codeden 0.2.0 → 0.3.0

package/dist/{runner-CJetH9jW.js → runner-DGomZl80.js}

@@ -8,7 +8,7 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypt
 import { execFile, spawn } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 import { createInterface } from "node:readline";
-import { copyFile, mkdir, readFile, rm, rmdir, stat, utimes, writeFile } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, utimes, writeFile } from "node:fs/promises";
 import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants as constants$1 } from "node:http2";
 import { Readable } from "node:stream";
@@ -6004,12 +6004,16 @@ const Role = _enum([
 	"agent"
 ]);
 /**
-* Autonomy levels (§11.2), mapped onto each provider's native enforcement.
+* Permission levels of an agent session (§11.2), mapped onto each provider's native enforcement.
+* Shown in the UI as "Permissions"; stored as `autonomy`.
+* - `read_only`: reads and runs checks, but never edits files, commits or pushes. Needs a
+*   provider with `ProviderCapabilities.readOnly`.
 * - `supervised`: every edit and command asks.
 * - `auto`: edits and normal commands in the worktree run freely; risky actions ask (default).
 * - `full`: no approvals inside the worktree.
 */
 const AutonomyLevel = _enum([
+	"read_only",
 	"supervised",
 	"auto",
 	"full"
@@ -6284,11 +6288,47 @@ const Attachment = discriminatedUnion("type", [object({
 	name: string().optional(),
 	mediaType: string().optional()
 })]);
+/**
+* Who sent a message to a session: the user, the orchestrator (to a PM), a PM (to its
+* sessions), an automation, or CodeDen itself (automatic wake-ups, the factory loop).
+*/
+const MessageSender = _enum([
+	"user",
+	"orchestrator",
+	"pm",
+	"automation",
+	"codeden"
+]);
 /** Input that starts or steers a turn: text plus optional image/file attachments. */
 const UserInput = object({
 	text: string(),
-	attachments: array(Attachment).default([])
+	attachments: array(Attachment).default([]),
+	/**
+	* Who wrote the message, when it was not the user: recorded so the transcript can show the
+	* sender without reading the text. Absent on the user's own messages and on every message
+	* stored before senders were recorded.
+	*/
+	from: MessageSender.optional()
 });
+/**
+* The first line of a message from a PM or the orchestrator, telling the agent who wrote it.
+* The only definition of these words: the server writes them, the UI recognises them.
+*/
+const SENDER_LINES = {
+	pm: "Message from your project manager:",
+	orchestrator: "Message from the orchestrator:"
+};
+/**
+* Input for a message from a PM or the orchestrator: the sender is recorded in `from` and
+* named for the agent in the text's first line (`SENDER_LINES`).
+*/
+function messageFrom(from, text) {
+	return {
+		text: `${SENDER_LINES[from]}\n${text}`,
+		attachments: [],
+		from
+	};
+}
 const itemBase = {
 	/** Unique within the session. */
 	id: Id,
@@ -6813,6 +6853,18 @@ const FactoryLoopState = _enum([
 	"stopped"
 ]);
 // ../../packages/contracts/src/entities/project.ts
+/**
+* Something re-detecting a project's folder found that CodeDen does not apply on its own (§9).
+* `github_remote_missing`: a `github` project's folder no longer has a GitHub `origin` (removed,
+* pointing at another host, or no git checkout at all). The project keeps its GitHub
+* coordinates until the user restores the remote or disconnects GitHub.
+*/
+const ProjectRemoteWarning = object({
+	code: literal("github_remote_missing"),
+	/** What `origin` points at now, credentials removed; null when there is no `origin`. */
+	remoteUrl: string().nullable(),
+	detectedAt: Timestamp
+});
 const projectBase = {
 	id: Id,
 	name: string().min(1),
@@ -6845,6 +6897,12 @@ const projectBase = {
 	* `projects.reordered`; archived projects keep theirs.
 	*/
 	sortOrder: int().nonnegative().default(0),
+	/**
+	* Set when re-detection found the folder's git remote out of step with the project (see
+	* `ProjectRemoteWarning`); absent when all is well. Cleared by the next detection that finds
+	* the GitHub remote again, or by disconnecting GitHub.
+	*/
+	remoteWarning: ProjectRemoteWarning.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	archivedAt: Timestamp.nullable()
@@ -6859,6 +6917,9 @@ const GitHubRepo = object({
 /**
 * A project. `github` projects get the full issue/PR/evidence flow; `local` projects
 * (no GitHub remote) get sessions, worktrees, checkpoints, diffs and automations only (§9).
+* The kind is detected when the project is added and again later (on server start, after
+* agent turns in local projects, on demand): a folder that gains a GitHub `origin` becomes a
+* `github` project. Losing the remote never downgrades a project on its own.
 */
 const Project = discriminatedUnion("kind", [object({
 	...projectBase,
@@ -7044,7 +7105,13 @@ const ProviderCapabilities = object({
 	* An autonomy change reaches a running turn from its next tool call. When false (or absent),
 	* a running turn keeps its autonomy and the change applies from the next turn.
 	*/
-	liveAutonomy: boolean().optional()
+	liveAutonomy: boolean().optional(),
+	/**
+	* The `read_only` permission level is enforced natively: no file edits, no writing shell
+	* commands, no commits or pushes (§11.2). When false (or absent), sessions on this provider
+	* cannot use `read_only`.
+	*/
+	readOnly: boolean().optional()
 });
 /** A model a provider offers. */
 const ModelInfo = object({
@@ -7703,7 +7770,11 @@ const RunnerCommandResults = {
 			ok: boolean()
 		})).optional()
 	}),
-	"workspace.remove": object({ removed: boolean() }),
+	"workspace.remove": object({
+		removed: boolean(),
+		/** A forced removal deleted uncommitted changes (absent from older runners). */
+		discardedChanges: boolean().optional()
+	}),
 	"session.start": object({ resumeToken: string().nullable() }),
 	"session.send": Empty,
 	"session.steer": Empty,
@@ -7813,13 +7884,7 @@ const QueuedMessage = object({
 	sessionId: Id,
 	input: UserInput,
 	/** Who queued it. Events written before senders were recorded were all the user's. */
-	from: _enum([
-		"user",
-		"orchestrator",
-		"pm",
-		"automation",
-		"codeden"
-	]).default("user"),
+	from: MessageSender.default("user"),
 	createdAt: Timestamp
 });
 object({ messages: array(QueuedMessage) });
@@ -8171,6 +8236,12 @@ const AutomationGuards = object({
 	/** Run once for missed schedules after downtime. */
 	catchUpMissed: boolean().default(false)
 });
+/** Who created a database automation (§10). */
+const AutomationCreator = _enum([
+	"user",
+	"pm",
+	"import"
+]);
 /** An automation: trigger + action + target + guards. Off by default. */
 const Automation = object({
 	id: Id,
@@ -8196,6 +8267,11 @@ const Automation = object({
 	* `automation:<template id or name slug>`.
