codeden 0.2.0 → 0.4.0

package/dist/{runner-CJetH9jW.js → runner-QPAnitMx.js}

@@ -8,7 +8,7 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypt
 import { execFile, spawn } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 import { createInterface } from "node:readline";
-import { copyFile, mkdir, readFile, rm, rmdir, stat, utimes, writeFile } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, utimes, writeFile } from "node:fs/promises";
 import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants as constants$1 } from "node:http2";
 import { Readable } from "node:stream";
@@ -6004,12 +6004,16 @@ const Role = _enum([
 	"agent"
 ]);
 /**
-* Autonomy levels (§11.2), mapped onto each provider's native enforcement.
+* Permission levels of an agent session (§11.2), mapped onto each provider's native enforcement.
+* Shown in the UI as "Permissions"; stored as `autonomy`.
+* - `read_only`: reads and runs checks, but never edits files, commits or pushes. Needs a
+*   provider with `ProviderCapabilities.readOnly`.
 * - `supervised`: every edit and command asks.
 * - `auto`: edits and normal commands in the worktree run freely; risky actions ask (default).
 * - `full`: no approvals inside the worktree.
 */
 const AutonomyLevel = _enum([
+	"read_only",
 	"supervised",
 	"auto",
 	"full"
@@ -6284,11 +6288,47 @@ const Attachment = discriminatedUnion("type", [object({
 	name: string().optional(),
 	mediaType: string().optional()
 })]);
+/**
+* Who sent a message to a session: the user, the orchestrator (to a PM), a PM (to its
+* sessions), an automation, or CodeDen itself (automatic wake-ups, the factory loop).
+*/
+const MessageSender = _enum([
+	"user",
+	"orchestrator",
+	"pm",
+	"automation",
+	"codeden"
+]);
 /** Input that starts or steers a turn: text plus optional image/file attachments. */
 const UserInput = object({
 	text: string(),
-	attachments: array(Attachment).default([])
+	attachments: array(Attachment).default([]),
+	/**
+	* Who wrote the message, when it was not the user: recorded so the transcript can show the
+	* sender without reading the text. Absent on the user's own messages and on every message
+	* stored before senders were recorded.
+	*/
+	from: MessageSender.optional()
 });
+/**
+* The first line of a message from a PM or the orchestrator, telling the agent who wrote it.
+* The only definition of these words: the server writes them, the UI recognises them.
+*/
+const SENDER_LINES = {
+	pm: "Message from your project manager:",
+	orchestrator: "Message from the orchestrator:"
+};
+/**
+* Input for a message from a PM or the orchestrator: the sender is recorded in `from` and
+* named for the agent in the text's first line (`SENDER_LINES`).
+*/
+function messageFrom(from, text) {
+	return {
+		text: `${SENDER_LINES[from]}\n${text}`,
+		attachments: [],
+		from
+	};
+}
 const itemBase = {
 	/** Unique within the session. */
 	id: Id,
@@ -6813,6 +6853,18 @@ const FactoryLoopState = _enum([
 	"stopped"
 ]);
 // ../../packages/contracts/src/entities/project.ts
+/**
+* Something re-detecting a project's folder found that CodeDen does not apply on its own (§9).
+* `github_remote_missing`: a `github` project's folder no longer has a GitHub `origin` (removed,
+* pointing at another host, or no git checkout at all). The project keeps its GitHub
+* coordinates until the user restores the remote or disconnects GitHub.
+*/
+const ProjectRemoteWarning = object({
+	code: literal("github_remote_missing"),
+	/** What `origin` points at now, credentials removed; null when there is no `origin`. */
+	remoteUrl: string().nullable(),
+	detectedAt: Timestamp
+});
 const projectBase = {
 	id: Id,
 	name: string().min(1),
@@ -6845,6 +6897,12 @@ const projectBase = {
 	* `projects.reordered`; archived projects keep theirs.
 	*/
 	sortOrder: int().nonnegative().default(0),
+	/**
+	* Set when re-detection found the folder's git remote out of step with the project (see
+	* `ProjectRemoteWarning`); absent when all is well. Cleared by the next detection that finds
+	* the GitHub remote again, or by disconnecting GitHub.
+	*/
+	remoteWarning: ProjectRemoteWarning.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	archivedAt: Timestamp.nullable()
@@ -6859,6 +6917,9 @@ const GitHubRepo = object({
 /**
 * A project. `github` projects get the full issue/PR/evidence flow; `local` projects
 * (no GitHub remote) get sessions, worktrees, checkpoints, diffs and automations only (§9).
+* The kind is detected when the project is added and again later (on server start, after
+* agent turns in local projects, on demand): a folder that gains a GitHub `origin` becomes a
+* `github` project. Losing the remote never downgrades a project on its own.
 */
 const Project = discriminatedUnion("kind", [object({
 	...projectBase,
@@ -7044,7 +7105,13 @@ const ProviderCapabilities = object({
 	* An autonomy change reaches a running turn from its next tool call. When false (or absent),
 	* a running turn keeps its autonomy and the change applies from the next turn.
 	*/
-	liveAutonomy: boolean().optional()
+	liveAutonomy: boolean().optional(),
+	/**
+	* The `read_only` permission level is enforced natively: no file edits, no writing shell
+	* commands, no commits or pushes (§11.2). When false (or absent), sessions on this provider
+	* cannot use `read_only`.
+	*/
+	readOnly: boolean().optional()
 });
 /** A model a provider offers. */
 const ModelInfo = object({
@@ -7703,7 +7770,11 @@ const RunnerCommandResults = {
 			ok: boolean()
 		})).optional()
 	}),
-	"workspace.remove": object({ removed: boolean() }),
+	"workspace.remove": object({
+		removed: boolean(),
+		/** A forced removal deleted uncommitted changes (absent from older runners). */
+		discardedChanges: boolean().optional()
+	}),
 	"session.start": object({ resumeToken: string().nullable() }),
 	"session.send": Empty,
 	"session.steer": Empty,
@@ -7813,13 +7884,7 @@ const QueuedMessage = object({
 	sessionId: Id,
 	input: UserInput,
 	/** Who queued it. Events written before senders were recorded were all the user's. */
-	from: _enum([
-		"user",
-		"orchestrator",
-		"pm",
-		"automation",
-		"codeden"
-	]).default("user"),
+	from: MessageSender.default("user"),
 	createdAt: Timestamp
 });
 object({ messages: array(QueuedMessage) });
@@ -8171,6 +8236,12 @@ const AutomationGuards = object({
 	/** Run once for missed schedules after downtime. */
 	catchUpMissed: boolean().default(false)
 });
+/** Who created a database automation (§10). */
+const AutomationCreator = _enum([
+	"user",
+	"pm",
+	"import"
+]);
 /** An automation: trigger + action + target + guards. Off by default. */
 const Automation = object({
 	id: Id,
@@ -8196,6 +8267,11 @@ const Automation = object({
 	* `automation:<template id or name slug>`.
 	*/
 	workKey: string().min(1).max(200).optional(),
+	/**
+	* Who created a database automation: the user in the UI (`user`, the default when absent),
+	* a PM through `create_automation` (`pm`), or an import of shared files (`import`).
+	*/
+	createdBy: AutomationCreator.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp
 });
@@ -9625,7 +9701,7 @@ const Settings = object({
 	/** Stops every project's factory loop and all factory sessions. */
 killSwitch: boolean().default(false) }).prefault({}),
 	/**
-	* Worktree cleanup (§9). Archiving a session always removes its worktree; with `cleanup` on,
+	* Worktree cleanup (§9). Archiving a session removes its worktree (unless it has uncommitted changes and isn't forced); with `cleanup` on,
 	* worktrees of sessions inactive for `afterDays` are removed too, unless the session's pull
 	* request is still open or the worktree has uncommitted changes.
