dahrk-node 0.1.10 → 0.1.11

package/dist/main.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/main.ts
-import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync12, realpathSync as realpathSync4 } from "fs";
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync13, realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { homedir as homedir5, platform as osPlatform4 } from "os";
-import { basename as basename2, join as join14 } from "path";
+import { homedir as homedir7, platform as osPlatform4 } from "os";
+import { basename as basename2, join as join16 } from "path";
 import { pathToFileURL } from "url";
 
 // ../../packages/edge/src/ws-client.ts
@@ -67,6 +67,8 @@ function createMockRunner(runtime) {
 }
 
 // ../../packages/executor-worktree/src/claude-adapter.ts
+import { homedir, tmpdir } from "os";
+import { join as join2 } from "path";
 import {
   query
 } from "@anthropic-ai/claude-agent-sdk";
@@ -336,7 +338,7 @@ var ManagedMailbox = class {
         const v = this.q.shift();
         if (v !== void 0) return Promise.resolve({ value: v, done: false });
         if (this.done) return Promise.resolve({ value: void 0, done: true });
-        return new Promise((resolve2) => this.waiters.push(resolve2));
+        return new Promise((resolve3) => this.waiters.push(resolve3));
       }
     };
   }
@@ -347,7 +349,7 @@ function interactiveIdleWindows(ctx) {
   return { firstReplyMs: Math.max(firstReplyMs, idleMs), idleMs };
 }
 function raceNextTurn(pending, idleMs, signal) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let settled = false;
     let timer;
     function finish(r) {
@@ -355,7 +357,7 @@ function raceNextTurn(pending, idleMs, signal) {
       settled = true;
       if (timer) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve2(r);
+      resolve3(r);
     }
     function onAbort() {
       finish({ kind: "cancelled" });
@@ -391,7 +393,7 @@ function createElicitTurnRouter(turns, opts) {
   const ask = (firstReply, onRaise) => {
     if (ref.settle) return Promise.resolve({ kind: "busy" });
     onRaise();
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let settled = false;
       const finish = (o) => {
         if (settled) return;
@@ -399,7 +401,7 @@ function createElicitTurnRouter(turns, opts) {
         clearTimeout(timer);
         opts.signal.removeEventListener("abort", onAbort);
         ref.settle = null;
-        resolve2(o);
+        resolve3(o);
       };
       const onAbort = () => finish({ kind: "cancel" });
       const timer = setTimeout(() => finish({ kind: "noreply" }), firstReply ? opts.firstReplyMs : opts.idleMs);
@@ -518,6 +520,22 @@ function buildBrokeredMcpServers(ctx) {
   for (const s of servers) entries[s.id] = { type: s.type, url: `${ctx.mcpProxyBaseUrl}/${s.id}` };
   return entries;
 }
+function sandboxOptions(ctx) {
+  if (process.env.DAHRK_SANDBOX !== "1") return {};
+  const home = homedir();
+  return {
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: false,
+      autoAllowBashIfSandboxed: false,
+      allowUnsandboxedCommands: false,
+      filesystem: {
+        allowWrite: [ctx.workspace.worktreePath, ctx.workspace.scratchPath, tmpdir()],
+        denyRead: [join2(home, ".ssh"), join2(home, ".aws"), join2(home, ".gnupg"), "/Volumes"]
+      }
+    }
+  };
+}
 function createClaudeRunner() {
   const abortController = new AbortController();
   let cancelled = false;
@@ -533,7 +551,25 @@ function createClaudeRunner() {
     // is a Claude Code SETTINGS key (not a top-level Options field), so it rides the inline `settings`
     // object, which sits at the flag layer and overrides any project/local setting. Mirrors the cyrus
     // reference (EdgeWorker.ts writes the same key into .claude/settings.local.json).
-    settings: { includeCoAuthoredBy: false },
+    settings: {
+      includeCoAuthoredBy: false,
+      // DHK-392, defence in depth. The stage runner's `fs_confine` builtin is the real block (it is
+      // what `canUseTool` below consults, and unlike these rules it covers Grep and Bash). These deny
+      // rules close the same door from inside Claude Code, for the tools its permission system does
+      // cover (Read/Glob/NotebookRead via `Read(...)`, Write/Edit via `Edit(...)`): credentials an
+      // agent has no business reading, and the mounted volumes whose scan started all this. Deny
+      // outranks allow, so a repo's own .claude/settings.json cannot undo them.
+      permissions: {
+        deny: [
+          "Read(//Volumes/**)",
+          "Read(~/.ssh/**)",
+          "Read(~/.aws/**)",
+          "Read(~/.gnupg/**)",
+          "Read(~/Library/Keychains/**)"
+        ]
+      }
+    },
+    ...sandboxOptions(ctx),
     // Inherit the REPO's .mcp.json / .claude settings (build spec section 9): do NOT set
     // strictMcpConfig. Policy enforcement around tools is M6; M4 allows tools to run and the
     // stage runner intercepts denied actions at the trace level.
@@ -1332,8 +1368,8 @@ var PROVIDER_BY_ENV = {
 // ../../packages/executor-worktree/src/git-service.ts
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
-import { homedir, tmpdir } from "os";
-import { basename, dirname, isAbsolute, join as join2 } from "path";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "os";
+import { basename, dirname, isAbsolute, join as join3 } from "path";
 var noopLogger = { info: () => {
 }, warn: () => {
 } };
@@ -1347,10 +1383,10 @@ function sanitizeBranchName(name) {
   return name.replace(/[`~^:?*[\]\\@{}\s]/g, "-").replace(/\.{2,}/g, ".").replace(/\/{2,}/g, "/").replace(/\.lock(\/|$)/g, "$1").replace(/^[.\-/]+/, "").replace(/[.\-/]+$/, "").replace(/-{2,}/g, "-");
 }
 function resolveWorktreesDir(override) {
-  return override ?? process.env.DAHRK_WORKTREES_DIR ?? process.env.SKAKEL_WORKTREES_DIR ?? join2(homedir(), ".dahrk", "worktrees");
+  return override ?? process.env.DAHRK_WORKTREES_DIR ?? process.env.SKAKEL_WORKTREES_DIR ?? join3(homedir2(), ".dahrk", "worktrees");
 }
 function resolveMirrorsDir(override) {
-  return override ?? process.env.DAHRK_MIRRORS_DIR ?? process.env.SKAKEL_MIRRORS_DIR ?? join2(homedir(), ".dahrk", "mirrors");
+  return override ?? process.env.DAHRK_MIRRORS_DIR ?? process.env.SKAKEL_MIRRORS_DIR ?? join3(homedir2(), ".dahrk", "mirrors");
 }
 function createGitService(opts = {}) {
   const worktreesDir = resolveWorktreesDir(opts.worktreesDir);
@@ -1389,12 +1425,12 @@ function createGitService(opts = {}) {
     const entry = `${SCRATCH_DIR}/`;
     try {
       const rel = git(worktreePath, ["rev-parse", "--git-path", "info/exclude"]).trim();
-      const excludePath = isAbsolute(rel) ? rel : join2(worktreePath, rel);
+      const excludePath = isAbsolute(rel) ? rel : join3(worktreePath, rel);
       const existing = existsSync(excludePath) ? readFileSync2(excludePath, "utf-8") : "";
       if (existing.split("\n").some((l) => l.trim() === entry)) return;
       mkdirSync(dirname(excludePath), { recursive: true });
-      const sep3 = existing && !existing.endsWith("\n") ? "\n" : "";
-      writeFileSync(excludePath, `${existing}${sep3}${entry}
+      const sep4 = existing && !existing.endsWith("\n") ? "\n" : "";
+      writeFileSync(excludePath, `${existing}${sep4}${entry}
 `);
     } catch (e) {
       log.warn(`could not set worktree scratch exclude at ${worktreePath}: ${e.message}`);
@@ -1419,8 +1455,8 @@ function createGitService(opts = {}) {
     return { headSha: git(worktreePath, ["rev-parse", "HEAD"]).trim(), dirty };
   };
   const setupAuth = (token) => {
-    const dir = mkdtempSync(join2(tmpdir(), "dahrk-cred-"));
-    const script = join2(dir, "askpass.sh");
+    const dir = mkdtempSync(join3(tmpdir2(), "dahrk-cred-"));
+    const script = join3(dir, "askpass.sh");
     writeFileSync(script, '#!/bin/sh\nprintf "%s" "$DAHRK_GIT_TOKEN"\n', { mode: 448 });
     return {
       env: { ...process.env, GIT_ASKPASS: script, DAHRK_GIT_TOKEN: token, GIT_TERMINAL_PROMPT: "0" },
@@ -1429,7 +1465,7 @@ function createGitService(opts = {}) {
   };
   const netEnv = (authEnv) => authEnv ?? { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   const withTokenUser = (gitUrl) => /^https:\/\/[^@/]+@/.test(gitUrl) ? gitUrl : gitUrl.replace(/^https:\/\//, "https://x-access-token@");
-  const mirrorPathFor = (repoId) => join2(mirrorsDir, sanitizeBranchName(repoId));
+  const mirrorPathFor = (repoId) => join3(mirrorsDir, sanitizeBranchName(repoId));
   const listWorktrees = (mirror) => {
     let out;
     try {
@@ -1540,18 +1576,18 @@ function createGitService(opts = {}) {
     repo: spec.repo ?? spec.repoId,
     baseBranch: spec.baseBranch,
     worktreePath,
-    scratchPath: join2(worktreePath, ".skakel", "scratch")
+    scratchPath: join3(worktreePath, ".skakel", "scratch")
   });
   return {
     worktreesDir,
     async createWorktree(spec) {
       const { repoId, gitUrl, baseBranch, runId } = spec;
       const branchName = sanitizeBranchName(spec.branch ?? `dahrk/${runId}`);
-      const worktreePath = join2(worktreesDir, runId);
+      const worktreePath = join3(worktreesDir, runId);
       mkdirSync(worktreesDir, { recursive: true });
       if (existsSync(worktreePath) && gitOk2(worktreePath, ["rev-parse", "--git-dir"])) {
         log.info(`reusing existing worktree at ${worktreePath}`);
-        mkdirSync(join2(worktreePath, ".skakel", "scratch"), { recursive: true });
+        mkdirSync(join3(worktreePath, ".skakel", "scratch"), { recursive: true });
         return refFor(spec, worktreePath);
       }
       const auth = spec.credentialToken ? setupAuth(spec.credentialToken) : void 0;
@@ -1587,7 +1623,7 @@ function createGitService(opts = {}) {
       if (!gitOk2(worktreePath, ["rev-parse", "--verify", "-q", "HEAD"])) {
         throw new Error(`base '${baseBranch}' did not materialise into ${worktreePath} (unborn HEAD)`);
       }
-      mkdirSync(join2(worktreePath, ".skakel", "scratch"), { recursive: true });
+      mkdirSync(join3(worktreePath, ".skakel", "scratch"), { recursive: true });
       return refFor(spec, worktreePath);
     },
     async commitAndPush(ref, opts2) {
@@ -1693,8 +1729,8 @@ function createGitService(opts = {}) {
           return void 0;
         }
       };
-      const tmp = mkdtempSync(join2(tmpdir(), "dahrk-pr-"));
-      const bodyFile = join2(tmp, "body.md");
+      const tmp = mkdtempSync(join3(tmpdir2(), "dahrk-pr-"));
+      const bodyFile = join3(tmp, "body.md");
       try {
         writeFileSync(bodyFile, opts2.body ?? "");
         try {
@@ -1730,7 +1766,7 @@ function createGitService(opts = {}) {
 // ../../packages/executor-worktree/src/worktree-reaper.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync2, readdirSync, realpathSync, rmSync as rmSync2, statSync } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var MINUTE = 6e4;
 var HOUR = 60 * MINUTE;
 var DEFAULTS = {
@@ -1760,7 +1796,7 @@ var canonical = (p) => {
   }
 };
 function lastUsedMs(worktreePath) {
-  const candidates = [join3(worktreePath, ".skakel", "scratch", "state.json"), worktreePath];
+  const candidates = [join4(worktreePath, ".skakel", "scratch", "state.json"), worktreePath];
   let newest = 0;
   for (const p of candidates) {
     try {
@@ -1783,7 +1819,7 @@ function createWorktreeReaper(opts) {
   const log = opts.logger ?? noop;
   const mirrors = () => {
     try {
-      return readdirSync(opts.mirrorsDir).map((d) => join3(opts.mirrorsDir, d)).filter((m) => gitOk(m, ["rev-parse", "--git-dir"]));
+      return readdirSync(opts.mirrorsDir).map((d) => join4(opts.mirrorsDir, d)).filter((m) => gitOk(m, ["rev-parse", "--git-dir"]));
     } catch {
       return [];
     }
@@ -1807,7 +1843,7 @@ function createWorktreeReaper(opts) {
       }
       const onDisk = (() => {
         try {
-          return readdirSync(opts.worktreesDir).map((d) => canonical(join3(opts.worktreesDir, d)));
+          return readdirSync(opts.worktreesDir).map((d) => canonical(join4(opts.worktreesDir, d)));
         } catch {
           return [];
         }
@@ -1868,15 +1904,15 @@ function createWorktreeReaper(opts) {
 // ../../packages/executor-worktree/src/trace-writer.ts
 import { createHash } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var DEFAULT_SPILL_BYTES = 8192;
 function createTraceWriter(scratchPath, meta, opts = {}) {
   const spillBytes = opts.spillBytes ?? DEFAULT_SPILL_BYTES;
-  const dir = join4(scratchPath, "traces", meta.stageId, `attempt-${meta.attempt}`);
-  mkdirSync2(join4(dir, "blobs"), { recursive: true });
-  mkdirSync2(join4(dir, "raw"), { recursive: true });
-  const tracePath = join4(dir, "trace.jsonl");
-  const metaPath = join4(dir, "meta.json");
+  const dir = join5(scratchPath, "traces", meta.stageId, `attempt-${meta.attempt}`);
+  mkdirSync2(join5(dir, "blobs"), { recursive: true });
+  mkdirSync2(join5(dir, "raw"), { recursive: true });
+  const tracePath = join5(dir, "trace.jsonl");
+  const metaPath = join5(dir, "meta.json");
   let current = { ...meta };
   let nextSeq = 0;
   let rawCount = 0;
@@ -1888,8 +1924,8 @@ function createTraceWriter(scratchPath, meta, opts = {}) {
   const spillValue = (value) => {
     const data = typeof value === "string" ? value : JSON.stringify(value);
     const sha = createHash("sha256").update(data).digest("hex");
-    writeFileSync2(join4(dir, "blobs", sha), data);
-    return join4("blobs", sha);
+    writeFileSync2(join5(dir, "blobs", sha), data);
+    return join5("blobs", sha);
   };
   const spill = (event) => {
     if (event.type === "thought" && event.text !== void 0 && tooBig(event.text)) {
@@ -1919,8 +1955,8 @@ function createTraceWriter(scratchPath, meta, opts = {}) {
       return written;
     },
     writeRaw(record) {
-      const rel = join4("raw", `${rawCount++}.json`);
-      writeFileSync2(join4(dir, rel), JSON.stringify(record, null, 2));
+      const rel = join5("raw", `${rawCount++}.json`);
+      writeFileSync2(join5(dir, rel), JSON.stringify(record, null, 2));
       return rel;
     },
     finalise(patch = {}) {
@@ -1936,12 +1972,12 @@ function createTraceWriter(scratchPath, meta, opts = {}) {
 // ../../packages/executor-worktree/src/pack-cache.ts
 import { createHash as createHash2 } from "crypto";
 import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readdirSync as readdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join5, relative, sep } from "path";
+import { dirname as dirname2, join as join6, relative, sep } from "path";
 function readManifestFiles(dir) {
   const out = [];
   const walk = (cur) => {
     for (const entry of readdirSync2(cur, { withFileTypes: true })) {
-      const abs = join5(cur, entry.name);
+      const abs = join6(cur, entry.name);
       if (entry.isDirectory()) walk(abs);
       else out.push(relative(dir, abs).split(sep).join("/"));
     }
@@ -1952,7 +1988,7 @@ function readManifestFiles(dir) {
 