 	*/
 	workKey: string().min(1).max(200).optional(),
+	/**
+	* Who created a database automation: the user in the UI (`user`, the default when absent),
+	* a PM through `create_automation` (`pm`), or an import of shared files (`import`).
+	*/
+	createdBy: AutomationCreator.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp
 });
@@ -9625,7 +9701,7 @@ const Settings = object({
 	/** Stops every project's factory loop and all factory sessions. */
 killSwitch: boolean().default(false) }).prefault({}),
 	/**
-	* Worktree cleanup (§9). Archiving a session always removes its worktree; with `cleanup` on,
+	* Worktree cleanup (§9). Archiving a session removes its worktree (unless it has uncommitted changes and isn't forced); with `cleanup` on,
 	* worktrees of sessions inactive for `afterDays` are removed too, unless the session's pull
 	* request is still open or the worktree has uncommitted changes.
 	*/
@@ -9928,20 +10004,22 @@ const CreateProjectRequest = object({
 	defaultProvider: ProviderId.nullable().optional(),
 	autonomy: AutonomyLevel.nullable().optional()
 });
+/** What CodeDen found in a project folder. */
+const ProjectDetection = object({
+	isGitRepo: boolean(),
+	/** Top level of the git checkout (may differ from the chosen folder). */
+	gitRoot: string().nullable(),
+	remoteUrl: string().nullable(),
+	github: GitHubRepo.nullable(),
+	defaultBranch: string().nullable(),
+	currentBranch: string().nullable(),
+	packageManager: PackageManager.nullable(),
+	/** Suggested worktree setup commands, e.g. `pnpm install`. */
+	suggestedSetupCommands: array(string())
+});
 object({
 	project: Project,
-	detected: object({
-		isGitRepo: boolean(),
-		/** Top level of the git checkout (may differ from the chosen folder). */
-		gitRoot: string().nullable(),
-		remoteUrl: string().nullable(),
-		github: GitHubRepo.nullable(),
-		defaultBranch: string().nullable(),
-		currentBranch: string().nullable(),
-		packageManager: PackageManager.nullable(),
-		/** Suggested worktree setup commands, e.g. `pnpm install`. */
-		suggestedSetupCommands: array(string())
-	})
+	detected: ProjectDetection
 });
 /** `PATCH /api/projects/:id`. */
 const UpdateProjectRequest = object({
@@ -10540,6 +10618,97 @@ object({
 	/** The session start when accepted (possibly `conflict`); null when declined. */
 	start: StartSessionResponse.nullable()
 });
+// ../../packages/contracts/src/automations-sharing.ts
+/**
+* Sharing automations (§10): duplicate, export as the Markdown + YAML frontmatter file format
+* (one `.md`, or all of a project's as a `.zip`), and import those files back. Imports are
+* parsed with the same parser and validation as automation files, never run anything and
+* always start off.
+*/
+/** Size limits for an import, checked by the server before anything is parsed. */
+const AUTOMATION_IMPORT_LIMITS = {
+	/** Automation files in one import (Markdown files, zip entries or pasted text). */
+	maxFiles: 50,
+	/** One file's text, in UTF-16 code units (about bytes for ASCII). */
+	maxFileChars: 131072,
+	/** All files together, after unzipping. */
+	maxTotalChars: 1048576,
+	/** A zip as uploaded, before base64 (base64 makes it about a third bigger). */
+	maxZipBytes: 1048576,
+	/** Entries a zip may list, `.md` or not (more is refused before inflating anything). */
+	maxZipEntries: 200
+};
+/** What to import: Markdown files, a zip of them (base64) and/or pasted Markdown. */
+const AutomationImportSource = object({
+	files: array(object({
+		/** File name, e.g. `release-notes.md`; its stem becomes the default work key. */
+		name: string().trim().min(1).max(255),
+		content: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars)
+	})).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional(),
+	/** A `.zip` of `.md` files, base64-encoded. Other entries are ignored. */
+	zipBase64: string().max(Math.ceil(AUTOMATION_IMPORT_LIMITS.maxZipBytes / 3) * 4 + 4).optional(),
+	/** One automation pasted as text. */
+	text: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars).optional()
+}).refine((s) => Boolean(s.files?.length || s.zipBase64 || s.text?.trim()), { message: "Pass files, a zip or pasted text" });
+/** The definition an import would create (no id, target or switch yet). */
+const AutomationDraft = object({
+	name: string().min(1),
+	description: string().nullable(),
+	trigger: AutomationTrigger,
+	action: AutomationAction,
+	guards: AutomationGuards,
+	workKey: string().min(1).max(200)
+});
+object({ items: array(object({
+	/** File name, unique within the import (duplicates get ` (2)`). */
+	fileName: string(),
+	/** Null when the file is invalid. */
+	automation: AutomationDraft.nullable(),
+	/** Validation error (bad YAML, unknown fields, invalid cron, ...); null when importable. */
+	error: string().nullable(),
+	/** Runs with Full permissions: it never asks before acting. */
+	fullPermissions: boolean()
+})) });
+/**
+* `POST /api/automations/import`: re-parse the same source and create the selected files as
+* database automations, always off. `projectId` targets one project; omitted, all projects.
+*/
+const ImportAutomationsRequest = object({
+	source: AutomationImportSource,
+	projectId: Id.optional(),
+	/** File names (from the preview) to import; omitted, every valid file. */
+	select: array(string()).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional()
+});
+object({
+	/** The new automations, all off. */
+	created: array(AutomationListItem),
+	/** Selected files that could not be imported, with the reason. */
+	failed: array(object({
+		fileName: string(),
+		error: string()
+	}))
+});
+object({
+	/** `<slug>.md`. */
+	fileName: string().min(1),
+	markdown: string()
+});
+/** `GET /api/automations/export?projectId=`: the query; without a project, every automation. */
+const ExportAutomationsQuery = object({ projectId: Id.optional() });
+object({
+	fileName: string().min(1),
+	/** The zip, base64-encoded. */
+	zipBase64: string(),
+	count: int().nonnegative()
+});
+/**
+* `POST /api/automations/:id/duplicate`: an editable copy (also of file-based and built-in
+* automations), off. `projectId` targets one project; omitted, the original's target.