 	*/
@@ -9928,20 +10004,22 @@ const CreateProjectRequest = object({
 	defaultProvider: ProviderId.nullable().optional(),
 	autonomy: AutonomyLevel.nullable().optional()
 });
+/** What CodeDen found in a project folder. */
+const ProjectDetection = object({
+	isGitRepo: boolean(),
+	/** Top level of the git checkout (may differ from the chosen folder). */
+	gitRoot: string().nullable(),
+	remoteUrl: string().nullable(),
+	github: GitHubRepo.nullable(),
+	defaultBranch: string().nullable(),
+	currentBranch: string().nullable(),
+	packageManager: PackageManager.nullable(),
+	/** Suggested worktree setup commands, e.g. `pnpm install`. */
+	suggestedSetupCommands: array(string())
+});
 object({
 	project: Project,
-	detected: object({
-		isGitRepo: boolean(),
-		/** Top level of the git checkout (may differ from the chosen folder). */
-		gitRoot: string().nullable(),
-		remoteUrl: string().nullable(),
-		github: GitHubRepo.nullable(),
-		defaultBranch: string().nullable(),
-		currentBranch: string().nullable(),
-		packageManager: PackageManager.nullable(),
-		/** Suggested worktree setup commands, e.g. `pnpm install`. */
-		suggestedSetupCommands: array(string())
-	})
+	detected: ProjectDetection
 });
 /** `PATCH /api/projects/:id`. */
 const UpdateProjectRequest = object({
@@ -10540,6 +10618,97 @@ object({
 	/** The session start when accepted (possibly `conflict`); null when declined. */
 	start: StartSessionResponse.nullable()
 });
+// ../../packages/contracts/src/automations-sharing.ts
+/**
+* Sharing automations (§10): duplicate, export as the Markdown + YAML frontmatter file format
+* (one `.md`, or all of a project's as a `.zip`), and import those files back. Imports are
+* parsed with the same parser and validation as automation files, never run anything and
+* always start off.
+*/
+/** Size limits for an import, checked by the server before anything is parsed. */
+const AUTOMATION_IMPORT_LIMITS = {
+	/** Automation files in one import (Markdown files, zip entries or pasted text). */
+	maxFiles: 50,
+	/** One file's text, in UTF-16 code units (about bytes for ASCII). */
+	maxFileChars: 131072,
+	/** All files together, after unzipping. */
+	maxTotalChars: 1048576,
+	/** A zip as uploaded, before base64 (base64 makes it about a third bigger). */
+	maxZipBytes: 1048576,
+	/** Entries a zip may list, `.md` or not (more is refused before inflating anything). */
+	maxZipEntries: 200
+};
+/** What to import: Markdown files, a zip of them (base64) and/or pasted Markdown. */
+const AutomationImportSource = object({
+	files: array(object({
+		/** File name, e.g. `release-notes.md`; its stem becomes the default work key. */
+		name: string().trim().min(1).max(255),
+		content: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars)
+	})).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional(),
+	/** A `.zip` of `.md` files, base64-encoded. Other entries are ignored. */
+	zipBase64: string().max(Math.ceil(AUTOMATION_IMPORT_LIMITS.maxZipBytes / 3) * 4 + 4).optional(),
+	/** One automation pasted as text. */
+	text: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars).optional()
+}).refine((s) => Boolean(s.files?.length || s.zipBase64 || s.text?.trim()), { message: "Pass files, a zip or pasted text" });
+/** The definition an import would create (no id, target or switch yet). */
+const AutomationDraft = object({
+	name: string().min(1),
+	description: string().nullable(),
+	trigger: AutomationTrigger,
+	action: AutomationAction,
+	guards: AutomationGuards,
+	workKey: string().min(1).max(200)
+});
+object({ items: array(object({
+	/** File name, unique within the import (duplicates get ` (2)`). */
+	fileName: string(),
+	/** Null when the file is invalid. */
+	automation: AutomationDraft.nullable(),
+	/** Validation error (bad YAML, unknown fields, invalid cron, ...); null when importable. */
+	error: string().nullable(),
+	/** Runs with Full permissions: it never asks before acting. */
+	fullPermissions: boolean()
+})) });
+/**
+* `POST /api/automations/import`: re-parse the same source and create the selected files as
+* database automations, always off. `projectId` targets one project; omitted, all projects.
+*/
+const ImportAutomationsRequest = object({
+	source: AutomationImportSource,
+	projectId: Id.optional(),
+	/** File names (from the preview) to import; omitted, every valid file. */
+	select: array(string()).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional()
+});
+object({
+	/** The new automations, all off. */
+	created: array(AutomationListItem),
+	/** Selected files that could not be imported, with the reason. */
+	failed: array(object({
+		fileName: string(),
+		error: string()
+	}))
+});
+object({
+	/** `<slug>.md`. */
+	fileName: string().min(1),
+	markdown: string()
+});
+/** `GET /api/automations/export?projectId=`: the query; without a project, every automation. */
+const ExportAutomationsQuery = object({ projectId: Id.optional() });
+object({
+	fileName: string().min(1),
+	/** The zip, base64-encoded. */
+	zipBase64: string(),
+	count: int().nonnegative()
+});
+/**
+* `POST /api/automations/:id/duplicate`: an editable copy (also of file-based and built-in
+* automations), off. `projectId` targets one project; omitted, the original's target.
+*/
+const DuplicateAutomationRequest = object({
+	projectId: Id.optional(),
+	name: string().trim().min(1).max(200).optional()
+});
 // ../../packages/contracts/src/browser-api.ts
 /**
 * Browser panel HTTP and WebSocket shapes (§12.2). Routes live under
@@ -10841,6 +11010,201 @@ object({
 		message: string()
 	}).optional()
 });
+/** The password rules in plain words, shown next to the password field. */
+const PASSWORD_RULE_TEXT = "Use at least 15 characters. A short sentence or a few random words works well. Very common passwords, repeated characters and simple sequences such as abcdef… or 12345… are refused.";
+/** Base words of very common passwords; a password made of one of these plus digits is refused. */
+const COMMON_WORDS = /* @__PURE__ */ new Set([
+	"password",
+	"passw0rd",
+	"letmein",
+	"welcome",
+	"admin",
+	"administrator",
+	"iloveyou",
+	"qwerty",
+	"monkey",
+	"dragon",
+	"football",
+	"baseball",
+	"sunshine",
+	"princess",
+	"superman",
+	"batman",
+	"trustno",
+	"master",
+	"shadow",
+	"michael",
+	"jennifer",
+	"computer",
+	"secret",
+	"changeme",
+	"codeden",
+	"default",
+	"login",
+	"hello",
+	"abc",
+	"test",
+	"guest",
+	"root",
+	"starwars",
+	"whatever",
+	"freedom",
+	"mustang",
+	"pokemon",
+	"charlie",
+	"correcthorsebatterystaple"
+]);
+/** Character runs a "sequence" password walks along (alphabet, digits, keyboard rows). */
+const SEQUENCES = [
+	"abcdefghijklmnopqrstuvwxyz",
+	"0123456789",
+	"qwertyuiopasdfghjklzxcvbnm",
+	"qwertzuiopasdfghjklyxcvbnm",
+	"azertyuiopqsdfghjklmwxcvbn",
+	"1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p",
+	"qazwsxedcrfvtgbyhnujmikolp",
+	"1234567890qwertyuiopasdfghjklzxcvbnm"
+];
+/** True when `text` is one short unit repeated (`abcabcabc`, `passwordpassword`). */
+function isRepeatedUnit(text) {
+	for (let size = 1; size <= text.length / 2; size++) {
+		if (text.length % size !== 0) continue;
+		if (text.slice(0, size).repeat(text.length / size) === text) return true;
+	}
+	return false;
+}
+/** True when `text` walks along one of the known sequences, forwards or backwards (wrapping). */
+function isSequence(text) {
+	return SEQUENCES.some((seq) => {
+		const looped = seq.repeat(Math.ceil(text.length / seq.length) + 2);
+		const reversed = [...looped].reverse().join("");
+		return looped.includes(text) || reversed.includes(text);
+	});
+}
+/**
+* Why `password` can't be used for network access, in plain words, or null when it is fine.