 // ../../packages/executor-worktree/src/overlay.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname3, join as join7 } from "path";
 function sameBytes(dest, bytes) {
   try {
     return readFileSync3(dest).equals(bytes);
@@ -1972,8 +2008,8 @@ async function overlayComponents(opts) {
     }
     const { dir } = await cache.materialise(ref);
     for (const relPath of readManifestFiles(dir)) {
-      const src = join6(dir, relPath);
-      const dest = join6(worktreePath, relPath);
+      const src = join7(dir, relPath);
+      const dest = join7(worktreePath, relPath);
       const bytes = readFileSync3(src);
       if (existsSync4(dest)) {
         if (sameBytes(dest, bytes)) continue;
@@ -2160,7 +2196,7 @@ function ceilingFromEnv(env) {
 
 // ../../packages/edge/src/logger.ts
 import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync5, openSync, renameSync, rmSync as rmSync4, statSync as statSync2, writeSync } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import pino from "pino";
 
 // ../../packages/edge/src/redact.ts
@@ -2350,7 +2386,7 @@ function createNodeLogger(opts = {}) {
   if (opts.dir && fileLevel !== "silent") {
     try {
       mkdirSync5(opts.dir, { recursive: true, mode: 448 });
-      const file = new RotatingFile(join7(opts.dir, "node.jsonl"), opts.maxBytes ?? 10 * 1024 * 1024, opts.maxFiles ?? 5);
+      const file = new RotatingFile(join8(opts.dir, "node.jsonl"), opts.maxBytes ?? 10 * 1024 * 1024, opts.maxFiles ?? 5);
       streams.push({ level: fileLevel, stream: file });
     } catch (e) {
       process.stderr.write(`dahrk: file logging disabled (${e.message})
@@ -2406,15 +2442,377 @@ function denyToolRule(tool3) {
 }
 
 // ../../packages/edge/src/stage-runner.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync4, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve, sep as sep2 } from "path";
+import { tmpdir as tmpdir4 } from "os";
+import { isAbsolute as isAbsolute3, join as join10, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
 import { attachedDocBasename as attachedDocBasename2 } from "@dahrk/contracts";
 
