codeam-cli 2.75.26 → 2.75.28

package/dist/index.js

@@ -357,8 +357,8 @@ function defaultSpawn(timeoutMs) {
   });
 }
 function resolveConvexBin(cwd) {
-  const local = path94.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
-  if (fs80.existsSync(local)) return { cmd: local, args: [] };
+  const local = path95.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "convex.cmd" : "convex");
+  if (fs81.existsSync(local)) return { cmd: local, args: [] };
   return { cmd: "npx", args: ["--yes", "convex"] };
 }
 function redact(text, key) {
@@ -489,13 +489,13 @@ async function runConvexAdminMcp(client3, id) {
   });
   await server.connect(new StdioServerTransport());
 }
-var import_node_child_process32, fs80, path94, TOOLS;
+var import_node_child_process32, fs81, path95, TOOLS;
 var init_convex_admin_mcp = __esm({
   "src/integrations/convex-admin-mcp.ts"() {
     "use strict";
     import_node_child_process32 = require("child_process");
-    fs80 = __toESM(require("fs"));
-    path94 = __toESM(require("path"));
+    fs81 = __toESM(require("fs"));
+    path95 = __toESM(require("path"));
     TOOLS = [
       {
         name: "tables",
@@ -3431,6 +3431,9 @@ function maybeRotate() {
   } catch {
     return;
   }
+  rotateNow();
+}
+function rotateNow() {
   const archivePath = (n) => n === 0 ? `${debugFilePath}.old` : `${debugFilePath}.${n}`;
   for (let i = MAX_ARCHIVES - 1; i >= 0; i--) {
     const src = archivePath(i);
@@ -3454,6 +3457,7 @@ function appendToFile(line) {
   try {
     if (!fileInitialized) {
       fs.mkdirSync(path.dirname(debugFilePath), { recursive: true, mode: 448 });
+      if (fs.existsSync(debugFilePath)) rotateNow();
       const header = jsonMode ? `${JSON.stringify({
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         level: "info",
@@ -3528,11 +3532,11 @@ function quiet(fn) {
     log.debug(TAG, "ignored sync error", err);
   }
 }
-function rmIfExistsQuiet(path96) {
+function rmIfExistsQuiet(path97) {
   try {
-    fs2.rmSync(path96, { force: true });
+    fs2.rmSync(path97, { force: true });
   } catch (err) {
-    log.debug(TAG, `rmIfExists failed for ${path96}`, err);
+    log.debug(TAG, `rmIfExists failed for ${path97}`, err);
   }
 }
 function killQuiet(target, signal = "SIGTERM") {
@@ -3736,8 +3740,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path96) {
-  return path96.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path97) {
+  return path97.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/error-tracking/index.mjs
@@ -6470,13 +6474,13 @@ var PostHogCoreStateless = class {
       sentFromRoute += batchMessages.length;
     }
   }
-  async _sendOtlpBatch({ path: path96, payload }) {
+  async _sendOtlpBatch({ path: path97, payload }) {
     if (this.disabled) return {
       kind: "fatal",
       error: new Error("The client is disabled")
     };
     const serialized = JSON.stringify(payload);
-    const url2 = `${this.host}/i/v1/${path96}?token=${encodeURIComponent(this.apiKey)}`;
+    const url2 = `${this.host}/i/v1/${path97}?token=${encodeURIComponent(this.apiKey)}`;
     const gzippedPayload = this.disableCompression ? null : await this.compressPayload(serialized);
     const fetchOptions = {
       method: "POST",
@@ -7716,14 +7720,14 @@ async function addSourceContext(frames, openSourceFile = import_promises.open, l
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-async function openRegularSourceFile(path96, openSourceFile, logger) {
+async function openRegularSourceFile(path97, openSourceFile, logger) {
   let fileHandle;
   let isValid = false;
   try {
-    fileHandle = await openSourceFile(path96, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
+    fileHandle = await openSourceFile(path97, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
     const fileStat = await fileHandle.stat();
     if (!fileStat.isFile()) return;
-    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path96}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
+    if (fileStat.size > MAX_CONTEXTLINES_FILE_SIZE) return void logger?.debug(`Skipping source context for oversized file ${path97}: ${fileStat.size} bytes exceeds ${MAX_CONTEXTLINES_FILE_SIZE}`);
     isValid = true;
     return fileHandle;
   } catch {
@@ -7733,8 +7737,8 @@ async function openRegularSourceFile(path96, openSourceFile, logger) {
     });
   }
 }
-async function getContextLinesFromFile(path96, ranges, output, cacheKey, openSourceFile, logger) {
-  const fileHandle = await openRegularSourceFile(path96, openSourceFile, logger);
+async function getContextLinesFromFile(path97, ranges, output, cacheKey, openSourceFile, logger) {
+  const fileHandle = await openRegularSourceFile(path97, openSourceFile, logger);
   if (void 0 === fileHandle) return void LRU_FILE_CONTENTS_FS_READ_FAILED.set(cacheKey, 1);
   const openedFileHandle = fileHandle;
   return new Promise((resolve12) => {
@@ -7836,22 +7840,22 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path96) {
-  return path96.startsWith("node:") || path96.endsWith(".min.js") || path96.endsWith(".min.cjs") || path96.endsWith(".min.mjs") || path96.startsWith("data:");
+function shouldSkipContextLinesForFile(path97) {
+  return path97.startsWith("node:") || path97.endsWith(".min.js") || path97.endsWith(".min.cjs") || path97.endsWith(".min.mjs") || path97.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
   if (void 0 !== frame.colno && frame.colno > MAX_CONTEXTLINES_COLNO) return true;
   return false;
 }
-function makeSourceCacheKey(path96, basePath) {
-  if ((0, import_node_path.isAbsolute)(path96)) return JSON.stringify([
+function makeSourceCacheKey(path97, basePath) {
+  if ((0, import_node_path.isAbsolute)(path97)) return JSON.stringify([
     null,
-    path96
+    path97
   ]);
   return void 0 === basePath ? void 0 : JSON.stringify([
     basePath,
-    path96
+    path97
   ]);
 }
 function rangeExistsInContentCache(cacheKey, range) {
@@ -10512,7 +10516,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.26" : "0.0.0-dev",
+    cliVersion: true ? "2.75.28" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10754,7 +10758,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.26",
+  version: "2.75.28",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12084,7 +12088,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.26" ? { ideVersion: "2.75.26" } : {}
+      ..."2.75.28" ? { ideVersion: "2.75.28" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -12390,10 +12394,10 @@ var WINDOWS_LEGACY_JUNCTIONS = [
   /[\\/]Start Menu([\\/]|$)/i,
   /[\\/]Templates([\\/]|$)/i
 ];
-function isUnsafeWindowsWatchRoot(dir, homedir51) {
+function isUnsafeWindowsWatchRoot(dir, homedir52) {
   const norm = (p2) => p2.replace(/\//g, "\\").replace(/\\+$/, "").toLowerCase();
   const cwd = norm(dir);
-  const home = norm(homedir51);
+  const home = norm(homedir52);
   if (cwd === home) return true;
   if (/^[a-z]:$/.test(cwd)) return true;
   const sysRoots = [
@@ -17123,10 +17127,10 @@ function buildForPlatform(platform3) {
 var import_node_crypto4 = require("crypto");
 
 // src/agents/claude/resolver.ts
-function buildClaudeLaunch(extraArgs = [], os65 = createOsStrategy()) {
-  const found = os65.findInPath("claude") ?? os65.findInPath("claude-code");
+function buildClaudeLaunch(extraArgs = [], os66 = createOsStrategy()) {
+  const found = os66.findInPath("claude") ?? os66.findInPath("claude-code");
   if (!found) return null;
-  return os65.buildLaunch(found, extraArgs);
+  return os66.buildLaunch(found, extraArgs);
 }
 
 // src/agents/claude/installer.ts
@@ -17904,8 +17908,8 @@ var ClaudeRuntimeStrategy = class {
   meta = getAgent("claude");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   /**
    * Claude Code's react-ink TUI enables bracketed-paste mode at
@@ -18999,8 +19003,8 @@ function codexCredentialLocator() {
 function codexLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os65 = createOsStrategy();
-      return os65.findInPath("codex") !== null;
+      const os66 = createOsStrategy();
+      return os66.findInPath("codex") !== null;
     },
     launch() {
       return (0, import_node_child_process3.spawn)("codex", ["login"], { stdio: "inherit" });
@@ -19023,8 +19027,8 @@ var CodexRuntimeStrategy = class {
   meta = getAgent("codex");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     let binary = this.os.findInPath("codex");
@@ -19134,12 +19138,12 @@ var CodexRuntimeStrategy = class {
     });
   }
 };
-function resolveNpm(os65) {
-  return os65.id === "win32" ? "npm.cmd" : "npm";
+function resolveNpm(os66) {
+  return os66.id === "win32" ? "npm.cmd" : "npm";
 }
-async function installCodexViaNpm(os65) {
+async function installCodexViaNpm(os66) {
   return new Promise((resolve12, reject) => {
-    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os65), ["install", "-g", "@openai/codex"], {
+    const proc = (0, import_node_child_process4.spawn)(resolveNpm(os66), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
@@ -19156,16 +19160,16 @@ async function installCodexViaNpm(os65) {
     });
   });
 }
-function augmentNpmGlobalBin(os65) {
+function augmentNpmGlobalBin(os66) {
   try {
-    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os65), ["prefix", "-g"], {
+    const result = (0, import_node_child_process4.spawnSync)(resolveNpm(os66), ["prefix", "-g"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     if (result.status !== 0) return;
     const prefix = result.stdout.toString().trim();
     if (!prefix) return;
-    const binDir = os65.id === "win32" ? prefix : path24.join(prefix, "bin");
-    os65.augmentPath([binDir]);
+    const binDir = os66.id === "win32" ? prefix : path24.join(prefix, "bin");
+    os66.augmentPath([binDir]);
   } catch {
   }
 }
@@ -19359,10 +19363,10 @@ function manualInstallHint(runner, tools) {
   const argv = osPackageInstallArgv(detectPackageManager(runner), [...tools]);
   return argv ? `\`sudo ${argv.join(" ")}\`` : `your package manager (e.g. \`${pkgs}\`)`;
 }
-function writeUnzipShim(os65, runner) {
+function writeUnzipShim(os66, runner) {
   const python = ["python3", "python"].find((p2) => runner.which(p2));
   if (!python) return null;
-  const dir = os65.scratchPath("codeam-cr-prereq");
+  const dir = os66.scratchPath("codeam-cr-prereq");
   const shim = path26.join(dir, "unzip");
   const script = `#!/bin/sh
 set -e
@@ -19384,9 +19388,9 @@ exec ${python} -m zipfile -e "$archive" "$dest"
   (0, import_node_fs5.chmodSync)(shim, 448);
   return dir;
 }
-async function ensureInstallPrerequisites(os65, deps = {}) {
+async function ensureInstallPrerequisites(os66, deps = {}) {
   const runner = deps.runner ?? defaultOsRunner;
-  const missing = REQUIRED_TOOLS.filter((t2) => os65.findInPath(t2) === null);
+  const missing = REQUIRED_TOOLS.filter((t2) => os66.findInPath(t2) === null);
   if (missing.length === 0) return { ok: true, extraPath: [] };
   log.info(
     "coderabbit",
@@ -19405,10 +19409,10 @@ async function ensureInstallPrerequisites(os65, deps = {}) {
       );
     }
   }
-  const stillMissing = REQUIRED_TOOLS.filter((t2) => os65.findInPath(t2) === null);
+  const stillMissing = REQUIRED_TOOLS.filter((t2) => os66.findInPath(t2) === null);
   if (stillMissing.length === 0) return { ok: true, extraPath: [] };
   if (stillMissing.length === 1 && stillMissing[0] === "unzip") {
-    const shimDir = writeUnzipShim(os65, runner);
+    const shimDir = writeUnzipShim(os66, runner);
     if (shimDir) {
       log.info("coderabbit", "unzip is unavailable \u2014 using a scoped python zipfile shim");
       return { ok: true, extraPath: [shimDir] };
@@ -19471,15 +19475,15 @@ function summarizeInstallFailure(output) {
   }
   return lines.length > 0 ? lines[lines.length - 1] : null;
 }
-async function ensureCoderabbitInstalled(os65, deps = {}) {
-  if (os65.findInPath("coderabbit")) return { ok: true };
-  if (os65.id === "win32") {
+async function ensureCoderabbitInstalled(os66, deps = {}) {
+  if (os66.findInPath("coderabbit")) return { ok: true };
+  if (os66.id === "win32") {
     return {
       ok: false,
       error: "CodeRabbit on Windows requires WSL. Install the CLI inside your WSL distribution (curl -fsSL https://cli.coderabbit.ai/install.sh | sh), then try again."
     };
   }
-  const prereq = await ensureInstallPrerequisites(os65, deps);
+  const prereq = await ensureInstallPrerequisites(os66, deps);
   if (!prereq.ok) return { ok: false, error: prereq.error };
   const env = { ...process.env };
   if (prereq.extraPath.length > 0) {
@@ -19488,8 +19492,8 @@ async function ensureCoderabbitInstalled(os65, deps = {}) {
   log.info("coderabbit", "CodeRabbit CLI not found \u2014 installing via the official script");
   const run = deps.runInstallScript ?? defaultRunInstallScript;
   const { code, output } = await run(env);
-  os65.augmentPath([`${os65.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
-  const binary = os65.findInPath("coderabbit");
+  os66.augmentPath([`${os66.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
+  const binary = os66.findInPath("coderabbit");
   const detail = summarizeInstallFailure(output);
   if (binary !== null) {
     if (code === 0) return { ok: true };
@@ -19543,10 +19547,10 @@ function coderabbitCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function coderabbitLoginLauncher(os65) {
+function coderabbitLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      const result = await ensureCoderabbitInstalled(os65);
+      const result = await ensureCoderabbitInstalled(os66);
       if (!result.ok && result.error) console.error(`
   \u2717 ${result.error}
 `);
@@ -19606,8 +19610,8 @@ function pickLine(obj) {
 function toHunk(raw, groupSeverity) {
   if (!raw || typeof raw !== "object") return null;
   const o = raw;
-  const path96 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
-  if (!path96) return null;
+  const path97 = asString(pick(o, ["file_path", "filePath", "file", "path", "filename", "fileName"])) ?? asString(pick(o, ["location"])?.path);
+  if (!path97) return null;
   const message = asString(
     pick(o, [
       "comment",
@@ -19624,7 +19628,7 @@ function toHunk(raw, groupSeverity) {
   const severity = normSeverity(pick(o, ["severity", "level", "priority", "impact"])) ?? normSeverity(groupSeverity);
   const locObj = pick(o, ["location"]) ?? o;
   return {
-    path: path96.trim(),
+    path: path97.trim(),
     line: pickLine(o) ?? pickLine(locObj),
     severity,
     message: (title && message ? `${title}: ${message}` : title || message).trim() || "(no message)"
@@ -19707,10 +19711,10 @@ function parsePlain(stdout) {
   for (const line of stdout.split(/\r?\n/)) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path96, lineNo, sevToken, message] = m;
-    if (!path96 || !lineNo || !message) continue;
+    const [, path97, lineNo, sevToken, message] = m;
+    if (!path97 || !lineNo || !message) continue;
     hunks.push({
-      path: path96.trim(),
+      path: path97.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: message.trim().replace(/^[*-]\s+/, "")
@@ -19770,8 +19774,8 @@ var CoderabbitRuntimeStrategy = class {
   meta = getAgent("coderabbit");
   mode = "batch";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   getDefaultArgs() {
     return ["review", "--agent"];
@@ -20042,10 +20046,10 @@ function cursorCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function cursorLoginLauncher(os65) {
+function cursorLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      if (os65.findInPath("cursor-agent")) return true;
+      if (os66.findInPath("cursor-agent")) return true;
       console.error(
         "\n  \u2717 cursor-agent binary not on PATH.\n    Install Cursor (https://cursor.com/) and ensure the CLI\n    plugin is enabled, then re-run `codeam link cursor`.\n"
       );
@@ -20109,8 +20113,8 @@ var CursorRuntimeStrategy = class {
   meta = getAgent("cursor");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("cursor-agent");
@@ -20327,10 +20331,10 @@ function aiderCredentialLocator() {
     validate: validateNonEmptyCredential
   };
 }
-function aiderLoginLauncher(os65) {
+function aiderLoginLauncher(os66) {
   return {
     async ensureInstalled() {
-      if (os65.findInPath("aider")) return true;
+      if (os66.findInPath("aider")) return true;
       console.error(
         "\n  \u2717 aider binary not on PATH.\n    Install Aider:\n      pip install aider-chat\n    then re-run `codeam link aider`.\n"
       );
@@ -20340,7 +20344,7 @@ function aiderLoginLauncher(os65) {
       console.error(
         "\n  Aider has no interactive login flow.\n    Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell,\n    or re-run `codeam link aider --api-key=<your-key>`.\n"
       );
-      return (0, import_node_child_process11.spawn)(os65.id === "win32" ? "cmd.exe" : "sh", os65.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
+      return (0, import_node_child_process11.spawn)(os66.id === "win32" ? "cmd.exe" : "sh", os66.id === "win32" ? ["/c", "exit", "0"] : ["-c", "exit 0"], {
         stdio: "ignore"
       });
     }
@@ -20429,14 +20433,14 @@ function defaultSdkDir() {
   return resolveSdkDirViaRequire();
 }
 function resolveClaudeNativeBinary(deps = {}) {
-  const existsSync28 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync30 = deps.existsSync ?? import_fs.default.existsSync;
   const platformKey = deps.platformKey ?? currentPlatformKey();
   const sdkDir = deps.sdkDir !== void 0 ? deps.sdkDir : defaultSdkDir();
   if (!sdkDir) return null;
   const scopeDir = import_path4.default.dirname(sdkDir);
   const binName = platformKey.startsWith("win32-") ? "claude.exe" : "claude";
   const candidate = import_path4.default.join(scopeDir, `claude-agent-sdk-${platformKey}`, binName);
-  return existsSync28(candidate) ? candidate : null;
+  return existsSync30(candidate) ? candidate : null;
 }
 var realSleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
 async function waitForClaudeNativeBinary(opts = {}) {
@@ -20518,18 +20522,18 @@ function augmentUserLocalBinPaths(deps = {}) {
   env.PATH = [...additions, ...parts].join(p2.delimiter);
 }
 function resolveCursorAgentBinary(deps = {}) {
-  const existsSync28 = deps.existsSync ?? import_fs.default.existsSync;
+  const existsSync30 = deps.existsSync ?? import_fs.default.existsSync;
   const platform3 = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
   if (platform3 === "win32") {
     const localAppData = env.LOCALAPPDATA;
     if (!localAppData) return null;
     const exe = import_path4.default.win32.join(localAppData, "cursor-agent", "cursor-agent.exe");
-    return existsSync28(exe) ? exe : null;
+    return existsSync30(exe) ? exe : null;
   }
   const home = deps.homedir ?? import_os4.default.homedir();
   const unix = import_path4.default.posix.join(home, ".local", "bin", "cursor-agent");
-  return existsSync28(unix) ? unix : null;
+  return existsSync30(unix) ? unix : null;
 }
 async function waitForCursorAgent(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
@@ -20615,8 +20619,8 @@ var AiderRuntimeStrategy = class {
   meta = getAgent("aider");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     augmentUserLocalBinPaths();
@@ -20749,8 +20753,8 @@ function geminiCredentialLocator() {
 function geminiLoginLauncher() {
   return {
     async ensureInstalled() {
-      const os65 = createOsStrategy();
-      return os65.findInPath("gemini") !== null;
+      const os66 = createOsStrategy();
+      return os66.findInPath("gemini") !== null;
     },
     launch() {
       return (0, import_node_child_process12.spawn)("gemini", ["auth", "login"], { stdio: "inherit" });
@@ -20940,8 +20944,8 @@ var GeminiRuntimeStrategy = class {
   meta = getAgent("gemini");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("gemini");
@@ -21233,8 +21237,8 @@ var KimiRuntimeStrategy = class {
   meta = getAgent("kimi");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("kimi");
@@ -21377,8 +21381,8 @@ var OpencodeRuntimeStrategy = class {
   meta = getAgent("opencode");
   mode = "interactive";
   os;
-  constructor(os65) {
-    this.os = os65;
+  constructor(os66) {
+    this.os = os66;
   }
   async prepareLaunch() {
     const binary = this.os.findInPath("opencode");
@@ -21463,20 +21467,20 @@ var OpencodeRuntimeStrategy = class {
 