+* Shared by the server (which enforces it) and the UI (which explains it as you type).
+*/
+function passwordProblem(password) {
+	if (password.length < 15) return `Use at least 15 characters (this one has ${password.length}).`;
+	if (password.length > 256) return `Use at most 256 characters.`;
+	const lower = password.toLowerCase();
+	const compact = lower.replace(/\s+/g, "");
+	if (new Set(compact).size < 5 || isRepeatedUnit(compact)) return "That repeats the same few characters. Try a few random words instead.";
+	if (isSequence(compact)) return "That is a simple sequence. Try a few random words instead.";
+	const letters = lower.replace(/[^a-z]/g, "");
+	const words = lower.split(/[^a-z]+/).filter(Boolean);
+	if (letters.length > 0 && (COMMON_WORDS.has(letters) || isRepeatedUnitOf(letters, COMMON_WORDS) || words.length > 0 && words.every((w) => COMMON_WORDS.has(w)))) return "That is too close to a very common password. Try a few random words instead.";
+	return null;
+}
+function isRepeatedUnitOf(text, units) {
+	for (const unit of units) if (text.length % unit.length === 0 && unit.repeat(text.length / unit.length) === text) return true;
+	return false;
+}
+/** One address CodeDen can be opened on, with the URL a phone would scan. */
+const NetworkAddress = object({
+	kind: _enum([
+		"local",
+		"lan",
+		"vpn"
+	]),
+	/** Human label, e.g. "This computer", "Wi-Fi (192.168.1.20)", "Tailscale". */
+	label: string(),
+	/** The interface the address belongs to (`Wi-Fi`, `eth0`, `tailscale0`), or null for localhost. */
+	interfaceName: string().nullable(),
+	/** The bare host: `localhost` or an IPv4 address. */
+	host: string(),
+	/** `http://<host>:<port>`. */
+	url: string()
+});
+/** A signed-in remote device, as listed in Settings › Network access (never the token). */
+const RemoteDevice = object({
+	id: string(),
+	/** The browser's user agent when it signed in (trimmed). */
+	label: string(),
+	/** The address it signed in from. */
+	address: string().nullable(),
+	createdAt: Timestamp,
+	lastSeenAt: Timestamp,
+	expiresAt: Timestamp,
+	/** The device making this request. */
+	current: boolean()
+});
+/**
+* `GET /api/network`: whether network access is on, where CodeDen answers, and who is signed
+* in. `remote` tells the caller whether it is itself a remote device (management is
+* loopback-only, so the UI shows the controls read-only there).
+*/
+const NetworkStatus = object({
+	enabled: boolean(),
+	passwordSet: boolean(),
+	passwordSetAt: Timestamp.nullable(),
+	/** Where the HTTP listener is bound right now. */
+	listening: _enum(["loopback", "network"]),
+	port: int().nonnegative(),
+	/** Addresses CodeDen answers on: localhost always, LAN and VPN addresses when enabled. */
+	addresses: array(NetworkAddress),
+	/** Addresses it would answer on once enabled (for the off state's preview). */
+	candidates: array(NetworkAddress),
+	devices: array(RemoteDevice),
+	remote: boolean()
+});
+/**
+* `POST /api/network/password` (loopback only): set a password, or let the server generate a
+* passphrase. Either way every remote device is signed out.
+*/
+const SetNetworkPasswordRequest = union([object({ password: string().min(1).max(256) }), object({ generate: literal(true) })]);
+/** Response to setting the password: the generated passphrase is returned once, never again. */
+const SetNetworkPasswordResponse = object({
+	status: NetworkStatus,
+	generated: string().nullable()
+});
+/** `PUT /api/network` (loopback only): turn network access on or off. */
+const SetNetworkAccessRequest = object({ enabled: boolean() });
+/** `POST /api/auth/sign-in` from a remote device. */
+const SignInRequest = object({ password: string().max(256) });
+object({
+	/** The caller is not on this machine. */
+	remote: boolean(),
+	/** The caller has a valid session (remote) or install-token cookie (local). */
+	signedIn: boolean(),
+	networkEnabled: boolean()
+});
+object({ error: object({
+	code: _enum([
+		"invalid_password",
+		"rate_limited",
+		"locked_out",
+		"network_off"
+	]),
+	message: string(),
+	retryAfterSec: int().nonnegative().nullable()
+}) });
+/** A stored remote session: only the SHA-256 hash of its token is kept. */
+const RemoteSessionRecord = object({
+	id: string(),
+	tokenHash: string().regex(/^[0-9a-f]{64}$/),
+	label: string(),
+	address: string().nullable(),
+	createdAt: Timestamp,
+	lastSeenAt: Timestamp,
+	expiresAt: Timestamp
+});
+/**
+* `<home>/remote-access.json` (mode 0600): the network switch, the password hash (scrypt,
+* salted; never the password) and the remote sessions. Kept out of `settings.json` so the
+* settings API can't switch network access on without the checks.
+*/
+const RemoteAccessFile = object({
+	schemaVersion: literal(1).default(1),
+	enabled: boolean().default(false),
+	password: object({
+		/** `scrypt$<N>$<r>$<p>$<salt b64>$<hash b64>`. */
+		hash: string().startsWith("scrypt$"),
+		setAt: Timestamp
+	}).nullable().default(null),
+	sessions: array(RemoteSessionRecord).default([])
+});
 object({ session: Session.nullable() });
 /** `POST .../orchestrator/messages` and `.../projects/:id/pm/messages`. */
 const RoleMessageRequest = object({
@@ -10911,6 +11275,25 @@ object({
 		message: string().nullable()
 	})
 });
+object({
+	/** The project after the check (unchanged unless `changed`). */
+	project: Project,
+	outcome: _enum([
+		"unchanged",
+		"git_detected",
+		"github_connected",
+		"github_changed",
+		"github_remote_missing",
+		"folder_missing"
+	]),
+	/** True when the check updated the project (a `project.updated` event was appended). */
+	changed: boolean(),
+	/** One line for the UI, e.g. "Connected to octo/app" or "Still no GitHub remote on origin". */
+	message: string(),
+	/** What was found in the folder; null when the folder is missing. */
+	detected: ProjectDetection.nullable()
+});
+object({ project: Project });
 // ../../packages/contracts/src/runner/events.ts
 /**
 * Durable runner -> server events. Journaled by the runner and delivered with a `seq`
@@ -11439,7 +11822,7 @@ object({
 * rest of the bundle, so the package version is the single source of truth at runtime;
 * everywhere else (workspace, tests) it is `SOURCE_VERSION`.
 */
-const CODEDEN_VERSION = packageVersion() ?? "0.2.0";
+const CODEDEN_VERSION = packageVersion() ?? "0.4.0";
 function packageVersion() {
 	const value = globalThis.__CODEDEN_PACKAGE_VERSION__;
 	return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -15593,9 +15976,11 @@ function explicitModel(model) {
 }
 // ../../packages/providers/src/policy/read-only.ts
 /**
-* Read-only sessions (the orchestrator and PMs, §11.2) may inspect a repository but never
-* change it. This allowlist decides which shell commands they may run: commands that only
-* read, with no output redirection and no command substitution. Anything else is denied.
+* Read-only sessions (the orchestrator and PMs, and agent sessions with the `read_only`
+* permission level, §11.2) may inspect a repository but never change it. This allowlist decides
+* which shell commands they may run: commands that only read, with no output redirection and no
+* command substitution. Agent sessions may also run the project's checks (tests, lint, type
+* checks) without fix or update flags. Anything else is denied.