 // ../../packages/edge/src/builtins.ts
+import { execFileSync as execFileSync4 } from "child_process";
+
+// ../../packages/edge/src/fs-roots.ts
 import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync6, realpathSync as realpathSync2 } from "fs";
+import { homedir as homedir3, tmpdir as tmpdir3 } from "os";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve, sep as sep2 } from "path";
+function isUnder(root, target) {
+  const rel = relative2(resolve(root), resolve(target));
+  return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function expandPath(raw, cwd) {
+  const home = homedir3();
+  const expanded = raw.replace(/^~(?=$|\/)/, home).replace(/^\$\{HOME\}(?=$|\/)/, home).replace(/^\$HOME(?=$|\/)/, home);
+  return resolve(cwd, expanded);
+}
+function realish(p) {
+  let head = p;
+  const tail = [];
+  while (head !== dirname4(head)) {
+    if (existsSync6(head)) {
+      try {
+        return join9(realpathSync2.native(head), ...tail.reverse());
+      } catch {
+        return p;
+      }
+    }
+    tail.push(head.slice(dirname4(head).length + 1));
+    head = dirname4(head);
+  }
+  return p;
+}
+function withinRoots(raw, roots, need) {
+  const literal = expandPath(raw, roots.cwd);
+  const real = realish(literal);
+  const hits = (list2) => list2.some((root) => isUnder(root, literal) || isUnder(root, real));
+  if (hits(roots.deny)) return false;
+  if (hits(roots.rw)) return true;
+  return need === "read" && hits(roots.ro);
+}
+function gitCommonDir(worktreePath) {
+  try {
+    const out = execFileSync3("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+      cwd: worktreePath,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    return out || void 0;
+  } catch {
+    return void 0;
+  }
+}
+var pnpmStoreCache;
+function pnpmStore() {
+  if (pnpmStoreCache) return pnpmStoreCache.path;
+  try {
+    const out = execFileSync3("pnpm", ["store", "path"], { stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }).toString().trim();
+    pnpmStoreCache = { path: out || void 0 };
+  } catch {
+    pnpmStoreCache = { path: void 0 };
+  }
+  return pnpmStoreCache.path;
+}
+var splitRoots = (v) => (v ?? "").split(":").map((s) => s.trim()).filter(Boolean);
+function computeFsRoots(opts) {
+  const home = homedir3();
+  const wt = realish(resolve(opts.worktreePath));
+  const rw = [
+    wt,
+    ...opts.scratchPath ? [realish(resolve(opts.scratchPath))] : [],
+    // Every git command in the worktree reads and writes here.
+    ...[gitCommonDir(opts.worktreePath)].filter((p) => Boolean(p)).map(realish),
+    // Scratch space: `mkdtemp`, git's temp files, and an agent tidying a throwaway dir it created.
+    ...[tmpdir3(), "/tmp", "/private/tmp", "/var/folders", "/private/var/folders"].map(realish),
+    // The safe I/O sinks. `2>/dev/null` is on a third of the shell commands real stages run; treating
+    // it as a write outside the worktree would deny most of a normal build. The raw devices are NOT
+    // here, so `> /dev/sda` still fails confinement (as well as shell_guard's device-write regex).
+    ...["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty", "/dev/fd"],
+    ...[pnpmStore()].filter((p) => Boolean(p)).map(realish),
+    ...splitRoots(process.env.DAHRK_FS_EXTRA_ROOTS).map((p) => realish(resolve(p)))
+  ];
+  const ro = [
+    "/usr",
+    "/bin",
+    "/sbin",
+    "/etc",
+    "/opt",
+    "/nix",
+    "/Library",
+    "/System",
+    "/proc",
+    "/sys",
+    join9(home, ".gitconfig"),
+    join9(home, ".config"),
+    join9(home, ".npmrc"),
+    join9(home, ".cache"),
+    join9(home, "Library", "Caches"),
+    join9(home, "Library", "pnpm"),
+    join9(home, ".local", "share"),
+    join9(home, ".nvm"),
+    join9(home, ".volta"),
+    join9(home, ".asdf"),
+    join9(home, ".cargo"),
+    join9(home, ".rustup"),
+    ...splitRoots(process.env.DAHRK_FS_EXTRA_READ_ROOTS).map((p) => realish(resolve(p)))
+  ].map(realish);
+  const deny = [
+    join9(home, ".ssh"),
+    join9(home, ".aws"),
+    join9(home, ".gnupg"),
+    join9(home, ".config", "gcloud"),
+    join9(home, "Library", "Keychains"),
+    "/Volumes",
+    "/etc/shadow",
+    "/etc/sudoers"
+  ];
+  return { rw, ro, deny, cwd: wt };
+}
+
+// ../../packages/edge/src/shell-scan.ts
+var PATTERN_FLAGS = /* @__PURE__ */ new Set([
+  "-e",
+  "--regexp",
+  "-path",
+  "-ipath",
+  "-name",
+  "-iname",
+  "-wholename",
+  "--glob",
+  "-g",
+  "--include",
+  "--exclude",
+  "--exclude-dir",
+  "--type",
+  "-m",
+  "--message"
+]);
+var PATTERN_FIRST = /* @__PURE__ */ new Set(["grep", "egrep", "fgrep", "rg", "ag", "ack", "sed", "awk", "perl"]);
+var DIR_FLAGS = /* @__PURE__ */ new Set(["-C", "--git-dir", "--work-tree", "--cwd", "--directory"]);
+var NO_PATH_ARGV0 = /* @__PURE__ */ new Set(["echo", "printf", ":", "true", "false"]);
+var WRITE_ALL = /* @__PURE__ */ new Set(["rm", "rmdir", "mkdir", "touch", "chmod", "chown", "truncate", "mkfifo"]);
+var WRITE_LAST = /* @__PURE__ */ new Set(["cp", "mv", "ln", "tee", "dd", "install", "rsync"]);
+var SHELL_ARGV0 = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "eval", "xargs", "env", "nohup", "time", "sudo"]);
+var REDIRECTS = /* @__PURE__ */ new Set([">", ">>", "<", "2>", "2>>", "&>", "<<<"]);
+function tokenise(cmd) {
+  const tokens = [];
+  const subshells = [];
+  let cur = "";
+  let quoted = false;
+  let started = false;
+  let quote = null;
+  const push = () => {
+    if (started) tokens.push({ value: cur, quoted });
+    cur = "";
+    quoted = false;
+    started = false;
+  };
+  for (let i = 0; i < cmd.length; i++) {
+    const c = cmd[i];
+    if (quote) {
+      if (c === quote) {
+        quote = null;
+      } else if (c === "\\" && quote === '"' && i + 1 < cmd.length) {
+        cur += cmd[++i];
+        started = true;
+      } else {
+        cur += c;
+        started = true;
+      }
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      quoted = true;
+      started = true;
+      continue;
+    }
+    if (c === "\\" && i + 1 < cmd.length) {
+      cur += cmd[++i];
+      started = true;
+      continue;
+    }
+    if (c === "$" && cmd[i + 1] === "(" || c === "`") {
+      const open = c === "`" ? "`" : "(";
+      const close = c === "`" ? "`" : ")";
+      let depth = 1;
+      let j = i + (c === "`" ? 1 : 2);
+      let body = "";
+      for (; j < cmd.length && depth > 0; j++) {
+        const d = cmd[j];
+        if (d === open && close !== "`") depth++;
+        else if (d === close) {
+          depth--;
+          if (depth === 0) break;
+        }
+        body += d;
+      }
+      if (depth > 0) return null;
+      subshells.push(body);
+      cur += "$SUBSHELL";
+      started = true;
+      i = j;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      push();
+      continue;
+    }
+    const three = cmd.slice(i, i + 3);
+    const two = cmd.slice(i, i + 2);
+    if (three === "<<<") {
+      push();
+      tokens.push({ value: three, quoted: false, operator: three });
+      i += 2;
+      continue;
+    }
+    if (["&&", "||", ">>", "2>", "&>"].includes(two)) {
+      push();
+      tokens.push({ value: two, quoted: false, operator: two });
+      i += 1;
+      continue;
+    }
+    if (c === ";" || c === "|" || c === "&" || c === ">" || c === "<" || c === "\n") {
+      push();
+      tokens.push({ value: c, quoted: false, operator: c });
+      continue;
+    }
+    cur += c;
+    started = true;
+  }