+*/
+const DuplicateAutomationRequest = object({
+	projectId: Id.optional(),
+	name: string().trim().min(1).max(200).optional()
+});
 // ../../packages/contracts/src/browser-api.ts
 /**
 * Browser panel HTTP and WebSocket shapes (§12.2). Routes live under
@@ -10911,6 +11080,25 @@ object({
 		message: string().nullable()
 	})
 });
+object({
+	/** The project after the check (unchanged unless `changed`). */
+	project: Project,
+	outcome: _enum([
+		"unchanged",
+		"git_detected",
+		"github_connected",
+		"github_changed",
+		"github_remote_missing",
+		"folder_missing"
+	]),
+	/** True when the check updated the project (a `project.updated` event was appended). */
+	changed: boolean(),
+	/** One line for the UI, e.g. "Connected to octo/app" or "Still no GitHub remote on origin". */
+	message: string(),
+	/** What was found in the folder; null when the folder is missing. */
+	detected: ProjectDetection.nullable()
+});
+object({ project: Project });
 // ../../packages/contracts/src/runner/events.ts
 /**
 * Durable runner -> server events. Journaled by the runner and delivered with a `seq`
@@ -11439,7 +11627,7 @@ object({
 * rest of the bundle, so the package version is the single source of truth at runtime;
 * everywhere else (workspace, tests) it is `SOURCE_VERSION`.
 */
-const CODEDEN_VERSION = packageVersion() ?? "0.2.0";
+const CODEDEN_VERSION = packageVersion() ?? "0.3.0";
 function packageVersion() {
 	const value = globalThis.__CODEDEN_PACKAGE_VERSION__;
 	return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -15593,9 +15781,11 @@ function explicitModel(model) {
 }
 // ../../packages/providers/src/policy/read-only.ts
 /**
-* Read-only sessions (the orchestrator and PMs, §11.2) may inspect a repository but never
-* change it. This allowlist decides which shell commands they may run: commands that only
-* read, with no output redirection and no command substitution. Anything else is denied.
+* Read-only sessions (the orchestrator and PMs, and agent sessions with the `read_only`
+* permission level, §11.2) may inspect a repository but never change it. This allowlist decides
+* which shell commands they may run: commands that only read, with no output redirection and no
+* command substitution. Agent sessions may also run the project's checks (tests, lint, type
+* checks) without fix or update flags. Anything else is denied.
 */
 /**
 * Split on every `;`, `&&`, `||`, `|` and newline, even inside quotes. Deliberately cruder
@@ -15705,8 +15895,75 @@ const READ_ONLY_GH = /* @__PURE__ */ new Set([
 	"checks"
 ]);
 const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
+/** Package managers whose `test`, `lint`, ... scripts count as checks. */
+const PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+/** Script names a package manager may run as a check (`pnpm test`, `npm run lint`). */
+const CHECK_SCRIPTS = /* @__PURE__ */ new Set([
+	"test",
+	"tests",
+	"lint",
+	"typecheck",
+	"type-check",
+	"check",
+	"types",
+	"vitest",
+	"jest",
+	"biome",
+	"eslint",
+	"tsc"
+]);
+/** Programs (null: any arguments) and `<program> <subcommand>` pairs that run checks. */
+const CHECK_COMMANDS = {
+	tsc: null,
+	vitest: null,
+	jest: null,
+	eslint: null,
+	pytest: null,
+	mypy: null,
+	pyright: null,
+	biome: [
+		"check",
+		"lint",
+		"ci"
+	],
+	ruff: ["check"],
+	cargo: [
+		"test",
+		"check",
+		"clippy"
+	],
+	go: ["test", "vet"],
+	dotnet: ["test"],
+	mvn: ["test", "verify"],
+	gradle: ["test", "check"]
+};
+/** Flags that turn a check into a write (fixing, formatting, updating snapshots, watching). */
+const WRITING_FLAG = /^(--fix|--fix-type=.*|--write|--apply|--apply-unsafe|--unsafe|-u|--update|--update-snapshots?|--updatesnapshot|--watch|-w)(=.*)?$/;
+/** True when `name args` runs a known check without writing flags. */
+function isCheck(name, args) {
+	if (args.some((a) => WRITING_FLAG.test(a))) return false;
+	const positional = args.filter((a) => !a.startsWith("-"));
+	if (PACKAGE_MANAGERS.has(name)) {
+		const script = positional[0] === "run" ? positional[1] : positional[0];
+		return script !== void 0 && CHECK_SCRIPTS.has(script);
+	}
+	if (name === "npx" || name === "pnpx" || name === "bunx") {
+		const tool = positional[0];
+		return tool !== void 0 && isCheck(bin(tool), args.slice(args.indexOf(tool) + 1));
+	}
+	if (name === "python" || name === "python3" || name === "py") return args[0] === "-m" && (args[1] === "pytest" || args[1] === "mypy");
+	if (!Object.hasOwn(CHECK_COMMANDS, name)) return false;
+	const subs = CHECK_COMMANDS[name];
+	if (!subs) return true;
+	return positional[0] !== void 0 && subs.includes(positional[0]);
+}
 /** Why a command is refused in a read-only session, or undefined when it may run. */
-function readOnlyCommandDenial(command) {
+function readOnlyCommandDenial(command, options = {}) {
 	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
 	for (const simple of splitCommands(command)) {
 		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
@@ -15725,6 +15982,7 @@ function readOnlyCommandDenial(command) {
 			continue;
 		}
 		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
+		if (options.allowChecks && isCheck(name, args)) continue;
 		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
 	}
 }
@@ -15866,7 +16124,7 @@ function tempRootsFrom(candidates, platform, home) {
 	}
 	return out;
 }
-const realpath = (p) => {
+const realpath$1 = (p) => {
 	try {
 		return realpathSync.native(p);
 	} catch {
@@ -15883,7 +16141,7 @@ function osTempRoots(platform = process.platform) {
 	if (platform !== process.platform) return [];
 	if (cachedTempRoots) return cachedTempRoots;
 	const env = process.env;
-	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath(c)] : []), platform, os.homedir());
+	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath$1(c)] : []), platform, os.homedir());
 	return cachedTempRoots;
 }
 const SECRET_BASENAMES = /* @__PURE__ */ new Set([
@@ -16739,6 +16997,8 @@ function approvalTitle(name, input) {
 // ../../packages/providers/src/claude/permissions.ts
 /**
 * Native permission mode per autonomy level (§11.2):
+* - read_only  -> `default`; edits and writing commands are denied by the PreToolUse hook
+*                 (`ClaudePolicy.denial`), so they never reach a prompt
 * - supervised -> `default`, and every edit/command is forced to ask via a PreToolUse hook
 * - auto       -> `acceptEdits`, plus the risky-action classifier
 * - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
@@ -16747,7 +17007,7 @@ function approvalTitle(name, input) {
 */
 function permissionModeFor(autonomy, planMode) {
 	if (planMode) return "plan";
-	if (autonomy === "supervised") return "default";
+	if (autonomy === "read_only" || autonomy === "supervised") return "default";
 	if (autonomy === "auto") return "acceptEdits";
 	return "bypassPermissions";
 }
@@ -16769,16 +17029,23 @@ var ClaudePolicy = class {
 	get level() {
 		return this.autonomy;
 	}
+	/**
+	* True while edits and writing commands are refused: a read-only role (orchestrator, PMs),
+	* or the `read_only` permission level, which can change live with `setAutonomy`.