 */
 /**
 * Split on every `;`, `&&`, `||`, `|` and newline, even inside quotes. Deliberately cruder
@@ -15705,8 +16090,75 @@ const READ_ONLY_GH = /* @__PURE__ */ new Set([
 	"checks"
 ]);
 const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
+/** Package managers whose `test`, `lint`, ... scripts count as checks. */
+const PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+/** Script names a package manager may run as a check (`pnpm test`, `npm run lint`). */
+const CHECK_SCRIPTS = /* @__PURE__ */ new Set([
+	"test",
+	"tests",
+	"lint",
+	"typecheck",
+	"type-check",
+	"check",
+	"types",
+	"vitest",
+	"jest",
+	"biome",
+	"eslint",
+	"tsc"
+]);
+/** Programs (null: any arguments) and `<program> <subcommand>` pairs that run checks. */
+const CHECK_COMMANDS = {
+	tsc: null,
+	vitest: null,
+	jest: null,
+	eslint: null,
+	pytest: null,
+	mypy: null,
+	pyright: null,
+	biome: [
+		"check",
+		"lint",
+		"ci"
+	],
+	ruff: ["check"],
+	cargo: [
+		"test",
+		"check",
+		"clippy"
+	],
+	go: ["test", "vet"],
+	dotnet: ["test"],
+	mvn: ["test", "verify"],
+	gradle: ["test", "check"]
+};
+/** Flags that turn a check into a write (fixing, formatting, updating snapshots, watching). */
+const WRITING_FLAG = /^(--fix|--fix-type=.*|--write|--apply|--apply-unsafe|--unsafe|-u|--update|--update-snapshots?|--updatesnapshot|--watch|-w)(=.*)?$/;
+/** True when `name args` runs a known check without writing flags. */
+function isCheck(name, args) {
+	if (args.some((a) => WRITING_FLAG.test(a))) return false;
+	const positional = args.filter((a) => !a.startsWith("-"));
+	if (PACKAGE_MANAGERS.has(name)) {
+		const script = positional[0] === "run" ? positional[1] : positional[0];
+		return script !== void 0 && CHECK_SCRIPTS.has(script);
+	}
+	if (name === "npx" || name === "pnpx" || name === "bunx") {
+		const tool = positional[0];
+		return tool !== void 0 && isCheck(bin(tool), args.slice(args.indexOf(tool) + 1));
+	}
+	if (name === "python" || name === "python3" || name === "py") return args[0] === "-m" && (args[1] === "pytest" || args[1] === "mypy");
+	if (!Object.hasOwn(CHECK_COMMANDS, name)) return false;
+	const subs = CHECK_COMMANDS[name];
+	if (!subs) return true;
+	return positional[0] !== void 0 && subs.includes(positional[0]);
+}
 /** Why a command is refused in a read-only session, or undefined when it may run. */
-function readOnlyCommandDenial(command) {
+function readOnlyCommandDenial(command, options = {}) {
 	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
 	for (const simple of splitCommands(command)) {
 		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
@@ -15725,6 +16177,7 @@ function readOnlyCommandDenial(command) {
 			continue;
 		}
 		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
+		if (options.allowChecks && isCheck(name, args)) continue;
 		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
 	}
 }
@@ -15866,7 +16319,7 @@ function tempRootsFrom(candidates, platform, home) {
 	}
 	return out;
 }
-const realpath = (p) => {
+const realpath$1 = (p) => {
 	try {
 		return realpathSync.native(p);
 	} catch {
@@ -15883,7 +16336,7 @@ function osTempRoots(platform = process.platform) {
 	if (platform !== process.platform) return [];
 	if (cachedTempRoots) return cachedTempRoots;
 	const env = process.env;
-	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath(c)] : []), platform, os.homedir());
+	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath$1(c)] : []), platform, os.homedir());
 	return cachedTempRoots;
 }
 const SECRET_BASENAMES = /* @__PURE__ */ new Set([
@@ -16739,6 +17192,8 @@ function approvalTitle(name, input) {
 // ../../packages/providers/src/claude/permissions.ts
 /**
 * Native permission mode per autonomy level (§11.2):
+* - read_only  -> `default`; edits and writing commands are denied by the PreToolUse hook
+*                 (`ClaudePolicy.denial`), so they never reach a prompt
 * - supervised -> `default`, and every edit/command is forced to ask via a PreToolUse hook
 * - auto       -> `acceptEdits`, plus the risky-action classifier
 * - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
@@ -16747,7 +17202,7 @@ function approvalTitle(name, input) {
 */
 function permissionModeFor(autonomy, planMode) {
 	if (planMode) return "plan";
-	if (autonomy === "supervised") return "default";
+	if (autonomy === "read_only" || autonomy === "supervised") return "default";
 	if (autonomy === "auto") return "acceptEdits";
 	return "bypassPermissions";
 }
@@ -16769,16 +17224,23 @@ var ClaudePolicy = class {
 	get level() {
 		return this.autonomy;
 	}
+	/**
+	* True while edits and writing commands are refused: a read-only role (orchestrator, PMs),
+	* or the `read_only` permission level, which can change live with `setAutonomy`.
+	*/
+	get isReadOnly() {
+		return this.readOnly || this.autonomy === "read_only";
+	}
 	/** Switch the level; the next `gate()` uses it. `allow_session` decisions are kept. */
 	setAutonomy(level) {
 		this.autonomy = level;
 	}
 	/** Why a call is refused outright (read-only sessions), or undefined. */
 	denial(toolName, input) {
-		if (!this.readOnly) return void 0;
-		if (EDIT_TOOLS.has(toolName)) return "This session is read-only: it cannot edit files. Act through CodeDen tools instead.";
+		if (!this.isReadOnly) return void 0;
+		if (EDIT_TOOLS.has(toolName)) return this.readOnly ? "This session is read-only: it cannot edit files. Act through CodeDen tools instead." : "This session has read-only permissions: it cannot edit files, commit or push. Report what you found instead.";
 		if (COMMAND_TOOLS.has(toolName)) {
-			const reason = readOnlyCommandDenial(str(input, "command") ?? "");
+			const reason = readOnlyCommandDenial(str(input, "command") ?? "", { allowChecks: !this.readOnly });
 			return reason ? `This session is read-only: ${reason}.` : void 0;
 		}
 	}
@@ -18649,7 +19111,8 @@ const capabilities$2 = {
 	reasoningEffort: true,
 	mcp: true,
 	skills: true,
-	liveAutonomy: true
+	liveAutonomy: true,
+	readOnly: true
 };
 const EFFORTS = [
 	"low",
@@ -19302,6 +19765,7 @@ async function handleServerRequest(req, ac) {
 // ../../packages/providers/src/codex/config.ts
 /**
 * Native sandbox + approval policy per autonomy level (§11.2):
+* - read_only  -> read-only sandbox + `never`: writes fail instead of asking, no network
 * - supervised -> `untrusted`: every command that isn't known-safe and every patch asks
 * - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes (to the
 *                 worktree, extra roots and the OS temp directory) and network; escaping it
@@ -19310,7 +19774,7 @@ async function handleServerRequest(req, ac) {
 *                 to the worktree, extra roots and temp
 */
 function codexPolicy(autonomy, readOnly = false) {
-	if (readOnly) return {
+	if (readOnly || autonomy === "read_only") return {
 		approvalPolicy: "never",
 		sandbox: "read-only",
 		networkAccess: false
@@ -19337,7 +19801,7 @@ function codexPolicy(autonomy, readOnly = false) {
 * never needs an approval (§11.2).
