codeden 0.6.2 → 0.7.0

package/dist/{runner-DYf8dV43.js → runner-CQYh087M.js}

@@ -1,5 +1,5 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
-import { Bn as BROWSER_RELAY_SECRET_HEADER, Er as ReasoningEffort, Hn as RuntimeResponse, Vn as ProviderCapabilities, Wn as ProjectConfigFile, a as childEnv, d as RunnerLock, er as AgentEvent, i as listDescendants, ir as UserInput, m as ServerToRunnerMessage, n as killTree$1, nr as oneLineDescription, o as CODEDEN_VERSION, rr as winningCommands, t as isAlive$1, u as RunnerEventMessage, zn as SETUP_TAIL_LIMIT } from "./tree-CF7Q8tXK.js";
+import { $n as ProjectConfigFile, Hn as SETUP_TAIL_LIMIT, Un as BROWSER_RELAY_SECRET_HEADER, Xn as ProviderCapabilities, Yn as CODEDEN_CREDENTIAL_FILES, Zn as RuntimeResponse, a as childEnv, d as RunnerEventMessage, dr as mergeItemDeltas, f as RunnerLock, gr as UserInput, h as ServerToRunnerMessage, hr as itemDeltaText, i as listDescendants, lr as AgentEvent, mr as winningCommands, n as killTree$1, o as CODEDEN_VERSION, pr as oneLineDescription, qn as MAX_FOCUS_TYPE_CHARS, t as isAlive$1, zr as ReasoningEffort } from "./tree-Bjv-rXir.js";
 import { createRequire } from "node:module";
 import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { pathToFileURL } from "node:url";
@@ -3612,6 +3612,8 @@ var import_websocket = /* @__PURE__ */ __toESM(require_websocket(), 1);
 var import_websocket_server = /* @__PURE__ */ __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 // ../../packages/providers/src/adapter.ts
+/** `ProviderSessionError` code: the conversation doesn't hold the fork point it was asked for. */
+const FORK_POINT_MISSING = "fork_point_missing";
 /**
 * Session options ready to open (`SessionOptions.forkFrom`): with `forkFrom` and no
 * `resumeToken`, the conversation is copied first (`forkConversation`) and the session resumes
@@ -4513,6 +4515,52 @@ function parseClaudeAuthStatus(stdout) {
 		return unknown;
 	}
 }
+// ../../packages/providers/src/claude/fork.ts
+const reasonOf = (error) => error instanceof Error ? error.message : String(error);
+/**
+* Copy a Claude conversation with the SDK's `forkSession()`: the transcript is written to a new
+* session file at once (fresh message ids, the original untouched) and the new session id is
+* returned for resuming. With `upTo` (a turn's fork point: its last transcript message), the
+* copy ends with that message. A conversation that no longer holds it (replaced or deleted)
+* throws `FORK_POINT_MISSING` before anything is copied, so it never becomes a whole copy
+* instead: `confirmForkPoint` refuses it from the transcript read when it can, and otherwise
+* `forkSession()` does, as it slices the whole transcript file and refuses a message the file
+* doesn't hold before writing anything (SDK 0.3.318: `Message <uuid> not found in session <id>`).
+*/
+async function forkClaudeConversation(sdk, resumeToken, upTo) {
+	if (upTo) await confirmForkPoint(sdk, resumeToken, upTo);
+	try {
+		return (await sdk.forkSession(resumeToken, upTo ? { upToMessageId: upTo } : void 0)).sessionId;
+	} catch (error) {
+		if (upTo && refusedForkPoint(error, upTo)) throw forkPointMissing();
+		throw new Error(`Could not fork the Claude conversation ${resumeToken}: ${reasonOf(error)}`);
+	}
+}
+/**
+* Read the transcript (`getSessionMessages`) and refuse a fork point it doesn't hold. That read
+* follows `parentUuid` links back from the newest message, and a context compaction's boundary
+* has none, so in a compacted conversation it starts at the latest boundary (a `system`
+* message) and leaves out every earlier message, although the transcript file still holds
+* them. A fork point missing from such a read may be before the compaction, so `forkSession()`
+* decides then. An empty read (a conversation that was deleted) holds nothing.
+*/
+async function confirmForkPoint(sdk, resumeToken, upTo) {
+	let messages;
+	try {
+		messages = await sdk.getSessionMessages(resumeToken, { includeSystemMessages: true });
+	} catch (error) {
+		throw new Error(`Could not read the Claude conversation ${resumeToken}: ${reasonOf(error)}`);
+	}
+	if (!(messages[0]?.type === "system") && !messages.some((m) => m.uuid === upTo)) throw forkPointMissing();
+}
+/** Whether `forkSession()` refused `upTo` as a message its transcript doesn't hold. */
+function refusedForkPoint(error, upTo) {
+	const reason = reasonOf(error);
+	return reason.includes(upTo) && /\bnot found\b/i.test(reason);
+}
+function forkPointMissing() {
+	return new ProviderSessionError(FORK_POINT_MISSING, "The conversation no longer holds the end of that turn (it was replaced or deleted), so it can't be forked there");
+}
 // ../../packages/providers/src/util/model.ts
 /** The id the model pickers use for "the provider's own default model". */
 const DEFAULT_MODEL_ID = "default";
@@ -4524,8 +4572,26 @@ function explicitModel(model) {
 	const id = model?.trim();
 	return id && id !== "default" ? id : void 0;
 }
+// ../../packages/providers/src/policy/assessment.ts
+const SAFE = { risky: false };
+const risky = (action, reason) => ({
+	risky: true,
+	action,
+	reason
+});
+/** True for a verdict on CodeDen's own credential files. */
+const touchesCodeden = (risk) => risk.risky && risk.codeden === true;
+/**
+* The verdict for several checks of one action: CodeDen's own credentials first (a level may
+* allow an ordinary risk that comes before them), then the first risky one, else safe.
+*/
+function mostSevere(risks) {
+	return risks.find(touchesCodeden) ?? risks.find((r) => r.risky) ?? SAFE;
+}
 // ../../packages/providers/src/policy/paths.ts
+/** True when the context's paths are Windows paths. */
 const isWin = (ctx) => (ctx.platform ?? process.platform) === "win32";
+/** The path functions for the context's platform. */
 function pathApi(ctx) {
 	return isWin(ctx) ? path.win32 : path.posix;
 }
@@ -4542,6 +4608,8 @@ const HOME_VARS = /^(\$HOME|\$\{HOME\}|\$env:USERPROFILE|%USERPROFILE%)(?=$|[\\/
 * printed) is not the temp directory; PowerShell's and cmd's names are not.
 */
 const TEMP_VARS = [/^(\$TMPDIR|\$\{TMPDIR\}|\$TEMP|\$\{TEMP\}|\$TMP|\$\{TMP\})(?=$|[\\/])/, /^(\$env:TEMP|\$env:TMP|%TEMP%|%TMP%)(?=$|[\\/])/i];
+/** CodeDen's home variable, which agents inherit: case-sensitive in POSIX shells only. */
+const CODEDEN_HOME_VARS = [/^(\$CODEDEN_HOME|\$\{CODEDEN_HOME\})(?=$|[\\/])/, /^(\$env:CODEDEN_HOME|%CODEDEN_HOME%)(?=$|[\\/])/i];
 /**
 * Git Bash paths on Windows: `/c/Users/x` is `C:\Users\x`, and `/tmp` is the user's temp
 * directory.
@@ -4553,9 +4621,9 @@ function fromGitBash(value, temp) {
 	return value;
 }
 /**
-* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home or
-* temp variable) to an absolute path. On Windows the directory it resolves from may be in Git
-* Bash form too: the shell reports `/c/Users/x/repo` once a command has run in it.
+* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home, temp or
+* CodeDen home variable) to an absolute path. On Windows the directory it resolves from may be
+* in Git Bash form too: the shell reports `/c/Users/x/repo` once a command has run in it.
 */
 function resolveAgainst(target, ctx) {
 	const p = pathApi(ctx);
@@ -4563,6 +4631,8 @@ function resolveAgainst(target, ctx) {
 	const home = homeOf(ctx);
 	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) value = home + value.slice(1);
 	value = value.replace(HOME_VARS, home);
+	const codeden = ctx.codedenHome;
+	if (codeden) for (const vars of CODEDEN_HOME_VARS) value = value.replace(vars, codeden);
 	const temp = tempRootsOf(ctx)[0];
 	if (temp) for (const vars of TEMP_VARS) value = value.replace(vars, temp);
 	let base = ctx.dir ?? ctx.cwd;
@@ -4582,6 +4652,10 @@ function relative$1(root, target, ctx) {
 	const norm = (s) => isWin(ctx) ? p.resolve(s).toLowerCase() : p.resolve(s);
 	return p.relative(norm(root), norm(target));
 }
+/** True when two absolute paths name the same file. Case-insensitive on Windows. */
+function samePath(a, b, ctx) {
+	return relative$1(a, b, ctx) === "";
+}
 /** True when `target` is inside the worktree or one of the extra roots. */
 function isInWorkspace(target, ctx) {
 	const abs = resolveAgainst(target, ctx);
@@ -4698,13 +4772,6 @@ function isSecretPath(target) {
 	if (SECRET_EXTENSIONS.some((ext) => base.endsWith(ext))) return true;
 	return /(^|\/)\.(ssh|aws|gnupg|docker)\//i.test(normalized) && !base.endsWith(".pub");
 }
-// ../../packages/providers/src/policy/assessment.ts
-const SAFE = { risky: false };
-const risky = (action, reason) => ({
-	risky: true,
-	action,
-	reason
-});
 // ../../packages/providers/src/policy/git.ts
 /**
 * Git rules of the risk classifier (§11.2): force pushes, deleting refs, global config. `args`
@@ -5655,6 +5722,590 @@ function unixToIso(value) {
 	const ms = value < 0xe8d4a51000 ? value * 1e3 : value;
 	return new Date(ms).toISOString();
 }
+// ../../packages/providers/src/policy/codeden-home.ts
+/**
+* CodeDen's own credential files (§15): the install token, the runner lock and the remote
+* access store in its data directory. An agent holding the install token or the runner's token
+* could drive CodeDen itself and approve its own requests, so touching one asks at every level,
+* Full included, and is refused for read-only sessions (§11.2). The data directory comes from
+* the session (`SessionOptions.codedenHome`); without it, this rule is off.
+*/
+/** A risky verdict on CodeDen's own credentials, which every level asks about. */
+function credentialsRisk(reason) {
+	return {
+		risky: true,
+		action: "secrets",
+		reason,
+		codeden: true
+	};
+}
+/** The credential files in the session's CodeDen home, as absolute paths (none without one). */
+function codedenCredentialFiles(ctx) {
+	const home = ctx.codedenHome;
+	if (!home) return [];
+	const p = pathApi(ctx);
+	return CODEDEN_CREDENTIAL_FILES.map((file) => p.join(home, file));
+}
+/** The credential files, then the folders that hold them. */
+function guardedPaths(ctx) {
+	const files = codedenCredentialFiles(ctx);
+	const p = pathApi(ctx);
+	return [...files, ...new Set(files.map((file) => p.dirname(file)))];
+}
+const WILDCARD = /[*?[]/;
+/** `c` matched as itself in a regular expression. */
+const literalChar = (c) => c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* A shell wildcard (`*`, `?`, `[...]`, and `**`, which before a slash stands for zero or more
+* folders) over a `/`-separated path as a regular expression. Its first `literal` characters
+* match as themselves. Undefined when malformed.
+*/
+function wildcardPattern(pattern, ignoreCase, literal = 0) {
+	let source = pattern.slice(0, literal).replace(/[\s\S]/g, literalChar);
+	for (let i = literal; i < pattern.length; i += 1) {
+		const c = pattern[i];
+		if (c === "*" && pattern[i + 1] === "*") {
+			const folders = pattern[i + 2] === "/";
+			source += folders ? "(?:.*/)?" : ".*";
+			i += folders ? 2 : 1;
+		} else if (c === "*") source += "[^/]*";
+		else if (c === "?") source += "[^/]";
+		else if (c === "[" && pattern.indexOf("]", i + 2) > 0) {
+			const end = pattern.indexOf("]", i + 2);
+			const body = pattern.slice(i + 1, end).replace(/^!/, "^").replace(/\\/g, "\\\\");
+			source += `[${body}]`;
+			i = end;
+		} else source += literalChar(c);
+	}
+	try {
+		return new RegExp(`^${source}$`, ignoreCase ? "i" : "");
+	} catch {
+		return;
+	}
+}
+/** `/`-separated, for wildcard matching; Windows paths match in any case. */
+function slashes(value, ctx) {
+	return isWin(ctx) ? value.replace(/\\/g, "/") : value;
+}
+/**
+* Variables left in a resolved path (`$f`, `${f}`, `$env:F`, `%F%`) could be any name, so they
+* match like `*`. `$CODEDEN_HOME`, `$HOME` and the temp variables at the start resolve first.
+*/
+const PATH_VARIABLE = /\$\{\w+\}|\$env:\w+|\$\w+|%\w+%/gi;
+/**
+* How many leading characters of `abs` are CodeDen's home or a folder above it, at a folder
+* boundary. That part comes from the session (`$CODEDEN_HOME`, `~`, the working directory), so it
+* is always literal: `[`, `*`, `?` or `$` in the home's own path (`CodeDen [dev]`) are never a
+* pattern. Compared like `samePath`, in any case on Windows.
+*/
+function literalPrefix(abs, ctx) {
+	const home = ctx.codedenHome;
+	if (!home) return 0;
+	const p = pathApi(ctx);
+	const value = slashes(abs, ctx);
+	const fold = (s) => isWin(ctx) ? s.toLowerCase() : s;
+	for (let dir = p.resolve(home);; dir = p.dirname(dir)) {
+		const prefix = slashes(dir, ctx).replace(/\/$/, "");
+		const n = prefix.length;
+		const atBoundary = value.length === n || value[n] === "/";
+		if (n > 0 && atBoundary && fold(value.slice(0, n)) === fold(prefix)) return n;
+		if (p.dirname(dir) === dir) return 0;
+	}
+}
+/** `target` as an absolute path, the unknown variables it adds as wildcards. */
+function resolvePattern(target, ctx) {
+	const abs = resolveAgainst(target, ctx);
+	const literal = literalPrefix(abs, ctx);
+	return abs.slice(0, literal) + abs.slice(literal).replace(PATH_VARIABLE, "*");
+}
+/**
+* The wildcards in `abs` (from `resolvePattern`) as a regular expression over `/`-separated
+* paths, or undefined when it has none (or is malformed). Only the agent's part can be a pattern:
+* CodeDen's home, and the folders above it, match literally (`literalPrefix`).
+*/
+function agentPattern(abs, ctx) {
+	const value = slashes(abs, ctx);
+	const literal = literalPrefix(abs, ctx);
+	if (!WILDCARD.test(value.slice(literal))) return void 0;
+	return wildcardPattern(value, isWin(ctx), literal);
+}
+/**
+* True when `target` reaches one of CodeDen's credential files: the file itself, a folder that
+* holds one (`<home>`, `<home>/runner`: copying or searching it reads them), or a wildcard that
+* matches either. `~`, `$HOME`, `$CODEDEN_HOME` (and its PowerShell and cmd forms) and relative
+* paths resolve as in the shell. The home itself is always compared literally.
+*/
+function touchesCodedenCredentials(target, ctx) {
+	if (!ctx.codedenHome || !target.trim()) return false;
+	const abs = resolvePattern(target, ctx);
+	const guarded = guardedPaths(ctx);
+	if (guarded.some((p) => samePath(p, abs, ctx))) return true;
+	const pattern = agentPattern(abs, ctx);
+	return pattern !== void 0 && guarded.some((p) => pattern.test(slashes(p, ctx)));
+}
+// ../../packages/providers/src/policy/search-words.ts
+/**
+* Search commands (`grep`, `rg`, `findstr`, `Select-String`, ...) read as the tool reads them, for
+* the risk classifier (§11.2). Each word gets one role, once: an option, an option's value or an
+* operand. The pattern is an option's pattern value, or else the first operand. Because roles are
+* fixed in one pass, a value that looks like an option (`rg -r-e`: replacement text `-e`) is never
+* read as one, and a word that looks like a pattern option is never skipped as a value.
+*/
+/** Search commands, whose first operand is the pattern (`grep -rn "process.env" src`). */
+const SEARCHES = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep",
+	"rg",
+	"ag",
+	"ack",
+	"findstr",
+	"select-string",
+	"sls"
+]);
+/** Options that take the next word as their value, per search tool. */
+const GREP_VALUED = [
+	"-A",
+	"-B",
+	"-C",
+	"-m",
+	"-d",
+	"-D",
+	"--after-context",
+	"--before-context",
+	"--context",
+	"--max-count",
+	"--include",
+	"--exclude",
+	"--exclude-dir",
+	"--label",
+	"--binary-files",
+	"--devices",
+	"--directories"
+];
+const RG_VALUED = [
+	...GREP_VALUED,
+	"-g",
+	"--glob",
+	"--iglob",
+	"-t",
+	"--type",
+	"-T",
+	"--type-not",
+	"-j",
+	"--threads",
+	"--max-depth",
+	"-M",
+	"--max-columns",
+	"--sort",
+	"--sortr",
+	"-r",
+	"--replace",
+	"--colors",
+	"-E",
+	"--encoding"
+];
+const SELECT_STRING_VALUED = [
+	"-path",
+	"-literalpath",
+	"-include",
+	"-exclude",
+	"-encoding",
+	"-context"
+];
+/** Tools whose option names are matched in any case (names are kept in lower case). */
+const ANY_CASE = /* @__PURE__ */ new Set([
+	"findstr",
+	"select-string",
+	"sls"
+]);
+/**
+* Tools whose short options combine in one word, the getopt way (`-ne.` is `-n -e .`), and whose
+* `-e` and `-f` take a value. `ag -f` and `ack -f` take none, so their words stay as written.