+  if (quote) return null;
+  push();
+  return { tokens, subshells };
+}
+function looksLikePath(t) {
+  if (t.value.startsWith("-")) return false;
+  if (/\s/.test(t.value)) return false;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(t.value)) return false;
+  const s = t.value.replace(/^@/, "");
+  if (s.includes("$SUBSHELL")) return false;
+  if (/^\$(?!\{?HOME\b)/.test(s)) return false;
+  return /^(\/|~(?:$|\/)|\$\{?HOME\}?(?:$|\/)|\.\.(?:$|\/))/.test(s) || s.includes("/../") || s.endsWith("/..");
+}
+var bare = (v) => v.replace(/^@/, "");
+function scanSimple(tokens, roots, cwd) {
+  const scoped = { ...roots, cwd };
+  const check = (raw, need) => withinRoots(bare(raw), scoped, need) ? null : { kind: "escape", path: bare(raw), need };
+  const argv0 = tokens.find((t) => !t.operator && !t.value.includes("="))?.value ?? "";
+  const cmdName = argv0.split("/").pop() ?? argv0;
+  if (SHELL_ARGV0.has(cmdName)) {
+    for (const t of tokens) {
+      if (t.operator || t.value === argv0) continue;
+      if (t.quoted || t.value.includes(" ")) {
+        const inner = scanCommand(t.value, roots, cwd);
+        if (inner.kind !== "ok") return inner;
+      } else if (looksLikePath(t)) {
+        const bad = check(t.value, "read");
+        if (bad) return bad;
+      }
+    }
+    return { kind: "ok" };
+  }
+  if (NO_PATH_ARGV0.has(cmdName)) {
+    return { kind: "ok" };
+  }
+  const writeAll = WRITE_ALL.has(cmdName);
+  const writeLast = WRITE_LAST.has(cmdName);
+  const operands = [];
+  let patternPending = PATTERN_FIRST.has(cmdName);
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.operator) continue;
+    if (t.value === argv0 && i === tokens.indexOf(t)) {
+      if (looksLikePath(t)) {
+        const bad = check(t.value, "read");
+        if (bad) return bad;
+      }
+      continue;
+    }
+    if (DIR_FLAGS.has(t.value)) {
+      const operand = tokens[i + 1];
+      if (operand && !operand.operator) {
+        const bad = check(operand.value, "read");
+        if (bad) return bad;
+        i++;
+      }
+      continue;
+    }
+    if (PATTERN_FLAGS.has(t.value)) {
+      i++;
+      continue;
+    }
+    if (t.value.startsWith("-")) continue;
+    if (patternPending) {
+      patternPending = false;
+      continue;
+    }
+    if (looksLikePath(t)) operands.push({ token: t, index: i });
+  }
+  if (cmdName === "cd") {
+    const target = tokens.find((t) => !t.operator && t.value !== argv0 && !t.value.startsWith("-"));
+    if (!target) return { kind: "ok" };
+    const bad = check(target.value, "read");
+    if (bad) return bad;
+    return { kind: "cd", to: target.value };
+  }
+  for (let n = 0; n < operands.length; n++) {
+    const entry = operands[n];
+    const isLast = n === operands.length - 1;
+    const need = writeAll || writeLast && isLast ? "write" : "read";
+    const bad = check(entry.token.value, need);
+    if (bad) return bad;
+  }
+  return { kind: "ok" };
+}
+function scanCommand(cmd, roots, cwd = roots.cwd) {
+  if (!cmd.trim()) return { kind: "ok" };
+  const lexed = tokenise(cmd);
+  if (!lexed) return { kind: "unparseable", reason: "unbalanced quotes or unterminated substitution" };
+  for (const body of lexed.subshells) {
+    const inner = scanCommand(body, roots, cwd);
+    if (inner.kind !== "ok") return inner;
+  }
+  let current = [];
+  let cwdNow = cwd;
+  const segments = [];
+  for (const t of lexed.tokens) {
+    if (t.operator && [";", "|", "&", "&&", "||", "\n"].includes(t.operator)) {
+      segments.push(current);
+      current = [];
+      continue;
+    }
+    current.push(t);
+  }
+  segments.push(current);
+  for (const seg of segments) {
+    if (seg.length === 0) continue;
+    const plain = [];
+    for (let i = 0; i < seg.length; i++) {
+      const t = seg[i];
+      if (t.operator && REDIRECTS.has(t.operator)) {
+        const target = seg[i + 1];
+        if (target && !target.operator) {
+          const need = t.operator === "<" || t.operator === "<<<" ? "read" : "write";
+          if (!withinRoots(bare(target.value), { ...roots, cwd: cwdNow }, need)) {
+            return { kind: "escape", path: bare(target.value), need };
+          }
+          i++;
+        }
+        continue;
+      }
+      plain.push(t);
+    }
+    const out = scanSimple(plain, roots, cwdNow);
+    if (out.kind === "cd") {
+      cwdNow = expandPath(out.to, cwdNow);
+      continue;
+    }
+    if (out.kind !== "ok") return out;
+  }
+  return { kind: "ok" };
+}
+
+// ../../packages/edge/src/builtins.ts
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
@@ -2456,7 +2854,7 @@ function isDangerousRm(cmd) {
 }
 function currentBranch(worktreePath) {
   try {
-    return execFileSync3("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: worktreePath }).toString().trim();
+    return execFileSync4("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: worktreePath }).toString().trim();
   } catch {
     return "";
   }
@@ -2475,9 +2873,54 @@ function commandOf(input) {
   }
   return "";
 }
+var PATH_FIELDS = ["file_path", "notebook_path", "path", "filePath", "cwd", "directory"];
+var PATH_WRITE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "apply_patch"]);
+function pathsIn(input) {
+  if (!input || typeof input !== "object") return [];
+  const o = input;
+  const out = [];
+  for (const f of PATH_FIELDS) {
+    if (typeof o[f] === "string" && o[f]) out.push(o[f]);
+  }
+  if (o.changes && typeof o.changes === "object") {
+    out.push(...Object.keys(o.changes));
+  }
+  return out;
+}
+function fsConfineRule(roots) {
+  return {
+    name: "fs_confine",
+    evaluate(event) {
+      if (event.kind !== "action") return null;
+      const deny = (path, need2) => ({
+        verdict: "deny",
+        policy: "fs_confine",
+        reason: `${need2 === "write" ? "write to" : "read of"} "${path}" is outside the run's worktree`
+      });
+      if (SHELL_TOOLS.has(event.tool)) {
+        const result = scanCommand(commandOf(event.input), roots);
+        if (result.kind === "escape") return deny(result.path, result.need);
+        if (result.kind === "unparseable") {
+          return {
+            verdict: "deny",
+            policy: "fs_confine",
+            reason: `shell command could not be parsed for path confinement (${result.reason})`
+          };
+        }
+        return null;
+      }
+      const need = PATH_WRITE_TOOLS.has(event.tool) ? "write" : "read";
+      for (const p of pathsIn(event.input)) {
+        if (!withinRoots(p, roots, need)) return deny(p, need);
+      }
+      return null;
+    }
+  };
+}
 function buildRules(policies, ctx) {
   const rules = [];
   let stageToolCalls = 0;
+  if (ctx.fsRoots && process.env.DAHRK_FS_CONFINE !== "0") rules.push(fsConfineRule(ctx.fsRoots));
   for (const p of policies) {
     if ("read_only" in p && p.read_only) {
       rules.push({
@@ -2592,11 +3035,11 @@ async function startMcpGateway(opts) {
     if (upstream.body) await pipeline(Readable.fromWeb(upstream.body), res);
     else res.end();
   };
-  await new Promise((resolve2) => server.listen(0, "127.0.0.1", resolve2));
+  await new Promise((resolve3) => server.listen(0, "127.0.0.1", resolve3));
   const { port } = server.address();
   return {
     baseUrl: `http://127.0.0.1:${port}`,
-    stop: () => new Promise((resolve2) => server.close(() => resolve2()))
+    stop: () => new Promise((resolve3) => server.close(() => resolve3()))
   };
 }
 
