",
+          message: "The preview is still coming up (dependencies or a slow dev server). It keeps going in the background \u2014 call preview_status in a minute."
+        }),
+        waitMs
+      );
+      timer.unref?.();
+    });
+    try {
+      return await Promise.race([inflight, pending]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+  status() {
+    const ctx = this.ctx;
+    if (!ctx) return { status: "idle" };
+    const active2 = serving(ctx.sessionId);
+    if (active2) return running(active2, true);
+    if (this.inflight) return { status: "starting", message: "The preview is starting." };
+    if (this.lastError) return { status: "error", ...this.lastError };
+    return { status: "idle" };
+  }
+  async highlight(input) {
+    const ctx = this.ctx;
+    if (!ctx?.pluginAuthToken) return { ok: false, message: "The session is still starting." };
+    const active2 = serving(ctx.sessionId);
+    if (!active2) {
+      return { ok: false, message: "No preview is running \u2014 call start_preview first." };
+    }
+    if (!active2.inspector) {
+      return {
+        ok: false,
+        message: `Element highlighting needs the web inspector, which ${active2.framework} previews don't have.`
+      };
+    }
+    let payload;
+    if (input.clear === true) {
+      payload = { clear: true };
+    } else {
+      const selector = typeof input.selector === "string" ? input.selector.trim() : "";
+      if (!selector || selector.length > MAX_SELECTOR) {
+        return { ok: false, message: `selector must be a CSS selector of 1-${MAX_SELECTOR} characters.` };
+      }
+      const label = typeof input.label === "string" ? input.label.trim().slice(0, MAX_LABEL) : "";
+      payload = label ? { selector, label } : { selector };
+    }
+    const res = await postPreviewEvent({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      type: USER_EVENTS.PREVIEW_AGENT_HIGHLIGHT,
+      payload
+    });
+    if (!res.ok) {
+      return { ok: false, message: `Could not reach the app (${res.status}): ${res.message}` };
+    }
+    return {
+      ok: true,
+      message: payload.clear === true ? "Cleared your marks from the preview." : `Marked ${String(payload.selector)} in the user's preview. If the selector matches nothing, no mark appears.`
+    };
+  }
+  async stop() {
+    const ctx = this.ctx;
+    if (!ctx?.pluginAuthToken) return { ok: false, message: "The session is still starting." };
+    if (!activePreviews.has(ctx.sessionId)) return { ok: true, message: "No preview was running." };
+    await killPreview(ctx.sessionId);
+    resetBuildHealState(ctx.sessionId);
+    await postPreviewEvent({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken: ctx.pluginAuthToken,
+      type: USER_EVENTS.PREVIEW_STOPPED,
+      payload: { reason: "user", origin: "agent" }
+    });
+    return { ok: true, message: "Preview stopped." };
+  }
+  // ─── Internals ─────────────────────────────────────────────────────────
+  async launch(ctx, pluginAuthToken, override) {
+    this.lastError = null;
+    const already = serving(ctx.sessionId);
+    if (already) {
+      await postPreviewEvent({
+        sessionId: ctx.sessionId,
+        pluginId: ctx.pluginId,
+        pluginAuthToken,
+        type: USER_EVENTS.PREVIEW_READY,
+        payload: {
+          url: already.url,
+          framework: already.framework,
+          port: already.detection.port,
+          origin: "agent"
+        }
+      });
+      return running(already, true);
+    }
+    void postPreviewEvent({
+      sessionId: ctx.sessionId,
+      pluginId: ctx.pluginId,
+      pluginAuthToken,
+      type: USER_EVENTS.PREVIEW_DETECTION_PENDING,
+      payload: { origin: "agent" }
+    });
+    const detection = (override && detectionFromOverride(override)) ?? await resolvePreviewDetection({ ctx, runtime: ctx.getRuntime(), pluginAuthToken, origin: "agent" });
+    if (!detection) {
+      const err2 = { stage: "detection", message: "Could not work out how to start this project." };
+      this.lastError = err2;
+      return { status: "error", ...err2 };
+    }
+    let failure = null;
+    await startPreviewFromDetection(ctx, detection, pluginAuthToken, {
+      origin: "agent",
+      onEvent: (type, payload) => {
+        if (type === USER_EVENTS.PREVIEW_ERROR) {
+          failure = {
+            stage: String(payload.stage ?? "spawn"),
+            message: String(payload.message ?? "The preview failed to start.")
+          };
+        }
+      }
+    });
+    const up = serving(ctx.sessionId);
+    if (up) return running(up, false);
+    const err = failure ?? { stage: "spawn", message: "The preview did not come up." };
+    this.lastError = err;
+    return { status: "error", ...err };
+  }
+  async handle(req, res) {
+    const reply = (code, body) => {
+      res.writeHead(code, { "content-type": "application/json" });
+      res.end(JSON.stringify(body));
+    };
+    if (!authorized(req.headers.authorization, this.token)) return reply(401, { error: "unauthorized" });
+    try {
+      const body = req.method === "POST" ? await readJson(req) : {};
+      switch (`${req.method} ${req.url}`) {
+        case "POST /preview/start":
+          return reply(200, await this.start(overrideFrom(body)));
+        case "GET /preview/status":
+          return reply(200, this.status());
+        case "POST /preview/highlight":
+          return reply(200, await this.highlight(body));
+        case "POST /preview/stop":
+          return reply(200, await this.stop());
+        default:
+          return reply(404, { error: "not found" });
+      }
+    } catch (err) {
+      log.warn("agent-preview", `bridge request failed: ${String(err)}`);
+      return reply(500, { error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+};
+function serving(sessionId) {
+  const active2 = activePreviews.get(sessionId);
+  if (!active2 || active2.devServer && active2.devServer.exitCode !== null) return null;
+  return active2;
+}
+function running(active2, reused) {
+  return {
+    status: "running",
+    url: active2.url,
+    framework: active2.framework,
+    ...reused ? { reused: true } : {},
+    inspector: Boolean(active2.inspector)
+  };
+}
+function detectionFromOverride(o) {
+  if (!o.command || !Number.isInteger(o.port) || o.port <= 0 || o.port > 65535) return null;
+  return {
+    framework: o.framework?.trim() || "custom",
+    command: o.command,
+    args: Array.isArray(o.args) ? o.args.map(String) : [],
+    port: o.port,
+    // Any Local/ready/listening line; the TCP probe is the real fallback.