+*/
+const CLUSTERING = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep",
+	"rg"
+]);
+/** Options whose value is the search pattern. */
+const PATTERN_OPTIONS = [
+	"-e",
+	"--regexp",
+	"-pattern",
+	"/c"
+];
+/** Options that give the pattern another way, a pattern file: then no operand is the pattern. */
+const isPatternFile = (name) => name === "-f" || name.startsWith("--file") || name === "/g";
+/** True when the option `name` takes the next word as its value. */
+function takesValue(bin, name) {
+	if ([
+		"-e",
+		"--regexp",
+		"-pattern",
+		"-f",
+		"--file"
+	].includes(name)) return true;
+	if (bin === "rg") return RG_VALUED.includes(name);
+	if (bin === "select-string" || bin === "sls") return SELECT_STRING_VALUED.includes(name);
+	return GREP_VALUED.includes(name);
+}
+/** An option word's value bound with `=` or `:` (`--glob=x`, `-Path:x`, `/c:x`). */
+const BOUND = /^(--?[A-Za-z][\w-]*|\/[A-Za-z])[=:]/;
+/** Parse a search command's arguments (after the program name) into roles. */
+function parseSearch(bin, args) {
+	const words = [];
+	const add = (text, role, arg, from = 0, option) => words.push({
+		text,
+		role,
+		option,
+		arg,
+		from,
+		pattern: false
+	});
+	const fold = (name) => ANY_CASE.has(bin) ? name.toLowerCase() : name;
+	const isOption = (a) => a.startsWith("-") || bin === "findstr" && a.startsWith("/");
+	let operandsOnly = false;
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		if (operandsOnly || !isOption(a)) add(a, "operand", i);
+		else if (a === "--") {
+			operandsOnly = true;
+			add(a, "option", i, 0, a);
+		} else if (CLUSTERING.has(bin) && /^-[^-]./.test(a)) for (let j = 1; j < a.length; j += 1) {
+			const flag = `-${a[j]}`;
+			add(flag, "option", -1, 0, flag);
+			if (!takesValue(bin, flag)) continue;
+			if (j + 1 < a.length) add(a.slice(j + 1), "value", i, j + 1, flag);
+			else if (i + 1 < args.length) add(args[++i], "value", i, 0, flag);
+			break;
+		}
+		else {
+			const bound = BOUND.exec(a);
+			const name = fold(bound?.[1] ?? a);
+			add(a, "option", i, 0, name);
+			if (!bound && takesValue(bin, name) && i + 1 < args.length) add(args[++i], "value", i, 0, name);
+		}
+	}
+	markPatterns(words);
+	return words;
+}
+/**
+* Mark the pattern words: the values of `-e`, `--regexp`, `-Pattern` and `findstr /c:`, or, when
+* no option gives the pattern (nor a pattern file, `-f`), the first operand.
+*/
+function markPatterns(words) {
+	let explicit = false;
+	for (const w of words) {
+		const name = w.option ?? "";
+		if (w.role === "value" && PATTERN_OPTIONS.includes(name)) {
+			w.pattern = true;
+			explicit = true;
+		} else if (w.role === "option" && PATTERN_OPTIONS.includes(name)) {
+			explicit = true;
+			if (w.text.length > name.length) w.pattern = true;
+		} else if (w.role === "option" && isPatternFile(name)) explicit = true;
+	}
+	if (explicit) return;
+	const first = words.find((w) => w.role === "operand");
+	if (first) first.pattern = true;
+}
+/** The file operands of a parsed search (`grep -r -e x src lib` -> `src`, `lib`). */
+function searchOperands(words) {
+	return words.filter((w) => w.role === "operand" && !w.pattern);
+}
+/** The values given to the named options: `name X`, `name=X`, or in a cluster (`-gX`). */
+function searchOptionValues(words, names) {
+	return words.flatMap((w) => {
+		if (!w.option || !names.includes(w.option)) return [];
+		if (w.role === "value") return [w.text];
+		return w.role === "option" && w.text.length > w.option.length ? [w.text.slice(w.option.length + 1)] : [];
+	});
+}
+// ../../packages/providers/src/policy/secrets.ts
+/**
+* Secrets rules of the risk classifier (§11.2): which words of a command read a credentials
+* file, and which commands dump the environment. Writing a secrets file inside the worktree is
+* not access (`cp .env.example .env`); reading one is.
+*/
+/**
+* The argument as a path, or undefined when it can't be one: inline code, multi-line text
+* or anything with shell or code punctuation (`selected={row.key`) is not a file name. A
+* variable in braces (`${HOME}/.env`) is a path, and so is an option's value: `--file=x`, or
+* PowerShell's colon-bound `-Path:x` and `-LiteralPath:x`.
+*/
+function asPath(arg) {
+	const value = arg.replace(/^-+[a-z-]*=/i, "").replace(/^-[a-z][a-z-]*:(?=.)/i, "");
+	if (!value || /[\n\r{}()<>|;=`]/.test(value.replace(/\$\{\w+\}/g, ""))) return void 0;
+	return value;
+}
+/** Commands whose words are data or only checked for existence (`echo .env >> .gitignore`). */
+const DATA = /* @__PURE__ */ new Set([
+	"echo",
+	"printf",
+	"write-output",
+	"write-host",
+	"test",
+	"[",
+	"[["
+]);
+/** Commands that list or describe files without reading them (`ls certs/*.pem`). */
+const LISTS = /* @__PURE__ */ new Set([
+	"ls",
+	"dir",
+	"get-childitem",
+	"gci",
+	"find",
+	"fd",
+	"tree",
+	"stat",
+	"du",
+	"test-path"
+]);
+/**
+* The first argument that reads a credentials file, if any. `written` are the paths the command
+* writes (a copy's destination), which classifyWrite judges instead. `isSecret` decides which
+* paths count (default: secrets files by name). `paths` gives what a word may stand for (each
+* element of a PowerShell list, `shell.wordPaths`). A search's patterns are skipped whole, list
+* elements included: the tool searches for them, not in them.
+*/
+function secretArgument(bin, args, written = [], isSecret = isSecretPath, paths = (word, from) => [word.slice(from)]) {
+	if (DATA.has(bin)) return void 0;
+	const runs = (bin === "find" || bin === "fd") && args.some((a) => /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/.test(a));
+	if (LISTS.has(bin) && !runs) return void 0;
+	return (SEARCHES.has(bin) ? parseSearch(bin, args) : args.map((text, arg) => ({
+		text,
+		arg,
+		from: 0,
+		pattern: false
+	}))).find((w) => {
+		if (w.pattern || written.includes(w.text)) return false;
+		return (w.arg >= 0 ? paths(args[w.arg], w.from) : [w.text]).some((word) => braceAlternatives(word).some((alt) => {
+			const value = asPath(alt);
+			return value !== void 0 && isSecret(value);
+		}));
+	})?.text;
+}
+/** The most words one argument's brace expansion is followed to. */
+const MAX_ALTERNATIVES = 64;
+/**
+* The words a shell's brace expansion makes of `word` (`~/.ssh/{id_rsa,x}` -> `~/.ssh/id_rsa`,
+* `~/.ssh/x`), capped; just `word` when it has no `{a,b}` group.
+*/
+function braceAlternatives(word) {
+	const group = /\{([^{}]*,[^{}]*)\}/.exec(word);
+	if (!group?.[1]) return [word];
+	const before = word.slice(0, group.index);
+	const after = word.slice(group.index + group[0].length);
+	const out = [];
+	for (const part of group[1].split(",")) for (const alt of braceAlternatives(before + part + after)) {
+		if (out.length >= MAX_ALTERNATIVES) return out;
+		out.push(alt);
+	}
+	return out;
+}
+/** Files a tool writes through its own options (`openssl req -keyout key.pem -out cert.pem`). */
+function toolOutputs(bin, args) {
+	if (bin !== "openssl" && bin !== "ssh-keygen") return [];
+	const flags = bin === "openssl" ? ["-out", "-keyout"] : ["-f"];
+	return args.flatMap((a, i) => flags.includes(a) && args[i + 1] ? [args[i + 1]] : []);
+}
+/** Variable names that may hold a credential. */
+const SECRET_VAR = /key|token|secret|passw|pwd|credential|auth|private|session|cookie/i;
+/**
+* True for `printenv` and `Get-ChildItem env:` listings. Printing named variables that don't
+* look like credentials (`printenv PATH`, `Get-ChildItem env:NODE_ENV`) is not a dump.
+*/
+function dumpsEnvironment(bin, args) {
+	const named = (names) => names.length > 0 && names.every((n) => /^\w+$/.test(n) && !SECRET_VAR.test(n));
+	if (bin === "printenv") return !named(args.filter((a) => !a.startsWith("-")));
+	if (!/^(get-childitem|gci|ls|dir)$/.test(bin)) return false;
+	const drives = args.filter((a) => /^env:/i.test(a));
+	return drives.length > 0 && !named(drives.map((a) => a.slice(4)));
+}
+// ../../packages/providers/src/policy/codeden-search.ts
+/** The values of an option, given as `name X`, `name=X` or `name:X`, each time it appears. */
+function optionValues(args, names, anyCase) {
+	const out = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		const word = anyCase ? a.toLowerCase() : a;
+		if (names.includes(word)) {
+			if (i + 1 < args.length) out.push(args[i + 1]);
+			i += 1;
+			continue;
+		}
+		const bound = names.find((n) => word.startsWith(`${n}=`) || word.startsWith(`${n}:`));
+		if (bound) out.push(a.slice(bound.length + 1));
+	}
+	return out;
+}
+const GREPS = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep"
+]);
+/** `grep -r`, `-R`, `-rn`, `--recursive`, `-d recurse`: grep reads folders only then. */
+function grepRecursive(words) {
+	return words.some((w) => w.role === "option" && /^(-r|-R|--recursive|--dereference-recursive)$/.test(w.text)) || searchOptionValues(words, ["-d", "--directories"]).includes("recurse");
+}
+/**
+* The folders a search reads recursively, with its name filters. Roles come from `parseSearch`
+* (`grep -re. ~` is `grep -r -e . ~`; in `rg -r-g x ~`, `-g` is replacement text, not a filter),
+* and each root may be a PowerShell list (`paths`).
+*/
+function searchWalks(bin, args, ctx, paths) {
+	const words = parseSearch(bin, args);
+	const operands = searchOperands(words).flatMap((w) => paths(args[w.arg], w.from));
+	if (bin === "rg" || bin === "ag" || bin === "ack") return [{
+		roots: operands,
+		recursive: true,
+		names: bin === "rg" ? searchOptionValues(words, [
+			"-g",
+			"--glob",
+			"--iglob"
+		]).filter((n) => !n.startsWith("!")) : []
+	}];
+	if (GREPS.has(bin)) {
+		if (!grepRecursive(words)) return [];
+		return [{
+			roots: operands,
+			recursive: true,
+			names: searchOptionValues(words, ["--include"])
+		}];
+	}
+	const sub = words.some((w) => w.role === "option" && /^\/[a-z]*s[a-z]*$/i.test(w.text));
+	if (bin === "findstr" && sub) {
+		const p = pathApi(ctx);
+		return operands.map((operand) => ({
+			roots: [p.dirname(operand)],
+			recursive: true,
+			names: [p.basename(operand)]
+		}));
+	}
+	return [];
+}
+const LISTINGS = /* @__PURE__ */ new Set([
+	"get-childitem",
+	"gci",
+	"dir",
+	"ls"
+]);
+const LISTING_VALUED = [
+	"-filter",
+	"-include",
+	"-exclude",
+	"-depth",
+	"-attributes"
+];
+/** `find -exec cat {} +` and `fd -x cat` hand what they find to a command. */
+const RUNS = /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/;
+/** The folders a listing goes through, with its name filters. */
+function listingWalk(bin, args) {
+	if (bin === "find") {
+		const end = args.findIndex((a) => /^[-(!)]/.test(a));
+		const either = args.some((a) => [
+			"-o",
+			"-or",
+			"!",
+			"-not"
+		].includes(a));
+		return {
+			roots: end < 0 ? args : args.slice(0, end),
+			recursive: true,
+			names: either ? [] : optionValues(args, ["-name", "-iname"], false)
+		};
+	}
+	if (bin === "fd") return {
+		roots: args.filter((a) => !a.startsWith("-")).slice(1),
+		recursive: true,
+		names: []
+	};
+	if (!LISTINGS.has(bin)) return void 0;
+	const recursive = args.some((a) => /^-rec/i.test(a) || a === "-r" || /^-[a-zA-Z]*R[a-zA-Z]*$/.test(a) || /^\/s$/i.test(a));
+	const named = optionValues(args, ["-path", "-literalpath"], true);
+	const positional = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		const lower = a.toLowerCase();
+		if (LISTING_VALUED.includes(lower) || lower === "-path" || lower === "-literalpath") i += 1;
+		else if (!a.startsWith("-") && !/^\/[a-z](:\S*)?$/i.test(a)) positional.push(a);
+	}
+	return {
+		roots: [...named, ...positional].flatMap((root) => root.split(",")),
+		recursive,
+		names: optionValues(args, ["-filter", "-include"], true).flatMap((n) => n.split(","))
+	};
+}
+/**
+* True when listing `dir` (and, recursively, its subfolders) reaches `folder`: by its path, or
+* through the wildcards the agent wrote in it (never ones in CodeDen's home path).
+*/
+function holds(dir, folder, recursive, ctx) {
+	if (recursive ? isInside$1(folder, dir, ctx) : samePath(dir, folder, ctx)) return true;
+	const pattern = agentPattern(dir, ctx);
+	if (!pattern) return false;
+	const p = pathApi(ctx);
+	for (let at = folder;; at = p.dirname(at)) {
+		if (pattern.test(slashes(at, ctx))) return true;
+		if (!recursive || p.dirname(at) === at) return false;
+	}
+}
+/** True when `file`, found under `root`, passes one of the name filters (or there are none). */
+function keeps(names, file, root, ctx) {
+	if (names.length === 0) return true;
+	const p = pathApi(ctx);
+	const base = p.basename(file);
+	const below = slashes(p.relative(root, file), ctx);
+	return names.flatMap((name) => braceAlternatives(name.trim().replace(/^\.[\\/]/, ""))).some((name) => {
+		const pattern = wildcardPattern(slashes(name, ctx), true);
+		if (!pattern) return true;
+		return /[\\/]/.test(name) ? pattern.test(below) : pattern.test(base);
+	});
+}
+/** The root of `walk` from which it reaches a credential file, if any. */
+function walkReaches(walk, ctx) {
+	const files = codedenCredentialFiles(ctx);
+	const p = pathApi(ctx);
+	for (const root of walk.roots.length ? walk.roots : ["."]) for (const alt of braceAlternatives(root)) {
+		const dir = resolvePattern(alt, ctx);
+		if (files.some((file) => holds(dir, p.dirname(file), walk.recursive, ctx) && keeps(walk.names, file, dir, ctx))) return root;
+	}
+}
+/**
+* A recursive search from `roots` (Claude's Grep), keeping files whose names match `names`:
+* the root it reaches a credential file from, if any.
+*/
+function searchReaches(roots, names, ctx) {
+	return ctx.codedenHome ? walkReaches({
+		roots,
+		recursive: true,
+		names
+	}, ctx) : void 0;
+}
+/**
+* How a command reaches CodeDen's credential files other than by naming one: a recursive search
+* from a folder above them, or a listing (or `echo`ed path) whose output `feeds` another command.
+* `paths` gives what a word may stand for (a PowerShell list's elements). Returns the word it
+* reaches them through.
+*/
+function reachesThroughFolder(bin, args, ctx, feeds, paths = (word, from) => [word.slice(from)]) {
+	if (!ctx.codedenHome) return void 0;
+	if (SEARCHES.has(bin)) for (const walk of searchWalks(bin, args, ctx, paths)) {
+		const root = walkReaches(walk, ctx);
+		if (root) return root;
+	}
+	if (feeds || (bin === "find" || bin === "fd") && args.some((a) => RUNS.test(a))) {
+		const walk = listingWalk(bin, args);
+		const root = walk && walkReaches(walk, ctx);
+		if (root) return root;
+	}
+	if (feeds && DATA.has(bin)) return args.find((a) => paths(a, 0).some((path) => touchesCodedenCredentials(path, ctx)));
+}
 // ../../packages/providers/src/util/git-head.ts
 /**
 * The branch checked out in the repository at `dir` (its `.git` folder, or the `gitdir:` a
@@ -5911,186 +6562,32 @@ function runsStdin(cmd) {
 	const args = tokens.slice(1);
 	for (let i = 0; i < args.length; i += 1) {
 		const arg = args[i];
-		if (arg === "--") return isStdin(args[i + 1]);
-		if (!/^[-+]./.test(arg)) return isStdin(arg);
-		if (spec.stdin?.(arg)) return true;
-		if (spec.program(arg)) return !arg.includes("=") && isStdin(args[i + 1]);
-		if (spec.valued(arg)) i += 1;
-	}
-	return true;
-}
-// ../../packages/providers/src/policy/secrets.ts
-/**
-* Secrets rules of the risk classifier (§11.2): which words of a command read a credentials
-* file, and which commands dump the environment. Writing a secrets file inside the worktree is
-* not access (`cp .env.example .env`); reading one is.