@@ -2639,7 +3082,7 @@ var attemptOf = (jobId) => {
 };
 var digest = (value) => `sha256:${createHash3("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 16)}`;
 function writeScratchState(ref, job, attempt, status) {
-  const statePath = join8(ref.scratchPath, "state.json");
+  const statePath = join10(ref.scratchPath, "state.json");
   let state;
   try {
     state = JSON.parse(readFileSync4(statePath, "utf8"));
@@ -2654,17 +3097,17 @@ function writeIssueContext(ref, issueContext) {
   if (issueContext === void 0) return;
   try {
     mkdirSync6(ref.scratchPath, { recursive: true });
-    writeFileSync5(join8(ref.scratchPath, "issue.md"), issueContext);
+    writeFileSync5(join10(ref.scratchPath, "issue.md"), issueContext);
   } catch {
   }
 }
 function writeAttachedDocuments(ref, docs) {
   if (!docs || docs.length === 0) return;
   try {
-    const dir = join8(ref.scratchPath, "docs");
+    const dir = join10(ref.scratchPath, "docs");
     mkdirSync6(dir, { recursive: true });
     for (const doc of docs) {
-      writeFileSync5(join8(dir, `${attachedDocBasename2(doc)}.md`), doc.content);
+      writeFileSync5(join10(dir, `${attachedDocBasename2(doc)}.md`), doc.content);
     }
   } catch {
   }
@@ -2683,7 +3126,7 @@ function writeGuidance(ref, guidance) {
   if (!guidance || guidance.length === 0) return;
   try {
     mkdirSync6(ref.scratchPath, { recursive: true });
-    writeFileSync5(join8(ref.scratchPath, "guidance.md"), renderGuidanceMarkdown(guidance));
+    writeFileSync5(join10(ref.scratchPath, "guidance.md"), renderGuidanceMarkdown(guidance));
   } catch {
   }
 }
@@ -2693,11 +3136,11 @@ function capContent(raw) {
   return raw.length > ARTIFACT_CAP_BYTES ? raw.slice(0, ARTIFACT_CAP_BYTES) : raw;
 }
 function resolveWorktreeRelativePath(ref, relPath) {
-  if (isAbsolute2(relPath)) return void 0;
-  const root = resolve(ref.worktreePath);
-  const target = resolve(root, relPath);
-  const fromRoot = relative2(root, target);
-  if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${sep2}`) || isAbsolute2(fromRoot)) {
+  if (isAbsolute3(relPath)) return void 0;
+  const root = resolve2(ref.worktreePath);
+  const target = resolve2(root, relPath);
+  const fromRoot = relative3(root, target);
+  if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${sep3}`) || isAbsolute3(fromRoot)) {
     return void 0;
   }
   return target;
@@ -2717,13 +3160,13 @@ function readEmittedArtifact(ref, relPath) {
 }
 function scanScratchOutput(ref, preferRel) {
   try {
-    const names = readdirSync3(join8(ref.worktreePath, SCRATCH_OUTPUT_DIR)).filter(
+    const names = readdirSync3(join10(ref.worktreePath, SCRATCH_OUTPUT_DIR)).filter(
       (n) => n.toLowerCase().endsWith(".md")
     );
     if (names.length === 0) return void 0;
     const preferBase = preferRel?.split("/").pop();
     const pick = preferBase && names.includes(preferBase) ? preferBase : names[0];
-    const raw = readFileSync4(join8(ref.worktreePath, SCRATCH_OUTPUT_DIR, pick), "utf8");
+    const raw = readFileSync4(join10(ref.worktreePath, SCRATCH_OUTPUT_DIR, pick), "utf8");
     if (raw.trim().length === 0) return void 0;
     return { path: `${SCRATCH_OUTPUT_DIR}/${pick}`, content: capContent(raw) };
   } catch {
@@ -2733,7 +3176,7 @@ function scanScratchOutput(ref, preferRel) {
 function scanChangedMarkdown(ref) {
   const git = (args) => {
     try {
-      return execFileSync4("git", ["-C", ref.worktreePath, ...args], { encoding: "utf8" }).split("\n").map((s) => s.trim()).filter(Boolean);
+      return execFileSync5("git", ["-C", ref.worktreePath, ...args], { encoding: "utf8" }).split("\n").map((s) => s.trim()).filter(Boolean);
     } catch {
       return [];
     }
@@ -2743,7 +3186,7 @@ function scanChangedMarkdown(ref) {
   );
   for (const rel of rels) {
     try {
-      const raw = readFileSync4(join8(ref.worktreePath, rel), "utf8");
+      const raw = readFileSync4(join10(ref.worktreePath, rel), "utf8");
       if (raw.trim().length > 0) return { path: rel, content: capContent(raw) };
     } catch {
     }
@@ -2866,9 +3309,9 @@ function createStageRunner(deps) {
               ...job.workspaceRef.credentialToken ? { credentialToken: job.workspaceRef.credentialToken } : {}
             });
           } else {
-            const base = deps.scratchRoot ?? join8(tmpdir2(), "dahrk", "scratch");
-            const worktreePath = join8(base, runId);
-            const scratchPath = join8(worktreePath, ".skakel", "scratch");
+            const base = deps.scratchRoot ?? join10(tmpdir4(), "dahrk", "scratch");
+            const worktreePath = join10(base, runId);
+            const scratchPath = join10(worktreePath, ".skakel", "scratch");
             mkdirSync6(scratchPath, { recursive: true });
             ref = { repoId: "", gitUrl: "", repo: "", baseBranch: "", worktreePath, scratchPath };
             scratchOnly.add(runId);
@@ -2884,7 +3327,7 @@ function createStageRunner(deps) {
           const slash = job.agentConfig.emitArtifact.lastIndexOf("/");
           if (artifactDir && slash > 0) {
             try {
-              mkdirSync6(join8(ref.worktreePath, job.agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
+              mkdirSync6(join10(ref.worktreePath, job.agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
             } catch {
             }
           }
@@ -2912,8 +3355,8 @@ function createStageRunner(deps) {
           if (!sink) return;
           const base = { tenantId: job.tenantId, runId, stageId, attempt };
           try {
-            for (const name of readdirSync3(join8(writer.dir, "blobs"))) {
-              const bytes = readFileSync4(join8(writer.dir, "blobs", name));
+            for (const name of readdirSync3(join10(writer.dir, "blobs"))) {
+              const bytes = readFileSync4(join10(writer.dir, "blobs", name));
               const { url } = await sink.requestBlobUrl({
                 ...base,
                 sha256: name,
@@ -2927,7 +3370,7 @@ function createStageRunner(deps) {
           }
           let archiveKey;
           try {
-            const bytes = readFileSync4(join8(writer.dir, "trace.jsonl"));
+            const bytes = readFileSync4(join10(writer.dir, "trace.jsonl"));
             const sha = createHash3("sha256").update(bytes).digest("hex");
             const { key, url } = await sink.requestBlobUrl({
               ...base,
@@ -3011,7 +3454,11 @@ function createStageRunner(deps) {
         const jobRules = buildRules(job.policies ?? [], {
           worktreePath: ref.worktreePath,
           repoName: job.workspaceRef?.repo ?? "",
-          runToolCalls: counter
+          runToolCalls: counter,
+          // DHK-392: the stage is confined to the run's worktree (plus its scratch dir, the git object
+          // store it depends on, and the toolchain). A node default, not a workflow policy. A run with
+          // no repo still gets a box - just a smaller one, around its scratch dir.
+          fsRoots: computeFsRoots({ worktreePath: ref.worktreePath, scratchPath: ref.scratchPath })
         });
         const rules = [...jobRules, ...deps.rules];
         const entry = evaluatePolicies({ kind: "stage-entry", stageId }, rules);
@@ -3020,6 +3467,7 @@ function createStageRunner(deps) {
           return finish("fail", `${stageId}: denied at stage entry (${entry.policy})`, job.sessionId);
         }
         let denied = false;
+        let escapedUnblocked = false;
         const authorisedActions = [];
         const runtime = agentConfig.runtime;
         const actionKey = (tool3, input) => {
@@ -3062,6 +3510,7 @@ function createStageRunner(deps) {
               if (verdict.verdict === "deny") {
                 streamEvent(writer.append(event));
                 recordDeny(verdict, event.toolUseId);
+                if (verdict.policy === "fs_confine" && runtime !== "claude-code") escapedUnblocked = true;
                 return;
               }
             }
@@ -3124,10 +3573,16 @@ function createStageRunner(deps) {
           if (killTimer) clearTimeout(killTimer);
         }
         let status = timedOut ? "timeout" : result.status;
+        if (status === "ok" && escapedUnblocked) {
+          status = "fail";
+          const msg = `stage reached outside the run's worktree and the ${runtime} runtime could not block it before it ran`;
+          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "fs-confine-escape", message: msg });
+          deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
+        }
         if (status === "ok" && job.hooks && job.hooks.length > 0) {
           for (const cmd of job.hooks) {
             try {
-              execFileSync4("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
+              execFileSync5("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
             } catch (e) {
               status = "fail";
               writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
@@ -3372,12 +3827,12 @@ async function startEdgeNode(opts) {
   const trace = {
     event: (frame) => send({ type: "trace-event", ...frame }),
     finalised: (frame) => send({ type: "trace-finalised", ...frame }),
-    requestBlobUrl: (req) => new Promise((resolve2) => {
+    requestBlobUrl: (req) => new Promise((resolve3) => {
       const reqId = `${req.runId}:${req.stageId}:${req.attempt}:${blobReqCounter++}`;
-      pendingBlob.set(reqId, resolve2);
+      pendingBlob.set(reqId, resolve3);
       send({ type: "blob-put-request", reqId, ...req });
       setTimeout(() => {
-        if (pendingBlob.delete(reqId)) resolve2({ key: "" });
+        if (pendingBlob.delete(reqId)) resolve3({ key: "" });
       }, 3e4).unref?.();
     })
   };
@@ -3440,10 +3895,10 @@ async function startEdgeNode(opts) {
       return;
     }
     if (msg.type === "blob-put-url") {
-      const resolve2 = pendingBlob.get(msg.reqId);
-      if (resolve2) {
+      const resolve3 = pendingBlob.get(msg.reqId);
+      if (resolve3) {
         pendingBlob.delete(msg.reqId);
-        resolve2({ key: msg.key, ...msg.url ? { url: msg.url } : {} });
+        resolve3({ key: msg.key, ...msg.url ? { url: msg.url } : {} });
       }
       return;
     }
@@ -3612,11 +4067,11 @@ async function startEdgeNode(opts) {
     { once: true }
   );
   connect();
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     const t = setInterval(() => {
       if (ws && ws.readyState === WebSocket.OPEN) {
         clearInterval(t);
-        resolve2();
+        resolve3();
       }
     }, 50);
     onFatal = (err) => {
@@ -3634,11 +4089,11 @@ var PROBES = [
   { runtime: "pi", cmd: "pi" }
 ];
 function probe(cmd, timeoutMs) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     execFile(cmd, ["--version"], { timeout: timeoutMs }, (err, stdout) => {
-      if (err) return resolve2(void 0);
+      if (err) return resolve3(void 0);
       const line = stdout.split("\n").map((s) => s.trim()).find(Boolean);
-      resolve2(line ?? "");
+      resolve3(line ?? "");
     });
   });
 }
@@ -3681,7 +4136,7 @@ function probeHub(opts) {
     clientVersion = "0.0.0",
     timeoutMs = 8e3
   } = opts;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let settled = false;
     let opened = false;
     let ws;
@@ -3693,7 +4148,7 @@ function probeHub(opts) {
         ws.terminate();
       } catch {
       }
-      resolve2(result);
+      resolve3(result);
     };
     const timer = setTimeout(
       () => done({ ok: false, reason: "timeout", detail: `no welcome within ${timeoutMs}ms` }),
@@ -4153,8 +4608,8 @@ function usage(bin, command) {
 }
 
