codeden 0.6.3 → 0.7.0

package/dist/{runner-CiaiUWOE.js → runner-CQYh087M.js}

@@ -1,5 +1,5 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
-import { Ar as ReasoningEffort, Bn as BROWSER_RELAY_SECRET_HEADER, Hn as RuntimeResponse, Vn as ProviderCapabilities, Wn as ProjectConfigFile, a as childEnv, ar as winningCommands, d as RunnerLock, er as AgentEvent, i as listDescendants, ir as oneLineDescription, m as ServerToRunnerMessage, n as killTree$1, nr as mergeItemDeltas, o as CODEDEN_VERSION, or as itemDeltaText, sr as UserInput, t as isAlive$1, u as RunnerEventMessage, zn as SETUP_TAIL_LIMIT } from "./tree-31WAOm5k.js";
+import { $n as ProjectConfigFile, Hn as SETUP_TAIL_LIMIT, Un as BROWSER_RELAY_SECRET_HEADER, Xn as ProviderCapabilities, Yn as CODEDEN_CREDENTIAL_FILES, Zn as RuntimeResponse, a as childEnv, d as RunnerEventMessage, dr as mergeItemDeltas, f as RunnerLock, gr as UserInput, h as ServerToRunnerMessage, hr as itemDeltaText, i as listDescendants, lr as AgentEvent, mr as winningCommands, n as killTree$1, o as CODEDEN_VERSION, pr as oneLineDescription, qn as MAX_FOCUS_TYPE_CHARS, t as isAlive$1, zr as ReasoningEffort } from "./tree-Bjv-rXir.js";
 import { createRequire } from "node:module";
 import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { pathToFileURL } from "node:url";
@@ -4521,18 +4521,29 @@ const reasonOf = (error) => error instanceof Error ? error.message : String(erro
 * Copy a Claude conversation with the SDK's `forkSession()`: the transcript is written to a new
 * session file at once (fresh message ids, the original untouched) and the new session id is
 * returned for resuming. With `upTo` (a turn's fork point: its last transcript message), the
-* transcript is read first (`getSessionMessages`) to confirm it still holds that message, and
-* the copy ends with it. A conversation that no longer holds it (replaced or deleted) throws
-* `FORK_POINT_MISSING` before anything is copied, so it never becomes a whole copy instead.
+* copy ends with that message. A conversation that no longer holds it (replaced or deleted)
+* throws `FORK_POINT_MISSING` before anything is copied, so it never becomes a whole copy
+* instead: `confirmForkPoint` refuses it from the transcript read when it can, and otherwise
+* `forkSession()` does, as it slices the whole transcript file and refuses a message the file
+* doesn't hold before writing anything (SDK 0.3.318: `Message <uuid> not found in session <id>`).
 */
 async function forkClaudeConversation(sdk, resumeToken, upTo) {
 	if (upTo) await confirmForkPoint(sdk, resumeToken, upTo);
 	try {
 		return (await sdk.forkSession(resumeToken, upTo ? { upToMessageId: upTo } : void 0)).sessionId;
 	} catch (error) {
+		if (upTo && refusedForkPoint(error, upTo)) throw forkPointMissing();
 		throw new Error(`Could not fork the Claude conversation ${resumeToken}: ${reasonOf(error)}`);
 	}
 }
+/**
+* Read the transcript (`getSessionMessages`) and refuse a fork point it doesn't hold. That read
+* follows `parentUuid` links back from the newest message, and a context compaction's boundary
+* has none, so in a compacted conversation it starts at the latest boundary (a `system`
+* message) and leaves out every earlier message, although the transcript file still holds
+* them. A fork point missing from such a read may be before the compaction, so `forkSession()`
+* decides then. An empty read (a conversation that was deleted) holds nothing.
+*/
 async function confirmForkPoint(sdk, resumeToken, upTo) {
 	let messages;
 	try {
@@ -4540,7 +4551,15 @@ async function confirmForkPoint(sdk, resumeToken, upTo) {
 	} catch (error) {
 		throw new Error(`Could not read the Claude conversation ${resumeToken}: ${reasonOf(error)}`);
 	}
-	if (!messages.some((m) => m.uuid === upTo)) throw new ProviderSessionError(FORK_POINT_MISSING, "The conversation no longer holds the end of that turn (it was replaced or deleted), so it can't be forked there");
+	if (!(messages[0]?.type === "system") && !messages.some((m) => m.uuid === upTo)) throw forkPointMissing();
+}
+/** Whether `forkSession()` refused `upTo` as a message its transcript doesn't hold. */
+function refusedForkPoint(error, upTo) {
+	const reason = reasonOf(error);
+	return reason.includes(upTo) && /\bnot found\b/i.test(reason);
+}
+function forkPointMissing() {
+	return new ProviderSessionError(FORK_POINT_MISSING, "The conversation no longer holds the end of that turn (it was replaced or deleted), so it can't be forked there");
 }
 // ../../packages/providers/src/util/model.ts
 /** The id the model pickers use for "the provider's own default model". */
@@ -4553,8 +4572,26 @@ function explicitModel(model) {
 	const id = model?.trim();
 	return id && id !== "default" ? id : void 0;
 }
+// ../../packages/providers/src/policy/assessment.ts
+const SAFE = { risky: false };
+const risky = (action, reason) => ({
+	risky: true,
+	action,
+	reason
+});
+/** True for a verdict on CodeDen's own credential files. */
+const touchesCodeden = (risk) => risk.risky && risk.codeden === true;
+/**
+* The verdict for several checks of one action: CodeDen's own credentials first (a level may
+* allow an ordinary risk that comes before them), then the first risky one, else safe.
+*/
+function mostSevere(risks) {
+	return risks.find(touchesCodeden) ?? risks.find((r) => r.risky) ?? SAFE;
+}
 // ../../packages/providers/src/policy/paths.ts
+/** True when the context's paths are Windows paths. */
 const isWin = (ctx) => (ctx.platform ?? process.platform) === "win32";
+/** The path functions for the context's platform. */
 function pathApi(ctx) {
 	return isWin(ctx) ? path.win32 : path.posix;
 }
@@ -4571,6 +4608,8 @@ const HOME_VARS = /^(\$HOME|\$\{HOME\}|\$env:USERPROFILE|%USERPROFILE%)(?=$|[\\/
 * printed) is not the temp directory; PowerShell's and cmd's names are not.
 */
 const TEMP_VARS = [/^(\$TMPDIR|\$\{TMPDIR\}|\$TEMP|\$\{TEMP\}|\$TMP|\$\{TMP\})(?=$|[\\/])/, /^(\$env:TEMP|\$env:TMP|%TEMP%|%TMP%)(?=$|[\\/])/i];
+/** CodeDen's home variable, which agents inherit: case-sensitive in POSIX shells only. */
+const CODEDEN_HOME_VARS = [/^(\$CODEDEN_HOME|\$\{CODEDEN_HOME\})(?=$|[\\/])/, /^(\$env:CODEDEN_HOME|%CODEDEN_HOME%)(?=$|[\\/])/i];
 /**
 * Git Bash paths on Windows: `/c/Users/x` is `C:\Users\x`, and `/tmp` is the user's temp
 * directory.
@@ -4582,9 +4621,9 @@ function fromGitBash(value, temp) {
 	return value;
 }
 /**
-* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home or
-* temp variable) to an absolute path. On Windows the directory it resolves from may be in Git
-* Bash form too: the shell reports `/c/Users/x/repo` once a command has run in it.
+* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home, temp or
+* CodeDen home variable) to an absolute path. On Windows the directory it resolves from may be
+* in Git Bash form too: the shell reports `/c/Users/x/repo` once a command has run in it.
 */
 function resolveAgainst(target, ctx) {
 	const p = pathApi(ctx);
@@ -4592,6 +4631,8 @@ function resolveAgainst(target, ctx) {
 	const home = homeOf(ctx);
 	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) value = home + value.slice(1);
 	value = value.replace(HOME_VARS, home);
+	const codeden = ctx.codedenHome;
+	if (codeden) for (const vars of CODEDEN_HOME_VARS) value = value.replace(vars, codeden);
 	const temp = tempRootsOf(ctx)[0];
 	if (temp) for (const vars of TEMP_VARS) value = value.replace(vars, temp);
 	let base = ctx.dir ?? ctx.cwd;
@@ -4611,6 +4652,10 @@ function relative$1(root, target, ctx) {
 	const norm = (s) => isWin(ctx) ? p.resolve(s).toLowerCase() : p.resolve(s);
 	return p.relative(norm(root), norm(target));
 }
+/** True when two absolute paths name the same file. Case-insensitive on Windows. */
+function samePath(a, b, ctx) {
+	return relative$1(a, b, ctx) === "";
+}
 /** True when `target` is inside the worktree or one of the extra roots. */
 function isInWorkspace(target, ctx) {
 	const abs = resolveAgainst(target, ctx);
@@ -4727,13 +4772,6 @@ function isSecretPath(target) {
 	if (SECRET_EXTENSIONS.some((ext) => base.endsWith(ext))) return true;
 	return /(^|\/)\.(ssh|aws|gnupg|docker)\//i.test(normalized) && !base.endsWith(".pub");
 }
-// ../../packages/providers/src/policy/assessment.ts
-const SAFE = { risky: false };
-const risky = (action, reason) => ({
-	risky: true,
-	action,
-	reason
-});
 // ../../packages/providers/src/policy/git.ts
 /**
 * Git rules of the risk classifier (§11.2): force pushes, deleting refs, global config. `args`
@@ -5684,6 +5722,590 @@ function unixToIso(value) {
 	const ms = value < 0xe8d4a51000 ? value * 1e3 : value;
 	return new Date(ms).toISOString();
 }
+// ../../packages/providers/src/policy/codeden-home.ts
+/**
+* CodeDen's own credential files (§15): the install token, the runner lock and the remote
+* access store in its data directory. An agent holding the install token or the runner's token
+* could drive CodeDen itself and approve its own requests, so touching one asks at every level,
+* Full included, and is refused for read-only sessions (§11.2). The data directory comes from
+* the session (`SessionOptions.codedenHome`); without it, this rule is off.
+*/
+/** A risky verdict on CodeDen's own credentials, which every level asks about. */
+function credentialsRisk(reason) {
+	return {
+		risky: true,
+		action: "secrets",
+		reason,
+		codeden: true
+	};
+}
+/** The credential files in the session's CodeDen home, as absolute paths (none without one). */
+function codedenCredentialFiles(ctx) {
+	const home = ctx.codedenHome;
+	if (!home) return [];
+	const p = pathApi(ctx);
+	return CODEDEN_CREDENTIAL_FILES.map((file) => p.join(home, file));
+}
+/** The credential files, then the folders that hold them. */
+function guardedPaths(ctx) {
+	const files = codedenCredentialFiles(ctx);
+	const p = pathApi(ctx);
+	return [...files, ...new Set(files.map((file) => p.dirname(file)))];
+}
+const WILDCARD = /[*?[]/;
+/** `c` matched as itself in a regular expression. */
+const literalChar = (c) => c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* A shell wildcard (`*`, `?`, `[...]`, and `**`, which before a slash stands for zero or more
+* folders) over a `/`-separated path as a regular expression. Its first `literal` characters
+* match as themselves. Undefined when malformed.
+*/
+function wildcardPattern(pattern, ignoreCase, literal = 0) {
+	let source = pattern.slice(0, literal).replace(/[\s\S]/g, literalChar);
+	for (let i = literal; i < pattern.length; i += 1) {
+		const c = pattern[i];
+		if (c === "*" && pattern[i + 1] === "*") {
+			const folders = pattern[i + 2] === "/";
+			source += folders ? "(?:.*/)?" : ".*";
+			i += folders ? 2 : 1;
+		} else if (c === "*") source += "[^/]*";
+		else if (c === "?") source += "[^/]";
+		else if (c === "[" && pattern.indexOf("]", i + 2) > 0) {
+			const end = pattern.indexOf("]", i + 2);
+			const body = pattern.slice(i + 1, end).replace(/^!/, "^").replace(/\\/g, "\\\\");
+			source += `[${body}]`;
+			i = end;
+		} else source += literalChar(c);
+	}
+	try {
+		return new RegExp(`^${source}$`, ignoreCase ? "i" : "");
+	} catch {
+		return;
+	}
+}
+/** `/`-separated, for wildcard matching; Windows paths match in any case. */
+function slashes(value, ctx) {
+	return isWin(ctx) ? value.replace(/\\/g, "/") : value;
+}
+/**
+* Variables left in a resolved path (`$f`, `${f}`, `$env:F`, `%F%`) could be any name, so they
+* match like `*`. `$CODEDEN_HOME`, `$HOME` and the temp variables at the start resolve first.