+	*/
+	get isReadOnly() {
+		return this.readOnly || this.autonomy === "read_only";
+	}
 	/** Switch the level; the next `gate()` uses it. `allow_session` decisions are kept. */
 	setAutonomy(level) {
 		this.autonomy = level;
 	}
 	/** Why a call is refused outright (read-only sessions), or undefined. */
 	denial(toolName, input) {
-		if (!this.readOnly) return void 0;
-		if (EDIT_TOOLS.has(toolName)) return "This session is read-only: it cannot edit files. Act through CodeDen tools instead.";
+		if (!this.isReadOnly) return void 0;
+		if (EDIT_TOOLS.has(toolName)) return this.readOnly ? "This session is read-only: it cannot edit files. Act through CodeDen tools instead." : "This session has read-only permissions: it cannot edit files, commit or push. Report what you found instead.";
 		if (COMMAND_TOOLS.has(toolName)) {
-			const reason = readOnlyCommandDenial(str(input, "command") ?? "");
+			const reason = readOnlyCommandDenial(str(input, "command") ?? "", { allowChecks: !this.readOnly });
 			return reason ? `This session is read-only: ${reason}.` : void 0;
 		}
 	}
@@ -18649,7 +18916,8 @@ const capabilities$2 = {
 	reasoningEffort: true,
 	mcp: true,
 	skills: true,
-	liveAutonomy: true
+	liveAutonomy: true,
+	readOnly: true
 };
 const EFFORTS = [
 	"low",
@@ -19302,6 +19570,7 @@ async function handleServerRequest(req, ac) {
 // ../../packages/providers/src/codex/config.ts
 /**
 * Native sandbox + approval policy per autonomy level (§11.2):
+* - read_only  -> read-only sandbox + `never`: writes fail instead of asking, no network
 * - supervised -> `untrusted`: every command that isn't known-safe and every patch asks
 * - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes (to the
 *                 worktree, extra roots and the OS temp directory) and network; escaping it
@@ -19310,7 +19579,7 @@ async function handleServerRequest(req, ac) {
 *                 to the worktree, extra roots and temp
 */
 function codexPolicy(autonomy, readOnly = false) {
-	if (readOnly) return {
+	if (readOnly || autonomy === "read_only") return {
 		approvalPolicy: "never",
 		sandbox: "read-only",
 		networkAccess: false
@@ -19337,7 +19606,7 @@ function codexPolicy(autonomy, readOnly = false) {
 * never needs an approval (§11.2).
 */
 function codexWritableRoots(opts, tempRoots = osTempRoots()) {
-	const temp = opts.readOnly || opts.autonomy === "supervised" ? [] : tempRoots;
+	const temp = opts.readOnly || opts.autonomy === "read_only" || opts.autonomy === "supervised" ? [] : tempRoots;
 	return [.../* @__PURE__ */ new Set([...opts.additionalDirectories, ...temp])];
 }
 /**
@@ -20309,7 +20578,8 @@ const capabilities$1 = {
 	reasoningEffort: true,
 	mcp: true,
 	skills: true,
-	liveAutonomy: false
+	liveAutonomy: false,
+	readOnly: true
 };
 const CONFIGURED_MODEL = "The model configured in ~/.codex/config.toml";
 /**
@@ -20582,7 +20852,8 @@ var FakeSession = class {
 			await this.streamAssistant(turn, threadId, this.replyFor(prompt));
 			await this.todoList(turn);
 			if (prompt.includes("[mcp]")) await this.mcpToolCall(turn);
-			if ((this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) await this.commandToolCall(turn);
+			const readOnly = this.autonomy === "read_only";
+			if ((!readOnly && (this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) && !readOnly) await this.commandToolCall(turn);
 			if (this.fake.subagent || prompt.includes("[subagent]")) await this.subagent(turn);
 			if (this.fake.followups ?? true) {
 				await this.step(turn);
@@ -20975,7 +21246,8 @@ const capabilities = {
 	reasoningEffort: false,
 	mcp: false,
 	skills: false,
-	liveAutonomy: true
+	liveAutonomy: true,
+	readOnly: true
 };
 /**
 * Deterministic scripted provider for demos and tests (§7.2). Every turn streams:
@@ -26296,6 +26568,303 @@ async function listPorts(probe = []) {
 		url: `http://localhost:${port}`
 	}));
 }
+// ../runner/src/util/paths.ts
+/** True when `child` is `dir` itself or somewhere inside it. */
+function isInside(dir, child) {
+	const rel = relative(resolve(dir), resolve(child));
+	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
+}
+// ../runner/src/workspace/delete-tree.ts
+/** Error codes Windows returns while another process still holds a file or folder open. */
+const IN_USE = /* @__PURE__ */ new Set([
+	"EBUSY",
+	"EPERM",
+	"EACCES",
+	"ENOTEMPTY"
+]);
+const errorCode = (error) => error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+/** Run `op`, retrying briefly (about 1.5s for 5 attempts) while the path is in use. */
+async function retry(op, attempts = 5) {
+	for (let attempt = 1;; attempt++) try {
+		await op();
+		return;
+	} catch (error) {
+		const code = errorCode(error);
+		if (code === "ENOENT") return;
+		if (!code || !IN_USE.has(code) || attempt >= attempts) throw error;
+		await new Promise((r) => setTimeout(r, 100 * attempt));
+	}
+}
+/** Delete a file or link (never what a link points at); clears the read-only flag if needed. */
+function removeFile(path) {
+	return retry(async () => {
+		try {
+			await unlink(path);
+		} catch (error) {
+			if (errorCode(error) !== "EPERM" && errorCode(error) !== "EACCES") throw error;
+			await chmod(path, 438).catch(() => void 0);
+			await unlink(path);
+		}
+	});
+}
+async function kind(path, entry) {
+	if (entry.isSymbolicLink()) return "other";
+	if (entry.isDirectory()) return "dir";
+	if (entry.isFile()) return "other";
+	const stat = await lstat(path).catch(() => void 0);
+	return stat?.isDirectory() && !stat.isSymbolicLink() ? "dir" : "other";
+}
+/**
+* Empty `dir`: files and links are unlinked, real folders are emptied and removed. A symlink
+* or junction is never descended into (Windows reports junctions as links), so nothing
+* outside the tree is touched. Every branch is finished before the first failure is thrown.