-*/
-/**
-* The argument as a path, or undefined when it can't be one: inline code, multi-line text
-* or anything with shell or code punctuation (`selected={row.key`) is not a file name.
-*/
-function asPath(arg) {
-	const value = arg.replace(/^-+[a-z-]*=/i, "");
-	if (!value || /[\n\r{}()<>|;=`]/.test(value)) return void 0;
-	return value;
-}
-/** Commands whose words are data or only checked for existence (`echo .env >> .gitignore`). */
-const DATA = /* @__PURE__ */ new Set([
-	"echo",
-	"printf",
-	"write-output",
-	"write-host",
-	"test",
-	"[",
-	"[["
-]);
-/** Commands that list or describe files without reading them (`ls certs/*.pem`). */
-const LISTS = /* @__PURE__ */ new Set([
-	"ls",
-	"dir",
-	"get-childitem",
-	"gci",
-	"find",
-	"fd",
-	"tree",
-	"stat",
-	"du",
-	"test-path"
-]);
-/** Search commands, whose first operand is the pattern (`grep -rn "process.env" src`). */
-const SEARCHES = /* @__PURE__ */ new Set([
-	"grep",
-	"egrep",
-	"fgrep",
-	"zgrep",
-	"rg",
-	"ag",
-	"ack",
-	"findstr",
-	"select-string",
-	"sls"
-]);
-/** Options that take the next word as their value, per search tool. */
-const GREP_VALUED = [
-	"-A",
-	"-B",
-	"-C",
-	"-m",
-	"-d",
-	"-D",
-	"--after-context",
-	"--before-context",
-	"--context",
-	"--max-count",
-	"--include",
-	"--exclude",
-	"--exclude-dir",
-	"--label",
-	"--binary-files",
-	"--devices",
-	"--directories"
-];
-const RG_VALUED = [
-	...GREP_VALUED,
-	"-g",
-	"--glob",
-	"--iglob",
-	"-t",
-	"--type",
-	"-T",
-	"--type-not",
-	"-j",
-	"--threads",
-	"--max-depth",
-	"-M",
-	"--max-columns",
-	"--sort",
-	"--sortr",
-	"-r",
-	"--replace",
-	"--colors",
-	"-E",
-	"--encoding"
-];
-const SELECT_STRING_VALUED = [
-	"-path",
-	"-literalpath",
-	"-include",
-	"-exclude",
-	"-encoding",
-	"-context"
-];
-function searchValued(bin, arg) {
-	if (bin === "rg") return RG_VALUED.includes(arg);
-	if (bin === "select-string" || bin === "sls") return SELECT_STRING_VALUED.includes(arg.toLowerCase());
-	return GREP_VALUED.includes(arg);
-}
-/**
-* The search pattern words of a search command: `-e`/`--regexp`/`-Pattern` values, or the first
-* operand when the pattern isn't given by an option (or a pattern file, `-f`). `findstr`'s
-* `/c:"text"` is a pattern too.
-*/
-function searchPatterns(bin, args) {
-	const patterns = /* @__PURE__ */ new Set();
-	let explicit = false;
-	for (let i = 0; i < args.length; i += 1) {
-		const a = args[i];
-		if (a === "-e" || a === "--regexp" || /^-pattern$/i.test(a)) {
-			explicit = true;
-			const value = args[i + 1];
-			if (value !== void 0) patterns.add(value);
-			i += 1;
-		} else if (a.startsWith("--regexp=") || /^\/c:/i.test(a)) {
-			explicit = true;
-			patterns.add(a);
-		} else if (a === "-f" || a.startsWith("--file") || /^\/g:/i.test(a)) explicit = true;
-	}
-	if (explicit) return patterns;
-	for (let i = 0; i < args.length; i += 1) {
-		const a = args[i];
-		if (searchValued(bin, a)) i += 1;
-		else if (!a.startsWith("-") && !(bin === "findstr" && a.startsWith("/"))) {
-			patterns.add(a);
-			break;
-		}
+		if (arg === "--") return isStdin(args[i + 1]);
+		if (!/^[-+]./.test(arg)) return isStdin(arg);
+		if (spec.stdin?.(arg)) return true;
+		if (spec.program(arg)) return !arg.includes("=") && isStdin(args[i + 1]);
+		if (spec.valued(arg)) i += 1;
 	}
-	return patterns;
-}
-/**
-* The first argument that reads a credentials file, if any. `written` are the paths the command
-* writes (a copy's destination), which classifyWrite judges instead.
-*/
-function secretArgument(bin, args, written = []) {
-	if (DATA.has(bin)) return void 0;
-	const runs = (bin === "find" || bin === "fd") && args.some((a) => /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/.test(a));
-	if (LISTS.has(bin) && !runs) return void 0;
-	const patterns = SEARCHES.has(bin) ? searchPatterns(bin, args) : /* @__PURE__ */ new Set();
-	return args.find((a) => {
-		if (patterns.has(a) || written.includes(a)) return false;
-		const value = asPath(a);
-		return value !== void 0 && isSecretPath(value);
-	});
-}
-/** Files a tool writes through its own options (`openssl req -keyout key.pem -out cert.pem`). */
-function toolOutputs(bin, args) {
-	if (bin !== "openssl" && bin !== "ssh-keygen") return [];
-	const flags = bin === "openssl" ? ["-out", "-keyout"] : ["-f"];
-	return args.flatMap((a, i) => flags.includes(a) && args[i + 1] ? [args[i + 1]] : []);
+	return true;
 }
-/** Variable names that may hold a credential. */
-const SECRET_VAR = /key|token|secret|passw|pwd|credential|auth|private|session|cookie/i;
+// ../../packages/providers/src/policy/shell.ts
 /**
-* True for `printenv` and `Get-ChildItem env:` listings. Printing named variables that don't
-* look like credentials (`printenv PATH`, `Get-ChildItem env:NODE_ENV`) is not a dump.
+* The paths a word of `cmd` may stand for, from `from` on: its text and, for a PowerShell list
+* (`a,b`), each element. The whole text stays: when the shell is unknown it may be one name, or a
+* brace expansion (`{a,b}`). Callers apply it after reading the word's role, so a list given as a
+* search pattern stays data.
 */
-function dumpsEnvironment(bin, args) {
-	const named = (names) => names.length > 0 && names.every((n) => /^\w+$/.test(n) && !SECRET_VAR.test(n));
-	if (bin === "printenv") return !named(args.filter((a) => !a.startsWith("-")));
-	if (!/^(get-childitem|gci|ls|dir)$/.test(bin)) return false;
-	const drives = args.filter((a) => /^env:/i.test(a));
-	return drives.length > 0 && !named(drives.map((a) => a.slice(4)));
+function wordPaths(cmd, word, from = 0) {
+	const text = word.slice(from);
+	const commas = cmd.lists?.get(word)?.filter((at) => at >= from) ?? [];
+	if (!commas.length) return [text];
+	const bounds = [
+		from - 1,
+		...commas,
+		word.length
+	];
+	return [text, ...bounds.slice(1).map((end, k) => word.slice(bounds[k] + 1, end)).filter(Boolean)];
 }
-// ../../packages/providers/src/policy/shell.ts
 /** Parse a command line into its simple commands. */
 function parseShell(src, dialect = "auto") {
 	return new Lexer(src, dialect).list(null);
@@ -6111,6 +6608,8 @@ var Builder = class {
 	target = "word";
 	heredocStrip = false;
 	heredocs = [];
+	/** Where the word's unquoted commas are: a PowerShell list's element boundaries. */
+	commas = [];
 	constructor(out) {
 		this.out = out;
 	}
@@ -6118,6 +6617,11 @@ var Builder = class {
 		this.word += text;
 		this.inWord = true;
 	}
+	/** An unquoted comma, which separates a PowerShell list's elements (`a,b`). */
+	addComma() {
+		this.commas.push(this.word.length);
+		this.add(",");
+	}
 	endWord() {
 		if (!this.inWord) return;
 		if (this.target === "write") this.cmd.writes.push(this.word);
@@ -6125,10 +6629,24 @@ var Builder = class {
 			delim: this.word.replace(/\\/g, ""),
 			strip: this.heredocStrip
 		});
-		else if (this.target === "word") this.cmd.words.push(this.word);
+		else if (this.target === "word") {
+			this.cmd.words.push(this.word);
+			if (this.commas.length) this.addList();
+		} else if (this.target === "skip") this.cmd.input = [...this.cmd.input ?? [], this.word];
 		this.target = "word";
 		this.word = "";
 		this.inWord = false;
+		this.commas = [];
+	}
+	/**
+	* Note where the current word's unquoted commas are. The same text written twice with different
+	* quoting keeps every comma either one had, so its list is never missed.
+	*/
+	addList() {
+		this.cmd.lists ??= /* @__PURE__ */ new Map();
+		const seen = this.cmd.lists.get(this.word) ?? [];
+		const commas = [.../* @__PURE__ */ new Set([...seen, ...this.commas])].sort((a, b) => a - b);
+		this.cmd.lists.set(this.word, commas);
 	}
 	endCommand() {
 		this.endWord();
@@ -6205,6 +6723,9 @@ var Lexer = class {
 				this.i += 1;
 				b.cmd.nested.push(this.list(")"));
 				b.add(src.slice(start, this.i));
+			} else if (c === "," && this.dialect !== "posix") {
+				b.addComma();
+				this.i += 1;
 			} else {
 				b.add(c);
 				this.i += 1;
@@ -6347,12 +6868,62 @@ const MAX_DEPTH = 4;
 * Classify a shell command (any shell: POSIX, PowerShell or cmd). Downloads piped into an
 * interpreter (`curl … | sh`, `irm … | iex`) are found on the parsed pipeline in
 * `classifyList`; here, a download run through a substitution (`iex (irm …)`,
-* `bash -c "$(curl …)"`, `bash <(curl …)`).
+* `bash -c "$(curl …)"`, `bash <(curl …)`). CodeDen's own credentials are looked for first,
+* across the whole command, so an earlier ordinary risk (`cat .env; …`) can't hide them.
 */
 function classifyCommand(command, ctx) {
+	const list = parseShell(command, ctx.shell ?? "auto");
+	const credentials = credentialAccess(list, ctx, 0);
+	if (credentials) return credentials;
 	if (/\b(iex|invoke-expression)\b[^|]*\b(irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/i.test(command)) return risky("network", "Executes a downloaded script");
 	if (/\b(bash|sh|zsh)\s+(-c\s+)?["']?\$\(\s*(curl|wget)\b/i.test(command) || /<\(\s*(curl|wget)\b/i.test(command)) return risky("network", "Executes a downloaded script");
-	return classifyList(parseShell(command, ctx.shell ?? "auto"), ctx, 0);
+	return classifyList(list, ctx, 0);
+}
+/**
+* The first access to CodeDen's own credential files anywhere in `list`: substitutions,
+* subshells and inline scripts (`bash -c "…"`) included, following `cd` like `classifyList`.
+* `feeds`: the list's output is used by another command (it sits in a substitution or a pipe).
+*/
+function credentialAccess(list, ctx, depth, feeds = false) {
+	let here = ctx;
+	for (const [i, cmd] of list.entries()) {
+		for (const nested of cmd.nested) {
+			const found = credentialAccess(nested, here, depth, true);
+			if (found) return found;
+		}
+		const piped = list[i + 1]?.piped === true;
+		const found = credentialCommand(cmd, here, depth, feeds || piped);
+		if (found) return found;
+		here = afterCd(cmd, here);
+	}
+}
+/** The paths each word of `cmd` may stand for: itself, and a PowerShell list's elements. */
+const pathsOf = (cmd) => (word, from) => wordPaths(cmd, word, from);
+/**
+* One simple command's access to CodeDen's credentials: a redirect onto one, any argument (or
+* here-string) that reaches one (read, written, copied or deleted), or a search or listing that
+* reaches one from a folder above it (`./codeden-search`). Moving into CodeDen's home with `cd`
+* reads nothing; the command that then reads is caught.
+*/
+function credentialCommand(cmd, ctx, depth, feeds) {
+	const { tokens } = unwrap(cmd.words);
+	const bin = binName(tokens[0]);
+	const args = tokens.slice(1);
+	const script = inlineScript(bin, args);
+	if (script && depth < MAX_DEPTH) {
+		const inner = credentialAccess(parseShell(script.text, script.dialect), ctx, depth + 1, feeds);
+		if (inner) return inner;
+	}
+	for (const target of cmd.writes) if (!DISCARD.test(target) && touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Writes CodeDen's own credentials: ${target}`);
+	const given = (cmd.input ?? []).find((word) => touchesCodedenCredentials(word, ctx));
+	if (given) return credentialsRisk(`Passes CodeDen's own credentials: ${given}`);
+	if (CD.has(bin)) return void 0;
+	const paths = pathsOf(cmd);
+	const reads = (a) => touchesCodedenCredentials(a, ctx);
+	const touched = secretArgument(bin, args, [], reads, paths);
+	if (touched) return credentialsRisk(`Accesses CodeDen's own credentials: ${touched}`);
+	const through = reachesThroughFolder(bin, args, ctx, feeds, paths);
+	return through ? credentialsRisk(`Reaches CodeDen's own credentials from ${through}`) : void 0;
 }
 /**
 * Classify commands in order. A `cd` moves where later relative paths resolve; commands in
@@ -6392,10 +6963,17 @@ function afterCd(cmd, ctx) {
 		dir: resolveAgainst(target, ctx)
 	};
 }
-/** The value after a PowerShell-style named parameter (`-Path x`), if present. */
+/**
+* The value of a PowerShell-style named parameter, if present: `-Path x`, or bound with a
+* colon, `-Path:x`.
+*/
 function namedArg(args, names) {
-	const i = args.findIndex((a) => names.includes(a.toLowerCase()));
-	return i >= 0 ? args[i + 1] : void 0;
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i].toLowerCase();
+		if (names.includes(arg)) return args[i + 1];
+		const bound = names.find((name) => arg.startsWith(`${name}:`));
+		if (bound) return args[i].slice(bound.length + 1);
+	}
 }
 /** The script of an inline shell invocation (`bash -c "…"`, `pwsh -Command …`, `cmd /c …`). */
 function inlineScript(bin, args) {
@@ -6478,7 +7056,7 @@ function classifySimple(cmd, ctx, depth) {
 		const write = classifyWrite(target, ctx);
 		if (write.risky) return write;
 	}
-	const secret = secretArgument(bin, args, written);
+	const secret = secretArgument(bin, args, written, isSecretPath, pathsOf(cmd));
 	if (secret) return risky("secrets", `Accesses the secrets file ${secret}`);
 	if (dumpsEnvironment(bin, args)) return risky("secrets", "Dumps environment variables");
 	return SAFE;
@@ -6535,18 +7113,36 @@ function copyTargets(bin, args, dest, ctx) {
 * Classify a file write/edit. The worktree, extra roots and OS temp are fine, secrets files in
 * the worktree included: writing one (`cp .env.example .env`) reads nothing. A secrets file in
 * temp counts as outside the worktree, so Full autonomy (which only asks for writes outside the
-* worktree) still asks for it.
+* worktree) still asks for it. CodeDen's own credential files ask at every level.
 */
 function classifyWrite(target, ctx) {
+	if (touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Writes CodeDen's own credentials: ${target}`);
 	if (!isWritable(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
 	if (isSecretPath(target) && !isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes the secrets file ${target}, outside the worktree`);
 	return SAFE;
 }
-/** Classify a file read or search. Reads anywhere are fine except credential files. */
-function classifyRead(target, _ctx) {
+/**
+* Classify a file read or search. Reads anywhere are fine except credential files; CodeDen's own
+* (or a folder holding them) ask at every level.
+*/
+function classifyRead(target, ctx) {
+	if (touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Reads CodeDen's own credentials: ${target}`);
 	if (isSecretPath(target)) return risky("secrets", `Reads the secrets file ${target}`);
 	return SAFE;
 }
+/**
+* Classify a file-name search: `pattern` (Claude's Glob, or a search's `--glob` filter) from
+* `base` (default: the current directory). Listing names reads nothing, so only a pattern that
+* reaches CodeDen's own credential files asks; `{a,b}` alternatives are followed.