+    ready_pattern: o.ready_pattern?.trim() || "(ready|local:|listening|started server|compiled)"
+  };
+}
+function overrideFrom(body) {
+  if (typeof body.command !== "string" || typeof body.port !== "number") return void 0;
+  return {
+    command: body.command,
+    args: Array.isArray(body.args) ? body.args.map(String) : void 0,
+    port: body.port,
+    framework: typeof body.framework === "string" ? body.framework : void 0,
+    ready_pattern: typeof body.ready_pattern === "string" ? body.ready_pattern : void 0
+  };
+}
+function authorized(header, token) {
+  const presented = Buffer.from((header ?? "").replace(/^Bearer\s+/i, ""));
+  const expected = Buffer.from(token);
+  return presented.length === expected.length && (0, import_node_crypto10.timingSafeEqual)(presented, expected);
+}
+function readJson(req) {
+  return new Promise((resolve12, reject) => {
+    let raw = "";
+    req.setEncoding("utf8");
+    req.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > 64e3) {
+        reject(new Error("body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => {
+      if (!raw) return resolve12({});
+      try {
+        const parsed = JSON.parse(raw);
+        resolve12(parsed && typeof parsed === "object" ? parsed : {});
+      } catch {
+        reject(new Error("invalid JSON"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+var agentPreviewBridge = new AgentPreviewBridge();
+
 // src/integrations/detect-stack.ts
 var import_node_fs13 = __toESM(require("fs"));
 var import_node_path13 = __toESM(require("path"));
@@ -39669,7 +40532,7 @@ function logMentionOutcome(result) {
 }
 
 // src/agents/acp/command-handlers.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process24 = require("child_process");
 
 // src/agents/acp/buildAcpPromptBlocks.ts
 var MIME_FROM_EXT = {
@@ -40631,7 +41494,7 @@ async function prewarmNewMcpEntries(manifest, previousIds) {
     fresh.map(
       (e) => new Promise((resolve12) => {
         const mcp = e.delivery.mcp;
-        const child = (0, import_node_child_process23.execFile)(
+        const child = (0, import_node_child_process24.execFile)(
           mcp.command,
           [...mcp.args, "--help"],
           { timeout: 9e4 },
@@ -40658,7 +41521,8 @@ async function integrationsSyncH(ctx) {
         sessionId: opts.sessionId,
         pluginId: opts.pluginId,
         pluginAuthToken: opts.pluginAuthToken,
-        pollSecret: opts.pollSecret
+        pollSecret: opts.pollSecret,
+        preview: agentPreviewBridge.address()
       })
     );
     const applied = await client3.reprovisionMcp(servers);
@@ -41295,7 +42159,7 @@ var AcpHistory = class {
       this.summary = trimmed.length > 120 ? trimmed.slice(0, 117) + "\u2026" : trimmed;
     }
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "user",
       text,
       timestamp: Date.now(),
@@ -41311,7 +42175,7 @@ var AcpHistory = class {
   appendAgentReply(text, agentId = this.opts.agent) {
     if (text.length === 0) return;
     this.messages.push({
-      id: (0, import_node_crypto10.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       role: "agent",
       text,
       timestamp: Date.now(),
@@ -41799,11 +42663,11 @@ async function runAcpSession(opts) {
     if (swapOpts.house) {
       houseWireId = swapOpts.wireId ?? HOUSE_AGENT_ID;
       if (pendingHouseConfig) {
-        persistHouseProxyConfig(pendingHouseConfig);
+        persistHouseProxyConfig(pendingHouseConfig, deployIdFromWorkspace(process.cwd()) ?? void 0);
         pendingHouseConfig = null;
       }
     } else if (wasHouse) {
-      clearHouseProxyConfig();
+      clearHouseProxyConfig(deployIdFromWorkspace(process.cwd()) ?? void 0);
     }
     const managedBanner = swapOpts.house && isManagedProviderId(houseWireId) ? houseWireId : null;
     void publisher.publishOutput({
@@ -41842,17 +42706,17 @@ async function runAcpSession(opts) {
       switchCredentialEnv = provisionAgentCredentials(agentId, auth);
     },
     provisionHouseProxy: ({ baseUrl, token, model, managedAgentId }) => {
-      const claudeConfigDir = path80.join(
-        os53.homedir(),
+      const claudeConfigDir = path82.join(
+        os55.homedir(),
         ".codeam",
         "house-claude",
         `switch-${opts.pluginId}`
       );
       try {
-        fs69.mkdirSync(claudeConfigDir, { recursive: true, mode: 448 });
+        fs71.mkdirSync(claudeConfigDir, { recursive: true, mode: 448 });
       } catch {
       }
-      const memoryFile = path80.join(claudeConfigDir, "CLAUDE.md");
+      const memoryFile = path82.join(claudeConfigDir, "CLAUDE.md");
       ensureBeadsWorkflowHint(void 0, memoryFile);
       ensureAgentStandard(void 0, memoryFile);
       const cfg = {
@@ -43075,9 +43939,9 @@ function pickPinnedSession(pinnedId, listSessions2) {
 }
 
 // src/agents/retired-proxy-cleanup.ts
-var fs70 = __toESM(require("fs"));
-var path81 = __toESM(require("path"));
-var os54 = __toESM(require("os"));
+var fs72 = __toESM(require("fs"));
+var path83 = __toESM(require("path"));
+var os56 = __toESM(require("os"));
 var RETIRED_PROXY_RE = /^https?:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):8787(?:[/?#]|$)/i;
 var HEADROOM_CMD_RE = /(^|[\s/"'])headroom(\s|$)/i;
 var MARKETPLACE_KEY = "headroom-marketplace";
@@ -43086,12 +43950,12 @@ function isHeadroomHook(group) {
     (h) => typeof h?.command === "string" && HEADROOM_CMD_RE.test(h.command)
   );
 }
-function sanitizeRetiredProxyConfig(homeDir2 = os54.homedir()) {
+function sanitizeRetiredProxyConfig(homeDir2 = os56.homedir()) {
   const out2 = { inspected: false, changed: false, removed: [] };
-  const file = path81.join(homeDir2, ".claude", "settings.json");
+  const file = path83.join(homeDir2, ".claude", "settings.json");
   let parsed;
   try {
-    parsed = JSON.parse(fs70.readFileSync(file, "utf8"));
+    parsed = JSON.parse(fs72.readFileSync(file, "utf8"));
   } catch {
     return out2;
   }
@@ -43133,9 +43997,9 @@ function sanitizeRetiredProxyConfig(homeDir2 = os54.homedir()) {
   if (!out2.changed) return out2;
   try {
     const tmp = `${file}.codeam.tmp`;
-    fs70.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}
+    fs72.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}
 `, { mode: 384 });
-    fs70.renameSync(tmp, file);
+    fs72.renameSync(tmp, file);
   } catch {
     out2.changed = false;
   }
@@ -43667,7 +44531,7 @@ var AcpDriver = class {
 };
 
 // src/baton/transcript-mirror.ts
-var fs71 = __toESM(require("fs"));
+var fs73 = __toESM(require("fs"));
 var TranscriptMirror = class {
   constructor(deps) {
     this.deps = deps;
@@ -43761,7 +44625,7 @@ var TranscriptMirror = class {
   }
 };
 function defaultWatch(file, onChange) {
-  const w3 = fs71.watch(file, { persistent: false }, () => onChange());
+  const w3 = fs73.watch(file, { persistent: false }, () => onChange());
   return () => w3.close();
 }
 
@@ -44071,7 +44935,7 @@ function toEpochMs(ts) {
 }
 
 // src/services/keep-awake.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 function keepDeviceAwake(deps = {}) {
   const env = deps.env ?? process.env;
   const isLocal = deps.isLocal ?? isLocalSession(env);
@@ -44081,7 +44945,7 @@ function keepDeviceAwake(deps = {}) {
   if (env.CODEAM_NO_KEEP_AWAKE === "1") return noop;
   const command2 = deps.command !== void 0 ? deps.command : createOsStrategy().keepAwakeCommand(deps.pid ?? process.pid);
   if (!command2) return noop;
-  const spawnFn = deps.spawnFn ?? import_node_child_process24.spawn;
+  const spawnFn = deps.spawnFn ?? import_node_child_process25.spawn;
   let child = null;
   try {
     child = spawnFn(command2.cmd, command2.args, { stdio: "ignore", detached: true });
@@ -44107,16 +44971,16 @@ function keepDeviceAwake(deps = {}) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs72 = __toESM(require("fs"));
-var os56 = __toESM(require("os"));
-var path82 = __toESM(require("path"));
+var fs74 = __toESM(require("fs"));
+var os58 = __toESM(require("os"));
+var path84 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path82.join(os56.homedir(), ".claude.json");
+    const file = path84.join(os58.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs72.readFileSync(file, "utf8"));
+      config = JSON.parse(fs74.readFileSync(file, "utf8"));
     } catch {
     }
     let changed = false;
@@ -44141,8 +45005,8 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs72.mkdirSync(path82.dirname(file), { recursive: true });
-    fs72.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs74.mkdirSync(path84.dirname(file), { recursive: true });
+    fs74.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
       `pre-completed Claude onboarding${cwd ? ` + trusted workspace ${cwd}` : ""}`
