codeam-cli 2.75.45 → 2.75.46

package/dist/index.js

@@ -3763,9 +3763,9 @@ var _default = makeConfig();
 var { getConfig, ensurePluginId, addSession, removeSession, setActiveSession, getActiveSession, getActiveSessionForAgent, setDisable1mContext, setSessionAgent, setSquadAuto, getSquadAuto, clearAll, saveCliConfig, loadCliConfig } = _default;
 
 // src/commands/pair-auto.ts
-var fs52 = __toESM(require("fs"));
-var os40 = __toESM(require("os"));
-var path60 = __toESM(require("path"));
+var fs54 = __toESM(require("fs"));
+var os42 = __toESM(require("os"));
+var path62 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
 
 // src/services/telemetry.service.ts
@@ -10577,7 +10577,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.75.45" : "0.0.0-dev",
+    cliVersion: true ? "2.75.46" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -10822,7 +10822,7 @@ var http = __toESM(require("http"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.75.45",
+  version: "2.75.46",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -12156,7 +12156,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.75.45" ? { ideVersion: "2.75.45" } : {}
+      ..."2.75.46" ? { ideVersion: "2.75.46" } : {}
     };
     try {
       const res = await _postJson(`${API_BASE2}/api/plugin/heartbeat`, body);
@@ -13632,9 +13632,9 @@ function closeAllTerminals() {
 }
 
 // src/commands/start/handlers.ts
-var fs51 = __toESM(require("fs"));
-var os39 = __toESM(require("os"));
-var path59 = __toESM(require("path"));
+var fs53 = __toESM(require("fs"));
+var os41 = __toESM(require("os"));
+var path61 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 var import_child_process25 = require("child_process");
 
@@ -17638,6 +17638,8 @@ async function spawnAndCapture(cmd, args2, opts = {}) {
       clearTimeout(timer);
       activeChildren.delete(child);
       if (code !== 0) {
+        const failedOut = stdout.trim();
+        if (failedOut) opts.onFailedOutput?.(failedOut);
         settle(null);
         return;
       }
@@ -18143,6 +18145,7 @@ var ClaudeRuntimeStrategy = class {
     if (!launch) return null;
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -19230,6 +19233,7 @@ var CodexRuntimeStrategy = class {
     const launch = this.os.buildLaunch(binary, ["exec", prompt]);
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -20335,6 +20339,7 @@ var CursorRuntimeStrategy = class {
     const launch = this.os.buildLaunch(binary, ["--print", "--force", "--trust", prompt]);
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -21138,6 +21143,7 @@ var GeminiRuntimeStrategy = class {
     const launch = this.os.buildLaunch(binary, ["--skip-trust", "-p", prompt]);
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -21416,6 +21422,7 @@ var KimiRuntimeStrategy = class {
     const launch = this.os.buildLaunch(binary, ["-p", prompt, "--output-format", "text"]);
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -21536,6 +21543,7 @@ var OpencodeRuntimeStrategy = class {
     const launch = this.os.buildLaunch(binary, ["run", prompt]);
     return spawnAndCapture(launch.cmd, launch.args, {
       onStderr: opts?.onStderr,
+      onFailedOutput: opts?.onFailedOutput,
       cwd: opts?.cwd,
       timeoutMs: opts?.timeoutMs
     });
@@ -22676,17 +22684,548 @@ function setGuardrailPolicy(raw, homeDir2 = os28.homedir()) {
   return next;
 }
 