 // src/agents/registry.ts
 var runtimeBuilders = {
-  claude: (os65) => new ClaudeRuntimeStrategy(os65),
-  codex: (os65) => new CodexRuntimeStrategy(os65),
-  coderabbit: (os65) => new CoderabbitRuntimeStrategy(os65),
-  cursor: (os65) => new CursorRuntimeStrategy(os65),
-  aider: (os65) => new AiderRuntimeStrategy(os65),
-  gemini: (os65) => new GeminiRuntimeStrategy(os65),
-  kimi: (os65) => new KimiRuntimeStrategy(os65),
-  opencode: (os65) => new OpencodeRuntimeStrategy(os65)
+  claude: (os66) => new ClaudeRuntimeStrategy(os66),
+  codex: (os66) => new CodexRuntimeStrategy(os66),
+  coderabbit: (os66) => new CoderabbitRuntimeStrategy(os66),
+  cursor: (os66) => new CursorRuntimeStrategy(os66),
+  aider: (os66) => new AiderRuntimeStrategy(os66),
+  gemini: (os66) => new GeminiRuntimeStrategy(os66),
+  kimi: (os66) => new KimiRuntimeStrategy(os66),
+  opencode: (os66) => new OpencodeRuntimeStrategy(os66)
 };
 var deployBuilders = {
   claude: () => new ClaudeDeployStrategy(),
   codex: () => new CodexDeployStrategy()
 };
-function createAgentStrategy(agent, os65 = createOsStrategy()) {
+function createAgentStrategy(agent, os66 = createOsStrategy()) {
   if (!AGENT_REGISTRY[agent]?.enabled) {
     throw new Error(
       `Agent "${agent}" is not supported in this codeam-cli version. Upgrade with 'npm i -g codeam-cli@latest'.`
@@ -21486,10 +21490,10 @@ function createAgentStrategy(agent, os65 = createOsStrategy()) {
   if (!build) {
     throw new Error(`No runtime strategy registered for agent "${agent}"`);
   }
-  return build(os65);
+  return build(os66);
 }
-function createInteractiveAgentStrategy(agent, os65 = createOsStrategy()) {
-  const s = createAgentStrategy(agent, os65);
+function createInteractiveAgentStrategy(agent, os66 = createOsStrategy()) {
+  const s = createAgentStrategy(agent, os66);
   if (s.mode !== "interactive") {
     throw new Error(
       `Agent "${agent}" is a batch agent; use createAgentStrategy + .runOneShot for one-shot reviews.`
@@ -22199,8 +22203,8 @@ function collectChangedFiles(cwd) {
   }
   return [...byPath.values()];
 }
-function restoreCoderabbitOauthBlob(os65, value) {
-  const dir = path38.join(os65.homeDir(), ".coderabbit");
+function restoreCoderabbitOauthBlob(os66, value) {
+  const dir = path38.join(os66.homeDir(), ".coderabbit");
   (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
   let file = "auth.json";
   let contents = value.trim();
@@ -22220,26 +22224,26 @@ function installFailureMessage(result) {
   return result.error ?? "CodeRabbit CLI could not be installed";
 }
 async function configureCoderabbit(input, deps = {}) {
-  const os65 = deps.os ?? createOsStrategy();
+  const os66 = deps.os ?? createOsStrategy();
   const ensureInstalled = deps.ensureInstalled ?? ensureCoderabbitInstalled;
   const isLoggedIn = deps.isLoggedIn ?? defaultIsLoggedIn;
   const runOAuth = deps.runOAuthLogin ?? runCoderabbitOAuthLogin;
   const snapshot = deps.snapshotDir ?? (() => snapshotCredentialDir());
   const capture2 = deps.captureCredential ?? ((b) => diffCapturedCredential(b));
   const loginWithApiKey = deps.loginWithApiKey ?? defaultLoginWithApiKey;
-  const home = os65.homeDir();
-  os65.augmentPath(
-    os65.id === "win32" ? [
+  const home = os66.homeDir();
+  os66.augmentPath(
+    os66.id === "win32" ? [
       path38.join(home, ".local", "bin"),
       path38.join(process.env.APPDATA ?? path38.join(home, "AppData", "Roaming"), "npm"),
       path38.join(home, "scoop", "shims")
     ] : [path38.join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin"]
   );
-  const installed2 = os65.findInPath("coderabbit") !== null;
+  const installed2 = os66.findInPath("coderabbit") !== null;
   const base = () => ({
     action: input.action,
     supported: true,
-    installed: os65.findInPath("coderabbit") !== null,
+    installed: os66.findInPath("coderabbit") !== null,
     loggedIn: false
   });
   if (input.action === "status") {
@@ -22253,7 +22257,7 @@ async function configureCoderabbit(input, deps = {}) {
     const key = (input.apiKey ?? "").trim();
     if (!key) return { ...res2, error: "No API key provided" };
     if (!res2.installed) {
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22277,7 +22281,7 @@ async function configureCoderabbit(input, deps = {}) {
     }
     if (!res2.installed) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22294,7 +22298,7 @@ async function configureCoderabbit(input, deps = {}) {
       return { ...res2, loggedIn: true, linked: true };
     }
     try {
-      restoreCoderabbitOauthBlob(os65, cred.credential);
+      restoreCoderabbitOauthBlob(os66, cred.credential);
     } catch (err) {
       return {
         ...res2,
@@ -22318,7 +22322,7 @@ async function configureCoderabbit(input, deps = {}) {
     const res2 = base();
     if (!installed2) {
       deps.onEvent?.({ kind: "installing" });
-      const inst = await ensureInstalled(os65);
+      const inst = await ensureInstalled(os66);
       res2.installed = inst.ok;
       if (!inst.ok) return { ...res2, error: installFailureMessage(inst) };
     }
@@ -22358,7 +22362,7 @@ async function configureCoderabbit(input, deps = {}) {
   }
   const res = base();
   if (!res.installed) {
-    const inst = await ensureInstalled(os65);
+    const inst = await ensureInstalled(os66);
     res.installed = inst.ok;
     if (!inst.ok) return { ...res, error: installFailureMessage(inst) };
   }
@@ -24864,9 +24868,10 @@ async function bringUpInspector(targetPort, deps = {}) {
     const start2 = deps.start ?? startInspectorProxy;
     const proxy = await start2({
       targetPort,
+      ...deps.targetHost ? { targetHost: deps.targetHost } : {},
       script: inspectorClientSource({ allowedOrigins: resolveInspectorOrigins(env) })
     });
-    log2(`preview inspector proxy on :${proxy.port} \u2192 :${targetPort}`);
+    log2(`preview inspector proxy on :${proxy.port} \u2192 ${deps.targetHost ?? "127.0.0.1"}:${targetPort}`);
     return { port: proxy.port, proxy };
   } catch (e) {
     log2(`preview inspector unavailable (${e.message}) \u2014 going direct`);
@@ -24874,6 +24879,30 @@ async function bringUpInspector(targetPort, deps = {}) {
   }
 }
 
+// src/services/preview/served-address.ts
+var LOOPBACK_HOSTS = ["127.0.0.1", "::1"];
+var ANSI_RE2 = /\x1b\[[0-9;]*m/g;
+var LOCAL_URL_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1?\]|\[::\]):(\d{2,5})\b/gi;
+function announcedPorts(output) {
+  const clean = output.replace(ANSI_RE2, "");
+  const ports = [];
+  for (const m of clean.matchAll(LOCAL_URL_RE)) {
+    const port = Number(m[1]);
+    if (port > 0 && port < 65536) ports.push(port);
+  }
+  return [...new Set(ports.reverse())];
+}
+async function resolveServedAddress(output, detectedPort, deps = {}) {
+  const listening = deps.listening ?? isPortListening;
+  const candidates = [.../* @__PURE__ */ new Set([...announcedPorts(output), detectedPort])];
+  for (const port of candidates) {
+    for (const host2 of LOOPBACK_HOSTS) {
+      if (await listening(port, host2)) return { host: host2, port };
+    }
+  }
+  return { host: "127.0.0.1", port: detectedPort };
+}
+
 // src/services/preview/start-orchestrator.ts
 var INSTALL_TIMEOUT_MS2 = 5 * 6e4;
 var SETUP_TIMEOUT_MS = 2 * 6e4;
@@ -25182,7 +25211,10 @@ async function startDevServer(ctx, extraEnv = {}) {
       if (verdict.adopt) {
         log.info("preview", `adopting the dev server already serving on port ${detection.port}`);
         emitProgress("READY_DETECTED", `adopted the server already on port ${detection.port}`);
-        return { devServer: null };
+        return {
+          devServer: null,
+          served: await resolveServedAddress("", detection.port)
+        };
       }
       emit2(USER_EVENTS.PREVIEW_ERROR, {
         stage: "spawn",
@@ -25245,15 +25277,23 @@ async function startDevServer(ctx, extraEnv = {}) {
     });
     return null;
   }
-  emitProgress("READY_DETECTED", `port ${detection.port}`);
-  return { devServer };
+  const served = await resolveServedAddress(outputTail, detection.port);
+  if (served.port !== detection.port || served.host !== "127.0.0.1") {
+    log.info(
+      "preview",
+      `dev server serves on ${served.host}:${served.port} (detection said :${detection.port})`
+    );
+  }
+  emitProgress("READY_DETECTED", `port ${served.port}`);
+  return { devServer, served };
 }
 var MAX_TUNNEL_ATTEMPTS = 3;
 async function establishTunnel(ctx, dev) {
   const { detection, emit: emit2, emitProgress } = ctx;
   const { devServer } = dev;
   emitProgress("TUNNEL_STARTING", "cloudflared quick tunnel");
-  const inspection = await bringUpInspector(detection.port, {
+  const inspection = await bringUpInspector(dev.served.port, {
+    targetHost: dev.served.host,
     log: (m) => log.info("preview", m)
   });
   const pub = await bringUpPublicUrl(ctx, inspection.port);
@@ -25667,11 +25707,11 @@ function resolveDoltInstallStrategy(platform3) {
 }
 var DOLT_RELEASE_BASE = "https://github.com/dolthub/dolt/releases/latest/download";
 function doltPlatformTuple(platform3, arch2) {
-  const os65 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
+  const os66 = platform3 === "win32" ? "windows" : platform3 === "darwin" ? "darwin" : "linux";
   const a = arch2 === "x64" ? "amd64" : arch2 === "arm64" ? "arm64" : null;
   if (!a) return null;
-  if (os65 === "windows" && a !== "amd64") return null;
-  return `${os65}-${a}`;
+  if (os66 === "windows" && a !== "amd64") return null;
+  return `${os66}-${a}`;
 }
 function resolveDoltTarballStrategy(targetDir, platform3, arch2) {
   const tuple = doltPlatformTuple(platform3, arch2);
@@ -27360,7 +27400,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
   });
   const token = ctx.pluginAuthToken;
   void (async () => {
-    const os65 = createOsStrategy();
+    const os66 = createOsStrategy();
     try {
       const report = await reviewPullRequest(
         {
@@ -27369,7 +27409,7 @@ var vcsAgentReviewH = async (ctx, cmd, parsed) => {
           baseBranch: parsed.baseBranch
         },
         {
-          runReview: (input) => new CoderabbitRuntimeStrategy(os65).runOneShot(input),
+          runReview: (input) => new CoderabbitRuntimeStrategy(os66).runOneShot(input),
           runGh: (args2) => defaultRunGh(args2),
           postReport: async (r) => {
             if (!token) return;
@@ -27507,13 +27547,13 @@ function resolveGlobalNodeModulesDir(opts) {
 var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
-  const readdirSync13 = deps?.readdirSync ?? fs51.readdirSync;
+  const readdirSync14 = deps?.readdirSync ?? fs51.readdirSync;
   const statSync15 = deps?.statSync ?? fs51.statSync;
   const rmSync9 = deps?.rmSync ?? fs51.rmSync;
   let removed = 0;
   let entries;
   try {
-    entries = readdirSync13(nodeModulesDir);
+    entries = readdirSync14(nodeModulesDir);
   } catch {
     return 0;
   }
@@ -28536,11 +28576,11 @@ function resolveTokenValue(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path96 = fileFlag.slice("--token-file=".length);
+    const path97 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs52.readFileSync(path96, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path96} is empty`);
-      rmIfExistsQuiet(path96);
+      const content = fs52.readFileSync(path97, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path97} is empty`);
+      rmIfExistsQuiet(path97);
       return content;
     } catch (err) {
       fail(`Could not read --token-file: ${err.message}`);
@@ -29472,32 +29512,200 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
   return null;
 }
 