+*/
+const PATH_VARIABLE = /\$\{\w+\}|\$env:\w+|\$\w+|%\w+%/gi;
+/**
+* How many leading characters of `abs` are CodeDen's home or a folder above it, at a folder
+* boundary. That part comes from the session (`$CODEDEN_HOME`, `~`, the working directory), so it
+* is always literal: `[`, `*`, `?` or `$` in the home's own path (`CodeDen [dev]`) are never a
+* pattern. Compared like `samePath`, in any case on Windows.
+*/
+function literalPrefix(abs, ctx) {
+	const home = ctx.codedenHome;
+	if (!home) return 0;
+	const p = pathApi(ctx);
+	const value = slashes(abs, ctx);
+	const fold = (s) => isWin(ctx) ? s.toLowerCase() : s;
+	for (let dir = p.resolve(home);; dir = p.dirname(dir)) {
+		const prefix = slashes(dir, ctx).replace(/\/$/, "");
+		const n = prefix.length;
+		const atBoundary = value.length === n || value[n] === "/";
+		if (n > 0 && atBoundary && fold(value.slice(0, n)) === fold(prefix)) return n;
+		if (p.dirname(dir) === dir) return 0;
+	}
+}
+/** `target` as an absolute path, the unknown variables it adds as wildcards. */
+function resolvePattern(target, ctx) {
+	const abs = resolveAgainst(target, ctx);
+	const literal = literalPrefix(abs, ctx);
+	return abs.slice(0, literal) + abs.slice(literal).replace(PATH_VARIABLE, "*");
+}
+/**
+* The wildcards in `abs` (from `resolvePattern`) as a regular expression over `/`-separated
+* paths, or undefined when it has none (or is malformed). Only the agent's part can be a pattern:
+* CodeDen's home, and the folders above it, match literally (`literalPrefix`).
+*/
+function agentPattern(abs, ctx) {
+	const value = slashes(abs, ctx);
+	const literal = literalPrefix(abs, ctx);
+	if (!WILDCARD.test(value.slice(literal))) return void 0;
+	return wildcardPattern(value, isWin(ctx), literal);
+}
+/**
+* True when `target` reaches one of CodeDen's credential files: the file itself, a folder that
+* holds one (`<home>`, `<home>/runner`: copying or searching it reads them), or a wildcard that
+* matches either. `~`, `$HOME`, `$CODEDEN_HOME` (and its PowerShell and cmd forms) and relative
+* paths resolve as in the shell. The home itself is always compared literally.
+*/
+function touchesCodedenCredentials(target, ctx) {
+	if (!ctx.codedenHome || !target.trim()) return false;
+	const abs = resolvePattern(target, ctx);
+	const guarded = guardedPaths(ctx);
+	if (guarded.some((p) => samePath(p, abs, ctx))) return true;
+	const pattern = agentPattern(abs, ctx);
+	return pattern !== void 0 && guarded.some((p) => pattern.test(slashes(p, ctx)));
+}
+// ../../packages/providers/src/policy/search-words.ts
+/**
+* Search commands (`grep`, `rg`, `findstr`, `Select-String`, ...) read as the tool reads them, for
+* the risk classifier (§11.2). Each word gets one role, once: an option, an option's value or an
+* operand. The pattern is an option's pattern value, or else the first operand. Because roles are
+* fixed in one pass, a value that looks like an option (`rg -r-e`: replacement text `-e`) is never
+* read as one, and a word that looks like a pattern option is never skipped as a value.
+*/
+/** Search commands, whose first operand is the pattern (`grep -rn "process.env" src`). */
+const SEARCHES = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep",
+	"rg",
+	"ag",
+	"ack",
+	"findstr",
+	"select-string",
+	"sls"
+]);
+/** Options that take the next word as their value, per search tool. */
+const GREP_VALUED = [
+	"-A",
+	"-B",
+	"-C",
+	"-m",
+	"-d",
+	"-D",
+	"--after-context",
+	"--before-context",
+	"--context",
+	"--max-count",
+	"--include",
+	"--exclude",
+	"--exclude-dir",
+	"--label",
+	"--binary-files",
+	"--devices",
+	"--directories"
+];
+const RG_VALUED = [
+	...GREP_VALUED,
+	"-g",
+	"--glob",
+	"--iglob",
+	"-t",
+	"--type",
+	"-T",
+	"--type-not",
+	"-j",
+	"--threads",
+	"--max-depth",
+	"-M",
+	"--max-columns",
+	"--sort",
+	"--sortr",
+	"-r",
+	"--replace",
+	"--colors",
+	"-E",
+	"--encoding"
+];
+const SELECT_STRING_VALUED = [
+	"-path",
+	"-literalpath",
+	"-include",
+	"-exclude",
+	"-encoding",
+	"-context"
+];
+/** Tools whose option names are matched in any case (names are kept in lower case). */
+const ANY_CASE = /* @__PURE__ */ new Set([
+	"findstr",
+	"select-string",
+	"sls"
+]);
+/**
+* Tools whose short options combine in one word, the getopt way (`-ne.` is `-n -e .`), and whose
+* `-e` and `-f` take a value. `ag -f` and `ack -f` take none, so their words stay as written.
+*/
+const CLUSTERING = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep",
+	"rg"
+]);
+/** Options whose value is the search pattern. */
+const PATTERN_OPTIONS = [
+	"-e",
+	"--regexp",
+	"-pattern",
+	"/c"
+];
+/** Options that give the pattern another way, a pattern file: then no operand is the pattern. */
+const isPatternFile = (name) => name === "-f" || name.startsWith("--file") || name === "/g";
+/** True when the option `name` takes the next word as its value. */
+function takesValue(bin, name) {
+	if ([
+		"-e",
+		"--regexp",
+		"-pattern",
+		"-f",
+		"--file"
+	].includes(name)) return true;
+	if (bin === "rg") return RG_VALUED.includes(name);
+	if (bin === "select-string" || bin === "sls") return SELECT_STRING_VALUED.includes(name);
+	return GREP_VALUED.includes(name);
+}
+/** An option word's value bound with `=` or `:` (`--glob=x`, `-Path:x`, `/c:x`). */
+const BOUND = /^(--?[A-Za-z][\w-]*|\/[A-Za-z])[=:]/;
+/** Parse a search command's arguments (after the program name) into roles. */
+function parseSearch(bin, args) {
+	const words = [];
+	const add = (text, role, arg, from = 0, option) => words.push({
+		text,
+		role,
+		option,
+		arg,
+		from,
+		pattern: false
+	});
+	const fold = (name) => ANY_CASE.has(bin) ? name.toLowerCase() : name;
+	const isOption = (a) => a.startsWith("-") || bin === "findstr" && a.startsWith("/");
+	let operandsOnly = false;
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		if (operandsOnly || !isOption(a)) add(a, "operand", i);
+		else if (a === "--") {
+			operandsOnly = true;
+			add(a, "option", i, 0, a);
+		} else if (CLUSTERING.has(bin) && /^-[^-]./.test(a)) for (let j = 1; j < a.length; j += 1) {
+			const flag = `-${a[j]}`;
+			add(flag, "option", -1, 0, flag);
+			if (!takesValue(bin, flag)) continue;
+			if (j + 1 < a.length) add(a.slice(j + 1), "value", i, j + 1, flag);
+			else if (i + 1 < args.length) add(args[++i], "value", i, 0, flag);
+			break;
+		}
+		else {
+			const bound = BOUND.exec(a);
+			const name = fold(bound?.[1] ?? a);
+			add(a, "option", i, 0, name);
+			if (!bound && takesValue(bin, name) && i + 1 < args.length) add(args[++i], "value", i, 0, name);
+		}
+	}
+	markPatterns(words);
+	return words;
+}
+/**
+* Mark the pattern words: the values of `-e`, `--regexp`, `-Pattern` and `findstr /c:`, or, when
+* no option gives the pattern (nor a pattern file, `-f`), the first operand.
+*/
+function markPatterns(words) {
+	let explicit = false;
+	for (const w of words) {
+		const name = w.option ?? "";
+		if (w.role === "value" && PATTERN_OPTIONS.includes(name)) {
+			w.pattern = true;
+			explicit = true;
+		} else if (w.role === "option" && PATTERN_OPTIONS.includes(name)) {
+			explicit = true;
+			if (w.text.length > name.length) w.pattern = true;
+		} else if (w.role === "option" && isPatternFile(name)) explicit = true;
+	}
+	if (explicit) return;
+	const first = words.find((w) => w.role === "operand");
+	if (first) first.pattern = true;
+}
+/** The file operands of a parsed search (`grep -r -e x src lib` -> `src`, `lib`). */
+function searchOperands(words) {
+	return words.filter((w) => w.role === "operand" && !w.pattern);
+}
+/** The values given to the named options: `name X`, `name=X`, or in a cluster (`-gX`). */
+function searchOptionValues(words, names) {
+	return words.flatMap((w) => {
+		if (!w.option || !names.includes(w.option)) return [];
+		if (w.role === "value") return [w.text];
+		return w.role === "option" && w.text.length > w.option.length ? [w.text.slice(w.option.length + 1)] : [];
+	});
+}
+// ../../packages/providers/src/policy/secrets.ts
+/**
+* Secrets rules of the risk classifier (§11.2): which words of a command read a credentials
+* file, and which commands dump the environment. Writing a secrets file inside the worktree is
+* not access (`cp .env.example .env`); reading one is.
+*/
+/**
+* The argument as a path, or undefined when it can't be one: inline code, multi-line text
+* or anything with shell or code punctuation (`selected={row.key`) is not a file name. A
+* variable in braces (`${HOME}/.env`) is a path, and so is an option's value: `--file=x`, or
+* PowerShell's colon-bound `-Path:x` and `-LiteralPath:x`.
+*/
+function asPath(arg) {
+	const value = arg.replace(/^-+[a-z-]*=/i, "").replace(/^-[a-z][a-z-]*:(?=.)/i, "");
+	if (!value || /[\n\r{}()<>|;=`]/.test(value.replace(/\$\{\w+\}/g, ""))) return void 0;
+	return value;
+}
+/** Commands whose words are data or only checked for existence (`echo .env >> .gitignore`). */
+const DATA = /* @__PURE__ */ new Set([
+	"echo",
+	"printf",
+	"write-output",
+	"write-host",
+	"test",
+	"[",
+	"[["
+]);
+/** Commands that list or describe files without reading them (`ls certs/*.pem`). */
+const LISTS = /* @__PURE__ */ new Set([
+	"ls",
+	"dir",
+	"get-childitem",
+	"gci",
+	"find",
+	"fd",
+	"tree",
+	"stat",
+	"du",
+	"test-path"
+]);
+/**
+* The first argument that reads a credentials file, if any. `written` are the paths the command
+* writes (a copy's destination), which classifyWrite judges instead. `isSecret` decides which
+* paths count (default: secrets files by name). `paths` gives what a word may stand for (each
+* element of a PowerShell list, `shell.wordPaths`). A search's patterns are skipped whole, list
+* elements included: the tool searches for them, not in them.
+*/
+function secretArgument(bin, args, written = [], isSecret = isSecretPath, paths = (word, from) => [word.slice(from)]) {
+	if (DATA.has(bin)) return void 0;
+	const runs = (bin === "find" || bin === "fd") && args.some((a) => /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/.test(a));
+	if (LISTS.has(bin) && !runs) return void 0;
+	return (SEARCHES.has(bin) ? parseSearch(bin, args) : args.map((text, arg) => ({
+		text,
+		arg,
+		from: 0,
+		pattern: false
+	}))).find((w) => {
+		if (w.pattern || written.includes(w.text)) return false;
+		return (w.arg >= 0 ? paths(args[w.arg], w.from) : [w.text]).some((word) => braceAlternatives(word).some((alt) => {
+			const value = asPath(alt);
+			return value !== void 0 && isSecret(value);
+		}));
+	})?.text;
+}
+/** The most words one argument's brace expansion is followed to. */
+const MAX_ALTERNATIVES = 64;
+/**
+* The words a shell's brace expansion makes of `word` (`~/.ssh/{id_rsa,x}` -> `~/.ssh/id_rsa`,
+* `~/.ssh/x`), capped; just `word` when it has no `{a,b}` group.