+*/
+async function emptyDir(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return;
+		throw error;
+	}
+	const failed = (await Promise.allSettled(entries.map(async (entry) => {
+		const path = join(dir, entry.name);
+		if (await kind(path, entry) !== "dir") return removeFile(path);
+		await emptyDir(path);
+		await retry(() => rmdir(path));
+	}))).find((r) => r.status === "rejected");
+	if (failed) throw failed.reason;
+}
+/** A short, user-facing error for a failed delete or move of the worktree folder `root`. */
+function deleteFailed(root, error) {
+	const file = error && typeof error === "object" && "path" in error ? String(error.path) : root;
+	const where = relative(root, file);
+	const code = errorCode(error);
+	if (code && IN_USE.has(code)) return new CommandError("worktree_in_use", `${where ? `A file in the worktree is in use (${where})` : "The worktree is in use"}. Close whatever is using it (a terminal, dev server or editor), then try again.`);
+	const reason = error instanceof Error ? error.message : String(error);
+	return new CommandError("remove_failed", `Could not delete ${where || root}: ${reason}`);
+}
+/**
+* Delete a worktree folder without ever following a symlink or junction out of it.
+*
+* `git worktree remove` can't be trusted with this on Windows: Git treats junctions as
+* folders, so it deletes the contents of whatever a live junction points at, and it stops at
+* a dangling one with "Directory not empty". In a pnpm install the packages are deleted before
+* the junctions that point at them, so it fails halfway, after removing `.git`. Node's
+* recursive `rm` is no better here: on Windows it waits for as long as a file stays locked.
+*
+* `.git` goes first, so a delete that a locked file interrupts leaves an orphan folder the
+* next attempt cleans up (never a damaged worktree that looks dirty). Each locked entry is
+* retried for about 1.5s, then this throws `worktree_in_use`.
+*/
+async function deleteTree(root) {
+	try {
+		const stat = await lstat(root).catch(() => void 0);
+		if (!stat) return;
+		if (stat.isSymbolicLink() || !stat.isDirectory()) return await removeFile(root);
+		await removeFile(join(root, ".git"));
+		await emptyDir(root);
+		await retry(() => rmdir(root));
+	} catch (error) {
+		throw deleteFailed(root, error);
+	}
+}
+// ../runner/src/workspace/trash.ts
+/**
+* True for a session folder CodeDen created and owns: exactly `<home>/wt/<project>/<session>`.
+* Only these may be deleted once they are no longer git worktrees.
+*/
+function isManagedWorktreePath(home, path) {
+	const rel = relative(resolve(home, "wt"), resolve(path));
+	if (!rel || isAbsolute(rel)) return false;
+	const parts = rel.split(/[\\/]+/);
+	return parts.length === 2 && !parts.includes("..") && !parts.includes(".") && parts[0] !== ".trash";
+}
+/** Where removed worktrees wait to be deleted. `.trash` can never be a project slug. */
+function trashDir(home) {
+	return join(resolve(home), "wt", ".trash");
+}
+/**
+* Move a session folder into the trash. A rename is all or nothing: while anything in the
+* folder is held open (a process's working directory, an open file), Windows refuses it and
+* the folder stays exactly as it was (`worktree_in_use`). Returns null when the trash is on
+* another volume.
+*/
+async function moveToTrash(home, path) {
+	const trash = trashDir(home);
+	await mkdir(trash, { recursive: true });
+	const stamp = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+	const dest = join(trash, `${basename(dirname(path))}-${basename(path)}-${stamp}`);
+	try {
+		await retry(() => rename(path, dest), 8);
+		return dest;
+	} catch (error) {
+		if (errorCode(error) === "EXDEV") return null;
+		throw deleteFailed(path, error);
+	}
+}
+const runs = /* @__PURE__ */ new Map();
+/**
+* Delete everything in the trash, one folder at a time, never following a link (the links in
+* a trashed pnpm install still point at the old path, where a new worktree may live by now).
+* Runs in the background after each removal and when the runner starts; a folder something
+* still holds open stays for the next run. Calls during a run share it and add one more pass.
+*/
+function emptyTrash(home, log) {
+	const trash = trashDir(home);
+	const current = runs.get(trash);
+	if (current) {
+		current.again = true;
+		return current.done;
+	}
+	const run = {
+		again: true,
+		done: Promise.resolve()
+	};
+	run.done = (async () => {
+		try {
+			while (run.again) {
+				run.again = false;
+				const entries = await readdir(trash).catch(() => []);
+				for (const name of entries) await deleteTree(join(trash, name)).catch((error) => log?.(`worktree trash: ${error instanceof Error ? error.message : String(error)}`));
+			}
+		} finally {
+			runs.delete(trash);
+		}
+	})();
+	runs.set(trash, run);
+	return run.done;
+}
+/**
+* Delete a worktree folder that has been cleared for removal. A session folder under
+* `<home>/wt` goes to the trash, so the removal is instant and the path is free right away,
+* and is deleted in the background. Anything else is deleted in place.
+*/
+async function discardFolder(home, path, log) {
+	if (isManagedWorktreePath(home, path) ? await moveToTrash(home, path) : null) emptyTrash(home, log);
+	else await deleteTree(path);
+}
+// ../runner/src/workspace/removal.ts
+async function canonical(path) {
+	const real = await realpath(path).catch(() => resolve(path));
+	return process.platform === "win32" ? real.toLowerCase() : real;
+}
+async function listWorktrees(repo) {
+	const out = await gitText(repo, [
+		"worktree",
+		"list",
+		"--porcelain"
+	]).catch(() => "");
+	const list = [];
+	for (const block of out.split(/\r?\n\r?\n/)) {
+		const lines = block.split(/\r?\n/);
+		if (!lines[0]?.startsWith("worktree ")) continue;
+		const locked = lines.some((l) => l === "locked" || l.startsWith("locked "));
+		list.push({
+			path: lines[0].slice(9),
+			locked
+		});
+	}
+	return list;
+}
+/** Classify `path` against the worktrees of `repo` (see `WorktreeState`). */
+async function worktreeState(repo, path) {
+	const target = await canonical(path);
+	let registered = false;
+	let locked = false;
+	let containsOther = false;
+	for (const wt of await listWorktrees(repo)) {
+		const other = await canonical(wt.path);
+		if (other === target) {
+			registered = true;
+			locked = wt.locked;
+		} else if (isInside(target, other)) containsOther = true;
+	}
+	if (isInside(target, await canonical(repo))) containsOther = true;
+	const info = {
+		registered,
+		locked,
+		containsOther
+	};
+	const stat = await lstat(path).catch(() => void 0);
+	if (!stat) return {
+		state: "missing",
+		...info
+	};
+	if (stat.isSymbolicLink() || !stat.isDirectory()) return {
+		state: "orphan",
+		...info
+	};
+	const dotGit = await lstat(resolve(path, ".git")).catch(() => void 0);
+	if (!dotGit) return {
+		state: "orphan",
+		...info
+	};
+	return {
+		state: dotGit.isFile() && registered ? "registered" : "foreign",
+		...info
+	};
+}
+/** Whether a registered worktree has uncommitted changes (ignored files don't count). */
+async function isDirty(path) {
+	return (await git(path, ["status", "--porcelain"])).stdout.toString("utf8").trim() !== "";
+}
+/**
+* Decide whether `workspace.remove` may delete the path, before anything is touched (terminals
+* and processes in it are stopped only after this passes). Refuses (`not_a_worktree`) anything
+* that isn't a linked worktree of the repository, unless it is an orphan inside CodeDen's
+* worktree folder, and anything containing the repository or another worktree. Unless forced,
+* keeps a locked worktree (`worktree_locked`) or one with uncommitted changes
+* (`worktree_dirty`); ignored files (build output, `node_modules`) don't count.