-// src/services/preview/port-registry.ts
-var fs33 = __toESM(require("fs"));
-var os29 = __toESM(require("os"));
+// src/agents/acp/oneMContextRecovery.ts
+var ONE_M_CONTEXT_CREDITS_RE = /usage credits required for 1m context/i;
+function looksLike1mContextCreditsError(text) {
+  return ONE_M_CONTEXT_CREDITS_RE.test(text);
+}
+function shouldOfferOneMRecovery(opts) {
+  return looksLike1mContextCreditsError(opts.detail) || looksLike1mContextCreditsError(opts.recentStderr) || looksLike1mContextCreditsError(opts.finalText);
+}
+
+// src/commands/host/house-proxy-config.ts
+var fs34 = __toESM(require("fs"));
+var os30 = __toESM(require("os"));
 var path40 = __toESM(require("path"));
+
+// src/lib/restrict-to-owner.ts
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_os4 = __toESM(require("os"));
+var import_node_child_process18 = require("child_process");
+var BROAD_WINDOWS_SIDS = [
+  "*S-1-1-0",
+  "*S-1-5-11",
+  "*S-1-5-32-545",
+  "*S-1-5-32-544",
+  "*S-1-5-18"
+];
+function restrictToOwner(filePath) {
+  try {
+    if (process.platform === "win32") {
+      const username = import_node_os4.default.userInfo().username;
+      (0, import_node_child_process18.execFileSync)(
+        "icacls",
+        [
+          filePath,
+          "/inheritance:r",
+          "/grant:r",
+          `${username}:F`,
+          ...BROAD_WINDOWS_SIDS.flatMap((sid) => ["/remove", sid])
+        ],
+        { stdio: "ignore" }
+      );
+    } else {
+      import_node_fs7.default.chmodSync(filePath, 384);
+    }
+  } catch {
+  }
+}
+
+// src/commands/host/house-proxy-config.ts
+function houseProxyConfigPath() {
+  return path40.join(os30.homedir(), ".codeam", "house-proxy.json");
+}
+var DEPLOY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function deployHouseProxyConfigPath(deployId) {
+  if (!DEPLOY_ID_RE.test(deployId) || deployId.includes("..")) return null;
+  return path40.join(os30.homedir(), ".codeam", "house-proxy", `${deployId}.json`);
+}
+function writeJson0600(file, value) {
+  fs34.mkdirSync(path40.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs34.writeFileSync(tmp, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 384 });
+  fs34.renameSync(tmp, file);
+  restrictToOwner(file);
+}
+function persistHouseProxyConfig(config, deployId) {
+  try {
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, config);
+    writeJson0600(houseProxyConfigPath(), config);
+  } catch (err) {
+    log.warn(
+      "host-agent",
+      `failed to persist house-proxy config (best-effort): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function clearHouseProxyConfig(deployId) {
+  try {
+    fs34.rmSync(houseProxyConfigPath(), { force: true });
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    if (perDeploy) writeJson0600(perDeploy, { none: true });
+  } catch {
+  }
+}
+function readHouseProxyChildEnv(deployId) {
+  try {
+    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
+    const file = perDeploy && fs34.existsSync(perDeploy) ? perDeploy : houseProxyConfigPath();
+    const raw = fs34.readFileSync(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const o = parsed;
+    if (o.none === true) return {};
+    if (typeof o.baseUrl !== "string" || !o.baseUrl) return {};
+    if (typeof o.token !== "string" || !o.token) return {};
+    return buildHouseProxyChildEnv({
+      baseUrl: o.baseUrl,
+      token: o.token,
+      openRouter: o.openRouter === true,
+      ...typeof o.claudeConfigDir === "string" && o.claudeConfigDir ? { claudeConfigDir: o.claudeConfigDir } : {},
+      ...typeof o.model === "string" && o.model ? { model: o.model } : {},
+      ...typeof o.managedAgentId === "string" && o.managedAgentId ? { managedAgentId: o.managedAgentId } : {}
+    });
+  } catch {
+    return {};
+  }
+}
+var HOUSE_MODEL_CONTEXT_TOKENS = "512000";
+function buildHouseProxyChildEnv(cfg) {
+  const env = {
+    ANTHROPIC_BASE_URL: cfg.baseUrl,
+    ANTHROPIC_AUTH_TOKEN: cfg.token,
+    // ⚠️ MAX_CONTEXT_TOKENS, not (only) AUTO_COMPACT_WINDOW — and this is
+    // HOUSE-AGENT ONLY: it lives in this builder precisely so a user's own
+    // Claude Code (a real Anthropic model claude knows) is never touched.
+    //
+    // claude does not know `MiniMax-M3`, so it falls back to its
+    // unknown-model default (200k). `CLAUDE_CODE_AUTO_COMPACT_WINDOW` is then
+    // applied as `Math.min(assumedWindow, env)` — it can only SHRINK the
+    // window, never grow it — so the 512000 we used to set here was inert:
+    // claude kept believing 200k. Meanwhile a session with a dozen linked
+    // integrations carries ~175k tokens of MCP tool schemas on EVERY turn
+    // (measured: 475 tools ≈ 698 KB on a real box), so the context started
+    // ~88% full and a 28-character prompt triggered a compaction, then the
+    // next small tool result triggered another: "Autocompact is thrashing:
+    // the context refilled to the limit within 3 turns", 13 compactions in
+    // one session (rafaelph90.br@gmail.com, 2026-09-03).
+    //
+    // claude's own unknown-model notice names the fix: "set
+    // CLAUDE_CODE_MAX_CONTEXT_TOKENS to its real window" — that variable is
+    // what `wL()` returns for an unrecognised model. MiniMax-M3 is a 1M-context
+    // model with a guaranteed minimum of 512K, so 512000 here is the
+    // conservative truth, not a wish. AUTO_COMPACT_WINDOW stays as the
+    // compaction threshold beneath it.
+    CLAUDE_CODE_MAX_CONTEXT_TOKENS: HOUSE_MODEL_CONTEXT_TOKENS,
+    CLAUDE_CODE_AUTO_COMPACT_WINDOW: HOUSE_MODEL_CONTEXT_TOKENS,
+    API_TIMEOUT_MS: "3000000"
+  };
+  if (cfg.openRouter === true) {
+    env.ANTHROPIC_API_KEY = "";
+  } else {
+    const model = typeof cfg.model === "string" && cfg.model ? cfg.model : "MiniMax-M3";
+    env.ANTHROPIC_MODEL = model;
+    env.ANTHROPIC_DEFAULT_SONNET_MODEL = model;
+    env.ANTHROPIC_DEFAULT_OPUS_MODEL = model;
+    env.ANTHROPIC_DEFAULT_HAIKU_MODEL = model;
+  }
+  if (typeof cfg.claudeConfigDir === "string" && cfg.claudeConfigDir) {
+    env.CLAUDE_CONFIG_DIR = cfg.claudeConfigDir;
+  }
+  if (isManagedProviderId(cfg.managedAgentId)) {
+    env[MANAGED_AGENT_ENV] = cfg.managedAgentId;
+  }
+  return env;
+}
+function houseRailWireId(env) {
+  const managed = env[MANAGED_AGENT_ENV];
+  return isManagedProviderId(managed) ? managed : HOUSE_AGENT_ID;
+}
+var HOUSE_PROXY_ENV_KEYS = [
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+  "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
+  "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
+  "API_TIMEOUT_MS",
+  "CLAUDE_CONFIG_DIR",
+  MANAGED_AGENT_ENV
+];
+function clearHouseProxyEnvOverrides() {
+  const out2 = {};
+  for (const key of HOUSE_PROXY_ENV_KEYS) out2[key] = void 0;
+  return out2;
+}
+function isHouseProxyEnv(env) {
+  return typeof env.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN.length > 0 && (env.ANTHROPIC_BASE_URL ?? "").includes("/api/v1/agent-proxy");
+}
+function currentRailWireId(env = process.env) {
+  return isHouseProxyEnv(env) ? houseRailWireId(env) : null;
+}
+function pickHouseProxyEnv(env) {
+  const out2 = {};
+  for (const key of HOUSE_PROXY_ENV_KEYS) {
+    const v = env[key];
+    if (typeof v === "string") out2[key] = v;
+  }
+  return out2;
+}
+
+// src/lib/provider-routing.ts
+var fs35 = __toESM(require("fs"));
+var os31 = __toESM(require("os"));
+var path41 = __toESM(require("path"));
+var PROVIDER_BASE_URL_ENV_KEYS = [
+  "ANTHROPIC_BASE_URL",
+  "OPENAI_BASE_URL",
+  "OPENAI_API_BASE",
+  "GEMINI_API_BASE",
+  "GOOGLE_GEMINI_BASE_URL"
+];
+var ROUTING_DEFAULT = "default";
+function redactUrlToOrigin(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  try {
+    const u2 = new URL(trimmed);
+    if (!u2.host) return "invalid-url";
+    return `${u2.protocol}//${u2.host}`;
+  } catch {
+    return "invalid-url";
+  }
+}
+function readOpencodeProviderOrigins(opts = {}) {
+  const home = opts.homeDir ?? os31.homedir();
+  const readFile7 = opts.readFile ?? ((f) => fs35.readFileSync(f, "utf8"));
+  const candidates = [];
+  if (opts.cwd) {
+    candidates.push(path41.join(opts.cwd, "opencode.json"), path41.join(opts.cwd, "opencode.jsonc"));
+  }
+  candidates.push(
+    path41.join(home, ".config", "opencode", "opencode.json"),
+    path41.join(home, ".config", "opencode", "opencode.jsonc")
+  );
+  const out2 = [];
+  const seen2 = /* @__PURE__ */ new Set();
+  for (const file of candidates) {
+    let text;
+    try {
+      text = readFile7(file);
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text.replace(/^\s*\/\/.*$/gm, ""));
+    } catch {
+      continue;
+    }
+    const providers = parsed?.provider;
+    if (!providers || typeof providers !== "object") continue;
+    for (const [id, cfg] of Object.entries(providers)) {
+      if (seen2.has(id)) continue;
+      const options = cfg?.options;
+      const base = options?.baseURL ?? options?.baseUrl ?? options?.base_url;
+      const origin = redactUrlToOrigin(base);
+      if (!origin) continue;
+      seen2.add(id);
+      out2.push({ provider: id, origin });
+    }
+  }
+  return out2;
+}
+function describeProviderRouting(env, opts = {}) {
+  const routed = {};
+  for (const key of PROVIDER_BASE_URL_ENV_KEYS) {
+    routed[key] = redactUrlToOrigin(env[key]) ?? ROUTING_DEFAULT;
+  }
+  let opencode = [];
+  try {
+    opencode = readOpencodeProviderOrigins(opts);
+  } catch {
+  }
+  const houseKeys = HOUSE_PROXY_ENV_KEYS.filter(
+    (k2) => typeof env[k2] === "string" && env[k2].length > 0
+  );
+  const codeamKeys = Object.keys(env).filter((k2) => k2.startsWith("CODEAM_") && typeof env[k2] === "string" && env[k2].length > 0).sort();
+  return { env: routed, opencode, houseProxy: isHouseProxyEnv(env), houseKeys, codeamKeys };
+}
+function formatProviderRouting(r, label) {
+  const parts = [
+    label ? `agent=${label}` : null,
+    `anthropic=${r.env.ANTHROPIC_BASE_URL}`,
+    `openai=${r.env.OPENAI_BASE_URL !== ROUTING_DEFAULT ? r.env.OPENAI_BASE_URL : r.env.OPENAI_API_BASE}`,
+    `gemini=${r.env.GEMINI_API_BASE !== ROUTING_DEFAULT ? r.env.GEMINI_API_BASE : r.env.GOOGLE_GEMINI_BASE_URL}`,
+    `opencode=[${r.opencode.map((p2) => `${p2.provider}=${p2.origin}`).join(",")}]`,
+    `houseProxy=${r.houseProxy ? "yes" : "no"}`,
+    `houseKeys=[${r.houseKeys.join(",")}]`,
+    `codeamKeys=[${r.codeamKeys.join(",")}]`
+  ];
+  return parts.filter((p2) => p2 !== null).join(" ");
+}
+var PROVIDER_BILLING_RE = /(?:api error|http|status)[:\s]+402\b|\b402\b[^\n]{0,40}(?:payment required|insufficient|credits?|balance)|insufficient (?:credits?|balance|funds)|payment required/i;
+function matchesProviderBilling(text) {
+  return PROVIDER_BILLING_RE.test(text);
+}
+function scrubSecrets(text) {
+  return text.replace(/\b(?:sk|pk|rk|key|token)[-_][A-Za-z0-9_-]{12,}/gi, "[redacted]").replace(/bearer\s+[A-Za-z0-9._-]{12,}/gi, "Bearer [redacted]").replace(/\b[A-Za-z0-9_-]{40,}\b/g, "[redacted]");
+}
+function classifyProviderBilling(text, env) {
+  if (!matchesProviderBilling(text)) return null;
+  const line = text.split("\n").find((l) => PROVIDER_BILLING_RE.test(l)) ?? text;
+  return {
+    marker: isHouseProxyEnv(env) ? "provider_billing_house" : "provider_billing_external",
+    anthropicHost: redactUrlToOrigin(env.ANTHROPIC_BASE_URL) ?? ROUTING_DEFAULT,
+    snippet: scrubSecrets(line.trim()).slice(0, 160)
+  };
+}
+
+// src/agents/acp/agent-hooks.ts
+function replyIsCursorUpgradeRequired(finalText) {
+  const t2 = finalText.trim().toLowerCase();
+  if (t2.length === 0 || t2.length > 200) return false;
+  return t2.includes("upgrade your plan to continue") || t2.includes("upgrade your plan") && t2.includes("continue");
+}
+function isGeminiIneligibleTier(haystack2) {
+  return /IneligibleTierError|UNSUPPORTED_CLIENT|no longer supported for Gemini Code Assist|not eligible for Gemini Code Assist/i.test(
+    haystack2
+  );
+}
+var ACP_AGENT_HOOKS = {
+  claude: {
+    statusPage: { vendor: "Anthropic", url: "https://status.anthropic.com" },
+    // Freeze the SDK-bundled Claude Code binary at the version this CLI (and its
+    // pinned ACP adapter) was tested against. Without this the binary silently
+    // self-updates to @latest and can drift PAST the adapter — a newer Claude
+    // Code (v2.1.211) started streaming its TUI chrome (What's-new banner, status
+    // line, box-drawing) into the ACP text channel, which paints as a broken chat
+    // on mobile. A version regression must now reach users only through a gated
+    // codeam-cli release, never silently via auto-update.
+    startupExtraEnv: () => ({
+      DISABLE_AUTOUPDATER: "1",
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+    })
+  },
+  codex: {
+    statusPage: { vendor: "OpenAI", url: "https://status.openai.com" },
+    startupExtraEnv: ({ autoApprovePermissions }) => autoApprovePermissions ? { INITIAL_AGENT_MODE: "agent-full-access" } : {}
+  },
+  gemini: {
+    statusPage: { vendor: "Google", url: "https://status.cloud.google.com" },
+    classifyStartupFailure: (haystack2) => isGeminiIneligibleTier(haystack2) ? "ineligible_tier" : null
+  },
+  copilot: {
+    statusPage: { vendor: "GitHub", url: "https://www.githubstatus.com" }
+  },
+  cursor: {
+    statusPage: { vendor: "Cursor", url: "https://status.cursor.com" },
+    classifyCompletedReply: (finalText) => replyIsCursorUpgradeRequired(finalText) ? "upgrade_required" : null
+  }
+};
+function agentHooks(agent) {
+  return ACP_AGENT_HOOKS[agent];
+}
+
+// src/agents/acp/failure-messages.ts
+function describeError(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+var AUTH_FAILURE_RE = /invalid authentication credentials|failed to authenticate|authentication[_ ](?:error|required)|please run \/login|\bunauthorized\b|\binvalid x-api-key\b|oauth (?:token|session) (?:expired|revoked)|(?:session|token|credentials?|oauth)[^\n]{0,40}could not be refreshed|(?:api error|http|status)[:\s]+401|\b401\b[^\n]{0,40}(?:unauthor|authenticat|credential|api[_ ]?key|login)/i;
+var HOUSE_AGENT_LIMIT_RE = /HOUSE_AGENT_CEILING|CodeAgent Cloud[^\n]{0,60}(?:usage )?ceiling|CodeAgent Cloud is temporarily (?:unavailable|disabled)/i;
+function looksLikeHouseAgentLimit(text) {
+  return HOUSE_AGENT_LIMIT_RE.test(text);
+}
+var LOCAL_PROXY_RE = /(?:127\.0\.0\.1|localhost|\[::1\]):\d+/i;
+var CONNECTION_ERROR_RE = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|socket hang up|fetch failed|network error|connection (?:refused|reset|closed)/i;
+function looksLikeLocalProxyUnavailable(text) {
+  return LOCAL_PROXY_RE.test(text) && CONNECTION_ERROR_RE.test(text);
+}
+function looksLikeAuthFailure(text) {
+  if (looksLikeHouseAgentLimit(text)) return false;
+  if (looksLikeLocalProxyUnavailable(text)) return false;
+  return AUTH_FAILURE_RE.test(text);
+}
+function replyIsAuthFailure(finalText) {
+  const t2 = finalText.trim();
+  return t2.length > 0 && t2.length <= 200 && looksLikeAuthFailure(t2);
+}
+function replyIsHouseAgentLimit(finalText) {
+  const t2 = finalText.trim();
+  return t2.length > 0 && t2.length <= 400 && looksLikeHouseAgentLimit(t2);
+}
+var BYO_PROVIDER_BILLING_RE = /(?:api error|http|status)[:\s]+402\b[^\n]{0,80}(?:insufficient (?:credits?|balance)|requires more credits)|\b402\b[^\n]{0,40}(?:insufficient (?:credits?|balance)|requires more credits)|insufficient (?:credits?|balance)[^\n]{0,40}\b402\b/i;
+var PROVIDER_CREDITS_PHRASE_RE = /\brequires more credits\b|\binsufficient credits\.?\s+add more\b|\bcredit balance is too low\b|\binsufficient_quota\b|\bexceeded your current quota\b/i;
+function looksLikeByoProviderBilling(text, env = currentAgentEnv()) {
+  return !isHouseProxyEnv(env) && (BYO_PROVIDER_BILLING_RE.test(text) || PROVIDER_CREDITS_PHRASE_RE.test(text));
+}
+function replyIsByoProviderBilling(finalText, env = currentAgentEnv()) {
+  const t2 = finalText.trim();
+  return t2.length > 0 && t2.length <= 600 && looksLikeByoProviderBilling(t2, env);
+}
+var PROVIDER_HOST_NAMES = [
+  [/(^|\.)openrouter\.ai$/i, "OpenRouter"],
+  [/(^|\.)deepinfra\.com$/i, "DeepInfra"],
+  [/(^|\.)anthropic\.com$/i, "Anthropic"],
+  [/(^|\.)openai\.com$/i, "OpenAI"],
+  [/(^|\.)googleapis\.com$/i, "Google"],
+  [/(^|\.)minimax(?:i)?\.(?:io|com|chat)$/i, "MiniMax"],
+  [/(^|\.)moonshot\.(?:ai|cn)$/i, "Moonshot"],
+  [/(^|\.)x\.ai$/i, "xAI"],
+  [/(^|\.)mistral\.ai$/i, "Mistral"],
+  [/(^|\.)groq\.com$/i, "Groq"],
+  [/(^|\.)together\.(?:ai|xyz)$/i, "Together"]
+];
+var AGENT_DEFAULT_PROVIDER = {
+  claude: "Anthropic",
+  codex: "OpenAI",
+  gemini: "Google"
+};
+function byoProviderName(opts) {
+  const env = opts.env ?? currentAgentEnv();
+  for (const key of PROVIDER_BASE_URL_ENV_KEYS) {
+    const origin = redactUrlToOrigin(env[key]);
+    if (!origin || origin === "invalid-url") continue;
+    const host2 = new URL(origin).hostname;
+    for (const [re2, name] of PROVIDER_HOST_NAMES) if (re2.test(host2)) return name;
+    return host2;
+  }
+  return opts.agent && AGENT_DEFAULT_PROVIDER[opts.agent] || "provider";
+}
+function byoProviderBillingMessage(provider) {
+  return `\u{1F4B3} **Your ${provider} account has no credits left.** Top up at your provider, or switch this session to another agent.`;
+}
+function completedReplyFailureBubble(opts) {
+  const env = opts.env ?? currentAgentEnv();
+  if (replyIsHouseAgentLimit(opts.finalText)) return houseAgentLimitMessage(opts.finalText);
+  if (replyIsByoProviderBilling(opts.finalText, env)) {
+    return byoProviderBillingMessage(byoProviderName({ env, agent: opts.agent }));
+  }
+  if (replyIsAuthFailure(opts.finalText)) return AUTH_FAILURE_MESSAGE;
+  return null;
+}
+function houseAgentLimitMessage(text) {
+  if (/temporarily (?:unavailable|disabled)/i.test(text)) {
+    return "\u23F3 **Our agent service is temporarily unavailable \u2014 this one\u2019s on us, not your account.**\n\nThere\u2019s nothing to buy and nothing owed, and it isn\u2019t a problem with your login, so re-authenticating won\u2019t help. Send your message again in a bit, or connect your own agent (Claude Code, Codex, Cursor, Gemini) in **Profile \u203A Agents** to keep going now.";
+  }
+  const canUpgrade = /upgrade to pro/i.test(text);
+  return "\u{1F4CA} **You\u2019ve reached today\u2019s agent usage limit.**\n\nThe free agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
+}
+var AUTH_FAILURE_MESSAGE = (
+  // ⚠️ Do NOT name a status code here. This bubble fires for several
+  // different failures, and the old hard-coded "(API 401)" told users the API
+  // had answered 401 when it never had — it also sent a live investigation
+  // hunting for 401s in proxy logs that were serving 200s throughout
+  // (2026-08-24). Say what happened, not a number we did not see.
+  "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired.**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again."
+);
+var CURSOR_UPGRADE_MESSAGE = "\u26A1 **Cursor needs a paid plan to run the agent.**\n\nThe headless Cursor Agent requires Cursor **Pro** \u2014 your Free plan\u2019s included usage does NOT cover Agent runs, even with quota left. This is your Cursor account (not CodeAgent). Upgrade, then send your message again:\n\n[Upgrade to Cursor Pro \u2192](https://cursor.com/dashboard)";
+var ONE_M_CREDITS_MESSAGE = "\u{1F504} **Reconnect your Claude subscription to continue.**\n\nClaude requested 1M-context but your account doesn\u2019t have the usage credits for it on this credential. Reconnecting refreshes your subscription so the agent can keep going \u2014 disabling 1M context won\u2019t fix a credits gate.\n\nTap [Reconnect this agent](codeam://reauth) to reconnect your Claude subscription in Profile \u203A Agents, then send your message again.";
+var TURN_FAILURE_MESSAGE = "\u26A0\uFE0F **The agent hit an error and couldn\u2019t finish this turn.** Please send your message again.";
+function emptyReplyMessage(agent) {
+  const label = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].displayName : agent;
+  const binary = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].binaryName : agent;
+  return `\u26A0\uFE0F **${label} returned an empty reply.** Its provider may be having issues \u2014 check the agent's login/subscription on this machine (e.g. run \`${binary} -p "test"\` there).`;
+}
+var PROVIDER_OUTAGE_RE = /overloaded_error|\boverloaded\b|service[ _]unavailable|temporarily[ _]unavailable|(?:api error|http|status)[:\s]+(?:529|503|502|504)\b|\b(?:529|503|502|504)\b[^\n]{0,40}(?:overload|unavailable|gateway|upstream|server error)|bad gateway|gateway time-?out|upstream (?:error|connect|timeout)/i;
+function looksLikeProviderOutage(text) {
+  return PROVIDER_OUTAGE_RE.test(text);
+}
+function agentStatusPage(agent, railWireId) {
+  if (railWireId) return null;
+  const a = (agent ?? "").toLowerCase();
+  const id = a.includes("claude") || a.includes("anthropic") ? "claude" : a.includes("codex") || a.includes("openai") ? "codex" : a.includes("gemini") || a.includes("google") ? "gemini" : a.includes("copilot") ? "copilot" : a.includes("cursor") ? "cursor" : null;
+  return id ? agentHooks(id)?.statusPage ?? null : null;
+}
+function providerOutageMessage(agent, railWireId) {
+  if (railWireId) {
+    const who2 = isManagedProviderId(railWireId) ? `${MANAGED_PROVIDER_DISPLAY_NAMES[railWireId]} ` : "";
+    return `\u{1F310} **CodeAgent's agent service is having a disruption \u2014 this isn't your session.**
+
+Your ${who2}agent couldn't finish this turn because our provider returned an overload error. It usually clears up on its own \u2014 just send your message again in a bit.`;
+  }
+  const info = agentStatusPage(agent);
+  const who = info ? info.vendor : "The agent provider";
+  return `\u{1F310} **${who} is having a service disruption \u2014 this isn\u2019t your session.**
+
+The agent provider returned an overload/outage error, so this turn couldn\u2019t finish. It usually clears up on its own \u2014 just send your message again in a bit.` + (info ? `
+
+Follow the status here: [${info.url}](${info.url})` : "");
+}
+function startupFailureMessage(agent, detail, recentStderr, railWireId) {
+  const haystack2 = `${detail}
+${recentStderr}`;
+  if (agentHooks(agent)?.classifyStartupFailure?.(haystack2) === "ineligible_tier") {
+    return [
+      "\u26A0\uFE0F **Gemini couldn't start \u2014 your Google account isn't eligible.**",
+      "",
+      "Google discontinued free **\u201CLogin with Google\u201D** access to the Gemini CLI on 2026-06-18. The free / individual tier (and Google AI Pro/Ultra) can no longer authenticate here.",
+      "",
+      "To use Gemini from CodeAgent, re-link it in **Profile \u203A Agents** with either:",
+      "\u2022 a **Gemini API key** (AI Studio \u2014 free quota available), or",
+      "\u2022 a paid **Gemini Code Assist (Standard/Enterprise)** subscription."
+    ].join("\n");
+  }
+  if (looksLikeAuthFailure(haystack2)) return AUTH_FAILURE_MESSAGE;
+  if (looksLikeProviderOutage(haystack2)) return providerOutageMessage(agent, railWireId);
+  const tail = recentStderr.split("\n").filter(Boolean).slice(-3).join("\n");
+  return [`\u26A0\uFE0F The ${agent} agent failed to start.`, "", tail ? `Details:
+${tail}` : detail].join(
+    "\n"
+  );
+}
+function startupCredentialInvalidReason(agent, detail, recentStderr) {
+  const haystack2 = `${detail}
+${recentStderr}`;
+  return agentHooks(agent)?.classifyStartupFailure?.(haystack2) === "ineligible_tier" ? "ineligible_tier" : null;
+}
+function failureBubble(opts) {
+  const env = opts.env ?? currentAgentEnv();
+  if (looksLikeHouseAgentLimit(opts.detail) || looksLikeHouseAgentLimit(opts.recentStderr)) {
+    return houseAgentLimitMessage(`${opts.detail}
+${opts.recentStderr}`);
+  }
+  if (looksLikeByoProviderBilling(opts.detail, env) || looksLikeByoProviderBilling(opts.recentStderr, env)) {
+    return byoProviderBillingMessage(byoProviderName({ env, agent: opts.agent }));
+  }
+  if (looksLikeAuthFailure(opts.detail) || looksLikeAuthFailure(opts.recentStderr)) {
+    return AUTH_FAILURE_MESSAGE;
+  }
+  if (looksLike1mContextCreditsError(opts.detail) || looksLike1mContextCreditsError(opts.recentStderr)) {
+    return ONE_M_CREDITS_MESSAGE;
+  }
+  if (looksLikeProviderOutage(opts.detail) || looksLikeProviderOutage(opts.recentStderr)) {
+    return providerOutageMessage(opts.agent, opts.railWireId);
+  }
+  if (!opts.hadText) return TURN_FAILURE_MESSAGE;
+  return null;
+}
+var WINDOWS_CONTROL_C_EXIT = 3221225786;
+function adapterExitMessage(opts) {
+  if (opts.code === WINDOWS_CONTROL_C_EXIT) return null;
+  if (opts.signal === "SIGINT") return null;
+  if (opts.authFail) return AUTH_FAILURE_MESSAGE;
+  if (opts.outageFail) return providerOutageMessage(opts.agent, opts.railWireId);
+  return `Agent adapter exited unexpectedly (code=${opts.code ?? "null"} signal=${opts.signal ?? "null"}).`;
+}
+
+// src/services/preview/port-registry.ts
+var fs36 = __toESM(require("fs"));
+var os32 = __toESM(require("os"));
+var path42 = __toESM(require("path"));
 var import_child_process14 = require("child_process");
 function registryPath() {
-  return path40.join(os29.homedir(), ".codeam", "preview-ports.json");
+  return path42.join(os32.homedir(), ".codeam", "preview-ports.json");
 }
 function readRegistry() {
   try {
-    const raw = fs33.readFileSync(registryPath(), "utf8");
+    const raw = fs36.readFileSync(registryPath(), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object") return parsed;
   } catch {
@@ -22696,10 +23235,10 @@ function readRegistry() {
 function writeRegistry(reg) {
   try {
     const file = registryPath();
-    fs33.mkdirSync(path40.dirname(file), { recursive: true });
+    fs36.mkdirSync(path42.dirname(file), { recursive: true });
     const tmp = `${file}.tmp`;
-    fs33.writeFileSync(tmp, JSON.stringify(reg), "utf8");
-    fs33.renameSync(tmp, file);
+    fs36.writeFileSync(tmp, JSON.stringify(reg), "utf8");
+    fs36.renameSync(tmp, file);
   } catch (err) {
     log.warn("preview", `port-registry write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -22765,7 +23304,7 @@ function reclaimOwnOrphanPort(port) {
 