+*/
+function braceAlternatives(word) {
+	const group = /\{([^{}]*,[^{}]*)\}/.exec(word);
+	if (!group?.[1]) return [word];
+	const before = word.slice(0, group.index);
+	const after = word.slice(group.index + group[0].length);
+	const out = [];
+	for (const part of group[1].split(",")) for (const alt of braceAlternatives(before + part + after)) {
+		if (out.length >= MAX_ALTERNATIVES) return out;
+		out.push(alt);
+	}
+	return out;
+}
+/** Files a tool writes through its own options (`openssl req -keyout key.pem -out cert.pem`). */
+function toolOutputs(bin, args) {
+	if (bin !== "openssl" && bin !== "ssh-keygen") return [];
+	const flags = bin === "openssl" ? ["-out", "-keyout"] : ["-f"];
+	return args.flatMap((a, i) => flags.includes(a) && args[i + 1] ? [args[i + 1]] : []);
+}
+/** Variable names that may hold a credential. */
+const SECRET_VAR = /key|token|secret|passw|pwd|credential|auth|private|session|cookie/i;
+/**
+* True for `printenv` and `Get-ChildItem env:` listings. Printing named variables that don't
+* look like credentials (`printenv PATH`, `Get-ChildItem env:NODE_ENV`) is not a dump.
+*/
+function dumpsEnvironment(bin, args) {
+	const named = (names) => names.length > 0 && names.every((n) => /^\w+$/.test(n) && !SECRET_VAR.test(n));
+	if (bin === "printenv") return !named(args.filter((a) => !a.startsWith("-")));
+	if (!/^(get-childitem|gci|ls|dir)$/.test(bin)) return false;
+	const drives = args.filter((a) => /^env:/i.test(a));
+	return drives.length > 0 && !named(drives.map((a) => a.slice(4)));
+}
+// ../../packages/providers/src/policy/codeden-search.ts
+/** The values of an option, given as `name X`, `name=X` or `name:X`, each time it appears. */
+function optionValues(args, names, anyCase) {
+	const out = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		const word = anyCase ? a.toLowerCase() : a;
+		if (names.includes(word)) {
+			if (i + 1 < args.length) out.push(args[i + 1]);
+			i += 1;
+			continue;
+		}
+		const bound = names.find((n) => word.startsWith(`${n}=`) || word.startsWith(`${n}:`));
+		if (bound) out.push(a.slice(bound.length + 1));
+	}
+	return out;
+}
+const GREPS = /* @__PURE__ */ new Set([
+	"grep",
+	"egrep",
+	"fgrep",
+	"zgrep"
+]);
+/** `grep -r`, `-R`, `-rn`, `--recursive`, `-d recurse`: grep reads folders only then. */
+function grepRecursive(words) {
+	return words.some((w) => w.role === "option" && /^(-r|-R|--recursive|--dereference-recursive)$/.test(w.text)) || searchOptionValues(words, ["-d", "--directories"]).includes("recurse");
+}
+/**
+* The folders a search reads recursively, with its name filters. Roles come from `parseSearch`
+* (`grep -re. ~` is `grep -r -e . ~`; in `rg -r-g x ~`, `-g` is replacement text, not a filter),
+* and each root may be a PowerShell list (`paths`).
+*/
+function searchWalks(bin, args, ctx, paths) {
+	const words = parseSearch(bin, args);
+	const operands = searchOperands(words).flatMap((w) => paths(args[w.arg], w.from));
+	if (bin === "rg" || bin === "ag" || bin === "ack") return [{
+		roots: operands,
+		recursive: true,
+		names: bin === "rg" ? searchOptionValues(words, [
+			"-g",
+			"--glob",
+			"--iglob"
+		]).filter((n) => !n.startsWith("!")) : []
+	}];
+	if (GREPS.has(bin)) {
+		if (!grepRecursive(words)) return [];
+		return [{
+			roots: operands,
+			recursive: true,
+			names: searchOptionValues(words, ["--include"])
+		}];
+	}
+	const sub = words.some((w) => w.role === "option" && /^\/[a-z]*s[a-z]*$/i.test(w.text));
+	if (bin === "findstr" && sub) {
+		const p = pathApi(ctx);
+		return operands.map((operand) => ({
+			roots: [p.dirname(operand)],
+			recursive: true,
+			names: [p.basename(operand)]
+		}));
+	}
+	return [];
+}
+const LISTINGS = /* @__PURE__ */ new Set([
+	"get-childitem",
+	"gci",
+	"dir",
+	"ls"
+]);
+const LISTING_VALUED = [
+	"-filter",
+	"-include",
+	"-exclude",
+	"-depth",
+	"-attributes"
+];
+/** `find -exec cat {} +` and `fd -x cat` hand what they find to a command. */
+const RUNS = /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/;
+/** The folders a listing goes through, with its name filters. */
+function listingWalk(bin, args) {
+	if (bin === "find") {
+		const end = args.findIndex((a) => /^[-(!)]/.test(a));
+		const either = args.some((a) => [
+			"-o",
+			"-or",
+			"!",
+			"-not"
+		].includes(a));
+		return {
+			roots: end < 0 ? args : args.slice(0, end),
+			recursive: true,
+			names: either ? [] : optionValues(args, ["-name", "-iname"], false)
+		};
+	}
+	if (bin === "fd") return {
+		roots: args.filter((a) => !a.startsWith("-")).slice(1),
+		recursive: true,
+		names: []
+	};
+	if (!LISTINGS.has(bin)) return void 0;
+	const recursive = args.some((a) => /^-rec/i.test(a) || a === "-r" || /^-[a-zA-Z]*R[a-zA-Z]*$/.test(a) || /^\/s$/i.test(a));
+	const named = optionValues(args, ["-path", "-literalpath"], true);
+	const positional = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const a = args[i];
+		const lower = a.toLowerCase();
+		if (LISTING_VALUED.includes(lower) || lower === "-path" || lower === "-literalpath") i += 1;
+		else if (!a.startsWith("-") && !/^\/[a-z](:\S*)?$/i.test(a)) positional.push(a);
+	}
+	return {
+		roots: [...named, ...positional].flatMap((root) => root.split(",")),
+		recursive,
+		names: optionValues(args, ["-filter", "-include"], true).flatMap((n) => n.split(","))
+	};
+}
+/**
+* True when listing `dir` (and, recursively, its subfolders) reaches `folder`: by its path, or
+* through the wildcards the agent wrote in it (never ones in CodeDen's home path).
+*/
+function holds(dir, folder, recursive, ctx) {
+	if (recursive ? isInside$1(folder, dir, ctx) : samePath(dir, folder, ctx)) return true;
+	const pattern = agentPattern(dir, ctx);
+	if (!pattern) return false;
+	const p = pathApi(ctx);
+	for (let at = folder;; at = p.dirname(at)) {
+		if (pattern.test(slashes(at, ctx))) return true;
+		if (!recursive || p.dirname(at) === at) return false;
+	}
+}
+/** True when `file`, found under `root`, passes one of the name filters (or there are none). */
+function keeps(names, file, root, ctx) {
+	if (names.length === 0) return true;
+	const p = pathApi(ctx);
+	const base = p.basename(file);
+	const below = slashes(p.relative(root, file), ctx);
+	return names.flatMap((name) => braceAlternatives(name.trim().replace(/^\.[\\/]/, ""))).some((name) => {
+		const pattern = wildcardPattern(slashes(name, ctx), true);
+		if (!pattern) return true;
+		return /[\\/]/.test(name) ? pattern.test(below) : pattern.test(base);
+	});
+}
+/** The root of `walk` from which it reaches a credential file, if any. */
+function walkReaches(walk, ctx) {
+	const files = codedenCredentialFiles(ctx);
+	const p = pathApi(ctx);
+	for (const root of walk.roots.length ? walk.roots : ["."]) for (const alt of braceAlternatives(root)) {
+		const dir = resolvePattern(alt, ctx);
+		if (files.some((file) => holds(dir, p.dirname(file), walk.recursive, ctx) && keeps(walk.names, file, dir, ctx))) return root;
+	}
+}
+/**
+* A recursive search from `roots` (Claude's Grep), keeping files whose names match `names`:
+* the root it reaches a credential file from, if any.
+*/
+function searchReaches(roots, names, ctx) {
+	return ctx.codedenHome ? walkReaches({
+		roots,
+		recursive: true,
+		names
+	}, ctx) : void 0;
+}
+/**
+* How a command reaches CodeDen's credential files other than by naming one: a recursive search
+* from a folder above them, or a listing (or `echo`ed path) whose output `feeds` another command.
+* `paths` gives what a word may stand for (a PowerShell list's elements). Returns the word it
+* reaches them through.
+*/
+function reachesThroughFolder(bin, args, ctx, feeds, paths = (word, from) => [word.slice(from)]) {
+	if (!ctx.codedenHome) return void 0;
+	if (SEARCHES.has(bin)) for (const walk of searchWalks(bin, args, ctx, paths)) {
+		const root = walkReaches(walk, ctx);
+		if (root) return root;
+	}
+	if (feeds || (bin === "find" || bin === "fd") && args.some((a) => RUNS.test(a))) {
+		const walk = listingWalk(bin, args);
+		const root = walk && walkReaches(walk, ctx);
+		if (root) return root;
+	}
+	if (feeds && DATA.has(bin)) return args.find((a) => paths(a, 0).some((path) => touchesCodedenCredentials(path, ctx)));
+}
 // ../../packages/providers/src/util/git-head.ts
 /**
 * The branch checked out in the repository at `dir` (its `.git` folder, or the `gitdir:` a
@@ -5914,212 +6536,58 @@ const INTERPRETERS = new Map([
 		"mksh",
 		"ash",
 		"fish"
-	].map((b) => [b, SHELL]),
-	["node", NODE],
-	["nodejs", NODE],
-	["perl", PERL],
-	["ruby", RUBY],
-	["pwsh", POWERSHELL],
-	["powershell", POWERSHELL],
-	["source", SOURCE],
-	[".", SOURCE]
-]);
-const interpreter = (bin) => INTERPRETERS.get(bin) ?? (/^(python[\d.]*|py|pypy3?)$/.test(bin) ? PYTHON : void 0);
-/** A program argument that means "read the program from stdin". */
-const isStdin = (arg) => arg === void 0 || arg === "-" || arg === "/dev/stdin" || arg === "/proc/self/fd/0";
-/**
-* True when the command runs what it reads on stdin as code: an interpreter given no program
-* (no `-c`/`-e` code, module or script file), or told to read it from stdin (`-`, `sh -s`).
-*/
-function runsStdin(cmd) {
-	const { tokens } = unwrap(cmd.words);
-	const bin = binName(tokens[0]);
-	if (bin === "iex" || bin === "invoke-expression") return true;
-	const spec = interpreter(bin);
-	if (!spec) return false;
-	const args = tokens.slice(1);
-	for (let i = 0; i < args.length; i += 1) {
-		const arg = args[i];
-		if (arg === "--") return isStdin(args[i + 1]);
-		if (!/^[-+]./.test(arg)) return isStdin(arg);
-		if (spec.stdin?.(arg)) return true;
-		if (spec.program(arg)) return !arg.includes("=") && isStdin(args[i + 1]);
-		if (spec.valued(arg)) i += 1;
-	}
-	return true;
-}
-// ../../packages/providers/src/policy/secrets.ts
-/**
-* Secrets rules of the risk classifier (§11.2): which words of a command read a credentials
-* file, and which commands dump the environment. Writing a secrets file inside the worktree is
-* not access (`cp .env.example .env`); reading one is.
-*/
-/**
-* The argument as a path, or undefined when it can't be one: inline code, multi-line text
-* or anything with shell or code punctuation (`selected={row.key`) is not a file name.
