dorkos 0.127.0 → 0.127.1

package/dist/bin/cli.js

@@ -345,10 +345,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema3) {
   return mergeDefs(schema3._zod.def);
 }
-function getElementAtPath(obj, path73) {
-  if (!path73)
+function getElementAtPath(obj, path74) {
+  if (!path74)
     return obj;
-  return path73.reduce((acc, key) => acc?.[key], obj);
+  return path74.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -607,11 +607,11 @@ function explicitlyAborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path73, issues) {
+function prefixIssues(path74, issues) {
   return issues.map((iss) => {
     var _a7;
     (_a7 = iss).path ?? (_a7.path = []);
-    iss.path.unshift(path73);
+    iss.path.unshift(path74);
     return iss;
   });
 }
@@ -1144,16 +1144,16 @@ function flattenError(error63, mapper = (issue2) => issue2.message) {
 }
 function formatError(error63, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error64, path73 = []) => {
+  const processError = (error64, path74 = []) => {
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path73, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path74, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else {
-        const fullpath = [...path73, ...issue2.path];
+        const fullpath = [...path74, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1192,17 +1192,17 @@ function formatError(error63, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error63, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error64, path73 = []) => {
+  const processError = (error64, path74 = []) => {
     var _a7;
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path73, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path74, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path73, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path74, ...issue2.path]);
       } else {
-        const fullpath = [...path73, ...issue2.path];
+        const fullpath = [...path74, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -1241,8 +1241,8 @@ function treeifyError(error63, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path73 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path73) {
+  const path74 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path74) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19274,13 +19274,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path73 = ref.slice(1).split("/").filter(Boolean);
-  if (path73.length === 0) {
+  const path74 = ref.slice(1).split("/").filter(Boolean);
+  if (path74.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path73[0] === defsKey) {
-    const key = path73[1] === void 0 ? void 0 : decodeJSONPointerSegment(path73[1]);
+  if (path74[0] === defsKey) {
+    const key = path74[1] === void 0 ? void 0 : decodeJSONPointerSegment(path74[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -26844,23 +26844,22 @@ var init_config_schema = __esm({
 });
 
 // ../shared/src/links.ts
-function join(base, path73) {
-  if (path73 === "" || /^[/?#]/.test(path73)) return `${base}${path73}`;
-  return `${base}/${path73}`;
+function join(base, path74) {
+  if (path74 === "" || /^[/?#]/.test(path74)) return `${base}${path74}`;
+  return `${base}/${path74}`;
 }
-function siteUrl(path73 = "") {
-  return join(links.site, path73);
+function siteUrl(path74 = "") {
+  return join(links.site, path74);
 }
-function docsUrl(path73 = "") {
-  return join(links.docs, path73);
+function docsUrl(path74 = "") {
+  return join(links.docs, path74);
 }
-function repoUrl(path73 = "") {
-  return join(links.repo, path73);
+function repoUrl(path74 = "") {
+  return join(links.repo, path74);
 }
 var GITHUB_ORG, links;
 var init_links = __esm({
   "../shared/src/links.ts"() {
-    "use strict";
     GITHUB_ORG = "dork-labs";
     links = {
       /** The public origin of the marketing site, the docs and DorkOS Cloud. */
@@ -27289,7 +27288,7 @@ import path3 from "path";
 import { fileURLToPath } from "url";
 function resolveVersion() {
   if (env2.DORKOS_VERSION_OVERRIDE) return env2.DORKOS_VERSION_OVERRIDE;
-  if (true) return "0.127.0";
+  if (true) return "0.127.1";
   const pkgPath = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "../../package.json");
   return JSON.parse(readFileSync(pkgPath, "utf-8")).version;
 }
@@ -27492,8 +27491,8 @@ and your settings stay in the file you renamed.`;
 });
 
 // ../../apps/server/src/services/core/config/browser-setting.ts
-function browserSettingRefusal(path73, value) {
-  const enabled3 = path73 === "browser.enabled" ? value : path73 === "browser" && value !== null && typeof value === "object" ? value.enabled : void 0;
+function browserSettingRefusal(path74, value) {
+  const enabled3 = path74 === "browser.enabled" ? value : path74 === "browser" && value !== null && typeof value === "object" ? value.enabled : void 0;
   return enabled3 === true ? BROWSER_SETTING_UNAVAILABLE : null;
 }
 var BROWSER_SETTING_UNAVAILABLE;
@@ -27525,9 +27524,9 @@ function hubPinnedRead(key, value) {
   }
   return value;
 }
-function hubSettingRefusal(path73, value) {
+function hubSettingRefusal(path74, value) {
   if (currentServerRole() !== "hub") return null;
-  const enabled3 = path73 === "auth.enabled" ? value : path73 === "auth" && value !== null && typeof value === "object" ? value.enabled : true;
+  const enabled3 = path74 === "auth.enabled" ? value : path74 === "auth" && value !== null && typeof value === "object" ? value.enabled : true;
   return enabled3 === false ? HUB_LOGIN_ALWAYS_ON : null;
 }
 var HUB_LOGIN_ALWAYS_ON;
@@ -27607,9 +27606,9 @@ var init_trusted_carryovers = __esm({
 });
 
 // ../../apps/server/src/services/core/safe-defaults/protected-state.ts
-function readPath(root, path73) {
+function readPath(root, path74) {
   let cursor = root;
-  for (const part of path73.split(".")) {
+  for (const part of path74.split(".")) {
     if (cursor === null || typeof cursor !== "object") return void 0;
     cursor = cursor[part];
   }
@@ -27621,8 +27620,8 @@ function sectionSchemaAccepts(section, draft) {
   if (!schema3) return false;
   return schema3.safeParse(draft).success;
 }
-function writePath(root, path73, value) {
-  const parts = path73.split(".");
+function writePath(root, path74, value) {
+  const parts = path74.split(".");
   const leaf = parts.pop();
   if (leaf === void 0) return;
   let cursor = root;
@@ -27755,13 +27754,13 @@ function applyProtectedState(store, salvaged) {
     sections.set("telemetry", { ...section("telemetry"), ...salvaged.telemetry });
     label("telemetry", "telemetry (your consent choice)");
   }
-  for (const [path73, value] of Object.entries(salvaged.leaves)) {
-    const [top, ...rest] = path73.split(".");
+  for (const [path74, value] of Object.entries(salvaged.leaves)) {
+    const [top, ...rest] = path74.split(".");
     if (top === void 0) continue;
     const draft = section(top);
     if (rest.length === 0) continue;
     writePath(draft, rest.join("."), value);
-    label(top, path73);
+    label(top, path74);
   }
   const restored = [];
   for (const [name2, value] of sections) {
@@ -27787,9 +27786,9 @@ function restoreProtectedState(store, stored, context2) {
   if (restored.length > 0) {
     logger.warn(`[Config] ${context2}: kept your safer settings \u2014 ${restored.join(", ")}`);
   }
-  for (const { path: path73, reason } of salvaged.dropped) {
+  for (const { path: path74, reason } of salvaged.dropped) {
     logger.warn(
-      `[Config] Could not keep your ${path73} setting: ${reason}. It is back at the default.`
+      `[Config] Could not keep your ${path74} setting: ${reason}. It is back at the default.`
     );
   }
 }
@@ -28140,16 +28139,16 @@ function processSegment(segment, parts) {
   }
   return true;
 }
-function parsePath(path73) {
-  if (typeof path73 !== "string") {
-    throw new TypeError(`Expected a string, got ${typeof path73}`);
+function parsePath(path74) {
+  if (typeof path74 !== "string") {
+    throw new TypeError(`Expected a string, got ${typeof path74}`);
   }
   const parts = [];
   let currentSegment = "";
   let currentPart = "start";
   let isEscaping = false;
   let position = 0;
-  for (const character of path73) {
+  for (const character of path74) {
     position++;
     if (isEscaping) {
       currentSegment += character;
@@ -28259,13 +28258,13 @@ function parsePath(path73) {
   }
   return parts;
 }
-function normalizePath(path73) {
-  if (typeof path73 === "string") {
-    return parsePath(path73);
+function normalizePath(path74) {
+  if (typeof path74 === "string") {
+    return parsePath(path74);
   }
-  if (Array.isArray(path73)) {
+  if (Array.isArray(path74)) {
     const normalized = [];
-    for (const [index2, segment] of path73.entries()) {
+    for (const [index2, segment] of path74.entries()) {
       if (typeof segment !== "string" && typeof segment !== "number") {
         throw new TypeError(`Expected a string or number for path segment at index ${index2}, got ${typeof segment}`);
       }
@@ -28285,11 +28284,11 @@ function normalizePath(path73) {
   }
   return [];
 }
-function getProperty(object2, path73, value) {
-  if (!isObject2(object2) || typeof path73 !== "string" && !Array.isArray(path73)) {
+function getProperty(object2, path74, value) {
+  if (!isObject2(object2) || typeof path74 !== "string" && !Array.isArray(path74)) {
     return value === void 0 ? object2 : value;
   }
-  const pathArray = normalizePath(path73);
+  const pathArray = normalizePath(path74);
   if (pathArray.length === 0) {
     return value;
   }
@@ -28305,12 +28304,12 @@ function getProperty(object2, path73, value) {
   }
   return object2 === void 0 ? value : object2;
 }
-function setProperty(object2, path73, value) {
-  if (!isObject2(object2) || typeof path73 !== "string" && !Array.isArray(path73)) {
+function setProperty(object2, path74, value) {
+  if (!isObject2(object2) || typeof path74 !== "string" && !Array.isArray(path74)) {
     return object2;
   }
   const root = object2;
-  const pathArray = normalizePath(path73);
+  const pathArray = normalizePath(path74);
   if (pathArray.length === 0) {
     return object2;
   }
@@ -28327,11 +28326,11 @@ function setProperty(object2, path73, value) {
   }
   return root;
 }
-function deleteProperty(object2, path73) {
-  if (!isObject2(object2) || typeof path73 !== "string" && !Array.isArray(path73)) {
+function deleteProperty(object2, path74) {
+  if (!isObject2(object2) || typeof path74 !== "string" && !Array.isArray(path74)) {
     return false;
   }
-  const pathArray = normalizePath(path73);
+  const pathArray = normalizePath(path74);
   if (pathArray.length === 0) {
     return false;
   }
@@ -28351,11 +28350,11 @@ function deleteProperty(object2, path73) {
     }
   }
 }
-function hasProperty(object2, path73) {
-  if (!isObject2(object2) || typeof path73 !== "string" && !Array.isArray(path73)) {
+function hasProperty(object2, path74) {
+  if (!isObject2(object2) || typeof path74 !== "string" && !Array.isArray(path74)) {
     return false;
   }
-  const pathArray = normalizePath(path73);
+  const pathArray = normalizePath(path74);
   if (pathArray.length === 0) {
     return false;
   }
@@ -32174,8 +32173,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path73) {
-      let input4 = path73;
+    function removeDotSegments(path74) {
+      let input4 = path74;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -32584,8 +32583,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path73 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path73 && path73 !== "/" ? path73 : void 0;
+        const path74 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path74 && path74 !== "/" ? path74 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -36922,12 +36921,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name2}"`);
       return f3;
     };
-    function addFormats(ajv, list, fs42, exportName) {
+    function addFormats(ajv, list, fs43, exportName) {
       var _a7;
       var _b;
       (_a7 = (_b = ajv.opts.code).formats) !== null && _a7 !== void 0 ? _a7 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f3 of list)
-        ajv.addFormat(f3, fs42[f3]);
+        ajv.addFormat(f3, fs43[f3]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -40144,22 +40143,22 @@ function withPath(root, segments, value) {
   if (!isPlainObject4(root)) return root;
   return { ...root, [head]: withPath(root[head], rest, value) };
 }
-function leavesUnder(path73, policy2) {
-  const section = path73.split(".")[0];
+function leavesUnder(path74, policy2) {
+  const section = path74.split(".")[0];
   const candidates = policy2.bySection.get(section);
   if (candidates === void 0) return NO_RELAXED;
-  if (path73 === section) return candidates;
-  return candidates.filter((leaf) => leaf.path === path73 || leaf.path.startsWith(`${path73}.`));
+  if (path74 === section) return candidates;
+  return candidates.filter((leaf) => leaf.path === path74 || leaf.path.startsWith(`${path74}.`));
 }
-function relativeSegments(path73, leafPath) {
-  return leafPath === path73 ? [] : leafPath.slice(path73.length + 1).split(".");
+function relativeSegments(path74, leafPath) {
+  return leafPath === path74 ? [] : leafPath.slice(path74.length + 1).split(".");
 }
-function repairWidenedLeaves(path73, value, policy2) {
-  const leaves = leavesUnder(path73, policy2);
+function repairWidenedLeaves(path74, value, policy2) {
+  const leaves = leavesUnder(path74, policy2);
   let repaired = value;
   let skewed;
   for (const leaf of leaves) {
-    const relative12 = relativeSegments(path73, leaf.path);
+    const relative12 = relativeSegments(path74, leaf.path);
     const stored = relative12.length === 0 ? value : valueAt(value, relative12);
     if (stored === MISSING) continue;
     if (stored === leaf.fallback) continue;
@@ -45008,6 +45007,11 @@ var init_yaml_boolean = __esm({
 });
 
 // ../skills/src/schedule-schema.ts
+function isProjectRelativePath(value) {
+  if (value.startsWith("/") || value.startsWith("\\") || value.startsWith("~")) return false;
+  if (/^[A-Za-z]:/.test(value)) return false;
+  return !value.split(/[\\/]/).includes("..");
+}
 function isInvalidSchedule(field) {
   return field !== void 0 && "invalid" in field;
 }
@@ -45196,7 +45200,37 @@ var init_schedule_schema = __esm({
        * accounts are the machine's, and an id nobody registered falls through the
        * ladder at run time with a warning rather than making the file unreadable.
        */
-      account: external_exports.string().min(1).optional().catch(void 0)
+      account: external_exports.string().min(1).optional().catch(void 0),
+      /**
+       * Where this schedule belongs (DOR-3376). Absent means where its file is,
+       * which is how every schedule worked before this key.
+       *
+       * `project`: the schedule only makes sense inside a project. From a global
+       * package (`~/.dork/skills`), DorkOS never lists it as a global schedule and
+       * never asks to approve it there; each registered project gets its own copy,
+       * switched off, that runs in that project's folder. From a project's own
+       * skills, it behaves exactly as if the key were absent.
+       *
+       * **An enum with one value, and an unknown value is an error rather than a
+       * fallback.** More values may come later; a file naming one this build does
+       * not know must not quietly run as a global schedule, so the block parks with
+       * a complaint instead.
+       */
+      scope: external_exports.enum(["project"]).optional(),
+      /**
+       * With `scope: project` from a global package: the file whose presence says
+       * a project uses the package, as a path relative to the project's root
+       * (DOR-3376). Only a project holding it gets a copy, and with no
+       * `projectFile` no project does: when DorkOS cannot tell, it makes none.
+       *
+       * Relative and inside the project, or the block is unreadable and parks
+       * with a complaint: an absolute path, a `~`, or any `..` segment is refused
+       * here, and one that resolves outside the project (a symlink pointing out)
+       * reads as missing where it is checked.
+       */
+      projectFile: external_exports.string().min(1).refine(isProjectRelativePath, {
+        message: "must be a path inside the project, like .agents/flow/config.json"
+      }).optional()
     });
   }
 });
@@ -46046,16 +46080,16 @@ function resolveRelativePath(source, context2) {
     throw new ResolvePluginSourceError('Relative paths must not contain ".."');
   }
   const startsWithDotSlash = source.startsWith("./");
-  let path73;
+  let path74;
   if (startsWithDotSlash) {
-    path73 = stripLeadingDotSlash(source);
+    path74 = stripLeadingDotSlash(source);
   } else {
     const pluginRoot = normalizePluginRoot(context2.pluginRoot);
-    path73 = pluginRoot ? `${pluginRoot}/${source}` : source;
+    path74 = pluginRoot ? `${pluginRoot}/${source}` : source;
   }
   return {
     type: "relative-path",
-    path: path73,
+    path: path74,
     marketplaceRoot: context2.marketplaceRoot
   };
 }
@@ -50075,7 +50109,6 @@ function parseSkillFile(filePath, content, schema3, options) {
 }
 var init_parser = __esm({
   "../skills/src/parser.ts"() {
-    "use strict";
     init_constants7();
     init_frontmatter();
   }
@@ -51546,11 +51579,11 @@ var require_dist2 = __commonJS({
         return schema3;
       }
       generatePath(route) {
-        const { method, path: path73, request, responses } = route, pathItemConfig = __rest(route, ["method", "path", "request", "responses"]);
+        const { method, path: path74, request, responses } = route, pathItemConfig = __rest(route, ["method", "path", "request", "responses"]);
         const generatedResponses = mapValues(responses, (response) => {
           return this.getResponse(response);
         });
-        const parameters = enhanceMissingParametersError(() => this.getParameters(request), { route: `${method} ${path73}` });
+        const parameters = enhanceMissingParametersError(() => this.getParameters(request), { route: `${method} ${path74}` });
         const requestBody = this.getRequestBody(request === null || request === void 0 ? void 0 : request.body);
         const routeDoc = {
           [method]: Object.assign(Object.assign(Object.assign(Object.assign({}, pathItemConfig), parameters.length > 0 ? {
@@ -52017,10 +52050,10 @@ var init_canvas_channel_schemas = __esm({
         });
     });
     CanvasChannelPointerSchema = external_exports.string().max(4096).refine(
-      (path73) => {
-        if (path73 === "") return true;
-        if (!path73.startsWith("/")) return false;
-        return path73.slice(1).split("/").every(
+      (path74) => {
+        if (path74 === "") return true;
+        if (!path74.startsWith("/")) return false;
+        return path74.slice(1).split("/").every(
           (segment) => !/~(?![01])/u.test(segment) && !unsafeKeys.has(segment.replaceAll("~1", "/").replaceAll("~0", "~"))
         );
       },
@@ -54081,7 +54114,6 @@ var init_capabilities = __esm({
 var PROJECT_NAME_PATTERN, ProjectRefSchema, ProjectInfoSchema, ProjectListResponseSchema, ProjectResolveQuerySchema, ProjectResolveResponseSchema, AccountEligibilityRowSchema, AccountEligibilityQuerySchema, AccountEligibilityResponseSchema, ProjectAccountsRequestSchema, ProjectWithoutCreditsRequestSchema, OnlyProjectsRequestSchema, OnlyProjectsResponseSchema, NoAutoMoveSchema;
 var init_project_schemas = __esm({
   "../shared/src/project-schemas.ts"() {
-    "use strict";
     init_zod();
     init_zod_openapi();
     extendZodWithOpenApiOnce();
@@ -57879,6 +57911,15 @@ var init_schemas4 = __esm({
       packageOwned: external_exports.enum(["record", "legacy"]).nullable().default(null).openapi({
         description: "Whether an installed package owns this schedule's file: 'record' (the package lists it), 'legacy' (installed before DorkOS kept file lists), or null (the person's own)."
       }),
+      /**
+       * Whether this is one project's copy of a global schedule marked
+       * `scope: project` (DOR-3376). Its switch and timing belong to this project
+       * alone; what it does is the shared file's, which DorkOS never rewrites for
+       * one project. Absent reads as false.
+       */
+      projectOnly: external_exports.boolean().optional().openapi({
+        description: "True when this is one project's copy of a global schedule that only runs inside a project. Its switch and timing are this project's; its file is shared. Absent means false."
+      }),
       /**
        * What changed since this schedule was last approved, for a schedule
        * waiting again (DOR-2323): each part of the approved work that differs,
@@ -59599,9 +59640,9 @@ function substitutePlaceholders(value) {
   }
   return value;
 }
-function getValueAtPath(value, path73) {
+function getValueAtPath(value, path74) {
   let current3 = value;
-  for (const segment of path73) {
+  for (const segment of path74) {
     if (current3 === null || typeof current3 !== "object") return void 0;
     current3 = current3[segment];
   }
@@ -59630,12 +59671,12 @@ var init_ui_template = __esm({
         const result2 = WidgetDocumentSchema.safeParse(substitutePlaceholders(value));
         if (result2.success) return;
         for (const issue2 of result2.error.issues) {
-          const path73 = issue2.path.filter(
+          const path74 = issue2.path.filter(
             (segment) => segment !== void 0 && typeof segment !== "symbol"
           );
-          const original = getValueAtPath(value, path73);
-          const message2 = typeof original === "string" && WHOLE_PLACEHOLDER_PATTERN.test(original) ? `Placeholder "${original}" is not allowed in field "${path73.join(".")}" \u2014 placeholders may only fill free-form string fields, not number or enum fields` : issue2.message;
-          ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path73, message: message2 });
+          const original = getValueAtPath(value, path74);
+          const message2 = typeof original === "string" && WHOLE_PLACEHOLDER_PATTERN.test(original) ? `Placeholder "${original}" is not allowed in field "${path74.join(".")}" \u2014 placeholders may only fill free-form string fields, not number or enum fields` : issue2.message;
+          ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path74, message: message2 });
         }
       }).transform((value) => value)
     });
@@ -62733,7 +62774,7 @@ var init_context = __esm({
     init_utils();
     init_cookies();
     init_validator2();
-    createInternalContext = async (context2, { options, path: path73 }) => {
+    createInternalContext = async (context2, { options, path: path74 }) => {
       const headers = new Headers();
       let responseStatus = void 0;
       const { data, error: error63 } = await runValidation(options, context2);
@@ -62745,7 +62786,7 @@ var init_context = __esm({
         ...context2,
         body: data.body,
         query: data.query,
-        path: context2.path || path73 || "virtual:",
+        path: context2.path || path74 || "virtual:",
         context: "context" in context2 && context2.context ? context2.context : {},
         returned: void 0,
         headers: context2?.headers,
@@ -62972,16 +63013,16 @@ var init_to_response = __esm({
 