 // src/services/preview/host-allow.ts
 var import_fs2 = require("fs");
-var path41 = __toESM(require("path"));
+var path43 = __toESM(require("path"));
 var NEXT_ALLOWED_ORIGINS = [
   "*.trycloudflare.com",
   "*.preview.codeagent-mobile.com",
@@ -22785,7 +23324,7 @@ var MARKER_DIR = ".codeam";
 var MARKER_FILE = "preview-host-allow.json";
 var ORIG_INFIX = ".codeam-orig";
 function markerPath(cwd) {
-  return path41.join(cwd, MARKER_DIR, MARKER_FILE);
+  return path43.join(cwd, MARKER_DIR, MARKER_FILE);
 }
 async function fileExists(p2) {
   try {
@@ -22798,13 +23337,13 @@ async function fileExists(p2) {
 async function findConfigFile(cwd, framework) {
   const base = CONFIG_BASENAMES[framework];
   for (const ext of CONFIG_EXTS) {
-    if (await fileExists(path41.join(cwd, `${base}${ext}`))) return `${base}${ext}`;
+    if (await fileExists(path43.join(cwd, `${base}${ext}`))) return `${base}${ext}`;
   }
   return null;
 }
 async function dependsOn(cwd, pkgName) {
   try {
-    const raw = await import_fs2.promises.readFile(path41.join(cwd, "package.json"), "utf8");
+    const raw = await import_fs2.promises.readFile(path43.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return !!(pkg.dependencies?.[pkgName] ?? pkg.devDependencies?.[pkgName]);
   } catch {
@@ -22812,11 +23351,11 @@ async function dependsOn(cwd, pkgName) {
   }
 }
 async function isEsmConfig(cwd, configFile) {
-  const ext = path41.extname(configFile);
+  const ext = path43.extname(configFile);
   if (ext === ".mjs" || ext === ".mts" || ext === ".ts") return true;
   if (ext === ".cjs") return false;
   try {
-    const raw = await import_fs2.promises.readFile(path41.join(cwd, "package.json"), "utf8");
+    const raw = await import_fs2.promises.readFile(path43.join(cwd, "package.json"), "utf8");
     return JSON.parse(raw).type === "module";
   } catch {
     return false;
@@ -22907,7 +23446,7 @@ async function isOurShim(abs) {
   }
 }
 async function writeMarker(cwd, marker) {
-  await import_fs2.promises.mkdir(path41.join(cwd, MARKER_DIR), { recursive: true });
+  await import_fs2.promises.mkdir(path43.join(cwd, MARKER_DIR), { recursive: true });
   await import_fs2.promises.writeFile(markerPath(cwd), JSON.stringify(marker, null, 2), "utf8");
 }
 async function readMarker(cwd) {
@@ -22922,9 +23461,9 @@ async function restorePreviewHostAllow(cwd) {
   const marker = await readMarker(cwd);
   if (!marker) return;
   try {
-    const configAbs = path41.join(cwd, marker.configFile);
+    const configAbs = path43.join(cwd, marker.configFile);
     if (marker.backupFile) {
-      const backupAbs = path41.join(cwd, marker.backupFile);
+      const backupAbs = path43.join(cwd, marker.backupFile);
       if (await fileExists(backupAbs)) {
         await import_fs2.promises.rm(configAbs, { force: true });
         await import_fs2.promises.rename(backupAbs, configAbs);
@@ -22957,26 +23496,26 @@ async function applyPreviewHostAllow(cwd) {
     }
     if (!framework) return;
     if (existing) {
-      const ext = path41.extname(existing);
+      const ext = path43.extname(existing);
       const origBasename = `${CONFIG_BASENAMES[framework]}${ORIG_INFIX}${ext}`;
-      if (await isOurShim(path41.join(cwd, existing))) {
-        const origAbs = path41.join(cwd, origBasename);
+      if (await isOurShim(path43.join(cwd, existing))) {
+        const origAbs = path43.join(cwd, origBasename);
         if (!await fileExists(origAbs) || await isOurShim(origAbs)) {
           log.warn("preview", `host-allow: ${existing} is a leftover shim with no original \u2014 skipped`);
           return;
         }
-        await import_fs2.promises.rm(path41.join(cwd, existing), { force: true });
-        await import_fs2.promises.rename(origAbs, path41.join(cwd, existing));
+        await import_fs2.promises.rm(path43.join(cwd, existing), { force: true });
+        await import_fs2.promises.rename(origAbs, path43.join(cwd, existing));
         log.info("preview", `host-allow: restored ${existing} from a leftover ${origBasename}`);
       }
       const esm = await isEsmConfig(cwd, existing);
-      await import_fs2.promises.rename(path41.join(cwd, existing), path41.join(cwd, origBasename));
-      await import_fs2.promises.writeFile(path41.join(cwd, existing), shimFor(framework, origBasename, esm), "utf8");
+      await import_fs2.promises.rename(path43.join(cwd, existing), path43.join(cwd, origBasename));
+      await import_fs2.promises.writeFile(path43.join(cwd, existing), shimFor(framework, origBasename, esm), "utf8");
       await writeMarker(cwd, { framework, configFile: existing, backupFile: origBasename });
       log.info("preview", `host-allow: wrapped ${existing} (${framework}) for tunnel access`);
     } else {
       const configFile = `${CONFIG_BASENAMES[framework]}.mjs`;
-      await import_fs2.promises.writeFile(path41.join(cwd, configFile), shimFor(framework, null, true), "utf8");
+      await import_fs2.promises.writeFile(path43.join(cwd, configFile), shimFor(framework, null, true), "utf8");
       await writeMarker(cwd, { framework, configFile, backupFile: null });
       log.info("preview", `host-allow: created ${configFile} (${framework}) for tunnel access`);
     }
@@ -22986,8 +23525,8 @@ async function applyPreviewHostAllow(cwd) {
 }
 
 // src/services/preview/build-heal.ts
-var fs35 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
 var BUILD_MARKER_NAME = "BUILD_ID";
 var DEFAULT_DEBOUNCE_MS = 1500;
 var DEFAULT_MAX_RESTARTS = 3;
@@ -22996,7 +23535,7 @@ function isBuildHealSupported(framework) {
 }
 function defaultWatchDir(dir, onEvent) {
   try {
-    const w3 = fs35.watch(dir, { persistent: false }, (_eventType, filename) => onEvent(filename));
+    const w3 = fs38.watch(dir, { persistent: false }, (_eventType, filename) => onEvent(filename));
     w3.on("error", () => {
       try {
         w3.close();
@@ -23019,7 +23558,7 @@ function resetBuildHealState(sessionId) {
 }
 function readMarker2(markerPath2) {
   try {
-    return fs35.readFileSync(markerPath2, "utf8").trim();
+    return fs38.readFileSync(markerPath2, "utf8").trim();
   } catch {
     return null;
   }
@@ -23028,8 +23567,8 @@ function watchForBuildClobber(deps) {
   const watchDir = deps.watchDir ?? defaultWatchDir;
   const debounceMs = deps.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   const maxRestarts = deps.maxRestarts ?? DEFAULT_MAX_RESTARTS;
-  const nextDir = path42.join(deps.cwd, ".next");
-  const markerPath2 = path42.join(nextDir, BUILD_MARKER_NAME);
+  const nextDir = path44.join(deps.cwd, ".next");
+  const markerPath2 = path44.join(nextDir, BUILD_MARKER_NAME);
   let stopped = false;
   let debounceTimer = null;
   let dirUnwatch = null;
@@ -23087,12 +23626,12 @@ function watchForBuildClobber(deps) {
       if (filename === null || filename === BUILD_MARKER_NAME) onMarkerTouched();
     });
   };
-  if (fs35.existsSync(nextDir)) {
+  if (fs38.existsSync(nextDir)) {
     attachDirWatch();
   } else {
     cwdUnwatch = watchDir(deps.cwd, (filename) => {
       if (stopped || dirUnwatch) return;
-      if ((filename === ".next" || filename === null) && fs35.existsSync(nextDir)) {
+      if ((filename === ".next" || filename === null) && fs38.existsSync(nextDir)) {
         cwdUnwatch?.();
         cwdUnwatch = null;
         attachDirWatch();
@@ -23319,7 +23858,7 @@ function quoteIfNeeded(value) {
 