@@ -44265,12 +45129,20 @@ async function start(requestedAgent, presetSession) {
       agent: isHouseProxyEnv(process.env) ? houseRailWireId(process.env) : session.agent
     });
   }
+  const previewBridge = await agentPreviewBridge.listen();
+  agentPreviewBridge.attach({
+    sessionId: session.id,
+    pluginId,
+    pluginAuthToken: session.pluginAuthToken ?? void 0,
+    getRuntime: () => createInteractiveAgentStrategy(session.agent, createOsStrategy())
+  });
   const mcpServers = mergeWithLocalMcpServers(
     buildMcpServersForStart({
       sessionId: session.id,
       pluginId,
       pluginAuthToken: session.pluginAuthToken ?? void 0,
-      pollSecret: session.pollSecret
+      pollSecret: session.pollSecret,
+      preview: previewBridge
     })
   );
   provisionSkillsForStart();
@@ -44911,8 +45783,8 @@ var import_picocolors10 = __toESM(require("picocolors"));
 var import_child_process30 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors8 = __toESM(require("picocolors"));
-var path83 = __toESM(require("path"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process30.execFile);
+var path85 = __toESM(require("path"));
+var execFileP6 = (0, import_util4.promisify)(import_child_process30.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -44929,11 +45801,11 @@ var GitHubCodespacesProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP5("gh", ["--version"], { maxBuffer: MAX_BUFFER });
+      await execFileP6("gh", ["--version"], { maxBuffer: MAX_BUFFER });
     } catch {
       await this.tryInstallGh();
       try {
-        await execFileP5("gh", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("gh", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         throw new Error(
           [
@@ -44949,7 +45821,7 @@ var GitHubCodespacesProvider = class {
     }
     let isAuthed = false;
     try {
-      await execFileP5("gh", ["auth", "status"], { maxBuffer: MAX_BUFFER });
+      await execFileP6("gh", ["auth", "status"], { maxBuffer: MAX_BUFFER });
       isAuthed = true;
     } catch {
     }
@@ -45025,7 +45897,7 @@ var GitHubCodespacesProvider = class {
    */
   async getActiveGhUser() {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "user", "--jq", ".login"],
         { maxBuffer: MAX_BUFFER }
@@ -45045,7 +45917,7 @@ var GitHubCodespacesProvider = class {
    */
   async hasCodespaceScope() {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "-i", "user"],
         { maxBuffer: MAX_BUFFER }
@@ -45094,7 +45966,7 @@ var GitHubCodespacesProvider = class {
     let installCmd = null;
     if (platform3 === "darwin") {
       try {
-        await execFileP5("brew", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("brew", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         wt(
           [
@@ -45113,7 +45985,7 @@ var GitHubCodespacesProvider = class {
       };
     } else if (platform3 === "win32") {
       try {
-        await execFileP5("winget", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("winget", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         wt(
           [
@@ -45192,7 +46064,7 @@ var GitHubCodespacesProvider = class {
         "200"
       );
       try {
-        const { stdout } = await execFileP5("gh", args2, { maxBuffer: MAX_BUFFER });
+        const { stdout } = await execFileP6("gh", args2, { maxBuffer: MAX_BUFFER });
         return JSON.parse(stdout);
       } catch {
         return [];
@@ -45201,7 +46073,7 @@ var GitHubCodespacesProvider = class {
     const own = await fetchRepos();
     let orgRepos = [];
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "--paginate", "user/orgs", "--jq", ".[].login"],
         { maxBuffer: MAX_BUFFER }
@@ -45238,7 +46110,7 @@ var GitHubCodespacesProvider = class {
    */
   async listMachineTypes(projectId) {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", `/repos/${projectId}/codespaces/machines`],
         { maxBuffer: MAX_BUFFER }
@@ -45269,7 +46141,7 @@ var GitHubCodespacesProvider = class {
     const machine = machineTypeId ?? await this.pickDefaultMachine(projectId);
     const args2 = ["codespace", "create", "-R", projectId, "--default-permissions"];
     if (machine) args2.push("-m", machine);
-    const { stdout } = await execFileP5(
+    const { stdout } = await execFileP6(
       "gh",
       args2,
       { maxBuffer: MAX_BUFFER, timeout: 12e4 }
@@ -45309,7 +46181,7 @@ var GitHubCodespacesProvider = class {
   async waitUntilAvailable(name) {
     const deadline = Date.now() + 5 * 60 * 1e3;
     while (Date.now() < deadline) {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["codespace", "list", "--json", "name,state"],
         { maxBuffer: MAX_BUFFER }
@@ -45327,7 +46199,7 @@ var GitHubCodespacesProvider = class {
   }
   async exec(workspaceId, command2) {
     try {
-      const { stdout, stderr } = await execFileP5(
+      const { stdout, stderr } = await execFileP6(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", command2],
         { maxBuffer: MAX_BUFFER, timeout: 6e5 }
@@ -45400,7 +46272,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path83.posix.dirname(remotePath);
+    const remoteDir = path85.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -45432,7 +46304,7 @@ var GitHubCodespacesProvider = class {
     try {
       const args2 = ["codespace", "list", "--json", "name,displayName,state,lastUsedAt"];
       if (projectId) args2.push("--repo", projectId);
-      const { stdout } = await execFileP5("gh", args2, { maxBuffer: MAX_BUFFER });
+      const { stdout } = await execFileP6("gh", args2, { maxBuffer: MAX_BUFFER });
       const list = JSON.parse(stdout);
       return list.map((c2) => ({
         id: c2.name,
@@ -45447,7 +46319,7 @@ var GitHubCodespacesProvider = class {
   }
   async startWorkspace(workspaceId) {
     try {
-      await execFileP5(
+      await execFileP6(
         "gh",
         ["api", "-X", "POST", `/user/codespaces/${workspaceId}/start`],
         { maxBuffer: MAX_BUFFER, timeout: 6e4 }
@@ -45470,9 +46342,9 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process31 = require("child_process");
 var import_util5 = require("util");
-var path84 = __toESM(require("path"));
+var path86 = __toESM(require("path"));
 var import_picocolors9 = __toESM(require("picocolors"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process31.execFile);
+var execFileP7 = (0, import_util5.promisify)(import_child_process31.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -45489,7 +46361,7 @@ var GitpodProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP6("gitpod", ["--version"], { maxBuffer: MAX_BUFFER2 });
+      await execFileP7("gitpod", ["--version"], { maxBuffer: MAX_BUFFER2 });
     } catch {
       throw new Error(
         [
@@ -45502,7 +46374,7 @@ var GitpodProvider = class {
       );
     }
     try {
-      await execFileP6("gitpod", ["whoami"], { maxBuffer: MAX_BUFFER2 });
+      await execFileP7("gitpod", ["whoami"], { maxBuffer: MAX_BUFFER2 });
       return;
     } catch {
     }
@@ -45522,7 +46394,7 @@ var GitpodProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP6(
+      const { stdout } = await execFileP7(
         "gitpod",
         ["workspace", "list", "--output", "json", "--limit", "200"],
         { maxBuffer: MAX_BUFFER2 }
@@ -45555,7 +46427,7 @@ var GitpodProvider = class {
   async createWorkspace(projectId, machineTypeId) {
     const args2 = ["workspace", "create", projectId, "--start", "--output", "json"];
     if (machineTypeId) args2.push("--class", machineTypeId);
-    const { stdout } = await execFileP6("gitpod", args2, {
+    const { stdout } = await execFileP7("gitpod", args2, {
       maxBuffer: MAX_BUFFER2,
       timeout: 3e5
     });
@@ -45579,7 +46451,7 @@ var GitpodProvider = class {
     const deadline = Date.now() + 5 * 60 * 1e3;
     while (Date.now() < deadline) {
       try {
-        const { stdout } = await execFileP6(
+        const { stdout } = await execFileP7(
           "gitpod",
           ["workspace", "get", workspaceId, "--output", "json"],
           { maxBuffer: MAX_BUFFER2 }
@@ -45597,7 +46469,7 @@ var GitpodProvider = class {
   }
   async listMachineTypes(_projectId) {
     try {
-      const { stdout } = await execFileP6(
+      const { stdout } = await execFileP7(
         "gitpod",
         ["organization", "list-classes", "--output", "json"],
         { maxBuffer: MAX_BUFFER2 }
@@ -45615,7 +46487,7 @@ var GitpodProvider = class {
   async listExistingWorkspaces(projectId) {
     try {
       const args2 = ["workspace", "list", "--output", "json", "--limit", "200"];
-      const { stdout } = await execFileP6("gitpod", args2, { maxBuffer: MAX_BUFFER2 });
+      const { stdout } = await execFileP7("gitpod", args2, { maxBuffer: MAX_BUFFER2 });