 // ../../node_modules/.pnpm/better-call@1.4.0_zod@4.6.7/node_modules/better-call/dist/endpoint.mjs
 function createEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {
-  const path73 = typeof pathOrOptions === "string" ? pathOrOptions : void 0;
+  const path74 = typeof pathOrOptions === "string" ? pathOrOptions : void 0;
   const options = typeof handlerOrOptions === "object" ? handlerOrOptions : pathOrOptions;
   const handler = typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
   if ((options.method === "GET" || options.method === "HEAD") && options.body) throw new BetterCallError("Body is not allowed with GET or HEAD methods");
-  if (path73 && /\/{2,}/.test(path73)) throw new BetterCallError("Path cannot contain consecutive slashes");
+  if (path74 && /\/{2,}/.test(path74)) throw new BetterCallError("Path cannot contain consecutive slashes");
   const internalHandler = async (...inputCtx) => {
     const context2 = inputCtx[0] || {};
     const { data: internalContext, error: validationError } = await tryCatch(createInternalContext(context2, {
       options,
-      path: path73
+      path: path74
     }));
     if (validationError) {
       if (!(validationError instanceof ValidationError)) throw validationError;
@@ -63020,7 +63061,7 @@ function createEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {
     } : response;
   };
   internalHandler.options = options;
-  internalHandler.path = path73;
+  internalHandler.path = path74;
   return internalHandler;
 }
 function combineMiddleware(local, configured) {
@@ -63035,8 +63076,8 @@ var init_endpoint = __esm({
     createEndpoint.create = (opts) => {
       function createConfiguredEndpoint(...args) {
         if (args.length === 3) {
-          const [path73, options2, handler2] = args;
-          return createEndpoint(path73, {
+          const [path74, options2, handler2] = args;
+          return createEndpoint(path74, {
             ...options2,
             use: combineMiddleware(options2.use, opts?.use)
           }, handler2);
@@ -63306,39 +63347,39 @@ function createRouter() {
     static: new NullProtoObj()
   };
 }
-function scanFirstGroup(path73) {
+function scanFirstGroup(path74) {
   let i2 = 0;
   let depth = 0;
-  for (; i2 < path73.length; i2++) {
-    const c3 = path73.charCodeAt(i2);
+  for (; i2 < path74.length; i2++) {
+    const c3 = path74.charCodeAt(i2);
     if (c3 === 92) i2++;
     else if (c3 === 40) depth++;
     else if (c3 === 41 && depth > 0) depth--;
     else if (c3 === 123 && depth === 0) break;
   }
-  if (i2 >= path73.length) return;
+  if (i2 >= path74.length) return;
   let j = i2 + 1;
   depth = 0;
-  for (; j < path73.length; j++) {
-    const c3 = path73.charCodeAt(j);
+  for (; j < path74.length; j++) {
+    const c3 = path74.charCodeAt(j);
     if (c3 === 92) j++;
     else if (c3 === 40) depth++;
     else if (c3 === 41 && depth > 0) depth--;
     else if (c3 === 125 && depth === 0) break;
   }
-  if (j >= path73.length) return;
-  const mod = path73[j + 1];
+  if (j >= path74.length) return;
+  const mod = path74[j + 1];
   const hasMod = mod === "?" || mod === "+" || mod === "*";
   return [
-    path73.slice(0, i2),
-    path73.slice(i2 + 1, j),
-    path73.slice(j + (hasMod ? 2 : 1)),
+    path74.slice(0, i2),
+    path74.slice(i2 + 1, j),
+    path74.slice(j + (hasMod ? 2 : 1)),
     hasMod ? mod : void 0
   ];
 }
-function expandGroupDelimiters(path73) {
-  if (!path73.includes("{")) return;
-  const group = scanFirstGroup(path73);
+function expandGroupDelimiters(path74) {
+  if (!path74.includes("{")) return;
+  const group = scanFirstGroup(path74);
   if (!group) return;
   const [pre, body, suf, mod] = group;
   if (!mod) return [pre + body + suf];
@@ -63406,9 +63447,9 @@ function replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGr
   }
   return [replaced, nextIndex];
 }
-function encodeEscapes(path73) {
-  if (!path73.includes("\\")) return path73;
-  return path73.replace(/\\([:(){}])/g, (_3, c3) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c3)]);
+function encodeEscapes(path74) {
+  if (!path74.includes("\\")) return path74;
+  return path74.replace(/\\([:(){}])/g, (_3, c3) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c3)]);
 }
 function segmentKey(segment) {
   if (segment.startsWith("**")) return 2;
@@ -63437,22 +63478,22 @@ function expandModifiers(segments) {
     return m2[2] === "+" ? [wc] : [wc, without];
   }
 }
-function normalizePath2(path73) {
-  if (!path73.includes("/.")) return path73;
+function normalizePath2(path74) {
+  if (!path74.includes("/.")) return path74;
   const r3 = [];
-  for (const s2 of path73.split("/")) if (s2 === ".") continue;
+  for (const s2 of path74.split("/")) if (s2 === ".") continue;
   else if (s2 === ".." && r3.length > 1) r3.pop();
   else r3.push(s2);
   return r3.join("/") || "/";
 }
-function splitPath(path73) {
-  const s2 = path73.split("/");
+function splitPath(path74) {
+  const s2 = path74.split("/");
   s2.shift();
   if (s2[s2.length - 1] === "") s2.pop();
   return s2;
 }
-function splitRoute(path73) {
-  const s2 = splitPath(path73);
+function splitRoute(path74) {
+  const s2 = splitPath(path74);
   while (s2[s2.length - 1] === "") s2.pop();
   return s2;
 }
@@ -63468,16 +63509,16 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path73, data) {
+function addRoute(ctx, method = "", path74, data) {
   method = method.toUpperCase();
-  if (path73.charCodeAt(0) !== 47) path73 = `/${path73}`;
-  const groupExpanded = expandGroupDelimiters(path73);
+  if (path74.charCodeAt(0) !== 47) path74 = `/${path74}`;
+  const groupExpanded = expandGroupDelimiters(path74);
   if (groupExpanded) {
     for (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);
     return;
   }
-  path73 = encodeEscapes(path73);
-  const segments = splitRoute(path73);
+  path74 = encodeEscapes(path74);
+  const segments = splitRoute(path74);
   const expanded = expandModifiers(segments);
   if (expanded) {
     for (const p of expanded) addRoute(ctx, method, p, data);
@@ -63568,15 +63609,15 @@ function getParamRegexp(segment, unnamedStart = 0) {
   const regex2 = _s.replace(/:([\w-]+)(?:\(([^)]*)\))?/g, (_3, id, p) => `(?<${toGroupName(id)}>${p || "[^/]+"})`).replace(/\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i++)}>`).replace(/\uFFFE(.)/g, (_3, c3) => /[.*+?^${}()|[\]\\]/.test(c3) ? `\\${c3}` : c3);
   return [new RegExp(`^${regex2}$`), _i];
 }
-function findRoute(ctx, method = "", path73, opts) {
-  if (opts?.normalize) path73 = normalizePath2(path73);
-  if (path73.charCodeAt(path73.length - 1) === 47) path73 = path73.slice(0, -1);
-  const staticNode = ctx.static[path73];
+function findRoute(ctx, method = "", path74, opts) {
+  if (opts?.normalize) path74 = normalizePath2(path74);
+  if (path74.charCodeAt(path74.length - 1) === 47) path74 = path74.slice(0, -1);
+  const staticNode = ctx.static[path74];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path73);
+  const segments = splitPath(path74);
   const match = _lookupTree(ctx.root, method, segments, 0);
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -63638,10 +63679,10 @@ function _selectMatcher(methods2, method, segments, dynamicTerminal, optionalOnl
   }
   return best;
 }
-function findAllRoutes(ctx, method = "", path73, opts) {
-  if (opts?.normalize) path73 = normalizePath2(path73);
-  if (path73.charCodeAt(path73.length - 1) === 47) path73 = path73.slice(0, -1);
-  const segments = splitPath(path73);
+function findAllRoutes(ctx, method = "", path74, opts) {
+  if (opts?.normalize) path74 = normalizePath2(path74);
+  if (path74.charCodeAt(path74.length - 1) === 47) path74 = path74.slice(0, -1);
+  const segments = splitPath(path74);
   const matches = _findAll(ctx.root, method, segments, 0);
   if (opts?.params === false) return matches;
   return matches.map((m2) => {
@@ -63745,25 +63786,25 @@ var init_router = __esm({
         const methods2 = Array.isArray(endpoint.options?.method) ? endpoint.options.method : [endpoint.options?.method];
         for (const method of methods2) addRoute(router2, method, endpoint.path, endpoint);
       }
-      if (config3?.routerMiddleware?.length) for (const { path: path73, middleware } of config3.routerMiddleware) addRoute(middlewareRouter, "*", path73, middleware);
+      if (config3?.routerMiddleware?.length) for (const { path: path74, middleware } of config3.routerMiddleware) addRoute(middlewareRouter, "*", path74, middleware);
       const basePath = config3?.basePath && config3.basePath !== "/" ? config3.basePath.replace(/\/+$/, "") : "";
       const processRequest = async (request) => {
         const url2 = new URL(request.url);
         const pathname = url2.pathname;
-        let path73;
+        let path74;
         if (basePath) {
           if (!pathname.startsWith(`${basePath}/`)) return new Response(null, {
             status: 404,
             statusText: "Not Found"
           });
-          path73 = pathname.slice(basePath.length);
-        } else path73 = pathname;
-        if (path73.length === 0 || /\/{2,}/.test(path73)) return new Response(null, {
+          path74 = pathname.slice(basePath.length);
+        } else path74 = pathname;
+        if (path74.length === 0 || /\/{2,}/.test(path74)) return new Response(null, {
           status: 404,
           statusText: "Not Found"
         });
-        const route = findRoute(router2, request.method, path73);
-        if (path73.endsWith("/") !== route?.data?.path?.endsWith("/") && !config3?.skipTrailingSlashes) return new Response(null, {
+        const route = findRoute(router2, request.method, path74);
+        if (path74.endsWith("/") !== route?.data?.path?.endsWith("/") && !config3?.skipTrailingSlashes) return new Response(null, {
           status: 404,
           statusText: "Not Found"
         });
@@ -63781,7 +63822,7 @@ var init_router = __esm({
         try {
           const allowedMediaTypes = handler.options.metadata?.allowedMediaTypes || config3?.allowedMediaTypes;
           const context2 = {
-            path: path73,
+            path: path74,
             method: request.method,
             headers: request.headers,
             params: route.params ? { ...route.params } : {},
@@ -63792,7 +63833,7 @@ var init_router = __esm({
             asResponse: true,
             context: config3?.routerContext
           };
-          const middlewareRoutes = findAllRoutes(middlewareRouter, "*", path73);
+          const middlewareRoutes = findAllRoutes(middlewareRouter, "*", path74);
           if (middlewareRoutes?.length) for (const { data: middleware, params } of middlewareRoutes) {
             const res = await middleware({
               ...context2,
@@ -63978,8 +64019,8 @@ function wrapEndpointHandler(handler, options) {
 }
 function createAuthEndpoint(...args) {
   if (args.length === 3) {
-    const [path73, options2, handler2] = args;
-    return createEndpointWithAuthContext(path73, options2, wrapEndpointHandler(handler2, options2));
+    const [path74, options2, handler2] = args;
+    return createEndpointWithAuthContext(path74, options2, wrapEndpointHandler(handler2, options2));
   }
   const [options, handler] = args;
   return createEndpointWithAuthContext(options, wrapEndpointHandler(handler, options));
@@ -64488,8 +64529,8 @@ function getIP(req, options) {
   if (isTest() || isDevelopment()) return LOCALHOST_IP;
   return null;
 }
-function createRateLimitKey(ip, path73) {
-  return `${ip}|${path73}`;
+function createRateLimitKey(ip, path74) {
+  return `${ip}|${path74}`;
 }
 var ipv4Schema, ipv6Schema, CIDR_PREFIX_PATTERN, LOCALHOST_IP, DEFAULT_IP_HEADERS;
 var init_ip = __esm({
@@ -71382,20 +71423,20 @@ function createRetryStrategy(options) {
       throw new Error("Invalid retry strategy");
   }
 }
-function parseMethodModifier(path73) {
-  if (!path73.startsWith("@")) return {
+function parseMethodModifier(path74) {
+  if (!path74.startsWith("@")) return {
     method: void 0,
-    path: path73
+    path: path74
   };
-  const separator = path73.indexOf("/");
-  const method = path73.slice(1, separator === -1 ? void 0 : separator);
+  const separator = path74.indexOf("/");
+  const method = path74.slice(1, separator === -1 ? void 0 : separator);
   if (!methods.includes(method)) return {
     method: void 0,
-    path: path73
+    path: path74
   };
   return {
     method,
-    path: separator === -1 ? path73 : path73.slice(separator + 1)
+    path: separator === -1 ? path74 : path74.slice(separator + 1)
   };
 }
 function resolvePathSegment(segment, pathParams) {
@@ -71414,7 +71455,7 @@ function getURL$1(url2, option) {
   const { path: requestPath } = parseMethodModifier(url2);
   if (requestPath !== url2) url2 = `/${requestPath}`;
   if (!basePath.endsWith("/")) basePath += "/";
-  let [path73, urlQuery] = url2.replace(basePath, "").split("?");
+  let [path74, urlQuery] = url2.replace(basePath, "").split("?");
   const queryParams = new URLSearchParams(urlQuery);
   for (const [key, value] of Object.entries(query || {})) {
     if (value == null) continue;
@@ -71428,18 +71469,18 @@ function getURL$1(url2, option) {
   }
   const pathParams = /* @__PURE__ */ new Map();
   if (params) if (Array.isArray(params)) {
-    const paramPaths = path73.split("/").filter((p) => p.startsWith(":"));
+    const paramPaths = path74.split("/").filter((p) => p.startsWith(":"));
     for (const [index2, key] of paramPaths.entries()) {
       const value = params[index2];
       pathParams.set(key, String(value));
     }
   } else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
-  path73 = path73.split("/").map((segment) => resolvePathSegment(segment, pathParams)).join("/");
-  path73 = path73.replace(/^\/+/, "");
+  path74 = path74.split("/").map((segment) => resolvePathSegment(segment, pathParams)).join("/");
+  path74 = path74.replace(/^\/+/, "");
   let queryParamString = queryParams.toString();
   queryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\+/g, "%20") : "";
-  if (!basePath.startsWith("http")) return `${basePath}${path73}${queryParamString}`;
-  return new URL(`${path73}${queryParamString}`, basePath);
+  if (!basePath.startsWith("http")) return `${basePath}${path74}${queryParamString}`;
+  return new URL(`${path74}${queryParamString}`, basePath);
 }
 function detectResponseType(request) {
   const _contentType = request.headers.get("content-type");
@@ -99092,7 +99133,7 @@ var init_query_promise = __esm({
 function mapResultRow(columns, row2, joinsNotNullableMap) {
   const nullifyMap = {};
   const result2 = columns.reduce(
-    (result22, { path: path73, field }, columnIndex) => {
+    (result22, { path: path74, field }, columnIndex) => {
       let decoder2;
       if (is(field, Column)) {
         decoder2 = field;
@@ -99104,8 +99145,8 @@ function mapResultRow(columns, row2, joinsNotNullableMap) {
         decoder2 = field.sql.decoder;
       }
       let node2 = result22;
-      for (const [pathChunkIndex, pathChunk] of path73.entries()) {
-        if (pathChunkIndex < path73.length - 1) {
+      for (const [pathChunkIndex, pathChunk] of path74.entries()) {
+        if (pathChunkIndex < path74.length - 1) {
           if (!(pathChunk in node2)) {
             node2[pathChunk] = {};
           }
@@ -99113,8 +99154,8 @@ function mapResultRow(columns, row2, joinsNotNullableMap) {
         } else {
           const rawValue = row2[columnIndex];
           const value = node2[pathChunk] = rawValue === null ? null : decoder2.mapFromDriverValue(rawValue);
-          if (joinsNotNullableMap && is(field, Column) && path73.length === 2) {
-            const objectName = path73[0];
+          if (joinsNotNullableMap && is(field, Column) && path74.length === 2) {
+            const objectName = path74[0];
             if (!(objectName in nullifyMap)) {
               nullifyMap[objectName] = value === null ? getTableName(field.table) : false;
             } else if (typeof nullifyMap[objectName] === "string" && nullifyMap[objectName] !== getTableName(field.table)) {
@@ -102110,6 +102151,13 @@ var init_desktop_sign_in = __esm({
   }
 });
 
+// ../../apps/server/src/services/core/auth/person-step-up.ts
+var init_person_step_up = __esm({
+  "../../apps/server/src/services/core/auth/person-step-up.ts"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/.pnpm/@better-auth+core@1.7.7_@better-auth+utils@0.5.0_@better-fetch+fetch@1.3.2_@opentelemet_2ccd551e618bc3d9345b7bdfc16326c8/node_modules/@better-auth/core/dist/utils/async.mjs
 async function mapConcurrent(items, fn, options) {
   const n2 = items.length;
@@ -106819,6 +106867,13 @@ var init_tasks = __esm({
        * app, which shows ownership before a person tries an edit.
        */
       packageOwned: text("package_owned", { enum: ["record", "legacy", "unknown"] }),
+      /**
+       * Whether this row is one project's copy of a global schedule marked
+       * `scope: project` (DOR-3376). One file then backs one row per project, so
+       * a row is found by its file AND its agent, its switch lives on the row
+       * alone, and DorkOS never writes the shared file for it.
+       */
+      projectOnly: integer2("project_only", { mode: "boolean" }).notNull().default(false),
       prompt: text("prompt").notNull(),
       agentId: text("agent_id"),
       /**
@@ -113471,6 +113526,31 @@ var init_session_relay_link = __esm({
   }
 });
 
+// ../../apps/server/src/services/core/auth/person-proof.ts
+var init_person_proof = __esm({
+  "../../apps/server/src/services/core/auth/person-proof.ts"() {
+    "use strict";
+    init_auth2();
+  }
+});
+
+// ../shared/src/person-session.ts
+var PersonSessionResponseSchema, PersonSessionRequestSchema;
+var init_person_session = __esm({
+  "../shared/src/person-session.ts"() {
+    init_zod();
+    PersonSessionResponseSchema = external_exports.object({
+      ok: external_exports.literal(true),
+      /** The person proof to send in {@link PERSON_PROOF_HEADER}. */
+      proof: external_exports.string().min(1)
+    });
+    PersonSessionRequestSchema = external_exports.object({
+      /** The owner's password. Never logged or stored. */
+      password: external_exports.string().min(1).max(1024)
+    });
+  }
+});
+
 // ../../apps/server/src/services/core/auth/session-gate.ts
 var init_session_gate = __esm({
   "../../apps/server/src/services/core/auth/session-gate.ts"() {
@@ -113485,6 +113565,8 @@ var init_session_gate = __esm({
     init_session_relay_link();
     init_session_route();
     init_live_connections();
+    init_person_proof();
+    init_person_session();
   }
 });
 
@@ -113516,6 +113598,7 @@ var init_auth2 = __esm({
     init_auth_audit();
     init_hub_sign_in();
     init_desktop_sign_in();
+    init_person_step_up();
     init_src2();
     init_env();
     init_logger();
@@ -113577,6 +113660,7 @@ function defuseSystemTags(text3, tagNames) {
 var IDENTITY_MAX_LENGTH, INVISIBLE_FORMAT, CONTROL_CHARS, PATTERN_CACHE;
 var init_untrusted_text = __esm({
   "../shared/src/untrusted-text.ts"() {
+    "use strict";
     IDENTITY_MAX_LENGTH = 80;
     INVISIBLE_FORMAT = /[\u00ad\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff\ufff9-\ufffb]/g;
     CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
@@ -114160,17 +114244,17 @@ function patchPaths(value, prefix = "") {
   if (entries.length === 0) return prefix ? [prefix] : [];
   return entries.flatMap(([key, child]) => patchPaths(child, prefix ? `${prefix}.${key}` : key));
 }
-function withoutArrayMarkers(path73) {
-  return path73.replaceAll("[]", "");
+function withoutArrayMarkers(path74) {
+  return path74.replaceAll("[]", "");
 }
 function prepareGuardedPaths(paths2) {
-  return paths2.map((path73) => ({ path: path73, plain: withoutArrayMarkers(path73) }));
+  return paths2.map((path74) => ({ path: path74, plain: withoutArrayMarkers(path74) }));
 }
 function matchGuardedPaths(touched, guarded) {
   const hits = /* @__PURE__ */ new Set();
-  for (const path73 of new Set(touched)) {
+  for (const path74 of new Set(touched)) {
     for (const { path: guardedPath, plain } of guarded) {
-      if (path73 === plain || path73.startsWith(`${plain}.`) || plain.startsWith(`${path73}.`)) {
+      if (path74 === plain || path74.startsWith(`${plain}.`) || plain.startsWith(`${path74}.`)) {
         hits.add(guardedPath);
       }
     }
@@ -114206,8 +114290,8 @@ var init_remote_config_policy = __esm({
       "cloud.remote.edgeProofRef"
     ];
     CLOUD_REMOTE_WRITE_POLICY = Object.fromEntries(
-      [...CLOUD_REMOTE_REACH_PATHS, ...CLOUD_REMOTE_CREDENTIAL_PATHS].map((path73) => [
-        path73,
+      [...CLOUD_REMOTE_REACH_PATHS, ...CLOUD_REMOTE_CREDENTIAL_PATHS].map((path74) => [
+        path74,
         "operator-only"
       ])
     );
@@ -116034,17 +116118,17 @@ var init_agent_binding = __esm({
         if (!this.runtimes || !this.defaultRuntime) throw new Error("COMPUTER_REGISTRY_UNAVAILABLE");
         return resolveRegisteredAgentRuntime(id, mesh, this.runtimes, this.defaultRuntime, this);
       }
-      configure(id, path73) {
-        if (!id || id.length > 128 || !path73.startsWith("/") || canonicalDirectory(path73) !== path73) {
+      configure(id, path74) {
+        if (!id || id.length > 128 || !path74.startsWith("/") || canonicalDirectory(path74) !== path74) {
           throw new Error("COMPUTER_AGENT_BINDING_REFUSED");
         }
-        if (this.binding && (this.binding.id !== id || this.binding.path !== path73)) {
+        if (this.binding && (this.binding.id !== id || this.binding.path !== path74)) {
           throw new Error("COMPUTER_AGENT_BINDING_REFUSED");
         }
-        this.binding = { id, path: path73 };
+        this.binding = { id, path: path74 };
       }
-      forPath(path73) {
-        return this.binding?.path === path73 ? "computer-local" : void 0;
+      forPath(path74) {
+        return this.binding?.path === path74 ? "computer-local" : void 0;
       }
       forId(id) {
         return this.binding?.id === id ? "computer-local" : void 0;
@@ -120328,9 +120412,9 @@ var init_windows_execution_state = __esm({
 
 // ../keep-awake/src/environment.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-function readFileOrNull(path73) {
+function readFileOrNull(path74) {
   try {
-    return readFileSync4(path73, "utf8");
+    return readFileSync4(path74, "utf8");
   } catch {
     return null;
   }
@@ -121292,9 +121376,9 @@ async function boundTurnOpts(runtime, sessionId, incoming, deps) {
   }
   const { agentPath } = agent;
   const read = deps.levelOf ?? resolveAgentLaunchLevel;
-  const modeOf = async (path73) => {
+  const modeOf = async (path74) => {
     try {
-      return (await read({ agentPath: path73, capabilities })).mode ?? null;
+      return (await read({ agentPath: path74, capabilities })).mode ?? null;
     } catch (err) {
       logger.warn(
         "[agent-level] could not read the agent\u2019s level; holding the turn to the default",
@@ -123891,55 +123975,285 @@ var init_session_visibility = __esm({
   }
 });
 
-// ../../apps/server/src/services/workspace/providers/git.ts
+// ../shared/src/safe-git.ts
 import { execFile } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
-async function runGit(args, cwd, { timeoutMs = GIT_TIMEOUT_MS, config: config3 = internalGitConfig(), env: env6 } = {}) {
-  const { stdout: stdout3 } = await execFileAsync("git", [...gitConfigArgs(config3), ...args], {
-    cwd,
-    timeout: timeoutMs,
-    env: {
-      // eslint-disable-next-line no-restricted-syntax -- git must inherit PATH/HOME/credential vars; only the transport allowlist and prompt are added.
-      ...process.env,
-      ...env6,
-      GIT_ALLOW_PROTOCOL: WORKSPACE_GIT_PROTOCOLS,
-      GIT_TERMINAL_PROMPT: "0"
-    }
+import fs23 from "node:fs";
+import path42 from "node:path";
+function findGitPlaces(dir) {
+  const resolved = path42.resolve(dir);
+  const folders = /* @__PURE__ */ new Set([resolved]);
+  const gitDirs = /* @__PURE__ */ new Set();
+  const commonDirs = /* @__PURE__ */ new Set();
+  for (const start of /* @__PURE__ */ new Set([resolved, nativeRealPath(resolved)])) {
+    if (start.split(path42.sep).includes(".git")) return null;
+    folders.add(start);
+    for (let current3 = start; ; current3 = path42.dirname(current3)) {
+      if (looksLikeGitDir(current3)) gitDirs.add(current3);
+      const dotGit = path42.join(current3, ".git");
+      const stat5 = fs23.lstatSync(dotGit, { throwIfNoEntry: false });
+      if (stat5) {
+        folders.add(current3);
+        const common2 = stat5.isDirectory() ? dotGit : addPointer(current3, dotGit, gitDirs);
+        if (common2 === null) return null;
+        gitDirs.add(common2);
+        commonDirs.add(common2);
+      }
+      if (path42.dirname(current3) === current3) break;
+    }
+  }
+  const worktrees = /* @__PURE__ */ new Set();
+  for (const common2 of commonDirs) addLinkedWorktrees(common2, worktrees);
+  return { folders: [...folders], gitDirs: [...gitDirs], worktrees: [...worktrees] };
+}
+function addPointer(top, dotGit, gitDirs) {
+  const text3 = readGitFile(dotGit);
+  if (text3 === null || !text3.startsWith("gitdir: ")) return null;
+  const gitDir = path42.resolve(top, text3.slice("gitdir: ".length));
+  if (!isDirectory(gitDir)) return null;
+  gitDirs.add(gitDir);
+  const common2 = readGitFile(path42.join(gitDir, "commondir"));
+  if (common2 === null) return gitDir;
+  const commonDir = path42.resolve(gitDir, common2);
+  return isDirectory(commonDir) ? commonDir : null;
+}
+function readGitFile(file2) {
+  try {
+    return fs23.readFileSync(file2, "utf8").replace(/[\r\n]+$/, "");
+  } catch {
+    return null;
+  }
+}
+function isDirectory(dir) {
+  return fs23.statSync(dir, { throwIfNoEntry: false })?.isDirectory() ?? false;
+}
+function looksLikeGitDir(dir) {
+  return fs23.existsSync(path42.join(dir, "HEAD")) && isDirectory(path42.join(dir, "objects")) && isDirectory(path42.join(dir, "refs"));
+}
+function addLinkedWorktrees(common2, worktrees) {
+  const admin = path42.join(common2, "worktrees");
+  let names;
+  try {
+    names = fs23.readdirSync(admin);
+  } catch {
+    return;
+  }
+  for (const name2 of names) {
+    const dotGit = readGitFile(path42.join(admin, name2, "gitdir"));
+    if (dotGit) worktrees.add(path42.dirname(path42.resolve(admin, name2, dotGit)));
+  }
+}
+function nativeRealPath(dir) {
+  try {
+    return fs23.realpathSync.native(dir);
+  } catch {
+    return dir;
+  }
+}
+function minimalGitEnv(locale = {}) {
+  const parent = process.env;
+  const env6 = {};
+  if (locale.LC_ALL !== void 0) env6.LC_ALL = locale.LC_ALL;
+  if (locale.LANG !== void 0) env6.LANG = locale.LANG;
+  for (const name2 of [
+    "PATH",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "SystemRoot",
+    "SYSTEMROOT",
+    "USERPROFILE",
+    "PATHEXT",
+    "ComSpec"
+  ]) {
+    if (parent[name2] !== void 0 && env6[name2] === void 0) env6[name2] = parent[name2];
+  }
+  return {
+    ...env6,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
+    GIT_NO_LAZY_FETCH: "1",
+    GIT_ALLOW_PROTOCOL: "",
+    GIT_TERMINAL_PROMPT: "0",
+    // No GIT_OPTIONAL_LOCKS=0: `status` must be free to write back its
+    // refreshed index, as git always does. Without that, every file in a fresh
+    // checkout stays "racily clean" and each status re-reads all of them (on a
+    // fresh 20k-file checkout, 0.6 s every time against 0.09 s once written).
+    // A caller reading someone else's live worktree passes `--no-optional-locks`
+    // itself (the Workspaces scan does).
+    GIT_PAGER: "cat"
+  };
+}
+function keysIn(file2) {
+  return new Promise((resolve14, reject) => {
+    execFile(
+      "git",
+      ["config", "--file", file2, "--no-includes", "--name-only", "--list", "-z"],
+      // Run from the file system root: `--file` reads only that file, and no
+      // repository is found above `/` to add its own settings.
+      { cwd: path42.parse(file2).root, timeout: AUDIT_TIMEOUT_MS, env: minimalGitEnv() },
+      (err, stdout3) => {
+        if (err) return reject(new GitRepoConfigUnsafeError(file2, []));
+        resolve14([
+          ...new Set(
+            stdout3.split("\0").map((key) => key.trim().toLowerCase()).filter((key) => key !== "")
+          )
+        ]);
+      }
+    );
   });
-  return stdout3;
 }
-var execFileAsync, GIT_TIMEOUT_MS, WORKSPACE_GIT_PROTOCOLS;
-var init_git = __esm({
-  "../../apps/server/src/services/workspace/providers/git.ts"() {
-    "use strict";
+async function assertRepoConfigSafe(cwd, { allowHooksPath = false } = {}) {
+  const places = findGitPlaces(cwd);
+  if (places === null) throw new GitRepoConfigUnsafeError(path42.join(cwd, ".git"), []);
+  let worktreeConfigOn = false;
+  for (const gitDir of places.gitDirs) {
+    const passed = await auditFile(path42.join(gitDir, "config"), allowHooksPath);
+    worktreeConfigOn ||= passed.worktreeConfig;
+  }
+  if (!worktreeConfigOn) return;
+  for (const gitDir of places.gitDirs) {
+    await auditFile(path42.join(gitDir, "config.worktree"), allowHooksPath);
+  }
+}
+async function auditFile(file2, allowHooksPath) {
+  const stat5 = fs23.statSync(file2, { throwIfNoEntry: false });
+  if (!stat5) return { worktreeConfig: false };
+  const stamp2 = `${stat5.size}:${stat5.mtimeMs}:${stat5.ctimeMs}:${stat5.ino}`;
+  const cacheKey = allowHooksPath ? `${file2}\0read` : file2;
+  const cached2 = auditedAt.get(cacheKey);
+  if (cached2?.stamp === stamp2) return { worktreeConfig: cached2.worktreeConfig };
+  const keys = await keysIn(file2);
+  const unsafe = keys.filter(
+    (key) => !SAFE_REPO_CONFIG_KEY.test(key) && !(allowHooksPath && key === "core.hookspath")
+  );
+  if (unsafe.length > 0) {
+    auditedAt.delete(cacheKey);
+    throw new GitRepoConfigUnsafeError(file2, unsafe);
+  }
+  const worktreeConfig = keys.includes("extensions.worktreeconfig");
+  auditedAt.set(cacheKey, { stamp: stamp2, worktreeConfig });
+  return { worktreeConfig };
+}
+async function runSafeGit(args, cwd, options = {}) {
+  const out = await spawnSafeGit(args, cwd, options, "utf8");
+  return out;
+}
+async function spawnSafeGit(args, cwd, options, encoding) {
+  await assertRepoConfigSafe(cwd, { allowHooksPath: true });
+  return new Promise((resolve14, reject) => {
+    execFile(
+      "git",
+      [...SAFE_GIT_ARGS, ...args],
+      {
+        cwd,
+        timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER,
+        signal: options.signal,
+        env: minimalGitEnv(options.env),
+        encoding
+      },
+      (err, stdout3, stderr) => {
+        if (err) {
+          Object.assign(err, { stdout: stdout3, stderr });
+          return reject(err);
+        }
+        resolve14(stdout3);
+      }
+    );
+  });
+}
+var SAFE_REPO_CONFIG_KEY, SAFE_GIT_ARGS, GitRepoConfigUnsafeError, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_BUFFER, AUDIT_TIMEOUT_MS, auditedAt;
+var init_safe_git = __esm({
+  "../shared/src/safe-git.ts"() {
     init_git_hardening();
-    execFileAsync = promisify2(execFile);
-    GIT_TIMEOUT_MS = 3e4;
-    WORKSPACE_GIT_PROTOCOLS = "https:ssh:git:file";
+    SAFE_REPO_CONFIG_KEY = new RegExp(
+      "^(?:" + [
+        "core\\.(?:repositoryformatversion|filemode|bare|logallrefupdates|ignorecase|precomposeunicode|symlinks)",
+        "remote\\.[a-z0-9._-]+\\.(?:url|pushurl|fetch|push|tagopt|prune|gh-resolved)",
+        // Git never runs a command from a `branch.*` key.
+        "branch\\.[a-z0-9._/-]+\\.[a-z0-9-]+",
+        "extensions\\.(?:worktreeconfig|objectformat)",
+        "blame\\.ignorerevsfile",
+        "rerere\\.enabled",
+        "lfs\\.repositoryformatversion",
+        "gtr\\.[a-z.]+",
+        "gc\\.[a-z]+",
+        "maintenance\\.[a-z.]+",
+        "fetch\\.(?:prune|writecommitgraph)",
+        "pull\\.rebase",
+        "user\\.(?:name|email)"
+      ].join("|") + ")$"
+    );
+    SAFE_GIT_ARGS = [
+      ...gitConfigArgs(internalGitConfig()),
+      "-c",
+      "protocol.allow=never",
+      "-c",
+      "core.sshCommand=",
+      "-c",
+      "core.askPass=",
+      "-c",
+      "credential.helper=",
+      "-c",
+      "diff.external=",
+      "-c",
+      "core.pager=cat",
+      "-c",
+      "diff.ignoreSubmodules=all",
+      "-c",
+      "status.submoduleSummary=false",
+      "-c",
+      "submodule.recurse=false"
+    ];
+    GitRepoConfigUnsafeError = class extends Error {
+      /**
+       * Build the error.
+       *
+       * @param file - The settings file that holds the keys.
+       * @param keys - The keys off the safe list (empty when the file was unreadable).
+       */
+      constructor(file2, keys) {
+        super(
+          keys.length > 0 ? `DorkOS won't read this repository with git: ${file2} sets ${keys.join(", ")}.` : `DorkOS won't read this repository with git: ${file2} can't be read.`
+        );
+        this.file = file2;
+        this.keys = keys;
+        this.name = "GitRepoConfigUnsafeError";
+      }
+      file;
+      keys;
+    };
+    DEFAULT_TIMEOUT_MS = 1e4;
+    DEFAULT_MAX_BUFFER = 10 * 1024 * 1024;
+    AUDIT_TIMEOUT_MS = 5e3;
+    auditedAt = /* @__PURE__ */ new Map();
   }
 });
 