 // src/services/preview/expo.ts
 var http6 = __toESM(require("http"));
-var path45 = __toESM(require("path"));
+var path47 = __toESM(require("path"));
 var EXPO_PACKAGER_PROXY_URL_ENV = "EXPO_PACKAGER_PROXY_URL";
 function stripExpoTunnelFlag(args2) {
   return args2.filter((a) => a !== "--tunnel" && !a.startsWith("--tunnel="));
@@ -23328,7 +23867,7 @@ function ensureExpoPortArg(command2, args2, port) {
   const hasPort = args2.some((a) => a === "--port" || a.startsWith("--port="));
   if (hasPort) return [...args2];
   const out2 = [...args2];
-  if (path45.basename(command2) === "npm" && !out2.includes("--")) out2.push("--");
+  if (path47.basename(command2) === "npm" && !out2.includes("--")) out2.push("--");
   out2.push("--port", String(port));
   return out2;
 }
@@ -23457,6 +23996,9 @@ function describeOneShotAgentError(stderr) {
   if (!detail) return null;
   return `Preview detection couldn't run \u2014 the agent answered ${m[1]}: ${detail}`;
 }
+function previewProviderCreditsMessage(provider) {
+  return `Preview detection couldn't run \u2014 your ${provider} account has no credits left. Top up at your provider, or switch this session to another agent.`;
+}
 var RAW_EXCERPT_LIMIT = 1e3;
 function describeDetectionFailure(raw) {
   const text = raw?.trim() ?? "";
@@ -23949,8 +24491,8 @@ function isJsInstallCommand(cmd, args2) {
 }
 
 // src/services/preview/script-candidates.ts
-var fs40 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var path50 = __toESM(require("path"));
 var EXCLUDE_RE = /(^|:)(deploy|publish|release|build|test|e2e|lint|format|typecheck|type-check|clean|prebuild|postinstall|preinstall|prepare|install|migrate|seed|db|prisma|codegen|storybook-build)(:|$)/i;
 var EXCLUDE_BODY_RE = /\b(run:android|run:ios|gradlew|fastlane|xcodebuild|eas build|eas submit)\b/i;
 var MAX_APPS = 40;
@@ -23968,7 +24510,7 @@ function frameworkFor(pkg, body) {
 }
 function readPkg(file) {
   try {
-    return JSON.parse(fs40.readFileSync(file, "utf8"));
+    return JSON.parse(fs43.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
@@ -23978,7 +24520,7 @@ function expandGlob(root, pattern) {
   if (!clean.endsWith("/*")) return [clean];
   const base = clean.slice(0, -2);
   try {
-    return fs40.readdirSync(path48.join(root, base), { withFileTypes: true }).filter((d3) => d3.isDirectory() && !d3.name.startsWith(".") && d3.name !== "node_modules").map((d3) => path48.join(base, d3.name));
+    return fs43.readdirSync(path50.join(root, base), { withFileTypes: true }).filter((d3) => d3.isDirectory() && !d3.name.startsWith(".") && d3.name !== "node_modules").map((d3) => path50.join(base, d3.name));
   } catch {
     return [];
   }
@@ -23987,7 +24529,7 @@ function workspaceDirs(root, rootPkg) {
   const ws = rootPkg?.workspaces;
   const patterns = Array.isArray(ws) ? ws : ws?.packages ?? [];
   try {
-    const pnpm = fs40.readFileSync(path48.join(root, "pnpm-workspace.yaml"), "utf8");
+    const pnpm = fs43.readFileSync(path50.join(root, "pnpm-workspace.yaml"), "utf8");
     for (const m of pnpm.matchAll(/^\s*-\s*['"]?([^'"\n]+)['"]?\s*$/gm)) patterns.push(m[1]);
   } catch {
   }
@@ -23998,14 +24540,14 @@ function workspaceDirs(root, rootPkg) {
 }
 function listScriptCandidates(root) {
   const out2 = [];
-  const rootPkg = readPkg(path48.join(root, "package.json"));
+  const rootPkg = readPkg(path50.join(root, "package.json"));
   const add = (pkg, appDir) => {
     for (const [script, body] of Object.entries(pkg.scripts ?? {})) {
       if (out2.length >= MAX_CANDIDATES) return;
       if (EXCLUDE_RE.test(script) || EXCLUDE_BODY_RE.test(body)) continue;
       const fw = frameworkFor(pkg, body);
       out2.push({
-        app: pkg.name ?? (appDir === "." ? path48.basename(root) : appDir),
+        app: pkg.name ?? (appDir === "." ? path50.basename(root) : appDir),
         appDir,
         script,
         body,
@@ -24019,8 +24561,8 @@ function listScriptCandidates(root) {
   };
   if (rootPkg) add(rootPkg, ".");
   for (const dir of workspaceDirs(root, rootPkg)) {
-    const pkg = readPkg(path48.join(root, dir, "package.json"));
-    if (pkg) add(pkg, dir.split(path48.sep).join("/"));
+    const pkg = readPkg(path50.join(root, dir, "package.json"));
+    if (pkg) add(pkg, dir.split(path50.sep).join("/"));
   }
   return out2;
 }
@@ -24202,19 +24744,19 @@ function activePreviewSessionIds() {
 
 // src/services/preview/start-orchestrator.ts
 var import_child_process20 = require("child_process");
-var fs43 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var fs46 = __toESM(require("fs"));
+var path53 = __toESM(require("path"));
 var import_which3 = __toESM(require("which"));
 
 // src/services/project-env/index.ts
 var import_fs6 = require("fs");
-var path50 = __toESM(require("path"));
+var path52 = __toESM(require("path"));
 
 // src/beads/project-key.ts
 var import_child_process19 = require("child_process");
 var crypto2 = __toESM(require("crypto"));
-var fs41 = __toESM(require("fs"));
-var path49 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path51 = __toESM(require("path"));
 function normalizeOrigin(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -24240,17 +24782,17 @@ function normalizeOrigin(raw) {
   return `${host2}/${pathPart}`;
 }
 function findRepoRoot(cwd) {
-  let dir = path49.resolve(cwd);
+  let dir = path51.resolve(cwd);
   const seen2 = /* @__PURE__ */ new Set();
   for (let i = 0; i < 256; i++) {
     if (seen2.has(dir)) return null;
     seen2.add(dir);
     try {
-      const stat3 = fs41.statSync(path49.join(dir, ".git"), { throwIfNoEntry: false });
+      const stat3 = fs44.statSync(path51.join(dir, ".git"), { throwIfNoEntry: false });
       if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
     } catch {
     }
-    const parent = path49.dirname(dir);
+    const parent = path51.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -24261,7 +24803,7 @@ var _execSeam3 = {
     const out2 = (0, import_child_process19.execFileSync)(file, args2, opts);
     return typeof out2 === "string" ? out2 : out2.toString("utf8");
   },
-  realpath: (p2) => fs41.realpathSync(p2)
+  realpath: (p2) => fs44.realpathSync(p2)
 };
 function readOrigin(cwd) {
   try {
@@ -24290,7 +24832,7 @@ function deriveProjectIdentity(cwd = process.cwd()) {
   } catch {
   }
   const hash = crypto2.createHash("sha256").update(real).digest("hex");
-  return { projectKey: `path:${hash}`, projectLabel: path49.basename(real) || "project" };
+  return { projectKey: `path:${hash}`, projectLabel: path51.basename(real) || "project" };
 }
 
 // src/services/project-env/index.ts
@@ -24303,7 +24845,7 @@ async function readIfExists(p2) {
 }
 async function syncProjectEnvUp(cwd, ctx) {
   if (!ctx.pluginAuthToken) return;
-  const content = await readIfExists(path50.join(cwd, ".env"));
+  const content = await readIfExists(path52.join(cwd, ".env"));
   if (content == null) return;
   try {
     const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
@@ -24325,7 +24867,7 @@ async function syncProjectEnvUp(cwd, ctx) {
 }
 async function restoreProjectEnvIfMissing(cwd, ctx) {
   if (!ctx.pluginAuthToken) return false;
-  const envPath = path50.join(cwd, ".env");
+  const envPath = path52.join(cwd, ".env");
   if (await readIfExists(envPath) != null) return false;
   try {
     const { projectKey, projectLabel } = deriveProjectIdentity(cwd);
@@ -24336,7 +24878,7 @@ async function restoreProjectEnvIfMissing(cwd, ctx) {
       projectKey
     });
     if (!stored) return false;
-    const tmp = path50.join(cwd, ".env.codeam-restore.tmp");
+    const tmp = path52.join(cwd, ".env.codeam-restore.tmp");
     await import_fs6.promises.writeFile(tmp, stored.content, { encoding: "utf8", mode: 384 });
     await import_fs6.promises.rename(tmp, envPath);
     log.info("project-env", `restored .env (${stored.keyCount} vars) for ${projectLabel}`);
@@ -25119,8 +25661,8 @@ function normalizeDetectionForSpawn(detection, cwd) {
   if (args2.length === 0) return detection;
   const binName = args2[0];
   if (binName.startsWith("-")) return detection;
-  const binPath = path51.join(cwd, "node_modules", ".bin", binName);
-  if (!fs43.existsSync(binPath)) return detection;
+  const binPath = path53.join(cwd, "node_modules", ".bin", binName);
+  if (!fs46.existsSync(binPath)) return detection;
   return {
     ...detection,
     command: binPath,
@@ -25531,9 +26073,9 @@ async function bringUpPublicUrl(ctx, tunnelPort) {
 
 // src/beads/bd-adapter.ts
 var import_child_process21 = require("child_process");
-var fs44 = __toESM(require("fs"));
-var os31 = __toESM(require("os"));
-var path52 = __toESM(require("path"));
+var fs47 = __toESM(require("fs"));
+var os34 = __toESM(require("os"));
+var path54 = __toESM(require("path"));
 var BD_PACKAGE = "@beads/bd";
 function resolveBundledBdBinary() {
   return _resolveSeam.resolveBundled();
@@ -25545,11 +26087,11 @@ function _defaultResolveBundled() {
   } catch {
     return null;
   }
-  const binDir = path52.join(path52.dirname(pkgJsonPath), "bin");
+  const binDir = path54.join(path54.dirname(pkgJsonPath), "bin");
   const binaryName = process.platform === "win32" ? "bd.exe" : "bd";
-  const binaryPath = path52.join(binDir, binaryName);
+  const binaryPath = path54.join(binDir, binaryName);
   try {
-    fs44.accessSync(binaryPath, fs44.constants.F_OK);
+    fs47.accessSync(binaryPath, fs47.constants.F_OK);
     return binaryPath;
   } catch {
     return null;
@@ -25559,13 +26101,13 @@ function resolveBdOnPath() {
   return _resolveSeam.resolveOnPath();
 }
 function _defaultResolveOnPath() {
-  const dirs = (process.env.PATH ?? "").split(path52.delimiter).filter(Boolean);
+  const dirs = (process.env.PATH ?? "").split(path54.delimiter).filter(Boolean);
   const candidates = process.platform === "win32" ? ["bd.exe", "bd.cmd", "bd"] : ["bd"];
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const full = path52.join(dir, candidate);
+      const full = path54.join(dir, candidate);
       try {
-        fs44.accessSync(full, fs44.constants.F_OK);
+        fs47.accessSync(full, fs47.constants.F_OK);
         return full;
       } catch {
       }
@@ -25650,7 +26192,7 @@ var BdAdapter = class {
     const env = { ...process.env };
     if (!env.HOME) {
       try {
-        const home = os31.homedir();
+        const home = os34.homedir();
         if (home) env.HOME = home;
       } catch {
       }
@@ -25742,9 +26284,9 @@ function coerceIssue(row, projectKey) {
 
 // src/beads/provisioner.ts
 var import_child_process24 = require("child_process");
-var fs46 = __toESM(require("fs"));
-var os33 = __toESM(require("os"));
-var path54 = __toESM(require("path"));
+var fs49 = __toESM(require("fs"));
+var os36 = __toESM(require("os"));
+var path56 = __toESM(require("path"));
 
 // src/beads/install-bd.ts
 var import_child_process22 = require("child_process");
@@ -25809,9 +26351,9 @@ async function installBd(platform3 = process.platform) {
 