+*/
+async function assertRemovable(cmd, home) {
+	const path = resolve(cmd.path);
+	const info = await worktreeState(cmd.repoPath, path);
+	const leftAlone = (why) => new CommandError("not_a_worktree", `${path} ${why}, so it was left alone`);
+	if (info.state === "missing") return info;
+	if (info.containsOther) throw leftAlone("contains the repository or another worktree");
+	if (info.state === "foreign") throw leftAlone("is not a worktree of this repository");
+	if (info.state === "orphan" && !isManagedWorktreePath(home, path)) throw leftAlone("is no longer a git worktree and is outside CodeDen's worktree folder");
+	if (info.state !== "registered" || cmd.force) return info;
+	if (info.locked) throw new CommandError("worktree_locked", `${path} is locked; unlock it or remove it with force`);
+	if (await isDirty(path)) throw new CommandError("worktree_dirty", `${path} has uncommitted changes; commit them or remove it with force`);
+	return info;
+}
+/** Drop git's records of worktrees whose folders are gone. */
+async function pruneWorktrees(repo) {
+	await git(repo, ["worktree", "prune"]).catch(() => void 0);
+}
+/**
+* `workspace.remove`: delete a session worktree and git's record of it. Idempotent: a missing
+* path, or a half-deleted orphan inside `<home>/wt`, ends removed too. The folder goes to the
+* trash or is deleted in place, never through a link (`discardFolder`), then
+* `git worktree prune` drops the record. The branch stays unless `deleteBranch` names it.
+*/
+async function removeWorkspace(cmd, home, log) {
+	const path = resolve(cmd.path);
+	const info = await assertRemovable(cmd, home);
+	const registered = info.state === "registered";
+	const discardedChanges = registered && cmd.force === true && await isDirty(path);
+	try {
+		if (registered && info.locked) await git(cmd.repoPath, [
+			"worktree",
+			"unlock",
+			path
+		]).catch(() => void 0);
+		if (info.state !== "missing") await discardFolder(home, path, log);
+	} finally {
+		await pruneWorktrees(cmd.repoPath);
+	}
+	if (cmd.deleteBranch) await git(cmd.repoPath, [
+		"branch",
+		"-D",
+		cmd.deleteBranch
+	]).catch(() => void 0);
+	return {
+		removed: true,
+		...discardedChanges ? { discardedChanges } : {}
+	};
+}
 // ../runner/src/workspace/project-config.ts
 const PROJECT_CONFIG_PATH = ".codeden/project.json";
 /**
@@ -26438,20 +27007,41 @@ async function resolveBase(repo, cmd) {
 	])) return `origin/${def}`;
 	return def ?? "HEAD";
 }
-async function createWorktree(cmd, home) {
+function isEmptyDir(path) {
+	try {
+		return readdirSync(path).length === 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Make `path` ready for `git worktree add`: reuse a worktree of this repository, delete the
+* orphan folder an interrupted removal left inside `<home>/wt` (stopping processes in it
+* first), and drop git's stale record of it. Returns the worktree to reuse, if any.
+*/
+async function clearTarget(repo, path, ctx) {
+	const info = await worktreeState(repo, path);
+	if (info.state === "registered") return {
+		cwd: path,
+		branch: await currentBranch(path),
+		created: false
+	};
+	if (info.state === "orphan" && isManagedWorktreePath(ctx.home, path) && !info.containsOther) {
+		await ctx.supervisor.killUnder(path);
+		await discardFolder(ctx.home, path);
+	} else if (info.state !== "missing" && !isEmptyDir(path)) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
+	if (info.registered) await pruneWorktrees(repo);
+	return null;
+}
+async function createWorktree(cmd, ctx) {
 	const repo = await topLevel(cmd.repoPath).catch(() => {
 		throw new CommandError("not_a_repo", `${cmd.repoPath} is not a git repository`);
 	});
 	const short = sessionShort(cmd.sessionId);
-	const path = resolve(cmd.path ?? join(home, "wt", cmd.projectSlug ?? slugFromPath(repo), short));
-	if (existsSync(path)) {
-		if (await isWorkTree(path)) return {
-			cwd: path,
-			branch: await currentBranch(path),
-			created: false
-		};
-		if (readdirSync(path).length > 0) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
-	}
+	const slug = cmd.projectSlug ?? slugFromPath(repo);
+	const path = resolve(cmd.path ?? join(ctx.home, "wt", slug, short));
+	const reuse = await clearTarget(repo, path, ctx);
+	if (reuse) return reuse;
 	await mkdir(dirname(path), { recursive: true });
 	const base = await resolveBase(repo, cmd);
 	if (cmd.branch && await branchExists(repo, cmd.branch)) {
@@ -26511,7 +27101,7 @@ async function prepareWorkspace(cmd, ctx) {
 				created: false
 			};
 			break;
-		case "worktree": target = await createWorktree(cmd, ctx.home);
+		case "worktree": target = await createWorktree(cmd, ctx);
 	}
 	const { config, error } = await readProjectConfig(target.cwd);
 	if (error) ctx.emit({
@@ -26536,53 +27126,6 @@ async function prepareWorkspace(cmd, ctx) {
 		setup
 	};
 }
-/**
-* Refuse to remove a worktree with uncommitted changes (`worktree_dirty`) unless forced. Runs
-* before terminals and processes in the worktree are stopped, so a dirty worktree is left
-* exactly as it was. Ignored files (build output, `node_modules`) don't count.