 // ../../apps/server/src/services/projects/extension-copy.ts
-import { promises as fs23 } from "node:fs";
-import path42 from "node:path";
+import { promises as fs24 } from "node:fs";
+import path43 from "node:path";
 async function folderExists(dir) {
   try {
-    return (await fs23.stat(dir)).isDirectory();
+    return (await fs24.stat(dir)).isDirectory();
   } catch {
     return false;
   }
 }
 async function holdsExtensionCopy(root, extensionId) {
-  if (await folderExists(path42.join(root, ".dork", "extensions", extensionId))) return true;
+  if (await folderExists(path43.join(root, ".dork", "extensions", extensionId))) return true;
   let plugins;
   try {
-    plugins = await fs23.readdir(path42.join(root, ".dork", "plugins"));
+    plugins = await fs24.readdir(path43.join(root, ".dork", "plugins"));
   } catch {
     return false;
   }
   for (const plugin of plugins) {
     if (isInstallSiblingName(plugin)) continue;
-    const copy2 = path42.join(root, ".dork", "plugins", plugin, ".dork", "extensions", extensionId);
+    const copy2 = path43.join(root, ".dork", "plugins", plugin, ".dork", "extensions", extensionId);
     if (await folderExists(copy2)) return true;
   }
   return false;
@@ -123973,14 +124287,14 @@ var init_origin_repo = __esm({
 });
 
 // ../../apps/server/src/services/projects/project-names.ts
-import path43 from "node:path";
+import path44 from "node:path";
 function sanitizeNameSegment(segment) {
   return segment.replace(/[^A-Za-z0-9._-]/g, "-");
 }
 function assignProjectName(root, isTaken) {
-  const base = sanitizeNameSegment(path43.basename(root)) || "project";
+  const base = sanitizeNameSegment(path44.basename(root)) || "project";
   if (!isTaken(base)) return base;
-  const parent = sanitizeNameSegment(path43.basename(path43.dirname(root))) || "root";
+  const parent = sanitizeNameSegment(path44.basename(path44.dirname(root))) || "root";
   const withParent = `${base}~${parent}`;
   if (!isTaken(withParent)) return withParent;
   for (let n2 = 2; ; n2++) {
@@ -124032,17 +124346,19 @@ var init_slots = __esm({
 });
 
 // ../../apps/server/src/services/projects/resolve-project-root.ts
-import path44 from "node:path";
+import path45 from "node:path";
 function projectRootFromCommonDir(commonDir) {
   const trimmed = commonDir.trim();
   if (trimmed.length === 0) return null;
-  return path44.basename(trimmed) === ".git" ? path44.dirname(trimmed) : trimmed;
+  return path45.basename(trimmed) === ".git" ? path45.dirname(trimmed) : trimmed;
 }
 function isNotARepository(err) {
   if (typeof err !== "object" || err === null) return false;
-  const stderr = err.stderr;
-  const text3 = typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString() : "";
-  return /not a git repository|cannot use bare repository/i.test(text3);
+  const { code, killed } = err;
+  return code === 128 && killed !== true;
+}
+function rootOf(found) {
+  return found.kind === "project" ? found.root : null;
 }
 function negativeTtl(misses) {
   return Math.min(NEGATIVE_ROOT_TTL_MS * 2 ** Math.max(0, misses - 1), MAX_NEGATIVE_ROOT_TTL_MS);
@@ -124053,21 +124369,26 @@ function createProjectRootResolver(overrides = {}) {
   const byCwd = /* @__PURE__ */ new Map();
   async function lookUp(cwd) {
     const dir = deps.canonical(cwd);
-    if (!path44.isAbsolute(dir)) return { root: null, answered: true };
+    if (!path45.isAbsolute(dir)) return { found: { kind: "none" }, answered: true };
     try {
       const commonDir = await deps.runGit(
         ["rev-parse", "--path-format=absolute", "--git-common-dir"],
         dir,
-        { timeoutMs: GIT_TIMEOUT_MS2, env: ROOT_LOOKUP_GIT_ENV }
+        { timeoutMs: GIT_TIMEOUT_MS, env: ROOT_LOOKUP_GIT_ENV }
       );
       const root = projectRootFromCommonDir(commonDir);
-      return { root: root === null ? null : deps.canonical(root), answered: true };
+      return {
+        found: root === null ? { kind: "none" } : { kind: "project", root: deps.canonical(root) },
+        answered: true
+      };
     } catch (err) {
-      return { root: null, answered: isNotARepository(err) };
+      if (err instanceof GitRepoConfigUnsafeError)
+        return { found: { kind: "refused" }, answered: true };
+      return { found: { kind: "none" }, answered: isNotARepository(err) };
     }
   }
   async function readUncached(cwd) {
-    return (await lookUp(cwd)).root;
+    return rootOf((await lookUp(cwd)).found);
   }
   function live(cwd) {
     const entry = byCwd.get(cwd);
@@ -124075,29 +124396,33 @@ function createProjectRootResolver(overrides = {}) {
     if (entry.retryAt !== void 0 && deps.now() >= entry.retryAt) return void 0;
     return entry;
   }
-  function resolve14(cwd) {
+  function lookup(cwd) {
     const key = deps.canonical(cwd);
     const cached2 = live(key);
-    if (cached2) return cached2.root;
+    if (cached2) return cached2.found;
     const previousMisses = byCwd.get(key)?.misses ?? 0;
     const entry = {
       misses: previousMisses,
-      root: lookups.run(() => lookUp(key)).then(({ root, answered: answered2 }) => {
+      found: lookups.run(() => lookUp(key)).then(({ found, answered: answered2 }) => {
+        const root = rootOf(found);
         entry.settled = { root };
         if (root === null) {
           if (answered2) entry.misses = previousMisses + 1;
           entry.retryAt = deps.now() + (answered2 ? negativeTtl(entry.misses) : NEGATIVE_ROOT_TTL_MS);
         }
-        return root;
+        return found;
       })
     };
     byCwd.set(key, entry);
-    return entry.root;
+    return entry.found;
+  }
+  function resolve14(cwd) {
+    return lookup(cwd).then(rootOf);
   }
   function peek(cwd) {
     return live(deps.canonical(cwd))?.settled?.root;
   }
-  return { resolve: resolve14, peek, readUncached };
+  return { resolve: resolve14, lookup, peek, readUncached };
 }
 function resolveProjectRoot(cwd) {
   return defaultResolver.resolve(cwd);
@@ -124105,20 +124430,20 @@ function resolveProjectRoot(cwd) {
 function peekProjectRoot(cwd) {
   return defaultResolver.peek(cwd);
 }
-var NEGATIVE_ROOT_TTL_MS, MAX_NEGATIVE_ROOT_TTL_MS, MAX_CONCURRENT_ROOT_LOOKUPS, ROOT_LOOKUP_GIT_ENV, GIT_TIMEOUT_MS2, defaultDeps, defaultResolver;
+var NEGATIVE_ROOT_TTL_MS, MAX_NEGATIVE_ROOT_TTL_MS, MAX_CONCURRENT_ROOT_LOOKUPS, ROOT_LOOKUP_GIT_ENV, GIT_TIMEOUT_MS, defaultDeps, defaultResolver;
 var init_resolve_project_root = __esm({
   "../../apps/server/src/services/projects/resolve-project-root.ts"() {
     "use strict";
     init_canonical_directory();
     init_slots();
-    init_git();
+    init_safe_git();
     NEGATIVE_ROOT_TTL_MS = 6e4;
     MAX_NEGATIVE_ROOT_TTL_MS = 10 * 6e4;
     MAX_CONCURRENT_ROOT_LOOKUPS = 4;
     ROOT_LOOKUP_GIT_ENV = { LC_ALL: "C", LANG: "C" };
-    GIT_TIMEOUT_MS2 = 5e3;
+    GIT_TIMEOUT_MS = 5e3;
     defaultDeps = {
-      runGit,
+      runGit: runSafeGit,
       now: Date.now,
       canonical: canonicalDirectory
     };
@@ -124127,11 +124452,11 @@ var init_resolve_project_root = __esm({
 });
 
 // ../../apps/server/src/services/projects/project-registry.ts
-import path45 from "node:path";
+import path46 from "node:path";
 async function readOriginRepoFromGit(root) {
   try {
     return parseOriginRepo(
-      await runGit(["remote", "get-url", "origin"], root, { timeoutMs: ORIGIN_GIT_TIMEOUT_MS })
+      await runSafeGit(["remote", "get-url", "origin"], root, { timeoutMs: ORIGIN_GIT_TIMEOUT_MS })
     );
   } catch {
     return null;
@@ -124157,7 +124482,7 @@ var init_project_registry = __esm({
     "use strict";
     init_boundary();
     init_logger();
-    init_git();
+    init_safe_git();
     init_extension_copy();
     init_origin_repo();
     init_project_names();
@@ -124599,7 +124924,7 @@ var init_project_registry = __esm({
         this.sourcesReadAt = now3;
         this.sourcesRead = (async () => {
           try {
-            const folders = [...new Set(await sources2())].filter((dir) => path45.isAbsolute(dir));
+            const folders = [...new Set(await sources2())].filter((dir) => path46.isAbsolute(dir));
             await this.seedBatch(folders);
           } catch (err) {
             this.warn("could not read the folders to seed projects from", err);
@@ -125317,6 +125642,8 @@ var init_account_eligibility = __esm({
     init_config_schema();
     init_project_schemas();
     init_project_registry();
+    init_resolve_project_root();
+    init_config_manager();
   }
 });
 
@@ -125392,13 +125719,13 @@ var init_account_ranking = __esm({
 });
 
 // ../../apps/server/src/services/runtimes/claude-code/claude-config-dir.ts
-import path46 from "path";
+import path47 from "path";
 import os7 from "os";
 function expandClaudeAccountHome(dir) {
   return dir === "~" || dir.startsWith("~/") ? expandAccountPath(dir, os7.homedir()) : dir;
 }
 function inheritedClaudeRoot() {
-  return ambientClaudeConfigDir() ?? path46.join(os7.homedir(), ".claude");
+  return ambientClaudeConfigDir() ?? path47.join(os7.homedir(), ".claude");
 }
 var init_claude_config_dir = __esm({
   "../../apps/server/src/services/runtimes/claude-code/claude-config-dir.ts"() {
@@ -125583,13 +125910,13 @@ function sameLeaf(a2, b2) {
 function collectChangedPaths(before, after, prefix, out) {
   for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
     if (DANGEROUS_KEYS.has(key)) continue;
-    const path73 = prefix ? `${prefix}.${key}` : key;
+    const path74 = prefix ? `${prefix}.${key}` : key;
     const a2 = before[key];
     const b2 = after[key];
     if (isPlainObject6(a2) && isPlainObject6(b2)) {
-      collectChangedPaths(a2, b2, path73, out);
+      collectChangedPaths(a2, b2, path74, out);
     } else if (!sameLeaf(a2, b2)) {
-      out.push(path73);
+      out.push(path74);
     }
   }
 }
@@ -125601,9 +125928,9 @@ function renderSegment(segment) {
     (char) => `\\u${char.codePointAt(0).toString(16).padStart(4, "0")}`
   );
 }
-function isOperatorOnlyPath(path73) {
+function isOperatorOnlyPath(path74) {
   return OPERATOR_ONLY_CONFIG_PATHS.some(
-    (guarded) => path73 === guarded || path73.startsWith(`${guarded}.`)
+    (guarded) => path74 === guarded || path74.startsWith(`${guarded}.`)
   );
 }
 function describeConfigWrite(before, after) {
@@ -125613,14 +125940,14 @@ function describeConfigWrite(before, after) {
   if (changed.length === 0) return "";
   const ordered = [
     ...changed.filter(isOperatorOnlyPath).sort(),
-    ...changed.filter((path73) => !isOperatorOnlyPath(path73)).sort()
+    ...changed.filter((path74) => !isOperatorOnlyPath(path74)).sort()
   ];
-  const named3 = ordered.slice(0, LOGGED_PATH_LIMIT).map((path73) => path73.split(".").map(renderSegment).join(".")).join(", ");
+  const named3 = ordered.slice(0, LOGGED_PATH_LIMIT).map((path74) => path74.split(".").map(renderSegment).join(".")).join(", ");
   return ordered.length <= LOGGED_PATH_LIMIT ? named3 : `${named3}, and ${ordered.length - LOGGED_PATH_LIMIT} more`;
 }
-function valueAtPath(root, path73) {
+function valueAtPath(root, path74) {
   let node2 = root;
-  for (const key of path73.split(".")) {
+  for (const key of path74.split(".")) {
     if (!isPlainObject6(node2)) return void 0;
     node2 = node2[key];
   }
@@ -125751,9 +126078,9 @@ function describeOperatorOnlyRefusal(paths2) {
   const remaining = new Set(paths2);
   const clauses = [];
   for (const group of OPERATOR_ONLY_STAKES) {
-    const matched = paths2.filter((path73) => group.paths.includes(path73));
+    const matched = paths2.filter((path74) => group.paths.includes(path74));
     if (matched.length === 0) continue;
-    for (const path73 of matched) remaining.delete(path73);
+    for (const path74 of matched) remaining.delete(path74);
     clauses.push(`${group.description}: ${matched.join(", ")}.`);
   }
   if (remaining.size > 0) {
@@ -125792,7 +126119,7 @@ __export(config_write_exports, {
 function personApprovedAuthority(decidedByUserId, isLoginEnabled = () => decidedByUserId !== void 0 || configManager.get("auth")?.enabled === true, isOwner = (userId) => isInstallOwner(userId === void 0 ? void 0 : { userId })) {
   return {
     refuseOperatorOnly: (paths2) => {
-      const cloudPaths = paths2.filter((path73) => path73.startsWith("cloud."));
+      const cloudPaths = paths2.filter((path74) => path74.startsWith("cloud."));
       if (cloudPaths.length === 0 || !isLoginEnabled() || isOwner(decidedByUserId)) {
         return void 0;
       }
@@ -125806,9 +126133,9 @@ function personApprovedAuthority(decidedByUserId, isLoginEnabled = () => decided
     }
   };
 }
-function leafAt(config3, path73) {
+function leafAt(config3, path74) {
   let current3 = config3;
-  for (const key of path73) {
+  for (const key of path74) {
     if (current3 === null || typeof current3 !== "object") return null;
     current3 = current3[key];
   }
@@ -125819,9 +126146,9 @@ function onTrustStopChange(listener) {
 }
 function reportTrustStopMoves(before, after, write) {
   if (!trustStopListener) return;
-  const moves = TRUST_STOP_LEAVES.flatMap(({ path: path73, runtime }) => {
-    const was = leafAt(before, path73);
-    const now3 = leafAt(after, path73);
+  const moves = TRUST_STOP_LEAVES.flatMap(({ path: path74, runtime }) => {
+    const was = leafAt(before, path74);
+    const now3 = leafAt(after, path74);
     return was === now3 ? [] : [{ ...runtime ? { runtime } : {}, before: was, after: now3 }];
   });
   if (moves.length === 0) return;
@@ -132027,8 +132354,8 @@ var init_manifest_edit = __esm({
 import { readFileSync as readFileSync9 } from "node:fs";
 import { join as join30 } from "node:path";
 function enableHarnessInManifest(repoRoot, harness) {
-  const path73 = HARNESS_MANIFEST_PATH;
-  const abs = join30(repoRoot, path73);
+  const path74 = HARNESS_MANIFEST_PATH;
+  const abs = join30(repoRoot, path74);
   const before = readFileSync9(abs, "utf8");
   let parsed;
   try {
@@ -132037,7 +132364,7 @@ function enableHarnessInManifest(repoRoot, harness) {
     return {
       outcome: "unwritable",
       harness,
-      path: path73,
+      path: path74,
       reason: `it is not valid JSON (${err instanceof Error ? err.message : String(err)})`
     };
   }
@@ -132045,16 +132372,16 @@ function enableHarnessInManifest(repoRoot, harness) {
   try {
     manifest = parseHarnessManifest(parsed);
   } catch (err) {
-    return { outcome: "unwritable", harness, path: path73, reason: manifestSchemaReason(err) };
+    return { outcome: "unwritable", harness, path: path74, reason: manifestSchemaReason(err) };
   }
   const existing = manifest.harnesses;
-  if (existing.includes(harness)) return { outcome: "already-enabled", harness, path: path73 };
+  if (existing.includes(harness)) return { outcome: "already-enabled", harness, path: path74 };
   const edit = plannedEdit(before, existing, harness);
   if (!edit) {
     return {
       outcome: "unwritable",
       harness,
-      path: path73,
+      path: path74,
       reason: 'its "harnesses" list could not be located in the file as written'
     };
   }
@@ -132063,12 +132390,12 @@ function enableHarnessInManifest(repoRoot, harness) {
     return {
       outcome: "unwritable",
       harness,
-      path: path73,
+      path: path74,
       reason: "adding the harness would have changed something else in the file"
     };
   }
   writeFileAtomic(abs, after);
-  return { outcome: "enabled", harness, path: path73, inserted };
+  return { outcome: "enabled", harness, path: path74, inserted };
 }
 function plannedEdit(text3, existing, harness) {
   const array2 = findValueSpan(text3, "harnesses", "[");
@@ -132103,8 +132430,8 @@ var init_enable_harness = __esm({
 import { readFileSync as readFileSync10 } from "node:fs";
 import { join as join31 } from "node:path";
 function declareClaudeOnlySkill(repoRoot, entry) {
-  const path73 = HARNESS_MANIFEST_PATH;
-  const abs = join31(repoRoot, path73);
+  const path74 = HARNESS_MANIFEST_PATH;
+  const abs = join31(repoRoot, path74);
   const before = readFileSync10(abs, "utf8");
   let parsed;
   try {
@@ -132112,7 +132439,7 @@ function declareClaudeOnlySkill(repoRoot, entry) {
   } catch (err) {
     return {
       outcome: "unwritable",
-      path: path73,
+      path: path74,
       reason: `it is not valid JSON (${err instanceof Error ? err.message : String(err)})`
     };
   }
@@ -132120,10 +132447,10 @@ function declareClaudeOnlySkill(repoRoot, entry) {
   try {
     manifest = parseHarnessManifest(parsed);
   } catch (err) {
-    return { outcome: "unwritable", path: path73, reason: manifestSchemaReason(err) };
+    return { outcome: "unwritable", path: path74, reason: manifestSchemaReason(err) };
   }
   if (manifest.claudeOnlySkills.some((declared) => declared.name === entry.name)) {
-    return { outcome: "already-declared", path: path73 };
+    return { outcome: "already-declared", path: path74 };
   }
   const raw = parsed.claudeOnlySkills;
   const rawEntries = Array.isArray(raw) ? raw : [];
@@ -132132,7 +132459,7 @@ function declareClaudeOnlySkill(repoRoot, entry) {
   if (!edit) {
     return {
       outcome: "unwritable",
-      path: path73,
+      path: path74,
       reason: 'its "claudeOnlySkills" list could not be located in the file as written'
     };
   }
@@ -132140,12 +132467,12 @@ function declareClaudeOnlySkill(repoRoot, entry) {
   if (!isExactlyOneSkillDeclared(after, parsed, rawEntries, entry)) {
     return {
       outcome: "unwritable",
-      path: path73,
+      path: path74,
       reason: "recording the skill would have changed something else in the file"
     };
   }
   writeFileAtomic(abs, after);
-  return { outcome: "declared", path: path73, inserted };
+  return { outcome: "declared", path: path74, inserted };
 }
 function editAddingTheKey(text3, existing, entry) {
   const root = findRootObject(text3);
@@ -134132,14 +134459,14 @@ function ignoringLayer(layers, relPath2, leafKind) {
   }
   return decided;
 }
-function pathWithin(dir, path73) {
-  if (dir === "") return path73;
-  return path73.startsWith(`${dir}/`) ? path73.slice(dir.length + 1) : void 0;
+function pathWithin(dir, path74) {
+  if (dir === "") return path74;
+  return path74.startsWith(`${dir}/`) ? path74.slice(dir.length + 1) : void 0;
 }
 function gitignorePatternMatches(pattern, relPath2, leafKind = "file") {
   return isPathIgnored([pattern], relPath2, leafKind);
 }
-function decidePattern(pattern, path73, isDir) {
+function decidePattern(pattern, path74, isDir) {
   const trimmed = pattern.trim();
   if (trimmed === "" || trimmed.startsWith("#")) return void 0;
   const negated = trimmed.startsWith("!");
@@ -134152,7 +134479,7 @@ function decidePattern(pattern, path73, isDir) {
   if (body === "") return void 0;
   const anchored = !anyDepth && (rule.startsWith("/") || body.includes("/"));
   const prefix = anchored ? "^" : "^(?:.*/)?";
-  return new RegExp(`${prefix}${globToRegExpBody(body)}$`).test(path73) ? !negated : void 0;
+  return new RegExp(`${prefix}${globToRegExpBody(body)}$`).test(path74) ? !negated : void 0;
 }
 function globToRegExpBody(body) {
   let out = "";
@@ -134188,11 +134515,11 @@ function gitCheckoutRoot(projectRoot) {
     dir = parent;
   }
 }
-function physicalPath(path73) {
+function physicalPath(path74) {
   try {
-    return realpathSync8.native(path73);
+    return realpathSync8.native(path74);
   } catch {
-    return resolve4(path73);
+    return resolve4(path74);
   }
 }
 function projectPrefix(checkoutRoot, projectRoot) {
@@ -134249,7 +134576,7 @@ function ephemeralPaths(plan, repoRoot) {
     }
   }
   if (existsSync10(join32(repoRoot, PROJECT_PLUGINS_DIR))) paths2.set(INSTALL_ROOT_PROBE, "dir");
-  return [...paths2].map(([path73, kind]) => ({ path: path73, kind }));
+  return [...paths2].map(([path74, kind]) => ({ path: path74, kind }));
 }
 function onDiskKind(repoRoot, relPath2, fallback) {
   try {
@@ -134278,13 +134605,13 @@ function missingGitignoreLines(repoRoot, plan) {
   const checkout = checkoutContext(repoRoot);
   if (checkout === void 0) return [];
   const missing = /* @__PURE__ */ new Set();
-  for (const { path: path73, kind } of ephemeralPaths(plan, repoRoot)) {
-    if (ignoredBy(checkout.root, underPrefix(checkout.prefix, path73), kind) !== void 0) continue;
-    if (selfIgnored(plan, path73)) continue;
+  for (const { path: path74, kind } of ephemeralPaths(plan, repoRoot)) {
+    if (ignoredBy(checkout.root, underPrefix(checkout.prefix, path74), kind) !== void 0) continue;
+    if (selfIgnored(plan, path74)) continue;
     const covering = EPHEMERAL_GITIGNORE_PATTERNS.filter(
-      (pattern) => gitignorePatternMatches(pattern, path73, kind)
+      (pattern) => gitignorePatternMatches(pattern, path74, kind)
     );
-    if (covering.length === 0) missing.add(path73);
+    if (covering.length === 0) missing.add(path74);
     else for (const pattern of covering) missing.add(pattern);
   }
   const declared = EPHEMERAL_GITIGNORE_PATTERNS;
@@ -134463,10 +134790,10 @@ var init_read2 = __esm({
 // ../harness/src/apply/sweep-reasons.ts
 import { basename as basename4 } from "node:path";
 function explainSweep(paths2, cause) {
-  return paths2.map((path73) => ({ path: path73, reason: sweepReason(path73, cause) }));
+  return paths2.map((path74) => ({ path: path74, reason: sweepReason(path74, cause) }));
 }
-function sweepReason(path73, cause) {
-  if (cause === "command-wrapper" && isAtomicTempName(basename4(path73))) {
+function sweepReason(path74, cause) {
+  if (cause === "command-wrapper" && isAtomicTempName(basename4(path74))) {
     return SWEEP_REASONS["stale-temp"];
   }
   return SWEEP_REASONS[cause];
@@ -134543,10 +134870,10 @@ function partitionRemovable(repoRoot, paths2) {
   const removable = [];
   const warnings = [];
   const probed = /* @__PURE__ */ new Map();
-  for (const path73 of paths2) {
-    const absDir = unwritableParent(join34(repoRoot, path73), probed);
-    if (absDir === void 0) removable.push(path73);
-    else warnings.push(blockedRemovalWarning(path73, spell(repoRoot, absDir)));
+  for (const path74 of paths2) {
+    const absDir = unwritableParent(join34(repoRoot, path74), probed);
+    if (absDir === void 0) removable.push(path74);
+    else warnings.push(blockedRemovalWarning(path74, spell(repoRoot, absDir)));
   }
   return { removable, warnings };
 }
@@ -134624,8 +134951,8 @@ var init_authored_orphans = __esm({
 // ../harness/src/apply/symlink-occupants.ts
 import { readdirSync as readdirSync7, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync9, statSync as statSync8 } from "node:fs";
 import { basename as basename5, dirname as dirname10 } from "node:path";
-function withForwardSlashes(path73) {
-  return path73.split("\\").join("/");
+function withForwardSlashes(path74) {
+  return path74.split("\\").join("/");
 }
 function holdsOwnLinkText(absTarget, linkText) {
   try {
@@ -135272,7 +135599,7 @@ function applyPlan(repoRoot, plan, opts) {
   return {
     applied,
     conflicts,
-    swept: removals.map(({ path: path73 }) => path73),
+    swept: removals.map(({ path: path74 }) => path74),
     removals,
     leftAlone,
     // Three subjects, one list, and the junction one sits OUTSIDE the sweep
@@ -135390,7 +135717,7 @@ function checkPlan(repoRoot, plan) {
   return {
     drifted,
     blocked,
-    orphans: removals.map(({ path: path73 }) => path73),
+    orphans: removals.map(({ path: path74 }) => path74),
     removals,
     leftAlone: findLeftAloneGeneratedHookFiles(repoRoot, plan),
     // Not drift, and the first two are never an exit code either: a junction
@@ -135658,7 +135985,7 @@ function globalOrphanCandidates(plan, roots) {
 function findGlobalOrphans(plan, roots) {
   const orphans = globalOrphanCandidates(plan, roots);
   const removable = new Set(removableOf("", [...orphans.keys()]));
-  return [...orphans.entries()].filter(([path73]) => removable.has(path73)).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0).map(([path73, reason]) => ({ path: path73, reason }));
+  return [...orphans.entries()].filter(([path74]) => removable.has(path74)).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0).map(([path74, reason]) => ({ path: path74, reason }));
 }
 function findBlockedGlobalRemovals(plan, roots) {
   if (plan.unreadableRoot !== void 0) return [];
@@ -135669,7 +135996,7 @@ function rawGlobalOrphanPaths(plan, roots) {
 }
 function sweepGlobalOrphans(plan, roots) {
   const orphans = findGlobalOrphans(plan, roots);
-  for (const { path: path73 } of orphans) rmSync8(path73, { force: true });
+  for (const { path: path74 } of orphans) rmSync8(path74, { force: true });
   return orphans;
 }
 function globalLinkText(action) {
@@ -135771,7 +136098,7 @@ function applyGlobalPlan(plan, roots, opts) {
   return {
     applied,
     conflicts,
-    swept: removals.map(({ path: path73 }) => path73),
+    swept: removals.map(({ path: path74 }) => path74),
     removals,
     leftAlone: [],
     // A global run has no folder to be BLIND inside — `findGlobalOrphans` walks
@@ -135804,7 +136131,7 @@ function checkGlobalPlan(plan, roots) {
   return {
     drifted,
     blocked,
-    orphans: removals.map(({ path: path73 }) => path73),
+    orphans: removals.map(({ path: path74 }) => path74),
     removals,
     leftAlone: [],
     // The junction family cannot reach a global plan at all, and by nature
@@ -135974,16 +136301,16 @@ import {
   statSync as statSync10
 } from "node:fs";
 import { basename as basename7, isAbsolute as isAbsolute7, join as join42, relative as relative8, resolve as resolve7, sep as sep9 } from "node:path";
-function statOrUndefined(path73) {
+function statOrUndefined(path74) {
   try {
-    return statSync10(path73, { throwIfNoEntry: false });
+    return statSync10(path74, { throwIfNoEntry: false });
   } catch {
     return void 0;
   }
 }
-function lstatOrUndefined(path73) {
+function lstatOrUndefined(path74) {
   try {
-    return lstatSync14(path73, { throwIfNoEntry: false });
+    return lstatSync14(path74, { throwIfNoEntry: false });
   } catch {
     return void 0;
   }
@@ -136207,13 +136534,13 @@ function scanClaudeOnlySkills(repoRoot, manifest) {
   const resolved = /* @__PURE__ */ new Map();
   for (const entry of manifest.claudeOnlySkills) {
     const defaultPath = `${CLAUDE_SKILLS_DIR}/${entry.name}`;
-    const path73 = entry.path.trim() === "" ? defaultPath : entry.path;
-    const abs = join43(repoRoot, path73);
+    const path74 = entry.path.trim() === "" ? defaultPath : entry.path;
+    const abs = join43(repoRoot, path74);
     let kind = "missing";
     const stats2 = lstatSync15(abs, { throwIfNoEntry: false });
     if (stats2?.isSymbolicLink()) kind = "symlink";
     else if (stats2?.isDirectory() && existsSync15(join43(abs, "SKILL.md"))) kind = "directory";
-    resolved.set(entry.name, { path: path73, kind, atProjectionTarget: path73 === defaultPath });
+    resolved.set(entry.name, { path: path74, kind, atProjectionTarget: path74 === defaultPath });
   }
   return resolved;
 }
@@ -136862,9 +137189,9 @@ var init_harness_sync_allow_hooks = __esm({
 