 */
 function codexWritableRoots(opts, tempRoots = osTempRoots()) {
-	const temp = opts.readOnly || opts.autonomy === "supervised" ? [] : tempRoots;
+	const temp = opts.readOnly || opts.autonomy === "read_only" || opts.autonomy === "supervised" ? [] : tempRoots;
 	return [.../* @__PURE__ */ new Set([...opts.additionalDirectories, ...temp])];
 }
 /**
@@ -20309,7 +20773,8 @@ const capabilities$1 = {
 	reasoningEffort: true,
 	mcp: true,
 	skills: true,
-	liveAutonomy: false
+	liveAutonomy: false,
+	readOnly: true
 };
 const CONFIGURED_MODEL = "The model configured in ~/.codex/config.toml";
 /**
@@ -20582,7 +21047,8 @@ var FakeSession = class {
 			await this.streamAssistant(turn, threadId, this.replyFor(prompt));
 			await this.todoList(turn);
 			if (prompt.includes("[mcp]")) await this.mcpToolCall(turn);
-			if ((this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) await this.commandToolCall(turn);
+			const readOnly = this.autonomy === "read_only";
+			if ((!readOnly && (this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) && !readOnly) await this.commandToolCall(turn);
 			if (this.fake.subagent || prompt.includes("[subagent]")) await this.subagent(turn);
 			if (this.fake.followups ?? true) {
 				await this.step(turn);
@@ -20975,7 +21441,8 @@ const capabilities = {
 	reasoningEffort: false,
 	mcp: false,
 	skills: false,
-	liveAutonomy: true
+	liveAutonomy: true,
+	readOnly: true
 };
 /**
 * Deterministic scripted provider for demos and tests (§7.2). Every turn streams:
@@ -26296,6 +26763,303 @@ async function listPorts(probe = []) {
 		url: `http://localhost:${port}`
 	}));
 }
+// ../runner/src/util/paths.ts
+/** True when `child` is `dir` itself or somewhere inside it. */
+function isInside(dir, child) {
+	const rel = relative(resolve(dir), resolve(child));
+	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
+}
+// ../runner/src/workspace/delete-tree.ts
+/** Error codes Windows returns while another process still holds a file or folder open. */
+const IN_USE = /* @__PURE__ */ new Set([
+	"EBUSY",
+	"EPERM",
+	"EACCES",
+	"ENOTEMPTY"
+]);
+const errorCode = (error) => error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+/** Run `op`, retrying briefly (about 1.5s for 5 attempts) while the path is in use. */
+async function retry(op, attempts = 5) {
+	for (let attempt = 1;; attempt++) try {
+		await op();
+		return;
+	} catch (error) {
+		const code = errorCode(error);
+		if (code === "ENOENT") return;
+		if (!code || !IN_USE.has(code) || attempt >= attempts) throw error;
+		await new Promise((r) => setTimeout(r, 100 * attempt));
+	}
+}
+/** Delete a file or link (never what a link points at); clears the read-only flag if needed. */
+function removeFile(path) {
+	return retry(async () => {
+		try {
+			await unlink(path);
+		} catch (error) {
+			if (errorCode(error) !== "EPERM" && errorCode(error) !== "EACCES") throw error;
+			await chmod(path, 438).catch(() => void 0);
+			await unlink(path);
+		}
+	});
+}
+async function kind(path, entry) {
+	if (entry.isSymbolicLink()) return "other";
+	if (entry.isDirectory()) return "dir";
+	if (entry.isFile()) return "other";
+	const stat = await lstat(path).catch(() => void 0);
+	return stat?.isDirectory() && !stat.isSymbolicLink() ? "dir" : "other";
+}
+/**
+* Empty `dir`: files and links are unlinked, real folders are emptied and removed. A symlink
+* or junction is never descended into (Windows reports junctions as links), so nothing
+* outside the tree is touched. Every branch is finished before the first failure is thrown.
+*/
+async function emptyDir(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return;
+		throw error;
+	}
+	const failed = (await Promise.allSettled(entries.map(async (entry) => {
+		const path = join(dir, entry.name);
+		if (await kind(path, entry) !== "dir") return removeFile(path);
+		await emptyDir(path);
+		await retry(() => rmdir(path));
+	}))).find((r) => r.status === "rejected");
+	if (failed) throw failed.reason;
+}
+/** A short, user-facing error for a failed delete or move of the worktree folder `root`. */
+function deleteFailed(root, error) {
+	const file = error && typeof error === "object" && "path" in error ? String(error.path) : root;
+	const where = relative(root, file);
+	const code = errorCode(error);
+	if (code && IN_USE.has(code)) return new CommandError("worktree_in_use", `${where ? `A file in the worktree is in use (${where})` : "The worktree is in use"}. Close whatever is using it (a terminal, dev server or editor), then try again.`);
+	const reason = error instanceof Error ? error.message : String(error);
+	return new CommandError("remove_failed", `Could not delete ${where || root}: ${reason}`);
+}
+/**
+* Delete a worktree folder without ever following a symlink or junction out of it.
+*
+* `git worktree remove` can't be trusted with this on Windows: Git treats junctions as
+* folders, so it deletes the contents of whatever a live junction points at, and it stops at
+* a dangling one with "Directory not empty". In a pnpm install the packages are deleted before
+* the junctions that point at them, so it fails halfway, after removing `.git`. Node's
+* recursive `rm` is no better here: on Windows it waits for as long as a file stays locked.
+*
+* `.git` goes first, so a delete that a locked file interrupts leaves an orphan folder the
+* next attempt cleans up (never a damaged worktree that looks dirty). Each locked entry is
+* retried for about 1.5s, then this throws `worktree_in_use`.
+*/
+async function deleteTree(root) {
+	try {
+		const stat = await lstat(root).catch(() => void 0);
+		if (!stat) return;
+		if (stat.isSymbolicLink() || !stat.isDirectory()) return await removeFile(root);
+		await removeFile(join(root, ".git"));
+		await emptyDir(root);
+		await retry(() => rmdir(root));
+	} catch (error) {
+		throw deleteFailed(root, error);
+	}
+}
+// ../runner/src/workspace/trash.ts
+/**
+* True for a session folder CodeDen created and owns: exactly `<home>/wt/<project>/<session>`.
+* Only these may be deleted once they are no longer git worktrees.
+*/
+function isManagedWorktreePath(home, path) {
+	const rel = relative(resolve(home, "wt"), resolve(path));
+	if (!rel || isAbsolute(rel)) return false;
+	const parts = rel.split(/[\\/]+/);
+	return parts.length === 2 && !parts.includes("..") && !parts.includes(".") && parts[0] !== ".trash";
+}
+/** Where removed worktrees wait to be deleted. `.trash` can never be a project slug. */
+function trashDir(home) {
+	return join(resolve(home), "wt", ".trash");
+}
+/**
+* Move a session folder into the trash. A rename is all or nothing: while anything in the
+* folder is held open (a process's working directory, an open file), Windows refuses it and
+* the folder stays exactly as it was (`worktree_in_use`). Returns null when the trash is on
+* another volume.
+*/
+async function moveToTrash(home, path) {
+	const trash = trashDir(home);
+	await mkdir(trash, { recursive: true });
+	const stamp = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+	const dest = join(trash, `${basename(dirname(path))}-${basename(path)}-${stamp}`);
+	try {
+		await retry(() => rename(path, dest), 8);
+		return dest;
+	} catch (error) {
+		if (errorCode(error) === "EXDEV") return null;
+		throw deleteFailed(path, error);
+	}
+}
+const runs = /* @__PURE__ */ new Map();
+/**
+* Delete everything in the trash, one folder at a time, never following a link (the links in
+* a trashed pnpm install still point at the old path, where a new worktree may live by now).
+* Runs in the background after each removal and when the runner starts; a folder something
+* still holds open stays for the next run. Calls during a run share it and add one more pass.