-*/
-async function assertRemovable(cmd) {
-	if (cmd.force || !existsSync(cmd.path) || !await isWorkTree(cmd.path)) return;
-	if ((await git(cmd.path, ["status", "--porcelain"])).stdout.toString("utf8").trim()) throw new CommandError("worktree_dirty", `${cmd.path} has uncommitted changes; commit them or remove it with force`);
-}
-/** `workspace.remove`: remove a worktree (retrying briefly for Windows file locks). */
-async function removeWorkspace(cmd) {
-	const path = resolve(cmd.path);
-	let removed = false;
-	let lastError;
-	for (let attempt = 0; attempt < 5 && !removed; attempt++) try {
-		const args = [
-			"worktree",
-			"remove",
-			...cmd.force ? ["--force"] : [],
-			path
-		];
-		await git(cmd.repoPath, args);
-		removed = true;
-	} catch (error) {
-		lastError = error;
-		if (!existsSync(path)) break;
-		if (!cmd.force && /modified or untracked|contains/.test(String(error))) break;
-		await new Promise((r) => setTimeout(r, 250 * (attempt + 1)));
-	}
-	if (!removed && existsSync(path) && cmd.force) {
-		await rm(path, {
-			recursive: true,
-			force: true,
-			maxRetries: 5,
-			retryDelay: 200
-		});
-		removed = true;
-	}
-	await git(cmd.repoPath, ["worktree", "prune"]).catch(() => void 0);
-	if (!removed && existsSync(path)) throw lastError instanceof Error ? lastError : new CommandError("remove_failed", `Could not remove ${path}`);
-	if (cmd.deleteBranch) await git(cmd.repoPath, [
-		"branch",
-		"-D",
-		cmd.deleteBranch
-	]).catch(() => void 0);
-	return { removed: removed || !existsSync(path) };
-}
 // ../runner/src/commands.ts
 /** Execute one server command (§4.3). Throws `CommandError` for expected failures. */
 async function executeCommand(core, command) {
@@ -26632,10 +27175,10 @@ async function executeCommand(core, command) {
 				emit: core.emit
 			});
 		case "workspace.remove":
-			await assertRemovable(command);
+			await assertRemovable(command, core.home);
 			await terminals.closeUnder(command.path);
 			await core.supervisor.killUnder(command.path);
-			return removeWorkspace(command);
+			return removeWorkspace(command, core.home, core.log);
 		case "session.start":
 			if (core.isDraining()) throw new CommandError("draining", "Runner is draining");
 			return host.start(command);
@@ -26913,12 +27456,6 @@ async function handleMcpRequest(request, upstream) {
 		return jsonRpcError(502, `CodeDen server unreachable: ${error.message}`);
 	}
 }
-// ../runner/src/util/paths.ts
-/** True when `child` is `dir` itself or somewhere inside it. */
-function isInside(dir, child) {
-	const rel = relative(resolve(dir), resolve(child));
-	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
-}
 // ../runner/src/process/supervisor.ts
 /**
 * Tracks every child process the runner starts so they can be killed as whole process
@@ -28721,6 +29258,7 @@ async function startRunner(opts) {
 		browser,
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		emit,
+		log,
 		isDraining: () => draining,
 		drain: ({ reason, timeoutMs, exitWhenDrained }) => {
 			if (!draining) {
@@ -28794,6 +29332,7 @@ async function startRunner(opts) {
 	renameSync(tmp, lockFile);
 	log(`runner ${journal.runnerId} listening on 127.0.0.1:${port}`);
 	registry.refreshModels();
+	emptyTrash(opts.home, log);
 	const removeLock = () => removeOwnLock(lockFile);
 	process.once("exit", removeLock);
 	async function close() {
@@ -28824,6 +29363,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { ListAutomationRunsQuery as $, literal as $n, FactoryTuning as $t, SessionFileQuery as A, FactoryLimits as An, LocalSttModelParams as At, ImageTestRequest as B, McpServerUpsertRequest as Bn, CreateGithubIssueRequest as Bt, isElectronRuntime as C, ProjectConfigFile as Cn, ThreadItemsQuery as Ct, CODEDEN_VERSION as D, Project as Dn, agentEventToNewEvent as Dt, wrapper_default as E, WorkKey as En, HealthResponse as Et, ListConflictsQuery as F, AgentConfigListQuery as Fn, UpdateStatus as Ft, BrowserNavigateRequest as G, _enum as Gn, GithubPr as Gt, BrowserClientMessage as H, ProviderId as Hn, GithubIssue as Ht, ListNoticesQuery as I, AgentConfigLocator as In, compareVersions$1 as It, BrowserViewportRequest as J, boolean as Jn, githubPrId as Jt, BrowserNewTabRequest as K, _null as Kn, MergePrRequest as Kt, ResolveConflictRequest as L, AgentConfigWriteRequest as Ln, isNewerVersion as Lt, RunnerToServerMessage as M, InboxItemKind as Mn, TtsRequest as Mt, ServerLock as N, AgentConfigDeleteQuery as Nn, AppPointer as Nt, UsageQuery as O, sortProjects as On, Settings as Ot, ArchiveSessionRequest as P, AgentConfigDiffRequest as Pn, UpdateInstallRequest as Pt, CreateAutomationRequest as Q, intersection as Qn, FactoryTriageRequest as Qt, RoleMessageRequest as R, McpServerDiffRequest as Rn, ConflictRecord as Rt, acquireInstallLock as S, SessionOptions as Sn, SteerRequest as St, import_websocket_server as T, StartedBy as Tn, UpdateProjectRequest as Tt, BrowserDevServerRequest as U, ReasoningEffort as Un, GithubLabelRequest as Ut, summarizeActivity as V, AutonomyLevel as Vn, GithubCommentRequest as Vt, BrowserHistoryRequest as W, datetime as Wn, GithubListQuery as Wt, AutomationFileFrontmatter as X, discriminatedUnion as Xn, DiscoveryArea as Xt, BrowserWsQuery as Y, custom as Yn, parseGithubPrId as Yt, AutomationProjectRequest as Z, int as Zn, FactoryCandidate as Zt, importClaudeSdkFrom as _, SessionResult as _n, SecretKey as _t, Hono as a, Artifact as an, record as ar, TriageReport as at, runNpm as b, TerminalQuery as bn, SetSecretRequest as bt, serve as c, AutomationRun as cn, unknown as cr, UpdateAutomationRequest as ct, createImageEngineRegistry as d, SessionStatus as dn, safeParse$1 as dr, FileWriteRequest as dt, KillSwitchRequest as en, looseObject as er, ListAutomationsQuery as et, IMAGE_ASPECT_RATIOS as f, DiffScope as fn, prettifyError as fr, ListInboxQuery as ft, CLAUDE_SDK_VERSION as