-*/
-function asPath(arg) {
-	const value = arg.replace(/^-+[a-z-]*=/i, "");
-	if (!value || /[\n\r{}()<>|;=`]/.test(value)) return void 0;
-	return value;
-}
-/** Commands whose words are data or only checked for existence (`echo .env >> .gitignore`). */
-const DATA = /* @__PURE__ */ new Set([
-	"echo",
-	"printf",
-	"write-output",
-	"write-host",
-	"test",
-	"[",
-	"[["
-]);
-/** Commands that list or describe files without reading them (`ls certs/*.pem`). */
-const LISTS = /* @__PURE__ */ new Set([
-	"ls",
-	"dir",
-	"get-childitem",
-	"gci",
-	"find",
-	"fd",
-	"tree",
-	"stat",
-	"du",
-	"test-path"
-]);
-/** Search commands, whose first operand is the pattern (`grep -rn "process.env" src`). */
-const SEARCHES = /* @__PURE__ */ new Set([
-	"grep",
-	"egrep",
-	"fgrep",
-	"zgrep",
-	"rg",
-	"ag",
-	"ack",
-	"findstr",
-	"select-string",
-	"sls"
-]);
-/** Options that take the next word as their value, per search tool. */
-const GREP_VALUED = [
-	"-A",
-	"-B",
-	"-C",
-	"-m",
-	"-d",
-	"-D",
-	"--after-context",
-	"--before-context",
-	"--context",
-	"--max-count",
-	"--include",
-	"--exclude",
-	"--exclude-dir",
-	"--label",
-	"--binary-files",
-	"--devices",
-	"--directories"
-];
-const RG_VALUED = [
-	...GREP_VALUED,
-	"-g",
-	"--glob",
-	"--iglob",
-	"-t",
-	"--type",
-	"-T",
-	"--type-not",
-	"-j",
-	"--threads",
-	"--max-depth",
-	"-M",
-	"--max-columns",
-	"--sort",
-	"--sortr",
-	"-r",
-	"--replace",
-	"--colors",
-	"-E",
-	"--encoding"
-];
-const SELECT_STRING_VALUED = [
-	"-path",
-	"-literalpath",
-	"-include",
-	"-exclude",
-	"-encoding",
-	"-context"
-];
-function searchValued(bin, arg) {
-	if (bin === "rg") return RG_VALUED.includes(arg);
-	if (bin === "select-string" || bin === "sls") return SELECT_STRING_VALUED.includes(arg.toLowerCase());
-	return GREP_VALUED.includes(arg);
-}
+	].map((b) => [b, SHELL]),
+	["node", NODE],
+	["nodejs", NODE],
+	["perl", PERL],
+	["ruby", RUBY],
+	["pwsh", POWERSHELL],
+	["powershell", POWERSHELL],
+	["source", SOURCE],
+	[".", SOURCE]
+]);
+const interpreter = (bin) => INTERPRETERS.get(bin) ?? (/^(python[\d.]*|py|pypy3?)$/.test(bin) ? PYTHON : void 0);
+/** A program argument that means "read the program from stdin". */
+const isStdin = (arg) => arg === void 0 || arg === "-" || arg === "/dev/stdin" || arg === "/proc/self/fd/0";
 /**
-* The search pattern words of a search command: `-e`/`--regexp`/`-Pattern` values, or the first
-* operand when the pattern isn't given by an option (or a pattern file, `-f`). `findstr`'s
-* `/c:"text"` is a pattern too.
+* True when the command runs what it reads on stdin as code: an interpreter given no program
+* (no `-c`/`-e` code, module or script file), or told to read it from stdin (`-`, `sh -s`).
 */
-function searchPatterns(bin, args) {
-	const patterns = /* @__PURE__ */ new Set();
-	let explicit = false;
-	for (let i = 0; i < args.length; i += 1) {
-		const a = args[i];
-		if (a === "-e" || a === "--regexp" || /^-pattern$/i.test(a)) {
-			explicit = true;
-			const value = args[i + 1];
-			if (value !== void 0) patterns.add(value);
-			i += 1;
-		} else if (a.startsWith("--regexp=") || /^\/c:/i.test(a)) {
-			explicit = true;
-			patterns.add(a);
-		} else if (a === "-f" || a.startsWith("--file") || /^\/g:/i.test(a)) explicit = true;
-	}
-	if (explicit) return patterns;
+function runsStdin(cmd) {
+	const { tokens } = unwrap(cmd.words);
+	const bin = binName(tokens[0]);
+	if (bin === "iex" || bin === "invoke-expression") return true;
+	const spec = interpreter(bin);
+	if (!spec) return false;
+	const args = tokens.slice(1);
 	for (let i = 0; i < args.length; i += 1) {
-		const a = args[i];
-		if (searchValued(bin, a)) i += 1;
-		else if (!a.startsWith("-") && !(bin === "findstr" && a.startsWith("/"))) {
-			patterns.add(a);
-			break;
-		}
+		const arg = args[i];
+		if (arg === "--") return isStdin(args[i + 1]);
+		if (!/^[-+]./.test(arg)) return isStdin(arg);
+		if (spec.stdin?.(arg)) return true;
+		if (spec.program(arg)) return !arg.includes("=") && isStdin(args[i + 1]);
+		if (spec.valued(arg)) i += 1;
 	}
-	return patterns;
-}
-/**
-* The first argument that reads a credentials file, if any. `written` are the paths the command
-* writes (a copy's destination), which classifyWrite judges instead.
-*/
-function secretArgument(bin, args, written = []) {
-	if (DATA.has(bin)) return void 0;
-	const runs = (bin === "find" || bin === "fd") && args.some((a) => /^-(exec|execdir|ok|okdir|x|X|-exec|-exec-batch)$/.test(a));
-	if (LISTS.has(bin) && !runs) return void 0;
-	const patterns = SEARCHES.has(bin) ? searchPatterns(bin, args) : /* @__PURE__ */ new Set();
-	return args.find((a) => {
-		if (patterns.has(a) || written.includes(a)) return false;
-		const value = asPath(a);
-		return value !== void 0 && isSecretPath(value);
-	});
-}
-/** Files a tool writes through its own options (`openssl req -keyout key.pem -out cert.pem`). */
-function toolOutputs(bin, args) {
-	if (bin !== "openssl" && bin !== "ssh-keygen") return [];
-	const flags = bin === "openssl" ? ["-out", "-keyout"] : ["-f"];
-	return args.flatMap((a, i) => flags.includes(a) && args[i + 1] ? [args[i + 1]] : []);
+	return true;
 }
-/** Variable names that may hold a credential. */
-const SECRET_VAR = /key|token|secret|passw|pwd|credential|auth|private|session|cookie/i;
+// ../../packages/providers/src/policy/shell.ts
 /**
-* True for `printenv` and `Get-ChildItem env:` listings. Printing named variables that don't
-* look like credentials (`printenv PATH`, `Get-ChildItem env:NODE_ENV`) is not a dump.
-*/
-function dumpsEnvironment(bin, args) {
-	const named = (names) => names.length > 0 && names.every((n) => /^\w+$/.test(n) && !SECRET_VAR.test(n));
-	if (bin === "printenv") return !named(args.filter((a) => !a.startsWith("-")));
-	if (!/^(get-childitem|gci|ls|dir)$/.test(bin)) return false;
-	const drives = args.filter((a) => /^env:/i.test(a));
-	return drives.length > 0 && !named(drives.map((a) => a.slice(4)));
+* The paths a word of `cmd` may stand for, from `from` on: its text and, for a PowerShell list
+* (`a,b`), each element. The whole text stays: when the shell is unknown it may be one name, or a
+* brace expansion (`{a,b}`). Callers apply it after reading the word's role, so a list given as a
+* search pattern stays data.
+*/
+function wordPaths(cmd, word, from = 0) {
+	const text = word.slice(from);
+	const commas = cmd.lists?.get(word)?.filter((at) => at >= from) ?? [];
+	if (!commas.length) return [text];
+	const bounds = [
+		from - 1,
+		...commas,
+		word.length
+	];
+	return [text, ...bounds.slice(1).map((end, k) => word.slice(bounds[k] + 1, end)).filter(Boolean)];
 }
-// ../../packages/providers/src/policy/shell.ts
 /** Parse a command line into its simple commands. */
 function parseShell(src, dialect = "auto") {
 	return new Lexer(src, dialect).list(null);
@@ -6140,6 +6608,8 @@ var Builder = class {
 	target = "word";
 	heredocStrip = false;
 	heredocs = [];
+	/** Where the word's unquoted commas are: a PowerShell list's element boundaries. */
+	commas = [];
 	constructor(out) {
 		this.out = out;
 	}
@@ -6147,6 +6617,11 @@ var Builder = class {
 		this.word += text;
 		this.inWord = true;
 	}
+	/** An unquoted comma, which separates a PowerShell list's elements (`a,b`). */
+	addComma() {
+		this.commas.push(this.word.length);
+		this.add(",");
+	}
 	endWord() {
 		if (!this.inWord) return;
 		if (this.target === "write") this.cmd.writes.push(this.word);
@@ -6154,10 +6629,24 @@ var Builder = class {
 			delim: this.word.replace(/\\/g, ""),
 			strip: this.heredocStrip
 		});
-		else if (this.target === "word") this.cmd.words.push(this.word);
+		else if (this.target === "word") {
+			this.cmd.words.push(this.word);
+			if (this.commas.length) this.addList();
+		} else if (this.target === "skip") this.cmd.input = [...this.cmd.input ?? [], this.word];
 		this.target = "word";
 		this.word = "";
 		this.inWord = false;
+		this.commas = [];
+	}
+	/**
+	* Note where the current word's unquoted commas are. The same text written twice with different
+	* quoting keeps every comma either one had, so its list is never missed.
+	*/
+	addList() {
+		this.cmd.lists ??= /* @__PURE__ */ new Map();
+		const seen = this.cmd.lists.get(this.word) ?? [];
+		const commas = [.../* @__PURE__ */ new Set([...seen, ...this.commas])].sort((a, b) => a - b);
+		this.cmd.lists.set(this.word, commas);
 	}
 	endCommand() {
 		this.endWord();
@@ -6234,6 +6723,9 @@ var Lexer = class {
 				this.i += 1;
 				b.cmd.nested.push(this.list(")"));
 				b.add(src.slice(start, this.i));
+			} else if (c === "," && this.dialect !== "posix") {
+				b.addComma();
+				this.i += 1;
 			} else {
 				b.add(c);
 				this.i += 1;
@@ -6376,12 +6868,62 @@ const MAX_DEPTH = 4;
 * Classify a shell command (any shell: POSIX, PowerShell or cmd). Downloads piped into an
 * interpreter (`curl … | sh`, `irm … | iex`) are found on the parsed pipeline in
 * `classifyList`; here, a download run through a substitution (`iex (irm …)`,
-* `bash -c "$(curl …)"`, `bash <(curl …)`).
+* `bash -c "$(curl …)"`, `bash <(curl …)`). CodeDen's own credentials are looked for first,
+* across the whole command, so an earlier ordinary risk (`cat .env; …`) can't hide them.
 */
 function classifyCommand(command, ctx) {
+	const list = parseShell(command, ctx.shell ?? "auto");
+	const credentials = credentialAccess(list, ctx, 0);
+	if (credentials) return credentials;
 	if (/\b(iex|invoke-expression)\b[^|]*\b(irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/i.test(command)) return risky("network", "Executes a downloaded script");
 	if (/\b(bash|sh|zsh)\s+(-c\s+)?["']?\$\(\s*(curl|wget)\b/i.test(command) || /<\(\s*(curl|wget)\b/i.test(command)) return risky("network", "Executes a downloaded script");
-	return classifyList(parseShell(command, ctx.shell ?? "auto"), ctx, 0);
+	return classifyList(list, ctx, 0);
+}
+/**
+* The first access to CodeDen's own credential files anywhere in `list`: substitutions,
+* subshells and inline scripts (`bash -c "…"`) included, following `cd` like `classifyList`.
+* `feeds`: the list's output is used by another command (it sits in a substitution or a pipe).
+*/
+function credentialAccess(list, ctx, depth, feeds = false) {
+	let here = ctx;
+	for (const [i, cmd] of list.entries()) {
+		for (const nested of cmd.nested) {
+			const found = credentialAccess(nested, here, depth, true);
+			if (found) return found;
+		}
+		const piped = list[i + 1]?.piped === true;
+		const found = credentialCommand(cmd, here, depth, feeds || piped);
+		if (found) return found;
+		here = afterCd(cmd, here);
+	}
+}
+/** The paths each word of `cmd` may stand for: itself, and a PowerShell list's elements. */
+const pathsOf = (cmd) => (word, from) => wordPaths(cmd, word, from);
+/**
+* One simple command's access to CodeDen's credentials: a redirect onto one, any argument (or
+* here-string) that reaches one (read, written, copied or deleted), or a search or listing that
+* reaches one from a folder above it (`./codeden-search`). Moving into CodeDen's home with `cd`
+* reads nothing; the command that then reads is caught.
+*/
+function credentialCommand(cmd, ctx, depth, feeds) {
+	const { tokens } = unwrap(cmd.words);
+	const bin = binName(tokens[0]);
+	const args = tokens.slice(1);
+	const script = inlineScript(bin, args);
+	if (script && depth < MAX_DEPTH) {
+		const inner = credentialAccess(parseShell(script.text, script.dialect), ctx, depth + 1, feeds);
+		if (inner) return inner;
+	}
+	for (const target of cmd.writes) if (!DISCARD.test(target) && touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Writes CodeDen's own credentials: ${target}`);
+	const given = (cmd.input ?? []).find((word) => touchesCodedenCredentials(word, ctx));
+	if (given) return credentialsRisk(`Passes CodeDen's own credentials: ${given}`);
+	if (CD.has(bin)) return void 0;
+	const paths = pathsOf(cmd);
+	const reads = (a) => touchesCodedenCredentials(a, ctx);
+	const touched = secretArgument(bin, args, [], reads, paths);
+	if (touched) return credentialsRisk(`Accesses CodeDen's own credentials: ${touched}`);
+	const through = reachesThroughFolder(bin, args, ctx, feeds, paths);
+	return through ? credentialsRisk(`Reaches CodeDen's own credentials from ${through}`) : void 0;
 }
 /**
 * Classify commands in order. A `cd` moves where later relative paths resolve; commands in
@@ -6421,10 +6963,17 @@ function afterCd(cmd, ctx) {
 		dir: resolveAgainst(target, ctx)
 	};
 }
-/** The value after a PowerShell-style named parameter (`-Path x`), if present. */
+/**
+* The value of a PowerShell-style named parameter, if present: `-Path x`, or bound with a
+* colon, `-Path:x`.