       const list = JSON.parse(stdout);
       return list.filter((w3) => !projectId || w3.contextUrl === projectId).map((w3) => ({
         id: w3.id,
@@ -45630,7 +46502,7 @@ var GitpodProvider = class {
   }
   async startWorkspace(workspaceId) {
     try {
-      await execFileP6(
+      await execFileP7(
         "gitpod",
         ["workspace", "start", workspaceId],
         { maxBuffer: MAX_BUFFER2, timeout: 6e4 }
@@ -45646,7 +46518,7 @@ var GitpodProvider = class {
   }
   async exec(workspaceId, command2) {
     try {
-      const { stdout, stderr } = await execFileP6(
+      const { stdout, stderr } = await execFileP7(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", command2],
         { maxBuffer: MAX_BUFFER2, timeout: 6e5 }
@@ -45710,7 +46582,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path84.posix.dirname(remotePath);
+    const remoteDir = path86.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -45746,8 +46618,8 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process32 = require("child_process");
 var import_util6 = require("util");
-var path85 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process32.execFile);
+var path87 = __toESM(require("path"));
+var execFileP8 = (0, import_util6.promisify)(import_child_process32.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -45765,7 +46637,7 @@ var GitLabWorkspacesProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP7("glab", ["--version"], { maxBuffer: MAX_BUFFER3 });
+      await execFileP8("glab", ["--version"], { maxBuffer: MAX_BUFFER3 });
     } catch {
       throw new Error(
         [
@@ -45779,7 +46651,7 @@ var GitLabWorkspacesProvider = class {
       );
     }
     try {
-      await execFileP7("glab", ["auth", "status"], { maxBuffer: MAX_BUFFER3 });
+      await execFileP8("glab", ["auth", "status"], { maxBuffer: MAX_BUFFER3 });
       return;
     } catch {
     }
@@ -45803,7 +46675,7 @@ var GitLabWorkspacesProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP7(
+      const { stdout } = await execFileP8(
         "glab",
         ["repo", "list", "--per-page", "200", "--output", "json"],
         { maxBuffer: MAX_BUFFER3 }
@@ -45935,7 +46807,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async exec(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     try {
-      const { stdout, stderr } = await execFileP7(
+      const { stdout, stderr } = await execFileP8(
         "ssh",
         [
           "-o",
@@ -46006,7 +46878,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path85.posix.dirname(remotePath);
+    const remoteDir = path87.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -46038,7 +46910,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
    */
   async getGlabToken() {
     try {
-      const { stdout, stderr } = await execFileP7(
+      const { stdout, stderr } = await execFileP8(
         "glab",
         ["auth", "status", "--show-token"],
         { maxBuffer: MAX_BUFFER3 }
@@ -46074,8 +46946,8 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process33 = require("child_process");
 var import_util7 = require("util");
-var path86 = __toESM(require("path"));
-var execFileP8 = (0, import_util7.promisify)(import_child_process33.execFile);
+var path88 = __toESM(require("path"));
+var execFileP9 = (0, import_util7.promisify)(import_child_process33.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -46092,7 +46964,7 @@ var RailwayProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP8("railway", ["--version"], { maxBuffer: MAX_BUFFER4 });
+      await execFileP9("railway", ["--version"], { maxBuffer: MAX_BUFFER4 });
     } catch {
       throw new Error(
         [
@@ -46106,7 +46978,7 @@ var RailwayProvider = class {
       );
     }
     try {
-      await execFileP8("railway", ["whoami"], { maxBuffer: MAX_BUFFER4 });
+      await execFileP9("railway", ["whoami"], { maxBuffer: MAX_BUFFER4 });
       return;
     } catch {
     }
@@ -46126,7 +46998,7 @@ var RailwayProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP8(
+      const { stdout } = await execFileP9(
         "railway",
         ["list", "--json"],
         { maxBuffer: MAX_BUFFER4 }
@@ -46142,7 +47014,7 @@ var RailwayProvider = class {
       }));
     } catch {
       try {
-        const { stdout } = await execFileP8("railway", ["list"], { maxBuffer: MAX_BUFFER4 });
+        const { stdout } = await execFileP9("railway", ["list"], { maxBuffer: MAX_BUFFER4 });
         const projects = [];
         for (const line of stdout.split("\n")) {
           const trimmed = line.trim();
@@ -46193,7 +47065,7 @@ var RailwayProvider = class {
   async listExistingWorkspaces(projectId) {
     if (!projectId) return [];
     try {
-      const { stdout } = await execFileP8(
+      const { stdout } = await execFileP9(
         "railway",
         ["service", "list", "--project", projectId, "--json"],
         { maxBuffer: MAX_BUFFER4 }
@@ -46218,7 +47090,7 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     try {
-      await execFileP8(
+      await execFileP9(
         "railway",
         ["service", "restart", "--service", serviceId, "--project", projectId],
         { maxBuffer: MAX_BUFFER4, timeout: 6e4 }
@@ -46237,7 +47109,7 @@ var RailwayProvider = class {
       };
     }
     try {
-      const { stdout, stderr } = await execFileP8(
+      const { stdout, stderr } = await execFileP9(
         "railway",
         ["run", "--project", projectId, "--service", serviceId, "--", "bash", "-lc", command2],
         { maxBuffer: MAX_BUFFER4, timeout: 6e5 }
@@ -46310,7 +47182,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path86.posix.dirname(remotePath);
+    const remoteDir = path88.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -46850,14 +47722,14 @@ async function stopWorkspaceFromLocal(target) {
 }
 
 // src/commands/host/host-client.ts
-var fs73 = __toESM(require("fs"));
-var os57 = __toESM(require("os"));
-var path87 = __toESM(require("path"));
-var import_node_crypto11 = require("crypto");
+var fs75 = __toESM(require("fs"));
+var os59 = __toESM(require("os"));
+var path89 = __toESM(require("path"));
+var import_node_crypto12 = require("crypto");
 function sampleCpuTimes() {
   let idle = 0;
   let total = 0;
-  for (const cpu of os57.cpus()) {
+  for (const cpu of os59.cpus()) {
     const t2 = cpu.times;
     idle += t2.idle;
     total += t2.user + t2.nice + t2.sys + t2.idle + t2.irq;
@@ -46876,8 +47748,8 @@ var MetricsCollector = class {
     const prev = this.prevCpu;
     this.prevCpu = current2;
     if (!prev) {
-      const cores = os57.cpus().length || 1;
-      const proxy = os57.loadavg()[0] / cores * 100;
+      const cores = os59.cpus().length || 1;
+      const proxy = os59.loadavg()[0] / cores * 100;
       return Math.min(100, Math.max(0, Math.round(proxy)));
     }
     const idleDelta = current2.idle - prev.idle;
@@ -46890,8 +47762,8 @@ var MetricsCollector = class {
   collect() {
     return {
       cpuPct: this.cpuPct(),
-      ramUsedMb: Math.round((os57.totalmem() - os57.freemem()) / 1048576),
-      ramTotalMb: Math.round(os57.totalmem() / 1048576),
+      ramUsedMb: Math.round((os59.totalmem() - os59.freemem()) / 1048576),
+      ramTotalMb: Math.round(os59.totalmem() / 1048576),
       latencyMs: this.lastLatencyMs
     };
   }
@@ -46900,19 +47772,19 @@ function apiBase() {
   return process.env.CODEAM_API_URL ?? resolveApiBaseUrl();
 }
 function hostIdentityPath() {
-  return path87.join(os57.homedir(), ".codeam", "host-agent.json");
+  return path89.join(os59.homedir(), ".codeam", "host-agent.json");
 }
 function collectOsInfo() {
   return {
-    distro: os57.platform(),
-    arch: os57.arch(),
-    kernel: os57.release(),
+    distro: os59.platform(),
+    arch: os59.arch(),
+    kernel: os59.release(),
     nodeVersion: process.versions.node
   };
 }
 function loadHostIdentity() {
   try {
-    const raw = fs73.readFileSync(hostIdentityPath(), "utf8");
+    const raw = fs75.readFileSync(hostIdentityPath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
       const p2 = parsed;
@@ -46931,8 +47803,8 @@ function loadHostIdentity() {
 }
 function saveHostIdentity(identity) {
   const file = hostIdentityPath();
-  fs73.mkdirSync(path87.dirname(file), { recursive: true, mode: 448 });
-  fs73.writeFileSync(file, JSON.stringify(identity, null, 2), {
+  fs75.mkdirSync(path89.dirname(file), { recursive: true, mode: 448 });
+  fs75.writeFileSync(file, JSON.stringify(identity, null, 2), {
     encoding: "utf8",
     mode: 384
   });
@@ -46977,7 +47849,7 @@ function isTerminalEnrollError(err) {
 }
 function deleteHostIdentity() {
   try {
-    fs73.rmSync(hostIdentityPath(), { force: true });
+    fs75.rmSync(hostIdentityPath(), { force: true });