 // ../../apps/server/src/services/harness/agents-user-home.ts
 import os8 from "os";
-import path47 from "path";
+import path48 from "path";
 function agentsUserSkillsDir() {
-  return path47.join(os8.homedir(), ".agents", "skills");
+  return path48.join(os8.homedir(), ".agents", "skills");
 }
 var init_agents_user_home = __esm({
   "../../apps/server/src/services/harness/agents-user-home.ts"() {
@@ -137098,7 +137425,7 @@ async function listSharing(dorkHome) {
 function removalLines(removals, about) {
   if (removals.length === 0) return [];
   const heading = about === "will" ? `Removing ${removals.length} link(s):` : `Removed ${removals.length} link(s):`;
-  return ["", heading, ...removals.map(({ path: path73, reason }) => `  ${path73} \u2014 ${reason}`)];
+  return ["", heading, ...removals.map(({ path: path74, reason }) => `  ${path74} \u2014 ${reason}`)];
 }
 async function enableTool(dorkHome, tool) {
   const {
@@ -137307,7 +137634,7 @@ function globalActionLine(action) {
 function removalPreview(removals, about) {
   if (removals.length === 0) return [];
   const heading = about === "will" ? `Removing ${removals.length} link(s):` : `Removed ${removals.length} link(s):`;
-  return ["", heading, ...removals.map(({ path: path73, reason }) => `  ${path73} \u2014 ${reason}`)];
+  return ["", heading, ...removals.map(({ path: path74, reason }) => `  ${path74} \u2014 ${reason}`)];
 }
 function linkNamesIn(plan) {
   return [...new Set(plan.actions.map((action) => action.name))];
@@ -137542,31 +137869,31 @@ var init_harness_sync_claude_only = __esm({
 // ../../apps/server/src/services/runtimes/claude-code/folder-settings/folder-config-scripts.ts
 import { createHash as createHash4 } from "node:crypto";
 import { lstatSync as lstatSync16, readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync11 } from "node:fs";
-import path48 from "node:path";
+import path49 from "node:path";
 function isInside4(base, target) {
-  const rel = path48.relative(base, target);
-  return rel !== "" && !rel.startsWith("..") && !path48.isAbsolute(rel);
+  const rel = path49.relative(base, target);
+  return rel !== "" && !rel.startsWith("..") && !path49.isAbsolute(rel);
 }
 function sha2562(content) {
   return createHash4("sha256").update(content).digest("hex");
 }
 function namedTargets(root, pluginsRoot, commands) {
   const found = /* @__PURE__ */ new Set();
-  const pluginSegment = `${path48.sep}.dork${path48.sep}plugins${path48.sep}`;
+  const pluginSegment = `${path49.sep}.dork${path49.sep}plugins${path49.sep}`;
   for (const command of commands) {
     const words = command.replace(/["']/g, "").replace(OUTPUT_REDIRECT, " ").replace(PROJECT_DIR_VAR, HOME_MARK).split(WORD_BREAK);
     for (const word of words) {
       if (!word) continue;
       if (word.startsWith(HOME_MARK)) {
-        const target = path48.join(root, word.slice(HOME_MARK.length).split(HOME_MARK).join(root));
+        const target = path49.join(root, word.slice(HOME_MARK.length).split(HOME_MARK).join(root));
         if (isInside4(root, target)) found.add(target);
-      } else if (path48.isAbsolute(word)) {
-        const target = path48.resolve(word);
+      } else if (path49.isAbsolute(word)) {
+        const target = path49.resolve(word);
         if (isInside4(root, target) || isInside4(pluginsRoot, target) || target.includes(pluginSegment)) {
           found.add(target);
         }
       } else if (!word.startsWith("~") && !word.startsWith("$") && !word.startsWith("-") && PATH_LIKE.test(word)) {
-        const target = path48.resolve(root, word);
+        const target = path49.resolve(root, word);
         if (isInside4(root, target)) found.add(target);
       }
     }
@@ -137574,7 +137901,7 @@ function namedTargets(root, pluginsRoot, commands) {
   return [...found];
 }
 function hookScriptFiles(home2, commands, dorkHome) {
-  const root = path48.resolve(home2);
+  const root = path49.resolve(home2);
   const entries = /* @__PURE__ */ new Map();
   let files = 0;
   const hash3 = (abs) => {
@@ -137617,7 +137944,7 @@ function hookScriptFiles(home2, commands, dorkHome) {
       return false;
     }
     for (const name2 of names) {
-      const child = path48.join(abs, name2);
+      const child = path49.join(abs, name2);
       let childStat;
       try {
         childStat = lstatSync16(child);
@@ -137628,15 +137955,15 @@ function hookScriptFiles(home2, commands, dorkHome) {
     }
     return true;
   };
-  if (!walk(path48.join(root, ".claude", "hooks"), 1)) return void 0;
-  for (const target of namedTargets(root, path48.resolve(dorkHome, "plugins"), commands)) {
+  if (!walk(path49.join(root, ".claude", "hooks"), 1)) return void 0;
+  for (const target of namedTargets(root, path49.resolve(dorkHome, "plugins"), commands)) {
     if (!hash3(target)) return void 0;
   }
   return sortedByPath(root, entries);
 }
 function sortedByPath(root, entries) {
   return [...entries].map(([abs, value]) => [
-    isInside4(root, abs) ? path48.relative(root, abs).split(path48.sep).join("/") : abs,
+    isInside4(root, abs) ? path49.relative(root, abs).split(path49.sep).join("/") : abs,
     value
   ]).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0);
 }
@@ -137654,7 +137981,7 @@ function pickAgentFileFields(text3) {
   }
 }
 function agentFileHooks(home2) {
-  const root = path48.resolve(home2);
+  const root = path49.resolve(home2);
   const entries = /* @__PURE__ */ new Map();
   let files = 0;
   const read = (abs) => {
@@ -137690,7 +138017,7 @@ function agentFileHooks(home2) {
     if (names === null) return true;
     if (names === void 0) return false;
     for (const name2 of names) {
-      const child = path48.join(abs, name2);
+      const child = path49.join(abs, name2);
       const sub = listDir2(child);
       if (sub !== void 0 && sub !== null) {
         if (!walkAgents(child, depth + 1)) return false;
@@ -137700,14 +138027,14 @@ function agentFileHooks(home2) {
     }
     return true;
   };
-  if (!walkAgents(path48.join(root, ".claude", "agents"), 1)) return void 0;
-  if (!walkAgents(path48.join(root, ".claude", "commands"), 1)) return void 0;
-  const skillsDir = path48.join(root, ".claude", "skills");
+  if (!walkAgents(path49.join(root, ".claude", "agents"), 1)) return void 0;
+  if (!walkAgents(path49.join(root, ".claude", "commands"), 1)) return void 0;
+  const skillsDir = path49.join(root, ".claude", "skills");
   const skills = listDir2(skillsDir);
   if (skills === void 0) return void 0;
   for (const name2 of skills ?? []) {
-    if (!read(path48.join(skillsDir, name2, "SKILL.md"))) {
-      if (listDir2(path48.join(skillsDir, name2)) !== void 0) return void 0;
+    if (!read(path49.join(skillsDir, name2, "SKILL.md"))) {
+      if (listDir2(path49.join(skillsDir, name2)) !== void 0) return void 0;
     }
   }
   return sortedByPath(root, entries);
@@ -137741,10 +138068,10 @@ var init_folder_config_scripts = __esm({
 // ../../apps/server/src/services/harness/hook-script-pins.ts
 import { createHash as createHash5 } from "node:crypto";
 import { readFileSync as readFileSync22, statSync as statSync12 } from "node:fs";
-import path49 from "node:path";
+import path50 from "node:path";
 function isInside5(base, target) {
-  const rel = path49.relative(base, target);
-  return rel !== "" && !rel.startsWith("..") && !path49.isAbsolute(rel);
+  const rel = path50.relative(base, target);
+  return rel !== "" && !rel.startsWith("..") && !path50.isAbsolute(rel);
 }
 function fileFingerprint(abs) {
   let stat5;
@@ -137763,10 +138090,10 @@ function fileFingerprint(abs) {
   }
 }
 function hookScriptPins(projectPath, commands, dorkHome) {
-  const root = path49.resolve(projectPath);
+  const root = path50.resolve(projectPath);
   const local = commands.map((command) => command.replace(URL_WORD, " "));
-  return namedTargets(root, path49.resolve(dorkHome, "plugins"), local).map((abs) => [
-    isInside5(root, abs) ? path49.relative(root, abs).split(path49.sep).join("/") : abs,
+  return namedTargets(root, path50.resolve(dorkHome, "plugins"), local).map((abs) => [
+    isInside5(root, abs) ? path50.relative(root, abs).split(path50.sep).join("/") : abs,
     fileFingerprint(abs)
   ]).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0);
 }
@@ -137783,7 +138110,7 @@ var init_hook_script_pins = __esm({
 // ../../apps/server/src/services/runtimes/claude-code/folder-settings/folder-config-pin.ts
 import { createHash as createHash6 } from "node:crypto";
 import { readFileSync as readFileSync23, statSync as statSync13 } from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 function readJsonFile2(file2) {
   let size;
   try {
@@ -137852,7 +138179,7 @@ function hooksPart(home2, dorkHome) {
   let verifiable = true;
   const commands = [];
   for (const name2 of SETTINGS_FILES) {
-    const read = readJsonFile2(path50.join(home2, ".claude", name2));
+    const read = readJsonFile2(path51.join(home2, ".claude", name2));
     if (read.kind === "unverifiable") verifiable = false;
     const picked = read.kind === "parsed" ? pick2(read.value, CODE_SETTINGS_KEYS) : void 0;
     if (picked !== void 0) collectCommands2(picked, commands);
@@ -137880,13 +138207,13 @@ function collectCommands2(value, out) {
   }
 }
 function mcpJsonPart(home2) {
-  const read = readJsonFile2(path50.join(home2, ".mcp.json"));
+  const read = readJsonFile2(path51.join(home2, ".mcp.json"));
   if (read.kind === "unverifiable") return { value: { unverifiable: true }, verifiable: false };
   if (read.kind === "malformed") return { value: malformed(read.text), verifiable: true };
   return { value: read.kind === "parsed" ? read.value : null, verifiable: true };
 }
 function manifestPart(home2) {
-  const read = readJsonFile2(path50.join(home2, ".dork", "agent.json"));
+  const read = readJsonFile2(path51.join(home2, ".dork", "agent.json"));
   if (read.kind === "unverifiable") return { value: { unverifiable: true }, verifiable: false };
   if (read.kind === "malformed") return { value: malformed(read.text), verifiable: true };
   if (read.kind === "absent") return { value: null, verifiable: true };
@@ -137988,14 +138315,14 @@ var init_folder_config_pin = __esm({
 // ../../apps/server/src/services/runtimes/claude-code/folder-settings/folder-config-consent.ts
 import { createHash as createHash7 } from "node:crypto";
 import { realpathSync as realpathSync12 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 function folderConfigEntry(state) {
   const parts = Object.fromEntries(FOLDER_CONFIG_PARTS.map((p) => [p, state.digests[p]]));
   const digest2 = createHash7("sha256").update(JSON.stringify({ home: canonicalHome2(state.home), parts })).digest("hex");
   return `${state.agentId}${FOLDER_CONFIG_ENTRY_MARKER}${digest2}`;
 }
 function canonicalHome2(home2) {
-  const resolved = path51.resolve(home2);
+  const resolved = path52.resolve(home2);
   try {
     return realpathSync12.native(resolved);
   } catch {
@@ -138295,11 +138622,11 @@ var init_atomic_write2 = __esm({
 });
 
 // ../../apps/server/src/services/marketplace/lib/package-paths.ts
-import path52 from "node:path";
+import path53 from "node:path";
 function assertContainedIn(root, candidate) {
-  const resolvedRoot = path52.resolve(root);
-  const resolved = path52.resolve(candidate);
-  if (!resolved.startsWith(resolvedRoot + path52.sep)) {
+  const resolvedRoot = path53.resolve(root);
+  const resolved = path53.resolve(candidate);
+  if (!resolved.startsWith(resolvedRoot + path53.sep)) {
     throw new PathEscapeError(root, candidate);
   }
   return candidate;
@@ -138468,13 +138795,13 @@ function subpathDigest(subpath) {
   if (subpath === "") return "";
   return createHash8("sha256").update(subpath).digest("hex").slice(0, 12);
 }
-async function stampUsed(path73) {
+async function stampUsed(path74) {
   const now3 = /* @__PURE__ */ new Date();
   try {
-    await utimes(path73, now3, now3);
+    await utimes(path74, now3, now3);
     return now3;
   } catch {
-    return (await stat2(path73)).mtime;
+    return (await stat2(path74)).mtime;
   }
 }
 function parsePackageDirName(entry) {
@@ -138715,14 +139042,14 @@ var init_marketplace_cache = __esm({
        * @returns A descriptor when a non-empty entry is present, `null` otherwise.
        */
       async getPackage(packageName, commitSha, subpath) {
-        const path73 = this.packageDir(packageName, commitSha, subpath);
-        const usedAt = await this.stampIfPresent(path73);
+        const path74 = this.packageDir(packageName, commitSha, subpath);
+        const usedAt = await this.stampIfPresent(path74);
         if (usedAt === null) return null;
         return {
           packageName,
           commitSha,
           subpathDigest: subpathDigest(subpath),
-          path: path73,
+          path: path74,
           lastUsedAt: usedAt
         };
       }
@@ -138914,10 +139241,10 @@ var init_marketplace_cache = __esm({
        * @returns When it was stamped, or `null` when there is no valid entry.
        * @internal
        */
-      stampIfPresent(path73) {
+      stampIfPresent(path74) {
         return this.exclusive(async () => {
-          if (!await isNonEmptyDir(path73)) return null;
-          return stampUsed(path73);
+          if (!await isNonEmptyDir(path74)) return null;
+          return stampUsed(path74);
         });
       }
       /**
@@ -138955,9 +139282,9 @@ var init_marketplace_cache = __esm({
           if (!parsed) {
             continue;
           }
-          const path73 = join51(root, entry);
+          const path74 = join51(root, entry);
           try {
-            const info2 = await stat2(path73);
+            const info2 = await stat2(path74);
             if (!info2.isDirectory()) {
               continue;
             }
@@ -138965,7 +139292,7 @@ var init_marketplace_cache = __esm({
               packageName: parsed.packageName,
               commitSha: parsed.commitSha,
               subpathDigest: parsed.subpathDigest,
-              path: path73,
+              path: path74,
               lastUsedAt: info2.mtime
             });
           } catch {
@@ -139333,7 +139660,7 @@ __export(claude_enabled_plugins_exports, {
   readClaudeOnlyPlugins: () => readClaudeOnlyPlugins
 });
 import { readFile as readFile5 } from "node:fs/promises";
-import path53 from "node:path";
+import path54 from "node:path";
 function causeOf(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -139432,7 +139759,7 @@ function splitPluginKey(key) {
 }
 async function readDorkosSources(dorkHome) {
   let sources2;
-  const sourcesPath = path53.join(dorkHome, "marketplaces.json");
+  const sourcesPath = path54.join(dorkHome, "marketplaces.json");
   try {
     sources2 = await new MarketplaceSourceManager(dorkHome).list();
   } catch {
@@ -139468,7 +139795,7 @@ function classifyOffer(repo, name2, dorkos) {
 async function readClaudeOnlyPlugins(input4) {
   const { claudeRoot, projectPath, dorkHome } = input4;
   const base = { root: claudeRoot, readAt: (/* @__PURE__ */ new Date()).toISOString(), mayBeOverridden: true };
-  const user2 = await readSettingsSlice(path53.join(claudeRoot, "settings.json"));
+  const user2 = await readSettingsSlice(path54.join(claudeRoot, "settings.json"));
   if (user2.slice === void 0) {
     return {
       ...base,
@@ -139478,8 +139805,8 @@ async function readClaudeOnlyPlugins(input4) {
       personalHookCommands: 0
     };
   }
-  const project2 = await readSettingsSlice(path53.join(projectPath, ".claude", "settings.json"));
-  const local = await readSettingsSlice(path53.join(projectPath, ".claude", "settings.local.json"));
+  const project2 = await readSettingsSlice(path54.join(projectPath, ".claude", "settings.json"));
+  const local = await readSettingsSlice(path54.join(projectPath, ".claude", "settings.local.json"));
   const merged = mergeSettings([user2.slice, project2.slice ?? {}, local.slice ?? {}]);
   const hooks = countHookCommands(user2.slice.hooks);
   const partial2 = {
@@ -139621,9 +139948,9 @@ function parseHarnessSyncArgs(rawArgs) {
   };
 }
 function formatAction2(action) {
-  const path73 = action.target ?? action.source ?? "(no path)";
+  const path74 = action.target ?? action.source ?? "(no path)";
   const note = action.reason ? ` \u2014 ${action.reason}` : "";
-  return `  [${action.kind}] ${action.artifact} "${action.name}" -> ${path73}  (${action.harness})${note}`;
+  return `  [${action.kind}] ${action.artifact} "${action.name}" -> ${path74}  (${action.harness})${note}`;
 }
 function formatAdoptable(repoRoot, manifest) {
   const { candidates } = readAdoptCandidates(repoRoot, inventorySourceTree(repoRoot), manifest);
@@ -139649,26 +139976,26 @@ function formatAutoAdoptInert(inert) {
   return inert ? ["", ADOPT_SENTENCES.S8()] : [];
 }
 function formatLeftAlone(leftAlone, manifest, harnessFilter) {
-  const shown2 = harnessFilter ? leftAlone.filter((path73) => harnessOf(path73) === harnessFilter) : leftAlone;
+  const shown2 = harnessFilter ? leftAlone.filter((path74) => harnessOf(path74) === harnessFilter) : leftAlone;
   if (shown2.length === 0) return [];
   const stopped = new Set(pluginHookReach(manifest).suppressed.map((s2) => s2.harness));
-  const carried = shown2.filter((path73) => {
-    const harness = harnessOf(path73);
+  const carried = shown2.filter((path74) => {
+    const harness = harnessOf(path74);
     return harness === void 0 || !stopped.has(harness);
   });
   return [
     "",
     "Left alone \u2014 files DorkOS did not write, at paths it would otherwise generate:",
-    ...shown2.map((path73) => {
-      const harness = harnessOf(path73);
+    ...shown2.map((path74) => {
+      const harness = harnessOf(path74);
       const note = harness && stopped.has(harness) ? " \u2014 your manifest's hookPolicies says not to write here" : "";
-      return `  ${path73}  (${harness})${note}`;
+      return `  ${path74}  (${harness})${note}`;
     }),
     carried.length > 0 ? "  Nothing to fix. Put these hooks in .claude/settings.json if you want DorkOS to carry them to every harness." : "  Nothing to fix, and nothing to move: your manifest tells DorkOS not to write these files."
   ];
 }
-function harnessOf(path73) {
-  return GENERATED_HOOK_TARGET_HARNESSES[path73];
+function harnessOf(path74) {
+  return GENERATED_HOOK_TARGET_HARNESSES[path74];
 }
 function summarizeActions(actions, withheld, enabled3) {
   const withheldLine = withheldSummaryLine(withheld);
@@ -139766,8 +140093,8 @@ function formatIgnoredCanonicalLayer(repoRoot) {
     "  on purpose."
   ];
 }
-function orphanLine({ path: path73, reason }) {
-  return `  ${path73} \u2014 ${reason}`;
+function orphanLine({ path: path74, reason }) {
+  return `  ${path74} \u2014 ${reason}`;
 }
 function reportCheck(repoRoot, plan, withheld, dorkHome, manifest, claudeOnly, autoAdoptInert, harnessFilter) {
   const drift = checkPlan(repoRoot, plan);
@@ -140487,8 +140814,8 @@ Examples:
 });
 