+*/
 function namedArg(args, names) {
-	const i = args.findIndex((a) => names.includes(a.toLowerCase()));
-	return i >= 0 ? args[i + 1] : void 0;
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i].toLowerCase();
+		if (names.includes(arg)) return args[i + 1];
+		const bound = names.find((name) => arg.startsWith(`${name}:`));
+		if (bound) return args[i].slice(bound.length + 1);
+	}
 }
 /** The script of an inline shell invocation (`bash -c "…"`, `pwsh -Command …`, `cmd /c …`). */
 function inlineScript(bin, args) {
@@ -6507,7 +7056,7 @@ function classifySimple(cmd, ctx, depth) {
 		const write = classifyWrite(target, ctx);
 		if (write.risky) return write;
 	}
-	const secret = secretArgument(bin, args, written);
+	const secret = secretArgument(bin, args, written, isSecretPath, pathsOf(cmd));
 	if (secret) return risky("secrets", `Accesses the secrets file ${secret}`);
 	if (dumpsEnvironment(bin, args)) return risky("secrets", "Dumps environment variables");
 	return SAFE;
@@ -6564,18 +7113,36 @@ function copyTargets(bin, args, dest, ctx) {
 * Classify a file write/edit. The worktree, extra roots and OS temp are fine, secrets files in
 * the worktree included: writing one (`cp .env.example .env`) reads nothing. A secrets file in
 * temp counts as outside the worktree, so Full autonomy (which only asks for writes outside the
-* worktree) still asks for it.
+* worktree) still asks for it. CodeDen's own credential files ask at every level.
 */
 function classifyWrite(target, ctx) {
+	if (touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Writes CodeDen's own credentials: ${target}`);
 	if (!isWritable(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
 	if (isSecretPath(target) && !isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes the secrets file ${target}, outside the worktree`);
 	return SAFE;
 }
-/** Classify a file read or search. Reads anywhere are fine except credential files. */
-function classifyRead(target, _ctx) {
+/**
+* Classify a file read or search. Reads anywhere are fine except credential files; CodeDen's own
+* (or a folder holding them) ask at every level.
+*/
+function classifyRead(target, ctx) {
+	if (touchesCodedenCredentials(target, ctx)) return credentialsRisk(`Reads CodeDen's own credentials: ${target}`);
 	if (isSecretPath(target)) return risky("secrets", `Reads the secrets file ${target}`);
 	return SAFE;
 }
+/**
+* Classify a file-name search: `pattern` (Claude's Glob, or a search's `--glob` filter) from
+* `base` (default: the current directory). Listing names reads nothing, so only a pattern that
+* reaches CodeDen's own credential files asks; `{a,b}` alternatives are followed.
+*/
+function classifyGlob(pattern, base, ctx) {
+	if (!pattern.trim()) return SAFE;
+	const dir = base ? resolveAgainst(base, ctx) : ctx.dir ?? ctx.cwd;
+	return braceAlternatives(pattern).some((alt) => touchesCodedenCredentials(alt, {
+		...ctx,
+		dir
+	})) ? credentialsRisk(`Lists CodeDen's own credential files: ${pattern}`) : SAFE;
+}
 /** Classify a web fetch. Only flagged when the context has an allowlist of hosts. */
 function classifyFetch(url, ctx) {
 	if (!ctx.allowedHosts) return SAFE;
@@ -6801,9 +7368,11 @@ function assessClaudeTool(name, input, ctx) {
 	if (name === "Read") return classifyRead(str(input, "file_path") ?? "", ctx);
 	if (name === "Grep") {
 		const target = str(input, "path");
-		return target ? classifyRead(target, ctx) : { risky: false };
+		const filter = str(input, "glob");
+		const root = searchReaches(target ? [target] : [], filter ? [filter] : [], ctx);
+		return mostSevere([target ? classifyRead(target, ctx) : SAFE, root ? credentialsRisk(`Reaches CodeDen's own credentials from ${root}`) : SAFE]);
 	}
-	if (name === "Glob") return { risky: false };
+	if (name === "Glob") return classifyGlob(str(input, "pattern") ?? "", str(input, "path"), ctx);
 	if (name === "WebFetch") return classifyFetch(str(input, "url") ?? "", ctx);
 	return { risky: false };
 }
@@ -6835,7 +7404,8 @@ const FINISH_PLAN = "Finish the plan and present it with ExitPlanMode; once the
 * - auto       -> `acceptEdits`, plus the risky-action classifier
 * - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
 *                 temp directory counts as inside, except for secrets files there)
-* Plan mode overrides all of them with `plan`.
+* Plan mode overrides all of them with `plan`. CodeDen's own credential files ask at every
+* level and are refused for read-only sessions (`../policy/codeden-home`).
 */
 function permissionModeFor(autonomy, planMode) {
 	if (planMode) return "plan";
@@ -6853,6 +7423,8 @@ var ClaudePolicy = class {
 	ctx;
 	readOnly;
 	sessionAllow = /* @__PURE__ */ new Set();
+	/** `allow_session` decisions on calls that touched CodeDen's own credentials (`credentialKey`). */
+	credentialAllow = /* @__PURE__ */ new Set();
 	/** Plan mode: edits outside Claude's notes and writing commands are refused. */
 	planning = false;
 	constructor(autonomy, ctx, readOnly = false) {
@@ -6881,8 +7453,12 @@ var ClaudePolicy = class {
 	setPlanning(on) {
 		this.planning = on;
 	}
-	/** Why a call is refused outright (read-only sessions, plan mode), or undefined. */
-	denial(toolName, input) {
+	/**
+	* Why a call is refused outright (read-only sessions, plan mode), or undefined. `dir` is the
+	* shell's current directory, as for `gate`.
+	*/
+	denial(toolName, input, dir) {
+		if (this.isReadOnly && touchesCodeden(this.assess(toolName, input, dir))) return this.readOnly ? "This session is read-only: CodeDen's own credential files are off limits. Act through CodeDen tools instead." : "This session has read-only permissions: CodeDen's own credential files are off limits. Report what you found instead.";
 		if (this.planning && !this.readOnly && this.isNotesEdit(toolName, input)) return void 0;
 		if (!this.isReadOnly) return this.planning ? this.planDenial(toolName, input) : void 0;
 		if (EDIT_TOOLS$1.has(toolName)) return this.readOnly ? "This session is read-only: it cannot edit files. Act through CodeDen tools instead." : "This session has read-only permissions: it cannot edit files, commit or push. Report what you found instead.";
@@ -6923,11 +7499,8 @@ var ClaudePolicy = class {
 			action: "plan",
 			reason: "The agent finished planning"
 		};
-		if (this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
-		const risk = assessClaudeTool(toolName, input, dir ? {
-			...this.ctx,
-			dir
-		} : this.ctx);
+		const risk = this.assess(toolName, input, dir);
+		if (touchesCodeden(risk) ? this.credentialAllow.has(this.credentialKey(toolName, input, dir)) : this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				ask: true,
@@ -6942,13 +7515,19 @@ var ClaudePolicy = class {
 			return { ask: false };
 		}
 		if (!risk.risky) return { ask: false };
-		if (this.autonomy === "full" && risk.action !== "outside_worktree") return { ask: false };
+		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !risk.codeden) return { ask: false };
 		return {
 			ask: true,
 			action: risk.action,
 			reason: risk.reason
 		};
 	}
+	assess(toolName, input, dir) {
+		return assessClaudeTool(toolName, input, dir ? {
+			...this.ctx,
+			dir
+		} : this.ctx);
+	}
 	/**
 	* Whether a `canUseTool` call (Claude's own permission prompt) needs the user. In supervised
 	* mode everything Claude asks about goes to the user; otherwise only gated calls do.
@@ -6963,9 +7542,17 @@ var ClaudePolicy = class {
 			reason: "Claude asked for permission"
 		};
 	}
-	/** Remember an `allow_session` decision. Commands and edits match exactly; others by name. */
-	allowForSession(toolName, input) {
+	/**
+	* Remember an `allow_session` decision. Commands and edits match exactly; others by name. A
+	* call that touches CodeDen's own credentials is remembered only as itself, in `dir`.
+	*/
+	allowForSession(toolName, input, dir) {
 		this.sessionAllow.add(this.key(toolName, input));
+		if (touchesCodeden(this.assess(toolName, input, dir))) this.credentialAllow.add(this.credentialKey(toolName, input, dir));
+	}
+	/** The exact call, in the directory its relative paths resolve from. */
+	credentialKey(toolName, input, dir) {
+		return `${toolName}\n${dir ?? this.ctx.cwd}\n${JSON.stringify(input)}`;
 	}
 	key(toolName, input) {
 		if (COMMAND_TOOLS.has(toolName)) return `${toolName}:${str(input, "command") ?? ""}`;
@@ -7724,7 +8311,7 @@ function policyHook(policy, shell) {
 		const toolInput = hookInput.tool_input ?? {};
 		const cwd = str(hookInput, "cwd");
 		if (cwd && (path.isAbsolute(cwd) || path.win32.isAbsolute(cwd))) shell.dir = cwd;
-		const denied = policy.denial(name, toolInput);
+		const denied = policy.denial(name, toolInput, shell.dir);
 		if (denied) return { hookSpecificOutput: {
 			hookEventName: "PreToolUse",
 			permissionDecision: "deny",
@@ -8053,23 +8640,130 @@ function statsFromUsageTrailer(text) {
 	};
 	return stats(field("total_tokens"), field("tool_uses"), field("duration_ms"));
 }
+// ../../packages/providers/src/claude/subagent-usage.ts
+/** Token counts of one call from a Messages API `usage` object; undefined when it has none. */
+function callTokens(usage) {
+	if (!usage || typeof usage !== "object") return void 0;
+	const u = usage;
+	const details = u.output_tokens_details;
+	const tokens = {
+		input: count(u.input_tokens) ?? 0,
+		output: count(u.output_tokens) ?? 0,
+		cacheRead: count(u.cache_read_input_tokens) ?? 0,
+		cacheWrite: count(u.cache_creation_input_tokens) ?? 0,
+		reasoning: count(details?.thinking_tokens) ?? 0
+	};
+	return tokens.input + tokens.output + tokens.cacheRead + tokens.cacheWrite > 0 ? tokens : void 0;
+}
+/**
+* Tokens per model across one subagent's own API calls, for its card's cost (§7.3). Claude
+* streams a call as several `assistant` frames sharing its message id (one per content block),
+* each with the call's usage as it stood when the call started: input and cache counts are
+* final, output is not. So calls are keyed by message id, frames of one call merge (the larger
+* figure wins), and the subagent's transcript, read once it has finished, supplies the final
+* figures (`applyTranscript`).
+*/
+var SubagentUsage = class {
+	calls = /* @__PURE__ */ new Map();
+	/** Fold in one streamed frame (`message` of an `assistant` message). */
+	addFrame(message) {
+		const id = str(message, "id");
+		const tokens = callTokens(message.usage);
+		if (!id || !tokens) return;
+		const model = modelOf(message);
+		const prev = this.calls.get(id);
+		this.calls.set(id, {
+			...model || prev?.model ? { model: model ?? prev?.model } : {},
+			input: Math.max(tokens.input, prev?.input ?? 0),
+			output: Math.max(tokens.output, prev?.output ?? 0),
+			cacheRead: Math.max(tokens.cacheRead, prev?.cacheRead ?? 0),
+			cacheWrite: Math.max(tokens.cacheWrite, prev?.cacheWrite ?? 0),
+			reasoning: Math.max(tokens.reasoning, prev?.reasoning ?? 0)
+		});
+	}
+	/**
+	* Take the final figures of the calls the frames showed from the subagent's transcript
+	* (`getSubagentMessages`): per message id, the transcript wins. Calls only the transcript
+	* holds are left out (an earlier run of a resumed subagent); calls it doesn't hold yet keep
+	* their streamed figures. Returns whether anything changed.