+*/
+function classifyGlob(pattern, base, ctx) {
+	if (!pattern.trim()) return SAFE;
+	const dir = base ? resolveAgainst(base, ctx) : ctx.dir ?? ctx.cwd;
+	return braceAlternatives(pattern).some((alt) => touchesCodedenCredentials(alt, {
+		...ctx,
+		dir
+	})) ? credentialsRisk(`Lists CodeDen's own credential files: ${pattern}`) : SAFE;
+}
 /** Classify a web fetch. Only flagged when the context has an allowlist of hosts. */
 function classifyFetch(url, ctx) {
 	if (!ctx.allowedHosts) return SAFE;
@@ -6772,9 +7368,11 @@ function assessClaudeTool(name, input, ctx) {
 	if (name === "Read") return classifyRead(str(input, "file_path") ?? "", ctx);
 	if (name === "Grep") {
 		const target = str(input, "path");
-		return target ? classifyRead(target, ctx) : { risky: false };
+		const filter = str(input, "glob");
+		const root = searchReaches(target ? [target] : [], filter ? [filter] : [], ctx);
+		return mostSevere([target ? classifyRead(target, ctx) : SAFE, root ? credentialsRisk(`Reaches CodeDen's own credentials from ${root}`) : SAFE]);
 	}
-	if (name === "Glob") return { risky: false };
+	if (name === "Glob") return classifyGlob(str(input, "pattern") ?? "", str(input, "path"), ctx);
 	if (name === "WebFetch") return classifyFetch(str(input, "url") ?? "", ctx);
 	return { risky: false };
 }
@@ -6806,7 +7404,8 @@ const FINISH_PLAN = "Finish the plan and present it with ExitPlanMode; once the
 * - auto       -> `acceptEdits`, plus the risky-action classifier
 * - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
 *                 temp directory counts as inside, except for secrets files there)
-* Plan mode overrides all of them with `plan`.
+* Plan mode overrides all of them with `plan`. CodeDen's own credential files ask at every
+* level and are refused for read-only sessions (`../policy/codeden-home`).
 */
 function permissionModeFor(autonomy, planMode) {
 	if (planMode) return "plan";
@@ -6824,6 +7423,8 @@ var ClaudePolicy = class {
 	ctx;
 	readOnly;
 	sessionAllow = /* @__PURE__ */ new Set();
+	/** `allow_session` decisions on calls that touched CodeDen's own credentials (`credentialKey`). */
+	credentialAllow = /* @__PURE__ */ new Set();
 	/** Plan mode: edits outside Claude's notes and writing commands are refused. */
 	planning = false;
 	constructor(autonomy, ctx, readOnly = false) {
@@ -6852,8 +7453,12 @@ var ClaudePolicy = class {
 	setPlanning(on) {
 		this.planning = on;
 	}
-	/** Why a call is refused outright (read-only sessions, plan mode), or undefined. */
-	denial(toolName, input) {
+	/**
+	* Why a call is refused outright (read-only sessions, plan mode), or undefined. `dir` is the
+	* shell's current directory, as for `gate`.
+	*/
+	denial(toolName, input, dir) {
+		if (this.isReadOnly && touchesCodeden(this.assess(toolName, input, dir))) return this.readOnly ? "This session is read-only: CodeDen's own credential files are off limits. Act through CodeDen tools instead." : "This session has read-only permissions: CodeDen's own credential files are off limits. Report what you found instead.";
 		if (this.planning && !this.readOnly && this.isNotesEdit(toolName, input)) return void 0;
 		if (!this.isReadOnly) return this.planning ? this.planDenial(toolName, input) : void 0;
 		if (EDIT_TOOLS$1.has(toolName)) return this.readOnly ? "This session is read-only: it cannot edit files. Act through CodeDen tools instead." : "This session has read-only permissions: it cannot edit files, commit or push. Report what you found instead.";
@@ -6894,11 +7499,8 @@ var ClaudePolicy = class {
 			action: "plan",
 			reason: "The agent finished planning"
 		};
-		if (this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
-		const risk = assessClaudeTool(toolName, input, dir ? {
-			...this.ctx,
-			dir
-		} : this.ctx);
+		const risk = this.assess(toolName, input, dir);
+		if (touchesCodeden(risk) ? this.credentialAllow.has(this.credentialKey(toolName, input, dir)) : this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				ask: true,
@@ -6913,13 +7515,19 @@ var ClaudePolicy = class {
 			return { ask: false };
 		}
 		if (!risk.risky) return { ask: false };
-		if (this.autonomy === "full" && risk.action !== "outside_worktree") return { ask: false };
+		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !risk.codeden) return { ask: false };
 		return {
 			ask: true,
 			action: risk.action,
 			reason: risk.reason
 		};
 	}
+	assess(toolName, input, dir) {
+		return assessClaudeTool(toolName, input, dir ? {
+			...this.ctx,
+			dir
+		} : this.ctx);
+	}
 	/**
 	* Whether a `canUseTool` call (Claude's own permission prompt) needs the user. In supervised
 	* mode everything Claude asks about goes to the user; otherwise only gated calls do.
@@ -6934,9 +7542,17 @@ var ClaudePolicy = class {
 			reason: "Claude asked for permission"
 		};
 	}
-	/** Remember an `allow_session` decision. Commands and edits match exactly; others by name. */
-	allowForSession(toolName, input) {
+	/**
+	* Remember an `allow_session` decision. Commands and edits match exactly; others by name. A
+	* call that touches CodeDen's own credentials is remembered only as itself, in `dir`.
+	*/
+	allowForSession(toolName, input, dir) {
 		this.sessionAllow.add(this.key(toolName, input));
+		if (touchesCodeden(this.assess(toolName, input, dir))) this.credentialAllow.add(this.credentialKey(toolName, input, dir));
+	}
+	/** The exact call, in the directory its relative paths resolve from. */
+	credentialKey(toolName, input, dir) {
+		return `${toolName}\n${dir ?? this.ctx.cwd}\n${JSON.stringify(input)}`;
 	}
 	key(toolName, input) {
 		if (COMMAND_TOOLS.has(toolName)) return `${toolName}:${str(input, "command") ?? ""}`;
@@ -7695,7 +8311,7 @@ function policyHook(policy, shell) {
 		const toolInput = hookInput.tool_input ?? {};
 		const cwd = str(hookInput, "cwd");
 		if (cwd && (path.isAbsolute(cwd) || path.win32.isAbsolute(cwd))) shell.dir = cwd;
-		const denied = policy.denial(name, toolInput);
+		const denied = policy.denial(name, toolInput, shell.dir);
 		if (denied) return { hookSpecificOutput: {
 			hookEventName: "PreToolUse",
 			permissionDecision: "deny",
@@ -8024,23 +8640,130 @@ function statsFromUsageTrailer(text) {
 	};
 	return stats(field("total_tokens"), field("tool_uses"), field("duration_ms"));
 }
+// ../../packages/providers/src/claude/subagent-usage.ts
+/** Token counts of one call from a Messages API `usage` object; undefined when it has none. */
+function callTokens(usage) {
+	if (!usage || typeof usage !== "object") return void 0;
+	const u = usage;
+	const details = u.output_tokens_details;
+	const tokens = {
+		input: count(u.input_tokens) ?? 0,
+		output: count(u.output_tokens) ?? 0,
+		cacheRead: count(u.cache_read_input_tokens) ?? 0,
+		cacheWrite: count(u.cache_creation_input_tokens) ?? 0,
+		reasoning: count(details?.thinking_tokens) ?? 0
+	};
+	return tokens.input + tokens.output + tokens.cacheRead + tokens.cacheWrite > 0 ? tokens : void 0;
+}
+/**
+* Tokens per model across one subagent's own API calls, for its card's cost (§7.3). Claude
+* streams a call as several `assistant` frames sharing its message id (one per content block),
+* each with the call's usage as it stood when the call started: input and cache counts are
+* final, output is not. So calls are keyed by message id, frames of one call merge (the larger
+* figure wins), and the subagent's transcript, read once it has finished, supplies the final
+* figures (`applyTranscript`).
+*/
+var SubagentUsage = class {
+	calls = /* @__PURE__ */ new Map();
+	/** Fold in one streamed frame (`message` of an `assistant` message). */
+	addFrame(message) {
+		const id = str(message, "id");
+		const tokens = callTokens(message.usage);
+		if (!id || !tokens) return;
+		const model = modelOf(message);
+		const prev = this.calls.get(id);
+		this.calls.set(id, {
+			...model || prev?.model ? { model: model ?? prev?.model } : {},
+			input: Math.max(tokens.input, prev?.input ?? 0),
+			output: Math.max(tokens.output, prev?.output ?? 0),
+			cacheRead: Math.max(tokens.cacheRead, prev?.cacheRead ?? 0),
+			cacheWrite: Math.max(tokens.cacheWrite, prev?.cacheWrite ?? 0),
+			reasoning: Math.max(tokens.reasoning, prev?.reasoning ?? 0)
+		});
+	}
+	/**
+	* Take the final figures of the calls the frames showed from the subagent's transcript
+	* (`getSubagentMessages`): per message id, the transcript wins. Calls only the transcript
+	* holds are left out (an earlier run of a resumed subagent); calls it doesn't hold yet keep
+	* their streamed figures. Returns whether anything changed.
+	*/
+	applyTranscript(messages) {
+		let changed = false;
+		for (const entry of messages) {
+			const raw = str(entry, "type") === "assistant" ? entry.message : void 0;
+			if (!raw || typeof raw !== "object") continue;
+			const message = raw;
+			const id = str(message, "id");
+			const prev = id ? this.calls.get(id) : void 0;
+			const tokens = callTokens(message.usage);
+			if (!id || !prev || !tokens) continue;
+			const model = modelOf(message) ?? prev.model;
+			const next = {
+				...model ? { model } : {},
+				...tokens
+			};
+			if (!sameCall(prev, next)) {
+				this.calls.set(id, next);
+				changed = true;
+			}
+		}
+		return changed;
+	}
+	/** Tokens per model in the order the models were first used; undefined with no calls. */
+	summary() {
+		const byModel = /* @__PURE__ */ new Map();
+		for (const call of this.calls.values()) {
+			const key = call.model ?? "";
+			const sum = byModel.get(key);
+			byModel.set(key, {
+				...call.model ? { model: call.model } : {},
+				input: (sum?.input ?? 0) + call.input,
+				output: (sum?.output ?? 0) + call.output,
+				cacheRead: (sum?.cacheRead ?? 0) + call.cacheRead,
+				cacheWrite: (sum?.cacheWrite ?? 0) + call.cacheWrite,
+				reasoning: (sum?.reasoning ?? 0) + call.reasoning
+			});
+		}
+		if (byModel.size === 0) return void 0;
+		return [...byModel.values()].map((c) => ({
+			...c.model ? { model: c.model } : {},
+			inputTokens: c.input,
+			outputTokens: c.output,
+			cacheReadTokens: c.cacheRead,
+			cacheWriteTokens: c.cacheWrite,
+			...c.reasoning > 0 ? { reasoningTokens: c.reasoning } : {}
+		}));
+	}
+};
+/** The model that served a call; Claude Code marks its own placeholder replies `<synthetic>`. */
+function modelOf(message) {
+	const model = str(message, "model")?.trim();
+	return model && model !== "<synthetic>" ? model : void 0;
+}
+function sameCall(a, b) {
+	return a.model === b.model && a.input === b.input && a.output === b.output && a.cacheRead === b.cacheRead && a.cacheWrite === b.cacheWrite && a.reasoning === b.reasoning;
+}
 // ../../packages/providers/src/claude/subagents.ts
 /**
 * Subagent (Agent/Task tool) runs as child threads (§7.3). The parent gets a `subagent` item;
 * messages tagged with `parent_tool_use_id` go to the child thread. Background subagents
-* finish on `task_notification`, foreground ones on their `tool_result`.
+* finish on `task_notification`, foreground ones on their `tool_result`. The card's figures
+* include the run's tokens per model, from its streamed messages; `onFinished` lets the
+* session read the final figures from the run's transcript (`correctUsage`).
 */
 var SubagentTracker = class {
 	sessionId;
 	emit;
 	newId;
 	onThreadEnd;
+	onFinished;
 	runs = /* @__PURE__ */ new Map();
-	constructor(sessionId, emit, newId, onThreadEnd = () => {}) {
+	constructor(sessionId, emit, newId, onThreadEnd = () => {}, onFinished = () => {}) {
 		this.sessionId = sessionId;
 		this.emit = emit;
 		this.newId = newId;
 		this.onThreadEnd = onThreadEnd;
+		this.onFinished = onFinished;
 	}
 	ctx(toolUseId) {
 		return this.runs.get(toolUseId)?.child;
@@ -8068,7 +8791,8 @@ var SubagentTracker = class {
 			child,
 			item,
 			background: input.run_in_background === true,
-			done: false
+			done: false,
+			usage: new SubagentUsage()
 		});
 		this.emit({
 			type: "thread.started",
@@ -8092,11 +8816,43 @@ var SubagentTracker = class {
 	}
 	onTaskStarted(msg) {
 		const run = this.runs.get(str(msg, "tool_use_id") ?? "");
-		if (run && msg.is_backgrounded === true) run.background = true;
+		if (!run) return;
+		if (msg.is_backgrounded === true) run.background = true;
+		run.agentId ??= str(msg, "task_id");
+	}
+	/** One of the run's own `assistant` messages (`parent_tool_use_id` is its tool use). */
+	onAssistant(toolUseId, msg) {
+		const run = this.runs.get(toolUseId);
+		if (!run || run.done) return;
+		run.agentId ??= str(msg, "agent_id");
+		if (msg.message && typeof msg.message === "object") run.usage.addFrame(msg.message);
+	}
+	/**
+	* The final figures of a finished run's calls, from its transcript: the card is sent again
+	* when they change what it shows (§7.3).
+	*/
+	correctUsage(toolUseId, transcript) {
+		const run = this.runs.get(toolUseId);
+		if (!run?.done || !run.usage.applyTranscript(transcript)) return;
+		const usage = run.usage.summary();
+		if (!usage) return;
+		run.item = {
+			...run.item,
+			stats: {
+				...run.item.stats,
+				usage
+			}
+		};
+		this.emit({
+			type: "item.completed",
+			...run.parent,
+			item: run.item
+		});
 	}
 	onToolResult(toolUseId, content, isError, toolUseResult) {
 		const run = this.runs.get(toolUseId);
 		if (!run || run.done) return;
+		run.agentId ??= str(toolUseResult, "agentId");
 		const status = str(toolUseResult, "status");
 		if (!isError && (status === "async_launched" || toolUseResult?.isAsync === true)) {
 			run.background = true;
@@ -8109,6 +8865,8 @@ var SubagentTracker = class {
 	onTaskNotification(msg) {
 		const toolUseId = str(msg, "tool_use_id");
 		if (!toolUseId) return;
+		const run = this.runs.get(toolUseId);
+		if (run) run.agentId ??= str(msg, "task_id");
 		const status = str(msg, "status");
 		const summary = str(msg, "summary");
 		this.finish(toolUseId, status === "completed" ? "completed" : status === "failed" ? "failed" : "interrupted", summary, statsFromTaskNotification(msg));
@@ -8141,16 +8899,23 @@ var SubagentTracker = class {
 			reason: "user"
 		});
 		const status = outcome === "completed" ? "completed" : outcome === "failed" ? "failed" : "cancelled";
+		const usage = run.usage.summary();
+		const figures = usage ? {
+			...stats,
+			usage
+		} : stats;
+		run.item = {
+			...run.item,
+			status,
+			...summary ? { summary } : {},
+			...figures ? { stats: figures } : {}
+		};
 		this.emit({
 			type: "item.completed",
 			...run.parent,
-			item: {
-				...run.item,
-				status,
-				...summary ? { summary } : {},
-				...stats ? { stats } : {}
-			}
+			item: run.item
 		});
+		if (usage && run.agentId) this.onFinished(toolUseId, run.agentId);
 	}
 };
 /** Drop the CLI's internal trailer (agent ids, usage) from a subagent result. */
@@ -8434,13 +9199,19 @@ var ClaudeEventMapper = class {
 	retryNoticeId;
 	/** What the current turn said about a failure, for classifying it (`errors.ts`). */
 	signals = {};
+	/**
+	* The `uuid` of the current root turn's last main-chain transcript message (an `assistant`
+	* or `user` message without `parent_tool_use_id`): the turn's fork point, where
+	* `forkSession({ upToMessageId })` ends a copy that keeps this turn and no later one.
+	*/
+	lastChainUuid;
 	/** The `/` command list last reported, so an unchanged list isn't sent again. */
 	commandsKey;
 	constructor(opts) {
 		this.rootThreadId = `${opts.sessionId}:thread-root`;
 		this.emit = opts.emit;
 		this.newId = opts.newId ?? randomUUID;
-		this.subagents = new SubagentTracker(opts.sessionId, this.emit, this.newId, (ctx, ok) => this.tools.finishTurn(ctx, ok));
+		this.subagents = new SubagentTracker(opts.sessionId, this.emit, this.newId, (ctx, ok) => this.tools.finishTurn(ctx, ok), opts.onSubagentFinished);
 		this.tools = new ToolTracker(opts.cwd, (ctx, phase, item) => this.item(ctx, phase, item), this.subagents, this.newId);
 		this.stream = new StreamAssembler({
 			rootCtx: () => this.rootCtx(),
@@ -8491,6 +9262,7 @@ var ClaudeEventMapper = class {
 		this.rootTurnId = turnId;
 		this.turnBaseline = this.queryTotal;
 		this.signals = {};
+		this.lastChainUuid = void 0;
 		this.emit({
 			type: "turn.started",
 			threadId: this.rootThreadId,
@@ -8517,6 +9289,13 @@ var ClaudeEventMapper = class {
 	ctxForTool(toolUseId) {
 		return this.tools.ctx(toolUseId) ?? this.rootCtx();
 	}
+	/**
+	* A finished subagent's transcript (`getSubagentMessages`): its calls' final token counts
+	* replace the streamed ones, and the card is sent again when that changes it.