   } catch {
   }
 }
@@ -47001,12 +47873,12 @@ async function postJson(pathname, body) {
 function resolveHostLabel(label) {
   const explicit = label?.trim();
   const envLabel = process.env.CODEAM_HOST_LABEL?.trim();
-  const resolved = explicit || envLabel || os57.hostname();
+  const resolved = explicit || envLabel || os59.hostname();
   return resolved.slice(0, 80);
 }
 async function redeemEnrollToken(token, label) {
-  const controlPollSecret = (0, import_node_crypto11.randomBytes)(32).toString("base64url");
-  const pluginSecretHash = (0, import_node_crypto11.createHash)("sha256").update(controlPollSecret).digest("hex");
+  const controlPollSecret = (0, import_node_crypto12.randomBytes)(32).toString("base64url");
+  const pluginSecretHash = (0, import_node_crypto12.createHash)("sha256").update(controlPollSecret).digest("hex");
   const data = await postJson("/api/self-hosted/redeem", {
     token,
     label: resolveHostLabel(label),
@@ -47190,9 +48062,9 @@ async function host(args2) {
 
 // src/commands/host-agent.ts
 var import_node_child_process30 = require("child_process");
-var os62 = __toESM(require("os"));
-var fs78 = __toESM(require("fs"));
-var path92 = __toESM(require("path"));
+var os63 = __toESM(require("os"));
+var fs79 = __toESM(require("fs"));
+var path93 = __toESM(require("path"));
 
 // src/skills/persist-from-payload.ts
 function persistOrClearSkillsFromPayload(skills) {
@@ -47201,13 +48073,13 @@ function persistOrClearSkillsFromPayload(skills) {
 }
 
 // src/commands/host/session-state.ts
-var fs74 = __toESM(require("fs"));
-var os58 = __toESM(require("os"));
-var path88 = __toESM(require("path"));
+var fs76 = __toESM(require("fs"));
+var os60 = __toESM(require("os"));
+var path90 = __toESM(require("path"));
 function hostSessionStatePath(env = process.env) {
   const override = env.CODEAM_HOST_SESSION_STATE_FILE;
   if (override && override.trim()) return override.trim();
-  return path88.join(os58.homedir(), ".codeam", "host-agent-sessions.json");
+  return path90.join(os60.homedir(), ".codeam", "host-agent-sessions.json");
 }
 function isRecord5(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -47218,7 +48090,7 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
   return {
     load() {
       try {
-        const raw = JSON.parse(fs74.readFileSync(file, "utf8"));
+        const raw = JSON.parse(fs76.readFileSync(file, "utf8"));
         return Array.isArray(raw?.sessions) ? raw.sessions.filter(isRecord5) : [];
       } catch {
         return [];
@@ -47226,18 +48098,18 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
     },
     save(list) {
       try {
-        fs74.mkdirSync(path88.dirname(file), { recursive: true, mode: 448 });
+        fs76.mkdirSync(path90.dirname(file), { recursive: true, mode: 448 });
         const tmp = `${file}.${process.pid}.tmp`;
-        fs74.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
+        fs76.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
           mode: 384
         });
-        fs74.renameSync(tmp, file);
+        fs76.renameSync(tmp, file);
       } catch {
       }
     },
     clear() {
       try {
-        fs74.rmSync(file, { force: true });
+        fs76.rmSync(file, { force: true });
       } catch {
       }
     }
@@ -47260,181 +48132,22 @@ function planSessionResume(records, max) {
   return { resume: ordered.slice(0, bound), dropped: ordered.slice(bound) };
 }
 function pickSavedSessionForWorkspace(sessions3, cwd) {
-  const target = path88.resolve(cwd);
+  const target = path90.resolve(cwd);
   const matches = sessions3.filter(
-    (s) => !!s.cwd && path88.resolve(s.cwd) === target && !!s.pluginId && !!s.pollSecret && !!s.agent
+    (s) => !!s.cwd && path90.resolve(s.cwd) === target && !!s.pluginId && !!s.pollSecret && !!s.agent
   );
   if (matches.length === 0) return null;
   matches.sort((a, b) => b.pairedAt - a.pairedAt);
   return matches[0];
 }
 
-// src/commands/host/workspace.ts
-var fs75 = __toESM(require("fs"));
-var os59 = __toESM(require("os"));
-var path89 = __toESM(require("path"));
-var import_node_child_process25 = require("child_process");
-var import_node_util5 = require("util");
-var execFileP9 = (0, import_node_util5.promisify)(import_node_child_process25.execFile);
-function isAbsolutePathTarget(target) {
-  return path89.isAbsolute(target);
-}
-function selfHostedWorkspaceRoot() {
-  return path89.join(os59.homedir(), ".codeam", "self-hosted");
-}
-function deployIdFromWorkspace(cwd) {
-  if (!cwd) return null;
-  const root = selfHostedWorkspaceRoot();
-  const resolved = path89.resolve(cwd);
-  const rel = path89.relative(root, resolved);
-  if (!rel || rel.startsWith("..") || path89.isAbsolute(rel)) return null;
-  const parts = rel.split(path89.sep).filter(Boolean);
-  if (parts.length !== 1) return null;
-  return parts[0];
-}
-function nonInteractiveGitEnv() {
-  return {
-    ...process.env,
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_ASKPASS: "",
-    GCM_INTERACTIVE: "never"
-  };
-}
-function githubOwnerRepo(repoRef) {
-  const trimmed = repoRef.trim();
-  const shorthand = /^([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
-  if (shorthand && !/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@")) {
-    return { owner: shorthand[1], repo: shorthand[2] };
-  }
-  const httpsMatch = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(trimmed);
-  if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
-  return null;
-}
-function gitlabProjectPath(repoRef) {
-  const trimmed = repoRef.trim();
-  const https9 = /^https?:\/\/gitlab\.com\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
-  if (https9) return https9[1];
-  if (!/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@") && trimmed.includes("/")) {
-    return trimmed.replace(/\.git$/, "");
-  }
-  return null;
-}
-function repoCloneUrl(repoRef, cloneToken, provider = "github") {
-  const trimmed = repoRef.trim();
-  if (provider === "gitlab") {
-    const glPath = gitlabProjectPath(trimmed);
-    if (glPath) {
-      return cloneToken ? `https://oauth2:${cloneToken}@gitlab.com/${glPath}.git` : `https://gitlab.com/${glPath}.git`;
-    }
-    if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
-  }
-  if (cloneToken) {
-    const gh = githubOwnerRepo(trimmed);
-    if (gh) {
-      return `https://x-access-token:${cloneToken}@github.com/${gh.owner}/${gh.repo}.git`;
-    }
-  }
-  if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
-  return `https://github.com/${trimmed.replace(/\.git$/, "")}.git`;
-}
-function maskCloneUrl(url2) {
-  return url2.replace(/(https?:\/\/)[^@/]+@/, "$1***@");
-}
-async function fetchGithubIdentity(token) {
-  try {
-    const res = await fetch("https://api.github.com/user", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "User-Agent": "codeam-cli",
-        Accept: "application/vnd.github+json"
-      }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    return { login: body.login, email: body.email ?? void 0 };
-  } catch {
-    return null;
-  }
-}
-async function configureGitCredentials(dest, repoRef, cloneToken, provider = "github") {
-  const isGitlab = provider === "gitlab";
-  if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
-  if (!cloneToken) return;
-  const credFile = path89.join(dest, ".git", "codeam-credentials");
-  const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
-` : `https://x-access-token:${cloneToken}@github.com
-`;
-  fs75.writeFileSync(credFile, credLine, { mode: 384 });
-  restrictToOwner(credFile);
-  const env = nonInteractiveGitEnv();
-  const git2 = (args2) => execFileP9("git", ["-C", dest, ...args2], { timeout: 3e4, env });
-  const credFilePosix = credFile.split(path89.sep).join("/");
-  await git2(["config", "--local", "--replace-all", "credential.helper", ""]).catch(() => {
-  });
-  await git2([
-    "config",
-    "--local",
-    "--add",
-    "credential.helper",
-    `store --file=${credFilePosix}`
-  ]).catch(() => {
-  });
-  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef, void 0, provider)]).catch(() => {
-  });
-  const hasIdentity = await git2(["config", "user.email"]).then(() => true).catch(() => false);
-  if (!hasIdentity) {
-    const who = isGitlab ? null : await fetchGithubIdentity(cloneToken);
-    const login = who?.login ?? "CodeAgent";
-    await git2(["config", "--local", "user.name", login]).catch(() => {
-    });
-    const email = who?.email ?? (isGitlab ? "agent@codeagent-mobile.com" : `${login}@users.noreply.github.com`);
-    await git2(["config", "--local", "user.email", email]).catch(() => {
-    });
-  }
-}
-function maskToken(text, cloneToken) {
-  const masked = maskCloneUrl(text);
-  if (cloneToken && cloneToken.length > 0) {