+	*/
+	applyTranscript(messages) {
+		let changed = false;
+		for (const entry of messages) {
+			const raw = str(entry, "type") === "assistant" ? entry.message : void 0;
+			if (!raw || typeof raw !== "object") continue;
+			const message = raw;
+			const id = str(message, "id");
+			const prev = id ? this.calls.get(id) : void 0;
+			const tokens = callTokens(message.usage);
+			if (!id || !prev || !tokens) continue;
+			const model = modelOf(message) ?? prev.model;
+			const next = {
+				...model ? { model } : {},
+				...tokens
+			};
+			if (!sameCall(prev, next)) {
+				this.calls.set(id, next);
+				changed = true;
+			}
+		}
+		return changed;
+	}
+	/** Tokens per model in the order the models were first used; undefined with no calls. */
+	summary() {
+		const byModel = /* @__PURE__ */ new Map();
+		for (const call of this.calls.values()) {
+			const key = call.model ?? "";
+			const sum = byModel.get(key);
+			byModel.set(key, {
+				...call.model ? { model: call.model } : {},
+				input: (sum?.input ?? 0) + call.input,
+				output: (sum?.output ?? 0) + call.output,
+				cacheRead: (sum?.cacheRead ?? 0) + call.cacheRead,
+				cacheWrite: (sum?.cacheWrite ?? 0) + call.cacheWrite,
+				reasoning: (sum?.reasoning ?? 0) + call.reasoning
+			});
+		}
+		if (byModel.size === 0) return void 0;
+		return [...byModel.values()].map((c) => ({
+			...c.model ? { model: c.model } : {},
+			inputTokens: c.input,
+			outputTokens: c.output,
+			cacheReadTokens: c.cacheRead,
+			cacheWriteTokens: c.cacheWrite,
+			...c.reasoning > 0 ? { reasoningTokens: c.reasoning } : {}
+		}));
+	}
+};
+/** The model that served a call; Claude Code marks its own placeholder replies `<synthetic>`. */
+function modelOf(message) {
+	const model = str(message, "model")?.trim();
+	return model && model !== "<synthetic>" ? model : void 0;
+}
+function sameCall(a, b) {
+	return a.model === b.model && a.input === b.input && a.output === b.output && a.cacheRead === b.cacheRead && a.cacheWrite === b.cacheWrite && a.reasoning === b.reasoning;
+}
 // ../../packages/providers/src/claude/subagents.ts
 /**
 * Subagent (Agent/Task tool) runs as child threads (§7.3). The parent gets a `subagent` item;
 * messages tagged with `parent_tool_use_id` go to the child thread. Background subagents
-* finish on `task_notification`, foreground ones on their `tool_result`.
+* finish on `task_notification`, foreground ones on their `tool_result`. The card's figures
+* include the run's tokens per model, from its streamed messages; `onFinished` lets the
+* session read the final figures from the run's transcript (`correctUsage`).
 */
 var SubagentTracker = class {
 	sessionId;
 	emit;
 	newId;
 	onThreadEnd;
+	onFinished;
 	runs = /* @__PURE__ */ new Map();
-	constructor(sessionId, emit, newId, onThreadEnd = () => {}) {
+	constructor(sessionId, emit, newId, onThreadEnd = () => {}, onFinished = () => {}) {
 		this.sessionId = sessionId;
 		this.emit = emit;
 		this.newId = newId;
 		this.onThreadEnd = onThreadEnd;
+		this.onFinished = onFinished;
 	}
 	ctx(toolUseId) {
 		return this.runs.get(toolUseId)?.child;
@@ -8097,7 +8791,8 @@ var SubagentTracker = class {
 			child,
 			item,
 			background: input.run_in_background === true,
-			done: false
+			done: false,
+			usage: new SubagentUsage()
 		});
 		this.emit({
 			type: "thread.started",
@@ -8121,11 +8816,43 @@ var SubagentTracker = class {
 	}
 	onTaskStarted(msg) {
 		const run = this.runs.get(str(msg, "tool_use_id") ?? "");
-		if (run && msg.is_backgrounded === true) run.background = true;
+		if (!run) return;
+		if (msg.is_backgrounded === true) run.background = true;
+		run.agentId ??= str(msg, "task_id");
+	}
+	/** One of the run's own `assistant` messages (`parent_tool_use_id` is its tool use). */
+	onAssistant(toolUseId, msg) {
+		const run = this.runs.get(toolUseId);
+		if (!run || run.done) return;
+		run.agentId ??= str(msg, "agent_id");
+		if (msg.message && typeof msg.message === "object") run.usage.addFrame(msg.message);
+	}
+	/**
+	* The final figures of a finished run's calls, from its transcript: the card is sent again
+	* when they change what it shows (§7.3).
+	*/
+	correctUsage(toolUseId, transcript) {
+		const run = this.runs.get(toolUseId);
+		if (!run?.done || !run.usage.applyTranscript(transcript)) return;
+		const usage = run.usage.summary();
+		if (!usage) return;
+		run.item = {
+			...run.item,
+			stats: {
+				...run.item.stats,
+				usage
+			}
+		};
+		this.emit({
+			type: "item.completed",
+			...run.parent,
+			item: run.item
+		});
 	}
 	onToolResult(toolUseId, content, isError, toolUseResult) {
 		const run = this.runs.get(toolUseId);
 		if (!run || run.done) return;
+		run.agentId ??= str(toolUseResult, "agentId");
 		const status = str(toolUseResult, "status");
 		if (!isError && (status === "async_launched" || toolUseResult?.isAsync === true)) {
 			run.background = true;
@@ -8138,6 +8865,8 @@ var SubagentTracker = class {
 	onTaskNotification(msg) {
 		const toolUseId = str(msg, "tool_use_id");
 		if (!toolUseId) return;
+		const run = this.runs.get(toolUseId);
+		if (run) run.agentId ??= str(msg, "task_id");
 		const status = str(msg, "status");
 		const summary = str(msg, "summary");
 		this.finish(toolUseId, status === "completed" ? "completed" : status === "failed" ? "failed" : "interrupted", summary, statsFromTaskNotification(msg));
@@ -8170,16 +8899,23 @@ var SubagentTracker = class {
 			reason: "user"
 		});
 		const status = outcome === "completed" ? "completed" : outcome === "failed" ? "failed" : "cancelled";
+		const usage = run.usage.summary();
+		const figures = usage ? {
+			...stats,
+			usage
+		} : stats;
+		run.item = {
+			...run.item,
+			status,
+			...summary ? { summary } : {},
+			...figures ? { stats: figures } : {}
+		};
 		this.emit({
 			type: "item.completed",
 			...run.parent,
-			item: {
-				...run.item,
-				status,
-				...summary ? { summary } : {},
-				...stats ? { stats } : {}
-			}
+			item: run.item
 		});
+		if (usage && run.agentId) this.onFinished(toolUseId, run.agentId);
 	}
 };
 /** Drop the CLI's internal trailer (agent ids, usage) from a subagent result. */
@@ -8475,7 +9211,7 @@ var ClaudeEventMapper = class {
 		this.rootThreadId = `${opts.sessionId}:thread-root`;
 		this.emit = opts.emit;
 		this.newId = opts.newId ?? randomUUID;
-		this.subagents = new SubagentTracker(opts.sessionId, this.emit, this.newId, (ctx, ok) => this.tools.finishTurn(ctx, ok));
+		this.subagents = new SubagentTracker(opts.sessionId, this.emit, this.newId, (ctx, ok) => this.tools.finishTurn(ctx, ok), opts.onSubagentFinished);
 		this.tools = new ToolTracker(opts.cwd, (ctx, phase, item) => this.item(ctx, phase, item), this.subagents, this.newId);
 		this.stream = new StreamAssembler({
 			rootCtx: () => this.rootCtx(),
@@ -8553,6 +9289,13 @@ var ClaudeEventMapper = class {
 	ctxForTool(toolUseId) {
 		return this.tools.ctx(toolUseId) ?? this.rootCtx();
 	}
+	/**
+	* A finished subagent's transcript (`getSubagentMessages`): its calls' final token counts
+	* replace the streamed ones, and the card is sent again when that changes it.
+	*/
+	correctSubagentUsage(toolUseId, transcript) {
+		this.subagents.correctUsage(toolUseId, transcript);
+	}
 	/** Emit an item event in a context. */
 	item(ctx, phase, item) {
 		this.emit({
@@ -8614,6 +9357,7 @@ var ClaudeEventMapper = class {
 		const isRoot = !msg.parent_tool_use_id;
 		const messageId = str(message, "id") ?? this.newId();
 		if (isRoot) this.contextTokens = contextTokensFromMessageUsage(message.usage) ?? this.contextTokens;
+		else if (typeof msg.parent_tool_use_id === "string") this.subagents.onAssistant(msg.parent_tool_use_id, msg);
 		const content = Array.isArray(message.content) ? message.content : [];
 		for (const block of content) if (block.type === "text" || block.type === "thinking" || block.type === "redacted_thinking") {
 			const type = block.type === "text" ? "text" : "thinking";
@@ -9020,7 +9764,10 @@ var ClaudeSession = class {
 		this.mapper = new ClaudeEventMapper({
 			sessionId: opts.sessionId,
 			cwd: opts.cwd,
-			emit
+			emit,
+			onSubagentFinished: (toolUseId, agentId) => {
+				this.correctSubagentUsage(toolUseId, agentId);
+			}
 		});
 		this.broker = new ApprovalBroker(emit);
 		this.autonomy = opts.autonomy;
@@ -9028,6 +9775,7 @@ var ClaudeSession = class {
 			cwd: opts.cwd,
 			extraRoots: opts.additionalDirectories,
 			...opts.ownBranch ? { ownBranch: opts.ownBranch } : {},
+			...opts.codedenHome ? { codedenHome: opts.codedenHome } : {},
 			notesRoots: config.notesRoots ?? claudeNotesDirs({
 				cwd: opts.cwd,
 				...claudeHomes(opts.env)
@@ -9042,6 +9790,20 @@ var ClaudeSession = class {
 		return this.mapper.resumeToken ?? this.opts.resumeToken;
 	}
 	/**
+	* A subagent's streamed messages don't carry their calls' final output counts; its
+	* transcript does. Read it once the run finished and let the card take the final figures.
+	* If it can't be read (another config folder, not written yet), the streamed ones stay.
+	*/
+	async correctSubagentUsage(toolUseId, agentId) {
+		const read = this.config.getSubagentMessages;
+		const claudeSessionId = this.resumeToken();
+		if (!read || !claudeSessionId || this.closed) return;
+		try {
+			const transcript = await read(claudeSessionId, agentId, { dir: this.opts.cwd });
+			if (!this.closed) this.mapper.correctSubagentUsage(toolUseId, transcript);
+		} catch {}
+	}
+	/**
 	* Switch autonomy. The policy changes at once, so the next tool call (even in a running
 	* turn) follows the new level; approvals already waiting stay waiting. The CLI's own
 	* permission mode follows (`applyPermissionMode`), except while planning: the CLI stays in
@@ -9264,7 +10026,7 @@ var ClaudeSession = class {
 			mapper: this.mapper
 		}, input, options.toolUseID, options.signal);
 		if (toolName === "ExitPlanMode") return this.reviewPlan(input, options);
-		const denied = this.policy.denial(toolName, input);
+		const denied = this.policy.denial(toolName, input, this.shell.dir);
 		if (denied) return {
 			behavior: "deny",
 			message: denied
@@ -9302,7 +10064,7 @@ var ClaudeSession = class {
 	};
 	toPermissionResult(toolName, input, response) {
 		if (response.kind === "approval" && response.decision !== "deny") {
-			if (response.decision === "allow_session") this.policy.allowForSession(toolName, input);
+			if (response.decision === "allow_session") this.policy.allowForSession(toolName, input, this.shell.dir);
 			return {
 				behavior: "allow",
 				updatedInput: input
@@ -9446,10 +10208,11 @@ var ClaudeAdapter = class {
 	async openSession(opts) {
 		const executable = this.executable();
 		if (!executable) throw new Error("Claude Code is not installed (no `claude` on PATH)");
-		const { query } = await (this.options.loadSdk ?? loadClaudeSdk)();
+		const { query, getSubagentMessages } = await (this.options.loadSdk ?? loadClaudeSdk)();
 		return new ClaudeSession(await withFork(this, opts), {
 			executable,
 			query,
+			...getSubagentMessages ? { getSubagentMessages } : {},
 			onModels: (models) => {
 				if (!models.length) return;
 				this.freshness.confirm(executableFingerprint(executable));
@@ -9986,22 +10749,23 @@ var CodexUtilityModel = class {
 * same risk classifier as Claude's tool calls: what the level allows is approved by policy
 * (recorded with `decidedBy: "policy"`), and only the rest reaches the user.