+	*/
+	correctSubagentUsage(toolUseId, transcript) {
+		this.subagents.correctUsage(toolUseId, transcript);
+	}
 	/** Emit an item event in a context. */
 	item(ctx, phase, item) {
 		this.emit({
@@ -8535,9 +9314,11 @@ var ClaudeEventMapper = class {
 				return;
 			case "assistant":
 				this.onAssistant(msg);
+				this.noteChainMessage(msg);
 				return;
 			case "user":
 				this.onUser(msg);
+				this.noteChainMessage(msg);
 				return;
 			case "system":
 				this.onSystem(msg);
@@ -8560,12 +9341,23 @@ var ClaudeEventMapper = class {
 			default: return;
 		}
 	}
+	/**
+	* Keep a root turn's latest main-chain message as its fork point. Subagents' messages don't
+	* count, nor do meta or synthetic ones, which the transcript read that confirms a fork point
+	* (`getSessionMessages`) may leave out.
+	*/
+	noteChainMessage(msg) {
+		if (msg.parent_tool_use_id || !this.rootTurnId || msg.isMeta || msg.isSynthetic) return;
+		const uuid = str(msg, "uuid");
+		if (uuid) this.lastChainUuid = uuid;
+	}
 	onAssistant(msg) {
 		const message = msg.message ?? {};
 		const ctx = this.ctxFor(msg.parent_tool_use_id);
 		const isRoot = !msg.parent_tool_use_id;
 		const messageId = str(message, "id") ?? this.newId();
 		if (isRoot) this.contextTokens = contextTokensFromMessageUsage(message.usage) ?? this.contextTokens;
+		else if (typeof msg.parent_tool_use_id === "string") this.subagents.onAssistant(msg.parent_tool_use_id, msg);
 		const content = Array.isArray(message.content) ? message.content : [];
 		for (const block of content) if (block.type === "text" || block.type === "thinking" || block.type === "redacted_thinking") {
 			const type = block.type === "text" ? "text" : "thinking";
@@ -8703,19 +9495,24 @@ var ClaudeEventMapper = class {
 		this.tools.finishTurn(ctx, outcome.type === "completed");
 		this.rootTurnId = void 0;
 		this.interruptRequested = false;
+		const end = {
+			...ctx,
+			...this.lastChainUuid ? { forkPoint: this.lastChainUuid } : {}
+		};
+		this.lastChainUuid = void 0;
 		if (outcome.type === "completed") this.emit({
 			type: "turn.completed",
-			...ctx,
+			...end,
 			stopReason: outcome.stopReason
 		});
 		else if (outcome.type === "failed") this.emit({
 			type: "turn.failed",
-			...ctx,
+			...end,
 			error: outcome.error
 		});
 		else this.emit({
 			type: "turn.interrupted",
-			...ctx,
+			...end,
 			reason: outcome.reason
 		});
 	}
@@ -8967,7 +9764,10 @@ var ClaudeSession = class {
 		this.mapper = new ClaudeEventMapper({
 			sessionId: opts.sessionId,
 			cwd: opts.cwd,
-			emit
+			emit,
+			onSubagentFinished: (toolUseId, agentId) => {
+				this.correctSubagentUsage(toolUseId, agentId);
+			}
 		});
 		this.broker = new ApprovalBroker(emit);
 		this.autonomy = opts.autonomy;
@@ -8975,6 +9775,7 @@ var ClaudeSession = class {
 			cwd: opts.cwd,
 			extraRoots: opts.additionalDirectories,
 			...opts.ownBranch ? { ownBranch: opts.ownBranch } : {},
+			...opts.codedenHome ? { codedenHome: opts.codedenHome } : {},
 			notesRoots: config.notesRoots ?? claudeNotesDirs({
 				cwd: opts.cwd,
 				...claudeHomes(opts.env)
@@ -8989,6 +9790,20 @@ var ClaudeSession = class {
 		return this.mapper.resumeToken ?? this.opts.resumeToken;
 	}
 	/**
+	* A subagent's streamed messages don't carry their calls' final output counts; its
+	* transcript does. Read it once the run finished and let the card take the final figures.
+	* If it can't be read (another config folder, not written yet), the streamed ones stay.
+	*/
+	async correctSubagentUsage(toolUseId, agentId) {
+		const read = this.config.getSubagentMessages;
+		const claudeSessionId = this.resumeToken();
+		if (!read || !claudeSessionId || this.closed) return;
+		try {
+			const transcript = await read(claudeSessionId, agentId, { dir: this.opts.cwd });
+			if (!this.closed) this.mapper.correctSubagentUsage(toolUseId, transcript);
+		} catch {}
+	}
+	/**
 	* Switch autonomy. The policy changes at once, so the next tool call (even in a running
 	* turn) follows the new level; approvals already waiting stay waiting. The CLI's own
 	* permission mode follows (`applyPermissionMode`), except while planning: the CLI stays in
@@ -9211,7 +10026,7 @@ var ClaudeSession = class {
 			mapper: this.mapper
 		}, input, options.toolUseID, options.signal);
 		if (toolName === "ExitPlanMode") return this.reviewPlan(input, options);
-		const denied = this.policy.denial(toolName, input);
+		const denied = this.policy.denial(toolName, input, this.shell.dir);
 		if (denied) return {
 			behavior: "deny",
 			message: denied
@@ -9249,7 +10064,7 @@ var ClaudeSession = class {
 	};
 	toPermissionResult(toolName, input, response) {
 		if (response.kind === "approval" && response.decision !== "deny") {
-			if (response.decision === "allow_session") this.policy.allowForSession(toolName, input);
+			if (response.decision === "allow_session") this.policy.allowForSession(toolName, input, this.shell.dir);
 			return {
 				behavior: "allow",
 				updatedInput: input
@@ -9393,10 +10208,11 @@ var ClaudeAdapter = class {
 	async openSession(opts) {
 		const executable = this.executable();
 		if (!executable) throw new Error("Claude Code is not installed (no `claude` on PATH)");
-		const { query } = await (this.options.loadSdk ?? loadClaudeSdk)();
+		const { query, getSubagentMessages } = await (this.options.loadSdk ?? loadClaudeSdk)();
 		return new ClaudeSession(await withFork(this, opts), {
 			executable,
 			query,
+			...getSubagentMessages ? { getSubagentMessages } : {},
 			onModels: (models) => {
 				if (!models.length) return;
 				this.freshness.confirm(executableFingerprint(executable));
@@ -9405,18 +10221,12 @@ var ClaudeAdapter = class {
 		});
 	}
 	/**
-	* Copy a conversation with the SDK's `forkSession()`: the transcript is written to a new
-	* session file at once (fresh message ids, the original untouched) and the new session id is
-	* returned for resuming. The copy is found from any worktree of the project.
+	* Copy a conversation (see `forkClaudeConversation`): at once, with fresh message ids, the
+	* original untouched; with `upTo`, only through the turn that ended with that message. The
+	* copy is found from any worktree of the project.
 	*/
-	async forkConversation(resumeToken) {
-		const { forkSession } = await (this.options.loadSdk ?? loadClaudeSdk)();
-		try {
-			return (await forkSession(resumeToken)).sessionId;
-		} catch (error) {
-			const reason = error instanceof Error ? error.message : String(error);
-			throw new Error(`Could not fork the Claude conversation ${resumeToken}: ${reason}`);
-		}
+	async forkConversation(resumeToken, opts) {
+		return forkClaudeConversation(await (this.options.loadSdk ?? loadClaudeSdk)(), resumeToken, opts?.upTo);
 	}
 	utilityModel() {
 		return new ClaudeUtilityModel(() => this.executable());
@@ -9733,11 +10543,27 @@ async function startAppServer(exe, handlers, opts = {}) {
 	}
 }
 // ../../packages/providers/src/codex/fork.ts
+/** Turns listed per `thread/turns/list` page, and the most pages read to find a turn. */
+const TURNS_PAGE = 100;
+const MAX_PAGES$1 = 50;
+/**
+* How the app-server answers for a thread or turn it doesn't have. Codex 0.160 says
+* `no rollout found for thread id <id>` for a deleted thread and `turn not found: <id>` for a
+* missing `lastTurnId`. Other refusals (a turn still in progress, a malformed id) don't match.
+*/
+const MISSING = /\bno rollout found\b|\b(thread|turn|rollout) not found\b/i;
 /**
 * Copy a Codex thread with `thread/fork` through a short-lived `codex app-server` and return
 * the new thread's id. The original thread is untouched; the session that resumes the copy
 * sets its own cwd, policy and instructions (`thread/resume` overrides). The process is closed
 * before returning, so it no longer holds the new thread when that session resumes it.
+*
+* With `upTo` (a turn id), the copy ends with that turn (`lastTurnId`). A thread that no
+* longer holds the turn, or no longer exists, throws `FORK_POINT_MISSING`: when the turn list
+* (`thread/turns/list`) shows it before anything is copied, or else when `thread/fork` answers
+* so. A short-lived app-server usually can't list a thread it hasn't loaded (Codex 0.160 says
+* `thread not loaded`), so `thread/fork`'s answer is what decides then. Any other failure, and
+* every failure of a whole copy, stays a plain error.
 */
 async function forkCodexThread(exe, threadId, opts) {
 	const { rpc } = await startAppServer(exe, {
@@ -9746,17 +10572,47 @@ async function forkCodexThread(exe, threadId, opts) {
 		onExit: () => {}
 	}, { cwd: opts.cwd });
 	try {
-		return (await rpc.request("thread/fork", {
+		if (opts.upTo && await holdsTurn(rpc, threadId, opts.upTo) === false) throw new ProviderSessionError(FORK_POINT_MISSING, "The thread no longer holds that turn (it was replaced or deleted), so it can't be forked there");
+		const params = {
 			threadId,
 			cwd: opts.cwd,
-			excludeTurns: true
-		})).thread.id;
+			excludeTurns: true,
+			...opts.upTo ? { lastTurnId: opts.upTo } : {}
+		};
+		return (await rpc.request("thread/fork", params)).thread.id;
 	} catch (error) {
-		throw new Error(`Could not fork Codex thread ${threadId}: ${error.message}`);
+		if (error instanceof ProviderSessionError) throw error;
+		const message = error.message;
+		if (opts.upTo && error instanceof CodexRpcError && MISSING.test(message)) throw new ProviderSessionError(FORK_POINT_MISSING, `The thread no longer holds that turn (${message}), so it can't be forked there`);
+		throw new Error(`Could not fork Codex thread ${threadId}: ${message}`);
 	} finally {
 		await rpc.close();
 	}
 }
+/**
+* Whether the thread still holds `turnId`, from its turn list. Undefined when the list can't be
+* read (a thread this app-server hasn't loaded, or an app-server without the method):
+* `thread/fork` then decides.
+*/
+async function holdsTurn(rpc, threadId, turnId) {
+	let cursor = null;
+	try {
+		for (let page = 0; page < MAX_PAGES$1; page++) {
+			const res = await rpc.request("thread/turns/list", {
+				threadId,
+				limit: TURNS_PAGE,
+				itemsView: "notLoaded",
+				...cursor ? { cursor } : {}
+			});
+			if (res.data.some((t) => t.id === turnId)) return true;
+			cursor = res.nextCursor;
+			if (!cursor) return false;
+		}
+		return;
+	} catch {
+		return;
+	}
+}
 /** `model/list` pages are followed up to this many (a guard against a looping cursor). */
 const MAX_PAGES = 20;
 /**
@@ -9893,78 +10749,369 @@ var CodexUtilityModel = class {
 * same risk classifier as Claude's tool calls: what the level allows is approved by policy
 * (recorded with `decidedBy: "policy"`), and only the rest reaches the user.
 */
-/** True when the permission level allows an action the classifier assessed as `risk`. */
+/**
+* True when the permission level allows an action the classifier assessed as `risk`. CodeDen's
+* own credential files are never allowed by policy. Commands Codex runs inside its sandbox
+* without asking (reads included) never reach this policy.
+*/
 function levelAllows(autonomy, risk) {
 	if (autonomy === "auto") return !risk.risky;
-	if (autonomy === "full") return !risk.risky || risk.action !== "outside_worktree";
+	if (autonomy === "full") return !risk.risky || risk.action !== "outside_worktree" && !risk.codeden;
 	return false;
 }
-/** The first risky assessment of `items`, or safe. */
-function first(items) {
-	return items.find((r) => r.risky) ?? { risky: false };
+/**
+* Risk of a command Codex asks to run: the command line as sent and each parsed action, so a
+* redirect or path the parsed form drops still counts. Here and below, CodeDen's own
+* credentials win over an earlier ordinary risk (`mostSevere`).
+*/
+function commandRisk(texts, ctx) {
+	return mostSevere(texts.filter(Boolean).map((text) => classifyCommand(text, ctx)));
+}
+/**
+* Risk of a patch Codex asks to apply: each file it changes, and the root it asks to write
+* under for the rest of the session. Unknown paths can't be judged, so they need the user.
+*/
+function patchRisk(paths, grantRoot, ctx) {
+	const targets = [...paths, ...grantRoot ? [grantRoot] : []];
+	if (targets.length === 0) return {
+		risky: true,
+		action: "outside_worktree",
+		reason: "Changes files Codex did not name"
+	};
+	return mostSevere(targets.map((target) => classifyWrite(target, ctx)));
+}
+/**
+* Risk of extra permissions Codex asks for: network access (not restricted, as for Claude,
+* while no host list applies) and folders to read or write. Patterns and special folders can't
+* be judged, so they need the user.
+*/
+function permissionsRisk(permissions, ctx) {
+	const fs = permissions.fileSystem;
+	if (!fs) return { risky: false };
+	const unknown = {
+		risky: true,
+		action: "outside_worktree",
+		reason: "Asks for access to folders by pattern"
+	};
+	return mostSevere([
+		...(fs.write ?? []).map((p) => classifyWrite(p, ctx)),
+		...(fs.read ?? []).map((p) => classifyRead(p, ctx)),
+		...(fs.entries ?? []).map((entry) => {
+			if (entry.path.type !== "path") return unknown;
+			if (entry.access === "write") return classifyWrite(entry.path.path, ctx);
+			return entry.access === "read" ? classifyRead(entry.path.path, ctx) : { risky: false };
+		})
+	]);
+}
+// ../../packages/providers/src/codex/approval-context.ts
+const decisionOf = (r) => r.kind === "approval" ? r.decision : "cancel";
+/**
+* Approve `item` by policy when the permission level allows `risk`: record it as decided by
+* policy (shown in the transcript, never waited on) and return true. Otherwise return false and
+* the caller asks the user, with the classifier's reason.
+*/
+function approvedByPolicy(ac, p, item, risk) {
+	const autonomy = ac.autonomy?.() ?? "supervised";
+	if (!levelAllows(autonomy, risk)) return false;
+	ac.broker.record(ac.ctx(p.threadId, p.turnId), {
+		...item,
+		status: "completed",
+		reason: `Allowed by the ${autonomy === "full" ? "Full" : "Auto"} permission level`,
+		decision: "allow_once",
+		decidedBy: "policy"
+	});
+	return true;
+}
+// ../../packages/providers/src/codex/elicitation-form.ts
+/** The option that leaves an optional field empty. */
+const LEAVE_EMPTY = "Leave empty";
+/** A form without fields is a confirmation: one question, accept or decline. */
+const CONFIRM_ID = "confirm";
+const ACCEPT = "Accept";
+const DECLINE = "Decline";
+function formFields(schema) {
+	const required = new Set(schema.required ?? []);
+	return Object.entries(schema.properties).flatMap(([name, prop], i) => prop ? [field(name, i, prop, required.has(name))] : []);
+}
+function field(name, index, s, required) {
+	const description = s.description?.trim();
+	const base = {
+		name,
+		id: name.length > 0 && name.length <= 200 ? name : `field-${index}`,
+		label: s.title?.trim() || name,
+		...description ? { description } : {},
+		required,
+		choices: []
+	};
+	if (s.type === "boolean") return {
+		...base,
+		type: "boolean"
+	};
+	if (s.type === "number" || s.type === "integer") return {
+		...base,
+		type: s.type
+	};
+	if (s.type === "array") {
+		const items = s.items;
+		const choices = "anyOf" in items ? items.anyOf.map((o) => ({
+			value: o.const,
+			label: o.title
+		})) : items.enum.map((value) => ({
+			value,
+			label: value
+		}));
+		return {
+			...base,
+			type: "choices",
+			choices: unique(choices)
+		};
+	}
+	if ("oneOf" in s) return {
+		...base,
+		type: "choice",
+		choices: unique(s.oneOf.map((o) => ({
+			value: o.const,
+			label: o.title
+		})))
+	};
+	if ("enum" in s) {
+		const names = "enumNames" in s ? s.enumNames : void 0;
+		const choices = s.enum.map((value, i) => ({
+			value,
+			label: names?.[i] ?? value
+		}));
+		return {
+			...base,
+			type: "choice",
+			choices: unique(choices)
+		};
+	}
+	return {
+		...base,
+		type: "text"
+	};
+}
+/**
+* Labels are how answers come back, so each must name exactly one value: a repeated label (or
+* one that reads as {@link LEAVE_EMPTY}) gets its value added, then a number, until it is free.