+// src/commands/host/workspace.ts
+var fs53 = __toESM(require("fs"));
+var os41 = __toESM(require("os"));
+var path62 = __toESM(require("path"));
+var import_node_child_process21 = require("child_process");
+var import_node_util5 = require("util");
+var execFileP5 = (0, import_node_util5.promisify)(import_node_child_process21.execFile);
+function isAbsolutePathTarget(target) {
+  return path62.isAbsolute(target);
+}
+function selfHostedWorkspaceRoot() {
+  return path62.join(os41.homedir(), ".codeam", "self-hosted");
+}
+function deployIdFromWorkspace(cwd) {
+  if (!cwd) return null;
+  const root = selfHostedWorkspaceRoot();
+  const resolved = path62.resolve(cwd);
+  const rel = path62.relative(root, resolved);
+  if (!rel || rel.startsWith("..") || path62.isAbsolute(rel)) return null;
+  const parts = rel.split(path62.sep).filter(Boolean);
+  if (parts.length !== 1) return null;
+  return parts[0];
+}
+function nonInteractiveGitEnv() {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    GCM_INTERACTIVE: "never"
+  };
+}
+function githubOwnerRepo(repoRef) {
+  const trimmed = repoRef.trim();
+  const shorthand = /^([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+  if (shorthand && !/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@")) {
+    return { owner: shorthand[1], repo: shorthand[2] };
+  }
+  const httpsMatch = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(trimmed);
+  if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
+  return null;
+}
+function gitlabProjectPath(repoRef) {
+  const trimmed = repoRef.trim();
+  const https9 = /^https?:\/\/gitlab\.com\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
+  if (https9) return https9[1];
+  if (!/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@") && trimmed.includes("/")) {
+    return trimmed.replace(/\.git$/, "");
+  }
+  return null;
+}
+function repoCloneUrl(repoRef, cloneToken, provider = "github") {
+  const trimmed = repoRef.trim();
+  if (provider === "gitlab") {
+    const glPath = gitlabProjectPath(trimmed);
+    if (glPath) {
+      return cloneToken ? `https://oauth2:${cloneToken}@gitlab.com/${glPath}.git` : `https://gitlab.com/${glPath}.git`;
+    }
+    if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  }
+  if (cloneToken) {
+    const gh = githubOwnerRepo(trimmed);
+    if (gh) {
+      return `https://x-access-token:${cloneToken}@github.com/${gh.owner}/${gh.repo}.git`;
+    }
+  }
+  if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  return `https://github.com/${trimmed.replace(/\.git$/, "")}.git`;
+}
+function maskCloneUrl(url2) {
+  return url2.replace(/(https?:\/\/)[^@/]+@/, "$1***@");
+}
+async function fetchGithubIdentity(token) {
+  try {
+    const res = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "codeam-cli",
+        Accept: "application/vnd.github+json"
+      }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return { login: body.login, email: body.email ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+async function configureGitCredentials(dest, repoRef, cloneToken, provider = "github") {
+  const isGitlab = provider === "gitlab";
+  if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
+  if (!cloneToken) return;
+  const credFile = path62.join(dest, ".git", "codeam-credentials");
+  const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
+` : `https://x-access-token:${cloneToken}@github.com
+`;
+  fs53.writeFileSync(credFile, credLine, { mode: 384 });
+  restrictToOwner(credFile);
+  const env = nonInteractiveGitEnv();
+  const git2 = (args2) => execFileP5("git", ["-C", dest, ...args2], { timeout: 3e4, env });
+  const credFilePosix = credFile.split(path62.sep).join("/");
+  await git2(["config", "--local", "--replace-all", "credential.helper", ""]).catch(() => {
+  });
+  await git2([
+    "config",
+    "--local",
+    "--add",
+    "credential.helper",
+    `store --file=${credFilePosix}`
+  ]).catch(() => {
+  });
+  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef, void 0, provider)]).catch(() => {
+  });
+  const hasIdentity = await git2(["config", "user.email"]).then(() => true).catch(() => false);
+  if (!hasIdentity) {
+    const who = isGitlab ? null : await fetchGithubIdentity(cloneToken);
+    const login = who?.login ?? "CodeAgent";
+    await git2(["config", "--local", "user.name", login]).catch(() => {
+    });
+    const email = who?.email ?? (isGitlab ? "agent@codeagent-mobile.com" : `${login}@users.noreply.github.com`);
+    await git2(["config", "--local", "user.email", email]).catch(() => {
+    });
+  }
+}
+function maskToken(text, cloneToken) {
+  const masked = maskCloneUrl(text);
+  if (cloneToken && cloneToken.length > 0) {
+    return masked.split(cloneToken).join("***");
+  }
+  return masked;
+}
+async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github", branch) {
+  if (isAbsolutePathTarget(repoOrPath)) {
+    if (!fs53.existsSync(repoOrPath)) {
+      throw new Error(`deploy target path does not exist: ${repoOrPath}`);
+    }
+    return repoOrPath;
+  }
+  const dest = path62.join(selfHostedWorkspaceRoot(), deployId);
+  if (fs53.existsSync(path62.join(dest, ".git"))) {
+    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
+    return dest;
+  }
+  fs53.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
+  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
+  const cloneArgs = branch ? ["clone", "--depth", "1", "--branch", branch, cloneUrl, dest] : ["clone", "--depth", "1", cloneUrl, dest];
+  try {
+    await execFileP5("git", cloneArgs, {
+      timeout: 12e4,
+      maxBuffer: 16 * 1024 * 1024,
+      env: nonInteractiveGitEnv()
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`git clone failed for ${maskCloneUrl(cloneUrl)}: ${maskToken(reason, cloneToken)}`);
+  }
+  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
+  return dest;
+}
+
 // src/agents/acp/runner.ts
 var import_node_crypto11 = require("crypto");
-var fs69 = __toESM(require("fs"));
-var os53 = __toESM(require("os"));
-var path80 = __toESM(require("path"));
+var fs71 = __toESM(require("fs"));
+var os55 = __toESM(require("os"));
+var path82 = __toESM(require("path"));
 
 // src/lib/provider-routing.ts
+var fs55 = __toESM(require("fs"));
+var os43 = __toESM(require("os"));
+var path64 = __toESM(require("path"));
+
+// src/commands/host/house-proxy-config.ts
 var fs54 = __toESM(require("fs"));
 var os42 = __toESM(require("os"));
 var path63 = __toESM(require("path"));
-
-// src/commands/host/house-proxy-config.ts
-var fs53 = __toESM(require("fs"));
-var os41 = __toESM(require("os"));
-var path62 = __toESM(require("path"));
 function houseProxyConfigPath() {
-  return path62.join(os41.homedir(), ".codeam", "house-proxy.json");
+  return path63.join(os42.homedir(), ".codeam", "house-proxy.json");
+}
+var DEPLOY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function deployHouseProxyConfigPath(deployId) {
+  if (!DEPLOY_ID_RE.test(deployId) || deployId.includes("..")) return null;
+  return path63.join(os42.homedir(), ".codeam", "house-proxy", `${deployId}.json`);
+}
+function writeJson0600(file, value) {
+  fs54.mkdirSync(path63.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs54.writeFileSync(tmp, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 384 });
+  fs54.renameSync(tmp, file);
+  restrictToOwner(file);
 }
-function persistHouseProxyConfig(config) {
+function persistHouseProxyConfig(config, deployId) {
   try {
-    const file = houseProxyConfigPath();
-    fs53.mkdirSync(path62.dirname(file), { recursive: true, mode: 448 });
-    const tmp = `${file}.tmp-${process.pid}`;
-    fs53.writeFileSync(tmp, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
-    fs53.renameSync(tmp, file);
-    restrictToOwner(file);
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, config);
+    writeJson0600(houseProxyConfigPath(), config);
   } catch (err) {
     log.warn(
       "host-agent",
@@ -29505,18 +29713,23 @@ function persistHouseProxyConfig(config) {
     );
   }
 }
-function clearHouseProxyConfig() {
+function clearHouseProxyConfig(deployId) {
   try {
-    fs53.rmSync(houseProxyConfigPath(), { force: true });
+    fs54.rmSync(houseProxyConfigPath(), { force: true });
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, { none: true });
   } catch {
   }
 }
-function readHouseProxyChildEnv() {
+function readHouseProxyChildEnv(deployId) {
   try {
-    const raw = fs53.readFileSync(houseProxyConfigPath(), "utf8");
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    const file = perDeploy && fs54.existsSync(perDeploy) ? perDeploy : houseProxyConfigPath();
+    const raw = fs54.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null) return {};
     const o = parsed;
+    if (o.none === true) return {};
     if (typeof o.baseUrl !== "string" || !o.baseUrl) return {};
     if (typeof o.token !== "string" || !o.token) return {};
     return buildHouseProxyChildEnv({
@@ -29639,15 +29852,15 @@ function redactUrlToOrigin(raw) {
   }
 }
 function readOpencodeProviderOrigins(opts = {}) {
-  const home = opts.homeDir ?? os42.homedir();
-  const readFile7 = opts.readFile ?? ((f) => fs54.readFileSync(f, "utf8"));
+  const home = opts.homeDir ?? os43.homedir();
+  const readFile7 = opts.readFile ?? ((f) => fs55.readFileSync(f, "utf8"));
   const candidates = [];
   if (opts.cwd) {
-    candidates.push(path63.join(opts.cwd, "opencode.json"), path63.join(opts.cwd, "opencode.jsonc"));
+    candidates.push(path64.join(opts.cwd, "opencode.json"), path64.join(opts.cwd, "opencode.jsonc"));
   }
   candidates.push(
-    path63.join(home, ".config", "opencode", "opencode.json"),
-    path63.join(home, ".config", "opencode", "opencode.jsonc")
+    path64.join(home, ".config", "opencode", "opencode.json"),
+    path64.join(home, ".config", "opencode", "opencode.jsonc")
   );
   const out2 = [];
   const seen2 = /* @__PURE__ */ new Set();
@@ -29754,9 +29967,9 @@ function noteProviderBillingSignal(opts) {
 }
 
 // src/services/history.service.ts
-var fs55 = __toESM(require("fs"));
-var path64 = __toESM(require("path"));
-var os43 = __toESM(require("os"));
+var fs56 = __toESM(require("fs"));
+var path65 = __toESM(require("path"));
+var os44 = __toESM(require("os"));
 var https6 = __toESM(require("https"));
 var http9 = __toESM(require("http"));
 var import_zod2 = require("zod");
@@ -29817,7 +30030,7 @@ function parseJsonl(filePath) {
   const messages = [];
   let raw;
   try {
-    raw = fs55.readFileSync(filePath, "utf8");
+    raw = fs56.readFileSync(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       log.warn("history:parseJsonl", `read failed for ${filePath}`, err);
@@ -29971,7 +30184,7 @@ var HistoryService = class _HistoryService {
     return this._quotaPercent === null || Date.now() - this._quotaFetchedAt > ttlMs;
   }
   get projectDir() {
-    return this.runtime.resolveHistoryDir(this.cwd) ?? path64.join(os43.homedir(), ".claude", "projects", encodeCwd(this.cwd));
+    return this.runtime.resolveHistoryDir(this.cwd) ?? path65.join(os44.homedir(), ".claude", "projects", encodeCwd(this.cwd));
   }
   /** Set the current Claude conversation ID (extracted from /cost command or session start) */
   setCurrentConversationId(id) {
@@ -29983,7 +30196,7 @@ var HistoryService = class _HistoryService {
   /** Return the current message count in the active conversation. */
   getCurrentMessageCount() {
     if (!this.currentConversationId) return 0;
-    const filePath = path64.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+    const filePath = path65.join(this.projectDir, `${this.currentConversationId}.jsonl`);
     return parseJsonl(filePath).length;
   }
   /**
@@ -29994,7 +30207,7 @@ var HistoryService = class _HistoryService {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.currentConversationId) return null;
-      const filePath = path64.join(this.projectDir, `${this.currentConversationId}.jsonl`);
+      const filePath = path65.join(this.projectDir, `${this.currentConversationId}.jsonl`);
       const messages = parseJsonl(filePath);
       if (messages.length > previousCount) {
         for (let i = messages.length - 1; i >= previousCount; i--) {
@@ -30020,16 +30233,16 @@ var HistoryService = class _HistoryService {
     const dir = this.projectDir;
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     try {
-      const files = fs55.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
+      const files = fs56.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
         try {
-          const stat3 = fs55.statSync(path64.join(dir, e.name));
+          const stat3 = fs56.statSync(path65.join(dir, e.name));
           return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
         } catch {
           return { name: e.name, mtime: 0, birthtime: 0 };
         }
       }).filter((f) => f.birthtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       if (files.length > 0) {
-        this.currentConversationId = path64.basename(files[0].name, ".jsonl");
+        this.currentConversationId = path65.basename(files[0].name, ".jsonl");
       }
     } catch {
     }
@@ -30063,13 +30276,13 @@ var HistoryService = class _HistoryService {
     const cutoff = this.bootTimeMs - _HistoryService.BIRTHTIME_GRACE_MS;
     let entries;
     try {
-      entries = fs55.readdirSync(dir, { withFileTypes: true });
+      entries = fs56.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     const files = entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => {
       try {
-        const stat3 = fs55.statSync(path64.join(dir, e.name));
+        const stat3 = fs56.statSync(path65.join(dir, e.name));
         return { name: e.name, mtime: stat3.mtimeMs, birthtime: stat3.birthtimeMs };
       } catch {
         return { name: e.name, mtime: 0, birthtime: 0 };
@@ -30078,12 +30291,12 @@ var HistoryService = class _HistoryService {
     if (files.length === 0) return null;
     const targetFile = this.currentConversationId ? `${this.currentConversationId}.jsonl` : files[0].name;
     if (!files.some((f) => f.name === targetFile)) return null;
-    return this.extractUsageFromFile(path64.join(dir, targetFile));
+    return this.extractUsageFromFile(path65.join(dir, targetFile));
   }
   extractUsageFromFile(filePath) {
     let raw;
     try {
-      raw = fs55.readFileSync(filePath, "utf8");
+      raw = fs56.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
@@ -30135,9 +30348,9 @@ var HistoryService = class _HistoryService {
     let totalCost = 0;
     let files;
     try {
-      files = fs55.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
+      files = fs56.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).filter((f) => {
         try {
-          return fs55.statSync(path64.join(projectDir, f)).mtimeMs >= monthStartMs;
+          return fs56.statSync(path65.join(projectDir, f)).mtimeMs >= monthStartMs;
         } catch {
           return false;
         }
@@ -30148,7 +30361,7 @@ var HistoryService = class _HistoryService {
     for (const file of files) {
       let raw;
       try {
-        raw = fs55.readFileSync(path64.join(projectDir, file), "utf8");
+        raw = fs56.readFileSync(path65.join(projectDir, file), "utf8");
       } catch {
         continue;
       }
@@ -30227,7 +30440,7 @@ var HistoryService = class _HistoryService {
     if (this.runtime.resolveHistoryFile) {
       return this.runtime.resolveHistoryFile(this.cwd, sessionId);
     }
-    return path64.join(this.projectDir, `${sessionId}.jsonl`);
+    return path65.join(this.projectDir, `${sessionId}.jsonl`);
   }
   /**
    * Parse a conversation's messages from disk, agent-aware. Claude uses the
@@ -30265,7 +30478,7 @@ var HistoryService = class _HistoryService {
         };
       });
     }
-    return parseJsonl(path64.join(this.projectDir, `${sessionId}.jsonl`));
+    return parseJsonl(path65.join(this.projectDir, `${sessionId}.jsonl`));
   }
   /** One in-flight full upload per conversation — the baton mirror and a
    *  `get_conversation` used to upload the same transcript concurrently. */
@@ -30347,7 +30560,7 @@ var HistoryService = class _HistoryService {
     if (!filePath) return false;
     let mtimeMs;
     try {
-      mtimeMs = fs55.statSync(filePath).mtimeMs;
+      mtimeMs = fs56.statSync(filePath).mtimeMs;
     } catch {
       return false;
     }
@@ -30421,11 +30634,11 @@ var HistoryService = class _HistoryService {
 };
 
 // src/agents/acp/client.ts
-var import_node_child_process21 = require("child_process");
-var fs56 = __toESM(require("fs/promises"));
+var import_node_child_process22 = require("child_process");
+var fs57 = __toESM(require("fs/promises"));
 var fsSync = __toESM(require("fs"));
-var os45 = __toESM(require("os"));
-var path66 = __toESM(require("path"));
+var os46 = __toESM(require("os"));
+var path67 = __toESM(require("path"));
 var import_node_stream = require("stream");
 
 // ../../node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -34451,8 +34664,8 @@ function createIdleTimeout(idleMs, makeError, activeIdleMs = idleMs) {
 }
 
 // src/agents/acp/internal-paths.ts
-var path65 = __toESM(require("path"));
-var os44 = __toESM(require("os"));
+var path66 = __toESM(require("path"));
+var os45 = __toESM(require("os"));
 var INTERNAL_TOKENS = [".codeam", "house-claude"];
 var PROSE_ONLY_TOOL_KINDS = /* @__PURE__ */ new Set(["think", "switch_mode"]);
 function isProseOnlyToolKind(kind) {
@@ -34464,13 +34677,13 @@ function textReferencesInternal(text) {
   const scrubbed = text.replace(SELF_HOSTED_WORKSPACE_RE, " ");
   return INTERNAL_TOKENS.some((t2) => scrubbed.includes(t2));
 }
-function pathIsInternal(p2, homeDir2 = os44.homedir()) {
+function pathIsInternal(p2, homeDir2 = os45.homedir()) {
   if (!p2) return false;
-  const abs = path65.resolve(p2);
-  const home = path65.resolve(homeDir2);
-  const within = (root) => abs === root || abs.startsWith(root + path65.sep);
-  if (within(path65.join(home, ".codeam", "self-hosted"))) return false;
-  return within(path65.join(home, ".codeam")) || within(path65.join(home, ".beads")) || abs === path65.join(home, ".codeam-host.log") || abs.includes(`${path65.sep}house-claude${path65.sep}`) || abs.endsWith(`${path65.sep}house-claude`);
+  const abs = path66.resolve(p2);
+  const home = path66.resolve(homeDir2);
+  const within = (root) => abs === root || abs.startsWith(root + path66.sep);
+  if (within(path66.join(home, ".codeam", "self-hosted"))) return false;
+  return within(path66.join(home, ".codeam")) || within(path66.join(home, ".beads")) || abs === path66.join(home, ".codeam-host.log") || abs.includes(`${path66.sep}house-claude${path66.sep}`) || abs.endsWith(`${path66.sep}house-claude`);
 }
 function toolCallReferencesInternal(call, homeDir2) {
   if (call.locations?.some((l) => pathIsInternal(l.path, homeDir2))) return true;
@@ -34798,7 +35011,7 @@ var AcpClient = class {
       "acpClient",
       `provider routing ${formatProviderRouting(describeProviderRouting(childEnv, { cwd }), adapter.command)}`
     );
-    const child = (0, import_node_child_process21.spawn)(adapter.command, adapter.args, {
+    const child = (0, import_node_child_process22.spawn)(adapter.command, adapter.args, {
       cwd,
       env: childEnv,
       stdio: ["pipe", "pipe", "pipe"],
@@ -35483,7 +35696,7 @@ var AcpClient = class {
     try {
       const pid = child.pid;
       if (process.platform === "win32") {
-        if (pid) (0, import_node_child_process21.spawnSync)("taskkill", ["/F", "/T", "/PID", String(pid)], { stdio: "ignore" });
+        if (pid) (0, import_node_child_process22.spawnSync)("taskkill", ["/F", "/T", "/PID", String(pid)], { stdio: "ignore" });
       } else if (pid) {
         killQuiet(-pid, "SIGTERM");
       } else {
@@ -35565,7 +35778,7 @@ var AcpClient = class {
           throw new RequestError(-32002, GUARDRAIL_SECRET_READ_BLOCK_REASON, { uri: params.path });
         }
         try {
-          const content = await fs56.readFile(params.path, "utf8");
+          const content = await fs57.readFile(params.path, "utf8");
           return applyLineRange(content, params.line ?? null, params.limit ?? null);
         } catch (err) {
           const code = err.code;
@@ -35586,7 +35799,7 @@ var AcpClient = class {
           throw new RequestError(-32002, INTERNAL_BLOCK_REASON, { uri: params.path });
         }
         try {
-          await fs56.writeFile(params.path, params.content, "utf8");
+          await fs57.writeFile(params.path, params.content, "utf8");
           return {};
         } catch (err) {
           const code = err.code;
@@ -35674,30 +35887,30 @@ function applyLineRange(content, line, limit) {
   return { content: lines.slice(start2, end).join("\n") };
 }
 function knownAgentBinaryDirs() {
-  const home = os45.homedir();
+  const home = os46.homedir();
   const out2 = [];
   out2.push("/tmp/codeam-node20/bin");
   for (const root of [
     "/usr/local/share/nvm/versions/node",
-    path66.join(home, ".nvm/versions/node")
+    path67.join(home, ".nvm/versions/node")
   ]) {
     try {
       for (const child of fsSync.readdirSync(root)) {
-        out2.push(path66.join(root, child, "bin"));
+        out2.push(path67.join(root, child, "bin"));
       }
     } catch {
     }
   }
-  out2.push(path66.join(home, ".volta/bin"));
+  out2.push(path67.join(home, ".volta/bin"));
   out2.push("/usr/local/bin");
   out2.push("/usr/bin");
-  out2.push(path66.join(home, ".local/bin"));
-  out2.push(path66.join(home, "bin"));
+  out2.push(path67.join(home, ".local/bin"));
+  out2.push(path67.join(home, "bin"));
   out2.push(...agentInstallBinDirs());
   if (process.platform === "win32") {
     const { LOCALAPPDATA, APPDATA } = process.env;
-    if (LOCALAPPDATA) out2.push(path66.join(LOCALAPPDATA, "cursor-agent"));
-    if (APPDATA) out2.push(path66.join(APPDATA, "npm"));
+    if (LOCALAPPDATA) out2.push(path67.join(LOCALAPPDATA, "cursor-agent"));
+    if (APPDATA) out2.push(path67.join(APPDATA, "npm"));
   }
   return out2.filter((p2) => {
     try {
@@ -35708,7 +35921,7 @@ function knownAgentBinaryDirs() {
   });
 }
 function expandPathForAgentBinaries(existingPath) {
-  const existing = new Set(existingPath.split(path66.delimiter).filter((p2) => p2.length > 0));
+  const existing = new Set(existingPath.split(path67.delimiter).filter((p2) => p2.length > 0));
   const additions = [];
   for (const dir of knownAgentBinaryDirs()) {
     if (!existing.has(dir)) {
@@ -35717,17 +35930,17 @@ function expandPathForAgentBinaries(existingPath) {
     }
   }
   if (additions.length === 0) return existingPath;
-  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path66.delimiter);
+  return [...additions, existingPath].filter((p2) => p2.length > 0).join(path67.delimiter);
 }
 