 // src/beads/install-dolt.ts
 var import_child_process23 = require("child_process");
-var fs45 = __toESM(require("fs"));
-var os32 = __toESM(require("os"));
-var path53 = __toESM(require("path"));
+var fs48 = __toESM(require("fs"));
+var os35 = __toESM(require("os"));
+var path55 = __toESM(require("path"));
 var DOLT_INSTALL_SH_URL = "https://github.com/dolthub/dolt/releases/latest/download/install.sh";
 var DOLT_MSI_URL = "https://github.com/dolthub/dolt/releases/latest/download/dolt-windows-amd64.msi";
 function resolveDoltInstallStrategy(platform3) {
@@ -25900,14 +26442,14 @@ async function installDoltToDir(targetDir, platform3 = process.platform, arch2 =
   return result;
 }
 var _doltPathSeam = {
-  homedir: () => os32.homedir(),
+  homedir: () => os35.homedir(),
   getPath: () => process.env.PATH ?? "",
   setPath: (p2) => {
     process.env.PATH = p2;
   },
   exists: (p2) => {
     try {
-      fs45.accessSync(p2, fs45.constants.F_OK);
+      fs48.accessSync(p2, fs48.constants.F_OK);
       return true;
     } catch {
       return false;
@@ -25918,7 +26460,7 @@ function doltBinaryNames(platform3) {
   return platform3 === "win32" ? ["dolt.exe", "dolt.cmd", "dolt"] : ["dolt"];
 }
 function knownDoltDirs(platform3) {
-  const P3 = platform3 === "win32" ? path53.win32 : path53.posix;
+  const P3 = platform3 === "win32" ? path55.win32 : path55.posix;
   const home = _doltPathSeam.homedir();
   if (platform3 === "win32") {
     return [
@@ -25934,7 +26476,7 @@ function knownDoltDirs(platform3) {
   ].filter(Boolean);
 }
 function ensureDoltResolvable(platform3 = process.platform) {
-  const P3 = platform3 === "win32" ? path53.win32 : path53.posix;
+  const P3 = platform3 === "win32" ? path55.win32 : path55.posix;
   const delim = platform3 === "win32" ? ";" : ":";
   const names = doltBinaryNames(platform3);
   const pathDirs = _doltPathSeam.getPath().split(delim).filter(Boolean);
@@ -26128,17 +26670,17 @@ function remoteHasDoltData(cwd) {
 }
 var _linkSeam = {
   platform: () => process.platform,
-  homedir: () => os33.homedir(),
+  homedir: () => os36.homedir(),
   isWritableDir: (dir) => {
     try {
-      fs46.accessSync(dir, fs46.constants.W_OK);
+      fs49.accessSync(dir, fs49.constants.W_OK);
       return true;
     } catch {
       return false;
     }
   },
   ensureDir: (dir) => {
-    fs46.mkdirSync(dir, { recursive: true });
+    fs49.mkdirSync(dir, { recursive: true });
   },
   /**
    * A directory to symlink `bd` into so the AGENT's shell + Claude Code's
@@ -26159,9 +26701,9 @@ var _linkSeam = {
    * which `linkBdOntoPath` creates if missing.
    */
   cliBinDir: () => {
-    const pathDirs = (process.env.PATH ?? "").split(path54.delimiter).filter(Boolean);
+    const pathDirs = (process.env.PATH ?? "").split(path56.delimiter).filter(Boolean);
     const home = _linkSeam.homedir();
-    const localBin = home ? path54.join(home, ".local", "bin") : null;
+    const localBin = home ? path56.join(home, ".local", "bin") : null;
     if (localBin) {
       try {
         _linkSeam.ensureDir(localBin);
@@ -26171,16 +26713,16 @@ var _linkSeam = {
     const candidates = [];
     if (localBin) candidates.push(localBin);
     try {
-      candidates.push(path54.dirname(process.execPath));
+      candidates.push(path56.dirname(process.execPath));
     } catch {
     }
     candidates.push("/usr/local/bin");
     const entry = process.argv[1];
     if (entry) {
       try {
-        candidates.push(path54.dirname(fs46.realpathSync(entry)));
+        candidates.push(path56.dirname(fs49.realpathSync(entry)));
       } catch {
-        candidates.push(path54.dirname(entry));
+        candidates.push(path56.dirname(entry));
       }
     }
     const onPathWritable = candidates.find(
@@ -26192,20 +26734,20 @@ var _linkSeam = {
   /** Current symlink target at `linkPath`, or null when absent / not a link. */
   readlink: (linkPath) => {
     try {
-      return fs46.readlinkSync(linkPath);
+      return fs49.readlinkSync(linkPath);
     } catch {
       return null;
     }
   },
-  unlink: (linkPath) => fs46.unlinkSync(linkPath),
-  symlink: (target, linkPath) => fs46.symlinkSync(target, linkPath)
+  unlink: (linkPath) => fs49.unlinkSync(linkPath),
+  symlink: (target, linkPath) => fs49.symlinkSync(target, linkPath)
 };
 function linkBdOntoPath(binaryPath) {
   if (_linkSeam.platform() === "win32") return;
   const binDir = _linkSeam.cliBinDir();
   if (!binDir) return;
   _linkSeam.ensureDir(binDir);
-  const linkPath = path54.join(binDir, "bd");
+  const linkPath = path56.join(binDir, "bd");
   if (linkPath === binaryPath) return;
   const current2 = _linkSeam.readlink(linkPath);
   if (current2 === binaryPath) return;
@@ -26419,16 +26961,16 @@ function dedupeRecipes(agents) {
 }
 function ensureLocalGitExclude(cwd, patterns) {
   try {
-    const gitDir = path54.join(cwd, ".git");
-    if (!fs46.statSync(gitDir).isDirectory()) return;
-    const file = path54.join(gitDir, "info", "exclude");
-    fs46.mkdirSync(path54.dirname(file), { recursive: true });
-    const current2 = fs46.existsSync(file) ? fs46.readFileSync(file, "utf8") : "";
+    const gitDir = path56.join(cwd, ".git");
+    if (!fs49.statSync(gitDir).isDirectory()) return;
+    const file = path56.join(gitDir, "info", "exclude");
+    fs49.mkdirSync(path56.dirname(file), { recursive: true });
+    const current2 = fs49.existsSync(file) ? fs49.readFileSync(file, "utf8") : "";
     const have = new Set(current2.split(/\r?\n/).map((l) => l.trim()));
     const missing = patterns.filter((p2) => !have.has(p2));
     if (missing.length === 0) return;
     const prefix = current2.length > 0 && !current2.endsWith("\n") ? "\n" : "";
-    fs46.appendFileSync(file, `${prefix}# CodeAgent: beads state stays local
+    fs49.appendFileSync(file, `${prefix}# CodeAgent: beads state stays local
 ${missing.join("\n")}
 `);
   } catch {
@@ -26437,7 +26979,7 @@ ${missing.join("\n")}
 
 // src/beads/watcher.ts
 var crypto4 = __toESM(require("crypto"));
-var path55 = __toESM(require("path"));
+var path57 = __toESM(require("path"));
 var API_BASE5 = resolveApiBaseUrl();
 var DEBOUNCE_MS2 = 400;
 var ZERO_SUMMARY = {
@@ -26461,7 +27003,7 @@ var BeadsWatcher = class {
   constructor(opts) {
     this.opts = opts;
     this.bd = opts.adapter ?? new BdAdapter({ cwd: opts.cwd, beadsDir: opts.beadsDir });
-    this.feedPath = opts.feedPath ?? path55.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
+    this.feedPath = opts.feedPath ?? path57.join(opts.cwd ?? process.cwd(), ".beads", "last-touched");
     this.apiBase = opts.apiBaseUrl ?? API_BASE5;
   }
   opts;
@@ -26715,41 +27257,6 @@ async function handleBeadsActionCommand(action, started) {
 var import_node_fs8 = __toESM(require("fs"));
 var import_node_os5 = __toESM(require("os"));
 var import_node_path6 = __toESM(require("path"));
-
-// src/lib/restrict-to-owner.ts
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_os4 = __toESM(require("os"));
-var import_node_child_process18 = require("child_process");
-var BROAD_WINDOWS_SIDS = [
-  "*S-1-1-0",
-  "*S-1-5-11",
-  "*S-1-5-32-545",
-  "*S-1-5-32-544",
-  "*S-1-5-18"
-];
-function restrictToOwner(filePath) {
-  try {
-    if (process.platform === "win32") {
-      const username = import_node_os4.default.userInfo().username;
-      (0, import_node_child_process18.execFileSync)(
-        "icacls",
-        [
-          filePath,
-          "/inheritance:r",
-          "/grant:r",
-          `${username}:F`,
-          ...BROAD_WINDOWS_SIDS.flatMap((sid) => ["/remove", sid])
-        ],
-        { stdio: "ignore" }
-      );
-    } else {
-      import_node_fs7.default.chmodSync(filePath, 384);
-    }
-  } catch {
-  }
-}
-
-// src/beads/config-store.ts
 function beadsConfigPath() {
   return import_node_path6.default.join(import_node_os5.default.homedir(), ".codeam", "beads-config.json");
 }
@@ -27036,8 +27543,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path59.join(os39.tmpdir(), `codeam-${(0, import_crypto2.randomUUID)()}-${safeName}`);
-    fs51.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path61.join(os41.tmpdir(), `codeam-${(0, import_crypto2.randomUUID)()}-${safeName}`);
+    fs53.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -27272,10 +27779,10 @@ var listFiles = async (ctx, cmd, parsed) => {
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
 var envReadH = async (ctx, cmd) => {
-  const envPath = path59.join(process.cwd(), ".env");
+  const envPath = path61.join(process.cwd(), ".env");
   await restoreProjectEnvIfMissing(process.cwd(), ctx);
   try {
-    const raw = await fs51.promises.readFile(envPath, "utf8");
+    const raw = await fs53.promises.readFile(envPath, "utf8");
     await ctx.relay.sendResult(cmd.id, "completed", {
       exists: true,
       vars: parseDotenv(raw)
@@ -27304,7 +27811,7 @@ var envParseH = async (ctx, cmd, parsed) => {
   const existing = /* @__PURE__ */ new Map();
   if (!replace) {
     try {
-      const raw = await fs51.promises.readFile(path59.join(process.cwd(), ".env"), "utf8");
+      const raw = await fs53.promises.readFile(path61.join(process.cwd(), ".env"), "utf8");
       for (const v of parseDotenv(raw)) existing.set(v.key, v.value);
     } catch {
     }
@@ -27344,15 +27851,15 @@ var envWriteH = async (ctx, cmd, parsed) => {
     }
     seen2.add(v.key);
   }
-  const envPath = path59.join(process.cwd(), ".env");
-  const tmpPath = path59.join(process.cwd(), ".env.codeam.tmp");
+  const envPath = path61.join(process.cwd(), ".env");
+  const tmpPath = path61.join(process.cwd(), ".env.codeam.tmp");
   try {
-    await fs51.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
-    await fs51.promises.rename(tmpPath, envPath);
+    await fs53.promises.writeFile(tmpPath, serializeDotenv(vars), "utf8");
+    await fs53.promises.rename(tmpPath, envPath);
     await ctx.relay.sendResult(cmd.id, "completed", { ok: true, count: vars.length });
     void syncProjectEnvUp(process.cwd(), ctx);
   } catch (err) {
-    await fs51.promises.rm(tmpPath, { force: true }).catch(() => void 0);
+    await fs53.promises.rm(tmpPath, { force: true }).catch(() => void 0);
     await ctx.relay.sendResult(cmd.id, "failed", { error: err.message });
   }
 };
@@ -27684,9 +28191,9 @@ var CLI_UPDATE_MAX_ATTEMPTS = 3;
 function buildNpmInstallInvocation(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const execPath = opts?.execPath ?? process.execPath;
-  const exists2 = opts?.existsSync ?? fs51.existsSync;
+  const exists2 = opts?.existsSync ?? fs53.existsSync;
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path59.win32 : path59.posix;
+  const p2 = platform3 === "win32" ? path61.win32 : path61.posix;
   const normalized = entryScript.split(/[\\/]/).join("/");
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = normalized.indexOf(marker);
@@ -27708,7 +28215,7 @@ function isPermissionError(stderr) {
 function resolveGlobalNodeModulesDir(opts) {
   const entryScript = opts?.entryScript ?? process.argv[1] ?? "";
   const platform3 = opts?.platform ?? process.platform;
-  const p2 = platform3 === "win32" ? path59.win32 : path59.posix;
+  const p2 = platform3 === "win32" ? path61.win32 : path61.posix;
   const marker = "/lib/node_modules/codeam-cli/";
   const markerIdx = entryScript.split(/[\\/]/).join("/").indexOf(marker);
   if (markerIdx <= 0) return null;
@@ -27718,9 +28225,9 @@ function resolveGlobalNodeModulesDir(opts) {
 var STALE_STAGING_AGE_MS = CLI_UPDATE_INSTALL_TIMEOUT_MS;
 function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   if (!nodeModulesDir) return 0;
-  const readdirSync16 = deps?.readdirSync ?? fs51.readdirSync;
-  const statSync16 = deps?.statSync ?? fs51.statSync;
-  const rmSync10 = deps?.rmSync ?? fs51.rmSync;
+  const readdirSync16 = deps?.readdirSync ?? fs53.readdirSync;
+  const statSync16 = deps?.statSync ?? fs53.statSync;
+  const rmSync10 = deps?.rmSync ?? fs53.rmSync;
   let removed = 0;
   let entries;
   try {
@@ -27730,7 +28237,7 @@ function sweepStaleCliStagingDirs(nodeModulesDir, now = Date.now(), deps) {
   }
   for (const name of entries) {
     if (!/^\.codeam-cli-/.test(name)) continue;
-    const full = path59.join(nodeModulesDir, name);
+    const full = path61.join(nodeModulesDir, name);
     try {
       const st3 = statSync16(full);
       if (now - st3.mtimeMs < STALE_STAGING_AGE_MS) continue;
@@ -28102,11 +28609,13 @@ async function runDetectOneShot(generate, timeoutMs = PREVIEW_DETECT_TIMEOUT_MS)
   const onStderr = (chunk) => {
     stderr = (stderr + chunk).slice(-4e3);
   };
+  const onFailedOutput = (stdout) => onStderr(`
+${stdout}`);
   const deadline = new Promise((resolve12) => {
     timer = setTimeout(() => resolve12({ raw: null, timedOut: true, stderr }), timeoutMs);
     timer.unref?.();
   });
-  const oneShot = generate(PREVIEW_DETECT_PROMPT, { timeoutMs, onStderr }).then(
+  const oneShot = generate(PREVIEW_DETECT_PROMPT, { timeoutMs, onStderr, onFailedOutput }).then(
     (raw) => ({ raw, timedOut: false, stderr }),
     (err) => {
       log.info("preview", `detect: generateOneShot threw: ${String(err)}`);
@@ -28170,6 +28679,15 @@ async function resolvePreviewDetection(args2) {
 --- salida cruda del agente (acotada) ---
 ${failure?.rawExcerpt ?? ""}`
     );
+    if (looksLikeByoProviderBilling(`${raw ?? ""}
+${stderr}`)) {
+      log.info("preview", "detect: provider out of credits \u2014 emitting preview_error");
+      emit2(USER_EVENTS.PREVIEW_ERROR, {
+        stage: "detection",
+        message: previewProviderCreditsMessage(byoProviderName({ agent: runtime.id }))
+      });
+      return null;
+    }
     emit2(USER_EVENTS.PREVIEW_ERROR, {
       stage: "detection",
       // El mensaje sale del diagnostico: decir "JSON invalido" cuando el
@@ -28765,7 +29283,7 @@ function resolveTokenValue(args2) {
   if (fileFlag) {
     const path98 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs52.readFileSync(path98, "utf8").trim();
+      const content = fs54.readFileSync(path98, "utf8").trim();
       if (content.length === 0) fail(`--token-file ${path98} is empty`);
       rmIfExistsQuiet(path98);
       return content;
@@ -28859,12 +29377,12 @@ async function claim(token, pluginId, pluginSecretHash) {
   }
 }
 function pairAutoLockPath() {
-  return path60.join(os40.homedir(), ".codeam", "pair-auto.lock");
+  return path62.join(os42.homedir(), ".codeam", "pair-auto.lock");
 }
 var procRoot = "/proc";
 function readProcFile(rel) {
   try {
-    return fs52.readFileSync(path60.join(procRoot, rel), "utf8");
+    return fs54.readFileSync(path62.join(procRoot, rel), "utf8");
   } catch {
     return void 0;
   }
@@ -28885,7 +29403,7 @@ function currentBootId() {
 function readLockRecord(lockPath) {
   let raw;
   try {
-    raw = fs52.readFileSync(lockPath, "utf8");
+    raw = fs54.readFileSync(lockPath, "utf8");
   } catch {
     return void 0;
   }
@@ -28934,7 +29452,7 @@ function isLiveLockHolder(rec) {
 }
 function releaseOwnLock(lockPath) {
   try {
-    if (readLockRecord(lockPath)?.pid === process.pid) fs52.unlinkSync(lockPath);
+    if (readLockRecord(lockPath)?.pid === process.pid) fs54.unlinkSync(lockPath);
   } catch {
   }
 }
@@ -28958,7 +29476,7 @@ function snapshotProcessTree(root) {
   const children = /* @__PURE__ */ new Map();
   let entries = [];
   try {
-    entries = fs52.readdirSync(procRoot).filter((e) => /^\d+$/.test(e));
+    entries = fs54.readdirSync(procRoot).filter((e) => /^\d+$/.test(e));
   } catch {
   }
   for (const e of entries) {
@@ -28993,18 +29511,18 @@ function signalProcessTree(refs, signal) {
 }
 function daemonLockPath(sessionId) {
   const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return path60.join(os40.homedir(), ".codeam", `daemon-${safe}.lock`);
+  return path62.join(os42.homedir(), ".codeam", `daemon-${safe}.lock`);
 }
 function acquireDaemonLock(sessionId) {
   const lockPath = daemonLockPath(sessionId);
   try {
-    fs52.mkdirSync(path60.dirname(lockPath), { recursive: true });
+    fs54.mkdirSync(path62.dirname(lockPath), { recursive: true });
     try {
-      fs52.writeFileSync(lockPath, ownLockBody(), { flag: "wx" });
+      fs54.writeFileSync(lockPath, ownLockBody(), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
       if (isLiveLockHolder(readLockRecord(lockPath))) return false;
-      fs52.writeFileSync(lockPath, ownLockBody());
+      fs54.writeFileSync(lockPath, ownLockBody());
     }
     const release3 = () => releaseOwnLock(lockPath);
     process.once("exit", release3);
@@ -29024,13 +29542,13 @@ function acquireDaemonLock(sessionId) {
 function acquireSingletonLock() {
   const lockPath = pairAutoLockPath();
   try {
-    fs52.mkdirSync(path60.dirname(lockPath), { recursive: true });
+    fs54.mkdirSync(path62.dirname(lockPath), { recursive: true });
     try {
-      fs52.writeFileSync(lockPath, ownLockBody(), { flag: "wx" });
+      fs54.writeFileSync(lockPath, ownLockBody(), { flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
       if (isLiveLockHolder(readLockRecord(lockPath))) return false;
-      fs52.writeFileSync(lockPath, ownLockBody());
+      fs54.writeFileSync(lockPath, ownLockBody());
     }
     process.once("exit", () => releaseOwnLock(lockPath));
     return true;
@@ -29447,7 +29965,7 @@ var AgentService = class _AgentService {
 };
 