 // src/lib/api-client.ts
-import fs24 from "node:fs";
-import path54 from "node:path";
+import fs25 from "node:fs";
+import path55 from "node:path";
 function getServerBaseUrl() {
   const envPort = process.env.DORKOS_PORT;
   if (envPort && /^\d+$/.test(envPort)) {
@@ -140500,7 +140827,7 @@ function getServerBaseUrl() {
 function readConfigPort() {
   const dorkHome = resolveDorkHome2();
   try {
-    const raw = fs24.readFileSync(path54.join(dorkHome, "config.json"), "utf-8");
+    const raw = fs25.readFileSync(path55.join(dorkHome, "config.json"), "utf-8");
     const config3 = JSON.parse(raw);
     const port2 = config3?.server?.port;
     if (typeof port2 === "number" && port2 > 0) return port2;
@@ -140513,13 +140840,13 @@ function agentIdentityHeaders() {
   return token ? { "X-DorkOS-Agent": token } : {};
 }
 function apiKeyFilePath() {
-  return path54.join(resolveDorkHome2(), API_KEY_FILE_NAME);
+  return path55.join(resolveDorkHome2(), API_KEY_FILE_NAME);
 }
 function resolveApiKey() {
   const fromEnv = process.env[API_KEY_ENV_VAR]?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const fromFile = fs24.readFileSync(apiKeyFilePath(), "utf-8").trim();
+    const fromFile = fs25.readFileSync(apiKeyFilePath(), "utf-8").trim();
     if (fromFile) return fromFile;
   } catch {
   }
@@ -141507,8 +141834,8 @@ var init_contracts = __esm({
 // ../browser/src/runtime/installation/filesystem.ts
 import { createHash as createHash10, randomUUID as randomUUID5 } from "node:crypto";
 import { constants as constants5 } from "node:fs";
-import * as fs25 from "node:fs/promises";
-import path55 from "node:path";
+import * as fs26 from "node:fs/promises";
+import path56 from "node:path";
 function requireFact(value, code) {
   if (!value) throw new InstallationFailure(code);
 }
@@ -141629,16 +141956,16 @@ var init_filesystem = __esm({
       }
       async ancestors(name2, missing = false) {
         requireFact(
-          path55.isAbsolute(name2) && path55.normalize(name2) === name2,
+          path56.isAbsolute(name2) && path56.normalize(name2) === name2,
           "INVALID_INSTALL_CONFIGURATION"
         );
         const result2 = [];
-        let current3 = path55.parse(name2).root;
-        const parts = path55.relative(current3, name2).split(path55.sep).filter(Boolean);
+        let current3 = path56.parse(name2).root;
+        const parts = path56.relative(current3, name2).split(path56.sep).filter(Boolean);
         for (const part of ["", ...parts]) {
-          if (part) current3 = path55.join(current3, part);
+          if (part) current3 = path56.join(current3, part);
           try {
-            const stat5 = await fs25.lstat(current3, { bigint: true });
+            const stat5 = await fs26.lstat(current3, { bigint: true });
             this.directorySecure(stat5);
             result2.push({ path: current3, identity: identity(stat5) });
           } catch (error63) {
@@ -141650,7 +141977,7 @@ var init_filesystem = __esm({
       }
       async recheckParents(parents) {
         for (const parent of parents) {
-          const stat5 = await fs25.lstat(parent.path, { bigint: true });
+          const stat5 = await fs26.lstat(parent.path, { bigint: true });
           this.directorySecure(stat5);
           requireFact(directoryIdentity(parent.identity, identity(stat5)), "ROOT_CHANGED");
         }
@@ -141659,7 +141986,7 @@ var init_filesystem = __esm({
         const duty = { path: name2, original: null, state: "acquiring", lease };
         this.duties.add(duty);
         try {
-          duty.original = await fs25.open(name2, flags, mode);
+          duty.original = await fs26.open(name2, flags, mode);
           duty.state = "open";
           return duty;
         } catch (error63) {
@@ -141727,7 +142054,7 @@ var init_filesystem = __esm({
         }
       }
       async checkDirectory(directory) {
-        const named3 = identity(await fs25.lstat(directory.path, { bigint: true }));
+        const named3 = identity(await fs26.lstat(directory.path, { bigint: true }));
         const held2 = identity(await directory.handle.stat({ bigint: true }));
         requireFact(
           directoryIdentity(directory.identity, named3) && directoryIdentity(named3, held2),
@@ -141743,41 +142070,41 @@ var init_filesystem = __esm({
         });
       }
       async ensureDirectories(name2) {
-        let current3 = path55.parse(name2).root;
-        for (const part of path55.relative(current3, name2).split(path55.sep).filter(Boolean)) {
+        let current3 = path56.parse(name2).root;
+        for (const part of path56.relative(current3, name2).split(path56.sep).filter(Boolean)) {
           const parent = current3;
-          current3 = path55.join(current3, part);
+          current3 = path56.join(current3, part);
           try {
-            this.directorySecure(await fs25.lstat(current3, { bigint: true }));
+            this.directorySecure(await fs26.lstat(current3, { bigint: true }));
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
             await this.ancestors(parent);
             try {
-              await fs25.mkdir(current3, { mode: 448 });
+              await fs26.mkdir(current3, { mode: 448 });
             } catch (mkdirError) {
               if (!isExists(mkdirError)) throw mkdirError;
             }
-            this.directorySecure(await fs25.lstat(current3, { bigint: true }));
+            this.directorySecure(await fs26.lstat(current3, { bigint: true }));
             await this.syncDirectory(current3);
             await this.syncDirectory(parent);
           }
         }
       }
       async exclusiveDirectory(name2) {
-        await this.ancestors(path55.dirname(name2));
-        await fs25.mkdir(name2, { mode: 448 });
-        const stat5 = await fs25.lstat(name2, { bigint: true });
+        await this.ancestors(path56.dirname(name2));
+        await fs26.mkdir(name2, { mode: 448 });
+        const stat5 = await fs26.lstat(name2, { bigint: true });
         this.directorySecure(stat5);
         requireFact(
           Number(stat5.uid) === process.getuid?.() && (Number(stat5.mode) & 63) === 0,
           "OWNERSHIP_UNCERTAIN"
         );
         await this.syncDirectory(name2);
-        await this.syncDirectory(path55.dirname(name2));
+        await this.syncDirectory(path56.dirname(name2));
       }
       async read(name2, cap, retain = 0) {
-        const parents = await this.ancestors(path55.dirname(name2));
-        const named3 = identity(await fs25.lstat(name2, { bigint: true }));
+        const parents = await this.ancestors(path56.dirname(name2));
+        const named3 = identity(await fs26.lstat(name2, { bigint: true }));
         requireFact(named3.type === "file" && BigInt(named3.size) <= BigInt(cap), "INSTALLATION_INVALID");
         const duty = await this.acquire(
           name2,
@@ -141807,7 +142134,7 @@ var init_filesystem = __esm({
             }
           }
           requireFact(
-            bytes === Number(acquired.size) && sameFileIdentity(acquired, identity(await handle.stat({ bigint: true }))) && sameFileIdentity(acquired, identity(await fs25.lstat(name2, { bigint: true }))),
+            bytes === Number(acquired.size) && sameFileIdentity(acquired, identity(await handle.stat({ bigint: true }))) && sameFileIdentity(acquired, identity(await fs26.lstat(name2, { bigint: true }))),
             "ROOT_CHANGED"
           );
           await this.recheckParents(parents);
@@ -141823,7 +142150,7 @@ var init_filesystem = __esm({
         this.duties.add(duty);
         return this.closeAfter([duty, directory.duty], async () => {
           try {
-            duty.original = await fs25.opendir(name2, { bufferSize: 1 });
+            duty.original = await fs26.opendir(name2, { bufferSize: 1 });
             duty.state = "open";
           } catch (error63) {
             duty.state = "uncertain";
@@ -141845,27 +142172,27 @@ var init_filesystem = __esm({
         });
       }
       async libraryBinMetadata(root, directory) {
-        const parents = await this.ancestors(directory), bins = path55.join(directory, ".bin");
-        const before = identity(await fs25.lstat(directory, { bigint: true }));
+        const parents = await this.ancestors(directory), bins = path56.join(directory, ".bin");
+        const before = identity(await fs26.lstat(directory, { bigint: true }));
         requireFact(
           (await this.names(directory, INSTALLATION_LIMITS.libraryEntries)).join(",") === ".bin",
           "LIBRARY_MISMATCH"
         );
-        const binParents = await this.ancestors(bins), binBefore = identity(await fs25.lstat(bins, { bigint: true }));
+        const binParents = await this.ancestors(bins), binBefore = identity(await fs26.lstat(bins, { bigint: true }));
         requireFact(
           (await this.names(bins, INSTALLATION_LIMITS.libraryEntries)).join(",") === "playwright-core",
           "LIBRARY_MISMATCH"
         );
-        const shim = path55.join(bins, "playwright-core"), stat5 = await fs25.lstat(shim, { bigint: true });
+        const shim = path56.join(bins, "playwright-core"), stat5 = await fs26.lstat(shim, { bigint: true });
         if (stat5.isSymbolicLink()) {
-          const link3 = await fs25.readlink(shim);
+          const link3 = await fs26.readlink(shim);
           requireFact(
-            Buffer.byteLength(link3) <= INSTALLATION_LIMITS.bufferBytes && await fs25.realpath(shim) === path55.join(root, "cli.js"),
+            Buffer.byteLength(link3) <= INSTALLATION_LIMITS.bufferBytes && await fs26.realpath(shim) === path56.join(root, "cli.js"),
             "LIBRARY_MISMATCH"
           );
-          const after = await fs25.lstat(shim, { bigint: true });
+          const after = await fs26.lstat(shim, { bigint: true });
           requireFact(
-            after.isSymbolicLink() && stat5.dev === after.dev && stat5.ino === after.ino && stat5.size === after.size && stat5.mode === after.mode && stat5.uid === after.uid && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs25.readlink(shim),
+            after.isSymbolicLink() && stat5.dev === after.dev && stat5.ino === after.ino && stat5.size === after.size && stat5.mode === after.mode && stat5.uid === after.uid && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs26.readlink(shim),
             "ROOT_CHANGED"
           );
         } else {
@@ -141874,7 +142201,7 @@ var init_filesystem = __esm({
           requireFact(sameFileIdentity(identity(stat5), read.file.identity), "ROOT_CHANGED");
         }
         requireFact(
-          sameFileIdentity(before, identity(await fs25.lstat(directory, { bigint: true }))) && sameFileIdentity(binBefore, identity(await fs25.lstat(bins, { bigint: true }))),
+          sameFileIdentity(before, identity(await fs26.lstat(directory, { bigint: true }))) && sameFileIdentity(binBefore, identity(await fs26.lstat(bins, { bigint: true }))),
           "ROOT_CHANGED"
         );
         await this.recheckParents(binParents);
@@ -141887,19 +142214,19 @@ var init_filesystem = __esm({
         const totalLimit = library ? INSTALLATION_LIMITS.libraryBytes : INSTALLATION_LIMITS.payloadBytes;
         const visit2 = async (directory, depth) => {
           requireFact(depth <= INSTALLATION_LIMITS.payloadDepth, "RETENTION_EXCEEDED");
-          const dirIdentity = identity(await fs25.lstat(directory, { bigint: true }));
+          const dirIdentity = identity(await fs26.lstat(directory, { bigint: true }));
           requireFact(dirIdentity.type === "directory", "ROOT_CHANGED");
           result2.directories.push({ path: directory, identity: dirIdentity });
           result2.rows.push({
-            path: path55.relative(root, directory).split(path55.sep).join("/"),
+            path: path56.relative(root, directory).split(path56.sep).join("/"),
             type: "directory",
             identity: dirIdentity
           });
           for (const name2 of await this.names(directory, entryLimit)) {
             requireFact(++result2.entries <= entryLimit, "RETENTION_EXCEEDED");
-            const absolute = path55.join(directory, name2), relative12 = path55.relative(root, absolute).split(path55.sep).join("/");
+            const absolute = path56.join(directory, name2), relative12 = path56.relative(root, absolute).split(path56.sep).join("/");
             requireFact(relativePath.safeParse(relative12).success, "INSTALLATION_INVALID");
-            const stat5 = await fs25.lstat(absolute, { bigint: true });
+            const stat5 = await fs26.lstat(absolute, { bigint: true });
             if (library && relative12 === "node_modules") {
               requireFact(stat5.isDirectory() && !stat5.isSymbolicLink(), "LIBRARY_MISMATCH");
               await this.libraryBinMetadata(root, absolute);
@@ -141907,13 +142234,13 @@ var init_filesystem = __esm({
             }
             if (stat5.isSymbolicLink()) {
               requireFact(!library, "LIBRARY_MISMATCH");
-              const link3 = await fs25.readlink(absolute), resolved = await fs25.realpath(absolute);
-              requireFact(resolved.startsWith(root + path55.sep), "ROOT_CHANGED");
-              const target = await fs25.stat(resolved, { bigint: true });
+              const link3 = await fs26.readlink(absolute), resolved = await fs26.realpath(absolute);
+              requireFact(resolved.startsWith(root + path56.sep), "ROOT_CHANGED");
+              const target = await fs26.stat(resolved, { bigint: true });
               requireFact(target.isFile() || target.isDirectory(), "ROOT_CHANGED");
-              const after = await fs25.lstat(absolute, { bigint: true });
+              const after = await fs26.lstat(absolute, { bigint: true });
               requireFact(
-                stat5.dev === after.dev && stat5.ino === after.ino && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs25.readlink(absolute),
+                stat5.dev === after.dev && stat5.ino === after.ino && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs26.readlink(absolute),
                 "ROOT_CHANGED"
               );
               result2.rows.push({
@@ -141946,7 +142273,7 @@ var init_filesystem = __esm({
             }
           }
           requireFact(
-            sameFileIdentity(dirIdentity, identity(await fs25.lstat(directory, { bigint: true }))),
+            sameFileIdentity(dirIdentity, identity(await fs26.lstat(directory, { bigint: true }))),
             "ROOT_CHANGED"
           );
         };
@@ -141983,13 +142310,13 @@ var init_filesystem = __esm({
             (a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0
           ))
             distribution.update(
-              path55.relative(this.configuration.libraryRoot, file2.path).split(path55.sep).join("/") + "\0" + file2.sha256 + "\n"
+              path56.relative(this.configuration.libraryRoot, file2.path).split(path56.sep).join("/") + "\0" + file2.sha256 + "\n"
             );
           const distributionSHA256 = distribution.digest("hex");
           requireFact(distributionSHA256 === INSTALLATION_TARGET.libraryDistributionSHA256, "LIBRARY_MISMATCH");
           const find = (name2) => {
             const file2 = tree.files.find(
-              (f3) => f3.path === path55.join(this.configuration.libraryRoot, name2)
+              (f3) => f3.path === path56.join(this.configuration.libraryRoot, name2)
             );
             requireFact(file2, "LIBRARY_MISMATCH");
             return file2;
@@ -142070,7 +142397,7 @@ var init_filesystem = __esm({
           requireFact(!this.active || this.active.state === "released", "PUBLICATION_BUSY");
           await this.ensureDirectories(this.configuration.cacheRoot);
           const root = await this.directory(this.configuration.cacheRoot);
-          const name2 = path55.join(root.path, "reservation");
+          const name2 = path56.join(root.path, "reservation");
           try {
             await this.exclusiveDirectory(name2);
           } catch (error63) {
@@ -142122,7 +142449,7 @@ var init_filesystem = __esm({
           directory.duty.lease = true;
           try {
             reservation.ownerFile = await this.atomicRecord(
-              path55.join(name2, "owner.json"),
+              path56.join(name2, "owner.json"),
               owner,
               INSTALLATION_LIMITS.journalBytes,
               false
@@ -142142,43 +142469,43 @@ var init_filesystem = __esm({
           await this.checkReservation(reservation);
           this.checkEnd(reservation);
           requireFact(reservation.attempt === null, "BINDING_MISMATCH");
-          const parent = path55.join(this.configuration.cacheRoot, "attempts");
+          const parent = path56.join(this.configuration.cacheRoot, "attempts");
           await this.ensureDirectories(parent);
-          const root = path55.join(parent, handle.binding.attemptId);
+          const root = path56.join(parent, handle.binding.attemptId);
           await this.exclusiveDirectory(root);
           for (const child of ["home", "tmp", "diagnostics"])
-            await this.exclusiveDirectory(path55.join(root, child));
+            await this.exclusiveDirectory(path56.join(root, child));
           await this.syncDirectory(root);
           await this.syncDirectory(parent);
-          const stat5 = identity(await fs25.lstat(root, { bigint: true }));
+          const stat5 = identity(await fs26.lstat(root, { bigint: true }));
           const attempt = Object.freeze({
             kind: "installation-attempt",
             binding: handle.binding,
             attemptRoot: root,
-            homeRoot: path55.join(root, "home"),
-            temporaryRoot: path55.join(root, "tmp"),
+            homeRoot: path56.join(root, "home"),
+            temporaryRoot: path56.join(root, "tmp"),
             identity: stat5
           });
           this.attempts.set(attempt, {
             reservation,
             handle: attempt,
-            diagnostics: path55.join(root, "diagnostics")
+            diagnostics: path56.join(root, "diagnostics")
           });
           reservation.attempt = attempt;
           return attempt;
         });
       }
       async atomicRecord(name2, record2, cap, replace) {
-        const bytes = recordBytes(record2, cap), parent = path55.dirname(name2), parents = await this.ancestors(parent);
+        const bytes = recordBytes(record2, cap), parent = path56.dirname(name2), parents = await this.ancestors(parent);
         if (!replace) {
           try {
-            await fs25.lstat(name2);
+            await fs26.lstat(name2);
             throw new InstallationFailure("RECORD_FAILED");
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
           }
         }
-        const temporary = path55.join(parent, ".installation-" + randomUUID5() + ".tmp");
+        const temporary = path56.join(parent, ".installation-" + randomUUID5() + ".tmp");
         const duty = await this.acquire(
           temporary,
           constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW
@@ -142197,7 +142524,7 @@ var init_filesystem = __esm({
           requireFact(
             sameFileIdentity(
               identity(await handle.stat({ bigint: true })),
-              identity(await fs25.lstat(temporary, { bigint: true }))
+              identity(await fs26.lstat(temporary, { bigint: true }))
             ),
             "ROOT_CHANGED"
           );
@@ -142205,14 +142532,14 @@ var init_filesystem = __esm({
         });
         if (!replace) {
           try {
-            await fs25.lstat(name2);
+            await fs26.lstat(name2);
             throw new InstallationFailure("RECORD_FAILED");
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
           }
         }
         await this.recheckParents(parents);
-        await fs25.rename(temporary, name2);
+        await fs26.rename(temporary, name2);
         await this.syncDirectory(parent);
         const result2 = await this.read(name2, cap, cap);
         requireFact(result2.file.sha256 === sha2564(bytes), "RECORD_FAILED");
@@ -142238,7 +142565,7 @@ var init_filesystem = __esm({
           await this.checkReservation(reservation);
           this.checkEnd(reservation);
           const old = await this.read(
-            path55.join(reservation.directory.path, "owner.json"),
+            path56.join(reservation.directory.path, "owner.json"),
             INSTALLATION_LIMITS.journalBytes,
             INSTALLATION_LIMITS.journalBytes
           );
@@ -142261,11 +142588,11 @@ var init_filesystem = __esm({
           requireFact(reservation.candidate === null, "BINDING_MISMATCH");
           await this.checkReservation(reservation);
           this.checkEnd(reservation);
-          const parent = path55.join(this.configuration.cacheRoot, "candidates");
+          const parent = path56.join(this.configuration.cacheRoot, "candidates");
           await this.ensureDirectories(parent);
-          const candidateRoot = path55.join(parent, handle.binding.installationId);
+          const candidateRoot = path56.join(parent, handle.binding.installationId);
           await this.exclusiveDirectory(candidateRoot);
-          const payloadRoot = path55.join(candidateRoot, "payload");
+          const payloadRoot = path56.join(candidateRoot, "payload");
           await this.exclusiveDirectory(payloadRoot);
           const candidate = Object.freeze({
             kind: "installation-candidate",
@@ -142303,8 +142630,8 @@ var init_filesystem = __esm({
         });
       }
       async snapshot(installationId, candidateRoot) {
-        const payloadRoot = path55.join(candidateRoot, "payload"), tree = await this.tree(payloadRoot);
-        const executablePath = path55.join(candidateRoot, INSTALLATION_TARGET.executablePath);
+        const payloadRoot = path56.join(candidateRoot, "payload"), tree = await this.tree(payloadRoot);
+        const executablePath = path56.join(candidateRoot, INSTALLATION_TARGET.executablePath);
         const executable = await this.read(executablePath, INSTALLATION_LIMITS.executableBytes);
         const observed = tree.files.find((file2) => file2.path === executablePath);
         requireFact(
@@ -142341,7 +142668,7 @@ var init_filesystem = __esm({
       async current() {
         try {
           const value = await this.read(
-            path55.join(this.configuration.cacheRoot, "current.json"),
+            path56.join(this.configuration.cacheRoot, "current.json"),
             INSTALLATION_LIMITS.pointerBytes,
             INSTALLATION_LIMITS.pointerBytes
           );
@@ -142387,13 +142714,13 @@ var init_filesystem = __esm({
                 installation: null
               };
             requireFact(current3.state === "present", "INSTALLATION_INVALID");
-            const root = path55.join(
+            const root = path56.join(
               this.configuration.cacheRoot,
               "candidates",
               current3.pointer.installationId
             );
             const manifestRead = await this.read(
-              path55.join(root, "manifest.json"),
+              path56.join(root, "manifest.json"),
               INSTALLATION_LIMITS.manifestBytes,
               INSTALLATION_LIMITS.manifestBytes
             );
@@ -142403,7 +142730,7 @@ var init_filesystem = __esm({
             );
             const manifest = parseRecord(manifestRead.bytes, ManifestSchema, INSTALLATION_LIMITS.manifestBytes);
             const verificationRead = await this.read(
-              path55.join(root, "verification.json"),
+              path56.join(root, "verification.json"),
               INSTALLATION_LIMITS.journalBytes,
               INSTALLATION_LIMITS.journalBytes
             );
@@ -142481,7 +142808,7 @@ var init_filesystem = __esm({
               requireFact(
                 sameFileIdentity(file2.identity, identity(await original.stat({ bigint: true }))) && sameFileIdentity(
                   file2.identity,
-                  identity(await fs25.lstat(file2.path, { bigint: true }))
+                  identity(await fs26.lstat(file2.path, { bigint: true }))
                 ),
                 "ROOT_CHANGED"
               );
@@ -142491,7 +142818,7 @@ var init_filesystem = __esm({
           for (const directory of [...tree.directories].reverse())
             await this.syncDirectory(directory.path);
           await this.syncDirectory(handle.candidateRoot);
-          await this.syncDirectory(path55.dirname(handle.candidateRoot));
+          await this.syncDirectory(path56.dirname(handle.candidateRoot));
           await this.syncDirectory(this.configuration.cacheRoot);
           await this.revalidateCandidate(handle, expected);
           candidate.durable = await this.observeCandidate(handle);
@@ -142561,18 +142888,18 @@ var init_filesystem = __esm({
             await this.revalidateCandidate(candidateHandle, candidate.durable);
             requireFact(compareCurrent(before, await this.current()), "ROOT_CHANGED");
             await this.atomicRecord(
-              path55.join(candidateHandle.candidateRoot, "verification.json"),
+              path56.join(candidateHandle.candidateRoot, "verification.json"),
               parsedVerification,
               INSTALLATION_LIMITS.journalBytes,
               false
             );
             await this.atomicRecord(
-              path55.join(candidateHandle.candidateRoot, "manifest.json"),
+              path56.join(candidateHandle.candidateRoot, "manifest.json"),
               parsedManifest,
               INSTALLATION_LIMITS.manifestBytes,
               false
             );
-            await this.syncDirectory(path55.dirname(candidateHandle.candidateRoot));
+            await this.syncDirectory(path56.dirname(candidateHandle.candidateRoot));
             await this.revalidateCandidate(candidateHandle, candidate.durable);
             requireFact(compareCurrent(before, await this.current()), "ROOT_CHANGED");
             this.checkEnd(reservation);
@@ -142580,7 +142907,7 @@ var init_filesystem = __esm({
               { schemaVersion: 1, installationId: parsedManifest.installationId, manifestDigest },
               INSTALLATION_LIMITS.pointerBytes
             );
-            const temporary = path55.join(
+            const temporary = path56.join(
               this.configuration.cacheRoot,
               ".current-" + randomUUID5() + ".json"
             );
@@ -142595,7 +142922,7 @@ var init_filesystem = __esm({
             requireFact(compareCurrent(before, await this.current()), "ROOT_CHANGED");
             this.checkEnd(reservation);
             replacementAttempted = true;
-            await fs25.rename(temporary, path55.join(this.configuration.cacheRoot, "current.json"));
+            await fs26.rename(temporary, path56.join(this.configuration.cacheRoot, "current.json"));
             pointerReplaced = true;
             await this.syncDirectory(this.configuration.cacheRoot);
             after = await this.current();
@@ -142662,7 +142989,7 @@ var init_filesystem = __esm({
             throw error63;
           }
           const oldVerification = await this.read(
-            path55.join(
+            path56.join(
               this.configuration.cacheRoot,
               "candidates",
               handle.binding.installationId,
@@ -142675,18 +143002,18 @@ var init_filesystem = __esm({
             "BINDING_MISMATCH"
           );
           const file2 = await this.atomicRecord(
-            path55.join(attempt.handle.attemptRoot, "reuse.json"),
+            path56.join(attempt.handle.attemptRoot, "reuse.json"),
             parsed,
             INSTALLATION_LIMITS.journalBytes,
             false
           );
-          await this.syncDirectory(path55.dirname(attempt.handle.attemptRoot));
+          await this.syncDirectory(path56.dirname(attempt.handle.attemptRoot));
           requireFact(compareCurrent(current3, await this.current()), "ROOT_CHANGED");
           return file2;
         });
       }
       async writer(name2, reservation, diagnosticBudget) {
-        const parents = await this.ancestors(path55.dirname(name2));
+        const parents = await this.ancestors(path56.dirname(name2));
         const duty = await this.acquire(
           name2,
           constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW
@@ -142697,7 +143024,7 @@ var init_filesystem = __esm({
         let expected;
         let hash3;
         const observe = async (size, growth = false) => {
-          const held2 = identity(await original.stat({ bigint: true })), named3 = identity(await fs25.lstat(name2, { bigint: true }));
+          const held2 = identity(await original.stat({ bigint: true })), named3 = identity(await fs26.lstat(name2, { bigint: true }));
           requireFact(
             held2.type === "file" && held2.size === String(size) && sameFileIdentity(held2, named3),
             "ROOT_CHANGED"
@@ -142806,7 +143133,7 @@ var init_filesystem = __esm({
                 first ??= error63;
               }
               try {
-                await this.syncDirectory(path55.dirname(name2));
+                await this.syncDirectory(path56.dirname(name2));
               } catch (error63) {
                 first ??= error63;
                 this.fault(error63);
@@ -142854,13 +143181,13 @@ var init_filesystem = __esm({
       }
       sink(attempt, reservation, probe2) {
         const jobs = reservation?.jobs ?? /* @__PURE__ */ new Map(), budget = reservation?.diagnosticBudget ?? { bytes: 0, reserved: 0 };
-        const diagnostics = path55.join(attempt.attemptRoot, "diagnostics");
+        const diagnostics = path56.join(attempt.attemptRoot, "diagnostics");
         const reobserve = async () => {
           if (reservation) await this.checkReservation(reservation);
           requireFact(
             sameFileIdentity(
               attempt.identity,
-              identity(await fs25.lstat(attempt.attemptRoot, { bigint: true }))
+              identity(await fs26.lstat(attempt.attemptRoot, { bigint: true }))
             ),
             "ROOT_CHANGED"
           );
@@ -142880,7 +143207,7 @@ var init_filesystem = __esm({
             );
             requireFact(!jobs.has(parsed.jobId), "BINDING_MISMATCH");
             await reobserve();
-            const prefix = path55.join(diagnostics, (probe2 ? "probe_" : "") + parsed.jobId);
+            const prefix = path56.join(diagnostics, (probe2 ? "probe_" : "") + parsed.jobId);
             const job = {
               intent: parsed,
               prefix,
@@ -142966,18 +143293,18 @@ var init_filesystem = __esm({
           requireFact(!this.freshAdmissionStarted, "BINDING_MISMATCH");
           this.freshAdmissionStarted = true;
           requireFact(
-            parsed.cacheRoot === c3.cacheRoot && parsed.libraryRoot === c3.libraryRoot && parsed.nodeExecutable === c3.nodeExecutable && parsed.nodeExecutableSHA256 === c3.nodeExecutableSHA256 && parsed.verifierEntry === c3.verifierEntry && parsed.controllerEntry === c3.controllerEntry && parsed.sourceManifestPath === c3.sourceManifestPath && canonicalDigest(parsed.sourceVintage) === canonicalDigest(c3.sourceVintage) && path55.resolve(process.execPath) === c3.nodeExecutable && process.argv[1] && path55.resolve(process.argv[1]) === c3.verifierEntry,
+            parsed.cacheRoot === c3.cacheRoot && parsed.libraryRoot === c3.libraryRoot && parsed.nodeExecutable === c3.nodeExecutable && parsed.nodeExecutableSHA256 === c3.nodeExecutableSHA256 && parsed.verifierEntry === c3.verifierEntry && parsed.controllerEntry === c3.controllerEntry && parsed.sourceManifestPath === c3.sourceManifestPath && canonicalDigest(parsed.sourceVintage) === canonicalDigest(c3.sourceVintage) && path56.resolve(process.execPath) === c3.nodeExecutable && process.argv[1] && path56.resolve(process.argv[1]) === c3.verifierEntry,
             "SOURCE_MISMATCH"
           );
           requireFact(
-            parsed.attemptRoot === path55.join(c3.cacheRoot, "attempts", parsed.binding.attemptId) && parsed.candidateRoot === path55.join(c3.cacheRoot, "candidates", parsed.binding.installationId) && parsed.executablePath === INSTALLATION_TARGET.executablePath,
+            parsed.attemptRoot === path56.join(c3.cacheRoot, "attempts", parsed.binding.attemptId) && parsed.candidateRoot === path56.join(c3.cacheRoot, "candidates", parsed.binding.installationId) && parsed.executablePath === INSTALLATION_TARGET.executablePath,
             "BINDING_MISMATCH"
           );
-          const attempt = identity(await fs25.lstat(parsed.attemptRoot, { bigint: true }));
+          const attempt = identity(await fs26.lstat(parsed.attemptRoot, { bigint: true }));
           requireFact(sameFileIdentity(attempt, parsed.attemptIdentity), "ROOT_CHANGED");
           await this.ancestors(parsed.attemptRoot);
           const ownerRead = await this.read(
-            path55.join(c3.cacheRoot, "reservation", "owner.json"),
+            path56.join(c3.cacheRoot, "reservation", "owner.json"),
             INSTALLATION_LIMITS.journalBytes,
             INSTALLATION_LIMITS.journalBytes
           );
@@ -142993,7 +143320,7 @@ var init_filesystem = __esm({
             birth && birth.executable === c3.nodeExecutable && birth.argv.includes(c3.verifierEntry),
             "BINDING_MISMATCH"
           );
-          const prefix = path55.join(parsed.attemptRoot, "diagnostics", birth.jobId);
+          const prefix = path56.join(parsed.attemptRoot, "diagnostics", birth.jobId);
           const intentRead = await this.read(
             prefix + ".intent.json",
             INSTALLATION_LIMITS.journalBytes,
@@ -143019,7 +143346,7 @@ var init_filesystem = __esm({
             "HASH_MISMATCH"
           );
           requireFact(
-            sameFileIdentity(attempt, identity(await fs25.lstat(parsed.attemptRoot, { bigint: true }))),
+            sameFileIdentity(attempt, identity(await fs26.lstat(parsed.attemptRoot, { bigint: true }))),
             "ROOT_CHANGED"
           );
           this.fresh.set(request, {
@@ -143038,8 +143365,8 @@ var init_filesystem = __esm({
           kind: "installation-attempt",
           binding: admitted.request.binding,
           attemptRoot: admitted.request.attemptRoot,
-          homeRoot: path55.join(admitted.request.attemptRoot, "home"),
-          temporaryRoot: path55.join(admitted.request.attemptRoot, "tmp"),
+          homeRoot: path56.join(admitted.request.attemptRoot, "home"),
+          temporaryRoot: path56.join(admitted.request.attemptRoot, "tmp"),
           identity: admitted.attempt
         });
         admitted.sink ??= this.sink(attempt, null, admitted);
@@ -143056,7 +143383,7 @@ var init_filesystem = __esm({
             "CUSTODY_UNCERTAIN"
           );
           const owner = await this.read(
-            path55.join(reservation.directory.path, "owner.json"),
+            path56.join(reservation.directory.path, "owner.json"),
             INSTALLATION_LIMITS.journalBytes
           );
           requireFact(
@@ -143068,11 +143395,11 @@ var init_filesystem = __esm({
             "OWNERSHIP_UNCERTAIN"
           );
           try {
-            await fs25.unlink(owner.file.path);
+            await fs26.unlink(owner.file.path);
             await reservation.directory.handle.sync();
             await this.checkDirectory(reservation.directory);
             await this.close(reservation.directory.duty);
-            await fs25.rmdir(reservation.directory.path);
+            await fs26.rmdir(reservation.directory.path);
             await reservation.root.handle.sync();
             await this.checkDirectory(reservation.root);
             await this.close(reservation.root.duty);
@@ -143120,8 +143447,8 @@ function identity2(s2) {
     type: s2.isFile() ? "file" : "directory"
   });
 }
-function within(root, path73) {
-  const name2 = relative11(root, path73);
+function within(root, path74) {
+  const name2 = relative11(root, path74);
   return name2 !== "" && !name2.startsWith("../") && name2 !== ".." && !isAbsolute10(name2);
 }
 function streamFacts(s2) {
@@ -143267,26 +143594,26 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
     originals.push(slot);
     return slot;
   }
-  async function assertDirectory(path73, expected) {
-    requireFact2(isAbsolute10(path73) && resolve12(path73) === path73, "ROOT_CHANGED");
-    const s2 = await lstat5(path73, { bigint: true });
+  async function assertDirectory(path74, expected) {
+    requireFact2(isAbsolute10(path74) && resolve12(path74) === path74, "ROOT_CHANGED");
+    const s2 = await lstat5(path74, { bigint: true });
     requireFact2(
-      s2.isDirectory() && !s2.isSymbolicLink() && await realpath4(path73) === path73,
+      s2.isDirectory() && !s2.isSymbolicLink() && await realpath4(path74) === path74,
       "ROOT_CHANGED"
     );
     requireFact2(!expected || sameFileIdentity(identity2(s2), expected), "ROOT_CHANGED");
   }
-  async function readPinned(slot, path73, digest2, cap, expected, keep2 = false) {
-    const before = await lstat5(path73, { bigint: true });
+  async function readPinned(slot, path74, digest2, cap, expected, keep2 = false) {
+    const before = await lstat5(path74, { bigint: true });
     requireFact2(
       before.isFile() && !before.isSymbolicLink() && before.size <= BigInt(cap),
       "SOURCE_MISMATCH"
     );
-    requireFact2(await realpath4(path73) === path73, "ROOT_CHANGED");
+    requireFact2(await realpath4(path74) === path74, "ROOT_CHANGED");
     const beforeIdentity = identity2(before);
     requireFact2(!expected || sameFileIdentity(beforeIdentity, expected), "HASH_MISMATCH");
     const original = await open4(
-      path73,
+      path74,
       constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK
     );
     heldReads.add(original);
@@ -143315,7 +143642,7 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
         if (keep2) chunks.push(buffer.slice(0, result3.bytesRead));
       }
       requireFact2(
-        sameFileIdentity(beforeIdentity, identity2(await original.stat({ bigint: true }))) && sameFileIdentity(beforeIdentity, identity2(await lstat5(path73, { bigint: true }))),
+        sameFileIdentity(beforeIdentity, identity2(await original.stat({ bigint: true }))) && sameFileIdentity(beforeIdentity, identity2(await lstat5(path74, { bigint: true }))),
         "ROOT_CHANGED"
       );
       requireFact2(hash3.digest("hex") === digest2 && bytes === Number(before.size), "HASH_MISMATCH");
@@ -143861,7 +144188,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
     ...parsed.data,
     sourceVintage: Object.freeze(parsed.data.sourceVintage)
   });
-  const { filesystem: fs42, jobs } = dependencies;
+  const { filesystem: fs43, jobs } = dependencies;
   const now3 = dependencies.now;
   const createId = dependencies.createId;
   let active3 = null;
@@ -143894,7 +144221,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
   };
   const id = () => IdSchema2.parse(Reflect.apply(createId, dependencies, []));
   const fsReturned = () => {
-    const custody = fs42.custody(reservation);
+    const custody = fs43.custody(reservation);
     require2(custody.pendingOperations === 0 && custody.unresolvedHandles === 0, "CUSTODY_UNCERTAIN");
     require2(custody.firstCause === null, custody.firstCause ?? "CUSTODY_UNCERTAIN");
     require2(custody.reservation === "held", "OWNERSHIP_UNCERTAIN");
@@ -143950,7 +144277,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
           finalEnd: origin + config3.finalMilliseconds
         })
       );
-      const before = await fs42.inspectExisting({ signal: options.signal });
+      const before = await fs43.inspectExisting({ signal: options.signal });
       check4(bounds, options.signal);
       require2(before.current.state !== "unknown" && before.status.state !== "unverified", "OWNERSHIP_UNCERTAIN");
       const existing = before.installation;
@@ -143972,18 +144299,18 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         binding.nonce,
         ...reuse ? [] : [binding.installationId]
       ])).size === (reuse ? 3 : 4), "BINDING_MISMATCH");
-      reservation = await fs42.acquireReservation(binding, bounds);
+      reservation = await fs43.acquireReservation(binding, bounds);
       check4(bounds, options.signal);
-      const reserved = await fs42.inspectExisting({ signal: options.signal });
+      const reserved = await fs43.inspectExisting({ signal: options.signal });
       require2(canonicalDigest(reserved.current) === canonicalDigest(before.current), "ROOT_CHANGED");
       require2(reserved.status.state !== "unverified", "OWNERSHIP_UNCERTAIN");
       if (reuse)
         require2(reserved.installation && canonicalDigest(reserved.installation) === canonicalDigest(existing), "ROOT_CHANGED");
       check4(bounds, options.signal);
-      const attempt = await fs42.createAttempt(reservation);
+      const attempt = await fs43.createAttempt(reservation);
       require2(sameBinding(attempt.binding, binding), "BINDING_MISMATCH");
       const owner = async (phase) => {
-        await fs42.writeOwner(
+        await fs43.writeOwner(
           reservation,
           attempt,
           Object.freeze({
@@ -143998,12 +144325,12 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       };
       await owner("reserved");
       check4(bounds, options.signal);
-      const library = await fs42.validateLibrary();
+      const library = await fs43.validateLibrary();
       validateLibrary(library);
       check4(bounds, options.signal);
-      const candidate = reuse ? await fs42.bindExistingCandidate(reservation, attempt, reserved.installation) : await fs42.stageCandidate(reservation, attempt);
+      const candidate = reuse ? await fs43.bindExistingCandidate(reservation, attempt, reserved.installation) : await fs43.stageCandidate(reservation, attempt);
       require2(sameBinding(candidate.binding, binding) && candidate.reuse === reuse, "BINDING_MISMATCH");
-      const sink3 = fs42.createJobSink(reservation, attempt);
+      const sink3 = fs43.createJobSink(reservation, attempt);
       let installer = {
         kind: "not-invoked"
       };
@@ -144029,7 +144356,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         installer = { kind: "invoked", jobId: facts2.jobId, receiptDigest: canonicalDigest(facts2) };
         check4(bounds, options.signal);
       }
-      const snapshot = await fs42.observeCandidate(candidate);
+      const snapshot = await fs43.observeCandidate(candidate);
       validateCandidate(snapshot, binding);
       check4(bounds, options.signal);
       await owner("verifying");
@@ -144083,7 +144410,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       require2(reply.libraryDistributionSHA256 === library.distributionSHA256, "LIBRARY_MISMATCH");
       require2(reply.sourceManifestSHA256 === config3.sourceVintage.sourceManifestSHA256, "SOURCE_MISMATCH");
       require2(reply.machOCPU === snapshot.machOCPU, "INSTALLATION_INVALID");
-      await fs42.revalidateCandidate(candidate, snapshot);
+      await fs43.revalidateCandidate(candidate, snapshot);
       check4(bounds, options.signal);
       allJobsReturned();
       fsReturned();
@@ -144117,17 +144444,17 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         });
         recordBytes(journal, INSTALLATION_LIMITS.journalBytes);
         check4(bounds, options.signal);
-        const written2 = await fs42.writeReuseJournal(reservation, attempt, journal);
+        const written2 = await fs43.writeReuseJournal(reservation, attempt, journal);
         require2(written2.path === join56(attempt.attemptRoot, "reuse.json") && written2.sha256 === sha2564(recordBytes(journal, INSTALLATION_LIMITS.journalBytes)), "OWNERSHIP_UNCERTAIN");
-        const unchanged = await fs42.inspectExisting({ signal: options.signal });
+        const unchanged = await fs43.inspectExisting({ signal: options.signal });
         require2(canonicalDigest(unchanged.current) === canonicalDigest(reserved.current) && canonicalDigest(unchanged.installation) === canonicalDigest(reserved.installation), "ROOT_CHANGED");
         journalDigest = written2.sha256;
         currentManifestDigest = reserved.installation.current.pointer.manifestDigest;
       } else {
         await owner("publishing");
         check4(bounds, options.signal);
-        await fs42.makeCandidateDurable(candidate, snapshot);
-        await fs42.revalidateCandidate(candidate, snapshot);
+        await fs43.makeCandidateDurable(candidate, snapshot);
+        await fs43.revalidateCandidate(candidate, snapshot);
         check4(bounds, options.signal);
         allJobsReturned();
         fsReturned();
@@ -144150,7 +144477,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
           }
         });
         recordBytes(manifest, INSTALLATION_LIMITS.manifestBytes);
-        const published = await fs42.publish(
+        const published = await fs43.publish(
           reservation,
           candidate,
           manifest,
@@ -144170,9 +144497,9 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       check4(bounds, options.signal, true);
       allJobsReturned();
       fsReturned();
-      await fs42.releaseReservation(reservation);
+      await fs43.releaseReservation(reservation);
       check4(bounds, options.signal, true);
-      const final = fs42.custody(reservation);
+      const final = fs43.custody(reservation);
       require2(final.reservation === "released" && final.pendingOperations === 0 && final.unresolvedHandles === 0 && final.firstCause === null, "CUSTODY_UNCERTAIN");
       return Object.freeze({
         state: reuse ? "verified-reused" : "verified-installed",
@@ -144192,7 +144519,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       fail(error63);
       let uncertain = !!reservation || publicationMayHaveChanged;
       try {
-        const files = fs42.custody(reservation);
+        const files = fs43.custody(reservation);
         const processes = jobs.custody();
         uncertain ||= files.reservation !== "released" || files.pendingOperations !== 0 || files.unresolvedHandles !== 0 || files.firstCause !== null || processes.pending !== 0 || processes.firstCause !== null;
       } catch {
@@ -144873,7 +145200,7 @@ var init_operator_output = __esm({
 });
 