-    return masked.split(cloneToken).join("***");
-  }
-  return masked;
-}
-async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github", branch) {
-  if (isAbsolutePathTarget(repoOrPath)) {
-    if (!fs75.existsSync(repoOrPath)) {
-      throw new Error(`deploy target path does not exist: ${repoOrPath}`);
-    }
-    return repoOrPath;
-  }
-  const dest = path89.join(selfHostedWorkspaceRoot(), deployId);
-  if (fs75.existsSync(path89.join(dest, ".git"))) {
-    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
-    return dest;
-  }
-  fs75.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
-  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
-  const cloneArgs = branch ? ["clone", "--depth", "1", "--branch", branch, cloneUrl, dest] : ["clone", "--depth", "1", cloneUrl, dest];
-  try {
-    await execFileP9("git", cloneArgs, {
-      timeout: 12e4,
-      maxBuffer: 16 * 1024 * 1024,
-      env: nonInteractiveGitEnv()
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(`git clone failed for ${maskCloneUrl(cloneUrl)}: ${maskToken(reason, cloneToken)}`);
-  }
-  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
-  return dest;
-}
-
 // src/commands/host/git-tooling.ts
 var import_node_child_process26 = require("child_process");
-var fs76 = __toESM(require("fs"));
-var os60 = __toESM(require("os"));
-var path90 = __toESM(require("path"));
+var fs77 = __toESM(require("fs"));
+var os61 = __toESM(require("os"));
+var path91 = __toESM(require("path"));
 function codeamBinDir() {
-  return process.env.CODEAM_BIN_DIR ?? path90.join(os60.homedir(), ".codeam", "bin");
+  return process.env.CODEAM_BIN_DIR ?? path91.join(os61.homedir(), ".codeam", "bin");
 }
 var FALLBACK_GH_VERSION = "2.62.0";
 var RELEASE_API = "https://api.github.com/repos/cli/cli/releases/latest";
@@ -47466,7 +48179,7 @@ async function download(url2, dest) {
     const res = await fetch(url2, { headers: { "User-Agent": "codeam-cli" } });
     if (!res.ok || !res.body) return false;
     const buf = Buffer.from(await res.arrayBuffer());
-    fs76.writeFileSync(dest, buf);
+    fs77.writeFileSync(dest, buf);
     return true;
   } catch {
     return false;
@@ -47489,8 +48202,8 @@ async function ensureGhCli(runner, token, deps = {}) {
     const version3 = await resolveVersionFn(token);
     const asset = `gh_${version3}_${osToken}_${arch2}`;
     const url2 = `https://github.com/cli/cli/releases/download/v${version3}/${asset}.${ext}`;
-    const tmpRoot = fs76.mkdtempSync(path90.join(os60.tmpdir(), "codeam-gh-"));
-    const archive = path90.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs77.mkdtempSync(path91.join(os61.tmpdir(), "codeam-gh-"));
+    const archive = path91.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "gh download failed \u2014 skipping (git pull/push still work via the credential helper)");
       return null;
@@ -47500,16 +48213,16 @@ async function ensureGhCli(runner, token, deps = {}) {
       log.warn("host-agent", `gh archive extraction failed (code=${String(extract.code)}) \u2014 skipping`);
       return null;
     }
-    const extractedBin = path90.join(tmpRoot, asset, "bin", binaryName);
-    if (!fs76.existsSync(extractedBin)) {
+    const extractedBin = path91.join(tmpRoot, asset, "bin", binaryName);
+    if (!fs77.existsSync(extractedBin)) {
       log.warn("host-agent", "gh binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs76.mkdirSync(binDir, { recursive: true });
-    const target = path90.join(binDir, binaryName);
-    fs76.copyFileSync(extractedBin, target);
-    fs76.chmodSync(target, 493);
+    fs77.mkdirSync(binDir, { recursive: true });
+    const target = path91.join(binDir, binaryName);
+    fs77.copyFileSync(extractedBin, target);
+    fs77.chmodSync(target, 493);
     log.info("host-agent", `gh installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -47546,19 +48259,19 @@ async function ensureGhAuth(runner, ghCmd, token) {
 }
 function ghConfigDir() {
   if (process.env.GH_CONFIG_DIR) return process.env.GH_CONFIG_DIR;
-  if (process.env.XDG_CONFIG_HOME) return path90.join(process.env.XDG_CONFIG_HOME, "gh");
+  if (process.env.XDG_CONFIG_HOME) return path91.join(process.env.XDG_CONFIG_HOME, "gh");
   if (process.platform === "win32" && process.env.APPDATA) {
-    return path90.join(process.env.APPDATA, "GitHub CLI");
+    return path91.join(process.env.APPDATA, "GitHub CLI");
   }
-  return path90.join(os60.homedir(), ".config", "gh");
+  return path91.join(os61.homedir(), ".config", "gh");
 }
 function writeGhHostsToken(token) {
   try {
     const dir = ghConfigDir();
-    const file = path90.join(dir, "hosts.yml");
-    if (fs76.existsSync(file)) return false;
-    fs76.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs76.writeFileSync(
+    const file = path91.join(dir, "hosts.yml");
+    if (fs77.existsSync(file)) return false;
+    fs77.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs77.writeFileSync(
       file,
       `github.com:
     oauth_token: ${token}
@@ -47601,8 +48314,8 @@ async function ensureGlabCli(runner, deps = {}) {
     const version3 = await resolveLatestGlabVersion();
     const asset = `glab_${version3}_${osToken}_${arch2}`;
     const url2 = `https://gitlab.com/gitlab-org/cli/-/releases/v${version3}/downloads/${asset}.${ext}`;
-    const tmpRoot = fs76.mkdtempSync(path90.join(os60.tmpdir(), "codeam-glab-"));
-    const archive = path90.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs77.mkdtempSync(path91.join(os61.tmpdir(), "codeam-glab-"));
+    const archive = path91.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "glab download failed \u2014 skipping (git push/pull still work)");
       return null;
@@ -47613,20 +48326,20 @@ async function ensureGlabCli(runner, deps = {}) {
       return null;
     }
     const candidates = [
-      path90.join(tmpRoot, "bin", binaryName),
-      path90.join(tmpRoot, asset, "bin", binaryName),
-      path90.join(tmpRoot, binaryName)
+      path91.join(tmpRoot, "bin", binaryName),
+      path91.join(tmpRoot, asset, "bin", binaryName),
+      path91.join(tmpRoot, binaryName)
     ];
-    const extractedBin = candidates.find((c2) => fs76.existsSync(c2));
+    const extractedBin = candidates.find((c2) => fs77.existsSync(c2));
     if (!extractedBin) {
       log.warn("host-agent", "glab binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs76.mkdirSync(binDir, { recursive: true });
-    const target = path90.join(binDir, binaryName);
-    fs76.copyFileSync(extractedBin, target);
-    fs76.chmodSync(target, 493);
+    fs77.mkdirSync(binDir, { recursive: true });
+    const target = path91.join(binDir, binaryName);
+    fs77.copyFileSync(extractedBin, target);
+    fs77.chmodSync(target, 493);
     log.info("host-agent", `glab installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -47708,9 +48421,9 @@ var defaultGitToolingRunner = {
 var import_node_child_process28 = require("child_process");
 
 // src/lib/updateNotifier.ts
-var fs77 = __toESM(require("fs"));
-var os61 = __toESM(require("os"));
-var path91 = __toESM(require("path"));
+var fs78 = __toESM(require("fs"));
+var os62 = __toESM(require("os"));
+var path92 = __toESM(require("path"));
 var https8 = __toESM(require("https"));
 var import_node_child_process27 = require("child_process");
 var import_picocolors12 = __toESM(require("picocolors"));
@@ -47719,12 +48432,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path91.join(os61.homedir(), ".codeam");
-  return path91.join(dir, "update-check.json");
+  const dir = path92.join(os62.homedir(), ".codeam");
+  return path92.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs77.readFileSync(cachePath(), "utf8");
+    const raw = fs78.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -47735,10 +48448,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs77.mkdirSync(path91.dirname(file), { recursive: true });
+    fs78.mkdirSync(path92.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs77.writeFileSync(tmp, JSON.stringify(cache));
-    fs77.renameSync(tmp, file);
+    fs78.writeFileSync(tmp, JSON.stringify(cache));
+    fs78.renameSync(tmp, file);
   } catch {
   }
 }
@@ -47812,8 +48525,8 @@ function isLinkedInstall() {
       timeout: 2e3
     }).trim();
     if (!root) return false;
-    const pkgPath = path91.join(root, PKG_NAME);
-    return fs77.lstatSync(pkgPath).isSymbolicLink();
+    const pkgPath = path92.join(root, PKG_NAME);
+    return fs78.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -47849,7 +48562,7 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs77.unlinkSync(cachePath());
+    fs78.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors12.default.green("\u2713")} Updated. Resuming session...