 */
-/** True when the permission level allows an action the classifier assessed as `risk`. */
+/**
+* True when the permission level allows an action the classifier assessed as `risk`. CodeDen's
+* own credential files are never allowed by policy. Commands Codex runs inside its sandbox
+* without asking (reads included) never reach this policy.
+*/
 function levelAllows(autonomy, risk) {
 	if (autonomy === "auto") return !risk.risky;
-	if (autonomy === "full") return !risk.risky || risk.action !== "outside_worktree";
+	if (autonomy === "full") return !risk.risky || risk.action !== "outside_worktree" && !risk.codeden;
 	return false;
 }
-/** The first risky assessment of `items`, or safe. */
-function first(items) {
-	return items.find((r) => r.risky) ?? { risky: false };
-}
 /**
 * Risk of a command Codex asks to run: the command line as sent and each parsed action, so a
-* redirect or path the parsed form drops still counts.
+* redirect or path the parsed form drops still counts. Here and below, CodeDen's own
+* credentials win over an earlier ordinary risk (`mostSevere`).
 */
 function commandRisk(texts, ctx) {
-	return first(texts.filter(Boolean).map((text) => classifyCommand(text, ctx)));
+	return mostSevere(texts.filter(Boolean).map((text) => classifyCommand(text, ctx)));
 }
 /**
 * Risk of a patch Codex asks to apply: each file it changes, and the root it asks to write
@@ -10014,7 +10778,7 @@ function patchRisk(paths, grantRoot, ctx) {
 		action: "outside_worktree",
 		reason: "Changes files Codex did not name"
 	};
-	return first(targets.map((target) => classifyWrite(target, ctx)));
+	return mostSevere(targets.map((target) => classifyWrite(target, ctx)));
 }
 /**
 * Risk of extra permissions Codex asks for: network access (not restricted, as for Claude,
@@ -10029,7 +10793,7 @@ function permissionsRisk(permissions, ctx) {
 		action: "outside_worktree",
 		reason: "Asks for access to folders by pattern"
 	};
-	return first([
+	return mostSevere([
 		...(fs.write ?? []).map((p) => classifyWrite(p, ctx)),
 		...(fs.read ?? []).map((p) => classifyRead(p, ctx)),
 		...(fs.entries ?? []).map((entry) => {
@@ -11256,6 +12020,21 @@ function tokenUsage(u) {
 	if (u.modelContextWindow && u.modelContextWindow > 0) usage.contextWindow = Math.round(u.modelContextWindow);
 	return usage;
 }
+/**
+* A sub-agent's tokens for its card (§7.3), from its thread's running `total`, in the same
+* terms as `tokenUsage`. `model` is the one its spawn asked for; absent, it runs the session's.
+*/
+function subagentUsage(u, model) {
+	const t = tokenUsage(u);
+	return {
+		...model ? { model } : {},
+		inputTokens: t.inputTokens ?? 0,
+		outputTokens: t.outputTokens ?? 0,
+		cacheReadTokens: t.cachedInputTokens ?? 0,
+		cacheWriteTokens: t.cacheWriteTokens ?? 0,
+		...t.reasoningTokens ? { reasoningTokens: t.reasoningTokens } : {}
+	};
+}
 function windowId(minutes, fallback) {
 	if (minutes === 300) return "5h";
 	if (minutes === 10080) return "weekly";
@@ -11384,7 +12163,7 @@ var CodexThreadMapper = class {
 				this.updatePlan(n.params.turnId, n.params.plan);
 				return;
 			case "thread/tokenUsage/updated": {
-				this.o.onTokens?.(n.params.tokenUsage.total.totalTokens);
+				this.o.onTokens?.(n.params.tokenUsage);
 				const usage = this.turnUsage.add(n.params.turnId, n.params.tokenUsage);
 				if (!this.o.root) {
 					delete usage.contextTokens;
@@ -11637,6 +12416,7 @@ var CodexSubagents = class {
 			return false;
 		}
 		const run = this.claim(from, turnId, item.id, spawnDetails(item));
+		if (item.model) run.model ??= item.model;
 		const child = item.receiverThreadIds[0];
 		if (child) this.bind(run, child);
 		if (phase !== "completed") return true;
@@ -11775,8 +12555,8 @@ var CodexSubagents = class {
 					prompt: item.input.text
 				};
 			},
-			onTokens: (total) => {
-				run.totalTokens = total;
+			onTokens: (usage) => {
+				run.tokens = usage;
 			}
 		});
 		run.thread = thread;
@@ -11877,9 +12657,10 @@ var CodexSubagents = class {
 	stats(run) {
 		const end = run.endedAt ?? this.o.now();
 		return {
-			...run.totalTokens !== void 0 ? { totalTokens: Math.max(0, Math.round(run.totalTokens)) } : {},
+			...run.tokens ? { totalTokens: Math.max(0, Math.round(run.tokens.total.totalTokens)) } : {},
 			toolUses: run.toolCalls.size,
-			durationMs: Math.max(0, Math.round(end - run.startedAt))
+			durationMs: Math.max(0, Math.round(end - run.startedAt)),
+			...run.tokens ? { usage: [subagentUsage(run.tokens, run.model)] } : {}
 		};
 	}
 };
@@ -12226,7 +13007,8 @@ var CodexSession = class {
 				risk: {
 					cwd: this.opts.cwd,
 					extraRoots: this.opts.additionalDirectories,
-					...this.opts.ownBranch ? { ownBranch: this.opts.ownBranch } : {}
+					...this.opts.ownBranch ? { ownBranch: this.opts.ownBranch } : {},
+					...this.opts.codedenHome ? { codedenHome: this.opts.codedenHome } : {}
 				},
 				autonomy: () => this.opts.readOnly ? "read_only" : this.autonomy,
 				ctx: (threadId, turnId) => this.mapper.requestCtx(threadId, turnId),
@@ -14927,25 +15709,32 @@ var OpenCodePolicy = class {
 			};
 		}
 	}
-	/** Remember an `allow_session` decision: commands and paths match exactly. */
+	/** Remember an `allow_session` decision: commands (in their directory) and paths match exactly. */
 	allowForSession(call) {
 		this.sessionAllow.add(this.key(call));
 	}
 	shell(call) {
 		const command = commandOf(call);
+		const risk = classifyCommand(command, {
+			...this.ctx,
+			dir: this.workdir(call)
+		});
 		if (this.isReadOnly) {
+			if (touchesCodeden(risk)) return this.credentialsDenial();
 			const reason = readOnlyCommandDenial(command, { allowChecks: !this.readOnly });
 			return reason ? {
 				kind: "deny",
 				message: `This session is read-only: ${reason}.`
 			} : ALLOW;
 		}
-		const workdir = str(call.toolInput, "workdir");
-		const dir = workdir ? path.resolve(this.ctx.cwd, workdir) : void 0;
-		return this.gate(classifyCommand(command, dir ? {
-			...this.ctx,
-			dir
-		} : this.ctx), "command");
+		return this.gate(risk, "command");
+	}
+	/** Read-only sessions never touch CodeDen's own credential files. */
+	credentialsDenial() {
+		return {
+			kind: "deny",
+			message: this.readOnly ? "This session is read-only: CodeDen's own credential files are off limits. Act through CodeDen tools instead." : "This session has read-only permissions: CodeDen's own credential files are off limits. Report what you found instead."
+		};
 	}
 	edit(paths) {
 		if (this.isReadOnly) return {
@@ -14954,19 +15743,19 @@ var OpenCodePolicy = class {
 		};
 		return this.gate(this.firstRisk(paths, classifyWrite), "file_change");
 	}
+	/** The verdict for every target: CodeDen's own credentials first, then the first risky one. */
 	firstRisk(targets, classify) {
-		for (const target of targets) {
-			const risk = classify(target, this.ctx);
-			if (risk.risky) return risk;
-		}
-		return { risky: false };
+		return mostSevere(targets.map((target) => classify(target, this.ctx)));
 	}
 	/**
 	* The level's gate (the same as Claude's): edits and commands (`supervisedAction`) always
 	* ask in supervised mode; `alwaysRisky` asks for flagged calls even at full autonomy
-	* (secrets reads).
+	* (secrets reads). CodeDen's own credential files ask at every level and are refused for
+	* read-only sessions.
 	*/
 	gate(risk, supervisedAction, alwaysRisky = false) {
+		const codeden = touchesCodeden(risk);
+		if (codeden && this.isReadOnly) return this.credentialsDenial();
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				kind: "ask",
@@ -14981,18 +15770,28 @@ var OpenCodePolicy = class {
 			return ALLOW;
 		}
 		if (!risk.risky) return ALLOW;
-		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !alwaysRisky) return ALLOW;
+		const always = alwaysRisky || codeden;
+		if (this.autonomy === "full" && risk.action !== "outside_worktree" && !always) return ALLOW;
 		return {
 			kind: "ask",
 			action: risk.action,
 			reason: risk.reason
 		};
 	}
+	/**
+	* What an approval for the session covers: a command in its working directory (the same
+	* relative path elsewhere is another file), or the exact paths.
+	*/
 	key(call) {
 		const { action, resources } = call.request;
-		if (action === "shell") return `shell:${commandOf(call)}`;
+		if (action === "shell") return `shell:${this.workdir(call)}\n${commandOf(call)}`;
 		return `${action}:${[...resources].sort().join("\n")}`;
 	}
+	/** Where a shell call runs: its `workdir`, else the worktree. */
+	workdir(call) {
+		const workdir = str(call.toolInput, "workdir");
+		return workdir ? resolveAgainst(workdir, this.ctx) : this.ctx.cwd;
+	}
 };
 /** The command an OpenCode `shell` ask is about: the tool input, else its parsed parts. */
 function commandOf(call) {
@@ -16079,7 +16878,8 @@ var OpenCodeSession = class {
 		this.broker = new ApprovalBroker(emit);
 		this.policy = new OpenCodePolicy(opts.autonomy, {
 			cwd: opts.cwd,
-			extraRoots: opts.additionalDirectories
+			extraRoots: opts.additionalDirectories,
+			...opts.codedenHome ? { codedenHome: opts.codedenHome } : {}
 		}, opts.readOnly ?? false);
 		this.model = explicitModel(opts.model);
 		this.effort = opts.effort;
@@ -22234,6 +23034,7 @@ async function executeCommand(core, command) {
 			if (added.length > 0) core.log?.(`PATH: picked up ${added.join(", ")}`);
 			const adapters = command.providerId ? registry.list().filter((a) => a.id === command.providerId) : registry.list();
 			const statuses = await Promise.all(adapters.map((a) => a.detect()));
+			if (command.refreshModels === false) return { statuses };
 			const refreshed = registry.refreshModels(adapters.map((a) => a.id));
 			if (!command.waitForModels) return { statuses };
 			await refreshed;
@@ -22348,7 +23149,7 @@ async function executeCommand(core, command) {
 		case "checkpoint.restoreFiles": return restoreFiles(command.cwd, command.sessionId, command.index, command.paths);
 		case "ports.list": return { ports: await listPorts(command.probe) };
 		case "mcp.test": {
-			const { testMcpServer } = await import("./server-test-b0hHPqXb.js");
+			const { testMcpServer } = await import("./server-test-BwyCFssm.js");
 			return testMcpServer({
 				spec: command.spec,
 				cwd: command.cwd,
@@ -23077,9 +23878,24 @@ async function click(session, ref, opts = {}) {
 	const options = opts.button ? { button: opts.button } : {};
 	await withRef(session.page(opts.tabId), ref, (locator) => opts.doubleClick ? locator.dblclick(options) : locator.click(options));
 }
-/** Replace the value of an editable element; `submit` presses Enter afterwards. */
+/**
+* Replace the value of an editable element; `submit` presses Enter afterwards. Without a ref,
+* type the text as key presses into whatever has focus (a canvas editor, a game, a field
+* clicked at coordinates).