 // src/lib/agent-browser/chrome-locator.ts
-import path56 from "node:path";
+import path57 from "node:path";
 function chromeCandidates(env6) {
   if (env6.platform === "darwin") {
     const apps = [
@@ -144881,8 +145208,8 @@ function chromeCandidates(env6) {
       ["Chromium.app", "Chromium"]
     ];
     return apps.flatMap(([app, binary3]) => [
-      path56.posix.join("/Applications", app, "Contents", "MacOS", binary3),
-      path56.posix.join(env6.homeDir, "Applications", app, "Contents", "MacOS", binary3)
+      path57.posix.join("/Applications", app, "Contents", "MacOS", binary3),
+      path57.posix.join(env6.homeDir, "Applications", app, "Contents", "MacOS", binary3)
     ]);
   }
   if (env6.platform === "win32") {
@@ -144891,15 +145218,15 @@ function chromeCandidates(env6) {
     );
     return [
       ...roots.map(
-        (root) => path56.win32.join(root, "Google", "Chrome", "Application", "chrome.exe")
+        (root) => path57.win32.join(root, "Google", "Chrome", "Application", "chrome.exe")
       ),
-      ...roots.map((root) => path56.win32.join(root, "Chromium", "Application", "chrome.exe"))
+      ...roots.map((root) => path57.win32.join(root, "Chromium", "Application", "chrome.exe"))
     ];
   }
   const names = ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"];
-  const dirs = (env6.pathVar ?? "").split(path56.posix.delimiter).filter(Boolean);
+  const dirs = (env6.pathVar ?? "").split(path57.posix.delimiter).filter(Boolean);
   return [
-    ...names.flatMap((name2) => dirs.map((dir) => path56.posix.join(dir, name2))),
+    ...names.flatMap((name2) => dirs.map((dir) => path57.posix.join(dir, name2))),
     "/opt/google/chrome/chrome"
   ];
 }
@@ -145064,8 +145391,8 @@ var init_process_liveness = __esm({
 });
 
 // src/lib/agent-browser/profile.ts
-import fs26 from "node:fs";
-import path57 from "node:path";
+import fs27 from "node:fs";
+import path58 from "node:path";
 function themePreferences() {
   const color = AGENT_BROWSER_THEME_COLOR;
   return {
@@ -145109,7 +145436,7 @@ function deepMerge2(base, patch) {
 }
 function readJsonObject(file2) {
   try {
-    const parsed = JSON.parse(fs26.readFileSync(file2, "utf8"));
+    const parsed = JSON.parse(fs27.readFileSync(file2, "utf8"));
     return isObject6(parsed) ? parsed : {};
   } catch {
     return {};
@@ -145124,26 +145451,26 @@ function hasOwnThemeColor(prefs) {
   return isObject6(extensions) && typeof extensions.id === "string" && extensions.id !== "";
 }
 function ensureAgentProfile(profileDir, now3 = /* @__PURE__ */ new Date()) {
-  const created = !fs26.existsSync(profileDir);
-  fs26.mkdirSync(path57.dirname(profileDir), { recursive: true, mode: 448 });
-  fs26.chmodSync(path57.dirname(profileDir), 448);
-  fs26.mkdirSync(profileDir, { recursive: true, mode: 448 });
-  const marker = path57.join(profileDir, THEME_MARKER_FILE);
-  if (fs26.existsSync(marker)) return { created, themed: false };
-  const prefsFile = path57.join(profileDir, "Default", "Preferences");
+  const created = !fs27.existsSync(profileDir);
+  fs27.mkdirSync(path58.dirname(profileDir), { recursive: true, mode: 448 });
+  fs27.chmodSync(path58.dirname(profileDir), 448);
+  fs27.mkdirSync(profileDir, { recursive: true, mode: 448 });
+  const marker = path58.join(profileDir, THEME_MARKER_FILE);
+  if (fs27.existsSync(marker)) return { created, themed: false };
+  const prefsFile = path58.join(profileDir, "Default", "Preferences");
   const prefs = readJsonObject(prefsFile);
   const themed = !hasOwnThemeColor(prefs);
   if (themed) {
-    fs26.mkdirSync(path57.dirname(prefsFile), { recursive: true, mode: 448 });
-    fs26.writeFileSync(prefsFile, JSON.stringify(deepMerge2(prefs, themePreferences())));
-    const localStateFile = path57.join(profileDir, "Local State");
+    fs27.mkdirSync(path58.dirname(prefsFile), { recursive: true, mode: 448 });
+    fs27.writeFileSync(prefsFile, JSON.stringify(deepMerge2(prefs, themePreferences())));
+    const localStateFile = path58.join(profileDir, "Local State");
     const localState = readJsonObject(localStateFile);
-    fs26.writeFileSync(
+    fs27.writeFileSync(
       localStateFile,
       JSON.stringify(deepMerge2(localState, localStateProfileInfo()))
     );
   }
-  fs26.writeFileSync(
+  fs27.writeFileSync(
     marker,
     `${JSON.stringify({ themeAppliedAt: now3.toISOString(), themed }, null, 2)}
 `
@@ -145152,10 +145479,10 @@ function ensureAgentProfile(profileDir, now3 = /* @__PURE__ */ new Date()) {
 }
 function profileLock(profileDir, platform3 = process.platform) {
   if (platform3 === "win32") {
-    const lockfile = path57.join(profileDir, "lockfile");
-    if (!fs26.existsSync(lockfile)) return { inUse: false };
+    const lockfile = path58.join(profileDir, "lockfile");
+    if (!fs27.existsSync(lockfile)) return { inUse: false };
     try {
-      fs26.rmSync(lockfile);
+      fs27.rmSync(lockfile);
       return { inUse: false };
     } catch {
       return { inUse: true };
@@ -145163,7 +145490,7 @@ function profileLock(profileDir, platform3 = process.platform) {
   }
   let target;
   try {
-    target = fs26.readlinkSync(path57.join(profileDir, "SingletonLock"));
+    target = fs27.readlinkSync(path58.join(profileDir, "SingletonLock"));
   } catch {
     return { inUse: false };
   }
@@ -145265,8 +145592,8 @@ var init_cloud_origin = __esm({
 });
 
 // src/lib/agent-browser/storage-state.ts
-import fs27 from "node:fs";
-import path58 from "node:path";
+import fs28 from "node:fs";
+import path59 from "node:path";
 function toStorageStateCookie(cookie) {
   const copy2 = {
     name: cookie.name,
@@ -145337,7 +145664,7 @@ function cliCloudOrigins() {
 }
 async function writeStorageState(file2, state) {
   const saved = withoutCloudOrigin(state, cliCloudOrigins()).state;
-  fs27.mkdirSync(path58.dirname(file2), { recursive: true, mode: 448 });
+  fs28.mkdirSync(path59.dirname(file2), { recursive: true, mode: 448 });
   await writeFileAtomic2(file2, `${JSON.stringify(saved, null, 2)}
 `, { mode: 384 });
   return saved;
@@ -145345,7 +145672,7 @@ async function writeStorageState(file2, state) {
 function readStorageState(file2) {
   let raw;
   try {
-    raw = fs27.readFileSync(file2, "utf8");
+    raw = fs28.readFileSync(file2, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -145455,13 +145782,13 @@ __export(browser_commands_exports, {
   runBrowserLogin: () => runBrowserLogin,
   runBrowserStatus: () => runBrowserStatus
 });
-import fs28 from "node:fs";
-import path59 from "node:path";
+import fs29 from "node:fs";
+import path60 from "node:path";
 import { parseArgs as parseArgs8 } from "node:util";
 function agentBrowserPaths(dorkHome) {
   return {
-    profileDir: path59.join(dorkHome, ...AGENT_BROWSER_PROFILE_SEGMENTS),
-    stateFile: path59.join(dorkHome, ...AGENT_BROWSER_STATE_SEGMENTS)
+    profileDir: path60.join(dorkHome, ...AGENT_BROWSER_PROFILE_SEGMENTS),
+    stateFile: path60.join(dorkHome, ...AGENT_BROWSER_STATE_SEGMENTS)
   };
 }
 function profileFlags(profileDir) {
@@ -145651,7 +145978,7 @@ function parseBrowserStatusArgs(rawArgs) {
 async function runBrowserStatus(args, deps) {
   const { stateFile } = agentBrowserPaths(deps.dorkHome);
   const state = readStorageState(stateFile);
-  const savedAt = state ? fs28.statSync(stateFile).mtime : null;
+  const savedAt = state ? fs29.statSync(stateFile).mtime : null;
   const sites = state ? summarizeStorageState(state, deps.now().getTime() / 1e3) : [];
   if (args.json) {
     printJson({
@@ -145728,7 +146055,7 @@ ${FORGET_USAGE}`);
   };
 }
 async function cleanProfile(deps, profileDir, target, knownOrigins, chromeFlag) {
-  if (!fs28.existsSync(profileDir)) return null;
+  if (!fs29.existsSync(profileDir)) return null;
   const what = target === "all" ? "those sites are" : `${target.site} is`;
   const nextSave = "the next `dorkos browser login` will save it again";
   if (deps.profileLock(profileDir).inUse) {
@@ -145824,7 +146151,7 @@ var browser_deps_exports = {};
 __export(browser_deps_exports, {
   defaultBrowserDeps: () => defaultBrowserDeps
 });
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { spawn as spawn3, spawnSync } from "node:child_process";
 import { createInterface as createInterface2 } from "node:readline";
@@ -145880,7 +146207,7 @@ function defaultBrowserDeps() {
         programFilesX86: env4["PROGRAMFILES(X86)"],
         exists: (file2) => {
           try {
-            return fs29.statSync(file2).isFile();
+            return fs30.statSync(file2).isFile();
           } catch {
             return false;
           }
@@ -146014,9 +146341,9 @@ var init_installation_label = __esm({
 });
 