 // src/commands/host/agent-install.ts
 var import_child_process27 = require("child_process");
-var os46 = __toESM(require("os"));
+var os47 = __toESM(require("os"));
 function runAgentInstallScript(script, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 18e4;
   const scope = opts.logScope ?? "agent-install";
   return new Promise((resolve12) => {
-    const home = process.env.HOME || os46.homedir();
+    const home = process.env.HOME || os47.homedir();
     const child = (0, import_child_process27.spawn)("sh", ["-c", script], {
       env: { ...process.env, HOME: home },
       stdio: ["ignore", "pipe", "pipe"]
@@ -35989,9 +36202,9 @@ async function performAgentSwitch(deps, rawAgentId, fastPath = {}) {
 }
 
 // src/commands/host/agent-provisioning.ts
-var fs57 = __toESM(require("fs"));
-var os47 = __toESM(require("os"));
-var path67 = __toESM(require("path"));
+var fs58 = __toESM(require("fs"));
+var os48 = __toESM(require("os"));
+var path68 = __toESM(require("path"));
 var PUBLIC_TO_INTERNAL_AGENT = {
   claude_code: "claude",
   claude: "claude",
@@ -36008,22 +36221,22 @@ function toInternalAgentId(publicAgentId) {
   return PUBLIC_TO_INTERNAL_AGENT[publicAgentId] ?? null;
 }
 function ensureDir(dir) {
-  fs57.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs58.mkdirSync(dir, { recursive: true, mode: 448 });
 }
 function writeFile0600(filePath, contents) {
-  ensureDir(path67.dirname(filePath));
-  fs57.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
+  ensureDir(path68.dirname(filePath));
+  fs58.writeFileSync(filePath, contents, { encoding: "utf8", mode: 384 });
   restrictToOwner(filePath);
 }
 function rmIfExists(filePath) {
   try {
-    fs57.rmSync(filePath, { force: true });
+    fs58.rmSync(filePath, { force: true });
   } catch {
   }
 }
 var claudeProvisioner = {
   write(auth, home) {
-    const credentialsJson = path67.join(home, ".claude", ".credentials.json");
+    const credentialsJson = path68.join(home, ".claude", ".credentials.json");
     if (auth.kind === "api_key") {
       rmIfExists(credentialsJson);
       return { ANTHROPIC_API_KEY: auth.value };
@@ -36035,8 +36248,8 @@ var claudeProvisioner = {
     } else {
       rmIfExists(credentialsJson);
     }
-    const claudeJson = path67.join(home, ".claude.json");
-    if (!fs57.existsSync(claudeJson)) {
+    const claudeJson = path68.join(home, ".claude.json");
+    if (!fs58.existsSync(claudeJson)) {
       writeFile0600(
         claudeJson,
         JSON.stringify({ hasCompletedOnboarding: true, customApiKeyResponses: { approved: [] } })
@@ -36047,7 +36260,7 @@ var claudeProvisioner = {
 };
 var codexProvisioner = {
   write(auth, home) {
-    const authJson = path67.join(home, ".codex", "auth.json");
+    const authJson = path68.join(home, ".codex", "auth.json");
     if (auth.kind === "api_key") {
       writeFile0600(authJson, JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: auth.value }));
       return { OPENAI_API_KEY: auth.value };
@@ -36058,8 +36271,8 @@ var codexProvisioner = {
 };
 var geminiProvisioner = {
   write(auth, home) {
-    const settingsJson = path67.join(home, ".gemini", "settings.json");
-    const oauthCreds = path67.join(home, ".gemini", "oauth_creds.json");
+    const settingsJson = path68.join(home, ".gemini", "settings.json");
+    const oauthCreds = path68.join(home, ".gemini", "oauth_creds.json");
     if (auth.kind === "api_key") {
       rmIfExists(oauthCreds);
       writeFile0600(settingsJson, '{"security":{"auth":{"selectedType":"gemini-api-key"}}}');
@@ -36072,7 +36285,7 @@ var geminiProvisioner = {
 };
 var cursorProvisioner = {
   write(auth, home) {
-    const authJson = path67.join(home, ".config", "cursor", "auth.json");
+    const authJson = path68.join(home, ".config", "cursor", "auth.json");
     if (auth.kind === "api_key") {
       rmIfExists(authJson);
       return { CURSOR_API_KEY: auth.value };
@@ -36114,22 +36327,22 @@ max_context_size = 262144
 var kimiProvisioner = {
   write(auth, home) {
     const credentialsFiles = [
-      path67.join(home, ".kimi", "credentials", "kimi-code.json"),
-      path67.join(home, ".kimi-code", "credentials", "kimi-code.json")
+      path68.join(home, ".kimi", "credentials", "kimi-code.json"),
+      path68.join(home, ".kimi-code", "credentials", "kimi-code.json")
     ];
     if (auth.kind === "api_key") {
       credentialsFiles.forEach(rmIfExists);
       return { KIMI_API_KEY: auth.value };
     }
     credentialsFiles.forEach((f) => writeFile0600(f, auth.value));
-    writeFile0600(path67.join(home, ".kimi-code", "config.toml"), KIMI_MANAGED_CONFIG_TOML);
+    writeFile0600(path68.join(home, ".kimi-code", "config.toml"), KIMI_MANAGED_CONFIG_TOML);
     return {};
   }
 };
 var coderabbitProvisioner = {
   write(auth, home) {
-    const dir = path67.join(home, ".coderabbit");
-    const authJson = path67.join(dir, "auth.json");
+    const dir = path68.join(home, ".coderabbit");
+    const authJson = path68.join(dir, "auth.json");
     if (auth.kind === "api_key") {
       rmIfExists(authJson);
       return { CODERABBIT_API_KEY: auth.value };
@@ -36141,13 +36354,13 @@ var coderabbitProvisioner = {
       try {
         const parsed = JSON.parse(value);
         if (typeof parsed.file === "string" && typeof parsed.contents === "string") {
-          file = path67.basename(parsed.file);
+          file = path68.basename(parsed.file);
           contents = parsed.contents;
         }
       } catch {
       }
     }
-    writeFile0600(path67.join(dir, file), contents);
+    writeFile0600(path68.join(dir, file), contents);
     return {};
   }
 };
@@ -36175,7 +36388,7 @@ var UnsupportedAgentError = class extends Error {
     this.agentId = agentId;
   }
 };
-function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os47.homedir()) {
+function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os48.homedir()) {
   const internal = toInternalAgentId(publicAgentId);
   if (!internal) throw new UnsupportedAgentError(publicAgentId);
   const provisioner = PROVISIONERS[internal];
@@ -36184,16 +36397,16 @@ function provisionAgentCredentials(publicAgentId, auth, homeDir2 = os47.homedir(
 }
 
 // src/beads/workflow-hint.ts
-var fs58 = __toESM(require("fs"));
-var path69 = __toESM(require("path"));
+var fs59 = __toESM(require("fs"));
+var path70 = __toESM(require("path"));
 
 // src/agents/claude-memory-file.ts
-var os48 = __toESM(require("os"));
-var path68 = __toESM(require("path"));
+var os49 = __toESM(require("os"));
+var path69 = __toESM(require("path"));
 function claudeMemoryFile(homeDir2, env = process.env) {
-  if (homeDir2) return path68.join(homeDir2, ".claude", "CLAUDE.md");
+  if (homeDir2) return path69.join(homeDir2, ".claude", "CLAUDE.md");
   const configDir = env.CLAUDE_CONFIG_DIR?.trim();
-  return configDir ? path68.join(configDir, "CLAUDE.md") : path68.join(os48.homedir(), ".claude", "CLAUDE.md");
+  return configDir ? path69.join(configDir, "CLAUDE.md") : path69.join(os49.homedir(), ".claude", "CLAUDE.md");
 }
 
 // src/beads/workflow-hint.ts
@@ -36223,11 +36436,11 @@ function ensureBeadsWorkflowHint(homeDir2, file = claudeMemoryFile(homeDir2)) {
   try {
     let existing = "";
     try {
-      existing = fs58.readFileSync(file, "utf8");
+      existing = fs59.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(BEADS_HINT)) return;
-    fs58.mkdirSync(path69.dirname(file), { recursive: true });
+    fs59.mkdirSync(path70.dirname(file), { recursive: true });
     let next;
     const open = existing.indexOf(BEADS_HINT_MARKER);
     const close = open === -1 ? -1 : existing.indexOf(BEADS_HINT_MARKER, open + BEADS_HINT_MARKER.length);
@@ -36240,40 +36453,40 @@ ${BEADS_HINT}
 ` : `${BEADS_HINT}
 `;
     }
-    fs58.writeFileSync(file, next);
+    fs59.writeFileSync(file, next);
   } catch {
   }
 }
 
 // src/agents/agent-standard.ts
-var fs59 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
-var os49 = __toESM(require("os"));
+var fs60 = __toESM(require("fs"));
+var path71 = __toESM(require("path"));
+var os50 = __toESM(require("os"));
 function ensureAgentStandard(homeDir2, file = claudeMemoryFile(homeDir2)) {
   try {
     let existing = "";
     try {
-      existing = fs59.readFileSync(file, "utf8");
+      existing = fs60.readFileSync(file, "utf8");
     } catch {
     }
     if (existing.includes(AGENT_STANDARD_MARKER)) return;
-    fs59.mkdirSync(path70.dirname(file), { recursive: true });
+    fs60.mkdirSync(path71.dirname(file), { recursive: true });
     const next = existing.trim() ? `${existing.trimEnd()}
 
 ${AGENT_STANDARD_BLOCK}
 ` : `${AGENT_STANDARD_BLOCK}
 `;
-    fs59.writeFileSync(file, next);
+    fs60.writeFileSync(file, next);
   } catch {
   }
 }
 var _agentStandardSeam = {
   isLocalSession: () => isLocalSession(),
-  markerPath: (sessionId) => path70.join(os49.homedir(), ".codeam", "agent-standard", `${sessionId}.done`),
-  exists: (p2) => fs59.existsSync(p2),
+  markerPath: (sessionId) => path71.join(os50.homedir(), ".codeam", "agent-standard", `${sessionId}.done`),
+  exists: (p2) => fs60.existsSync(p2),
   write: (p2) => {
-    fs59.mkdirSync(path70.dirname(p2), { recursive: true });
-    fs59.writeFileSync(p2, "");
+    fs60.mkdirSync(path71.dirname(p2), { recursive: true });
+    fs60.writeFileSync(p2, "");
   }
 };
 function isClaude(agent) {
@@ -36966,15 +37179,15 @@ function withholdTrailingPartialFenceMarker(text) {
 
 // src/agents/acp/onboarding.ts
 var import_child_process28 = require("child_process");
-var fs60 = __toESM(require("fs"));
-var os50 = __toESM(require("os"));
-var path71 = __toESM(require("path"));
+var fs61 = __toESM(require("fs"));
+var os51 = __toESM(require("os"));
+var path72 = __toESM(require("path"));
 var _onboardingSeam = {
-  markerPath: (sessionId) => path71.join(os50.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
-  exists: (p2) => fs60.existsSync(p2),
+  markerPath: (sessionId) => path72.join(os51.homedir(), ".codeam", "welcomed", `${sessionId}.done`),
+  exists: (p2) => fs61.existsSync(p2),
   write: (p2) => {
-    fs60.mkdirSync(path71.dirname(p2), { recursive: true });
-    fs60.writeFileSync(p2, "");
+    fs61.mkdirSync(path72.dirname(p2), { recursive: true });
+    fs61.writeFileSync(p2, "");
   },
   disabled: () => {
     const v = process.env.CODEAM_ONBOARDING_DISABLED;
@@ -37011,7 +37224,7 @@ function resolveRepoName(cwd) {
       if (name) return name;
     }
   }
-  const base = path71.basename(cwd || "");
+  const base = path72.basename(cwd || "");
   if (base && !isUuid(base)) return base;
   return "this project";
 }
@@ -37403,13 +37616,13 @@ var import_crypto4 = require("crypto");
 
 // src/services/turn-files/git-changeset.ts
 var import_child_process29 = require("child_process");
-var fs62 = __toESM(require("fs/promises"));
-var path73 = __toESM(require("path"));
+var fs63 = __toESM(require("fs/promises"));
+var path74 = __toESM(require("path"));
 
 // src/services/turn-files/review-ignore.ts
 var import_ignore2 = __toESM(require("ignore"));
-var fs61 = __toESM(require("fs"));
-var path72 = __toESM(require("path"));
+var fs62 = __toESM(require("fs"));
+var path73 = __toESM(require("path"));
 var CURATED_REVIEW_IGNORE = [
   // Google Cloud SDK (the incident) — installs a huge python tree.
   "google-cloud-sdk/",
@@ -37448,7 +37661,7 @@ var CURATED_REVIEW_IGNORE = [
 function makeReviewIgnore(repoRoot) {
   const ig = (0, import_ignore2.default)().add(CURATED_REVIEW_IGNORE);
   try {
-    const custom = fs61.readFileSync(path72.join(repoRoot, ".codeam", "reviewignore"), "utf8");
+    const custom = fs62.readFileSync(path73.join(repoRoot, ".codeam", "reviewignore"), "utf8");
     ig.add(custom);
   } catch {
   }
@@ -37493,7 +37706,7 @@ async function collectRepoChangeset(opts) {
     let stats;
     if (!truncated && row.fileStatus === "added" && numstatEntry === void 0) {
       const lineCount = await readUntrackedLineCount(
-        path73.join(opts.repoRoot, row.filePath)
+        path74.join(opts.repoRoot, row.filePath)
       );
       stats = { added: lineCount, removed: 0 };
     } else {
@@ -37524,7 +37737,7 @@ function readUntrackedLineCount(absPath) {
 }
 async function defaultReadUntrackedLineCount(absPath) {
   try {
-    const content = await fs62.readFile(absPath, "utf8");
+    const content = await fs63.readFile(absPath, "utf8");
     let count = 0;
     let pos = -1;
     while ((pos = content.indexOf("\n", pos + 1)) !== -1) {
@@ -37616,7 +37829,7 @@ function defaultRunGit(cwd, args2) {
   });
 }
 async function discoverRepos(workingDir, maxDepth = 4) {
-  const fs81 = await import("fs/promises");
+  const fs82 = await import("fs/promises");
   const out2 = [];
   await walk(workingDir, 0);
   return out2;
@@ -37624,7 +37837,7 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (depth > maxDepth) return;
     let entries = [];
     try {
-      const dirents = await fs81.readdir(dir, { withFileTypes: true });
+      const dirents = await fs82.readdir(dir, { withFileTypes: true });
       entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
     } catch {
       return;
@@ -37635,8 +37848,8 @@ async function discoverRepos(workingDir, maxDepth = 4) {
     if (hasGit) {
       out2.push({
         repoRoot: dir,
-        repoPath: path73.relative(workingDir, dir),
-        repoName: path73.basename(dir)
+        repoPath: path74.relative(workingDir, dir),
+        repoName: path74.basename(dir)
       });
       return;
     }
@@ -37644,14 +37857,14 @@ async function discoverRepos(workingDir, maxDepth = 4) {
       if (!entry.isDirectory) continue;
       if (entry.name === "node_modules") continue;
       if (entry.name === "dist" || entry.name === "build") continue;
-      await walk(path73.join(dir, entry.name), depth + 1);
+      await walk(path74.join(dir, entry.name), depth + 1);
     }
   }
 }
 