+*/
+function unique(choices) {
+	const seen = /* @__PURE__ */ new Set([LEAVE_EMPTY]);
+	return choices.map((c) => {
+		const label = c.label.trim() || c.value;
+		let free = seen.has(label) ? `${label} (${c.value})` : label;
+		for (let n = 2; seen.has(free); n++) free = `${label} (${c.value}) ${n}`;
+		seen.add(free);
+		return {
+			value: c.value,
+			label: free
+		};
+	});
+}
+const HINTS = {
+	integer: " (a whole number)",
+	number: " (a number)"
+};
+/** The form as questions; the first one carries the server's message. */
+function formQuestions(server, message, fields) {
+	const lead = `${server} asks: ${message.trim()}`;
+	if (fields.length === 0) return [{
+		id: CONFIRM_ID,
+		header: server,
+		question: lead,
+		options: [{ label: ACCEPT }, { label: DECLINE }],
+		multiSelect: false,
+		allowFreeText: false
+	}];
+	return fields.map((f, i) => {
+		const ask = `${f.description ?? f.label}${HINTS[f.type] ?? ""}`;
+		const plain = fields.length === 1 && ask === f.label;
+		const question = i > 0 ? ask : plain ? lead : `${lead} — ${ask}`;
+		const options = f.type === "boolean" ? [{ label: "Yes" }, { label: "No" }] : f.choices.map((c) => ({ label: c.label }));
+		return {
+			id: f.id,
+			header: f.label.length > 40 ? `${f.label.slice(0, 39)}…` : f.label,
+			question,
+			options: f.required ? options : [...options, { label: LEAVE_EMPTY }],
+			multiSelect: f.type === "choices",
+			allowFreeText: f.type === "text" || f.type === "number" || f.type === "integer"
+		};
+	});
 }
 /**
-* Risk of a command Codex asks to run: the command line as sent and each parsed action, so a
-* redirect or path the parsed form drops still counts.
+* The form's content from the answers (keyed by question id), or undefined when a required
+* field has no answer or an answer doesn't fit its field.
 */
-function commandRisk(texts, ctx) {
-	return first(texts.filter(Boolean).map((text) => classifyCommand(text, ctx)));
+function formContent(fields, answers) {
+	const content = {};
+	for (const f of fields) {
+		const given = (answers[f.id] ?? []).map((a) => a.trim()).filter(Boolean);
+		const values = f.required ? given : given.filter((a) => a !== LEAVE_EMPTY);
+		if (values.length === 0) {
+			if (f.required) return void 0;
+			continue;
+		}
+		const value = parse$1(f, values);
+		if (value === void 0) return void 0;
+		content[f.name] = value;
+	}
+	return content;
+}
+function parse$1(f, values) {
+	const [one] = values;
+	switch (f.type) {
+		case "text": return values.join("\n");
+		case "number":
+		case "integer": {
+			const n = values.length === 1 ? Number(one) : NaN;
+			return Number.isFinite(n) && (f.type === "number" || Number.isInteger(n)) ? n : void 0;
+		}
+		case "boolean": {
+			const v = values.length === 1 ? one?.toLowerCase() : void 0;
+			return v === "yes" || v === "true" ? true : v === "no" || v === "false" ? false : void 0;
+		}
+		case "choice": return values.length === 1 && one !== void 0 ? choice(f, one) : void 0;
+		case "choices": {
+			const picked = values.map((v) => choice(f, v));
+			return picked.every((v) => v !== void 0) ? picked : void 0;
+		}
+	}
 }
 /**
-* Risk of a patch Codex asks to apply: each file it changes, and the root it asks to write
-* under for the rest of the session. Unknown paths can't be judged, so they need the user.
+* The value of the option the user picked. The card sends labels, so labels are matched first,
+* across every option; a raw value (a PM may answer with one) only when no label matches.
 */
-function patchRisk(paths, grantRoot, ctx) {
-	const targets = [...paths, ...grantRoot ? [grantRoot] : []];
-	if (targets.length === 0) return {
-		risky: true,
-		action: "outside_worktree",
-		reason: "Changes files Codex did not name"
+const choice = (f, answer) => (f.choices.find((c) => c.label === answer) ?? f.choices.find((c) => c.value === answer))?.value;
+// ../../packages/providers/src/codex/elicitation.ts
+const accept = (content, meta = null) => ({
+	action: "accept",
+	content,
+	_meta: meta
+});
+const DECLINED = {
+	action: "decline",
+	content: null,
+	_meta: null
+};
+const CANCELLED = {
+	action: "cancel",
+	content: null,
+	_meta: null
+};
+const READ_ONLY = "This session has read-only permissions: it can't run MCP tools that may change things.";
+async function handleElicitation(p, ac) {
+	if (!p.turnId) return DECLINED;
+	const where = {
+		threadId: p.threadId,
+		turnId: p.turnId
 	};
-	return first(targets.map((target) => classifyWrite(target, ctx)));
+	if (p.mode === "url") return openLink(p, where, ac);
+	const meta = asMeta(p._meta);
+	if (meta.codex_approval_kind === "mcp_tool_call") return toolApproval(p, meta, where, ac);
+	if (p.mode === "form") return fillForm(p, where, ac);
+	return DECLINED;
 }
 /**
-* Risk of extra permissions Codex asks for: network access (not restricted, as for Claude,
-* while no host list applies) and folders to read or write. Patterns and special folders can't
-* be judged, so they need the user.
+* Codex asks before it runs one of the user's MCP tools that isn't marked read-only (its
+* `tool_call_mcp_elicitation` feature, on by default).
 */
-function permissionsRisk(permissions, ctx) {
-	const fs = permissions.fileSystem;
-	if (!fs) return { risky: false };
-	const unknown = {
-		risky: true,
-		action: "outside_worktree",
-		reason: "Asks for access to folders by pattern"
+async function toolApproval(p, meta, where, ac) {
+	const server = p.serverName;
+	const tool = text$1(meta.tool_name) ?? text$1(meta.tool_title) ?? /run tool "([^"]+)"/.exec(p.message)?.[1];
+	const persist = meta.persist;
+	const offersSession = persist === "session" || Array.isArray(persist) && persist.includes("session");
+	const requestId = newRequestId();
+	const item = {
+		id: `approval-${requestId}`,
+		kind: "approval_request",
+		status: "in_progress",
+		requestId,
+		action: "tool",
+		title: tool ? `Use ${server}: ${shorten(tool, 80)}` : `Use a tool of ${server}`,
+		...p.message.trim() ? { reason: p.message.trim() } : {},
+		...tool ? { toolName: `mcp__${server}__${tool}` } : {},
+		...meta.tool_params !== void 0 ? { toolInput: toJson(meta.tool_params) } : {},
+		options: offersSession ? [
+			"allow_once",
+			"allow_session",
+			"deny"
+		] : ["allow_once", "deny"]
 	};
-	return first([
-		...(fs.write ?? []).map((p) => classifyWrite(p, ctx)),
-		...(fs.read ?? []).map((p) => classifyRead(p, ctx)),
-		...(fs.entries ?? []).map((entry) => {
-			if (entry.path.type !== "path") return unknown;
-			if (entry.access === "write") return classifyWrite(entry.path.path, ctx);
-			return entry.access === "read" ? classifyRead(entry.path.path, ctx) : { risky: false };
-		})
-	]);
+	const ctx = ac.ctx(where.threadId, where.turnId);
+	if ((ac.autonomy?.() ?? "supervised") === "read_only") {
+		ac.broker.record(ctx, {
+			...item,
+			status: "declined",
+			reason: READ_ONLY,
+			decision: "deny",
+			decidedBy: "policy"
+		});
+		return DECLINED;
+	}
+	if (!(meta.codex_sensitive_action === true || meta.codex_requires_user_input === true) && approvedByPolicy(ac, where, item, { risky: false })) return accept({});
+	const decision = decisionOf(await ac.broker.request(ctx, item));
+	if (decision === "allow_session" && offersSession) return accept({}, { persist: "session" });
+	if (decision === "allow_once" || decision === "allow_session") return accept({});
+	return decision === "deny" ? DECLINED : CANCELLED;
+}
+/** A server's form: a question card built from its schema, the answers sent as its content. */
+async function fillForm(p, where, ac) {
+	const fields = formFields(p.requestedSchema);
+	const requestId = newRequestId();
+	const response = await ac.broker.request(ac.ctx(where.threadId, where.turnId), {
+		id: `question-${requestId}`,
+		kind: "user_question",
+		status: "in_progress",
+		requestId,
+		mcpServer: p.serverName,
+		questions: formQuestions(p.serverName, p.message, fields)
+	});
+	if (response.kind !== "answer") return CANCELLED;
+	if (fields.length === 0) return response.answers["confirm"]?.includes("Accept") ? accept({}) : DECLINED;
+	const content = formContent(fields, response.answers);
+	return content ? accept(content) : DECLINED;
 }
-// ../../packages/providers/src/codex/approvals.ts
-const decisionOf = (r) => r.kind === "approval" ? r.decision : "cancel";
 /**
-* Approve `item` by policy when the permission level allows `risk`: record it as decided by
-* policy (shown in the transcript, never waited on) and return true. Otherwise return false and
-* the caller asks the user, with the classifier's reason.
+* A server asks the user to open a link (to sign in, say). The card shows the link and the user
+* opens it: never decided by policy, and nothing opens it on the user's behalf.
 */
-function approvedByPolicy(ac, p, item, risk) {
-	const autonomy = ac.autonomy?.() ?? "supervised";
-	if (!levelAllows(autonomy, risk)) return false;
-	ac.broker.record(ac.ctx(p.threadId, p.turnId), {
-		...item,
-		status: "completed",
-		reason: `Allowed by the ${autonomy === "full" ? "Full" : "Auto"} permission level`,
-		decision: "allow_once",
-		decidedBy: "policy"
+async function openLink(p, where, ac) {
+	const url = webUrl(p.url);
+	if (!url) return DECLINED;
+	const requestId = newRequestId();
+	const response = await ac.broker.request(ac.ctx(where.threadId, where.turnId), {
+		id: `approval-${requestId}`,
+		kind: "approval_request",
+		status: "in_progress",
+		requestId,
+		action: "network",
+		title: `${p.serverName} asks you to open ${url.host}`,
+		...p.message.trim() ? { reason: p.message.trim() } : {},
+		url: url.href,
+		options: ["allow_once", "deny"]
 	});
-	return true;
+	const decision = decisionOf(response);
+	if (decision === "allow_once" || decision === "allow_session") return accept(null);
+	return decision === "deny" ? DECLINED : CANCELLED;
+}
+/** Elicitations carry no item id, and app-server request ids restart with each process. */
+const newRequestId = () => `mcp-${randomUUID()}`;
+function asMeta(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function text$1(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+/** Web links only: a card never links to a script or a local file. */
+function webUrl(raw) {
+	try {
+		const url = new URL(raw);
+		return url.protocol === "https:" || url.protocol === "http:" ? url : void 0;
+	} catch {
+		return;
+	}
 }
+// ../../packages/providers/src/codex/approvals.ts
 /** The item with the classifier's verdict, for the user to decide. */
 function withRisk(item, risk) {
 	if (!risk.risky) return item;
@@ -10099,11 +11246,7 @@ async function handleServerRequest(req, ac) {
 			if (response.kind === "answer") for (const [id, values] of Object.entries(response.answers)) answers[id] = { answers: values };
 			return { answers };
 		}
-		case "mcpServer/elicitation/request": return {
-			action: "decline",
-			content: null,
-			_meta: null
-		};
+		case "mcpServer/elicitation/request": return handleElicitation(req.params, ac);
 		case "execCommandApproval":
 		case "applyPatchApproval": return { decision: { denied: { rejection: "Unsupported approval request" } } };
 		default: throw new CodexRpcError(-32601, `CodeDen does not handle ${req.method}`);
@@ -10877,6 +12020,21 @@ function tokenUsage(u) {
 	if (u.modelContextWindow && u.modelContextWindow > 0) usage.contextWindow = Math.round(u.modelContextWindow);
 	return usage;
 }
+/**
+* A sub-agent's tokens for its card (§7.3), from its thread's running `total`, in the same
+* terms as `tokenUsage`. `model` is the one its spawn asked for; absent, it runs the session's.
+*/
+function subagentUsage(u, model) {
+	const t = tokenUsage(u);
+	return {
+		...model ? { model } : {},
+		inputTokens: t.inputTokens ?? 0,
+		outputTokens: t.outputTokens ?? 0,
+		cacheReadTokens: t.cachedInputTokens ?? 0,
+		cacheWriteTokens: t.cacheWriteTokens ?? 0,
+		...t.reasoningTokens ? { reasoningTokens: t.reasoningTokens } : {}
+	};
+}
 function windowId(minutes, fallback) {
 	if (minutes === 300) return "5h";
 	if (minutes === 10080) return "weekly";
@@ -11005,7 +12163,7 @@ var CodexThreadMapper = class {
 				this.updatePlan(n.params.turnId, n.params.plan);
 				return;
 			case "thread/tokenUsage/updated": {
-				this.o.onTokens?.(n.params.tokenUsage.total.totalTokens);
+				this.o.onTokens?.(n.params.tokenUsage);
 				const usage = this.turnUsage.add(n.params.turnId, n.params.tokenUsage);
 				if (!this.o.root) {
 					delete usage.contextTokens;
@@ -11115,10 +12273,16 @@ var CodexThreadMapper = class {
 			});
 		}
 	}
+	/**
+	* Codex ended a turn. On the session's own thread the turn's id is its fork point:
+	* `thread/fork { lastTurnId }` keeps it and drops later turns. Turns CodeDen closes itself
+	* (the process died, the session closed) report none, as Codex may not have finished them.
+	*/
 	completeTurn(turn) {
 		this.beginTurn(turn.id);
-		if (turn.status === "completed") this.endTurn({ type: "completed" }, turn.id);
-		else if (turn.status === "interrupted") this.endTurn({ type: "interrupted" }, turn.id);
+		const forkPoint = this.o.root ? turn.id : void 0;
+		if (turn.status === "completed") this.endTurn({ type: "completed" }, turn.id, forkPoint);
+		else if (turn.status === "interrupted") this.endTurn({ type: "interrupted" }, turn.id, forkPoint);
 		else {
 			const info = turn.error?.codexErrorInfo;
 			const kind = classifyCodexError(info);
@@ -11130,13 +12294,17 @@ var CodexThreadMapper = class {
 				code: codexErrorCode(info),
 				kind,
 				retryAt
-			}, turn.id);
+			}, turn.id, forkPoint);
 		}
 	}
 	/** Close the running turn (also used when the process dies or the session closes). */
-	endTurn(outcome, turnId = this.current) {
+	endTurn(outcome, turnId = this.current, forkPoint) {
 		if (!turnId || turnId !== this.current) return;
 		const ctx = this.ctx(turnId);
+		const end = {
+			...ctx,
+			...forkPoint ? { forkPoint } : {}
+		};
 		const ok = outcome.type === "completed";
 		for (const item of this.open.values()) this.o.emit({
 			type: "item.completed",
@@ -11163,17 +12331,17 @@ var CodexThreadMapper = class {
 		this.current = void 0;
 		if (outcome.type === "completed") this.o.emit({
 			type: "turn.completed",
-			...ctx,
+			...end,
 			stopReason: "end_turn"
 		});
 		else if (outcome.type === "interrupted") this.o.emit({
 			type: "turn.interrupted",
-			...ctx,
+			...end,
 			reason: "user"
 		});
 		else this.o.emit({
 			type: "turn.failed",
-			...ctx,
+			...end,
 			error: {
 				code: outcome.code ?? "turn_failed",
 				message: outcome.message,
@@ -11248,6 +12416,7 @@ var CodexSubagents = class {
 			return false;
 		}
 		const run = this.claim(from, turnId, item.id, spawnDetails(item));
+		if (item.model) run.model ??= item.model;
 		const child = item.receiverThreadIds[0];
 		if (child) this.bind(run, child);
 		if (phase !== "completed") return true;
@@ -11386,8 +12555,8 @@ var CodexSubagents = class {
 					prompt: item.input.text
 				};
 			},
-			onTokens: (total) => {
-				run.totalTokens = total;
+			onTokens: (usage) => {
+				run.tokens = usage;
 			}
 		});
 		run.thread = thread;
@@ -11488,9 +12657,10 @@ var CodexSubagents = class {
 	stats(run) {
 		const end = run.endedAt ?? this.o.now();
 		return {
-			...run.totalTokens !== void 0 ? { totalTokens: Math.max(0, Math.round(run.totalTokens)) } : {},
+			...run.tokens ? { totalTokens: Math.max(0, Math.round(run.tokens.total.totalTokens)) } : {},
 			toolUses: run.toolCalls.size,
-			durationMs: Math.max(0, Math.round(end - run.startedAt))
+			durationMs: Math.max(0, Math.round(end - run.startedAt)),
+			...run.tokens ? { usage: [subagentUsage(run.tokens, run.model)] } : {}
 		};
 	}
 };
@@ -11837,7 +13007,8 @@ var CodexSession = class {
 				risk: {
 					cwd: this.opts.cwd,
 					extraRoots: this.opts.additionalDirectories,
-					...this.opts.ownBranch ? { ownBranch: this.opts.ownBranch } : {}
+					...this.opts.ownBranch ? { ownBranch: this.opts.ownBranch } : {},
+					...this.opts.codedenHome ? { codedenHome: this.opts.codedenHome } : {}
 				},
 				autonomy: () => this.opts.readOnly ? "read_only" : this.autonomy,
 				ctx: (threadId, turnId) => this.mapper.requestCtx(threadId, turnId),
@@ -12054,7 +13225,10 @@ var CodexAdapter = class {
 		}
 		return session;
 	}
-	/** Copy a thread with `thread/fork` (see `forkCodexThread`); returns the new thread's id. */
+	/**
+	* Copy a thread with `thread/fork` (see `forkCodexThread`); returns the new thread's id. With
+	* `upTo` (a turn id), the copy ends with that turn.