g, RestoreFilesRequest as gn, RespondRequest as gt, claudeSdkSource as h, GitPushRequest as hn, ResolveInboxRequest as ht, killTree as i, isFactoryMode as in, preprocess as ir, TriageDecisionRequest as it, RunnerLock as j, InboxItem as jn, SttQuery as jt, UsageSettings as k, DEFAULT_VISION_PATH as kn, LOCAL_STT_SAMPLE_RATE as kt, upgradeWebSocket as l, TriagePolicy as ln, ZodError as lr, CreateProjectRequest as lt, ImageGenerationError as m, GitCommitRequest as mn, ReorderProjectsRequest as mt, readLock as n, ReviewVerdict as nn, object as nr, SetAutomationEnabledRequest as nt, tryDecodeURIComponent as o, Automation as on, string as or, UpcomingRunsQuery as ot, resolveImageOutput as p, EditQueuedMessageRequest as pn, ListSessionsQuery as pt, BrowserOpenRequest as q, array as qn, TriageIssueRequest as qt, isAlive as r, SetAutonomyModeRequest as rn, optional as rr, StarterSetRequest as rt, bufferToFormData as s, AutomationGuards as sn, union as sr, UpdateAutomationProjectSettingsRequest as st, startRunner as t, PutVisionRequest as tn, number$1 as tr, RunAutomationRequest as tt, ImageEngineRegistry as u, Session as un, toJSONSchema as ur, FileReadQuery as ut, installClaudeSdk as v, SpeechSummaryRequest as vn, SendMessageRequest as vt, ownNodeEnv as w, ConflictDecision as wn, UiClientMessage as wt, resolveNpm as x, RunnerCommandResults as xn, StartSessionRequest as xt, isClaudeSdkInstalled as y, TerminalClientMessage as yn, SessionStartMeta as yt, UpdateSessionRequest as z, McpServerTarget as zn, NOTICE_BATCH_CODE as zt };
+export { ExportAutomationsQuery as $, datetime as $n, TriageIssueRequest as $t, SessionFileQuery as A, SessionOptions as An, UiClientMessage as At, ImageTestRequest as B, InboxItemKind as Bn, UpdateInstallRequest as Bt, isElectronRuntime as C, GitPushRequest as Cn, SecretKey as Ct, CODEDEN_VERSION as D, TerminalClientMessage as Dn, StartSessionRequest as Dt, wrapper_default as E, SpeechSummaryRequest as En, SetSecretRequest as Et, ListConflictsQuery as F, Project as Fn, LOCAL_STT_SAMPLE_RATE as Ft, BrowserNavigateRequest as G, AgentConfigLocator as Gn, NOTICE_BATCH_CODE as Gt, BrowserClientMessage as H, AgentConfigDeleteQuery as Hn, compareVersions$1 as Ht, ListNoticesQuery as I, sortProjects as In, LocalSttModelParams as It, BrowserViewportRequest as J, McpServerTarget as Jn, GithubIssue as Jt, BrowserNewTabRequest as K, AgentConfigWriteRequest as Kn, CreateGithubIssueRequest as Kt, ResolveConflictRequest as L, DEFAULT_VISION_PATH as Ln, SttQuery as Lt, RunnerToServerMessage as M, ConflictDecision as Mn, HealthResponse as Mt, ServerLock as N, StartedBy as Nn, agentEventToNewEvent as Nt, UsageQuery as O, TerminalQuery as On, SteerRequest as Ot, ArchiveSessionRequest as P, WorkKey as Pn, Settings as Pt, DuplicateAutomationRequest as Q, ReasoningEffort as Qn, MergePrRequest as Qt, RoleMessageRequest as R, FactoryLimits as Rn, TtsRequest as Rt, acquireInstallLock as S, GitCommitRequest as Sn, RespondRequest as St, import_websocket_server as T, SessionResult as Tn, SessionStartMeta as Tt, BrowserDevServerRequest as U, AgentConfigDiffRequest as Un, isNewerVersion as Ut, summarizeActivity as V, messageFrom as Vn, UpdateStatus as Vt, BrowserHistoryRequest as W, AgentConfigListQuery as Wn, ConflictRecord as Wt, AUTOMATION_IMPORT_LIMITS as X, AutonomyLevel as Xn, GithubListQuery as Xt, BrowserWsQuery as Y, McpServerUpsertRequest as Yn, GithubLabelRequest as Yt, AutomationImportSource as Z, ProviderId as Zn, GithubPr as Zt, importClaudeSdkFrom as _, TriagePolicy as _n, unknown as _r, FileWriteRequest as _t, Hono as a, FactoryTuning as an, discriminatedUnion as ar, ListAutomationRunsQuery as at, runNpm as b, DiffScope as bn, safeParse$1 as br, ReorderProjectsRequest as bt, serve as c, ReviewVerdict as cn, literal as cr, SetAutomationEnabledRequest as ct, createImageEngineRegistry as d, Artifact as dn, object as dr, TriageReport as dt, githubPrId as en, _enum as er, ImportAutomationsRequest as et, IMAGE_ASPECT_RATIOS as f, Automation as fn, optional as fr, UpcomingRunsQuery as ft, CLAUDE_SDK_VERSION as g, AutomationTrigger as gn, union as gr, FileReadQuery as gt, claudeSdkSource as h, AutomationRun as hn, string as hr, CreateProjectRequest as ht, killTree as i, FactoryTriageRequest as in, custom as ir, CreateAutomationRequest as it, RunnerLock as j, ProjectConfigFile as jn, UpdateProjectRequest as jt, UsageSettings as k, RunnerCommandResults as kn, ThreadItemsQuery as kt, upgradeWebSocket as l, SetAutonomyModeRequest as ln, looseObject as lr, StarterSetRequest as lt, ImageGenerationError as m, AutomationGuards as mn, record as mr, UpdateAutomationRequest as mt, readLock as n, DiscoveryArea as nn, array as nr, AutomationGuardsPatch as nt, tryDecodeURIComponent as o, KillSwitchRequest as on, int as or, ListAutomationsQuery as ot, resolveImageOutput as p, AutomationAction as pn, preprocess as pr, UpdateAutomationProjectSettingsRequest as pt, BrowserOpenRequest as q, McpServerDiffRequest as qn, GithubCommentRequest as qt, isAlive as r, FactoryCandidate as rn, boolean as rr, AutomationProjectRequest as rt, bufferToFormData as s, PutVisionRequest as sn, intersection as sr, RunAutomationRequest as st, startRunner as t, parseGithubPrId as tn, _null as tr, AutomationFileFrontmatter as tt, ImageEngineRegistry as u, isFactoryMode as un, number$1 as ur, TriageDecisionRequest as ut, installClaudeSdk as v, Session as vn, ZodError as vr, ListInboxQuery as vt, ownNodeEnv as w, RestoreFilesRequest as wn, SendMessageRequest as wt, resolveNpm as x, EditQueuedMessageRequest as xn, prettifyError as xr, ResolveInboxRequest as xt, isClaudeSdkInstalled as y, SessionStatus as yn, toJSONSchema as yr, ListSessionsQuery as yt, UpdateSessionRequest as z, InboxItem as zn, AppPointer as zt };
 
-//# sourceMappingURL=runner-CJetH9jW.js.map
+//# sourceMappingURL=runner-DGomZl80.js.map