 // src/lib/package-commands.ts
-import path60 from "node:path";
+import path61 from "node:path";
 function resolveProjectFlag(value) {
-  return typeof value === "string" ? path60.resolve(process.cwd(), value) : void 0;
+  return typeof value === "string" ? path61.resolve(process.cwd(), value) : void 0;
 }
 function shellWord(value) {
   return /^[A-Za-z0-9_./,:@%+=-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
@@ -146805,8 +147132,8 @@ async function runUninstall(args) {
       console.log(
         result2.unproven && result2.unproven.length > 0 ? "Kept these files:" : "Kept the files you and your agents added or changed:"
       );
-      for (const path73 of result2.preservedData) {
-        console.log(`  ${path73}`);
+      for (const path74 of result2.preservedData) {
+        console.log(`  ${path74}`);
       }
     }
     if (result2.agentRemoved) {
@@ -147038,8 +147365,8 @@ function filesOf(pkg) {
 }
 function devLinkNoteOf(pkg) {
   if (!pkg.devLink) return void 0;
-  const { path: path73, state } = pkg.devLink;
-  return state === "active" ? `dev link \u2192 ${path73}` : `dev link \u2192 ${path73} (${DEV_LINK_TROUBLE[state]})`;
+  const { path: path74, state } = pkg.devLink;
+  return state === "active" ? `dev link \u2192 ${path74}` : `dev link \u2192 ${path74} (${DEV_LINK_TROUBLE[state]})`;
 }
 function notesOf(pkg) {
   return [
@@ -147386,8 +147713,8 @@ __export(marketplace_link_exports, {
   parseMarketplaceLinkArgs: () => parseMarketplaceLinkArgs,
   runMarketplaceLink: () => runMarketplaceLink
 });
-import fs30 from "node:fs";
-import path61 from "node:path";
+import fs31 from "node:fs";
+import path62 from "node:path";
 import { parseArgs as parseArgs17 } from "node:util";
 function parseMarketplaceLinkArgs(rawArgs) {
   let parsed;
@@ -147414,7 +147741,7 @@ ${USAGE_LINE16}`);
   if (positionals2.length > 1) throw new Error(`Link one folder at a time.
 ${USAGE_LINE16}`);
   return {
-    folder: path61.resolve(process.cwd(), folder),
+    folder: path62.resolve(process.cwd(), folder),
     projectPath: resolveProjectFlag(values2.project),
     replaceInstalled: Boolean(values2["replace-installed"]),
     yes: Boolean(values2.yes),
@@ -147428,7 +147755,7 @@ function runningAsAgent() {
 function describeUnreadableFolder(typed, err) {
   const code = err?.code;
   const reason = code === "ENOENT" ? `No folder at ${typed}.` : code === "EACCES" || code === "EPERM" ? `Can't read ${typed}: permission denied (${code}).` : `Can't read ${typed}${code ? ` (${code})` : ""}.`;
-  const tilde = typed.split(path61.sep).includes("~") ? " The shell does not expand ~ inside quotes; use the full path." : "";
+  const tilde = typed.split(path62.sep).includes("~") ? " The shell does not expand ~ inside quotes; use the full path." : "";
   return `Error: ${reason}${tilde}`;
 }
 function describeLinkPreview(preview) {
@@ -147448,7 +147775,7 @@ function describeLinkPreview(preview) {
 async function runMarketplaceLink(args) {
   let folder;
   try {
-    folder = fs30.realpathSync(args.folder);
+    folder = fs31.realpathSync(args.folder);
   } catch (err) {
     console.error(describeUnreadableFolder(args.folder, err));
     return 1;
@@ -147711,7 +148038,9 @@ Run \`dorkos marketplace refresh ${created.name}\` to try again.`
     return 0;
   } catch (err) {
     if (err instanceof ApiError) {
-      if (err.status === 409) {
+      if (err.body.code === SOURCE_NEEDS_APP) {
+        console.error(String(err.body.error ?? err.message));
+      } else if (err.status === 409) {
         console.error(
           `Error: marketplace '${name2}' already exists. Pass --name to choose another.`
         );
@@ -147727,13 +148056,14 @@ ${err.body.message}`);
     return 1;
   }
 }
-var USAGE_LINE18;
+var USAGE_LINE18, SOURCE_NEEDS_APP;
 var init_marketplace_add = __esm({
   "src/commands/marketplace-add.ts"() {
     "use strict";
     init_api_client();
     init_parse_args_error();
     USAGE_LINE18 = "Usage: dorkos marketplace add <url> [--name <name>]";
+    SOURCE_NEEDS_APP = "marketplace_source_needs_app";
   }
 });
 
@@ -148782,10 +149112,10 @@ function createGitHubCommunityReleaseSource(options) {
     },
     verifyManifest: async (bytes, trusted) => {
       const directory = await mkdtemp2(join58(tmpdir3(), "dorkos-community-manifest-"));
-      const path73 = join58(directory, "manifest.json");
+      const path74 = join58(directory, "manifest.json");
       try {
-        await writeFile5(path73, bytes, { mode: 384, flag: "wx" });
-        return await verify(path73, trusted);
+        await writeFile5(path74, bytes, { mode: 384, flag: "wx" });
+        return await verify(path74, trusted);
       } finally {
         await rm3(directory, { recursive: true, force: true });
       }
@@ -150424,7 +150754,7 @@ function flyGraphqlAuthorization(token) {
   const macaroon = token.split(",").some((part) => ["fm1r", "fm1a", "fm2"].includes(part.trim().split("_", 1)[0]));
   return `${macaroon ? "FlyV1" : "Bearer"} ${token}`;
 }
-var FLY_GRAPHQL_ENDPOINT, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RESPONSE_BYTES, MAX_TIMEOUT_MS, MAX_RESPONSE_BYTES, FlyGraphqlClientError, FlyTigrisGraphqlClient;
+var FLY_GRAPHQL_ENDPOINT, DEFAULT_TIMEOUT_MS2, DEFAULT_MAX_RESPONSE_BYTES, MAX_TIMEOUT_MS, MAX_RESPONSE_BYTES, FlyGraphqlClientError, FlyTigrisGraphqlClient;
 var init_fly_graphql_client = __esm({
   "src/commands/community-deploy/fly-graphql-client.ts"() {
     "use strict";
@@ -150432,7 +150762,7 @@ var init_fly_graphql_client = __esm({
     init_provider_identifiers();
     init_provider_mutation();
     FLY_GRAPHQL_ENDPOINT = "https://api.fly.io/graphql";
-    DEFAULT_TIMEOUT_MS = 3e4;
+    DEFAULT_TIMEOUT_MS2 = 3e4;
     DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
     MAX_TIMEOUT_MS = 5 * 60 * 1e3;
     MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
@@ -150465,14 +150795,14 @@ var init_fly_graphql_client = __esm({
         if (options.accessToken.length < 1 || options.accessToken.length > 4096 || !/^[\x21-\x7e]+$/u.test(options.accessToken)) {
           throw new FlyGraphqlClientError("AUTH_REQUIRED");
         }
-        if (!Number.isSafeInteger(options.timeoutMs ?? DEFAULT_TIMEOUT_MS) || (options.timeoutMs ?? DEFAULT_TIMEOUT_MS) < 1 || (options.timeoutMs ?? DEFAULT_TIMEOUT_MS) > MAX_TIMEOUT_MS) {
+        if (!Number.isSafeInteger(options.timeoutMs ?? DEFAULT_TIMEOUT_MS2) || (options.timeoutMs ?? DEFAULT_TIMEOUT_MS2) < 1 || (options.timeoutMs ?? DEFAULT_TIMEOUT_MS2) > MAX_TIMEOUT_MS) {
           throw new FlyGraphqlClientError("INVALID_RESPONSE");
         }
         if (!Number.isSafeInteger(options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES) || (options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES) < 1 || (options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES) > MAX_RESPONSE_BYTES) {
           throw new FlyGraphqlClientError("INVALID_RESPONSE");
         }
         this.accessToken = options.accessToken;
-        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
         this.maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
         this.fetch = options.fetch ?? fetch;
         this.signal = options.signal;
@@ -151590,10 +151920,10 @@ kill_timeout = "30s"
 }
 async function withCommunityFlyConfig(plan, consumer) {
   const directory = await mkdtemp3(join59(tmpdir4(), "dorkos-community-fly-"));
-  const path73 = join59(directory, "fly.toml");
+  const path74 = join59(directory, "fly.toml");
   try {
-    await writeFile6(path73, renderCommunityFlyConfig(plan), { mode: 384, flag: "wx" });
-    return await consumer(path73);
+    await writeFile6(path74, renderCommunityFlyConfig(plan), { mode: 384, flag: "wx" });
+    return await consumer(path74);
   } finally {
     await rm4(directory, { recursive: true, force: true });
   }
@@ -151731,7 +152061,7 @@ async function resolvePlatformImageDigest(input4) {
   if (!match || !REGISTRY_ALLOW_LIST.has(match[1]) || !Sha256DigestSchema2.safeParse(input4.digest).success) {
     throw invalid2();
   }
-  const [, host, path73] = match;
+  const [, host, path74] = match;
   const request = input4.fetch ?? fetch;
   const signal = AbortSignal.any([
     AbortSignal.timeout(input4.timeoutMs),
@@ -151741,14 +152071,14 @@ async function resolvePlatformImageDigest(input4) {
   let mediaType;
   try {
     const tokenResponse = await request(
-      `https://${host}/token?scope=${encodeURIComponent(`repository:${path73}:pull`)}&service=${host}`,
+      `https://${host}/token?scope=${encodeURIComponent(`repository:${path74}:pull`)}&service=${host}`,
       { signal, redirect: "error" }
     );
     if (!tokenResponse.ok) throw invalid2();
     const token = external_exports.object({ token: external_exports.string().min(1).max(8192) }).passthrough().parse(
       JSON.parse(Buffer.from(await readBounded2(tokenResponse, MAX_TOKEN_BYTES)).toString("utf8"))
     ).token;
-    const response = await request(`https://${host}/v2/${path73}/manifests/${input4.digest}`, {
+    const response = await request(`https://${host}/v2/${path74}/manifests/${input4.digest}`, {
       signal,
       redirect: "error",
       headers: {
@@ -152063,8 +152393,8 @@ function handoffCommands(system) {
     browser: { executable: "xdg-open", args: (origin) => [origin] }
   };
 }
-async function executableOnPath(executable, path73) {
-  for (const directory of path73.split(delimiter).filter(Boolean)) {
+async function executableOnPath(executable, path74) {
+  for (const directory of path74.split(delimiter).filter(Boolean)) {
     try {
       await access2(join60(directory, executable), constants9.X_OK);
       return true;
@@ -152078,11 +152408,11 @@ async function assertOwnerHandoffPrerequisites(env6, system = platform2()) {
     throw new Error(`Owner handoff is unsupported on this platform. See ${FLY_GUIDE_URL}`);
   }
   const commands = handoffCommands(system);
-  const path73 = env6.PATH ?? "";
+  const path74 = env6.PATH ?? "";
   const missing = (await Promise.all(
     [commands.clipboard.executable].map(async (executable) => ({
       executable,
-      found: await executableOnPath(executable, path73)
+      found: await executableOnPath(executable, path74)
     }))
   )).filter(({ found }) => !found);
   if (missing.length > 0) {
@@ -152288,9 +152618,9 @@ function launchJournalPath(dorkHome, runId) {
   const safeRunId = external_exports.uuid().parse(runId);
   return join61(dorkHome, "launches", "community", `${safeRunId}.json`);
 }
-async function rejectSymlink(path73) {
+async function rejectSymlink(path74) {
   try {
-    if ((await lstat7(path73)).isSymbolicLink()) throw new Error(`Refusing symbolic link: ${path73}`);
+    if ((await lstat7(path74)).isSymbolicLink()) throw new Error(`Refusing symbolic link: ${path74}`);
   } catch (error63) {
     if (error63.code !== "ENOENT") throw error63;
   }
@@ -152312,9 +152642,9 @@ async function prepareDirectory(filePath) {
     await rejectSymlink(directory);
   }
 }
-async function exists2(path73) {
+async function exists2(path74) {
   try {
-    await lstat7(path73);
+    await lstat7(path74);
     return true;
   } catch (error63) {
     if (error63.code === "ENOENT") return false;
@@ -155247,8 +155577,8 @@ There is no --yes mode. Before the first write, type the generated app name in a
 // src/commands/doctor-checks.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import net from "node:net";
-import fs31 from "node:fs";
-import path62 from "node:path";
+import fs32 from "node:fs";
+import path63 from "node:path";
 function checkNode() {
   const issue2 = checkNodeVersion();
   if (issue2) {
@@ -155257,11 +155587,11 @@ function checkNode() {
   return { label: `Node.js ${process.versions.node}`, status: "pass" };
 }
 function checkDorkHomeWritable(dorkHome) {
-  const probe2 = path62.join(dorkHome, `.doctor-write-${process.pid}`);
+  const probe2 = path63.join(dorkHome, `.doctor-write-${process.pid}`);
   try {
-    fs31.mkdirSync(dorkHome, { recursive: true });
-    fs31.writeFileSync(probe2, "ok");
-    fs31.rmSync(probe2, { force: true });
+    fs32.mkdirSync(dorkHome, { recursive: true });
+    fs32.writeFileSync(probe2, "ok");
+    fs32.rmSync(probe2, { force: true });
     return { label: `Data directory is writable`, status: "pass", detail: dorkHome };
   } catch (err) {
     return {
@@ -155310,8 +155640,8 @@ function readGitVersion() {
   return execFileSync3("git", ["--version"], { encoding: "utf-8", stdio: "pipe", timeout: 1e4 });
 }
 function checkClaudeAuth(homeDir) {
-  const claudeDir = path62.join(homeDir, ".claude");
-  if (fs31.existsSync(claudeDir)) {
+  const claudeDir = path63.join(homeDir, ".claude");
+  if (fs32.existsSync(claudeDir)) {
     return { label: "Claude looks configured", status: "info", detail: claudeDir };
   }
   return {
@@ -155401,10 +155731,10 @@ function checkFileDescriptors(softLimit) {
   };
 }
 function checkDevLinks(dorkHome) {
-  const file2 = path62.join(dorkHome, DEV_LINKS_FILE);
+  const file2 = path63.join(dorkHome, DEV_LINKS_FILE);
   let text3;
   try {
-    text3 = fs31.readFileSync(file2, "utf-8");
+    text3 = fs32.readFileSync(file2, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return judgeDevLinks({ entries: [] }, { paths: true });
@@ -155430,7 +155760,7 @@ function devLinkStateSync(record2) {
   let lstatIsLink = false;
   let present = false;
   try {
-    lstatIsLink = fs31.lstatSync(record2.slot).isSymbolicLink();
+    lstatIsLink = fs32.lstatSync(record2.slot).isSymbolicLink();
     present = true;
   } catch (err) {
     const code = err.code;
@@ -155438,15 +155768,15 @@ function devLinkStateSync(record2) {
   }
   let realpathOfSlot = null;
   try {
-    realpathOfSlot = fs31.realpathSync(record2.slot);
+    realpathOfSlot = fs32.realpathSync(record2.slot);
   } catch {
   }
   if (isActiveDevLink(record2, { lstatIsLink, realpathOfSlot })) return "active";
   if (!present) return "link-missing";
   if (lstatIsLink && realpathOfSlot === null) {
     try {
-      const text3 = fs31.readlinkSync(record2.slot);
-      if (path62.resolve(path62.dirname(record2.slot), text3) === record2.target) return "folder-missing";
+      const text3 = fs32.readlinkSync(record2.slot);
+      if (path63.resolve(path63.dirname(record2.slot), text3) === record2.target) return "folder-missing";
     } catch {
     }
   }
@@ -155566,9 +155896,9 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   withCleanStdout: () => withCleanStdout
 });
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import os9 from "node:os";
-import path63 from "node:path";
+import path64 from "node:path";
 function parseDoctorArgs(rawArgs) {
   const usage = "Usage: dorkos doctor [--json] [--deep]";
   const args = { json: false, deep: false };
@@ -155625,7 +155955,7 @@ function configFailureCheck(err, dorkHome) {
     label: "Your settings could not be used",
     status: "fail",
     detail: describeConfigFailure(err),
-    fix: `DorkOS did not replace or delete the file: ${path63.join(dorkHome, "config.json")}
+    fix: `DorkOS did not replace or delete the file: ${path64.join(dorkHome, "config.json")}
 Everything below was checked against the built-in defaults instead.
 ` + adviceFrom(err)
   };
@@ -155671,7 +156001,7 @@ async function gatherResults(dorkHome, store) {
     checkDevLinks(dorkHome),
     checkAuthConfig({
       authEnabled: readBool(store, "auth.enabled", false),
-      secretFileExists: fs32.existsSync(path63.join(dorkHome, SECRET_FILE_NAME2)),
+      secretFileExists: fs33.existsSync(path64.join(dorkHome, SECRET_FILE_NAME2)),
       // eslint-disable-next-line no-restricted-syntax -- reading an operator env override, matching secret.ts
       secretEnvSet: Boolean(process.env.BETTER_AUTH_SECRET?.trim())
     }),
@@ -156121,13 +156451,13 @@ function assertHasProtocol(url2) {
     throw new BetterAuthError(`Invalid base URL: ${url2}. Please provide a valid base URL.`, { cause: error63 });
   }
 }
-function withPath2(url2, path73 = "/api/auth") {
+function withPath2(url2, path74 = "/api/auth") {
   assertHasProtocol(url2);
   if (checkHasPath(url2)) return url2;
   const trimmedUrl = trimTrailingSlashes(url2);
-  if (!path73 || path73 === "/") return trimmedUrl;
-  path73 = path73.startsWith("/") ? path73 : `/${path73}`;
-  return `${trimmedUrl}${path73}`;
+  if (!path74 || path74 === "/") return trimmedUrl;
+  path74 = path74.startsWith("/") ? path74 : `/${path74}`;
+  return `${trimmedUrl}${path74}`;
 }
 function validateProxyHeader(header, type2) {
   if (!header || header.trim() === "") return false;
@@ -156147,26 +156477,26 @@ function validateProxyHeader(header, type2) {
   }
   return false;
 }
-function getBaseURL(url2, path73, request, loadEnv, trustedProxyHeaders) {
-  if (url2) return withPath2(url2, path73);
+function getBaseURL(url2, path74, request, loadEnv, trustedProxyHeaders) {
+  if (url2) return withPath2(url2, path74);
   if (loadEnv !== false) {
     const fromEnv = env5.BETTER_AUTH_URL || env5.NEXT_PUBLIC_BETTER_AUTH_URL || env5.PUBLIC_BETTER_AUTH_URL || env5.NUXT_PUBLIC_BETTER_AUTH_URL || env5.NUXT_PUBLIC_AUTH_URL || (env5.BASE_URL !== "/" ? env5.BASE_URL : void 0);
-    if (fromEnv) return withPath2(fromEnv, path73);
+    if (fromEnv) return withPath2(fromEnv, path74);
   }
   const fromRequest = request?.headers.get("x-forwarded-host");
   const fromRequestProto = request?.headers.get("x-forwarded-proto");
   if (fromRequest && fromRequestProto && trustedProxyHeaders) {
     if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
-      return withPath2(`${fromRequestProto}://${fromRequest}`, path73);
+      return withPath2(`${fromRequestProto}://${fromRequest}`, path74);
     } catch (_error) {
     }
   }
   if (request) {
     const url3 = getOrigin(request.url);
     if (!url3) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
-    return withPath2(url3, path73);
+    return withPath2(url3, path74);
   }
-  if (typeof window !== "undefined" && window.location) return withPath2(window.location.origin, path73);
+  if (typeof window !== "undefined" && window.location) return withPath2(window.location.origin, path74);
 }
 function getOrigin(url2) {
   try {
@@ -156757,9 +157087,9 @@ function parseCookieCachePayload(value) {
   if (parsed === null) return null;
   const result2 = cookieCachePayloadSchema.safeParse(parsed);
   if (result2.success) return result2.data;
-  logger2.warn("Cookie cache payload failed schema validation", { issues: result2.error.issues.map(({ code, path: path73 }) => ({
+  logger2.warn("Cookie cache payload failed schema validation", { issues: result2.error.issues.map(({ code, path: path74 }) => ({
     code,
-    path: path73
+    path: path74
   })) });
   return null;
 }
@@ -157556,10 +157886,10 @@ var init_trusted_origins2 = __esm({
     CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
     RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
     ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
-    normalizePath3 = (path73) => {
-      let decoded = path73;
+    normalizePath3 = (path74) => {
+      let decoded = path74;
       try {
-        decoded = decodeURIComponent(path73);
+        decoded = decodeURIComponent(path74);
       } catch {
       }
       const segments = [];
@@ -157586,18 +157916,18 @@ var init_trusted_origins2 = __esm({
         }
       }
       const pathEnd = rest.search(/[?#]/);
-      const path73 = normalizePath3(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
+      const path74 = normalizePath3(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
       return {
         scheme,
         authority: authority.toLowerCase(),
-        path: path73
+        path: path74
       };
     };
     isSafeRelativeURL = (value) => {
       if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) return false;
       const pathEnd = value.search(/[?#]/);
-      const path73 = pathEnd === -1 ? value : value.slice(0, pathEnd);
-      if (ENCODED_PATH_SEPARATOR_PATTERN.test(path73)) return false;
+      const path74 = pathEnd === -1 ? value : value.slice(0, pathEnd);
+      if (ENCODED_PATH_SEPARATOR_PATTERN.test(path74)) return false;
       try {
         return new URL(value, RELATIVE_URL_PARSER_ORIGIN).origin === RELATIVE_URL_PARSER_ORIGIN;
       } catch {
@@ -157981,7 +158311,7 @@ function getRateLimitStorage(ctx, rateLimitSettings) {
 }
 async function resolveRateLimitConfig(req, ctx) {
   const basePath = new URL(ctx.baseURL).pathname;
-  const path73 = normalizePathname(req.url, basePath);
+  const path74 = normalizePathname(req.url, basePath);
   let currentWindow = ctx.rateLimit.window;
   let currentMax = ctx.rateLimit.max;
   const ip = getIP(req, ctx.options);
@@ -157990,14 +158320,14 @@ async function resolveRateLimitConfig(req, ctx) {
     ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header, then set `advanced.ipAddress.ipAddressHeaders` or `advanced.ipAddress.trustedProxies` so the address can be resolved.");
     ipWarningLogged = true;
   }
-  const key = createRateLimitKey(ip ?? NO_TRUSTED_IP_KEY, path73);
-  const specialRule = getDefaultSpecialRules().find((rule) => rule.pathMatcher(path73));
+  const key = createRateLimitKey(ip ?? NO_TRUSTED_IP_KEY, path74);
+  const specialRule = getDefaultSpecialRules().find((rule) => rule.pathMatcher(path74));
   if (specialRule) {
     currentWindow = specialRule.window;
     currentMax = specialRule.max;
   }
   for (const plugin of ctx.options.plugins || []) if (plugin.rateLimit) {
-    const matchedRule = plugin.rateLimit.find((rule) => rule.pathMatcher(path73));
+    const matchedRule = plugin.rateLimit.find((rule) => rule.pathMatcher(path74));
     if (matchedRule) {
       currentWindow = matchedRule.window;
       currentMax = matchedRule.max;
@@ -158006,8 +158336,8 @@ async function resolveRateLimitConfig(req, ctx) {
   }
   if (ctx.rateLimit.customRules) {
     const _path = Object.keys(ctx.rateLimit.customRules).find((p) => {
-      if (p.includes("*")) return wildcardMatch(p)(path73);
-      return p === path73;
+      if (p.includes("*")) return wildcardMatch(p)(path74);
+      return p === path74;
     });
     if (_path) {
       const customRule = ctx.rateLimit.customRules[_path];
@@ -158043,14 +158373,14 @@ async function onRequestRateLimit(req, ctx) {
 }
 function getDefaultSpecialRules() {
   return [{
-    pathMatcher(path73) {
-      return path73.startsWith("/sign-in") || path73.startsWith("/sign-up") || path73.startsWith("/change-password") || path73.startsWith("/change-email");
+    pathMatcher(path74) {
+      return path74.startsWith("/sign-in") || path74.startsWith("/sign-up") || path74.startsWith("/change-password") || path74.startsWith("/change-email");
     },
     window: 10,
     max: 3
   }, {
-    pathMatcher(path73) {
-      return path73 === "/request-password-reset" || path73 === "/send-verification-email" || path73.startsWith("/forget-password") || path73 === "/email-otp/send-verification-otp" || path73 === "/email-otp/request-password-reset";
+    pathMatcher(path74) {
+      return path74 === "/request-password-reset" || path74 === "/send-verification-email" || path74.startsWith("/forget-password") || path74 === "/email-otp/send-verification-otp" || path74 === "/email-otp/request-password-reset";
     },
     window: 60,
     max: 3
@@ -163756,15 +164086,15 @@ function checkEndpointConflicts(options, logger3) {
   options.plugins?.forEach((plugin) => {
     if (plugin.endpoints) {
       for (const [key, endpoint] of Object.entries(plugin.endpoints)) if (endpoint && "path" in endpoint && typeof endpoint.path === "string") {
-        const path73 = endpoint.path;
+        const path74 = endpoint.path;
         let methods2 = [];
         if (endpoint.options && "method" in endpoint.options) {
           if (Array.isArray(endpoint.options.method)) methods2 = endpoint.options.method;
           else if (typeof endpoint.options.method === "string") methods2 = [endpoint.options.method];
         }
         if (methods2.length === 0) methods2 = ["*"];
-        if (!endpointRegistry.has(path73)) endpointRegistry.set(path73, []);
-        endpointRegistry.get(path73).push({
+        if (!endpointRegistry.has(path74)) endpointRegistry.set(path74, []);
+        endpointRegistry.get(path74).push({
           pluginId: plugin.id,
           endpointKey: key,
           methods: methods2
@@ -163773,7 +164103,7 @@ function checkEndpointConflicts(options, logger3) {
     }
   });
   const conflicts = [];
-  for (const [path73, entries] of endpointRegistry.entries()) if (entries.length > 1) {
+  for (const [path74, entries] of endpointRegistry.entries()) if (entries.length > 1) {
     const methodMap = /* @__PURE__ */ new Map();
     let hasConflict = false;
     for (const entry of entries) for (const method of entry.methods) {
@@ -163788,7 +164118,7 @@ function checkEndpointConflicts(options, logger3) {
       const conflictingMethods = [];
       for (const [method, plugins] of methodMap.entries()) if (plugins.length > 1 || method === "*" && entries.length > 1 || method !== "*" && methodMap.has("*")) conflictingMethods.push(method);
       conflicts.push({
-        path: path73,
+        path: path74,
         plugins: uniquePlugins,
         conflictingMethods
       });
@@ -173376,13 +173706,13 @@ __export(ended_standing_grants_exports, {
   readStandingGrantLicence: () => readStandingGrantLicence,
   recordEndedStandingGrants: () => recordEndedStandingGrants
 });
-import fs33 from "node:fs/promises";
+import fs34 from "node:fs/promises";
 import { readFileSync as readFileSync25, writeFileSync as writeFileSync4, renameSync as renameSync4 } from "node:fs";
-import path64 from "node:path";
+import path65 from "node:path";
 function readStandingGrantLicence(dorkHome) {
   let config3;
   try {
-    config3 = JSON.parse(readFileSync25(path64.join(dorkHome, "config.json"), "utf-8"));
+    config3 = JSON.parse(readFileSync25(path65.join(dorkHome, "config.json"), "utf-8"));
   } catch {
     return NO_LICENCE;
   }
@@ -173425,7 +173755,7 @@ function captureLiveStandingGrants(db2, dorkHome, logger3, licence, now3 = /* @_
       capabilityId: row2.capability_id,
       expiresAt: row2.expires_at
     }));
-    const file2 = path64.join(dorkHome, ENDED_STANDING_GRANTS_FILE);
+    const file2 = path65.join(dorkHome, ENDED_STANDING_GRANTS_FILE);
     const existing = readCaptured(file2);
     const byId = new Map([...existing, ...grants].map((grant) => [grant.id, grant]));
     const tmp = `${file2}.tmp`;
@@ -173457,16 +173787,16 @@ function readCaptured(file2) {
   }
 }
 async function recordEndedStandingGrants(deps) {
-  const file2 = path64.join(deps.dorkHome, ENDED_STANDING_GRANTS_FILE);
+  const file2 = path65.join(deps.dorkHome, ENDED_STANDING_GRANTS_FILE);
   const grants = readCaptured(file2);
   if (grants.length === 0) {
-    await fs33.rm(file2, { force: true });
+    await fs34.rm(file2, { force: true });
     return 0;
   }
   const agents2 = new Map(deps.agents().map((agent) => [agent.projectPath, agent]));
   for (const grant of grants) {
     const agent = agents2.get(grant.agentPath);
-    const name2 = agent ? agent.displayName || agent.name : path64.basename(grant.agentPath);
+    const name2 = agent ? agent.displayName || agent.name : path65.basename(grant.agentPath);
     const title = deps.actionTitle(grant.capabilityId);
     await deps.activity.emit({
       actorType: UPGRADE_WRITER.actorType,
@@ -173490,7 +173820,7 @@ async function recordEndedStandingGrants(deps) {
     });
   }
   try {
-    await fs33.rm(file2, { force: true });
+    await fs34.rm(file2, { force: true });
   } catch (err) {
     deps.logger.warn("[Permissions] could not remove the ended standing permissions file", {
       err: err instanceof Error ? err.message : String(err)
@@ -173509,12 +173839,12 @@ var init_ended_standing_grants = __esm({
 });
 