+*/
+function emptyTrash(home, log) {
+	const trash = trashDir(home);
+	const current = runs.get(trash);
+	if (current) {
+		current.again = true;
+		return current.done;
+	}
+	const run = {
+		again: true,
+		done: Promise.resolve()
+	};
+	run.done = (async () => {
+		try {
+			while (run.again) {
+				run.again = false;
+				const entries = await readdir(trash).catch(() => []);
+				for (const name of entries) await deleteTree(join(trash, name)).catch((error) => log?.(`worktree trash: ${error instanceof Error ? error.message : String(error)}`));
+			}
+		} finally {
+			runs.delete(trash);
+		}
+	})();
+	runs.set(trash, run);
+	return run.done;
+}
+/**
+* Delete a worktree folder that has been cleared for removal. A session folder under
+* `<home>/wt` goes to the trash, so the removal is instant and the path is free right away,
+* and is deleted in the background. Anything else is deleted in place.
+*/
+async function discardFolder(home, path, log) {
+	if (isManagedWorktreePath(home, path) ? await moveToTrash(home, path) : null) emptyTrash(home, log);
+	else await deleteTree(path);
+}
+// ../runner/src/workspace/removal.ts
+async function canonical(path) {
+	const real = await realpath(path).catch(() => resolve(path));
+	return process.platform === "win32" ? real.toLowerCase() : real;
+}
+async function listWorktrees(repo) {
+	const out = await gitText(repo, [
+		"worktree",
+		"list",
+		"--porcelain"
+	]).catch(() => "");
+	const list = [];
+	for (const block of out.split(/\r?\n\r?\n/)) {
+		const lines = block.split(/\r?\n/);
+		if (!lines[0]?.startsWith("worktree ")) continue;
+		const locked = lines.some((l) => l === "locked" || l.startsWith("locked "));
+		list.push({
+			path: lines[0].slice(9),
+			locked
+		});
+	}
+	return list;
+}
+/** Classify `path` against the worktrees of `repo` (see `WorktreeState`). */
+async function worktreeState(repo, path) {
+	const target = await canonical(path);
+	let registered = false;
+	let locked = false;
+	let containsOther = false;
+	for (const wt of await listWorktrees(repo)) {
+		const other = await canonical(wt.path);
+		if (other === target) {
+			registered = true;
+			locked = wt.locked;
+		} else if (isInside(target, other)) containsOther = true;
+	}
+	if (isInside(target, await canonical(repo))) containsOther = true;
+	const info = {
+		registered,
+		locked,
+		containsOther
+	};
+	const stat = await lstat(path).catch(() => void 0);
+	if (!stat) return {
+		state: "missing",
+		...info
+	};
+	if (stat.isSymbolicLink() || !stat.isDirectory()) return {
+		state: "orphan",
+		...info
+	};
+	const dotGit = await lstat(resolve(path, ".git")).catch(() => void 0);
+	if (!dotGit) return {
+		state: "orphan",
+		...info
+	};
+	return {
+		state: dotGit.isFile() && registered ? "registered" : "foreign",
+		...info
+	};
+}
+/** Whether a registered worktree has uncommitted changes (ignored files don't count). */
+async function isDirty(path) {
+	return (await git(path, ["status", "--porcelain"])).stdout.toString("utf8").trim() !== "";
+}
+/**
+* Decide whether `workspace.remove` may delete the path, before anything is touched (terminals
+* and processes in it are stopped only after this passes). Refuses (`not_a_worktree`) anything
+* that isn't a linked worktree of the repository, unless it is an orphan inside CodeDen's
+* worktree folder, and anything containing the repository or another worktree. Unless forced,
+* keeps a locked worktree (`worktree_locked`) or one with uncommitted changes
+* (`worktree_dirty`); ignored files (build output, `node_modules`) don't count.
+*/
+async function assertRemovable(cmd, home) {
+	const path = resolve(cmd.path);
+	const info = await worktreeState(cmd.repoPath, path);
+	const leftAlone = (why) => new CommandError("not_a_worktree", `${path} ${why}, so it was left alone`);
+	if (info.state === "missing") return info;
+	if (info.containsOther) throw leftAlone("contains the repository or another worktree");
+	if (info.state === "foreign") throw leftAlone("is not a worktree of this repository");
+	if (info.state === "orphan" && !isManagedWorktreePath(home, path)) throw leftAlone("is no longer a git worktree and is outside CodeDen's worktree folder");
+	if (info.state !== "registered" || cmd.force) return info;
+	if (info.locked) throw new CommandError("worktree_locked", `${path} is locked; unlock it or remove it with force`);
+	if (await isDirty(path)) throw new CommandError("worktree_dirty", `${path} has uncommitted changes; commit them or remove it with force`);
+	return info;
+}
+/** Drop git's records of worktrees whose folders are gone. */
+async function pruneWorktrees(repo) {
+	await git(repo, ["worktree", "prune"]).catch(() => void 0);
+}
+/**
+* `workspace.remove`: delete a session worktree and git's record of it. Idempotent: a missing
+* path, or a half-deleted orphan inside `<home>/wt`, ends removed too. The folder goes to the
+* trash or is deleted in place, never through a link (`discardFolder`), then
+* `git worktree prune` drops the record. The branch stays unless `deleteBranch` names it.
+*/
+async function removeWorkspace(cmd, home, log) {
+	const path = resolve(cmd.path);
+	const info = await assertRemovable(cmd, home);
+	const registered = info.state === "registered";
+	const discardedChanges = registered && cmd.force === true && await isDirty(path);
+	try {
+		if (registered && info.locked) await git(cmd.repoPath, [
+			"worktree",
+			"unlock",
+			path
+		]).catch(() => void 0);
+		if (info.state !== "missing") await discardFolder(home, path, log);
+	} finally {
+		await pruneWorktrees(cmd.repoPath);
+	}
+	if (cmd.deleteBranch) await git(cmd.repoPath, [
+		"branch",
+		"-D",
+		cmd.deleteBranch
+	]).catch(() => void 0);
+	return {
+		removed: true,
+		...discardedChanges ? { discardedChanges } : {}
+	};
+}
 // ../runner/src/workspace/project-config.ts
 const PROJECT_CONFIG_PATH = ".codeden/project.json";
 /**
@@ -26438,20 +27202,41 @@ async function resolveBase(repo, cmd) {
 	])) return `origin/${def}`;
 	return def ?? "HEAD";
 }
-async function createWorktree(cmd, home) {
+function isEmptyDir(path) {
+	try {
+		return readdirSync(path).length === 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Make `path` ready for `git worktree add`: reuse a worktree of this repository, delete the
+* orphan folder an interrupted removal left inside `<home>/wt` (stopping processes in it
+* first), and drop git's stale record of it. Returns the worktree to reuse, if any.