 // src/agents/acp/adapters.ts
-var path61 = __toESM(require("path"));
+var path63 = __toESM(require("path"));
 
 // src/agents/kimi/installer.ts
 var import_node_child_process19 = require("child_process");
@@ -29567,13 +30085,13 @@ function resolveBin(pkgName, binName) {
   try {
     const manifestPath = require_.resolve(`${pkgName}/package.json`);
     const manifest = require_(`${pkgName}/package.json`);
-    const pkgDir = path61.dirname(manifestPath);
+    const pkgDir = path63.dirname(manifestPath);
     const bin = manifest.bin;
     if (!bin) return null;
-    if (typeof bin === "string") return path61.resolve(pkgDir, bin);
+    if (typeof bin === "string") return path63.resolve(pkgDir, bin);
     const target = binName ?? Object.keys(bin)[0];
     if (!target || !bin[target]) return null;
-    return path61.resolve(pkgDir, bin[target]);
+    return path63.resolve(pkgDir, bin[target]);
   } catch {
     return null;
   }
@@ -29753,25 +30271,25 @@ async function resolveAcpAdapterWithRetry(agent, opts = {}) {
 }
 
 // src/commands/host/workspace.ts
-var fs53 = __toESM(require("fs"));
-var os41 = __toESM(require("os"));
-var path62 = __toESM(require("path"));
+var fs55 = __toESM(require("fs"));
+var os43 = __toESM(require("os"));
+var path64 = __toESM(require("path"));
 var import_node_child_process21 = require("child_process");
 var import_node_util5 = require("util");
 var execFileP5 = (0, import_node_util5.promisify)(import_node_child_process21.execFile);
 function isAbsolutePathTarget(target) {
-  return path62.isAbsolute(target);
+  return path64.isAbsolute(target);
 }
 function selfHostedWorkspaceRoot() {
-  return path62.join(os41.homedir(), ".codeam", "self-hosted");
+  return path64.join(os43.homedir(), ".codeam", "self-hosted");
 }
 function deployIdFromWorkspace(cwd) {
   if (!cwd) return null;
   const root = selfHostedWorkspaceRoot();
-  const resolved = path62.resolve(cwd);
-  const rel = path62.relative(root, resolved);
-  if (!rel || rel.startsWith("..") || path62.isAbsolute(rel)) return null;
-  const parts = rel.split(path62.sep).filter(Boolean);
+  const resolved = path64.resolve(cwd);
+  const rel = path64.relative(root, resolved);
+  if (!rel || rel.startsWith("..") || path64.isAbsolute(rel)) return null;
+  const parts = rel.split(path64.sep).filter(Boolean);
   if (parts.length !== 1) return null;
   return parts[0];
 }
@@ -29843,15 +30361,15 @@ async function configureGitCredentials(dest, repoRef, cloneToken, provider = "gi
   const isGitlab = provider === "gitlab";
   if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
   if (!cloneToken) return;
-  const credFile = path62.join(dest, ".git", "codeam-credentials");
+  const credFile = path64.join(dest, ".git", "codeam-credentials");
   const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
 ` : `https://x-access-token:${cloneToken}@github.com
 `;
-  fs53.writeFileSync(credFile, credLine, { mode: 384 });
+  fs55.writeFileSync(credFile, credLine, { mode: 384 });
   restrictToOwner(credFile);
   const env = nonInteractiveGitEnv();
   const git2 = (args2) => execFileP5("git", ["-C", dest, ...args2], { timeout: 3e4, env });
-  const credFilePosix = credFile.split(path62.sep).join("/");
+  const credFilePosix = credFile.split(path64.sep).join("/");
   await git2(["config", "--local", "--replace-all", "credential.helper", ""]).catch(() => {
   });
   await git2([
@@ -29884,17 +30402,17 @@ function maskToken(text, cloneToken) {
 }
 async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github", branch) {
   if (isAbsolutePathTarget(repoOrPath)) {
-    if (!fs53.existsSync(repoOrPath)) {
+    if (!fs55.existsSync(repoOrPath)) {
       throw new Error(`deploy target path does not exist: ${repoOrPath}`);
     }
     return repoOrPath;
   }
-  const dest = path62.join(selfHostedWorkspaceRoot(), deployId);
-  if (fs53.existsSync(path62.join(dest, ".git"))) {
+  const dest = path64.join(selfHostedWorkspaceRoot(), deployId);
+  if (fs55.existsSync(path64.join(dest, ".git"))) {
     if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
     return dest;
   }
-  fs53.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
+  fs55.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
   const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
   const cloneArgs = branch ? ["clone", "--depth", "1", "--branch", branch, cloneUrl, dest] : ["clone", "--depth", "1", cloneUrl, dest];
   try {
@@ -29917,266 +30435,6 @@ var fs72 = __toESM(require("fs"));
 var os56 = __toESM(require("os"));
 var path83 = __toESM(require("path"));
 