 // src/commands/auth-runtime.ts
-import path65 from "node:path";
+import path66 from "node:path";
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync26 } from "node:fs";
 import { input as input2, password as passwordPrompt } from "@inquirer/prompts";
 async function buildAuthRuntime(dorkHome) {
   mkdirSync8(dorkHome, { recursive: true });
-  const db2 = createDb(path65.join(dorkHome, "dork.db"));
+  const db2 = createDb(path66.join(dorkHome, "dork.db"));
   const { captureLiveStandingGrants: captureLiveStandingGrants2, readStandingGrantLicence: readStandingGrantLicence2 } = await Promise.resolve().then(() => (init_ended_standing_grants(), ended_standing_grants_exports));
   captureLiveStandingGrants2(db2, dorkHome, console, readStandingGrantLicence2(dorkHome));
   runMigrations(db2);
@@ -175603,19 +175933,19 @@ var init_cloud_link_client = __esm({
 
 // ../../apps/server/src/lib/instance-id.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import fs34 from "node:fs/promises";
-import path66 from "node:path";
+import fs35 from "node:fs/promises";
+import path67 from "node:path";
 async function getOrCreateInstanceId(dorkHome) {
-  const filePath = path66.join(dorkHome, INSTANCE_ID_FILENAME2);
+  const filePath = path67.join(dorkHome, INSTANCE_ID_FILENAME2);
   try {
-    const existing = await fs34.readFile(filePath, "utf8");
+    const existing = await fs35.readFile(filePath, "utf8");
     const trimmed = existing.trim();
     if (trimmed) return trimmed;
   } catch {
   }
   const id = randomUUID8();
-  await fs34.mkdir(dorkHome, { recursive: true });
-  await fs34.writeFile(filePath, id, "utf8");
+  await fs35.mkdir(dorkHome, { recursive: true });
+  await fs35.writeFile(filePath, id, "utf8");
   return id;
 }
 var INSTANCE_ID_FILENAME2;
@@ -176486,14 +176816,14 @@ function parseAgentCreateArgs(rawArgs) {
   }
   const { values: values2 } = parsed;
   const name2 = typeof values2.name === "string" ? values2.name : void 0;
-  const path73 = typeof values2.path === "string" ? values2.path : void 0;
+  const path74 = typeof values2.path === "string" ? values2.path : void 0;
   if (!name2) throw new Error(`Missing required --name.
 ${usage}`);
-  if (!path73) throw new Error(`Missing required --path.
+  if (!path74) throw new Error(`Missing required --path.
 ${usage}`);
   return {
     name: name2,
-    path: path73,
+    path: path74,
     template: typeof values2.template === "string" ? values2.template : void 0,
     displayName: typeof values2["display-name"] === "string" ? values2["display-name"] : void 0,
     description: typeof values2.description === "string" ? values2.description : void 0,
@@ -176543,12 +176873,12 @@ function parseAgentUpdateArgs(rawArgs) {
     rethrowUnknownOption(err, "agent update", usage);
   }
   const { values: values2 } = parsed;
-  const path73 = typeof values2.path === "string" ? values2.path : void 0;
-  if (!path73) throw new Error(`Missing required --path.
+  const path74 = typeof values2.path === "string" ? values2.path : void 0;
+  if (!path74) throw new Error(`Missing required --path.
 ${usage}`);
   const clearable = (v2) => typeof v2 === "string" ? v2.length === 0 ? null : v2 : void 0;
   return {
-    path: path73,
+    path: path74,
     displayName: typeof values2["display-name"] === "string" ? values2["display-name"] : void 0,
     description: typeof values2.description === "string" ? values2.description : void 0,
     color: clearable(values2.color),
@@ -177122,8 +177452,8 @@ __export(room_exports, {
   runRoomExport: () => runRoomExport
 });
 import { parseArgs as parseArgs30 } from "node:util";
-import fs35 from "node:fs";
-import path67 from "node:path";
+import fs36 from "node:fs";
+import path68 from "node:path";
 import { Readable } from "node:stream";
 import { finished as finished2, pipeline } from "node:stream/promises";
 function parseRoomExportArgs(rawArgs) {
@@ -177175,7 +177505,7 @@ async function resolveRoomId(reference) {
 }
 function suggestedFilename(disposition, roomId) {
   const match = disposition?.match(/filename="([^"]+)"/);
-  const name2 = match ? path67.basename(match[1]) : "";
+  const name2 = match ? path68.basename(match[1]) : "";
   return name2 && name2 !== "." && name2 !== ".." ? name2 : `room-${roomId}.jsonl`;
 }
 async function streamExport(body, destination, closeDestination) {
@@ -177209,18 +177539,18 @@ async function streamExport(body, destination, closeDestination) {
   return { entryCount: null, reason };
 }
 async function writeExportFile(body, target) {
-  const staging = fs35.mkdtempSync(path67.join(path67.dirname(target), ".dorkos-export-"));
-  const scratch = path67.join(staging, path67.basename(target));
+  const staging = fs36.mkdtempSync(path68.join(path68.dirname(target), ".dorkos-export-"));
+  const scratch = path68.join(staging, path68.basename(target));
   let file2;
   try {
-    file2 = fs35.createWriteStream(scratch);
+    file2 = fs36.createWriteStream(scratch);
     const outcome = await streamExport(body, file2, true);
-    if (outcome.entryCount !== null) fs35.renameSync(scratch, target);
+    if (outcome.entryCount !== null) fs36.renameSync(scratch, target);
     return outcome;
   } finally {
     if (file2) await finished2(file2).catch(() => {
     });
-    fs35.rmSync(staging, { recursive: true, force: true });
+    fs36.rmSync(staging, { recursive: true, force: true });
   }
 }
 async function runRoomExport(args) {
@@ -177231,10 +177561,10 @@ async function runRoomExport(args) {
     const toStdout = args.out === STDOUT_TARGET;
     let target = null;
     if (!toStdout) {
-      target = path67.resolve(
+      target = path68.resolve(
         args.out ?? suggestedFilename(res.headers.get("content-disposition"), roomId)
       );
-      if (!args.force && fs35.existsSync(target)) {
+      if (!args.force && fs36.existsSync(target)) {
         console.error(`Error: ${target} already exists. Pass --force to replace it.`);
         return 1;
       }
@@ -177428,7 +177758,7 @@ var init_connector_schemas2 = __esm({
 });
 
 // src/commands/connections-args.ts
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 function requireNonblank(value, flag, usage) {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw new Error(`Missing required ${flag} value.
@@ -177451,7 +177781,7 @@ ${usage}`);
   if (typeof inline === "string") raw = inline;
   if (typeof file2 === "string") {
     try {
-      raw = fs36.readFileSync(file2 === "-" ? 0 : file2, "utf8");
+      raw = fs37.readFileSync(file2 === "-" ? 0 : file2, "utf8");
     } catch (error63) {
       throw new Error(
         `Cannot read ${fileFlag} '${file2}': ${error63 instanceof Error ? error63.message : String(error63)}`,
@@ -178413,7 +178743,7 @@ __export(call_exports, {
   parseCallArgs: () => parseCallArgs2,
   runCall: () => runCall2
 });
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import { parseArgs as parseArgs34 } from "node:util";
 function parseCallArgs2(rawArgs) {
   const usage = "Usage: dorkos call <capability-id> [--input <json> | --input-file <path>]";
@@ -178450,7 +178780,7 @@ ${usage}`);
     rawInput = inline;
   } else if (file2 !== void 0) {
     try {
-      rawInput = fs37.readFileSync(file2 === "-" ? 0 : file2, "utf-8");
+      rawInput = fs38.readFileSync(file2 === "-" ? 0 : file2, "utf-8");
     } catch (err) {
       throw new Error(
         `Cannot read --input-file '${file2}': ${err instanceof Error ? err.message : String(err)}`,
@@ -178554,8 +178884,8 @@ __export(version_exports, {
   runVersionCheck: () => runVersionCheck,
   runVersionDispatcher: () => runVersionDispatcher
 });
-import fs38 from "node:fs";
-import path68 from "node:path";
+import fs39 from "node:fs";
+import path69 from "node:path";
 import { parseArgs as parseArgs35 } from "node:util";
 function parseVersionArgs(rawArgs) {
   const usage = "Usage: dorkos version [--check] [--json]";
@@ -178577,7 +178907,7 @@ function parseVersionArgs(rawArgs) {
 }
 function readCachedLatest(dorkHome) {
   try {
-    const raw = fs38.readFileSync(path68.join(dorkHome, "cache", "update-check.json"), "utf-8");
+    const raw = fs39.readFileSync(path69.join(dorkHome, "cache", "update-check.json"), "utf-8");
     const cache3 = JSON.parse(raw);
     return typeof cache3.latestVersion === "string" ? cache3.latestVersion : null;
   } catch {
@@ -178671,12 +179001,12 @@ __export(cleanup_command_exports, {
   runCleanup: () => runCleanup
 });
 import { confirm as confirm2 } from "@inquirer/prompts";
-import fs39 from "fs";
-import path69 from "path";
+import fs40 from "fs";
+import path70 from "path";
 import http from "node:http";
 function readPort(dorkHome) {
   try {
-    const raw = fs39.readFileSync(path69.join(dorkHome, "config.json"), "utf-8");
+    const raw = fs40.readFileSync(path70.join(dorkHome, "config.json"), "utf-8");
     const config3 = JSON.parse(raw);
     const port2 = config3?.server?.port;
     if (typeof port2 === "number" && port2 > 0) return port2;
@@ -178703,7 +179033,7 @@ async function findProjectPaths(dbPath) {
     const db2 = new Database3(dbPath, { readonly: true });
     try {
       const rows = db2.prepare("SELECT DISTINCT project_path FROM agents").all();
-      return rows.map((r3) => r3.project_path).filter((p) => fs39.existsSync(path69.join(p, ".dork")));
+      return rows.map((r3) => r3.project_path).filter((p) => fs40.existsSync(path70.join(p, ".dork")));
     } finally {
       db2.close();
     }
@@ -178713,7 +179043,7 @@ async function findProjectPaths(dbPath) {
 }
 async function runCleanup(options) {
   const { dorkHome } = options;
-  if (!fs39.existsSync(dorkHome)) {
+  if (!fs40.existsSync(dorkHome)) {
     console.log("\nNo DorkOS data found. Nothing to clean up.\n");
     return;
   }
@@ -178726,7 +179056,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     return;
   }
   console.log("\nDorkOS Cleanup\n");
-  const entries = fs39.readdirSync(dorkHome);
+  const entries = fs40.readdirSync(dorkHome);
   if (entries.length === 0) {
     console.log("No DorkOS data found. Nothing to clean up.\n");
     return;
@@ -178737,8 +179067,8 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     console.log(`  ${entry.padEnd(20)} (${description})`);
   }
   console.log("");
-  const dbPath = path69.join(dorkHome, "dork.db");
-  const projectPaths = fs39.existsSync(dbPath) ? await findProjectPaths(dbPath) : [];
+  const dbPath = path70.join(dorkHome, "dork.db");
+  const projectPaths = fs40.existsSync(dbPath) ? await findProjectPaths(dbPath) : [];
   const removeGlobal = await confirm2({
     message: `Remove global DorkOS data (${dorkHome})?`,
     default: false
@@ -178747,7 +179077,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     console.log("\n  Aborted.\n");
     return;
   }
-  fs39.rmSync(dorkHome, { recursive: true, force: true });
+  fs40.rmSync(dorkHome, { recursive: true, force: true });
   console.log(`
   Removed ${dorkHome}
 `);
@@ -178763,8 +179093,8 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     });
     if (removeProjects) {
       for (const p of projectPaths) {
-        const dorkDir = path69.join(p, ".dork");
-        fs39.rmSync(dorkDir, { recursive: true, force: true });
+        const dorkDir = path70.join(p, ".dork");
+        fs40.rmSync(dorkDir, { recursive: true, force: true });
         console.log(`  Removed ${dorkDir}`);
       }
       console.log("");
@@ -178799,9 +179129,9 @@ __export(config_write_exports2, {
   createServerConfigWriter: () => createServerConfigWriter,
   writeOrExplain: () => writeOrExplain
 });
-import path70 from "path";
+import path71 from "path";
 async function openAuditLog(dorkHome, level) {
-  const logDir2 = path70.join(dorkHome, "logs");
+  const logDir2 = path71.join(dorkHome, "logs");
   try {
     const { initLogger: initLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
     initLogger2({ logDir: logDir2, level });
@@ -179090,17 +179420,17 @@ __export(init_wizard_exports, {
   runInitWizard: () => runInitWizard
 });
 import { input as input3, select, confirm as confirm3 } from "@inquirer/prompts";
-import fs40 from "fs";
-import path71 from "path";
+import fs41 from "fs";
+import path72 from "path";
 async function runInitWizard(options) {
   const { yes, dorkHome, store } = options;
-  const configPath = path71.join(dorkHome, "config.json");
+  const configPath = path72.join(dorkHome, "config.json");
   if (yes) {
     store.reset();
     console.log(`Config initialized with defaults at ${configPath}`);
     return;
   }
-  if (fs40.existsSync(configPath)) {
+  if (fs41.existsSync(configPath)) {
     const overwrite = await confirm3({
       message: "Config already exists. Overwrite with new settings?",
       default: false
@@ -179144,7 +179474,7 @@ async function runInitWizard(options) {
   store.setDot("ui.theme", theme);
   store.setDot("tunnel.enabled", tunnelEnabled);
   if (cwd && cwd.trim() !== "") {
-    store.setDot("server.cwd", path71.resolve(cwd));
+    store.setDot("server.cwd", path72.resolve(cwd));
   }
   console.log(`
 Config saved to ${configPath}`);
@@ -179161,9 +179491,9 @@ init_check_claude();
 init_check_core_extensions();
 init_check_extension_compilation();
 import os11, { networkInterfaces } from "os";
-import path72 from "path";
+import path73 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
-import fs41 from "fs";
+import fs42 from "fs";
 
 // src/update-check.ts
 init_dork_home2();
@@ -179235,9 +179565,9 @@ async function alreadyShown() {
   }
 }
 async function markShown() {
-  const path73 = getMarkerPath();
-  await mkdir2(dirname2(path73), { recursive: true });
-  await writeFile2(path73, JSON.stringify({ shownAt: Date.now() }));
+  const path74 = getMarkerPath();
+  await mkdir2(dirname2(path74), { recursive: true });
+  await writeFile2(path74, JSON.stringify({ shownAt: Date.now() }));
 }
 async function maybeShowNewsletterTip() {
   try {
@@ -179953,7 +180283,7 @@ if (nodeVersionIssue) {
   console.error(formatDiagnostic(nodeVersionIssue));
   process.exit(1);
 }
-var __dirname2 = path72.dirname(fileURLToPath7(import.meta.url));
+var __dirname2 = path73.dirname(fileURLToPath7(import.meta.url));
 var knownCommands = /* @__PURE__ */ new Set([
   "package",
   "harness",
@@ -180107,7 +180437,7 @@ if (process.argv[2] === "community") {
     );
     Object.assign(childEnv, credentialEnv.pickCommunityCredentialEnv(rawProcessEnv));
     const exitCode = await dispatcher.runCommunityDispatcher(process.argv.slice(3), {
-      cliVersion: "0.127.0",
+      cliVersion: "0.127.1",
       dorkHome: DORK_HOME,
       processEnv: childEnv,
       parseRelease: (bytes) => releaseContract.parseCompatibleCommunityReleaseManifest(
@@ -180125,7 +180455,7 @@ if (process.argv[2] === "community") {
     process.exit(1);
   }
 }
-var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.127.0" });
+var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.127.1" });
 var uninstallCliErrorHandlers = cliErrorReporter ? installCliErrorHandlers(cliErrorReporter) : void 0;
 if (process.argv[2] === "doctor") {
   process.env.DORK_HOME = DORK_HOME;
@@ -180135,7 +180465,7 @@ if (process.argv[2] === "doctor") {
 if (process.argv[2] === "feedback") {
   process.env.DORK_HOME = DORK_HOME;
   const { runFeedback: runFeedback2 } = await Promise.resolve().then(() => (init_feedback2(), feedback_exports));
-  process.exit(await runFeedback2(DORK_HOME, "0.127.0", process.argv.slice(3)));
+  process.exit(await runFeedback2(DORK_HOME, "0.127.1", process.argv.slice(3)));
 }
 if (process.argv[2] === "auth") {
   process.env.DORK_HOME = DORK_HOME;
@@ -180144,13 +180474,13 @@ if (process.argv[2] === "auth") {
 }
 if (process.argv[2] === "cloud") {
   process.env.DORK_HOME = DORK_HOME;
-  fs41.mkdirSync(DORK_HOME, { recursive: true });
+  fs42.mkdirSync(DORK_HOME, { recursive: true });
   const { runCloudDispatcher: runCloudDispatcher2 } = await Promise.resolve().then(() => (init_cloud_dispatcher(), cloud_dispatcher_exports));
   process.exit(await runCloudDispatcher2(DORK_HOME, process.argv[3], process.argv.slice(4)));
 }
 if (process.argv[2] === "telemetry") {
   process.env.DORK_HOME = DORK_HOME;
-  fs41.mkdirSync(DORK_HOME, { recursive: true });
+  fs42.mkdirSync(DORK_HOME, { recursive: true });
   const { runTelemetryDispatcher: runTelemetryDispatcher2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
   process.exit(await runTelemetryDispatcher2(DORK_HOME, process.argv[3], process.argv.slice(4)));
 }
@@ -180234,7 +180564,7 @@ if (process.argv[2] === "agent" || process.argv[2] === "task" || process.argv[2]
     }
   }
   const { runVersionDispatcher: runVersionDispatcher2 } = await Promise.resolve().then(() => (init_version5(), version_exports));
-  process.exit(await runVersionDispatcher2("0.127.0", DORK_HOME, subArgs));
+  process.exit(await runVersionDispatcher2("0.127.1", DORK_HOME, subArgs));
 }
 var { values, positionals } = parseCliArgs();
 if (positionals[0] && !knownCommands.has(positionals[0])) {
@@ -180328,14 +180658,14 @@ Examples:
   process.exit(0);
 }
 if (values.version) {
-  console.log("0.127.0");
+  console.log("0.127.1");
   process.exit(0);
 }
 if (values["post-install-check"]) {
   const claudeFound = checkClaude();
   const coreExtensionsFound = checkCoreExtensions();
   const extensionsCompile = await checkExtensionCompilation();
-  console.log(`dorkos ${"0.127.0"}`);
+  console.log(`dorkos ${"0.127.1"}`);
   if (!coreExtensionsFound) {
     console.log("Installation incomplete \u2014 bundled core extensions are missing.");
   }
@@ -180358,7 +180688,7 @@ if (subcommand === "cleanup") {
   process.exit(process.exitCode ?? 0);
 }
 try {
-  fs41.mkdirSync(DORK_HOME, { recursive: true });
+  fs42.mkdirSync(DORK_HOME, { recursive: true });
 } catch (err) {
   const reason = err instanceof Error ? err.message : String(err);
   console.error(`\u26A0  DorkOS could not set up ${DORK_HOME}: ${reason}`);
@@ -180412,7 +180742,7 @@ if (cliPort) {
   process.env.DORKOS_PORT = configPort ? String(configPort) : String(DEFAULT_PORT);
 }
 process.env.NODE_ENV = "production";
-process.env.CLIENT_DIST_PATH = path72.join(__dirname2, "../client");
+process.env.CLIENT_DIST_PATH = path73.join(__dirname2, "../client");
 if (values.tunnel) process.env.TUNNEL_ENABLED = "true";
 var tunnelAuthtoken = cfgMgr.getDot("tunnel.authtoken");
 if (tunnelAuthtoken && !process.env.NGROK_AUTHTOKEN) {
@@ -180445,18 +180775,18 @@ if (values.open !== void 0) {
 }
 var cliDir = values.dir;
 if (cliDir) {
-  process.env.DORKOS_DEFAULT_CWD = path72.resolve(cliDir);
+  process.env.DORKOS_DEFAULT_CWD = path73.resolve(cliDir);
 } else if (!process.env.DORKOS_DEFAULT_CWD) {
   const configCwd = cfgMgr.getDot("server.cwd");
-  process.env.DORKOS_DEFAULT_CWD = configCwd ? path72.resolve(configCwd) : process.cwd();
+  process.env.DORKOS_DEFAULT_CWD = configCwd ? path73.resolve(configCwd) : process.cwd();
 }
 var cliBoundary = values.boundary;
 if (cliBoundary) {
-  process.env.DORKOS_BOUNDARY = path72.resolve(cliBoundary);
+  process.env.DORKOS_BOUNDARY = path73.resolve(cliBoundary);
 } else if (!process.env.DORKOS_BOUNDARY) {
   const configBoundary = cfgMgr.getDot("server.boundary");
   if (configBoundary) {
-    process.env.DORKOS_BOUNDARY = path72.resolve(configBoundary);
+    process.env.DORKOS_BOUNDARY = path73.resolve(configBoundary);
   }
 }
 var boundaryVal = process.env.DORKOS_BOUNDARY;
@@ -180468,7 +180798,7 @@ if (boundaryVal) {
 }
 var effectiveBoundary = process.env.DORKOS_BOUNDARY || home;
 var resolvedDir = process.env.DORKOS_DEFAULT_CWD;
-if (resolvedDir !== effectiveBoundary && !resolvedDir.startsWith(effectiveBoundary + path72.sep)) {
+if (resolvedDir !== effectiveBoundary && !resolvedDir.startsWith(effectiveBoundary + path73.sep)) {
   console.warn(
     `[Warning] Default CWD "${resolvedDir}" is outside boundary "${effectiveBoundary}". Falling back to boundary root.`
   );
@@ -180476,13 +180806,13 @@ if (resolvedDir !== effectiveBoundary && !resolvedDir.startsWith(effectiveBounda
 }
 var logLevelName = values["log-level"] || env4.LOG_LEVEL || cfgMgr.getDot("logging.level") || (env4.NODE_ENV === "production" ? "info" : "debug");
 process.env.DORKOS_LOG_LEVEL = String(LOG_LEVEL_MAP[logLevelName] ?? 3);
-var envPath = path72.join(process.env.DORKOS_DEFAULT_CWD, ".env");
-if (fs41.existsSync(envPath)) {
+var envPath = path73.join(process.env.DORKOS_DEFAULT_CWD, ".env");
+if (fs42.existsSync(envPath)) {
   const dotenv = await import("dotenv");
   dotenv.config({ path: envPath, override: false });
 }
 uninstallCliErrorHandlers?.();
-stampCliLaunch(process.env, fileURLToPath7(import.meta.url), "0.127.0");
+stampCliLaunch(process.env, fileURLToPath7(import.meta.url), "0.127.1");
 var server;
 try {
   server = await import("../server/index.js");
@@ -180507,7 +180837,7 @@ var ansiReset = "\x1B[0m";
 console.log("");
 console.log(`${purple}${logo}${ansiReset}`);
 console.log("");
-console.log(`  DorkOS v${"0.127.0"}`);
+console.log(`  DorkOS v${"0.127.1"}`);
 console.log(`  Local:   ${link(localUrl, localUrl)}`);
 var nets = networkInterfaces();
 var networkUrl = null;
@@ -180533,9 +180863,9 @@ if (shouldOpenBrowser && process.stdin.isTTY) {
   const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   exec(`${openCmd} ${localUrl}`);
 }
-checkForUpdate("0.127.0").then((latestVersion) => {
+checkForUpdate("0.127.1").then((latestVersion) => {
   if (latestVersion) {
-    const msg = `Update available: ${"0.127.0"} \u2192 ${latestVersion}`;
+    const msg = `Update available: ${"0.127.1"} \u2192 ${latestVersion}`;
     const cmd = "Run npm install -g dorkos@latest to update";
     const width = Math.max(msg.length, cmd.length) + 6;
     const pad2 = (s2) => `\u2502   ${s2}${" ".repeat(width - s2.length - 6)}   \u2502`;