+	*/
 	async forkConversation(resumeToken, opts) {
 		const executable = this.executable();
 		if (!executable) throw new Error("Codex is not installed (no `codex` on PATH)");
@@ -12316,6 +13490,7 @@ var FakeSession = class {
 	}
 	async runTurn(turn, input) {
 		const { threadId, turnId } = turn;
+		const forkPoint = turnId;
 		const prompt = input.text;
 		try {
 			this.emit({
@@ -12342,6 +13517,7 @@ var FakeSession = class {
 					type: "turn.failed",
 					threadId,
 					turnId,
+					forkPoint,
 					error: {
 						code: "fake_failure",
 						message: "Scripted failure",
@@ -12357,6 +13533,7 @@ var FakeSession = class {
 					type: "turn.failed",
 					threadId,
 					turnId,
+					forkPoint,
 					error: usage ? {
 						code: "usage_limit",
 						message: "Scripted usage limit",
@@ -12378,6 +13555,7 @@ var FakeSession = class {
 						type: "turn.completed",
 						threadId,
 						turnId,
+						forkPoint,
 						stopReason: "end_turn"
 					});
 					return;
@@ -12426,6 +13604,7 @@ var FakeSession = class {
 				type: "turn.completed",
 				threadId,
 				turnId,
+				forkPoint,
 				stopReason: "end_turn"
 			});
 		} catch (error) {
@@ -12434,6 +13613,7 @@ var FakeSession = class {
 					type: "turn.interrupted",
 					threadId,
 					turnId,
+					forkPoint,
 					reason: "user"
 				});
 				return;
@@ -12443,6 +13623,7 @@ var FakeSession = class {
 				type: "turn.failed",
 				threadId,
 				turnId,
+				forkPoint,
 				error: { message }
 			});
 		}
@@ -12843,10 +14024,13 @@ var FakeProvider = class {
 	async openSession(opts) {
 		return new FakeSession(await withFork(this, opts), this.options);
 	}
-	/** A fork gets a conversation of its own, named after the one it copies. */
-	async forkConversation(resumeToken) {
+	/**
+	* A fork gets a conversation of its own, named after the one it copies and, with `upTo`,
+	* the turn it ends with (`<token>:fork-<n>@<turn>`).
+	*/
+	async forkConversation(resumeToken, opts) {
 		this.forks += 1;
-		return `${resumeToken}:fork-${this.forks}`;
+		return `${resumeToken}:fork-${this.forks}${opts?.upTo ? `@${opts.upTo}` : ""}`;
 	}
 	forks = 0;
 };
@@ -14525,25 +15709,32 @@ var OpenCodePolicy = class {
 			};
 		}
 	}
-	/** Remember an `allow_session` decision: commands and paths match exactly. */
+	/** Remember an `allow_session` decision: commands (in their directory) and paths match exactly. */
 	allowForSession(call) {
 		this.sessionAllow.add(this.key(call));
 	}
 	shell(call) {
 		const command = commandOf(call);
+		const risk = classifyCommand(command, {
+			...this.ctx,
+			dir: this.workdir(call)
+		});
 		if (this.isReadOnly) {
+			if (touchesCodeden(risk)) return this.credentialsDenial();
 			const reason = readOnlyCommandDenial(command, { allowChecks: !this.readOnly });
 			return reason ? {
 				kind: "deny",
 				message: `This session is read-only: ${reason}.`
 			} : ALLOW;
 		}
-		const workdir = str(call.toolInput, "workdir");
-		const dir = workdir ? path.resolve(this.ctx.cwd, workdir) : void 0;
-		return this.gate(classifyCommand(command, dir ? {
-			...this.ctx,
-			dir
-		} : this.ctx), "command");
+		return this.gate(risk, "command");
+	}
+	/** Read-only sessions never touch CodeDen's own credential files. */
+	credentialsDenial() {
+		return {
+			kind: "deny",
+			message: this.readOnly ? "This session is read-only: CodeDen's own credential files are off limits. Act through CodeDen tools instead." : "This session has read-only permissions: CodeDen's own credential files are off limits. Report what you found instead."
+		};
 	}
 	edit(paths) {
 		if (this.isReadOnly) return {
@@ -14552,19 +15743,19 @@ var OpenCodePolicy = class {
 		};
 		return this.gate(this.firstRisk(paths, classifyWrite), "file_change");
 	}
+	/** The verdict for every target: CodeDen's own credentials first, then the first risky one. */
 	firstRisk(targets, classify) {
-		for (const target of targets) {
-			const risk = classify(target, this.ctx);
-			if (risk.risky) return risk;
-		}
-		return { risky: false };
+		return mostSevere(targets.map((target) => classify(target, this.ctx)));
 	}
 	/**
 	* The level's gate (the same as Claude's): edits and commands (`supervisedAction`) always
 	* ask in supervised mode; `alwaysRisky` asks for flagged calls even at full autonomy
-	* (secrets reads).
+	* (secrets reads). CodeDen's own credential files ask at every level and are refused for
+	* read-only sessions.
 	*/
 	gate(risk, supervisedAction, alwaysRisky = false) {
+		const codeden = touchesCodeden(risk);
+		if (codeden && this.isReadOnly) return this.credentialsDenial();
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				kind: "ask",
@@ -14579,18 +15770,28 @@ var OpenCodePolicy = class {
 			return ALLOW;
 		}
 		if (!risk.risky) return ALLOW;
-		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !alwaysRisky) return ALLOW;
+		const always = alwaysRisky || codeden;
+		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !always) return ALLOW;
 		return {
 			kind: "ask",
 			action: risk.action,
 			reason: risk.reason
 		};
 	}
+	/**
+	* What an approval for the session covers: a command in its working directory (the same
+	* relative path elsewhere is another file), or the exact paths.
+	*/
 	key(call) {
 		const { action, resources } = call.request;
-		if (action === "shell") return `shell:${commandOf(call)}`;
+		if (action === "shell") return `shell:${this.workdir(call)}\n${commandOf(call)}`;
 		return `${action}:${[...resources].sort().join("\n")}`;
 	}
+	/** Where a shell call runs: its `workdir`, else the worktree. */
+	workdir(call) {
+		const workdir = str(call.toolInput, "workdir");
+		return workdir ? resolveAgainst(workdir, this.ctx) : this.ctx.cwd;
+	}
 };
 /** The command an OpenCode `shell` ask is about: the tool input, else its parsed parts. */
 function commandOf(call) {
@@ -15677,7 +16878,8 @@ var OpenCodeSession = class {
 		this.broker = new ApprovalBroker(emit);
 		this.policy = new OpenCodePolicy(opts.autonomy, {
 			cwd: opts.cwd,
-			extraRoots: opts.additionalDirectories
+			extraRoots: opts.additionalDirectories,
+			...opts.codedenHome ? { codedenHome: opts.codedenHome } : {}
 		}, opts.readOnly ?? false);
 		this.model = explicitModel(opts.model);
 		this.effort = opts.effort;
@@ -21832,6 +23034,7 @@ async function executeCommand(core, command) {
 			if (added.length > 0) core.log?.(`PATH: picked up ${added.join(", ")}`);
 			const adapters = command.providerId ? registry.list().filter((a) => a.id === command.providerId) : registry.list();
 			const statuses = await Promise.all(adapters.map((a) => a.detect()));
+			if (command.refreshModels === false) return { statuses };
 			const refreshed = registry.refreshModels(adapters.map((a) => a.id));
 			if (!command.waitForModels) return { statuses };
 			await refreshed;
@@ -21858,9 +23061,12 @@ async function executeCommand(core, command) {
 			const adapter = registry.get(command.providerId);
 			if (!adapter?.capabilities().fork || !adapter.forkConversation) throw new CommandError("unsupported", `Provider ${command.providerId} cannot fork`);
 			try {
-				return { resumeToken: await adapter.forkConversation(command.resumeToken, { cwd: command.cwd }) };
+				return { resumeToken: await adapter.forkConversation(command.resumeToken, {
+					cwd: command.cwd,
+					...command.upTo ? { upTo: command.upTo } : {}
+				}) };
 			} catch (error) {
-				throw new CommandError("fork_failed", error.message);
+				throw new CommandError(error.code === FORK_POINT_MISSING ? FORK_POINT_MISSING : "fork_failed", error.message);
 			}
 		}
 		case "workspace.prepare":
@@ -21943,7 +23149,7 @@ async function executeCommand(core, command) {
 		case "checkpoint.restoreFiles": return restoreFiles(command.cwd, command.sessionId, command.index, command.paths);
 		case "ports.list": return { ports: await listPorts(command.probe) };
 		case "mcp.test": {
-			const { testMcpServer } = await import("./server-test-COAiKxTV.js");
+			const { testMcpServer } = await import("./server-test-BwyCFssm.js");
 			return testMcpServer({
 				spec: command.spec,
 				cwd: command.cwd,
@@ -22004,21 +23210,44 @@ function removeOwnLock(lockFile) {
 * monotonically increasing seq and kept until the server acks them, so nothing is lost
 * while the server is away. `state.json` holds the stable runner id and seq counters.
 *
-* TODO(M1): batch fsyncs and compact lazily instead of rewriting on every ack.
+* An ack only moves the acked position in memory. While acks flow, the journal persists at
+* most every `persistMs`: it writes `state.json`, then, when enough acked events have piled
+* up and they outweigh what is left, rewrites the file without them (compaction), so each
+* ack costs no more than its append did. State always goes first, so `lastSeq` outlives the
+* events a compaction drops. `close` persists and compacts at once. After a crash the journal
+* may still hold events the server already acked; the server's `resume` acks them again and
+* they are not replayed.
 */
 var Journal = class {
 	file;
 	stateFile;
+	compactEntries;
+	compactBytes;
+	persistMs;
 	state;
+	/** Every event in `journal.jsonl`, oldest first; those before `head` are acked. */
 	entries = [];
-	constructor(dir) {
+	head = 0;
+	fileBytes = 0;
+	ackedBytes = 0;
+	persistTimer;
+	constructor(dir, opts = {}) {
 		mkdirSync(dir, { recursive: true });
 		this.file = join(dir, "journal.jsonl");
 		this.stateFile = join(dir, "state.json");
+		this.compactEntries = opts.compactEntries ?? 1e3;
+		this.compactBytes = opts.compactBytes ?? 1048576;
+		this.persistMs = opts.persistMs ?? 250;
 		this.state = this.loadState();
-		this.entries = this.loadEntries().filter((e) => e.seq > this.state.ackedSeq);
-		const maxSeq = this.entries.at(-1)?.seq ?? 0;
-		this.state.lastSeq = Math.max(this.state.lastSeq, maxSeq);
+		const { entries, torn } = this.loadEntries();
+		this.entries = entries;
+		for (const e of entries) this.fileBytes += e.bytes;
+		this.state.lastSeq = Math.max(this.state.lastSeq, entries.at(-1)?.msg.seq ?? 0);
+		this.advanceHead(this.state.ackedSeq);
+		if (torn) {
+			this.writeState(this.state);
+			this.compact();
+		}
 	}
 	get runnerId() {
 		return this.state.runnerId;
@@ -22027,7 +23256,7 @@ var Journal = class {
 		return this.state.lastSeq;
 	}
 	get unacked() {
-		return this.entries.length;
+		return this.entries.length - this.head;
 	}
 	/** Assign the next seq, persist the event, and return the wire message. */
 	append(event) {
@@ -22038,20 +23267,84 @@ var Journal = class {
 			ts: (/* @__PURE__ */ new Date()).toISOString(),
 			event
 		};
-		appendFileSync(this.file, `${JSON.stringify(msg)}\n`);
-		this.entries.push(msg);
+		const line = `${JSON.stringify(msg)}\n`;
+		appendFileSync(this.file, line);
+		const bytes = Buffer.byteLength(line);
+		this.entries.push({
+			msg,
+			bytes
+		});
+		this.fileBytes += bytes;
 		return msg;
 	}
-	/** Drop everything with `seq <= seq` (cumulative ack). */
+	/** Acknowledge everything with `seq <= seq` (cumulative ack). */
 	ack(seq) {
-		if (seq <= this.state.ackedSeq) return;
-		this.state.ackedSeq = Math.min(seq, this.state.lastSeq);
-		this.entries = this.entries.filter((e) => e.seq > seq);
-		this.rewrite();
+		const upTo = Math.min(seq, this.state.lastSeq);
+		if (upTo <= this.state.ackedSeq) return;
+		this.state.ackedSeq = upTo;
+		this.advanceHead(upTo);
+		this.schedulePersist();
 	}
 	/** Unacked events after `seq`, oldest first (for replay on resume). */
 	after(seq) {
-		return this.entries.filter((e) => e.seq > seq);
+		const out = [];
+		for (let i = this.head; i < this.entries.length; i++) {
+			const msg = this.entries[i]?.msg;
+			if (msg && msg.seq > seq) out.push(msg);
+		}
+		return out;
+	}
+	/** Persist the acked position and drop every acked event from the file (runner shutdown). */
+	close() {
+		this.persist(true);
+	}
+	advanceHead(ackedSeq) {
+		for (;;) {
+			const entry = this.entries[this.head];
+			if (!entry || entry.msg.seq > ackedSeq) return;
+			this.ackedBytes += entry.bytes;
+			this.head += 1;
+		}
+	}
+	/** Enough acked events piled up, and rewriting what is left costs no more than they do. */
+	compactDue() {
+		return (this.head >= this.compactEntries || this.ackedBytes >= this.compactBytes) && this.ackedBytes >= this.fileBytes - this.ackedBytes;
+	}
+	schedulePersist() {
+		if (this.persistTimer) return;
+		this.persistTimer = setTimeout(() => {
+			this.persistTimer = void 0;
+			try {
+				this.persist(false);
+			} catch {}
+		}, this.persistMs);
+		this.persistTimer.unref();
+	}
+	/**
+	* Write the acked position, then compact when it is due (`all`: whenever anything is acked).
+	* State first, so `lastSeq` outlives the events the compaction drops.
+	*/
+	persist(all) {
+		if (this.persistTimer) clearTimeout(this.persistTimer);
+		this.persistTimer = void 0;
+		this.writeState(this.state);
+		if (all ? this.head > 0 : this.compactDue()) this.compact();
+	}
+	/** Rewrite the file without its acked events. Callers write the state first. */
+	compact() {
+		const live = this.entries.slice(this.head);
+		const tmp = `${this.file}.tmp`;
+		writeFileSync(tmp, live.map((e) => `${JSON.stringify(e.msg)}\n`).join(""));
+		renameSync(tmp, this.file);
+		this.entries = live;
+		this.head = 0;
+		this.fileBytes -= this.ackedBytes;
+		this.ackedBytes = 0;
+	}
+	writeState(state) {
+		const tmp = `${this.stateFile}.tmp`;
+		writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);
+		renameSync(tmp, this.stateFile);
 	}
 	loadState() {
 		try {
@@ -22071,25 +23364,26 @@ var Journal = class {
 		return fresh;
 	}
 	loadEntries() {
-		if (!existsSync(this.file)) return [];
-		const out = [];
-		for (const line of readFileSync(this.file, "utf8").split("\n")) {
+		if (!existsSync(this.file)) return {
+			entries: [],
+			torn: false
+		};
+		const raw = readFileSync(this.file, "utf8");
+		const entries = [];
+		let torn = raw.length > 0 && !raw.endsWith("\n");
+		for (const line of raw.split("\n")) {
 			if (!line.trim()) continue;
 			const parsed = RunnerEventMessage.safeParse(safeJson(line));
-			if (parsed.success) out.push(parsed.data);
+			if (parsed.success) entries.push({
+				msg: parsed.data,
+				bytes: Buffer.byteLength(line) + 1
+			});
+			else torn = true;
 		}
-		return out.sort((a, b) => a.seq - b.seq);
-	}
-	rewrite() {
-		const tmp = `${this.file}.tmp`;
-		writeFileSync(tmp, this.entries.map((e) => `${JSON.stringify(e)}\n`).join(""));
-		renameSync(tmp, this.file);
-		this.writeState(this.state);
-	}
-	writeState(state) {
-		const tmp = `${this.stateFile}.tmp`;
-		writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);
-		renameSync(tmp, this.stateFile);
+		return {
+			entries: entries.sort((a, b) => a.msg.seq - b.msg.seq),
+			torn
+		};
 	}
 };
 function safeJson(line) {
@@ -22584,9 +23878,24 @@ async function click(session, ref, opts = {}) {
 	const options = opts.button ? { button: opts.button } : {};
 	await withRef(session.page(opts.tabId), ref, (locator) => opts.doubleClick ? locator.dblclick(options) : locator.click(options));
 }
-/** Replace the value of an editable element; `submit` presses Enter afterwards. */
+/**
+* Replace the value of an editable element; `submit` presses Enter afterwards. Without a ref,
+* type the text as key presses into whatever has focus (a canvas editor, a game, a field
+* clicked at coordinates).