+*/
+async function clearTarget(repo, path, ctx) {
+	const info = await worktreeState(repo, path);
+	if (info.state === "registered") return {
+		cwd: path,
+		branch: await currentBranch(path),
+		created: false
+	};
+	if (info.state === "orphan" && isManagedWorktreePath(ctx.home, path) && !info.containsOther) {
+		await ctx.supervisor.killUnder(path);
+		await discardFolder(ctx.home, path);
+	} else if (info.state !== "missing" && !isEmptyDir(path)) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
+	if (info.registered) await pruneWorktrees(repo);
+	return null;
+}
+async function createWorktree(cmd, ctx) {
 	const repo = await topLevel(cmd.repoPath).catch(() => {
 		throw new CommandError("not_a_repo", `${cmd.repoPath} is not a git repository`);
 	});
 	const short = sessionShort(cmd.sessionId);
-	const path = resolve(cmd.path ?? join(home, "wt", cmd.projectSlug ?? slugFromPath(repo), short));
-	if (existsSync(path)) {
-		if (await isWorkTree(path)) return {
-			cwd: path,
-			branch: await currentBranch(path),
-			created: false
-		};
-		if (readdirSync(path).length > 0) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
-	}
+	const slug = cmd.projectSlug ?? slugFromPath(repo);
+	const path = resolve(cmd.path ?? join(ctx.home, "wt", slug, short));
+	const reuse = await clearTarget(repo, path, ctx);
+	if (reuse) return reuse;
 	await mkdir(dirname(path), { recursive: true });
 	const base = await resolveBase(repo, cmd);
 	if (cmd.branch && await branchExists(repo, cmd.branch)) {
@@ -26511,7 +27296,7 @@ async function prepareWorkspace(cmd, ctx) {
 				created: false
 			};
 			break;
-		case "worktree": target = await createWorktree(cmd, ctx.home);
+		case "worktree": target = await createWorktree(cmd, ctx);
 	}
 	const { config, error } = await readProjectConfig(target.cwd);
 	if (error) ctx.emit({
@@ -26536,53 +27321,6 @@ async function prepareWorkspace(cmd, ctx) {
 		setup
 	};
 }
-/**
-* Refuse to remove a worktree with uncommitted changes (`worktree_dirty`) unless forced. Runs
-* before terminals and processes in the worktree are stopped, so a dirty worktree is left
-* exactly as it was. Ignored files (build output, `node_modules`) don't count.
-*/
-async function assertRemovable(cmd) {
-	if (cmd.force || !existsSync(cmd.path) || !await isWorkTree(cmd.path)) return;
-	if ((await git(cmd.path, ["status", "--porcelain"])).stdout.toString("utf8").trim()) throw new CommandError("worktree_dirty", `${cmd.path} has uncommitted changes; commit them or remove it with force`);
-}
-/** `workspace.remove`: remove a worktree (retrying briefly for Windows file locks). */
-async function removeWorkspace(cmd) {
-	const path = resolve(cmd.path);
-	let removed = false;
-	let lastError;
-	for (let attempt = 0; attempt < 5 && !removed; attempt++) try {
-		const args = [
-			"worktree",
-			"remove",
-			...cmd.force ? ["--force"] : [],
-			path
-		];
-		await git(cmd.repoPath, args);
-		removed = true;
-	} catch (error) {
-		lastError = error;
-		if (!existsSync(path)) break;
-		if (!cmd.force && /modified or untracked|contains/.test(String(error))) break;
-		await new Promise((r) => setTimeout(r, 250 * (attempt + 1)));
-	}
-	if (!removed && existsSync(path) && cmd.force) {
-		await rm(path, {
-			recursive: true,
-			force: true,
-			maxRetries: 5,
-			retryDelay: 200
-		});
-		removed = true;
-	}
-	await git(cmd.repoPath, ["worktree", "prune"]).catch(() => void 0);
-	if (!removed && existsSync(path)) throw lastError instanceof Error ? lastError : new CommandError("remove_failed", `Could not remove ${path}`);
-	if (cmd.deleteBranch) await git(cmd.repoPath, [
-		"branch",
-		"-D",
-		cmd.deleteBranch
-	]).catch(() => void 0);
-	return { removed: removed || !existsSync(path) };
-}
 // ../runner/src/commands.ts
 /** Execute one server command (§4.3). Throws `CommandError` for expected failures. */
 async function executeCommand(core, command) {
@@ -26632,10 +27370,10 @@ async function executeCommand(core, command) {
 				emit: core.emit
 			});
 		case "workspace.remove":
-			await assertRemovable(command);
+			await assertRemovable(command, core.home);
 			await terminals.closeUnder(command.path);
 			await core.supervisor.killUnder(command.path);
-			return removeWorkspace(command);
+			return removeWorkspace(command, core.home, core.log);
 		case "session.start":
 			if (core.isDraining()) throw new CommandError("draining", "Runner is draining");
 			return host.start(command);
@@ -26913,12 +27651,6 @@ async function handleMcpRequest(request, upstream) {
 		return jsonRpcError(502, `CodeDen server unreachable: ${error.message}`);
 	}
 }
-// ../runner/src/util/paths.ts
-/** True when `child` is `dir` itself or somewhere inside it. */
-function isInside(dir, child) {
-	const rel = relative(resolve(dir), resolve(child));
-	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
-}
 // ../runner/src/process/supervisor.ts
 /**
 * Tracks every child process the runner starts so they can be killed as whole process
@@ -28721,6 +29453,7 @@ async function startRunner(opts) {
 		browser,
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		emit,
+		log,
 		isDraining: () => draining,
 		drain: ({ reason, timeoutMs, exitWhenDrained }) => {
 			if (!draining) {
@@ -28794,6 +29527,7 @@ async function startRunner(opts) {
 	renameSync(tmp, lockFile);
 	log(`runner ${journal.runnerId} listening on 127.0.0.1:${port}`);
 	registry.refreshModels();
+	emptyTrash(opts.home, log);
 	const removeLock = () => removeOwnLock(lockFile);
 	process.once("exit", removeLock);
 	async function close() {
@@ -28824,6 +29558,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { ListAutomationRunsQuery as $, literal as $n, FactoryTuning as $t, SessionFileQuery as A, FactoryLimits as An, LocalSttModelParams as At, ImageTestRequest as B, McpServerUpsertRequest as Bn, CreateGithubIssueRequest as Bt, isElectronRuntime as C, ProjectConfigFile as Cn, ThreadItemsQuery as Ct, CODEDEN_VERSION as D, Project as Dn, agentEventToNewEvent as Dt, wrapper_default as E, WorkKey as En, HealthResponse as Et, ListConflictsQuery as F, AgentConfigListQuery as Fn, UpdateStatus as Ft, BrowserNavigateRequest as G, _enum as Gn, GithubPr as Gt, BrowserClientMessage as H, ProviderId as Hn, GithubIssue as Ht, ListNoticesQuery as I, AgentConfigLocator as In, compareVersions$1 as It, BrowserViewportRequest as J, boolean as Jn, githubPrId as Jt, BrowserNewTabRequest as K, _null as Kn, MergePrRequest as Kt, ResolveConflictRequest as L, AgentConfigWriteRequest as Ln, isNewerVersion as Lt, RunnerToServerMessage as M, InboxItemKind as Mn, TtsRequest as Mt, ServerLock as N, AgentConfigDeleteQuery as Nn, AppPointer as Nt, UsageQuery as O, sortProjects as On, Settings as Ot, ArchiveSessionRequest as P, AgentConfigDiffRequest as Pn, UpdateInstallRequest as Pt, CreateAutomationRequest as Q, intersection as Qn, FactoryTriageRequest as Qt, RoleMessageRequest as R, McpServerDiffRequest as Rn, ConflictRecord as Rt, acquireInstallLock as S, SessionOptions as Sn, SteerRequest as St, import_websocket_server as T, StartedBy as