 // src/services/turn-files/files-outbox.ts
-var fs63 = __toESM(require("fs/promises"));
-var path74 = __toESM(require("path"));
+var fs64 = __toESM(require("fs/promises"));
+var path75 = __toESM(require("path"));
 var import_os12 = require("os");
 var HOME_OUTBOX_DIR = ".codeam/outbox";
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -37684,16 +37897,16 @@ var FilesOutbox = class {
   backoffIndex = 0;
   stopped = false;
   constructor(opts) {
-    const base = opts.baseDir ?? path74.join(homeDir(), HOME_OUTBOX_DIR);
-    this.filePath = path74.join(base, `${opts.sessionId}.jsonl`);
+    const base = opts.baseDir ?? path75.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path75.join(base, `${opts.sessionId}.jsonl`);
     this.post = opts.post;
     this.autoSchedule = opts.autoSchedule !== false;
   }
   /** Persist the entry to disk and trigger a flush. Returns once the
    *  line is durable on disk (not once the POST succeeds). */
   async enqueue(entry) {
-    await fs63.mkdir(path74.dirname(this.filePath), { recursive: true });
-    await fs63.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    await fs64.mkdir(path75.dirname(this.filePath), { recursive: true });
+    await fs64.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
     this.backoffIndex = 0;
     if (this.autoSchedule) this.scheduleFlush(0);
   }
@@ -37784,7 +37997,7 @@ var FilesOutbox = class {
   async readAll() {
     let raw = "";
     try {
-      raw = await fs63.readFile(this.filePath, "utf8");
+      raw = await fs64.readFile(this.filePath, "utf8");
     } catch {
       return [];
     }
@@ -37808,12 +38021,12 @@ var FilesOutbox = class {
   async rewrite(entries) {
     const tmpPath = `${this.filePath}.${process.pid}.tmp`;
     if (entries.length === 0) {
-      await fs63.unlink(this.filePath).catch(() => void 0);
+      await fs64.unlink(this.filePath).catch(() => void 0);
       return;
     }
     const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    await fs63.writeFile(tmpPath, payload, "utf8");
-    await fs63.rename(tmpPath, this.filePath);
+    await fs64.writeFile(tmpPath, payload, "utf8");
+    await fs64.rename(tmpPath, this.filePath);
   }
 };
 function applyJitter(ms) {
@@ -38360,11 +38573,11 @@ async function postCredentialSync(opts, fetchImpl = fetch) {
 }
 
 // src/packs/gates.ts
-var import_node_child_process22 = require("child_process");
-var fs64 = __toESM(require("fs"));
-var path75 = __toESM(require("path"));
+var import_node_child_process23 = require("child_process");
+var fs65 = __toESM(require("fs"));
+var path76 = __toESM(require("path"));
 var defaultCommandRunner = (file, args2, cwd, timeoutMs, env) => new Promise((resolve12) => {
-  (0, import_node_child_process22.execFile)(
+  (0, import_node_child_process23.execFile)(
     file,
     args2,
     {
@@ -38412,7 +38625,7 @@ async function changedFiles(run, cwd, from, to) {
 }
 function readWorkspaceFile(cwd, relPath) {
   try {
-    return fs64.readFileSync(path75.join(cwd, relPath), "utf8");
+    return fs65.readFileSync(path76.join(cwd, relPath), "utf8");
   } catch {
     return null;
   }
@@ -38421,14 +38634,14 @@ var NO_TEST_PLACEHOLDER = 'echo "Error: no test specified"';
 var CHECKS_TIMEOUT_MS = 5 * 6e4;
 function detectChecksCommand(cwd) {
   try {
-    const cfg = JSON.parse(fs64.readFileSync(path75.join(cwd, ".codeam", "pack.json"), "utf8"));
+    const cfg = JSON.parse(fs65.readFileSync(path76.join(cwd, ".codeam", "pack.json"), "utf8"));
     if (typeof cfg.checksCommand === "string" && cfg.checksCommand.trim().length > 0) {
       return cfg.checksCommand.trim();
     }
   } catch {
   }
   try {
-    const pkg = JSON.parse(fs64.readFileSync(path75.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs65.readFileSync(path76.join(cwd, "package.json"), "utf8"));
     const test = pkg.scripts?.test;
     if (typeof test === "string" && test.trim().length > 0 && !test.includes(NO_TEST_PLACEHOLDER)) {
       return "npm test";
@@ -38446,39 +38659,39 @@ ${res.stderr}`.trim();
 }
 
 // src/packs/run-store.ts
-var fs65 = __toESM(require("fs"));
-var path76 = __toESM(require("path"));
+var fs66 = __toESM(require("fs"));
+var path77 = __toESM(require("path"));
 var crypto5 = __toESM(require("crypto"));
 function packsDir(cwd) {
-  return path76.join(cwd, ".codeam", "packs");
+  return path77.join(cwd, ".codeam", "packs");
 }
 function runDir(cwd, runId) {
-  return path76.join(packsDir(cwd), runId);
+  return path77.join(packsDir(cwd), runId);
 }
 function newRunId() {
   return `pk_${Date.now().toString(36)}_${crypto5.randomBytes(4).toString("hex")}`;
 }
 function writeJsonAtomic(file, value) {
-  fs65.mkdirSync(path76.dirname(file), { recursive: true });
+  fs66.mkdirSync(path77.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs65.writeFileSync(tmp, JSON.stringify(value, null, 2));
-  fs65.renameSync(tmp, file);
+  fs66.writeFileSync(tmp, JSON.stringify(value, null, 2));
+  fs66.renameSync(tmp, file);
 }
 function saveRun(cwd, state) {
-  writeJsonAtomic(path76.join(runDir(cwd, state.runId), "run.json"), state);
+  writeJsonAtomic(path77.join(runDir(cwd, state.runId), "run.json"), state);
 }
 function saveStageHandoff(cwd, runId, stageIndex, role, handoff) {
   const name = `${String(stageIndex + 1).padStart(2, "0")}-${role}.json`;
-  writeJsonAtomic(path76.join(runDir(cwd, runId), name), handoff);
+  writeJsonAtomic(path77.join(runDir(cwd, runId), name), handoff);
 }
 function loadLatestRun(cwd) {
   try {
     const dir = packsDir(cwd);
-    const entries = fs65.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    const entries = fs66.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
     for (let i = entries.length - 1; i >= 0; i--) {
-      const file = path76.join(dir, entries[i], "run.json");
+      const file = path77.join(dir, entries[i], "run.json");
       try {
-        const parsed = JSON.parse(fs65.readFileSync(file, "utf8"));
+        const parsed = JSON.parse(fs66.readFileSync(file, "utf8"));
         if (parsed && typeof parsed.runId === "string") return parsed;
       } catch {
       }
@@ -38489,17 +38702,17 @@ function loadLatestRun(cwd) {
 }
 function ensureLedgerIgnored(cwd) {
   try {
-    const gitDir = path76.join(cwd, ".git");
-    if (!fs65.existsSync(gitDir)) return;
-    const exclude = path76.join(gitDir, "info", "exclude");
+    const gitDir = path77.join(cwd, ".git");
+    if (!fs66.existsSync(gitDir)) return;
+    const exclude = path77.join(gitDir, "info", "exclude");
     let existing = "";
     try {
-      existing = fs65.readFileSync(exclude, "utf8");
+      existing = fs66.readFileSync(exclude, "utf8");
     } catch {
     }
     if (existing.includes(".codeam/packs/")) return;
-    fs65.mkdirSync(path76.dirname(exclude), { recursive: true });
-    fs65.writeFileSync(exclude, `${existing.trimEnd()}
+    fs66.mkdirSync(path77.dirname(exclude), { recursive: true });
+    fs66.writeFileSync(exclude, `${existing.trimEnd()}
 .codeam/packs/
 `.trimStart());
   } catch {
@@ -39479,6 +39692,93 @@ async function mcpRouter() {
   });
 }
 
+// src/integrations/mcp-secrets.ts
+var fs68 = __toESM(require("fs"));
+var os53 = __toESM(require("os"));
+var path79 = __toESM(require("path"));
+var MCP_SECRETS_FILE_ENV = "CODEAM_MCP_SECRETS_FILE";
+function mcpSecretsDir() {
+  return path79.join(os53.homedir(), ".codeam", "mcp-secrets");
+}
+function mcpSecretsPath(scope, pid = process.pid) {
+  return path79.join(mcpSecretsDir(), `${pid}-${scope}.json`);
+}
+var registeredForCleanup = /* @__PURE__ */ new Set();
+function readFileVars(file) {
+  try {
+    const parsed = JSON.parse(fs68.readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object") return {};
+    const out2 = {};
+    for (const [k2, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out2[k2] = v;
+    }
+    return out2;
+  } catch {
+    return {};
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function pruneStale(dir) {
+  let names = [];
+  try {
+    names = fs68.readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const m = /^(\d+)-[a-z]+\.json$/.exec(name);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    if (pid === process.pid || pidAlive(pid)) continue;
+    try {
+      fs68.unlinkSync(path79.join(dir, name));
+    } catch {
+    }
+  }
+}
+function writeMcpSecrets(vars, file) {
+  try {
+    const dir = path79.dirname(file);
+    fs68.mkdirSync(dir, { recursive: true, mode: 448 });
+    pruneStale(dir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs68.writeFileSync(tmp, JSON.stringify(vars), { mode: 384 });
+    fs68.renameSync(tmp, file);
+    fs68.chmodSync(file, 384);
+    if (!registeredForCleanup.has(file)) {
+      registeredForCleanup.add(file);
+      process.once("exit", () => {
+        try {
+          fs68.unlinkSync(file);
+        } catch {
+        }
+      });
+    }
+    return file;
+  } catch {
+    return null;
+  }
+}
+function mcpSecretEnv(scope, vars) {
+  const file = writeMcpSecrets(vars, mcpSecretsPath(scope));
+  if (file) return [{ name: MCP_SECRETS_FILE_ENV, value: file }];
+  return Object.entries(vars).map(([name, value]) => ({ name, value }));
+}
+function loadMcpSecrets(env = process.env) {
+  const file = env[MCP_SECRETS_FILE_ENV];
+  if (!file) return;
+  for (const [k2, v] of Object.entries(readFileVars(file))) {
+    if (env[k2] === void 0) env[k2] = v;
+  }
+}
+
 // src/commands/preview-mcp.ts
 var PREVIEW_MCP_SERVER_NAME = "codeagent_preview";
 var PREVIEW_IPC_URL_ENV = "CODEAM_PREVIEW_IPC_URL";
@@ -39536,18 +39836,17 @@ function previewMcpServer(bridge) {
     // Same runtime + entrypoint as this CLI — never trust the agent's PATH.
     command: process.execPath,
     args: [process.argv[1], "preview-mcp"],
-    env: [
-      { name: PREVIEW_IPC_URL_ENV, value: bridge.url },
-      { name: PREVIEW_IPC_TOKEN_ENV, value: bridge.token }
-    ]
+    // The token rides the owner-only secrets file, never this env: the
+    // claude ACP adapter copies MCP env onto argv (codeagent-5bew).
+    env: [{ name: PREVIEW_IPC_URL_ENV, value: bridge.url }, ...mcpSecretEnv("preview", { [PREVIEW_IPC_TOKEN_ENV]: bridge.token })]
   };
 }
 function httpCall(baseUrl, token) {
-  return async (path96, method, body, timeoutMs) => {
+  return async (path97, method, body, timeoutMs) => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetch(`${baseUrl}${path96}`, {
+      const res = await fetch(`${baseUrl}${path97}`, {
         method,
         headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
         ...method === "POST" ? { body: JSON.stringify(body ?? {}) } : {},
@@ -39642,6 +39941,12 @@ async function previewMcp() {
 }
 
 // src/integrations/provision.ts
+function secretVars(ctx) {
+  return {
+    ...ctx.pluginAuthToken ? { CODEAM_MCP_PLUGIN_TOKEN: ctx.pluginAuthToken } : {},
+    ...ctx.pollSecret ? { CODEAM_MCP_POLL_SECRET: ctx.pollSecret } : {}
+  };
+}
 function buildMcpServersForStart(ctx) {
   const servers = buildIntegrationMcpServers(ctx);
   const preview = previewMcpServer(ctx.preview ?? null);
@@ -39661,9 +39966,10 @@ function buildIntegrationMcpServers(ctx) {
       { name: "CODEAM_MCP_INTEGRATION_ID", value: entry.id },
       { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
       { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
-      // Plugin token in ENV, never argv — argv is visible via `ps`.
-      { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
-      ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+      // ⚠️ Secrets via an owner-only FILE, not env values: the claude ACP
+      // adapter copies this env onto the agent's argv (`--mcp-config`), where
+      // `ps` shows it (codeagent-5bew). See `mcp-secrets.ts`.
+      ...mcpSecretEnv("integrations", secretVars(ctx))
     ];
     servers.push({
       name: entry.id,
@@ -39692,8 +39998,7 @@ function buildIntegrationMcpServers(ctx) {
         env: [
           { name: "CODEAM_MCP_SESSION_ID", value: ctx.sessionId },
           { name: "CODEAM_MCP_PLUGIN_ID", value: ctx.pluginId },
-          { name: "CODEAM_MCP_PLUGIN_TOKEN", value: ctx.pluginAuthToken },
-          ...ctx.pollSecret ? [{ name: "CODEAM_MCP_POLL_SECRET", value: ctx.pollSecret }] : []
+          ...mcpSecretEnv("integrations", secretVars(ctx))
         ]
       }
     ];
@@ -40263,7 +40568,7 @@ function logMentionOutcome(result) {
 }
 
 // src/agents/acp/command-handlers.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process24 = require("child_process");
 
 // src/agents/acp/buildAcpPromptBlocks.ts
 var MIME_FROM_EXT = {
@@ -41225,7 +41530,7 @@ async function prewarmNewMcpEntries(manifest, previousIds) {
     fresh.map(
       (e) => new Promise((resolve12) => {
         const mcp = e.delivery.mcp;
-        const child = (0, import_node_child_process23.execFile)(
+        const child = (0, import_node_child_process24.execFile)(
           mcp.command,
           [...mcp.args, "--help"],
           { timeout: 9e4 },
@@ -42394,11 +42699,11 @@ async function runAcpSession(opts) {
     if (swapOpts.house) {
       houseWireId = swapOpts.wireId ?? HOUSE_AGENT_ID;
       if (pendingHouseConfig) {
-        persistHouseProxyConfig(pendingHouseConfig);
+        persistHouseProxyConfig(pendingHouseConfig, deployIdFromWorkspace(process.cwd()) ?? void 0);
         pendingHouseConfig = null;
       }
     } else if (wasHouse) {
-      clearHouseProxyConfig();
+      clearHouseProxyConfig(deployIdFromWorkspace(process.cwd()) ?? void 0);
     }
     const managedBanner = swapOpts.house && isManagedProviderId(houseWireId) ? houseWireId : null;
     void publisher.publishOutput({
@@ -42437,17 +42742,17 @@ async function runAcpSession(opts) {
       switchCredentialEnv = provisionAgentCredentials(agentId, auth);
     },
     provisionHouseProxy: ({ baseUrl, token, model, managedAgentId }) => {
-      const claudeConfigDir = path80.join(
-        os53.homedir(),
+      const claudeConfigDir = path82.join(
+        os55.homedir(),
         ".codeam",
         "house-claude",
         `switch-${opts.pluginId}`
       );
       try {
-        fs69.mkdirSync(claudeConfigDir, { recursive: true, mode: 448 });
+        fs71.mkdirSync(claudeConfigDir, { recursive: true, mode: 448 });
       } catch {
       }
-      const memoryFile = path80.join(claudeConfigDir, "CLAUDE.md");
+      const memoryFile = path82.join(claudeConfigDir, "CLAUDE.md");
       ensureBeadsWorkflowHint(void 0, memoryFile);
       ensureAgentStandard(void 0, memoryFile);
       const cfg = {
@@ -43670,9 +43975,9 @@ function pickPinnedSession(pinnedId, listSessions2) {
 }
 
 // src/agents/retired-proxy-cleanup.ts
-var fs70 = __toESM(require("fs"));
-var path81 = __toESM(require("path"));
-var os54 = __toESM(require("os"));
+var fs72 = __toESM(require("fs"));
+var path83 = __toESM(require("path"));
+var os56 = __toESM(require("os"));
 var RETIRED_PROXY_RE = /^https?:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):8787(?:[/?#]|$)/i;
 var HEADROOM_CMD_RE = /(^|[\s/"'])headroom(\s|$)/i;
 var MARKETPLACE_KEY = "headroom-marketplace";
@@ -43681,12 +43986,12 @@ function isHeadroomHook(group) {
     (h) => typeof h?.command === "string" && HEADROOM_CMD_RE.test(h.command)
   );
 }
-function sanitizeRetiredProxyConfig(homeDir2 = os54.homedir()) {
+function sanitizeRetiredProxyConfig(homeDir2 = os56.homedir()) {
   const out2 = { inspected: false, changed: false, removed: [] };
-  const file = path81.join(homeDir2, ".claude", "settings.json");
+  const file = path83.join(homeDir2, ".claude", "settings.json");
   let parsed;
   try {
-    parsed = JSON.parse(fs70.readFileSync(file, "utf8"));
+    parsed = JSON.parse(fs72.readFileSync(file, "utf8"));
   } catch {
     return out2;
   }
@@ -43728,9 +44033,9 @@ function sanitizeRetiredProxyConfig(homeDir2 = os54.homedir()) {
   if (!out2.changed) return out2;
   try {
     const tmp = `${file}.codeam.tmp`;
-    fs70.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}
+    fs72.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}
 `, { mode: 384 });
-    fs70.renameSync(tmp, file);
+    fs72.renameSync(tmp, file);
   } catch {
     out2.changed = false;
   }
@@ -44262,7 +44567,7 @@ var AcpDriver = class {
 };
 