@@ -47865,7 +48578,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.25" : null;
+  const current2 = true ? "2.75.27" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47882,7 +48595,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.25" : null;
+  const current2 = true ? "2.75.27" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -47905,7 +48618,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.25" : null;
+  return true ? "2.75.27" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -48054,6 +48767,9 @@ function isDeployPayload(p2) {
 function isStopPayload(p2) {
   return typeof p2.sessionId === "string";
 }
+function isResumePayload(p2) {
+  return typeof p2.sessionId === "string" && p2.sessionId.length > 0;
+}
 function isCleanupPayload(p2) {
   return typeof p2.deployId === "string" && p2.deployId.length > 0;
 }
@@ -48342,10 +49058,7 @@ var HostAgentSupervisor = class {
     this.heartbeatTimer = setInterval(() => void this.beat(), HEARTBEAT_INTERVAL_MS);
     this.heartbeatTimer.unref?.();
     this.resumePersistedSessions();
-    void reportSessionEvent(
-      { hostId: this.identity.hostId, hostToken: this.identity.hostToken },
-      { event: "reconcile", activeDeployIds: this.activeSessions().map((s) => s.id) }
-    ).catch((err) => log.trace("host-agent", "boot reconcile failed (best-effort)", err));
+    this.reportLiveSet("boot");
     const updateMs = this.selfUpdateIntervalMs();
     if (updateMs > 0) {
       this.selfUpdateTimer = setInterval(() => void this.selfUpdateTick(), updateMs);
@@ -48591,6 +49304,14 @@ var HostAgentSupervisor = class {
       this.stopChild(cmd.payload.sessionId);
       return;
     }
+    if (cmd.type === "self_hosted_resume") {
+      if (!isResumePayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed self_hosted_resume id=${cmd.id}`);
+        return;
+      }
+      this.resumeSavedSession(cmd.payload.sessionId);
+      return;
+    }
     if (cmd.type === "self_hosted_cleanup") {
       if (!isCleanupPayload(cmd.payload)) {
         log.warn("host-agent", `ignoring malformed self_hosted_cleanup id=${cmd.id}`);
@@ -48638,13 +49359,13 @@ var HostAgentSupervisor = class {
     const relay = this.relay;
     if (!relay) return;
     const raw = cmd.payload?.path;
-    const target = typeof raw === "string" && raw.trim() ? path92.resolve(raw.trim()) : os62.homedir();
+    const target = typeof raw === "string" && raw.trim() ? path93.resolve(raw.trim()) : os63.homedir();
     try {
-      const dirents = await fs78.promises.readdir(target, { withFileTypes: true });
+      const dirents = await fs79.promises.readdir(target, { withFileTypes: true });
       const entries = dirents.filter((d3) => !d3.name.startsWith(".")).map((d3) => ({ name: d3.name, isDir: d3.isDirectory() })).sort(
         (a, b) => a.isDir === b.isDir ? a.name.localeCompare(b.name) : a.isDir ? -1 : 1
       );
-      const parent = path92.dirname(target);
+      const parent = path93.dirname(target);
       await relay.sendResult(cmd.id, "completed", {
         path: target,
         // null at the filesystem root so the UI can hide the ".." affordance.
@@ -48991,14 +49712,14 @@ var HostAgentSupervisor = class {
           ...buildHouseProxyChildEnv({ baseUrl, token, openRouter: openRouter === true }),
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        const houseConfigDir = path92.join(
-          os62.homedir(),
+        const houseConfigDir = path93.join(
+          os63.homedir(),
           ".codeam",
           "house-claude",
           payload.deployId
         );
         try {
-          fs78.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
+          fs79.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
         } catch {
         }
         childEnv.CLAUDE_CONFIG_DIR = houseConfigDir;
@@ -49008,7 +49729,7 @@ var HostAgentSupervisor = class {
           token,
           openRouter: !!openRouter,
           claudeConfigDir: houseConfigDir
-        });
+        }, payload.deployId);
       } else {
         const auth = await this.resolveAgentAuth(this.identity, payload.sealedAgentAuth);
         const credEnv = provisionAgentCredentials(payload.agentId, auth, void 0);
@@ -49016,7 +49737,7 @@ var HostAgentSupervisor = class {
           ...credEnv,
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        clearHouseProxyConfig();
+        clearHouseProxyConfig(payload.deployId);
       }
       childEnv = { ...childEnv, CODEAM_AUTO_APPROVE: "1" };
       childEnv = { ...childEnv, CODEAM_HOST_AGENT_CHILD: "1" };
@@ -49024,7 +49745,7 @@ var HostAgentSupervisor = class {
         report("installing", "installing agent CLI");
         await this.runAgentInstall(payload.agentInstallScript);
       }
-      const home = process.env.HOME || os62.homedir();
+      const home = process.env.HOME || os63.homedir();
       childEnv.PATH = `${home}/.local/bin:${process.env.PATH ?? ""}`;
       if (payload.cloneToken) {
         try {
@@ -49032,13 +49753,13 @@ var HostAgentSupervisor = class {
           if ((payload.repoProvider ?? "github") === "gitlab") {
             const glabCmd = await ensureGlabCli(defaultGitToolingRunner);
             if (glabCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path92.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path93.delimiter}${childEnv.PATH}`;
               await ensureGlabAuth(defaultGitToolingRunner, glabCmd, payload.cloneToken);
             }
           } else {
             const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
             if (ghCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path92.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path93.delimiter}${childEnv.PATH}`;
               await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
             }
           }
@@ -49066,9 +49787,9 @@ var HostAgentSupervisor = class {
       );
       if (!payload.suppressOnboardingWelcome) {
         try {
-          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path92.join(os62.homedir(), ".claude");
-          const projectDir = path92.join(cfgDir, "projects", encodeCwd(cwd));
-          const hasPriorConversation = fs78.existsSync(projectDir) && fs78.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
+          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path93.join(os63.homedir(), ".claude");
+          const projectDir = path93.join(cfgDir, "projects", encodeCwd(cwd));
+          const hasPriorConversation = fs79.existsSync(projectDir) && fs79.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
           if (hasPriorConversation) {
             childEnv.CODEAM_RESUME_LATEST = "1";
             log.info(
@@ -49196,7 +49917,7 @@ var HostAgentSupervisor = class {
           );
           continue;
         }
-        this.resumeOne({ deployId: rec.deployId, cwd: rec.cwd, session });
+        this.resumeOne({ deployId: rec.deployId, cwd: rec.cwd, session, agent: rec.agent });
         resumed += 1;
       }
       log.info(
@@ -49219,7 +49940,7 @@ var HostAgentSupervisor = class {
   fallbackResumeTarget() {
     const session = getActiveSession();
     if (!session || !session.pluginId || !session.pollSecret || !session.agent) return null;
-    const cwd = session.cwd && fs78.existsSync(session.cwd) ? session.cwd : process.cwd();
+    const cwd = session.cwd && fs79.existsSync(session.cwd) ? session.cwd : process.cwd();
     const deployId = deployIdFromWorkspace(session.cwd) ?? session.id;
     return { deployId, cwd, session };
   }
@@ -49233,23 +49954,94 @@ var HostAgentSupervisor = class {
     }
     return st3;
   }
+  /**
+   * `self_hosted_resume` — the user opened (or reconnected) a session this box
+   * is not running. A boot resumes only the children that were LIVE when the
+   * box went down, so any other saved session was a dead card: the app said
+   * "waking up — your message is queued", the box woke, and the session never
+   * came back (codeagent-o7lm, QA box 2026-09-25: 4 saved sessions, 2 resumed).