Tn, UpdateProjectRequest as Tt, BrowserDevServerRequest as U, ReasoningEffort as Un, GithubLabelRequest as Ut, summarizeActivity as V, AutonomyLevel as Vn, GithubCommentRequest as Vt, BrowserHistoryRequest as W, datetime as Wn, GithubListQuery as Wt, AutomationFileFrontmatter as X, discriminatedUnion as Xn, DiscoveryArea as Xt, BrowserWsQuery as Y, custom as Yn, parseGithubPrId as Yt, AutomationProjectRequest as Z, int as Zn, FactoryCandidate as Zt, importClaudeSdkFrom as _, SessionResult as _n, SecretKey as _t, Hono as a, Artifact as an, record as ar, TriageReport as at, runNpm as b, TerminalQuery as bn, SetSecretRequest as bt, serve as c, AutomationRun as cn, unknown as cr, UpdateAutomationRequest as ct, createImageEngineRegistry as d, SessionStatus as dn, safeParse$1 as dr, FileWriteRequest as dt, KillSwitchRequest as en, looseObject as er, ListAutomationsQuery as et, IMAGE_ASPECT_RATIOS as f, DiffScope as fn, prettifyError as fr, ListInboxQuery as ft, CLAUDE_SDK_VERSION as g, RestoreFilesRequest as gn, RespondRequest as gt, claudeSdkSource as h, GitPushRequest as hn, ResolveInboxRequest as ht, killTree as i, isFactoryMode as in, preprocess as ir, TriageDecisionRequest as it, RunnerLock as j, InboxItem as jn, SttQuery as jt, UsageSettings as k, DEFAULT_VISION_PATH as kn, LOCAL_STT_SAMPLE_RATE as kt, upgradeWebSocket as l, TriagePolicy as ln, ZodError as lr, CreateProjectRequest as lt, ImageGenerationError as m, GitCommitRequest as mn, ReorderProjectsRequest as mt, readLock as n, ReviewVerdict as nn, object as nr, SetAutomationEnabledRequest as nt, tryDecodeURIComponent as o, Automation as on, string as or, UpcomingRunsQuery as ot, resolveImageOutput as p, EditQueuedMessageRequest as pn, ListSessionsQuery as pt, BrowserOpenRequest as q, array as qn, TriageIssueRequest as qt, isAlive as r, SetAutonomyModeRequest as rn, optional as rr, StarterSetRequest as rt, bufferToFormData as s, AutomationGuards as sn, union as sr, UpdateAutomationProjectSettingsRequest as st, startRunner as t, PutVisionRequest as tn, number$1 as tr, RunAutomationRequest as tt, ImageEngineRegistry as u, Session as un, toJSONSchema as ur, FileReadQuery as ut, installClaudeSdk as v, SpeechSummaryRequest as vn, SendMessageRequest as vt, ownNodeEnv as w, ConflictDecision as wn, UiClientMessage as wt, resolveNpm as x, RunnerCommandResults as xn, StartSessionRequest as xt, isClaudeSdkInstalled as y, TerminalClientMessage as yn, SessionStartMeta as yt, UpdateSessionRequest as z, McpServerTarget as zn, NOTICE_BATCH_CODE as zt };
+export { BrowserNavigateRequest as $, AgentConfigLocator as $n, NOTICE_BATCH_CODE as $t, SessionFileQuery as A, GitCommitRequest as An, RespondRequest as At, NetworkStatus as B, ConflictDecision as Bn, HealthResponse as Bt, isElectronRuntime as C, AutomationRun as Cn, string as Cr, CreateProjectRequest as Ct, CODEDEN_VERSION as D, SessionStatus as Dn, toJSONSchema as Dr, ListSessionsQuery as Dt, wrapper_default as E, Session as En, ZodError as Er, ListInboxQuery as Et, ListConflictsQuery as F, TerminalClientMessage as Fn, StartSessionRequest as Ft, SetNetworkPasswordResponse as G, DEFAULT_VISION_PATH as Gn, SttQuery as Gt, RemoteAccessFile as H, WorkKey as Hn, Settings as Ht, ListNoticesQuery as I, TerminalQuery as In, SteerRequest as It, ImageTestRequest as J, InboxItemKind as Jn, UpdateInstallRequest as Jt, SignInRequest as K, FactoryLimits as Kn, TtsRequest as Kt, ResolveConflictRequest as L, RunnerCommandResults as Ln, ThreadItemsQuery as Lt, RunnerToServerMessage as M, RestoreFilesRequest as Mn, SendMessageRequest as Mt, ServerLock as N, SessionResult as Nn, SessionStartMeta as Nt, UsageQuery as O, DiffScope as On, safeParse$1 as Or, ReorderProjectsRequest as Ot, ArchiveSessionRequest as P, SpeechSummaryRequest as Pn, SetSecretRequest as Pt, BrowserHistoryRequest as Q, AgentConfigListQuery as Qn, ConflictRecord as Qt, RoleMessageRequest as R, SessionOptions as Rn, UiClientMessage as Rt, acquireInstallLock as S, AutomationGuards as Sn, record as Sr, UpdateAutomationRequest as St, import_websocket_server as T, TriagePolicy as Tn, unknown as Tr, FileWriteRequest as Tt, SetNetworkAccessRequest as U, Project as Un, LOCAL_STT_SAMPLE_RATE as Ut, PASSWORD_RULE_TEXT as V, StartedBy as Vn, agentEventToNewEvent as Vt, SetNetworkPasswordRequest as W, sortProjects as Wn, LocalSttModelParams as Wt, BrowserClientMessage as X, AgentConfigDeleteQuery as Xn, compareVersions$1 as Xt, summarizeActivity as Y, messageFrom as Yn, UpdateStatus as Yt, BrowserDevServerRequest as Z, AgentConfigDiffRequest as Zn, isNewerVersion as Zt, importClaudeSdkFrom as _, SetAutonomyModeRequest as _n, looseObject as _r, StarterSetRequest as _t, Hono as a, GithubPr as an, ProviderId as ar, AutomationImportSource as at, runNpm as b, Automation as bn, optional as br, UpcomingRunsQuery as bt, createAdaptorServer as c, githubPrId as cn, _enum as cr, ImportAutomationsRequest as ct, createImageEngineRegistry as d, FactoryCandidate as dn, boolean as dr, AutomationProjectRequest as dt, CreateGithubIssueRequest as en, AgentConfigWriteRequest as er, BrowserNewTabRequest as et, IMAGE_ASPECT_RATIOS as f, FactoryTriageRequest as fn, custom as fr, CreateAutomationRequest as ft, CLAUDE_SDK_VERSION as g, ReviewVerdict as gn, literal as gr, SetAutomationEnabledRequest as gt, claudeSdkSource as h, PutVisionRequest as hn, intersection as hr, RunAutomationRequest as ht, killTree as i, GithubListQuery as in, AutonomyLevel as ir, AUTOMATION_IMPORT_LIMITS as it, RunnerLock as j, GitPushRequest as jn, SecretKey as jt, UsageSettings as k, EditQueuedMessageRequest as kn, prettifyError as kr, ResolveInboxRequest as kt, upgradeWebSocket as l, parseGithubPrId as ln, _null as lr, AutomationFileFrontmatter as lt, ImageGenerationError as m, KillSwitchRequest as mn, int as mr, ListAutomationsQuery as mt, readLock as n, GithubIssue as nn, McpServerTarget as nr, BrowserViewportRequest as nt, tryDecodeURIComponent as o, MergePrRequest as on, ReasoningEffort as or, DuplicateAutomationRequest as ot, resolveImageOutput as p, FactoryTuning as pn, discriminatedUnion as pr, ListAutomationRunsQuery as pt, passwordProblem as q, InboxItem as qn, AppPointer as qt, isAlive as r, GithubLabelRequest as rn, McpServerUpsertRequest as rr, BrowserWsQuery as rt, bufferToFormData as s, TriageIssueRequest as sn, datetime as sr, ExportAutomationsQuery as st, startRunner as t, GithubCommentRequest as tn, McpServerDiffRequest as tr, BrowserOpenRequest as tt, ImageEngineRegistry as u, DiscoveryArea as un, array as ur, AutomationGuardsPatch as ut, installClaudeSdk as v, isFactoryMode as vn, number$1 as vr, TriageDecisionRequest as vt, ownNodeEnv as w, AutomationTrigger as wn, union as wr, FileReadQuery as wt, resolveNpm as x, AutomationAction as xn, preprocess as xr, UpdateAutomationProjectSettingsRequest as xt, isClaudeSdkInstalled as y, Artifact as yn, object as yr, TriageReport as yt, UpdateSessionRequest as z, ProjectConfigFile as zn, UpdateProjectRequest as zt };
 
-//# sourceMappingURL=runner-CJetH9jW.js.map
+//# sourceMappingURL=runner-QPAnitMx.js.map