 // src/baton/transcript-mirror.ts
-var fs71 = __toESM(require("fs"));
+var fs73 = __toESM(require("fs"));
 var TranscriptMirror = class {
   constructor(deps) {
     this.deps = deps;
@@ -44356,7 +44661,7 @@ var TranscriptMirror = class {
   }
 };
 function defaultWatch(file, onChange) {
-  const w3 = fs71.watch(file, { persistent: false }, () => onChange());
+  const w3 = fs73.watch(file, { persistent: false }, () => onChange());
   return () => w3.close();
 }
 
@@ -44666,7 +44971,7 @@ function toEpochMs(ts) {
 }
 
 // src/services/keep-awake.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 function keepDeviceAwake(deps = {}) {
   const env = deps.env ?? process.env;
   const isLocal = deps.isLocal ?? isLocalSession(env);
@@ -44676,7 +44981,7 @@ function keepDeviceAwake(deps = {}) {
   if (env.CODEAM_NO_KEEP_AWAKE === "1") return noop;
   const command2 = deps.command !== void 0 ? deps.command : createOsStrategy().keepAwakeCommand(deps.pid ?? process.pid);
   if (!command2) return noop;
-  const spawnFn = deps.spawnFn ?? import_node_child_process24.spawn;
+  const spawnFn = deps.spawnFn ?? import_node_child_process25.spawn;
   let child = null;
   try {
     child = spawnFn(command2.cmd, command2.args, { stdio: "ignore", detached: true });
@@ -44702,16 +45007,16 @@ function keepDeviceAwake(deps = {}) {
 }
 
 // src/agents/claude/onboarding.ts
-var fs72 = __toESM(require("fs"));
-var os56 = __toESM(require("os"));
-var path82 = __toESM(require("path"));
+var fs74 = __toESM(require("fs"));
+var os58 = __toESM(require("os"));
+var path84 = __toESM(require("path"));
 var ONBOARDING_VERSION_SENTINEL = "9999.0.0";
 function ensureClaudeOnboarded(cwd) {
   try {
-    const file = path82.join(os56.homedir(), ".claude.json");
+    const file = path84.join(os58.homedir(), ".claude.json");
     let config = {};
     try {
-      config = JSON.parse(fs72.readFileSync(file, "utf8"));
+      config = JSON.parse(fs74.readFileSync(file, "utf8"));
     } catch {
     }
     let changed = false;
@@ -44736,8 +45041,8 @@ function ensureClaudeOnboarded(cwd) {
       }
     }
     if (!changed) return;
-    fs72.mkdirSync(path82.dirname(file), { recursive: true });
-    fs72.writeFileSync(file, JSON.stringify(config, null, 2));
+    fs74.mkdirSync(path84.dirname(file), { recursive: true });
+    fs74.writeFileSync(file, JSON.stringify(config, null, 2));
     log.info(
       "claude",
       `pre-completed Claude onboarding${cwd ? ` + trusted workspace ${cwd}` : ""}`
@@ -45514,8 +45819,8 @@ var import_picocolors10 = __toESM(require("picocolors"));
 var import_child_process30 = require("child_process");
 var import_util4 = require("util");
 var import_picocolors8 = __toESM(require("picocolors"));
-var path83 = __toESM(require("path"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process30.execFile);
+var path85 = __toESM(require("path"));
+var execFileP6 = (0, import_util4.promisify)(import_child_process30.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -45532,11 +45837,11 @@ var GitHubCodespacesProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP5("gh", ["--version"], { maxBuffer: MAX_BUFFER });
+      await execFileP6("gh", ["--version"], { maxBuffer: MAX_BUFFER });
     } catch {
       await this.tryInstallGh();
       try {
-        await execFileP5("gh", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("gh", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         throw new Error(
           [
@@ -45552,7 +45857,7 @@ var GitHubCodespacesProvider = class {
     }
     let isAuthed = false;
     try {
-      await execFileP5("gh", ["auth", "status"], { maxBuffer: MAX_BUFFER });
+      await execFileP6("gh", ["auth", "status"], { maxBuffer: MAX_BUFFER });
       isAuthed = true;
     } catch {
     }
@@ -45628,7 +45933,7 @@ var GitHubCodespacesProvider = class {
    */
   async getActiveGhUser() {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "user", "--jq", ".login"],
         { maxBuffer: MAX_BUFFER }
@@ -45648,7 +45953,7 @@ var GitHubCodespacesProvider = class {
    */
   async hasCodespaceScope() {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "-i", "user"],
         { maxBuffer: MAX_BUFFER }
@@ -45697,7 +46002,7 @@ var GitHubCodespacesProvider = class {
     let installCmd = null;
     if (platform3 === "darwin") {
       try {
-        await execFileP5("brew", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("brew", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         wt(
           [
@@ -45716,7 +46021,7 @@ var GitHubCodespacesProvider = class {
       };
     } else if (platform3 === "win32") {
       try {
-        await execFileP5("winget", ["--version"], { maxBuffer: MAX_BUFFER });
+        await execFileP6("winget", ["--version"], { maxBuffer: MAX_BUFFER });
       } catch {
         wt(
           [
@@ -45795,7 +46100,7 @@ var GitHubCodespacesProvider = class {
         "200"
       );
       try {
-        const { stdout } = await execFileP5("gh", args2, { maxBuffer: MAX_BUFFER });
+        const { stdout } = await execFileP6("gh", args2, { maxBuffer: MAX_BUFFER });
         return JSON.parse(stdout);
       } catch {
         return [];
@@ -45804,7 +46109,7 @@ var GitHubCodespacesProvider = class {
     const own = await fetchRepos();
     let orgRepos = [];
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", "--paginate", "user/orgs", "--jq", ".[].login"],
         { maxBuffer: MAX_BUFFER }
@@ -45841,7 +46146,7 @@ var GitHubCodespacesProvider = class {
    */
   async listMachineTypes(projectId) {
     try {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["api", `/repos/${projectId}/codespaces/machines`],
         { maxBuffer: MAX_BUFFER }
@@ -45872,7 +46177,7 @@ var GitHubCodespacesProvider = class {
     const machine = machineTypeId ?? await this.pickDefaultMachine(projectId);
     const args2 = ["codespace", "create", "-R", projectId, "--default-permissions"];
     if (machine) args2.push("-m", machine);
-    const { stdout } = await execFileP5(
+    const { stdout } = await execFileP6(
       "gh",
       args2,
       { maxBuffer: MAX_BUFFER, timeout: 12e4 }
@@ -45912,7 +46217,7 @@ var GitHubCodespacesProvider = class {
   async waitUntilAvailable(name) {
     const deadline = Date.now() + 5 * 60 * 1e3;
     while (Date.now() < deadline) {
-      const { stdout } = await execFileP5(
+      const { stdout } = await execFileP6(
         "gh",
         ["codespace", "list", "--json", "name,state"],
         { maxBuffer: MAX_BUFFER }
@@ -45930,7 +46235,7 @@ var GitHubCodespacesProvider = class {
   }
   async exec(workspaceId, command2) {
     try {
-      const { stdout, stderr } = await execFileP5(
+      const { stdout, stderr } = await execFileP6(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", command2],
         { maxBuffer: MAX_BUFFER, timeout: 6e5 }
@@ -46003,7 +46308,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path83.posix.dirname(remotePath);
+    const remoteDir = path85.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -46035,7 +46340,7 @@ var GitHubCodespacesProvider = class {
     try {
       const args2 = ["codespace", "list", "--json", "name,displayName,state,lastUsedAt"];
       if (projectId) args2.push("--repo", projectId);
-      const { stdout } = await execFileP5("gh", args2, { maxBuffer: MAX_BUFFER });
+      const { stdout } = await execFileP6("gh", args2, { maxBuffer: MAX_BUFFER });
       const list = JSON.parse(stdout);
       return list.map((c2) => ({
         id: c2.name,
@@ -46050,7 +46355,7 @@ var GitHubCodespacesProvider = class {
   }
   async startWorkspace(workspaceId) {
     try {
-      await execFileP5(
+      await execFileP6(
         "gh",
         ["api", "-X", "POST", `/user/codespaces/${workspaceId}/start`],
         { maxBuffer: MAX_BUFFER, timeout: 6e4 }
@@ -46073,9 +46378,9 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process31 = require("child_process");
 var import_util5 = require("util");
-var path84 = __toESM(require("path"));
+var path86 = __toESM(require("path"));
 var import_picocolors9 = __toESM(require("picocolors"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process31.execFile);
+var execFileP7 = (0, import_util5.promisify)(import_child_process31.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -46092,7 +46397,7 @@ var GitpodProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP6("gitpod", ["--version"], { maxBuffer: MAX_BUFFER2 });
+      await execFileP7("gitpod", ["--version"], { maxBuffer: MAX_BUFFER2 });
     } catch {
       throw new Error(
         [
@@ -46105,7 +46410,7 @@ var GitpodProvider = class {
       );
     }
     try {
-      await execFileP6("gitpod", ["whoami"], { maxBuffer: MAX_BUFFER2 });
+      await execFileP7("gitpod", ["whoami"], { maxBuffer: MAX_BUFFER2 });
       return;
     } catch {
     }
@@ -46125,7 +46430,7 @@ var GitpodProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP6(
+      const { stdout } = await execFileP7(
         "gitpod",
         ["workspace", "list", "--output", "json", "--limit", "200"],
         { maxBuffer: MAX_BUFFER2 }
@@ -46158,7 +46463,7 @@ var GitpodProvider = class {
   async createWorkspace(projectId, machineTypeId) {
     const args2 = ["workspace", "create", projectId, "--start", "--output", "json"];
     if (machineTypeId) args2.push("--class", machineTypeId);
-    const { stdout } = await execFileP6("gitpod", args2, {
+    const { stdout } = await execFileP7("gitpod", args2, {
       maxBuffer: MAX_BUFFER2,
       timeout: 3e5
     });
@@ -46182,7 +46487,7 @@ var GitpodProvider = class {
     const deadline = Date.now() + 5 * 60 * 1e3;
     while (Date.now() < deadline) {
       try {
-        const { stdout } = await execFileP6(
+        const { stdout } = await execFileP7(
           "gitpod",
           ["workspace", "get", workspaceId, "--output", "json"],
           { maxBuffer: MAX_BUFFER2 }
@@ -46200,7 +46505,7 @@ var GitpodProvider = class {
   }
   async listMachineTypes(_projectId) {
     try {
-      const { stdout } = await execFileP6(
+      const { stdout } = await execFileP7(
         "gitpod",
         ["organization", "list-classes", "--output", "json"],
         { maxBuffer: MAX_BUFFER2 }
@@ -46218,7 +46523,7 @@ var GitpodProvider = class {
   async listExistingWorkspaces(projectId) {
     try {
       const args2 = ["workspace", "list", "--output", "json", "--limit", "200"];
-      const { stdout } = await execFileP6("gitpod", args2, { maxBuffer: MAX_BUFFER2 });
+      const { stdout } = await execFileP7("gitpod", args2, { maxBuffer: MAX_BUFFER2 });
       const list = JSON.parse(stdout);
       return list.filter((w3) => !projectId || w3.contextUrl === projectId).map((w3) => ({
         id: w3.id,
@@ -46233,7 +46538,7 @@ var GitpodProvider = class {
   }
   async startWorkspace(workspaceId) {
     try {
-      await execFileP6(
+      await execFileP7(
         "gitpod",
         ["workspace", "start", workspaceId],
         { maxBuffer: MAX_BUFFER2, timeout: 6e4 }
@@ -46249,7 +46554,7 @@ var GitpodProvider = class {
   }
   async exec(workspaceId, command2) {
     try {
-      const { stdout, stderr } = await execFileP6(
+      const { stdout, stderr } = await execFileP7(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", command2],
         { maxBuffer: MAX_BUFFER2, timeout: 6e5 }
@@ -46313,7 +46618,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path84.posix.dirname(remotePath);
+    const remoteDir = path86.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -46349,8 +46654,8 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process32 = require("child_process");
 var import_util6 = require("util");
-var path85 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process32.execFile);
+var path87 = __toESM(require("path"));
+var execFileP8 = (0, import_util6.promisify)(import_child_process32.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -46368,7 +46673,7 @@ var GitLabWorkspacesProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP7("glab", ["--version"], { maxBuffer: MAX_BUFFER3 });
+      await execFileP8("glab", ["--version"], { maxBuffer: MAX_BUFFER3 });
     } catch {
       throw new Error(
         [
@@ -46382,7 +46687,7 @@ var GitLabWorkspacesProvider = class {
       );
     }
     try {
-      await execFileP7("glab", ["auth", "status"], { maxBuffer: MAX_BUFFER3 });
+      await execFileP8("glab", ["auth", "status"], { maxBuffer: MAX_BUFFER3 });
       return;
     } catch {
     }
@@ -46406,7 +46711,7 @@ var GitLabWorkspacesProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP7(
+      const { stdout } = await execFileP8(
         "glab",
         ["repo", "list", "--per-page", "200", "--output", "json"],
         { maxBuffer: MAX_BUFFER3 }
@@ -46538,7 +46843,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async exec(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     try {
-      const { stdout, stderr } = await execFileP7(
+      const { stdout, stderr } = await execFileP8(
         "ssh",
         [
           "-o",
@@ -46609,7 +46914,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path85.posix.dirname(remotePath);
+    const remoteDir = path87.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -46641,7 +46946,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
    */
   async getGlabToken() {
     try {
-      const { stdout, stderr } = await execFileP7(
+      const { stdout, stderr } = await execFileP8(
         "glab",
         ["auth", "status", "--show-token"],
         { maxBuffer: MAX_BUFFER3 }
@@ -46677,8 +46982,8 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process33 = require("child_process");
 var import_util7 = require("util");
-var path86 = __toESM(require("path"));
-var execFileP8 = (0, import_util7.promisify)(import_child_process33.execFile);
+var path88 = __toESM(require("path"));
+var execFileP9 = (0, import_util7.promisify)(import_child_process33.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -46695,7 +47000,7 @@ var RailwayProvider = class {
   available = true;
   async authorize() {
     try {
-      await execFileP8("railway", ["--version"], { maxBuffer: MAX_BUFFER4 });
+      await execFileP9("railway", ["--version"], { maxBuffer: MAX_BUFFER4 });
     } catch {
       throw new Error(
         [
@@ -46709,7 +47014,7 @@ var RailwayProvider = class {
       );
     }
     try {
-      await execFileP8("railway", ["whoami"], { maxBuffer: MAX_BUFFER4 });
+      await execFileP9("railway", ["whoami"], { maxBuffer: MAX_BUFFER4 });
       return;
     } catch {
     }
@@ -46729,7 +47034,7 @@ var RailwayProvider = class {
   }
   async listProjects() {
     try {
-      const { stdout } = await execFileP8(
+      const { stdout } = await execFileP9(
         "railway",
         ["list", "--json"],
         { maxBuffer: MAX_BUFFER4 }
@@ -46745,7 +47050,7 @@ var RailwayProvider = class {
       }));
     } catch {
       try {
-        const { stdout } = await execFileP8("railway", ["list"], { maxBuffer: MAX_BUFFER4 });
+        const { stdout } = await execFileP9("railway", ["list"], { maxBuffer: MAX_BUFFER4 });
         const projects = [];
         for (const line of stdout.split("\n")) {
           const trimmed = line.trim();
@@ -46796,7 +47101,7 @@ var RailwayProvider = class {
   async listExistingWorkspaces(projectId) {
     if (!projectId) return [];
     try {
-      const { stdout } = await execFileP8(
+      const { stdout } = await execFileP9(
         "railway",
         ["service", "list", "--project", projectId, "--json"],
         { maxBuffer: MAX_BUFFER4 }
@@ -46821,7 +47126,7 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     try {
-      await execFileP8(
+      await execFileP9(
         "railway",
         ["service", "restart", "--service", serviceId, "--project", projectId],
         { maxBuffer: MAX_BUFFER4, timeout: 6e4 }
@@ -46840,7 +47145,7 @@ var RailwayProvider = class {
       };
     }
     try {
-      const { stdout, stderr } = await execFileP8(
+      const { stdout, stderr } = await execFileP9(
         "railway",
         ["run", "--project", projectId, "--service", serviceId, "--", "bash", "-lc", command2],
         { maxBuffer: MAX_BUFFER4, timeout: 6e5 }
@@ -46913,7 +47218,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path86.posix.dirname(remotePath);
+    const remoteDir = path88.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -47453,14 +47758,14 @@ async function stopWorkspaceFromLocal(target) {
 }
 