+   *
+   * Resumes it through the same `resumeOne` a boot uses (bounded retries,
+   * house-proxy env, persisted into the live set), then re-reports the live
+   * set so the backend restores the session's host link. No-op when the
+   * session is unknown, lacks its pairing, or its workspace is gone — the app
+   * then keeps its offline state instead of a phantom "waking".
+   */
+  resumeSavedSession(sessionId) {
+    const session = this.listSavedSessions().find((s) => s.id === sessionId);
+    if (!session || !session.pluginId || !session.pollSecret || !session.agent) {
+      log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: no saved pairing on this box`);
+      return;
+    }
+    if (!session.cwd || !fs79.existsSync(session.cwd)) {
+      log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: workspace is gone`);
+      return;
+    }
+    const deployId = deployIdFromWorkspace(session.cwd) ?? session.id;
+    if (this.children.has(deployId)) {
+      log.info("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: already live`);
+      return;
+    }
+    this.resumeOne({ deployId, cwd: session.cwd, session });
+    this.reportLiveSet("resume");
+  }
+  /**
+   * Tell the backend exactly which sessions this host runs. `activeSessions`
+   * (additive) carries the PairedSession id of every child that knows it, so a
+   * link lost to host-identity churn is rebuilt instead of the session
+   * rendering as LOCAL with a reconnect the user cannot perform.
+   */
+  reportLiveSet(why) {
+    const children = [...this.children.values()];
+    void reportSessionEvent(
+      { hostId: this.identity.hostId, hostToken: this.identity.hostToken },
+      {
+        event: "reconcile",
+        activeDeployIds: children.map((c2) => c2.deployId),
+        activeSessions: children.filter((c2) => typeof c2.sessionId === "string").map((c2) => ({ deployId: c2.deployId, sessionId: c2.sessionId, agent: c2.agent })),
+        knownSessions: this.knownSavedSessions()
+      }
+    ).catch((err) => log.trace("host-agent", `${why} reconcile failed (best-effort)`, err));
+  }
+  /**
+   * Every saved session this host could resume — a pairing whose deploy
+   * workspace is still on disk — live or not. The backend links the non-live
+   * ones too, so the app knows they belong to THIS box and wakes + resumes it
+   * when the user opens one, instead of showing a LOCAL session with a
+   * "run codeam in your terminal" the user cannot do (codeagent-bbou).
+   */
+  knownSavedSessions() {
+    try {
+      const persisted = new Map(this.sessionStore.load().map((r) => [r.deployId, r.agent]));
+      for (const c2 of this.children.values()) persisted.set(c2.deployId, c2.agent);
+      return this.listSavedSessions().map((s) => ({ s, deployId: deployIdFromWorkspace(s.cwd) })).filter(
+        (x) => x.deployId !== null && !!x.s.cwd && fs79.existsSync(x.s.cwd)
+      ).map(({ s, deployId }) => {
+        const agent = persisted.get(deployId);
+        return { deployId, sessionId: s.id, ...agent ? { agent } : {} };
+      });
+    } catch {
+      return [];
+    }
+  }
   /** Spawn ONE resume child for `target` (boot, retry, or re-probe). */
   resumeOne(target) {
     const { session, deployId } = target;
     if (this.children.has(deployId)) return;
     const st3 = this.resumeStateFor(target);
     try {
-      const cwd = fs78.existsSync(target.cwd) ? target.cwd : process.cwd();
+      const cwd = fs79.existsSync(target.cwd) ? target.cwd : process.cwd();
       const proc = this.resumeSpawner(
-        { ...readHouseProxyChildEnv(), CODEAM_RESUME_SESSION_ID: session.id },
+        { ...readHouseProxyChildEnv(deployId), CODEAM_RESUME_SESSION_ID: session.id },
         cwd
       );
       const child = {
         deployId,
         proc,
         cwd,
-        agent: session.agent,
-        startedAt: Date.now()
+        agent: target.agent ?? session.agent,
+        startedAt: Date.now(),
+        sessionId: session.id
       };
       this.trackChild(child);
       let tail = "";
@@ -49265,7 +50057,7 @@ var HostAgentSupervisor = class {
           return;
         }
         if (tracked && signal) {
-          this.onResumeChildExit(target, 128 + (os62.constants.signals[signal] ?? 9), `signal ${signal}`);
+          this.onResumeChildExit(target, 128 + (os63.constants.signals[signal] ?? 9), `signal ${signal}`);
           return;
         }
         log.warn(
@@ -49308,7 +50100,7 @@ var HostAgentSupervisor = class {
     if (Date.now() - child.startedAt < CRASH_RESPAWN_MIN_UPTIME_MS) return false;
     const session = pickSavedSessionForWorkspace(this.listSavedSessions(), child.cwd);
     if (!session) return false;
-    const exitCode = typeof code === "number" ? code : 128 + (signal ? os62.constants.signals[signal] ?? 9 : 9);
+    const exitCode = typeof code === "number" ? code : 128 + (signal ? os63.constants.signals[signal] ?? 9 : 9);
     log.warn(
       "host-agent",
       `session deploy=${child.deployId.slice(0, 8)} died (${signal ?? code}) after ${Math.round((Date.now() - child.startedAt) / 1e3)}s \u2014 respawning it (resume)`
@@ -49457,12 +50249,12 @@ var HostAgentSupervisor = class {
       this.untrackChild(deployId);
     }
     const dirs = [
-      path92.join(selfHostedWorkspaceRoot(), deployId),
-      path92.join(os62.homedir(), ".codeam", "house-claude", deployId)
+      path93.join(selfHostedWorkspaceRoot(), deployId),
+      path93.join(os63.homedir(), ".codeam", "house-claude", deployId)
     ];
     for (const dir of dirs) {
       try {
-        fs78.rmSync(dir, { recursive: true, force: true });
+        fs79.rmSync(dir, { recursive: true, force: true });
       } catch (err) {
         log.warn(
           "host-agent",
@@ -49621,9 +50413,9 @@ async function invite() {
 // src/commands/doctor.ts
 var import_node_dns = require("dns");
 var import_node_util6 = require("util");
-var import_node_crypto12 = require("crypto");
-var fs79 = __toESM(require("fs"));
-var path93 = __toESM(require("path"));
+var import_node_crypto13 = require("crypto");
+var fs80 = __toESM(require("fs"));
+var path94 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util6.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -49679,13 +50471,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path93.join(require("os").homedir(), ".codeam");
+  const dir = path94.join(require("os").homedir(), ".codeam");
   try {
-    fs79.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path93.join(dir, ".doctor-probe");
-    fs79.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs79.readFileSync(probe, "utf8");
-    fs79.unlinkSync(probe);
+    fs80.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path94.join(dir, ".doctor-probe");
+    fs80.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs80.readFileSync(probe, "utf8");
+    fs80.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -49725,9 +50517,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os65 = createOsStrategy();
+  const os66 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os65.findInPath(meta.binaryName);
+    const found = os66.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -49749,7 +50541,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path93.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path94.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -49791,9 +50583,9 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.25" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.27" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
-  const diagnosticId = (0, import_node_crypto12.randomUUID)();
+  const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
   const [dns, health] = await Promise.all([
     checkDns(apiBase2),
@@ -50315,7 +51107,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.25" : "unknown";
+  const v = true ? "2.75.27" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -50464,10 +51256,10 @@ var EXIT_CODE_NAMES = {
 };
 
 // src/index.ts
-var os64 = __toESM(require("os"));
+var os65 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os64.homedir();
+    const home = os65.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }
@@ -50513,9 +51305,15 @@ async function main() {
     await commands[command]();
     return;
   }
+  if (command === "mcp-run" || command === "mcp-router" || command === "preview-mcp") {
+    loadMcpSecrets();
+  }
   if (command === "mcp-run") {
     return mcpRun(args);
   }
+  if (command === "preview-mcp") {
+    return previewMcp();
+  }
   if (command === "mcp-warm") {
     await mcpWarm(args);
     return;