 // src/diagnose.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { join as join11 } from "path";
 var BUNDLE_LOG_LINES = 2e3;
 function tailJsonl(raw, n) {
   const records = [];
@@ -4195,7 +4650,7 @@ async function buildBundle(deps) {
   if (deps.exists(deps.crashDir)) {
     for (const name of deps.listDir(deps.crashDir).filter((f) => f.endsWith(".json")).sort()) {
       try {
-        crashes.push(JSON.parse(deps.readFile(join9(deps.crashDir, name))));
+        crashes.push(JSON.parse(deps.readFile(join11(deps.crashDir, name))));
       } catch (e) {
         warnings.push(`could not read crash record ${name} (${e.message})`);
       }
@@ -4254,17 +4709,17 @@ var defaultDiagnoseDeps = (paths, clientVersion, doctor) => ({
   ...doctor ? { doctor } : {},
   readFile: (p) => readFileSync5(p, "utf8"),
   listDir: (p) => readdirSync4(p),
-  exists: (p) => existsSync6(p),
+  exists: (p) => existsSync7(p),
   writeFile: (p, content) => {
-    const dir = join9(p, "..");
-    if (!existsSync6(dir)) mkdirSync7(dir, { recursive: true });
+    const dir = join11(p, "..");
+    if (!existsSync7(dir)) mkdirSync7(dir, { recursive: true });
     writeFileSync6(p, content, { mode: 384 });
   },
   out: (line) => void process.stdout.write(`${line}
 `)
 });
 function defaultBundlePath(cwd, now) {
-  return join9(cwd, `dahrk-diagnose-${now.toISOString().replace(/[:.]/g, "-")}.json`);
+  return join11(cwd, `dahrk-diagnose-${now.toISOString().replace(/[:.]/g, "-")}.json`);
 }
 