 // src/commands/host/host-client.ts
-var fs73 = __toESM(require("fs"));
-var os57 = __toESM(require("os"));
-var path87 = __toESM(require("path"));
+var fs75 = __toESM(require("fs"));
+var os59 = __toESM(require("os"));
+var path89 = __toESM(require("path"));
 var import_node_crypto12 = require("crypto");
 function sampleCpuTimes() {
   let idle = 0;
   let total = 0;
-  for (const cpu of os57.cpus()) {
+  for (const cpu of os59.cpus()) {
     const t2 = cpu.times;
     idle += t2.idle;
     total += t2.user + t2.nice + t2.sys + t2.idle + t2.irq;
@@ -47479,8 +47784,8 @@ var MetricsCollector = class {
     const prev = this.prevCpu;
     this.prevCpu = current2;
     if (!prev) {
-      const cores = os57.cpus().length || 1;
-      const proxy = os57.loadavg()[0] / cores * 100;
+      const cores = os59.cpus().length || 1;
+      const proxy = os59.loadavg()[0] / cores * 100;
       return Math.min(100, Math.max(0, Math.round(proxy)));
     }
     const idleDelta = current2.idle - prev.idle;
@@ -47493,8 +47798,8 @@ var MetricsCollector = class {
   collect() {
     return {
       cpuPct: this.cpuPct(),
-      ramUsedMb: Math.round((os57.totalmem() - os57.freemem()) / 1048576),
-      ramTotalMb: Math.round(os57.totalmem() / 1048576),
+      ramUsedMb: Math.round((os59.totalmem() - os59.freemem()) / 1048576),
+      ramTotalMb: Math.round(os59.totalmem() / 1048576),
       latencyMs: this.lastLatencyMs
     };
   }
@@ -47503,19 +47808,19 @@ function apiBase() {
   return process.env.CODEAM_API_URL ?? resolveApiBaseUrl();
 }
 function hostIdentityPath() {
-  return path87.join(os57.homedir(), ".codeam", "host-agent.json");
+  return path89.join(os59.homedir(), ".codeam", "host-agent.json");
 }
 function collectOsInfo() {
   return {
-    distro: os57.platform(),
-    arch: os57.arch(),
-    kernel: os57.release(),
+    distro: os59.platform(),
+    arch: os59.arch(),
+    kernel: os59.release(),
     nodeVersion: process.versions.node
   };
 }
 function loadHostIdentity() {
   try {
-    const raw = fs73.readFileSync(hostIdentityPath(), "utf8");
+    const raw = fs75.readFileSync(hostIdentityPath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && typeof parsed.hostId === "string" && typeof parsed.hostToken === "string" && typeof parsed.controlPluginId === "string") {
       const p2 = parsed;
@@ -47534,8 +47839,8 @@ function loadHostIdentity() {
 }
 function saveHostIdentity(identity) {
   const file = hostIdentityPath();
-  fs73.mkdirSync(path87.dirname(file), { recursive: true, mode: 448 });
-  fs73.writeFileSync(file, JSON.stringify(identity, null, 2), {
+  fs75.mkdirSync(path89.dirname(file), { recursive: true, mode: 448 });
+  fs75.writeFileSync(file, JSON.stringify(identity, null, 2), {
     encoding: "utf8",
     mode: 384
   });
@@ -47580,7 +47885,7 @@ function isTerminalEnrollError(err) {
 }
 function deleteHostIdentity() {
   try {
-    fs73.rmSync(hostIdentityPath(), { force: true });
+    fs75.rmSync(hostIdentityPath(), { force: true });
   } catch {
   }
 }
@@ -47604,7 +47909,7 @@ async function postJson(pathname, body) {
 function resolveHostLabel(label) {
   const explicit = label?.trim();
   const envLabel = process.env.CODEAM_HOST_LABEL?.trim();
-  const resolved = explicit || envLabel || os57.hostname();
+  const resolved = explicit || envLabel || os59.hostname();
   return resolved.slice(0, 80);
 }
 async function redeemEnrollToken(token, label) {
@@ -47793,9 +48098,9 @@ async function host(args2) {
 
 // src/commands/host-agent.ts
 var import_node_child_process30 = require("child_process");
-var os62 = __toESM(require("os"));
-var fs78 = __toESM(require("fs"));
-var path92 = __toESM(require("path"));
+var os63 = __toESM(require("os"));
+var fs79 = __toESM(require("fs"));
+var path93 = __toESM(require("path"));
 
 // src/skills/persist-from-payload.ts
 function persistOrClearSkillsFromPayload(skills) {
@@ -47804,13 +48109,13 @@ function persistOrClearSkillsFromPayload(skills) {
 }
 
 // src/commands/host/session-state.ts
-var fs74 = __toESM(require("fs"));
-var os58 = __toESM(require("os"));
-var path88 = __toESM(require("path"));
+var fs76 = __toESM(require("fs"));
+var os60 = __toESM(require("os"));
+var path90 = __toESM(require("path"));
 function hostSessionStatePath(env = process.env) {
   const override = env.CODEAM_HOST_SESSION_STATE_FILE;
   if (override && override.trim()) return override.trim();
-  return path88.join(os58.homedir(), ".codeam", "host-agent-sessions.json");
+  return path90.join(os60.homedir(), ".codeam", "host-agent-sessions.json");
 }
 function isRecord5(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -47821,7 +48126,7 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
   return {
     load() {
       try {
-        const raw = JSON.parse(fs74.readFileSync(file, "utf8"));
+        const raw = JSON.parse(fs76.readFileSync(file, "utf8"));
         return Array.isArray(raw?.sessions) ? raw.sessions.filter(isRecord5) : [];
       } catch {
         return [];
@@ -47829,18 +48134,18 @@ function fileSessionChildStore(file = hostSessionStatePath()) {
     },
     save(list) {
       try {
-        fs74.mkdirSync(path88.dirname(file), { recursive: true, mode: 448 });
+        fs76.mkdirSync(path90.dirname(file), { recursive: true, mode: 448 });
         const tmp = `${file}.${process.pid}.tmp`;
-        fs74.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
+        fs76.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: list }, null, 2), {
           mode: 384
         });
-        fs74.renameSync(tmp, file);
+        fs76.renameSync(tmp, file);
       } catch {
       }
     },
     clear() {
       try {
-        fs74.rmSync(file, { force: true });
+        fs76.rmSync(file, { force: true });
       } catch {
       }
     }
@@ -47863,181 +48168,22 @@ function planSessionResume(records, max) {
   return { resume: ordered.slice(0, bound), dropped: ordered.slice(bound) };
 }
 function pickSavedSessionForWorkspace(sessions3, cwd) {
-  const target = path88.resolve(cwd);
+  const target = path90.resolve(cwd);
   const matches = sessions3.filter(
-    (s) => !!s.cwd && path88.resolve(s.cwd) === target && !!s.pluginId && !!s.pollSecret && !!s.agent
+    (s) => !!s.cwd && path90.resolve(s.cwd) === target && !!s.pluginId && !!s.pollSecret && !!s.agent
   );
   if (matches.length === 0) return null;
   matches.sort((a, b) => b.pairedAt - a.pairedAt);
   return matches[0];
 }
 
-// src/commands/host/workspace.ts
-var fs75 = __toESM(require("fs"));
-var os59 = __toESM(require("os"));
-var path89 = __toESM(require("path"));
-var import_node_child_process25 = require("child_process");
-var import_node_util5 = require("util");
-var execFileP9 = (0, import_node_util5.promisify)(import_node_child_process25.execFile);
-function isAbsolutePathTarget(target) {
-  return path89.isAbsolute(target);
-}
-function selfHostedWorkspaceRoot() {
-  return path89.join(os59.homedir(), ".codeam", "self-hosted");
-}
-function deployIdFromWorkspace(cwd) {
-  if (!cwd) return null;
-  const root = selfHostedWorkspaceRoot();
-  const resolved = path89.resolve(cwd);
-  const rel = path89.relative(root, resolved);
-  if (!rel || rel.startsWith("..") || path89.isAbsolute(rel)) return null;
-  const parts = rel.split(path89.sep).filter(Boolean);
-  if (parts.length !== 1) return null;
-  return parts[0];
-}
-function nonInteractiveGitEnv() {
-  return {
-    ...process.env,
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_ASKPASS: "",
-    GCM_INTERACTIVE: "never"
-  };
-}
-function githubOwnerRepo(repoRef) {
-  const trimmed = repoRef.trim();
-  const shorthand = /^([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
-  if (shorthand && !/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@")) {
-    return { owner: shorthand[1], repo: shorthand[2] };
-  }
-  const httpsMatch = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(trimmed);
-  if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
-  return null;
-}
-function gitlabProjectPath(repoRef) {
-  const trimmed = repoRef.trim();
-  const https9 = /^https?:\/\/gitlab\.com\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
-  if (https9) return https9[1];
-  if (!/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@") && trimmed.includes("/")) {
-    return trimmed.replace(/\.git$/, "");
-  }
-  return null;
-}
-function repoCloneUrl(repoRef, cloneToken, provider = "github") {
-  const trimmed = repoRef.trim();
-  if (provider === "gitlab") {
-    const glPath = gitlabProjectPath(trimmed);
-    if (glPath) {
-      return cloneToken ? `https://oauth2:${cloneToken}@gitlab.com/${glPath}.git` : `https://gitlab.com/${glPath}.git`;
-    }
-    if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
-  }
-  if (cloneToken) {
-    const gh = githubOwnerRepo(trimmed);
-    if (gh) {
-      return `https://x-access-token:${cloneToken}@github.com/${gh.owner}/${gh.repo}.git`;
-    }
-  }
-  if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
-  return `https://github.com/${trimmed.replace(/\.git$/, "")}.git`;
-}
-function maskCloneUrl(url2) {
-  return url2.replace(/(https?:\/\/)[^@/]+@/, "$1***@");
-}
-async function fetchGithubIdentity(token) {
-  try {
-    const res = await fetch("https://api.github.com/user", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "User-Agent": "codeam-cli",
-        Accept: "application/vnd.github+json"
-      }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    return { login: body.login, email: body.email ?? void 0 };
-  } catch {
-    return null;
-  }
-}
-async function configureGitCredentials(dest, repoRef, cloneToken, provider = "github") {
-  const isGitlab = provider === "gitlab";
-  if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
-  if (!cloneToken) return;
-  const credFile = path89.join(dest, ".git", "codeam-credentials");
-  const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
-` : `https://x-access-token:${cloneToken}@github.com
-`;
-  fs75.writeFileSync(credFile, credLine, { mode: 384 });
-  restrictToOwner(credFile);
-  const env = nonInteractiveGitEnv();
-  const git2 = (args2) => execFileP9("git", ["-C", dest, ...args2], { timeout: 3e4, env });
-  const credFilePosix = credFile.split(path89.sep).join("/");
-  await git2(["config", "--local", "--replace-all", "credential.helper", ""]).catch(() => {
-  });
-  await git2([
-    "config",
-    "--local",
-    "--add",
-    "credential.helper",
-    `store --file=${credFilePosix}`
-  ]).catch(() => {
-  });
-  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef, void 0, provider)]).catch(() => {
-  });
-  const hasIdentity = await git2(["config", "user.email"]).then(() => true).catch(() => false);
-  if (!hasIdentity) {
-    const who = isGitlab ? null : await fetchGithubIdentity(cloneToken);
-    const login = who?.login ?? "CodeAgent";
-    await git2(["config", "--local", "user.name", login]).catch(() => {
-    });
-    const email = who?.email ?? (isGitlab ? "agent@codeagent-mobile.com" : `${login}@users.noreply.github.com`);
-    await git2(["config", "--local", "user.email", email]).catch(() => {
-    });
-  }
-}
-function maskToken(text, cloneToken) {
-  const masked = maskCloneUrl(text);
-  if (cloneToken && cloneToken.length > 0) {
-    return masked.split(cloneToken).join("***");
-  }
-  return masked;
-}
-async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github", branch) {
-  if (isAbsolutePathTarget(repoOrPath)) {
-    if (!fs75.existsSync(repoOrPath)) {
-      throw new Error(`deploy target path does not exist: ${repoOrPath}`);
-    }
-    return repoOrPath;
-  }
-  const dest = path89.join(selfHostedWorkspaceRoot(), deployId);
-  if (fs75.existsSync(path89.join(dest, ".git"))) {
-    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
-    return dest;
-  }
-  fs75.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
-  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
-  const cloneArgs = branch ? ["clone", "--depth", "1", "--branch", branch, cloneUrl, dest] : ["clone", "--depth", "1", cloneUrl, dest];
-  try {
-    await execFileP9("git", cloneArgs, {
-      timeout: 12e4,
-      maxBuffer: 16 * 1024 * 1024,
-      env: nonInteractiveGitEnv()
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(`git clone failed for ${maskCloneUrl(cloneUrl)}: ${maskToken(reason, cloneToken)}`);
-  }
-  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
-  return dest;
-}
-
 // src/commands/host/git-tooling.ts
 var import_node_child_process26 = require("child_process");
-var fs76 = __toESM(require("fs"));
-var os60 = __toESM(require("os"));
-var path90 = __toESM(require("path"));
+var fs77 = __toESM(require("fs"));
+var os61 = __toESM(require("os"));
+var path91 = __toESM(require("path"));
 function codeamBinDir() {
-  return process.env.CODEAM_BIN_DIR ?? path90.join(os60.homedir(), ".codeam", "bin");
+  return process.env.CODEAM_BIN_DIR ?? path91.join(os61.homedir(), ".codeam", "bin");
 }
 var FALLBACK_GH_VERSION = "2.62.0";
 var RELEASE_API = "https://api.github.com/repos/cli/cli/releases/latest";
@@ -48069,7 +48215,7 @@ async function download(url2, dest) {
     const res = await fetch(url2, { headers: { "User-Agent": "codeam-cli" } });
     if (!res.ok || !res.body) return false;
     const buf = Buffer.from(await res.arrayBuffer());
-    fs76.writeFileSync(dest, buf);
+    fs77.writeFileSync(dest, buf);
     return true;
   } catch {
     return false;
@@ -48092,8 +48238,8 @@ async function ensureGhCli(runner, token, deps = {}) {
     const version3 = await resolveVersionFn(token);
     const asset = `gh_${version3}_${osToken}_${arch2}`;
     const url2 = `https://github.com/cli/cli/releases/download/v${version3}/${asset}.${ext}`;
-    const tmpRoot = fs76.mkdtempSync(path90.join(os60.tmpdir(), "codeam-gh-"));
-    const archive = path90.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs77.mkdtempSync(path91.join(os61.tmpdir(), "codeam-gh-"));
+    const archive = path91.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "gh download failed \u2014 skipping (git pull/push still work via the credential helper)");
       return null;
@@ -48103,16 +48249,16 @@ async function ensureGhCli(runner, token, deps = {}) {
       log.warn("host-agent", `gh archive extraction failed (code=${String(extract.code)}) \u2014 skipping`);
       return null;
     }
-    const extractedBin = path90.join(tmpRoot, asset, "bin", binaryName);
-    if (!fs76.existsSync(extractedBin)) {
+    const extractedBin = path91.join(tmpRoot, asset, "bin", binaryName);
+    if (!fs77.existsSync(extractedBin)) {
       log.warn("host-agent", "gh binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs76.mkdirSync(binDir, { recursive: true });
-    const target = path90.join(binDir, binaryName);
-    fs76.copyFileSync(extractedBin, target);
-    fs76.chmodSync(target, 493);
+    fs77.mkdirSync(binDir, { recursive: true });
+    const target = path91.join(binDir, binaryName);
+    fs77.copyFileSync(extractedBin, target);
+    fs77.chmodSync(target, 493);
     log.info("host-agent", `gh installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -48149,19 +48295,19 @@ async function ensureGhAuth(runner, ghCmd, token) {
 }
 function ghConfigDir() {
   if (process.env.GH_CONFIG_DIR) return process.env.GH_CONFIG_DIR;
-  if (process.env.XDG_CONFIG_HOME) return path90.join(process.env.XDG_CONFIG_HOME, "gh");
+  if (process.env.XDG_CONFIG_HOME) return path91.join(process.env.XDG_CONFIG_HOME, "gh");
   if (process.platform === "win32" && process.env.APPDATA) {
-    return path90.join(process.env.APPDATA, "GitHub CLI");
+    return path91.join(process.env.APPDATA, "GitHub CLI");
   }
-  return path90.join(os60.homedir(), ".config", "gh");
+  return path91.join(os61.homedir(), ".config", "gh");
 }
 function writeGhHostsToken(token) {
   try {
     const dir = ghConfigDir();
-    const file = path90.join(dir, "hosts.yml");
-    if (fs76.existsSync(file)) return false;
-    fs76.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs76.writeFileSync(
+    const file = path91.join(dir, "hosts.yml");
+    if (fs77.existsSync(file)) return false;
+    fs77.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs77.writeFileSync(
       file,
       `github.com:
     oauth_token: ${token}
@@ -48204,8 +48350,8 @@ async function ensureGlabCli(runner, deps = {}) {
     const version3 = await resolveLatestGlabVersion();
     const asset = `glab_${version3}_${osToken}_${arch2}`;
     const url2 = `https://gitlab.com/gitlab-org/cli/-/releases/v${version3}/downloads/${asset}.${ext}`;
-    const tmpRoot = fs76.mkdtempSync(path90.join(os60.tmpdir(), "codeam-glab-"));
-    const archive = path90.join(tmpRoot, `${asset}.${ext}`);
+    const tmpRoot = fs77.mkdtempSync(path91.join(os61.tmpdir(), "codeam-glab-"));
+    const archive = path91.join(tmpRoot, `${asset}.${ext}`);
     if (!await downloadFn(url2, archive)) {
       log.warn("host-agent", "glab download failed \u2014 skipping (git push/pull still work)");
       return null;
@@ -48216,20 +48362,20 @@ async function ensureGlabCli(runner, deps = {}) {
       return null;
     }
     const candidates = [
-      path90.join(tmpRoot, "bin", binaryName),
-      path90.join(tmpRoot, asset, "bin", binaryName),
-      path90.join(tmpRoot, binaryName)
+      path91.join(tmpRoot, "bin", binaryName),
+      path91.join(tmpRoot, asset, "bin", binaryName),
+      path91.join(tmpRoot, binaryName)
     ];
-    const extractedBin = candidates.find((c2) => fs76.existsSync(c2));
+    const extractedBin = candidates.find((c2) => fs77.existsSync(c2));
     if (!extractedBin) {
       log.warn("host-agent", "glab binary not found in the extracted archive \u2014 skipping");
       return null;
     }
     const binDir = codeamBinDir();
-    fs76.mkdirSync(binDir, { recursive: true });
-    const target = path90.join(binDir, binaryName);
-    fs76.copyFileSync(extractedBin, target);
-    fs76.chmodSync(target, 493);
+    fs77.mkdirSync(binDir, { recursive: true });
+    const target = path91.join(binDir, binaryName);
+    fs77.copyFileSync(extractedBin, target);
+    fs77.chmodSync(target, 493);
     log.info("host-agent", `glab installed to ${target} (v${version3})`);
     return target;
   } catch (e) {
@@ -48311,9 +48457,9 @@ var defaultGitToolingRunner = {
 var import_node_child_process28 = require("child_process");
 