+*/
 async function type(session, ref, text, opts = {}) {
-	await withRef(session.page(opts.tabId), ref, async (locator) => {
+	const page = session.page(opts.tabId);
+	if (ref === void 0) {
+		if (text.length > 2e3) throw new CommandError("invalid_text", `Without a ref, type at most ${MAX_FOCUS_TYPE_CHARS} characters`);
+		try {
+			await page.keyboard.type(text);
+			if (opts.submit) await page.keyboard.press("Enter");
+		} catch (error) {
+			throw new CommandError("action_failed", `Typing at the focused element failed: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`);
+		}
+		return;
+	}
+	await withRef(page, ref, async (locator) => {
 		await locator.fill(text);
 		if (opts.submit) await locator.press("Enter");
 	});
@@ -22681,6 +23990,150 @@ async function wait(session, opts) {
 		throw new CommandError("action_failed", error instanceof Error ? error.message : String(error));
 	}
 }
+// ../runner/src/browser/pointer.ts
+/** Drags move in about one step per this many CSS pixels, so drag thresholds see motion. */
+const DRAG_STEP_PX = 20;
+const MIN_DRAG_STEPS = 5;
+const MAX_DRAG_STEPS = 50;
+/** A scroll returns once no scroll event came for this long (smooth scrolling has ended). */
+const SCROLL_QUIET_MS = 100;
+/** ... or after this long in the page, whatever happens. */
+const SCROLL_SETTLE_MAX_MS = 1e3;
+/** The runner stops waiting for the page itself after this (a busy or hidden page). */
+const SCROLL_SETTLE_TIMEOUT_MS = 1500;
+/**
+* Resolves once the page has had no `scroll` event (on any scroller: captured on `window`) for
+* `SCROLL_QUIET_MS`, at most `SCROLL_SETTLE_MAX_MS` (a timer too: hidden tabs get no animation
+* frames). A string, so it runs in the page's realm.
+*/
+const SCROLL_SETTLED = `new Promise((resolve) => {
+  const start = performance.now();
+  let last = start;
+  const onScroll = () => { last = performance.now(); };
+  const done = () => {
+    removeEventListener("scroll", onScroll, { capture: true });
+    clearTimeout(timer);
+    resolve(true);
+  };
+  const timer = setTimeout(done, ${SCROLL_SETTLE_MAX_MS});
+  addEventListener("scroll", onScroll, { capture: true, passive: true });
+  const tick = () => {
+    const now = performance.now();
+    if (now - last < ${SCROLL_QUIET_MS} && now - start < ${SCROLL_SETTLE_MAX_MS}) {
+      requestAnimationFrame(tick);
+    } else done();
+  };
+  requestAnimationFrame(tick);
+})`;
+/** Intermediate moves for a drag: about one per `DRAG_STEP_PX`, within 5 to 50. */
+function dragSteps(from, to) {
+	const distance = Math.hypot(to.x - from.x, to.y - from.y);
+	return Math.min(Math.max(Math.round(distance / DRAG_STEP_PX), MIN_DRAG_STEPS), MAX_DRAG_STEPS);
+}
+const fmt = (n) => String(Math.round(n * 100) / 100);
+/** Refuse a point outside the viewport: it would hit nothing, or the wrong thing. */
+function assertInViewport(point, viewport) {
+	if (point.x >= 0 && point.y >= 0 && point.x < viewport.width && point.y < viewport.height) return;
+	throw new CommandError("out_of_bounds", `Point (${fmt(point.x)}, ${fmt(point.y)}) is outside the viewport (${fmt(viewport.width)}x${fmt(viewport.height)} CSS pixels). Take a new browser_screenshot.`);
+}
+/** The points an action touches: its point, and a drag's end. */
+function pointsOf(command) {
+	const points = [{
+		x: command.x,
+		y: command.y
+	}];
+	if (command.action === "drag") points.push({
+		x: command.toX ?? NaN,
+		y: command.toY ?? NaN
+	});
+	return points;
+}
+/**
+* Run `action` with `modifiers` held, releasing every key it tried to press, also on failure.
+* A key counts as held before its press resolves: Playwright marks it down before dispatching,
+* so a press that fails can still leave it held for the next action in the shared browser.
+*/
+async function withModifiers(page, modifiers, action) {
+	const held = [];
+	try {
+		for (const key of new Set(modifiers)) {
+			held.push(key);
+			await page.keyboard.down(key);
+		}
+		await action();
+	} finally {
+		for (const key of held.reverse()) await page.keyboard.up(key).catch(() => void 0);
+	}
+}
+/**
+* Run steps that press `button`, releasing it if any of them fails, the press included (like
+* keys, Playwright marks a button held before the press is dispatched). The error is kept.
+*/
+async function releasingOnFailure(page, button, steps) {
+	try {
+		await steps();
+	} catch (error) {
+		await page.mouse.up({ button }).catch(() => void 0);
+		throw error;
+	}
+}
+async function drag(page, from, to, button) {
+	await page.mouse.move(from.x, from.y);
+	await releasingOnFailure(page, button, async () => {
+		await page.mouse.down({ button });
+		await page.mouse.move(to.x, to.y, { steps: dragSteps(from, to) });
+	});
+	await page.mouse.up({ button });
+}
+/** Wait until a scroll has been rendered, bounded; a page that never answers is not an error. */
+async function scrollSettled(page) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(resolve, SCROLL_SETTLE_TIMEOUT_MS);
+	});
+	try {
+		await Promise.race([page.evaluate(SCROLL_SETTLED).catch(() => void 0), timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Run one pointer action on a page whose viewport is `viewport` (CSS pixels). */
+async function mouseAction(page, command, viewport) {
+	const points = pointsOf(command);
+	for (const point of points) assertInViewport(point, viewport);
+	const [at, end] = points;
+	try {
+		await withModifiers(page, command.modifiers ?? [], async () => {
+			switch (command.action) {
+				case "click":
+					await releasingOnFailure(page, command.button, () => page.mouse.click(at.x, at.y, {
+						button: command.button,
+						clickCount: command.clickCount ?? 1
+					}));
+					return;
+				case "hover":
+					await page.mouse.move(at.x, at.y);
+					return;
+				case "drag":
+					await drag(page, at, end ?? at, command.button);
+					return;
+				case "scroll":
+					await page.mouse.move(at.x, at.y);
+					await page.mouse.wheel(command.deltaX ?? 0, command.deltaY ?? 0);
+					return;
+			}
+		});
+	} catch (error) {
+		if (error instanceof CommandError) throw error;
+		const message = error instanceof Error ? error.message.split("\n")[0] : String(error);
+		throw new CommandError("action_failed", `Mouse ${command.action} at (${fmt(at.x)}, ${fmt(at.y)}) failed: ${message}`);
+	}
+	if (command.action === "scroll") await scrollSettled(page);
+}
+/** `browser.mouse`: act at coordinates in a session's tab, checked against its current viewport. */
+async function mouse(session, command) {
+	await mouseAction(session.page(command.tabId), command, await session.currentViewport(command.tabId));
+}
 // ../runner/src/browser/handlers.ts
 /**
 * Handlers for the `browser.*` runner commands (§4.3, §12.2). Wire `execute` into the
@@ -22771,6 +24224,10 @@ function createBrowserCommandHandlers(deps) {
 			await press(manager.get(c.sessionId), c.key, c.tabId);
 			return {};
 		},
+		"browser.mouse": async ({ name: _name, sessionId, ...command }) => {
+			await mouse(manager.get(sessionId), command);
+			return {};
+		},
 		"browser.screenshot": (c) => screenshot(manager.get(c.sessionId), c.path, {
 			tabId: c.tabId,
 			fullPage: c.fullPage,
@@ -23634,21 +25091,34 @@ var BrowserSession = class {
 			await (await this.cdp(state)).send("Emulation.setDeviceMetricsOverride", deviceMetricsParams(this.viewport));
 		} catch {}
 	}
-	/** A native view's actual size (CSS pixels and scale), as the desktop panel laid it out. */
+	/**
+	* A view's own size (CSS pixels and scale); undefined while it has none. Throws when the page
+	* doesn't answer in time.
+	*/
+	async viewSize(page) {
+		const [width, height, scale] = await withTimeout(page.evaluate("[window.innerWidth, window.innerHeight, window.devicePixelRatio]"), NATIVE_MEASURE_TIMEOUT_MS);
+		return width && height ? {
+			width,
+			height,
+			deviceScaleFactor: scale || 1
+		} : void 0;
+	}
+	/** The shown native view's size, just measured: the session's viewport follows it. */
+	adopt(next) {
+		const changed = !sameViewport(next, this.viewport);
+		this.viewport = next;
+		this.measuredAt = Date.now();
+		if (changed) this.screencast.setFrameSize(nativeFrame(), next);
+	}
+	/**
+	* The shown native view's actual size, as the desktop panel laid it out. Tolerant, for viewer
+	* input and viewport answers: a view that doesn't answer keeps its last size.
+	*/
 	async measure() {
 		try {
-			const [width, height, scale] = await withTimeout(this.page().evaluate("[window.innerWidth, window.innerHeight, window.devicePixelRatio]"), NATIVE_MEASURE_TIMEOUT_MS);
-			if (width && height) {
-				const next = {
-					width,
-					height,
-					deviceScaleFactor: scale || 1
-				};
-				const changed = !sameViewport(next, this.viewport);
-				this.viewport = next;
-				if (changed) this.screencast.setFrameSize(nativeFrame(), next);
-			}
-			this.measuredAt = Date.now();
+			const next = await this.viewSize(this.page());
+			if (next) this.adopt(next);
+			else this.measuredAt = Date.now();
 		} catch {}
 		return { ...this.viewport };
 	}
@@ -23659,6 +25129,22 @@ var BrowserSession = class {
 	async syncViewport() {
 		if (this.native) await this.measure();
 	}
+	/**
+	* The viewport of `tabId` (default: the active tab) that an agent's coordinates refer to, now:
+	* the emulated size every tab shares, or a native view's own size measured fresh (agent actions
+	* are few, and the panel may have just resized). A native view in the background can differ
+	* from the shown one, so only the shown view's size updates the session's viewport. Strict,
+	* unlike `measure`: a view that can't be measured (busy in a script, navigating) fails with a
+	* retryable `viewport_unavailable` instead of borrowing another size, so no action is sent.
+	*/
+	async currentViewport(tabId) {
+		const state = this.tabState(tabId);
+		if (!this.native) return { ...this.viewport };
+		const size = await this.viewSize(state.page).catch(() => void 0);
+		if (!size) throw new CommandError("viewport_unavailable", `Could not measure the size of tab ${state.tabId} (the page may be busy or loading), so nothing was done. Try again in a moment.`);
+		if (state.tabId === this.activeTabId) this.adopt(size);
+		return { ...size };
+	}
 	/** The native view's size for input, measured at most once a second (pointer moves are many). */
 	async nativeViewport() {
 		if (Date.now() - this.measuredAt > NATIVE_MEASURE_MS) return this.measure();
@@ -24047,6 +25533,68 @@ function connectionHandlers(core, register, unregister, onAttach) {
 		}
 	};
 }
+/**
+* Batches streamed `item.delta` events on their way to the journal. Every event the runner
+* journals is also a send, a server transaction and an ack, and providers stream an answer a
+* few characters at a time. Per session, consecutive deltas that extend the same item the
+* same way (`mergeItemDeltas`) are merged and passed on as one: after `windowMs`, once the
+* batch holds `maxChars`, or right before any other event of that session, whoever emits it
+* (the session's provider, a checkpoint command, workspace setup). An event that belongs to
+* no session (a terminal exiting, a drain) passes every batch on first. So no event overtakes
+* a delta that came before it, and only deltas ever wait.
+*/
+var DeltaBatcher = class {
+	out;
+	opts;
+	batches = /* @__PURE__ */ new Map();
+	constructor(out, opts = {}) {
+		this.out = out;
+		this.opts = opts;
+	}
+	push(event) {
+		if (event.kind === "agent" && event.event.type === "item.delta") {
+			this.add(event.sessionId, event.event);
+			return;
+		}
+		this.flush("sessionId" in event ? event.sessionId : void 0);
+		this.out(event);
+	}
+	/** Pass on the pending batch of one session, or of every session. */
+	flush(sessionId) {
+		if (sessionId === void 0) {
+			for (const id of [...this.batches.keys()]) this.flush(id);
+			return;
+		}
+		const batch = this.batches.get(sessionId);
+		if (!batch) return;
+		clearTimeout(batch.timer);
+		this.batches.delete(sessionId);
+		this.out({
+			kind: "agent",
+			sessionId,
+			event: batch.delta
+		});
+	}
+	add(sessionId, delta) {
+		const chars = itemDeltaText(delta.delta).length;
+		let batch = this.batches.get(sessionId);
+		const merged = batch && mergeItemDeltas(batch.delta, delta);
+		if (batch && merged) {
+			batch.delta = merged;
+			batch.chars += chars;
+		} else {
+			this.flush(sessionId);
+			const windowMs = this.opts.windowMs ?? 50;
+			batch = {
+				delta,
+				chars,
+				timer: setTimeout(() => this.flush(sessionId), windowMs)
+			};
+			this.batches.set(sessionId, batch);
+		}
+		if (batch.chars >= (this.opts.maxChars ?? 16384)) this.flush(sessionId);
+	}
+};
 // ../runner/src/session-host.ts
 /**
 * Owns live provider sessions on this runner and pumps their normalized events into the
@@ -24137,7 +25685,12 @@ var SessionHost = class {
 	async send(cmd) {
 		const hosted = this.get(cmd.sessionId);
 		await hosted.checkpointChain;
-		await hosted.session.send(cmd.input);
+		try {
+			await hosted.session.send(cmd.input);
+		} catch (error) {
+			if (error instanceof ProviderSessionError && error.code === "turn_running") throw new CommandError("turn_running", error.message);
+			throw error;
+		}
 	}
 	async steer(cmd) {
 		const { session } = this.get(cmd.sessionId);
@@ -24346,11 +25899,15 @@ async function startRunner(opts) {
 	let mcpUpstream = opts.mcpUpstreamUrl ? new HttpMcpUpstream(opts.mcpUpstreamUrl) : void 0;
 	let port = 0;
 	let stopped = false;
-	const emit = (event) => {
+	const journalEvent = (event) => {
 		if (stopped) return;
 		const msg = journal.append(event);
 		attached?.deliver(msg);
 	};
+	const deltas = new DeltaBatcher(journalEvent, opts.deltaBatching);
+	const emit = (event) => {
+		if (!stopped) deltas.push(event);
+	};
 	const stream = (data) => {
 		attached?.deliver({
 			type: "stream",
@@ -24481,7 +26038,13 @@ async function startRunner(opts) {
 				if ("closeAllConnections" in server) server.closeAllConnections();
 			});
 			process.off("exit", removeLock);
+			deltas.flush();
 			stopped = true;
+			try {
+				journal.close();
+			} catch (error) {
+				log(`journal: ${String(error)}`);
+			}
 			log("runner stopped");
 		})();
 		return closing;
@@ -24494,6 +26057,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { isElectronRuntime as A, installClaudeSdk as C, acquireInstallLock as D, resolveNpm as E, import_websocket_server as M, wrapper_default as N, brokenInstallMessage as O, importClaudeSdkFrom as S, runNpm as T, claudeMemoryDir as _, bufferToFormData as a, claudeSdkSource as b, refreshProcessPath as c, ImageEngineRegistry as d, createImageEngineRegistry as f, ImageGenerationError as g, resolveImageOutput as h, tryDecodeURIComponent as i, ownNodeEnv as j, findExecutable as k, defaultShell as l, imageInfo as m, readLock as n, createAdaptorServer as o, IMAGE_ASPECT_RATIOS as p, Hono as r, upgradeWebSocket as s, startRunner as t, shellCommandLine as u, findGitRoot as v, isClaudeSdkInstalled as w, CLAUDE_SDK_VERSION as x, mainRepoRoot as y };
+export { findExecutable as A, installClaudeSdk as C, acquireInstallLock as D, resolveNpm as E, ownNodeEnv as M, import_websocket_server as N, isSecretPath as O, wrapper_default as P, importClaudeSdkFrom as S, runNpm as T, claudeMemoryDir as _, bufferToFormData as a, claudeSdkSource as b, refreshProcessPath as c, ImageEngineRegistry as d, createImageEngineRegistry as f, ImageGenerationError as g, resolveImageOutput as h, tryDecodeURIComponent as i, isElectronRuntime as j, brokenInstallMessage as k, defaultShell as l, imageInfo as m, readLock as n, createAdaptorServer as o, IMAGE_ASPECT_RATIOS as p, Hono as r, upgradeWebSocket as s, startRunner as t, shellCommandLine as u, findGitRoot as v, isClaudeSdkInstalled as w, CLAUDE_SDK_VERSION as x, mainRepoRoot as y };
 
-//# sourceMappingURL=runner-DYf8dV43.js.map
+//# sourceMappingURL=runner-CQYh087M.js.map