 // src/doctor.ts
@@ -4399,8 +4854,8 @@ async function runDoctor(inputs, deps = {}) {
 }
 
 // src/lock.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5 } from "path";
 function parseLock(content) {
   if (!content) return void 0;
   const pid = Number(content.trim());
@@ -4438,7 +4893,7 @@ var defaultLockDeps = (file) => ({
     }
   },
   writeFile: (path, content) => {
-    if (!existsSync7(dirname4(path))) mkdirSync8(dirname4(path), { recursive: true, mode: 448 });
+    if (!existsSync8(dirname5(path))) mkdirSync8(dirname5(path), { recursive: true, mode: 448 });
     writeFileSync7(path, content);
   },
   removeFile: (path) => rmSync6(path, { force: true }),
@@ -4447,7 +4902,7 @@ var defaultLockDeps = (file) => ({
 
 // src/logs.ts
 import { spawn } from "child_process";
-import { copyFileSync, existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync4, truncateSync } from "fs";
+import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync7, statSync as statSync4, truncateSync } from "fs";
 var MAX_LOG_BYTES = 10 * 1024 * 1024;
 function logsCommand(inputs) {
   return [
@@ -4528,7 +4983,7 @@ async function runStructuredLogs(inputs, deps) {
 }
 function rotateIfLarge(file, maxBytes = MAX_LOG_BYTES) {
   try {
-    if (!existsSync8(file) || statSync4(file).size <= maxBytes) return;
+    if (!existsSync9(file) || statSync4(file).size <= maxBytes) return;
     copyFileSync(file, `${file}.1`);
     truncateSync(file, 0);
   } catch {
@@ -4537,13 +4992,13 @@ function rotateIfLarge(file, maxBytes = MAX_LOG_BYTES) {
 var defaultLogsDeps = (files, jsonlFile) => ({
   files,
   jsonlFile,
-  fileExists: (path) => existsSync8(path),
+  fileExists: (path) => existsSync9(path),
   readFile: (path) => readFileSync7(path, "utf8"),
-  run: (argv) => new Promise((resolve2) => {
+  run: (argv) => new Promise((resolve3) => {
     const [cmd, ...args] = argv;
     const child = spawn(cmd, args, { stdio: "inherit" });
-    child.on("error", () => resolve2(1));
-    child.on("close", (code) => resolve2(code ?? 0));
+    child.on("error", () => resolve3(1));
+    child.on("close", (code) => resolve3(code ?? 0));
   }),
   out: (line) => void process.stdout.write(`${line}
 `)
@@ -4551,11 +5006,11 @@ var defaultLogsDeps = (files, jsonlFile) => ({
 
 // src/process-safety.ts
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "fs";
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 function writeCrashRecord(dir, record) {
   try {
     mkdirSync9(dir, { recursive: true, mode: 448 });
-    const file = join10(dir, `${record.at.replace(/[:.]/g, "-")}.json`);
+    const file = join12(dir, `${record.at.replace(/[:.]/g, "-")}.json`);
     writeFileSync8(file, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
     return file;
@@ -4609,11 +5064,11 @@ function installProcessSafetyNet(opts) {
 }
 
 // src/preflight.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { accessSync, constants as fsConstants, existsSync as existsSync9, readdirSync as readdirSync5, statfsSync as statfsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join11 } from "path";
+import { accessSync, constants as fsConstants, existsSync as existsSync10, readdirSync as readdirSync5, statfsSync as statfsSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join13 } from "path";
 var REPORT_BASE_URL = "https://app.dahrk.ai/r";
 var LOW_DISK_BYTES = 512 * 1024 * 1024;
 var PREFLIGHT_STAGES = [
@@ -4742,7 +5197,7 @@ var defaultDeps2 = () => ({
 });
 function commandPresent(cmd) {
   try {
-    execFileSync5("sh", ["-c", `command -v ${cmd}`], { stdio: "ignore" });
+    execFileSync6("sh", ["-c", `command -v ${cmd}`], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -4750,12 +5205,12 @@ function commandPresent(cmd) {
 }
 function sshKeyPresent() {
   try {
-    const dir = join11(homedir2(), ".ssh");
-    if (existsSync9(dir) && readdirSync5(dir).some((f) => f.endsWith(".pub"))) return true;
+    const dir = join13(homedir4(), ".ssh");
+    if (existsSync10(dir) && readdirSync5(dir).some((f) => f.endsWith(".pub"))) return true;
   } catch {
   }
   try {
-    execFileSync5("ssh-add", ["-l"], { stdio: "ignore" });
+    execFileSync6("ssh-add", ["-l"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -4770,12 +5225,12 @@ function writable(dir) {
   }
 }
 function worktreeRoot(env) {
-  return env.DAHRK_WORKTREES_DIR ?? join11(env.DAHRK_STATE_DIR ?? join11(homedir2(), ".dahrk"), "worktrees");
+  return env.DAHRK_WORKTREES_DIR ?? join13(env.DAHRK_STATE_DIR ?? join13(homedir4(), ".dahrk"), "worktrees");
 }
 function nearestExisting(dir) {
   let cur = dir;
-  while (!existsSync9(cur)) {
-    const parent = join11(cur, "..");
+  while (!existsSync10(cur)) {
+    const parent = join13(cur, "..");
     if (parent === cur) break;
     cur = parent;
   }
@@ -4790,7 +5245,7 @@ function freeDiskBytes(dir) {
   }
 }
 function probeRepo(repoPath) {
-  const git = (args) => execFileSync5("git", ["-C", repoPath, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  const git = (args) => execFileSync6("git", ["-C", repoPath, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   try {
     if (git(["rev-parse", "--is-inside-work-tree"]) !== "true") {
       return { path: repoPath, isGitRepo: false, headResolves: false, detail: "not inside a work tree" };
@@ -4825,49 +5280,49 @@ function gatherHostFacts(repoPath) {
 }
 
 // src/service.ts
-import { execFileSync as execFileSync6 } from "child_process";
-import { chmodSync as chmodSync2, existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync9, realpathSync as realpathSync2, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
-import { homedir as homedir4, platform as osPlatform3, userInfo } from "os";
-import { join as join13 } from "path";
+import { execFileSync as execFileSync7 } from "child_process";
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, realpathSync as realpathSync3, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir6, platform as osPlatform3, userInfo } from "os";
+import { join as join15 } from "path";
 