 // src/lib/updateNotifier.ts
-var fs77 = __toESM(require("fs"));
-var os61 = __toESM(require("os"));
-var path91 = __toESM(require("path"));
+var fs78 = __toESM(require("fs"));
+var os62 = __toESM(require("os"));
+var path92 = __toESM(require("path"));
 var https8 = __toESM(require("https"));
 var import_node_child_process27 = require("child_process");
 var import_picocolors12 = __toESM(require("picocolors"));
@@ -48322,12 +48468,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path91.join(os61.homedir(), ".codeam");
-  return path91.join(dir, "update-check.json");
+  const dir = path92.join(os62.homedir(), ".codeam");
+  return path92.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs77.readFileSync(cachePath(), "utf8");
+    const raw = fs78.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -48338,10 +48484,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs77.mkdirSync(path91.dirname(file), { recursive: true });
+    fs78.mkdirSync(path92.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs77.writeFileSync(tmp, JSON.stringify(cache));
-    fs77.renameSync(tmp, file);
+    fs78.writeFileSync(tmp, JSON.stringify(cache));
+    fs78.renameSync(tmp, file);
   } catch {
   }
 }
@@ -48415,8 +48561,8 @@ function isLinkedInstall() {
       timeout: 2e3
     }).trim();
     if (!root) return false;
-    const pkgPath = path91.join(root, PKG_NAME);
-    return fs77.lstatSync(pkgPath).isSymbolicLink();
+    const pkgPath = path92.join(root, PKG_NAME);
+    return fs78.lstatSync(pkgPath).isSymbolicLink();
   } catch {
     return false;
   }
@@ -48452,7 +48598,7 @@ function maybeAutoUpdate(currentVersion, latest) {
     return;
   }
   try {
-    fs77.unlinkSync(cachePath());
+    fs78.unlinkSync(cachePath());
   } catch {
   }
   process.stderr.write(`  ${import_picocolors12.default.green("\u2713")} Updated. Resuming session...
@@ -48468,7 +48614,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.26" : null;
+  const current2 = true ? "2.75.28" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48485,7 +48631,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.26" : null;
+  const current2 = true ? "2.75.28" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48508,7 +48654,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.26" : null;
+  return true ? "2.75.28" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -48657,6 +48803,9 @@ function isDeployPayload(p2) {
 function isStopPayload(p2) {
   return typeof p2.sessionId === "string";
 }
+function isResumePayload(p2) {
+  return typeof p2.sessionId === "string" && p2.sessionId.length > 0;
+}
 function isCleanupPayload(p2) {
   return typeof p2.deployId === "string" && p2.deployId.length > 0;
 }
@@ -48945,10 +49094,7 @@ var HostAgentSupervisor = class {
     this.heartbeatTimer = setInterval(() => void this.beat(), HEARTBEAT_INTERVAL_MS);
     this.heartbeatTimer.unref?.();
     this.resumePersistedSessions();
-    void reportSessionEvent(
-      { hostId: this.identity.hostId, hostToken: this.identity.hostToken },
-      { event: "reconcile", activeDeployIds: this.activeSessions().map((s) => s.id) }
-    ).catch((err) => log.trace("host-agent", "boot reconcile failed (best-effort)", err));
+    this.reportLiveSet("boot");
     const updateMs = this.selfUpdateIntervalMs();
     if (updateMs > 0) {
       this.selfUpdateTimer = setInterval(() => void this.selfUpdateTick(), updateMs);
@@ -49194,6 +49340,14 @@ var HostAgentSupervisor = class {
       this.stopChild(cmd.payload.sessionId);
       return;
     }
+    if (cmd.type === "self_hosted_resume") {
+      if (!isResumePayload(cmd.payload)) {
+        log.warn("host-agent", `ignoring malformed self_hosted_resume id=${cmd.id}`);
+        return;
+      }
+      this.resumeSavedSession(cmd.payload.sessionId);
+      return;
+    }
     if (cmd.type === "self_hosted_cleanup") {
       if (!isCleanupPayload(cmd.payload)) {
         log.warn("host-agent", `ignoring malformed self_hosted_cleanup id=${cmd.id}`);
@@ -49241,13 +49395,13 @@ var HostAgentSupervisor = class {
     const relay = this.relay;
     if (!relay) return;
     const raw = cmd.payload?.path;
-    const target = typeof raw === "string" && raw.trim() ? path92.resolve(raw.trim()) : os62.homedir();
+    const target = typeof raw === "string" && raw.trim() ? path93.resolve(raw.trim()) : os63.homedir();
     try {
-      const dirents = await fs78.promises.readdir(target, { withFileTypes: true });
+      const dirents = await fs79.promises.readdir(target, { withFileTypes: true });
       const entries = dirents.filter((d3) => !d3.name.startsWith(".")).map((d3) => ({ name: d3.name, isDir: d3.isDirectory() })).sort(
         (a, b) => a.isDir === b.isDir ? a.name.localeCompare(b.name) : a.isDir ? -1 : 1
       );
-      const parent = path92.dirname(target);
+      const parent = path93.dirname(target);
       await relay.sendResult(cmd.id, "completed", {
         path: target,
         // null at the filesystem root so the UI can hide the ".." affordance.
@@ -49594,14 +49748,14 @@ var HostAgentSupervisor = class {
           ...buildHouseProxyChildEnv({ baseUrl, token, openRouter: openRouter === true }),
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        const houseConfigDir = path92.join(
-          os62.homedir(),
+        const houseConfigDir = path93.join(
+          os63.homedir(),
           ".codeam",
           "house-claude",
           payload.deployId
         );
         try {
-          fs78.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
+          fs79.mkdirSync(houseConfigDir, { recursive: true, mode: 448 });
         } catch {
         }
         childEnv.CLAUDE_CONFIG_DIR = houseConfigDir;
@@ -49611,7 +49765,7 @@ var HostAgentSupervisor = class {
           token,
           openRouter: !!openRouter,
           claudeConfigDir: houseConfigDir
-        });
+        }, payload.deployId);
       } else {
         const auth = await this.resolveAgentAuth(this.identity, payload.sealedAgentAuth);
         const credEnv = provisionAgentCredentials(payload.agentId, auth, void 0);
@@ -49619,7 +49773,7 @@ var HostAgentSupervisor = class {
           ...credEnv,
           CODEAM_AUTO_TOKEN: payload.autoPairToken
         };
-        clearHouseProxyConfig();
+        clearHouseProxyConfig(payload.deployId);
       }
       childEnv = { ...childEnv, CODEAM_AUTO_APPROVE: "1" };
       childEnv = { ...childEnv, CODEAM_HOST_AGENT_CHILD: "1" };
@@ -49627,7 +49781,7 @@ var HostAgentSupervisor = class {
         report("installing", "installing agent CLI");
         await this.runAgentInstall(payload.agentInstallScript);
       }
-      const home = process.env.HOME || os62.homedir();
+      const home = process.env.HOME || os63.homedir();
       childEnv.PATH = `${home}/.local/bin:${process.env.PATH ?? ""}`;
       if (payload.cloneToken) {
         try {
@@ -49635,13 +49789,13 @@ var HostAgentSupervisor = class {
           if ((payload.repoProvider ?? "github") === "gitlab") {
             const glabCmd = await ensureGlabCli(defaultGitToolingRunner);
             if (glabCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path92.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path93.delimiter}${childEnv.PATH}`;
               await ensureGlabAuth(defaultGitToolingRunner, glabCmd, payload.cloneToken);
             }
           } else {
             const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
             if (ghCmd) {
-              childEnv.PATH = `${codeamBinDir()}${path92.delimiter}${childEnv.PATH}`;
+              childEnv.PATH = `${codeamBinDir()}${path93.delimiter}${childEnv.PATH}`;
               await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
             }
           }
@@ -49669,9 +49823,9 @@ var HostAgentSupervisor = class {
       );
       if (!payload.suppressOnboardingWelcome) {
         try {
-          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path92.join(os62.homedir(), ".claude");
-          const projectDir = path92.join(cfgDir, "projects", encodeCwd(cwd));
-          const hasPriorConversation = fs78.existsSync(projectDir) && fs78.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
+          const cfgDir = childEnv.CLAUDE_CONFIG_DIR || path93.join(os63.homedir(), ".claude");
+          const projectDir = path93.join(cfgDir, "projects", encodeCwd(cwd));
+          const hasPriorConversation = fs79.existsSync(projectDir) && fs79.readdirSync(projectDir).some((f) => f.endsWith(".jsonl"));
           if (hasPriorConversation) {
             childEnv.CODEAM_RESUME_LATEST = "1";
             log.info(
@@ -49799,7 +49953,7 @@ var HostAgentSupervisor = class {
           );
           continue;
         }
-        this.resumeOne({ deployId: rec.deployId, cwd: rec.cwd, session });
+        this.resumeOne({ deployId: rec.deployId, cwd: rec.cwd, session, agent: rec.agent });
         resumed += 1;
       }
       log.info(
@@ -49822,7 +49976,7 @@ var HostAgentSupervisor = class {
   fallbackResumeTarget() {
     const session = getActiveSession();
     if (!session || !session.pluginId || !session.pollSecret || !session.agent) return null;
-    const cwd = session.cwd && fs78.existsSync(session.cwd) ? session.cwd : process.cwd();
+    const cwd = session.cwd && fs79.existsSync(session.cwd) ? session.cwd : process.cwd();
     const deployId = deployIdFromWorkspace(session.cwd) ?? session.id;
     return { deployId, cwd, session };
   }
@@ -49836,23 +49990,94 @@ var HostAgentSupervisor = class {
     }
     return st3;
   }
+  /**
+   * `self_hosted_resume` — the user opened (or reconnected) a session this box
+   * is not running. A boot resumes only the children that were LIVE when the
+   * box went down, so any other saved session was a dead card: the app said
+   * "waking up — your message is queued", the box woke, and the session never
+   * came back (codeagent-o7lm, QA box 2026-09-25: 4 saved sessions, 2 resumed).
+   *
+   * Resumes it through the same `resumeOne` a boot uses (bounded retries,
+   * house-proxy env, persisted into the live set), then re-reports the live
+   * set so the backend restores the session's host link. No-op when the
+   * session is unknown, lacks its pairing, or its workspace is gone — the app
+   * then keeps its offline state instead of a phantom "waking".
+   */
+  resumeSavedSession(sessionId) {
+    const session = this.listSavedSessions().find((s) => s.id === sessionId);
+    if (!session || !session.pluginId || !session.pollSecret || !session.agent) {
+      log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: no saved pairing on this box`);
+      return;
+    }
+    if (!session.cwd || !fs79.existsSync(session.cwd)) {
+      log.warn("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: workspace is gone`);
+      return;
+    }
+    const deployId = deployIdFromWorkspace(session.cwd) ?? session.id;
+    if (this.children.has(deployId)) {
+      log.info("host-agent", `self_hosted_resume ${sessionId.slice(0, 8)}: already live`);
+      return;
+    }
+    this.resumeOne({ deployId, cwd: session.cwd, session });
+    this.reportLiveSet("resume");
+  }
+  /**
+   * Tell the backend exactly which sessions this host runs. `activeSessions`
+   * (additive) carries the PairedSession id of every child that knows it, so a
+   * link lost to host-identity churn is rebuilt instead of the session
+   * rendering as LOCAL with a reconnect the user cannot perform.
+   */
+  reportLiveSet(why) {
+    const children = [...this.children.values()];
+    void reportSessionEvent(
+      { hostId: this.identity.hostId, hostToken: this.identity.hostToken },
+      {
+        event: "reconcile",
+        activeDeployIds: children.map((c2) => c2.deployId),
+        activeSessions: children.filter((c2) => typeof c2.sessionId === "string").map((c2) => ({ deployId: c2.deployId, sessionId: c2.sessionId, agent: c2.agent })),
+        knownSessions: this.knownSavedSessions()
+      }
+    ).catch((err) => log.trace("host-agent", `${why} reconcile failed (best-effort)`, err));
+  }
+  /**
+   * Every saved session this host could resume — a pairing whose deploy
+   * workspace is still on disk — live or not. The backend links the non-live
+   * ones too, so the app knows they belong to THIS box and wakes + resumes it
+   * when the user opens one, instead of showing a LOCAL session with a
+   * "run codeam in your terminal" the user cannot do (codeagent-bbou).
+   */
+  knownSavedSessions() {
+    try {
+      const persisted = new Map(this.sessionStore.load().map((r) => [r.deployId, r.agent]));
+      for (const c2 of this.children.values()) persisted.set(c2.deployId, c2.agent);
+      return this.listSavedSessions().map((s) => ({ s, deployId: deployIdFromWorkspace(s.cwd) })).filter(
+        (x) => x.deployId !== null && !!x.s.cwd && fs79.existsSync(x.s.cwd)
+      ).map(({ s, deployId }) => {
+        const agent = persisted.get(deployId);
+        return { deployId, sessionId: s.id, ...agent ? { agent } : {} };
+      });
+    } catch {
+      return [];
+    }
+  }
   /** Spawn ONE resume child for `target` (boot, retry, or re-probe). */
   resumeOne(target) {
     const { session, deployId } = target;
     if (this.children.has(deployId)) return;
     const st3 = this.resumeStateFor(target);
     try {
-      const cwd = fs78.existsSync(target.cwd) ? target.cwd : process.cwd();
+      const cwd = fs79.existsSync(target.cwd) ? target.cwd : process.cwd();
       const proc = this.resumeSpawner(
-        { ...readHouseProxyChildEnv(), CODEAM_RESUME_SESSION_ID: session.id },
+        { ...readHouseProxyChildEnv(deployId), CODEAM_RESUME_SESSION_ID: session.id },
         cwd
       );
       const child = {
         deployId,
         proc,
         cwd,
-        agent: session.agent,
-        startedAt: Date.now()
+        agent: target.agent ?? session.agent,
+        startedAt: Date.now(),
+        sessionId: session.id
       };
       this.trackChild(child);
       let tail = "";
@@ -49868,7 +50093,7 @@ var HostAgentSupervisor = class {
           return;
         }
         if (tracked && signal) {
-          this.onResumeChildExit(target, 128 + (os62.constants.signals[signal] ?? 9), `signal ${signal}`);
+          this.onResumeChildExit(target, 128 + (os63.constants.signals[signal] ?? 9), `signal ${signal}`);
           return;
         }
         log.warn(
@@ -49911,7 +50136,7 @@ var HostAgentSupervisor = class {
     if (Date.now() - child.startedAt < CRASH_RESPAWN_MIN_UPTIME_MS) return false;
     const session = pickSavedSessionForWorkspace(this.listSavedSessions(), child.cwd);
     if (!session) return false;
-    const exitCode = typeof code === "number" ? code : 128 + (signal ? os62.constants.signals[signal] ?? 9 : 9);
+    const exitCode = typeof code === "number" ? code : 128 + (signal ? os63.constants.signals[signal] ?? 9 : 9);
     log.warn(
       "host-agent",
       `session deploy=${child.deployId.slice(0, 8)} died (${signal ?? code}) after ${Math.round((Date.now() - child.startedAt) / 1e3)}s \u2014 respawning it (resume)`
@@ -50060,12 +50285,12 @@ var HostAgentSupervisor = class {
       this.untrackChild(deployId);
     }
     const dirs = [
-      path92.join(selfHostedWorkspaceRoot(), deployId),
-      path92.join(os62.homedir(), ".codeam", "house-claude", deployId)
+      path93.join(selfHostedWorkspaceRoot(), deployId),
+      path93.join(os63.homedir(), ".codeam", "house-claude", deployId)
     ];
     for (const dir of dirs) {
       try {
-        fs78.rmSync(dir, { recursive: true, force: true });
+        fs79.rmSync(dir, { recursive: true, force: true });
       } catch (err) {
         log.warn(
           "host-agent",
@@ -50225,8 +50450,8 @@ async function invite() {
 var import_node_dns = require("dns");
 var import_node_util6 = require("util");
 var import_node_crypto13 = require("crypto");
-var fs79 = __toESM(require("fs"));
-var path93 = __toESM(require("path"));
+var fs80 = __toESM(require("fs"));
+var path94 = __toESM(require("path"));
 var import_picocolors14 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util6.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase2) {
@@ -50282,13 +50507,13 @@ async function checkHealth(apiBase2) {
   }
 }
 function checkConfigDir() {
-  const dir = path93.join(require("os").homedir(), ".codeam");
+  const dir = path94.join(require("os").homedir(), ".codeam");
   try {
-    fs79.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path93.join(dir, ".doctor-probe");
-    fs79.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs79.readFileSync(probe, "utf8");
-    fs79.unlinkSync(probe);
+    fs80.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path94.join(dir, ".doctor-probe");
+    fs80.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs80.readFileSync(probe, "utf8");
+    fs80.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -50328,9 +50553,9 @@ function checkSessions() {
   }
 }
 function checkAgentBinaries() {
-  const os65 = createOsStrategy();
+  const os66 = createOsStrategy();
   return getEnabledAgents().map((meta) => {
-    const found = os65.findInPath(meta.binaryName);
+    const found = os66.findInPath(meta.binaryName);
     return {
       id: `agent-${meta.id}`,
       label: `Agent binary: ${meta.displayName} (${meta.binaryName})`,
@@ -50352,7 +50577,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path93.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path94.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -50394,7 +50619,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.26" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.28" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -50918,7 +51143,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.26" : "unknown";
+  const v = true ? "2.75.28" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 
@@ -51067,10 +51292,10 @@ var EXIT_CODE_NAMES = {
 };
 
 // src/index.ts
-var os64 = __toESM(require("os"));
+var os65 = __toESM(require("os"));
 if (!process.env.HOME) {
   try {
-    const home = os64.homedir();
+    const home = os65.homedir();
     if (home) process.env.HOME = home;
   } catch {
   }
@@ -51116,6 +51341,9 @@ async function main() {
     await commands[command]();
     return;
   }
+  if (command === "mcp-run" || command === "mcp-router" || command === "preview-mcp") {
+    loadMcpSecrets();
+  }
   if (command === "mcp-run") {
     return mcpRun(args);
   }