+*/
 async function type(session, ref, text, opts = {}) {
-	await withRef(session.page(opts.tabId), ref, async (locator) => {
+	const page = session.page(opts.tabId);
+	if (ref === void 0) {
+		if (text.length > 2e3) throw new CommandError("invalid_text", `Without a ref, type at most ${MAX_FOCUS_TYPE_CHARS} characters`);
+		try {
+			await page.keyboard.type(text);
+			if (opts.submit) await page.keyboard.press("Enter");
+		} catch (error) {
+			throw new CommandError("action_failed", `Typing at the focused element failed: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`);
+		}
+		return;
+	}
+	await withRef(page, ref, async (locator) => {
 		await locator.fill(text);
 		if (opts.submit) await locator.press("Enter");
 	});
@@ -23174,6 +23990,150 @@ async function wait(session, opts) {
 		throw new CommandError("action_failed", error instanceof Error ? error.message : String(error));
 	}
 }
+// ../runner/src/browser/pointer.ts
+/** Drags move in about one step per this many CSS pixels, so drag thresholds see motion. */
+const DRAG_STEP_PX = 20;
+const MIN_DRAG_STEPS = 5;
+const MAX_DRAG_STEPS = 50;
+/** A scroll returns once no scroll event came for this long (smooth scrolling has ended). */
+const SCROLL_QUIET_MS = 100;
+/** ... or after this long in the page, whatever happens. */
+const SCROLL_SETTLE_MAX_MS = 1e3;
+/** The runner stops waiting for the page itself after this (a busy or hidden page). */
+const SCROLL_SETTLE_TIMEOUT_MS = 1500;
+/**
+* Resolves once the page has had no `scroll` event (on any scroller: captured on `window`) for
+* `SCROLL_QUIET_MS`, at most `SCROLL_SETTLE_MAX_MS` (a timer too: hidden tabs get no animation
+* frames). A string, so it runs in the page's realm.
+*/
+const SCROLL_SETTLED = `new Promise((resolve) => {
+  const start = performance.now();
+  let last = start;
+  const onScroll = () => { last = performance.now(); };
+  const done = () => {
+    removeEventListener("scroll", onScroll, { capture: true });
+    clearTimeout(timer);
+    resolve(true);
+  };
+  const timer = setTimeout(done, ${SCROLL_SETTLE_MAX_MS});
+  addEventListener("scroll", onScroll, { capture: true, passive: true });
+  const tick = () => {
+    const now = performance.now();
+    if (now - last < ${SCROLL_QUIET_MS} && now - start < ${SCROLL_SETTLE_MAX_MS}) {
+      requestAnimationFrame(tick);
+    } else done();
+  };
+  requestAnimationFrame(tick);
+})`;
+/** Intermediate moves for a drag: about one per `DRAG_STEP_PX`, within 5 to 50. */
+function dragSteps(from, to) {
+	const distance = Math.hypot(to.x - from.x, to.y - from.y);
+	return Math.min(Math.max(Math.round(distance / DRAG_STEP_PX), MIN_DRAG_STEPS), MAX_DRAG_STEPS);
+}
+const fmt = (n) => String(Math.round(n * 100) / 100);
+/** Refuse a point outside the viewport: it would hit nothing, or the wrong thing. */
+function assertInViewport(point, viewport) {
+	if (point.x >= 0 && point.y >= 0 && point.x < viewport.width && point.y < viewport.height) return;
+	throw new CommandError("out_of_bounds", `Point (${fmt(point.x)}, ${fmt(point.y)}) is outside the viewport (${fmt(viewport.width)}x${fmt(viewport.height)} CSS pixels). Take a new browser_screenshot.`);
+}
+/** The points an action touches: its point, and a drag's end. */
+function pointsOf(command) {
+	const points = [{
+		x: command.x,
+		y: command.y
+	}];
+	if (command.action === "drag") points.push({
+		x: command.toX ?? NaN,
+		y: command.toY ?? NaN
+	});
+	return points;
+}
+/**
+* Run `action` with `modifiers` held, releasing every key it tried to press, also on failure.
+* A key counts as held before its press resolves: Playwright marks it down before dispatching,
+* so a press that fails can still leave it held for the next action in the shared browser.
+*/
+async function withModifiers(page, modifiers, action) {
+	const held = [];
+	try {
+		for (const key of new Set(modifiers)) {
+			held.push(key);
+			await page.keyboard.down(key);
+		}
+		await action();
+	} finally {
+		for (const key of held.reverse()) await page.keyboard.up(key).catch(() => void 0);
+	}
+}
+/**
+* Run steps that press `button`, releasing it if any of them fails, the press included (like
+* keys, Playwright marks a button held before the press is dispatched). The error is kept.
+*/
+async function releasingOnFailure(page, button, steps) {
+	try {
+		await steps();
+	} catch (error) {
+		await page.mouse.up({ button }).catch(() => void 0);
+		throw error;
+	}
+}
+async function drag(page, from, to, button) {
+	await page.mouse.move(from.x, from.y);
+	await releasingOnFailure(page, button, async () => {
+		await page.mouse.down({ button });
+		await page.mouse.move(to.x, to.y, { steps: dragSteps(from, to) });
+	});
+	await page.mouse.up({ button });
+}
+/** Wait until a scroll has been rendered, bounded; a page that never answers is not an error. */
+async function scrollSettled(page) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(resolve, SCROLL_SETTLE_TIMEOUT_MS);
+	});
+	try {
+		await Promise.race([page.evaluate(SCROLL_SETTLED).catch(() => void 0), timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Run one pointer action on a page whose viewport is `viewport` (CSS pixels). */
+async function mouseAction(page, command, viewport) {
+	const points = pointsOf(command);
+	for (const point of points) assertInViewport(point, viewport);
+	const [at, end] = points;
+	try {
+		await withModifiers(page, command.modifiers ?? [], async () => {
+			switch (command.action) {
+				case "click":
+					await releasingOnFailure(page, command.button, () => page.mouse.click(at.x, at.y, {
+						button: command.button,
+						clickCount: command.clickCount ?? 1
+					}));
+					return;
+				case "hover":
+					await page.mouse.move(at.x, at.y);
+					return;
+				case "drag":
+					await drag(page, at, end ?? at, command.button);
+					return;
+				case "scroll":
+					await page.mouse.move(at.x, at.y);
+					await page.mouse.wheel(command.deltaX ?? 0, command.deltaY ?? 0);
+					return;
+			}
+		});
+	} catch (error) {
+		if (error instanceof CommandError) throw error;
+		const message = error instanceof Error ? error.message.split("\n")[0] : String(error);
+		throw new CommandError("action_failed", `Mouse ${command.action} at (${fmt(at.x)}, ${fmt(at.y)}) failed: ${message}`);
+	}
+	if (command.action === "scroll") await scrollSettled(page);
+}
+/** `browser.mouse`: act at coordinates in a session's tab, checked against its current viewport. */
+async function mouse(session, command) {
+	await mouseAction(session.page(command.tabId), command, await session.currentViewport(command.tabId));
+}
 // ../runner/src/browser/handlers.ts
 /**
 * Handlers for the `browser.*` runner commands (§4.3, §12.2). Wire `execute` into the
@@ -23264,6 +24224,10 @@ function createBrowserCommandHandlers(deps) {
 			await press(manager.get(c.sessionId), c.key, c.tabId);
 			return {};
 		},
+		"browser.mouse": async ({ name: _name, sessionId, ...command }) => {
+			await mouse(manager.get(sessionId), command);
+			return {};
+		},
 		"browser.screenshot": (c) => screenshot(manager.get(c.sessionId), c.path, {
 			tabId: c.tabId,
 			fullPage: c.fullPage,
@@ -24127,21 +25091,34 @@ var BrowserSession = class {
 			await (await this.cdp(state)).send("Emulation.setDeviceMetricsOverride", deviceMetricsParams(this.viewport));
 		} catch {}
 	}
-	/** A native view's actual size (CSS pixels and scale), as the desktop panel laid it out. */
+	/**
+	* A view's own size (CSS pixels and scale); undefined while it has none. Throws when the page
+	* doesn't answer in time.
+	*/
+	async viewSize(page) {
+		const [width, height, scale] = await withTimeout(page.evaluate("[window.innerWidth, window.innerHeight, window.devicePixelRatio]"), NATIVE_MEASURE_TIMEOUT_MS);
+		return width && height ? {
+			width,
+			height,
+			deviceScaleFactor: scale || 1
+		} : void 0;
+	}
+	/** The shown native view's size, just measured: the session's viewport follows it. */
+	adopt(next) {
+		const changed = !sameViewport(next, this.viewport);
+		this.viewport = next;
+		this.measuredAt = Date.now();
+		if (changed) this.screencast.setFrameSize(nativeFrame(), next);
+	}
+	/**
+	* The shown native view's actual size, as the desktop panel laid it out. Tolerant, for viewer
+	* input and viewport answers: a view that doesn't answer keeps its last size.
+	*/
 	async measure() {
 		try {
-			const [width, height, scale] = await withTimeout(this.page().evaluate("[window.innerWidth, window.innerHeight, window.devicePixelRatio]"), NATIVE_MEASURE_TIMEOUT_MS);
-			if (width && height) {
-				const next = {
-					width,
-					height,
-					deviceScaleFactor: scale || 1
-				};
-				const changed = !sameViewport(next, this.viewport);
-				this.viewport = next;
-				if (changed) this.screencast.setFrameSize(nativeFrame(), next);
-			}
-			this.measuredAt = Date.now();
+			const next = await this.viewSize(this.page());
+			if (next) this.adopt(next);
+			else this.measuredAt = Date.now();
 		} catch {}
 		return { ...this.viewport };
 	}
@@ -24152,6 +25129,22 @@ var BrowserSession = class {
 	async syncViewport() {
 		if (this.native) await this.measure();
 	}
+	/**
+	* The viewport of `tabId` (default: the active tab) that an agent's coordinates refer to, now:
+	* the emulated size every tab shares, or a native view's own size measured fresh (agent actions
+	* are few, and the panel may have just resized). A native view in the background can differ
+	* from the shown one, so only the shown view's size updates the session's viewport. Strict,
+	* unlike `measure`: a view that can't be measured (busy in a script, navigating) fails with a
+	* retryable `viewport_unavailable` instead of borrowing another size, so no action is sent.
+	*/
+	async currentViewport(tabId) {
+		const state = this.tabState(tabId);
+		if (!this.native) return { ...this.viewport };
+		const size = await this.viewSize(state.page).catch(() => void 0);
+		if (!size) throw new CommandError("viewport_unavailable", `Could not measure the size of tab ${state.tabId} (the page may be busy or loading), so nothing was done. Try again in a moment.`);
+		if (state.tabId === this.activeTabId) this.adopt(size);
+		return { ...size };
+	}
 	/** The native view's size for input, measured at most once a second (pointer moves are many). */
 	async nativeViewport() {
 		if (Date.now() - this.measuredAt > NATIVE_MEASURE_MS) return this.measure();
@@ -24692,7 +25685,12 @@ var SessionHost = class {
 	async send(cmd) {
 		const hosted = this.get(cmd.sessionId);
 		await hosted.checkpointChain;
-		await hosted.session.send(cmd.input);
+		try {
+			await hosted.session.send(cmd.input);
+		} catch (error) {
+			if (error instanceof ProviderSessionError && error.code === "turn_running") throw new CommandError("turn_running", error.message);
+			throw error;
+		}
 	}
 	async steer(cmd) {
 		const { session } = this.get(cmd.sessionId);
@@ -25059,6 +26057,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { isElectronRuntime as A, installClaudeSdk as C, acquireInstallLock as D, resolveNpm as E, import_websocket_server as M, wrapper_default as N, brokenInstallMessage as O, importClaudeSdkFrom as S, runNpm as T, claudeMemoryDir as _, bufferToFormData as a, claudeSdkSource as b, refreshProcessPath as c, ImageEngineRegistry as d, createImageEngineRegistry as f, ImageGenerationError as g, resolveImageOutput as h, tryDecodeURIComponent as i, ownNodeEnv as j, findExecutable as k, defaultShell as l, imageInfo as m, readLock as n, createAdaptorServer as o, IMAGE_ASPECT_RATIOS as p, Hono as r, upgradeWebSocket as s, startRunner as t, shellCommandLine as u, findGitRoot as v, isClaudeSdkInstalled as w, CLAUDE_SDK_VERSION as x, mainRepoRoot as y };
+export { findExecutable as A, installClaudeSdk as C, acquireInstallLock as D, resolveNpm as E, ownNodeEnv as M, import_websocket_server as N, isSecretPath as O, wrapper_default as P, importClaudeSdkFrom as S, runNpm as T, claudeMemoryDir as _, bufferToFormData as a, claudeSdkSource as b, refreshProcessPath as c, ImageEngineRegistry as d, createImageEngineRegistry as f, ImageGenerationError as g, resolveImageOutput as h, tryDecodeURIComponent as i, isElectronRuntime as j, brokenInstallMessage as k, defaultShell as l, imageInfo as m, readLock as n, createAdaptorServer as o, IMAGE_ASPECT_RATIOS as p, Hono as r, upgradeWebSocket as s, startRunner as t, shellCommandLine as u, findGitRoot as v, isClaudeSdkInstalled as w, CLAUDE_SDK_VERSION as x, mainRepoRoot as y };
 
-//# sourceMappingURL=runner-CiaiUWOE.js.map
+//# sourceMappingURL=runner-CQYh087M.js.map