 // src/state.ts
-import { chmodSync, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join12 } from "path";
+import { chmodSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join14 } from "path";
 var STRING_FIELDS = ["nodeId", "enrolToken", "name", "tenantId", "updateCheckedAt", "updateLatest"];
 var isDesired = (v) => v === "running" || v === "stopped";
 var FILE_MODE = 384;
 var DIR_MODE = 448;
 function stateDir(env) {
-  return env.DAHRK_STATE_DIR ?? join12(homedir3(), ".dahrk");
+  return env.DAHRK_STATE_DIR ?? join14(homedir5(), ".dahrk");
 }
 function legacyStateDir(env) {
-  return env.DAHRK_STATE_DIR ? void 0 : join12(homedir3(), ".skakel");
+  return env.DAHRK_STATE_DIR ? void 0 : join14(homedir5(), ".skakel");
 }
 function stateFile(env) {
-  return join12(stateDir(env), "node.json");
+  return join14(stateDir(env), "node.json");
 }
 function logDir(env) {
-  return join12(stateDir(env), "logs");
+  return join14(stateDir(env), "logs");
 }
 function logFiles(env) {
   const dir = logDir(env);
-  return { out: join12(dir, "node.out.log"), err: join12(dir, "node.err.log") };
+  return { out: join14(dir, "node.out.log"), err: join14(dir, "node.err.log") };
 }
 function jsonlLogFile(env) {
-  return join12(logDir(env), "node.jsonl");
+  return join14(logDir(env), "node.jsonl");
 }
 function crashDir(env) {
-  return join12(logDir(env), "crashes");
+  return join14(logDir(env), "crashes");
 }
 function lockFile(env) {
-  return join12(stateDir(env), "node.pid");
+  return join14(stateDir(env), "node.pid");
 }
 function setDesired(env, desired) {
   writeState(env, { desired });
 }
 function readState(file) {
-  if (!existsSync10(file)) return {};
+  if (!existsSync11(file)) return {};
   try {
     const parsed = JSON.parse(readFileSync8(file, "utf8"));
     const state = {};
@@ -4968,9 +5423,9 @@ ${envEntries}
   <key>ThrottleInterval</key>
   <integer>10</integer>
   <key>StandardOutPath</key>
-  <string>${xmlEscape(join13(inputs.logDir, "node.out.log"))}</string>
+  <string>${xmlEscape(join15(inputs.logDir, "node.out.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xmlEscape(join13(inputs.logDir, "node.err.log"))}</string>
+  <string>${xmlEscape(join15(inputs.logDir, "node.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -4993,8 +5448,8 @@ Type=simple
 ExecStart=${exec}
 ${envLines}
 WorkingDirectory=${inputs.homeDir}
-StandardOutput=append:${join13(inputs.logDir, "node.out.log")}
-StandardError=append:${join13(inputs.logDir, "node.err.log")}
+StandardOutput=append:${join15(inputs.logDir, "node.out.log")}
+StandardError=append:${join15(inputs.logDir, "node.err.log")}
 Restart=on-failure
 RestartSec=3
 RestartPreventExitStatus=78
@@ -5005,7 +5460,7 @@ WantedBy=default.target
 }
 function buildPlan(inputs) {
   if (inputs.manager === "launchd") {
-    const filePath2 = join13(inputs.homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    const filePath2 = join15(inputs.homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     return {
       manager: "launchd",
       label: LAUNCHD_LABEL,
@@ -5022,7 +5477,7 @@ function buildPlan(inputs) {
       logHint: "dahrk logs -f"
     };
   }
-  const filePath = join13(inputs.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+  const filePath = join15(inputs.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
   const user = userInfo().username;
   return {
     manager: "systemd",
@@ -5052,7 +5507,7 @@ function unitIsCurrent(plan, onDisk) {
   return onDisk === plan.content;
 }
 function unitPath(manager, homeDir) {
-  return manager === "launchd" ? join13(homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`) : join13(homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+  return manager === "launchd" ? join15(homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`) : join15(homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
 }
 function statusCommand(manager) {
   return manager === "launchd" ? ["launchctl", "list", LAUNCHD_LABEL] : ["systemctl", "--user", "show", SYSTEMD_UNIT, "-p", "ActiveState", "-p", "MainPID"];
@@ -5261,7 +5716,7 @@ function dirOf(path) {
 function resolveScriptPath() {
   const argv1 = process.argv[1] ?? "";
   try {
-    return realpathSync2(argv1);
+    return realpathSync3(argv1);
   } catch {
     return argv1;
   }
@@ -5275,14 +5730,14 @@ function stableNodeBin(execPath, realpath) {
 }
 var realpathOrUndefined = (p) => {
   try {
-    return realpathSync2(p);
+    return realpathSync3(p);
   } catch {
     return void 0;
   }
 };
 var defaultDeps3 = () => ({
   platform: osPlatform3(),
-  homeDir: homedir4(),
+  homeDir: homedir6(),
   // Not `process.execPath` raw: that is the versioned Homebrew Cellar path, which the next
   // `brew upgrade node` deletes out from under the unit. See `stableNodeBin`.
   nodeBin: stableNodeBin(process.execPath, realpathOrUndefined),
@@ -5309,11 +5764,11 @@ var defaultDeps3 = () => ({
     }
   },
   removeFile: (path) => rmSync7(path, { force: true }),
-  fileExists: (path) => existsSync11(path),
+  fileExists: (path) => existsSync12(path),
   run: (argv) => {
     const [cmd, ...args] = argv;
     try {
-      execFileSync6(cmd, args, { stdio: "inherit" });
+      execFileSync7(cmd, args, { stdio: "inherit" });
       return 0;
     } catch (e) {
       const status = e.status;
@@ -5323,7 +5778,7 @@ var defaultDeps3 = () => ({
   capture: (argv) => {
     const [cmd, ...args] = argv;
     try {
-      const stdout = execFileSync6(cmd, args, {
+      const stdout = execFileSync7(cmd, args, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -5338,8 +5793,8 @@ var defaultDeps3 = () => ({
 });
 
 // src/update.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { realpathSync as realpathSync3 } from "fs";
+import { execFileSync as execFileSync8 } from "child_process";
+import { realpathSync as realpathSync4 } from "fs";
 var LATEST_URL = "https://registry.npmjs.org/dahrk-node/latest";
 var CHANNEL_COMMANDS = {
   npm: "npm install -g dahrk-node@latest",
@@ -5360,7 +5815,7 @@ function detectChannel(binPath) {
   if (!binPath) return "unknown";
   let resolved = binPath;
   try {
-    resolved = realpathSync3(binPath);
+    resolved = realpathSync4(binPath);
   } catch {
   }
   if (/[\\/]node_modules[\\/]dahrk-node[\\/]/.test(resolved)) return "npm";
@@ -5448,7 +5903,7 @@ async function fetchLatestVersion(signal) {
 function spawnUpgrade(argv) {
   const [cmd, ...args] = argv;
   try {
-    execFileSync7(cmd, args, { stdio: "inherit" });
+    execFileSync8(cmd, args, { stdio: "inherit" });
     return 0;
   } catch (e) {
     const status = e.status;
@@ -5590,7 +6045,7 @@ async function runStatus(inputs, deps) {
 }
 
 // src/main.ts
-var CLIENT_VERSION = "0.1.10";
+var CLIENT_VERSION = "0.1.11";
 var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
 var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var RUNTIMES = ["claude-code", "codex", "pi"];
@@ -5602,7 +6057,7 @@ function resolveNodeId(env, opts = {}) {
   if (existing) return existing;
   const legacy = legacyStateDir(env);
   if (legacy) {
-    const legacyId = readState(join14(legacy, "node.json")).nodeId;
+    const legacyId = readState(join16(legacy, "node.json")).nodeId;
     if (legacyId) return legacyId;
   }
   const nodeId = randomUUID3();
@@ -5783,15 +6238,15 @@ function scheduleUpdateChecks(env) {
 function statusDeps(env) {
   return {
     platform: osPlatform4(),
-    homeDir: homedir5(),
+    homeDir: homedir7(),
     env,
     binPath: process.argv[1],
     detectRuntimes: () => resolveRuntimes(env),
-    fileExists: (path) => existsSync12(path),
+    fileExists: (path) => existsSync13(path),
     capture: (argv) => {
       const [cmd, ...args] = argv;
       try {
-        const stdout = execFileSync8(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const stdout = execFileSync9(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
         return { code: 0, stdout };
       } catch (e) {
         const status = e.status;
@@ -5932,7 +6387,7 @@ var invokedAsEntrypoint = (() => {
   const argv1 = process.argv[1];
   if (!argv1) return false;
   try {
-    return pathToFileURL(realpathSync4(argv1)).href === import.meta.url;
+    return pathToFileURL(realpathSync5(argv1)).href === import.meta.url;
   } catch {
     return false;
   }