-// src/lib/provider-routing.ts
-var fs55 = __toESM(require("fs"));
-var os43 = __toESM(require("os"));
-var path64 = __toESM(require("path"));
-
-// src/commands/host/house-proxy-config.ts
-var fs54 = __toESM(require("fs"));
-var os42 = __toESM(require("os"));
-var path63 = __toESM(require("path"));
-function houseProxyConfigPath() {
-  return path63.join(os42.homedir(), ".codeam", "house-proxy.json");
-}
-var DEPLOY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-function deployHouseProxyConfigPath(deployId) {
-  if (!DEPLOY_ID_RE.test(deployId) || deployId.includes("..")) return null;
-  return path63.join(os42.homedir(), ".codeam", "house-proxy", `${deployId}.json`);
-}
-function writeJson0600(file, value) {
-  fs54.mkdirSync(path63.dirname(file), { recursive: true, mode: 448 });
-  const tmp = `${file}.tmp-${process.pid}`;
-  fs54.writeFileSync(tmp, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 384 });
-  fs54.renameSync(tmp, file);
-  restrictToOwner(file);
-}
-function persistHouseProxyConfig(config, deployId) {
-  try {
-    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
-    if (perDeploy) writeJson0600(perDeploy, config);
-    writeJson0600(houseProxyConfigPath(), config);
-  } catch (err) {
-    log.warn(
-      "host-agent",
-      `failed to persist house-proxy config (best-effort): ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-function clearHouseProxyConfig(deployId) {
-  try {
-    fs54.rmSync(houseProxyConfigPath(), { force: true });
-    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
-    if (perDeploy) writeJson0600(perDeploy, { none: true });
-  } catch {
-  }
-}
-function readHouseProxyChildEnv(deployId) {
-  try {
-    const perDeploy = deployId ? deployHouseProxyConfigPath(deployId) : null;
-    const file = perDeploy && fs54.existsSync(perDeploy) ? perDeploy : houseProxyConfigPath();
-    const raw = fs54.readFileSync(file, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return {};
-    const o = parsed;
-    if (o.none === true) return {};
-    if (typeof o.baseUrl !== "string" || !o.baseUrl) return {};
-    if (typeof o.token !== "string" || !o.token) return {};
-    return buildHouseProxyChildEnv({
-      baseUrl: o.baseUrl,
-      token: o.token,
-      openRouter: o.openRouter === true,
-      ...typeof o.claudeConfigDir === "string" && o.claudeConfigDir ? { claudeConfigDir: o.claudeConfigDir } : {},
-      ...typeof o.model === "string" && o.model ? { model: o.model } : {},
-      ...typeof o.managedAgentId === "string" && o.managedAgentId ? { managedAgentId: o.managedAgentId } : {}
-    });
-  } catch {
-    return {};
-  }
-}
-var HOUSE_MODEL_CONTEXT_TOKENS = "512000";
-function buildHouseProxyChildEnv(cfg) {
-  const env = {
-    ANTHROPIC_BASE_URL: cfg.baseUrl,
-    ANTHROPIC_AUTH_TOKEN: cfg.token,
-    // ⚠️ MAX_CONTEXT_TOKENS, not (only) AUTO_COMPACT_WINDOW — and this is
-    // HOUSE-AGENT ONLY: it lives in this builder precisely so a user's own
-    // Claude Code (a real Anthropic model claude knows) is never touched.
-    //
-    // claude does not know `MiniMax-M3`, so it falls back to its
-    // unknown-model default (200k). `CLAUDE_CODE_AUTO_COMPACT_WINDOW` is then
-    // applied as `Math.min(assumedWindow, env)` — it can only SHRINK the
-    // window, never grow it — so the 512000 we used to set here was inert:
-    // claude kept believing 200k. Meanwhile a session with a dozen linked
-    // integrations carries ~175k tokens of MCP tool schemas on EVERY turn
-    // (measured: 475 tools ≈ 698 KB on a real box), so the context started
-    // ~88% full and a 28-character prompt triggered a compaction, then the
-    // next small tool result triggered another: "Autocompact is thrashing:
-    // the context refilled to the limit within 3 turns", 13 compactions in
-    // one session (rafaelph90.br@gmail.com, 2026-09-03).
-    //
-    // claude's own unknown-model notice names the fix: "set
-    // CLAUDE_CODE_MAX_CONTEXT_TOKENS to its real window" — that variable is
-    // what `wL()` returns for an unrecognised model. MiniMax-M3 is a 1M-context
-    // model with a guaranteed minimum of 512K, so 512000 here is the
-    // conservative truth, not a wish. AUTO_COMPACT_WINDOW stays as the
-    // compaction threshold beneath it.
-    CLAUDE_CODE_MAX_CONTEXT_TOKENS: HOUSE_MODEL_CONTEXT_TOKENS,
-    CLAUDE_CODE_AUTO_COMPACT_WINDOW: HOUSE_MODEL_CONTEXT_TOKENS,
-    API_TIMEOUT_MS: "3000000"
-  };
-  if (cfg.openRouter === true) {
-    env.ANTHROPIC_API_KEY = "";
-  } else {
-    const model = typeof cfg.model === "string" && cfg.model ? cfg.model : "MiniMax-M3";
-    env.ANTHROPIC_MODEL = model;
-    env.ANTHROPIC_DEFAULT_SONNET_MODEL = model;
-    env.ANTHROPIC_DEFAULT_OPUS_MODEL = model;
-    env.ANTHROPIC_DEFAULT_HAIKU_MODEL = model;
-  }
-  if (typeof cfg.claudeConfigDir === "string" && cfg.claudeConfigDir) {
-    env.CLAUDE_CONFIG_DIR = cfg.claudeConfigDir;
-  }
-  if (isManagedProviderId(cfg.managedAgentId)) {
-    env[MANAGED_AGENT_ENV] = cfg.managedAgentId;
-  }
-  return env;
-}
-function houseRailWireId(env) {
-  const managed = env[MANAGED_AGENT_ENV];
-  return isManagedProviderId(managed) ? managed : HOUSE_AGENT_ID;
-}
-var HOUSE_PROXY_ENV_KEYS = [
-  "ANTHROPIC_BASE_URL",
-  "ANTHROPIC_AUTH_TOKEN",
-  "ANTHROPIC_API_KEY",
-  "ANTHROPIC_MODEL",
-  "ANTHROPIC_DEFAULT_SONNET_MODEL",
-  "ANTHROPIC_DEFAULT_OPUS_MODEL",
-  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-  "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
-  "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
-  "API_TIMEOUT_MS",
-  "CLAUDE_CONFIG_DIR",
-  MANAGED_AGENT_ENV
-];
-function clearHouseProxyEnvOverrides() {
-  const out2 = {};
-  for (const key of HOUSE_PROXY_ENV_KEYS) out2[key] = void 0;
-  return out2;
-}
-function isHouseProxyEnv(env) {
-  return typeof env.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN.length > 0 && (env.ANTHROPIC_BASE_URL ?? "").includes("/api/v1/agent-proxy");
-}
-function currentRailWireId(env = process.env) {
-  return isHouseProxyEnv(env) ? houseRailWireId(env) : null;
-}
-function pickHouseProxyEnv(env) {
-  const out2 = {};
-  for (const key of HOUSE_PROXY_ENV_KEYS) {
-    const v = env[key];
-    if (typeof v === "string") out2[key] = v;
-  }
-  return out2;
-}
-
-// src/lib/provider-routing.ts
-var PROVIDER_BASE_URL_ENV_KEYS = [
-  "ANTHROPIC_BASE_URL",
-  "OPENAI_BASE_URL",
-  "OPENAI_API_BASE",
-  "GEMINI_API_BASE",
-  "GOOGLE_GEMINI_BASE_URL"
-];
-var ROUTING_DEFAULT = "default";
-function redactUrlToOrigin(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  try {
-    const u2 = new URL(trimmed);
-    if (!u2.host) return "invalid-url";
-    return `${u2.protocol}//${u2.host}`;
-  } catch {
-    return "invalid-url";
-  }
-}
-function readOpencodeProviderOrigins(opts = {}) {
-  const home = opts.homeDir ?? os43.homedir();
-  const readFile7 = opts.readFile ?? ((f) => fs55.readFileSync(f, "utf8"));
-  const candidates = [];
-  if (opts.cwd) {
-    candidates.push(path64.join(opts.cwd, "opencode.json"), path64.join(opts.cwd, "opencode.jsonc"));
-  }
-  candidates.push(
-    path64.join(home, ".config", "opencode", "opencode.json"),
-    path64.join(home, ".config", "opencode", "opencode.jsonc")
-  );
-  const out2 = [];
-  const seen2 = /* @__PURE__ */ new Set();
-  for (const file of candidates) {
-    let text;
-    try {
-      text = readFile7(file);
-    } catch {
-      continue;
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(text.replace(/^\s*\/\/.*$/gm, ""));
-    } catch {
-      continue;
-    }
-    const providers = parsed?.provider;
-    if (!providers || typeof providers !== "object") continue;
-    for (const [id, cfg] of Object.entries(providers)) {
-      if (seen2.has(id)) continue;
-      const options = cfg?.options;
-      const base = options?.baseURL ?? options?.baseUrl ?? options?.base_url;
-      const origin = redactUrlToOrigin(base);
-      if (!origin) continue;
-      seen2.add(id);
-      out2.push({ provider: id, origin });
-    }
-  }
-  return out2;
-}
-function describeProviderRouting(env, opts = {}) {
-  const routed = {};
-  for (const key of PROVIDER_BASE_URL_ENV_KEYS) {
-    routed[key] = redactUrlToOrigin(env[key]) ?? ROUTING_DEFAULT;
-  }
-  let opencode = [];
-  try {
-    opencode = readOpencodeProviderOrigins(opts);
-  } catch {
-  }
-  const houseKeys = HOUSE_PROXY_ENV_KEYS.filter(
-    (k2) => typeof env[k2] === "string" && env[k2].length > 0
-  );
-  const codeamKeys = Object.keys(env).filter((k2) => k2.startsWith("CODEAM_") && typeof env[k2] === "string" && env[k2].length > 0).sort();
-  return { env: routed, opencode, houseProxy: isHouseProxyEnv(env), houseKeys, codeamKeys };
-}
-function formatProviderRouting(r, label) {
-  const parts = [
-    label ? `agent=${label}` : null,
-    `anthropic=${r.env.ANTHROPIC_BASE_URL}`,
-    `openai=${r.env.OPENAI_BASE_URL !== ROUTING_DEFAULT ? r.env.OPENAI_BASE_URL : r.env.OPENAI_API_BASE}`,
-    `gemini=${r.env.GEMINI_API_BASE !== ROUTING_DEFAULT ? r.env.GEMINI_API_BASE : r.env.GOOGLE_GEMINI_BASE_URL}`,
-    `opencode=[${r.opencode.map((p2) => `${p2.provider}=${p2.origin}`).join(",")}]`,
-    `houseProxy=${r.houseProxy ? "yes" : "no"}`,
-    `houseKeys=[${r.houseKeys.join(",")}]`,
-    `codeamKeys=[${r.codeamKeys.join(",")}]`
-  ];
-  return parts.filter((p2) => p2 !== null).join(" ");
-}
-var PROVIDER_BILLING_RE = /(?:api error|http|status)[:\s]+402\b|\b402\b[^\n]{0,40}(?:payment required|insufficient|credits?|balance)|insufficient (?:credits?|balance|funds)|payment required/i;
-function matchesProviderBilling(text) {
-  return PROVIDER_BILLING_RE.test(text);
-}
-function scrubSecrets(text) {
-  return text.replace(/\b(?:sk|pk|rk|key|token)[-_][A-Za-z0-9_-]{12,}/gi, "[redacted]").replace(/bearer\s+[A-Za-z0-9._-]{12,}/gi, "Bearer [redacted]").replace(/\b[A-Za-z0-9_-]{40,}\b/g, "[redacted]");
-}
-function classifyProviderBilling(text, env) {
-  if (!matchesProviderBilling(text)) return null;
-  const line = text.split("\n").find((l) => PROVIDER_BILLING_RE.test(l)) ?? text;
-  return {
-    marker: isHouseProxyEnv(env) ? "provider_billing_house" : "provider_billing_external",
-    anthropicHost: redactUrlToOrigin(env.ANTHROPIC_BASE_URL) ?? ROUTING_DEFAULT,
-    snippet: scrubSecrets(line.trim()).slice(0, 160)
-  };
-}
-
 // src/agents/acp/provider-billing-signal.ts
 var seen = /* @__PURE__ */ new Set();
 function noteProviderBillingSignal(opts) {
@@ -38540,243 +38798,6 @@ function withTimeout(p2, ms) {
   });
 }
 
-// src/agents/acp/oneMContextRecovery.ts
-var ONE_M_CONTEXT_CREDITS_RE = /usage credits required for 1m context/i;
-function looksLike1mContextCreditsError(text) {
-  return ONE_M_CONTEXT_CREDITS_RE.test(text);
-}
-function shouldOfferOneMRecovery(opts) {
-  return looksLike1mContextCreditsError(opts.detail) || looksLike1mContextCreditsError(opts.recentStderr) || looksLike1mContextCreditsError(opts.finalText);
-}
-
-// src/agents/acp/agent-hooks.ts
-function replyIsCursorUpgradeRequired(finalText) {
-  const t2 = finalText.trim().toLowerCase();
-  if (t2.length === 0 || t2.length > 200) return false;
-  return t2.includes("upgrade your plan to continue") || t2.includes("upgrade your plan") && t2.includes("continue");
-}
-function isGeminiIneligibleTier(haystack2) {
-  return /IneligibleTierError|UNSUPPORTED_CLIENT|no longer supported for Gemini Code Assist|not eligible for Gemini Code Assist/i.test(
-    haystack2
-  );
-}
-var ACP_AGENT_HOOKS = {
-  claude: {
-    statusPage: { vendor: "Anthropic", url: "https://status.anthropic.com" },
-    // Freeze the SDK-bundled Claude Code binary at the version this CLI (and its
-    // pinned ACP adapter) was tested against. Without this the binary silently
-    // self-updates to @latest and can drift PAST the adapter — a newer Claude
-    // Code (v2.1.211) started streaming its TUI chrome (What's-new banner, status
-    // line, box-drawing) into the ACP text channel, which paints as a broken chat
-    // on mobile. A version regression must now reach users only through a gated
-    // codeam-cli release, never silently via auto-update.
-    startupExtraEnv: () => ({
-      DISABLE_AUTOUPDATER: "1",
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-    })
-  },
-  codex: {
-    statusPage: { vendor: "OpenAI", url: "https://status.openai.com" },
-    startupExtraEnv: ({ autoApprovePermissions }) => autoApprovePermissions ? { INITIAL_AGENT_MODE: "agent-full-access" } : {}
-  },
-  gemini: {
-    statusPage: { vendor: "Google", url: "https://status.cloud.google.com" },
-    classifyStartupFailure: (haystack2) => isGeminiIneligibleTier(haystack2) ? "ineligible_tier" : null
-  },
-  copilot: {
-    statusPage: { vendor: "GitHub", url: "https://www.githubstatus.com" }
-  },
-  cursor: {
-    statusPage: { vendor: "Cursor", url: "https://status.cursor.com" },
-    classifyCompletedReply: (finalText) => replyIsCursorUpgradeRequired(finalText) ? "upgrade_required" : null
-  }
-};
-function agentHooks(agent) {
-  return ACP_AGENT_HOOKS[agent];
-}
-
-// src/agents/acp/failure-messages.ts
-function describeError(err) {
-  if (err instanceof Error) return err.message;
-  return String(err);
-}
-var AUTH_FAILURE_RE = /invalid authentication credentials|failed to authenticate|authentication[_ ](?:error|required)|please run \/login|\bunauthorized\b|\binvalid x-api-key\b|oauth (?:token|session) (?:expired|revoked)|(?:session|token|credentials?|oauth)[^\n]{0,40}could not be refreshed|(?:api error|http|status)[:\s]+401|\b401\b[^\n]{0,40}(?:unauthor|authenticat|credential|api[_ ]?key|login)/i;
-var HOUSE_AGENT_LIMIT_RE = /HOUSE_AGENT_CEILING|CodeAgent Cloud[^\n]{0,60}(?:usage )?ceiling|CodeAgent Cloud is temporarily (?:unavailable|disabled)/i;
-function looksLikeHouseAgentLimit(text) {
-  return HOUSE_AGENT_LIMIT_RE.test(text);
-}
-var LOCAL_PROXY_RE = /(?:127\.0\.0\.1|localhost|\[::1\]):\d+/i;
-var CONNECTION_ERROR_RE = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|socket hang up|fetch failed|network error|connection (?:refused|reset|closed)/i;
-function looksLikeLocalProxyUnavailable(text) {
-  return LOCAL_PROXY_RE.test(text) && CONNECTION_ERROR_RE.test(text);
-}
-function looksLikeAuthFailure(text) {
-  if (looksLikeHouseAgentLimit(text)) return false;
-  if (looksLikeLocalProxyUnavailable(text)) return false;
-  return AUTH_FAILURE_RE.test(text);
-}
-function replyIsAuthFailure(finalText) {
-  const t2 = finalText.trim();
-  return t2.length > 0 && t2.length <= 200 && looksLikeAuthFailure(t2);
-}
-function replyIsHouseAgentLimit(finalText) {
-  const t2 = finalText.trim();
-  return t2.length > 0 && t2.length <= 400 && looksLikeHouseAgentLimit(t2);
-}
-var BYO_PROVIDER_BILLING_RE = /(?:api error|http|status)[:\s]+402\b[^\n]{0,80}(?:insufficient (?:credits?|balance)|requires more credits)|\b402\b[^\n]{0,40}(?:insufficient (?:credits?|balance)|requires more credits)|insufficient (?:credits?|balance)[^\n]{0,40}\b402\b/i;
-function looksLikeByoProviderBilling(text, env = process.env) {
-  return !isHouseProxyEnv(env) && BYO_PROVIDER_BILLING_RE.test(text);
-}
-function replyIsByoProviderBilling(finalText, env = process.env) {
-  const t2 = finalText.trim();
-  return t2.length > 0 && t2.length <= 600 && looksLikeByoProviderBilling(t2, env);
-}
-var PROVIDER_HOST_NAMES = [
-  [/(^|\.)openrouter\.ai$/i, "OpenRouter"],
-  [/(^|\.)deepinfra\.com$/i, "DeepInfra"],
-  [/(^|\.)anthropic\.com$/i, "Anthropic"],
-  [/(^|\.)openai\.com$/i, "OpenAI"],
-  [/(^|\.)googleapis\.com$/i, "Google"],
-  [/(^|\.)minimax(?:i)?\.(?:io|com|chat)$/i, "MiniMax"],
-  [/(^|\.)moonshot\.(?:ai|cn)$/i, "Moonshot"],
-  [/(^|\.)x\.ai$/i, "xAI"],
-  [/(^|\.)mistral\.ai$/i, "Mistral"],
-  [/(^|\.)groq\.com$/i, "Groq"],
-  [/(^|\.)together\.(?:ai|xyz)$/i, "Together"]
-];
-var AGENT_DEFAULT_PROVIDER = {
-  claude: "Anthropic",
-  codex: "OpenAI",
-  gemini: "Google"
-};
-function byoProviderName(opts) {
-  const env = opts.env ?? process.env;
-  for (const key of PROVIDER_BASE_URL_ENV_KEYS) {
-    const origin = redactUrlToOrigin(env[key]);
-    if (!origin || origin === "invalid-url") continue;
-    const host2 = new URL(origin).hostname;
-    for (const [re2, name] of PROVIDER_HOST_NAMES) if (re2.test(host2)) return name;
-    return host2;
-  }
-  return opts.agent && AGENT_DEFAULT_PROVIDER[opts.agent] || "provider";
-}
-function byoProviderBillingMessage(provider) {
-  return `\u{1F4B3} **Your ${provider} account has no credits left.** Top up at your provider, or switch this session to another agent.`;
-}
-function completedReplyFailureBubble(opts) {
-  const env = opts.env ?? process.env;
-  if (replyIsHouseAgentLimit(opts.finalText)) return houseAgentLimitMessage(opts.finalText);
-  if (replyIsByoProviderBilling(opts.finalText, env)) {
-    return byoProviderBillingMessage(byoProviderName({ env, agent: opts.agent }));
-  }
-  if (replyIsAuthFailure(opts.finalText)) return AUTH_FAILURE_MESSAGE;
-  return null;
-}
-function houseAgentLimitMessage(text) {
-  if (/temporarily (?:unavailable|disabled)/i.test(text)) {
-    return "\u23F3 **Our agent service is temporarily unavailable \u2014 this one\u2019s on us, not your account.**\n\nThere\u2019s nothing to buy and nothing owed, and it isn\u2019t a problem with your login, so re-authenticating won\u2019t help. Send your message again in a bit, or connect your own agent (Claude Code, Codex, Cursor, Gemini) in **Profile \u203A Agents** to keep going now.";
-  }
-  const canUpgrade = /upgrade to pro/i.test(text);
-  return "\u{1F4CA} **You\u2019ve reached today\u2019s agent usage limit.**\n\nThe free agent has a daily usage ceiling that resets at midnight UTC. This is a usage limit, not a problem with your login \u2014 re-authenticating won\u2019t change it. " + (canUpgrade ? "To keep going now, upgrade to **Pro** for a higher ceiling, or connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit." : "To keep going now, connect your own agent (Claude, Codex, \u2026) in **Profile \u203A Agents** to run without this limit, or wait for the reset.");
-}
-var AUTH_FAILURE_MESSAGE = (
-  // ⚠️ Do NOT name a status code here. This bubble fires for several
-  // different failures, and the old hard-coded "(API 401)" told users the API
-  // had answered 401 when it never had — it also sent a live investigation
-  // hunting for 401s in proxy logs that were serving 200s throughout
-  // (2026-08-24). Say what happened, not a number we did not see.
-  "\u{1F512} **Authentication failed \u2014 your agent credentials are invalid or expired.**\n\nTap [Re-authenticate this agent](codeam://reauth) to renew your credentials in Profile \u203A Agents, then send your message again."
-);
-var CURSOR_UPGRADE_MESSAGE = "\u26A1 **Cursor needs a paid plan to run the agent.**\n\nThe headless Cursor Agent requires Cursor **Pro** \u2014 your Free plan\u2019s included usage does NOT cover Agent runs, even with quota left. This is your Cursor account (not CodeAgent). Upgrade, then send your message again:\n\n[Upgrade to Cursor Pro \u2192](https://cursor.com/dashboard)";
-var ONE_M_CREDITS_MESSAGE = "\u{1F504} **Reconnect your Claude subscription to continue.**\n\nClaude requested 1M-context but your account doesn\u2019t have the usage credits for it on this credential. Reconnecting refreshes your subscription so the agent can keep going \u2014 disabling 1M context won\u2019t fix a credits gate.\n\nTap [Reconnect this agent](codeam://reauth) to reconnect your Claude subscription in Profile \u203A Agents, then send your message again.";
-var TURN_FAILURE_MESSAGE = "\u26A0\uFE0F **The agent hit an error and couldn\u2019t finish this turn.** Please send your message again.";
-function emptyReplyMessage(agent) {
-  const label = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].displayName : agent;
-  const binary = isKnownAgentId(agent) ? AGENT_REGISTRY[agent].binaryName : agent;
-  return `\u26A0\uFE0F **${label} returned an empty reply.** Its provider may be having issues \u2014 check the agent's login/subscription on this machine (e.g. run \`${binary} -p "test"\` there).`;
-}
-var PROVIDER_OUTAGE_RE = /overloaded_error|\boverloaded\b|service[ _]unavailable|temporarily[ _]unavailable|(?:api error|http|status)[:\s]+(?:529|503|502|504)\b|\b(?:529|503|502|504)\b[^\n]{0,40}(?:overload|unavailable|gateway|upstream|server error)|bad gateway|gateway time-?out|upstream (?:error|connect|timeout)/i;
-function looksLikeProviderOutage(text) {
-  return PROVIDER_OUTAGE_RE.test(text);
-}
-function agentStatusPage(agent, railWireId) {
-  if (railWireId) return null;
-  const a = (agent ?? "").toLowerCase();
-  const id = a.includes("claude") || a.includes("anthropic") ? "claude" : a.includes("codex") || a.includes("openai") ? "codex" : a.includes("gemini") || a.includes("google") ? "gemini" : a.includes("copilot") ? "copilot" : a.includes("cursor") ? "cursor" : null;
-  return id ? agentHooks(id)?.statusPage ?? null : null;
-}
-function providerOutageMessage(agent, railWireId) {
-  if (railWireId) {
-    const who2 = isManagedProviderId(railWireId) ? `${MANAGED_PROVIDER_DISPLAY_NAMES[railWireId]} ` : "";
-    return `\u{1F310} **CodeAgent's agent service is having a disruption \u2014 this isn't your session.**
-
-Your ${who2}agent couldn't finish this turn because our provider returned an overload error. It usually clears up on its own \u2014 just send your message again in a bit.`;
-  }
-  const info = agentStatusPage(agent);
-  const who = info ? info.vendor : "The agent provider";
-  return `\u{1F310} **${who} is having a service disruption \u2014 this isn\u2019t your session.**
-
-The agent provider returned an overload/outage error, so this turn couldn\u2019t finish. It usually clears up on its own \u2014 just send your message again in a bit.` + (info ? `
-
-Follow the status here: [${info.url}](${info.url})` : "");
-}
-function startupFailureMessage(agent, detail, recentStderr, railWireId) {
-  const haystack2 = `${detail}
-${recentStderr}`;
-  if (agentHooks(agent)?.classifyStartupFailure?.(haystack2) === "ineligible_tier") {
-    return [
-      "\u26A0\uFE0F **Gemini couldn't start \u2014 your Google account isn't eligible.**",
-      "",
-      "Google discontinued free **\u201CLogin with Google\u201D** access to the Gemini CLI on 2026-06-18. The free / individual tier (and Google AI Pro/Ultra) can no longer authenticate here.",
-      "",
-      "To use Gemini from CodeAgent, re-link it in **Profile \u203A Agents** with either:",
-      "\u2022 a **Gemini API key** (AI Studio \u2014 free quota available), or",
-      "\u2022 a paid **Gemini Code Assist (Standard/Enterprise)** subscription."
-    ].join("\n");
-  }
-  if (looksLikeAuthFailure(haystack2)) return AUTH_FAILURE_MESSAGE;
-  if (looksLikeProviderOutage(haystack2)) return providerOutageMessage(agent, railWireId);
-  const tail = recentStderr.split("\n").filter(Boolean).slice(-3).join("\n");
-  return [`\u26A0\uFE0F The ${agent} agent failed to start.`, "", tail ? `Details:
-${tail}` : detail].join(
-    "\n"
-  );
-}
-function startupCredentialInvalidReason(agent, detail, recentStderr) {
-  const haystack2 = `${detail}
-${recentStderr}`;
-  return agentHooks(agent)?.classifyStartupFailure?.(haystack2) === "ineligible_tier" ? "ineligible_tier" : null;
-}
-function failureBubble(opts) {
-  const env = opts.env ?? process.env;
-  if (looksLikeHouseAgentLimit(opts.detail) || looksLikeHouseAgentLimit(opts.recentStderr)) {
-    return houseAgentLimitMessage(`${opts.detail}
-${opts.recentStderr}`);
-  }
-  if (looksLikeByoProviderBilling(opts.detail, env) || looksLikeByoProviderBilling(opts.recentStderr, env)) {
-    return byoProviderBillingMessage(byoProviderName({ env, agent: opts.agent }));
-  }
-  if (looksLikeAuthFailure(opts.detail) || looksLikeAuthFailure(opts.recentStderr)) {
-    return AUTH_FAILURE_MESSAGE;
-  }
-  if (looksLike1mContextCreditsError(opts.detail) || looksLike1mContextCreditsError(opts.recentStderr)) {
-    return ONE_M_CREDITS_MESSAGE;
-  }
-  if (looksLikeProviderOutage(opts.detail) || looksLikeProviderOutage(opts.recentStderr)) {
-    return providerOutageMessage(opts.agent, opts.railWireId);
-  }
-  if (!opts.hadText) return TURN_FAILURE_MESSAGE;
-  return null;
-}
-var WINDOWS_CONTROL_C_EXIT = 3221225786;
-function adapterExitMessage(opts) {
-  if (opts.code === WINDOWS_CONTROL_C_EXIT) return null;
-  if (opts.signal === "SIGINT") return null;
-  if (opts.authFail) return AUTH_FAILURE_MESSAGE;
-  if (opts.outageFail) return providerOutageMessage(opts.agent, opts.railWireId);
-  return `Agent adapter exited unexpectedly (code=${opts.code ?? "null"} signal=${opts.signal ?? "null"}).`;
-}
-
 // src/agents/acp/backend-reports.ts
 async function reportCredentialInvalid(opts, fetchImpl = fetch) {
   const url2 = `${resolveApiBaseUrl()}/api/plugin/agents/${encodeURIComponent(opts.agent)}/credential-invalid`;
@@ -48963,7 +48984,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current2 = true ? "2.75.45" : null;
+  const current2 = true ? "2.75.46" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -48980,7 +49001,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current2 = true ? "2.75.45" : null;
+  const current2 = true ? "2.75.46" : null;
   if (!current2) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -49003,7 +49024,7 @@ var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 var SELF_UPDATE_LS_TIMEOUT_MS = 15e3;
 var SUDO_PREFLIGHT_TIMEOUT_MS = 5e3;
 function currentCliVersion() {
-  return true ? "2.75.45" : null;
+  return true ? "2.75.46" : null;
 }
 async function installedVersion(deps) {
   const ls = await deps.run(
@@ -51058,7 +51079,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.75.45" : "0.0.0-dev";
+  const cliVersion = true ? "2.75.46" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -51582,7 +51603,7 @@ async function mcpWarm(argv = [], opts = {}) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.75.45" : "unknown";
+  const v = true ? "2.75.46" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }