episoda 0.2.93 → 0.2.95

package/dist/daemon/daemon-process.js

@@ -1571,15 +1571,15 @@ var require_git_executor = __commonJS({
           try {
             const { stdout: gitDir } = await execAsync3("git rev-parse --git-dir", { cwd, timeout: 5e3 });
             const gitDirPath = gitDir.trim();
-            const fs21 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
+            const fs22 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
             const rebaseMergePath = `${gitDirPath}/rebase-merge`;
             const rebaseApplyPath = `${gitDirPath}/rebase-apply`;
             try {
-              await fs21.access(rebaseMergePath);
+              await fs22.access(rebaseMergePath);
               inRebase = true;
             } catch {
               try {
-                await fs21.access(rebaseApplyPath);
+                await fs22.access(rebaseApplyPath);
                 inRebase = true;
               } catch {
                 inRebase = false;
@@ -1633,9 +1633,9 @@ var require_git_executor = __commonJS({
               error: validation.error || "UNKNOWN_ERROR"
             };
           }
-          const fs21 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
+          const fs22 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
           try {
-            await fs21.access(command.path);
+            await fs22.access(command.path);
             return {
               success: false,
               error: "WORKTREE_EXISTS",
@@ -1689,9 +1689,9 @@ var require_git_executor = __commonJS({
        */
       async executeWorktreeRemove(command, cwd, options) {
         try {
-          const fs21 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
+          const fs22 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
           try {
-            await fs21.access(command.path);
+            await fs22.access(command.path);
           } catch {
             return {
               success: false,
@@ -1726,7 +1726,7 @@ var require_git_executor = __commonJS({
           const result = await this.runGitCommand(args, cwd, options);
           if (result.success) {
             try {
-              await fs21.rm(command.path, { recursive: true, force: true });
+              await fs22.rm(command.path, { recursive: true, force: true });
             } catch {
             }
             return {
@@ -1860,10 +1860,10 @@ var require_git_executor = __commonJS({
        */
       async executeCloneBare(command, options) {
         try {
-          const fs21 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
-          const path22 = await Promise.resolve().then(() => __importStar(require("path")));
+          const fs22 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
+          const path23 = await Promise.resolve().then(() => __importStar(require("path")));
           try {
-            await fs21.access(command.path);
+            await fs22.access(command.path);
             return {
               success: false,
               error: "BRANCH_ALREADY_EXISTS",
@@ -1872,9 +1872,9 @@ var require_git_executor = __commonJS({
             };
           } catch {
           }
-          const parentDir = path22.dirname(command.path);
+          const parentDir = path23.dirname(command.path);
           try {
-            await fs21.mkdir(parentDir, { recursive: true });
+            await fs22.mkdir(parentDir, { recursive: true });
           } catch {
           }
           const { stdout, stderr } = await execAsync3(
@@ -1922,22 +1922,22 @@ var require_git_executor = __commonJS({
        */
       async executeProjectInfo(cwd, options) {
         try {
-          const fs21 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
-          const path22 = await Promise.resolve().then(() => __importStar(require("path")));
+          const fs22 = await Promise.resolve().then(() => __importStar(require("fs"))).then((m) => m.promises);
+          const path23 = await Promise.resolve().then(() => __importStar(require("path")));
           let currentPath = cwd;
           let projectPath = cwd;
           let bareRepoPath;
           for (let i = 0; i < 10; i++) {
-            const bareDir = path22.join(currentPath, ".bare");
-            const episodaDir = path22.join(currentPath, ".episoda");
+            const bareDir = path23.join(currentPath, ".bare");
+            const episodaDir = path23.join(currentPath, ".episoda");
             try {
-              await fs21.access(bareDir);
-              await fs21.access(episodaDir);
+              await fs22.access(bareDir);
+              await fs22.access(episodaDir);
               projectPath = currentPath;
               bareRepoPath = bareDir;
               break;
             } catch {
-              const parentPath = path22.dirname(currentPath);
+              const parentPath = path23.dirname(currentPath);
               if (parentPath === currentPath) {
                 break;
               }
@@ -2153,7 +2153,7 @@ var require_websocket_client = __commonJS({
           clearTimeout(this.reconnectTimeout);
           this.reconnectTimeout = void 0;
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           const connectionTimeout = setTimeout(() => {
             if (this.ws) {
               this.ws.terminate();
@@ -2182,7 +2182,7 @@ var require_websocket_client = __commonJS({
                 daemonPid: this.daemonPid
               });
               this.startHeartbeat();
-              resolve3();
+              resolve4();
             });
             this.ws.on("pong", () => {
               if (this.heartbeatTimeoutTimer) {
@@ -2313,13 +2313,13 @@ var require_websocket_client = __commonJS({
           console.warn("[EpisodaClient] Cannot send - WebSocket not connected");
           return false;
         }
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           this.ws.send(JSON.stringify(message), (error) => {
             if (error) {
               console.error("[EpisodaClient] Failed to send message:", error);
-              resolve3(false);
+              resolve4(false);
             } else {
-              resolve3(true);
+              resolve4(true);
             }
           });
         });
@@ -2572,31 +2572,31 @@ var require_auth = __commonJS({
     exports2.loadConfig = loadConfig8;
     exports2.saveConfig = saveConfig2;
     exports2.validateToken = validateToken;
-    var fs21 = __importStar(require("fs"));
-    var path22 = __importStar(require("path"));
+    var fs22 = __importStar(require("fs"));
+    var path23 = __importStar(require("path"));
     var os9 = __importStar(require("os"));
     var child_process_1 = require("child_process");
     var DEFAULT_CONFIG_FILE = "config.json";
     function getConfigDir8() {
-      return process.env.EPISODA_CONFIG_DIR || path22.join(os9.homedir(), ".episoda");
+      return process.env.EPISODA_CONFIG_DIR || path23.join(os9.homedir(), ".episoda");
     }
     function getConfigPath(configPath) {
       if (configPath) {
         return configPath;
       }
-      return path22.join(getConfigDir8(), DEFAULT_CONFIG_FILE);
+      return path23.join(getConfigDir8(), DEFAULT_CONFIG_FILE);
     }
     function ensureConfigDir(configPath) {
-      const dir = path22.dirname(configPath);
-      const isNew = !fs21.existsSync(dir);
+      const dir = path23.dirname(configPath);
+      const isNew = !fs22.existsSync(dir);
       if (isNew) {
-        fs21.mkdirSync(dir, { recursive: true, mode: 448 });
+        fs22.mkdirSync(dir, { recursive: true, mode: 448 });
       }
       if (process.platform === "darwin") {
-        const nosyncPath = path22.join(dir, ".nosync");
-        if (isNew || !fs21.existsSync(nosyncPath)) {
+        const nosyncPath = path23.join(dir, ".nosync");
+        if (isNew || !fs22.existsSync(nosyncPath)) {
           try {
-            fs21.writeFileSync(nosyncPath, "", { mode: 384 });
+            fs22.writeFileSync(nosyncPath, "", { mode: 384 });
             (0, child_process_1.execSync)(`xattr -w com.apple.fileprovider.ignore 1 "${dir}"`, {
               stdio: "ignore",
               timeout: 5e3
@@ -2608,9 +2608,9 @@ var require_auth = __commonJS({
     }
     async function loadConfig8(configPath) {
       const fullPath = getConfigPath(configPath);
-      if (fs21.existsSync(fullPath)) {
+      if (fs22.existsSync(fullPath)) {
         try {
-          const content = fs21.readFileSync(fullPath, "utf8");
+          const content = fs22.readFileSync(fullPath, "utf8");
           const config = JSON.parse(content);
           return config;
         } catch (error) {
@@ -2620,9 +2620,9 @@ var require_auth = __commonJS({
       if (process.env.EPISODA_MODE === "cloud" && process.env.EPISODA_WORKSPACE) {
         const homeDir = process.env.HOME || require("os").homedir();
         const workspaceConfigPath = require("path").join(homeDir, "episoda", process.env.EPISODA_WORKSPACE, ".episoda", "config.json");
-        if (fs21.existsSync(workspaceConfigPath)) {
+        if (fs22.existsSync(workspaceConfigPath)) {
           try {
-            const content = fs21.readFileSync(workspaceConfigPath, "utf8");
+            const content = fs22.readFileSync(workspaceConfigPath, "utf8");
             const workspaceConfig = JSON.parse(content);
             return {
               access_token: process.env.EPISODA_ACCESS_TOKEN || workspaceConfig.accessToken,
@@ -2669,7 +2669,7 @@ var require_auth = __commonJS({
       ensureConfigDir(fullPath);
       try {
         const content = JSON.stringify(config, null, 2);
-        fs21.writeFileSync(fullPath, content, { mode: 384 });
+        fs22.writeFileSync(fullPath, content, { mode: 384 });
       } catch (error) {
         throw new Error(`Failed to save config: ${error instanceof Error ? error.message : String(error)}`);
       }
@@ -2786,7 +2786,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "episoda",
-      version: "0.2.93",
+      version: "0.2.95",
       description: "CLI tool for Episoda local development workflow orchestration",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -2821,7 +2821,8 @@ var require_package = __commonJS({
       },
       optionalDependencies: {
         "@anthropic-ai/claude-code": "^2.0.0",
-        "@openai/codex": "^0.86.0"
+        "@openai/codex": "^0.86.0",
+        "@modelcontextprotocol/server-github": "^0.6.0"
       },
       devDependencies: {
         "@episoda/core": "*",
@@ -3088,10 +3089,10 @@ var IPCServer = class {
     this.server = net.createServer((socket) => {
       this.handleConnection(socket);
     });
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       this.server.listen(socketPath, () => {
         fs3.chmodSync(socketPath, 384);
-        resolve3();
+        resolve4();
       });
       this.server.on("error", reject);
     });
@@ -3102,12 +3103,12 @@ var IPCServer = class {
   async stop() {
     if (!this.server) return;
     const socketPath = getSocketPath();
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       this.server.close(() => {
         if (fs3.existsSync(socketPath)) {
           fs3.unlinkSync(socketPath);
         }
-        resolve3();
+        resolve4();
       });
     });
   }
@@ -3240,18 +3241,171 @@ function performBackgroundUpdate(targetVersion) {
 }
 
 // src/daemon/handlers/file-handlers.ts
-var fs4 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var fs5 = __toESM(require("fs"));
+var path6 = __toESM(require("path"));
 var readline = __toESM(require("readline"));
-var DEFAULT_MAX_FILE_SIZE = 20 * 1024 * 1024;
-function validatePath(filePath, projectPath) {
+
+// src/daemon/permissions/path-classifier.ts
+var path5 = __toESM(require("path"));
+var fs4 = __toESM(require("fs"));
+function classifyPath(targetPath, options) {
+  const { workspaceRoot, projectRoot } = options;
+  const normalizedWorkspace = path5.resolve(workspaceRoot);
+  const normalizedProject = path5.resolve(projectRoot);
+  const resolvedPath = path5.isAbsolute(targetPath) ? path5.resolve(targetPath) : path5.resolve(projectRoot, targetPath);
+  const artifactsDir = path5.join(normalizedWorkspace, "artifacts");
+  if (resolvedPath.startsWith(artifactsDir + path5.sep) || resolvedPath === artifactsDir) {
+    return {
+      classification: "artifacts",
+      resolvedPath
+    };
+  }
+  if (!resolvedPath.startsWith(normalizedProject + path5.sep) && resolvedPath !== normalizedProject) {
+    if (resolvedPath.startsWith(normalizedWorkspace + path5.sep)) {
+      return {
+        classification: "unknown",
+        resolvedPath
+      };
+    }
+    return {
+      classification: "unknown",
+      resolvedPath
+    };
+  }
+  const relativePath = path5.relative(normalizedProject, resolvedPath);
+  const pathParts = relativePath.split(path5.sep);
+  if (pathParts[0] === ".bare") {
+    return {
+      classification: "bare_repo",
+      resolvedPath
+    };
+  }
+  if (pathParts[0] === ".episoda") {
+    return {
+      classification: "config",
+      resolvedPath
+    };
+  }
+  const firstPart = pathParts[0];
+  if (firstPart && isModuleUidPattern(firstPart)) {
+    const worktreeDir = path5.join(normalizedProject, firstPart);
+    const gitFile = path5.join(worktreeDir, ".git");
+    const worktreeExists = fs4.existsSync(gitFile) && fs4.statSync(gitFile).isFile();
+    return {
+      classification: "worktree",
+      moduleUid: firstPart,
+      worktreeExists,
+      resolvedPath
+    };
+  }
+  return {
+    classification: "project_root",
+    resolvedPath
+  };
+}
+function isModuleUidPattern(str) {
+  return /^EP\d+$/.test(str);
+}
+function deriveWorkspaceRoot(projectPath) {
+  return path5.dirname(path5.resolve(projectPath));
+}
+function validateWorkspacePath(filePath, projectPath) {
   const normalizedProjectPath = path5.resolve(projectPath);
+  const workspaceRoot = deriveWorkspaceRoot(projectPath);
+  const normalizedWorkspace = path5.resolve(workspaceRoot);
+  const artifactsDir = path5.join(normalizedWorkspace, "artifacts");
   const absolutePath = path5.isAbsolute(filePath) ? path5.resolve(filePath) : path5.resolve(projectPath, filePath);
   const normalizedPath = path5.normalize(absolutePath);
-  if (!normalizedPath.startsWith(normalizedProjectPath + path5.sep) && normalizedPath !== normalizedProjectPath) {
-    return null;
+  if (normalizedPath.startsWith(normalizedProjectPath + path5.sep) || normalizedPath === normalizedProjectPath) {
+    return normalizedPath;
   }
-  return normalizedPath;
+  if (normalizedPath.startsWith(artifactsDir + path5.sep) || normalizedPath === artifactsDir) {
+    return normalizedPath;
+  }
+  return null;
+}
+
+// src/daemon/permissions/write-permission.ts
+function checkWritePermission(targetPath, projectPath) {
+  const workspaceRoot = deriveWorkspaceRoot(projectPath);
+  const classification = classifyPath(targetPath, {
+    workspaceRoot,
+    projectRoot: projectPath
+  });
+  return evaluatePermission(classification);
+}
+function evaluatePermission(classification) {
+  const { classification: pathType, moduleUid, worktreeExists, resolvedPath } = classification;
+  switch (pathType) {
+    case "artifacts":
+      return {
+        allowed: true,
+        classification: pathType
+      };
+    case "bare_repo":
+      return {
+        allowed: false,
+        reason: "Cannot write to .bare/ directory - this is the protected git repository",
+        classification: pathType
+      };
+    case "config":
+      return {
+        allowed: false,
+        reason: "Cannot write to .episoda/ directory - this is protected configuration",
+        classification: pathType
+      };
+    case "worktree":
+      if (worktreeExists) {
+        return {
+          allowed: true,
+          classification: pathType,
+          moduleUid
+        };
+      } else {
+        return {
+          allowed: false,
+          reason: `Cannot write to ${moduleUid}/ - worktree does not exist. Module must be in 'doing' or 'review' state with an active worktree.`,
+          classification: pathType,
+          moduleUid
+        };
+      }
+    case "project_root":
+      return {
+        allowed: false,
+        reason: "Cannot write directly to project root. Files must be in a worktree directory or artifacts/",
+        classification: pathType
+      };
+    case "unknown":
+    default:
+      return {
+        allowed: false,
+        reason: "Path is outside the allowed project directory structure",
+        classification: pathType
+      };
+  }
+}
+function formatPermissionDenied(result) {
+  if (result.allowed) {
+    return "Write allowed";
+  }
+  const baseMessage = result.reason || "Write permission denied";
+  switch (result.classification) {
+    case "worktree":
+      return `${baseMessage} Use the platform to move the module to 'doing' state first.`;
+    case "bare_repo":
+    case "config":
+      return `${baseMessage} These directories are managed by the system.`;
+    case "project_root":
+      return `${baseMessage} Create files within your worktree (e.g., ${result.moduleUid || "EPxxx"}/src/...) or use artifacts/ for outputs.`;
+    default:
+      return baseMessage;
+  }
+}
+
+// src/daemon/handlers/file-handlers.ts
+var DEFAULT_MAX_FILE_SIZE = 20 * 1024 * 1024;
+function validatePath(filePath, projectPath) {
+  return validateWorkspacePath(filePath, projectPath);
 }
 async function handleFileRead(command, projectPath) {
   const { path: filePath, encoding = "base64", maxSize = DEFAULT_MAX_FILE_SIZE } = command;
@@ -3263,13 +3417,13 @@ async function handleFileRead(command, projectPath) {
     };
   }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "File not found"
       };
     }
-    const stats = fs4.statSync(validPath);
+    const stats = fs5.statSync(validPath);
     if (stats.isDirectory()) {
       return {
         success: false,
@@ -3282,7 +3436,7 @@ async function handleFileRead(command, projectPath) {
         error: `File too large: ${stats.size} bytes exceeds limit of ${maxSize} bytes`
       };
     }
-    const buffer = fs4.readFileSync(validPath);
+    const buffer = fs5.readFileSync(validPath);
     let content;
     if (encoding === "base64") {
       content = buffer.toString("base64");
@@ -3313,11 +3467,18 @@ async function handleFileWrite(command, projectPath) {
       error: "Invalid path: directory traversal not allowed"
     };
   }
+  const permission = checkWritePermission(validPath, projectPath);
+  if (!permission.allowed) {
+    return {
+      success: false,
+      error: formatPermissionDenied(permission)
+    };
+  }
   try {
     if (createDirs) {
-      const dirPath = path5.dirname(validPath);
-      if (!fs4.existsSync(dirPath)) {
-        fs4.mkdirSync(dirPath, { recursive: true });
+      const dirPath = path6.dirname(validPath);
+      if (!fs5.existsSync(dirPath)) {
+        fs5.mkdirSync(dirPath, { recursive: true });
       }
     }
     let buffer;
@@ -3327,8 +3488,8 @@ async function handleFileWrite(command, projectPath) {
       buffer = Buffer.from(content, "utf8");
     }
     const tempPath = `${validPath}.tmp.${Date.now()}`;
-    fs4.writeFileSync(tempPath, buffer);
-    fs4.renameSync(tempPath, validPath);
+    fs5.writeFileSync(tempPath, buffer);
+    fs5.renameSync(tempPath, validPath);
     return {
       success: true,
       bytesWritten: buffer.length
@@ -3353,13 +3514,13 @@ async function handleFileList(command, projectPath) {
     };
   }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "Directory not found"
       };
     }
-    const stats = fs4.statSync(validPath);
+    const stats = fs5.statSync(validPath);
     if (!stats.isDirectory()) {
       return {
         success: false,
@@ -3370,11 +3531,11 @@ async function handleFileList(command, projectPath) {
     if (recursive) {
       await listDirectoryRecursive(validPath, validPath, entries, includeHidden);
     } else {
-      const dirEntries = await fs4.promises.readdir(validPath, { withFileTypes: true });
+      const dirEntries = await fs5.promises.readdir(validPath, { withFileTypes: true });
       for (const entry of dirEntries) {
         if (!includeHidden && entry.name.startsWith(".")) continue;
-        const entryPath = path5.join(validPath, entry.name);
-        const entryStats = await fs4.promises.stat(entryPath);
+        const entryPath = path6.join(validPath, entry.name);
+        const entryStats = await fs5.promises.stat(entryPath);
         entries.push({
           name: entry.name,
           type: entry.isDirectory() ? "directory" : "file",
@@ -3396,13 +3557,13 @@ async function handleFileList(command, projectPath) {
   }
 }
 async function listDirectoryRecursive(basePath, currentPath, entries, includeHidden) {
-  const dirEntries = await fs4.promises.readdir(currentPath, { withFileTypes: true });
+  const dirEntries = await fs5.promises.readdir(currentPath, { withFileTypes: true });
   for (const entry of dirEntries) {
     if (!includeHidden && entry.name.startsWith(".")) continue;
-    const entryPath = path5.join(currentPath, entry.name);
-    const relativePath = path5.relative(basePath, entryPath);
+    const entryPath = path6.join(currentPath, entry.name);
+    const relativePath = path6.relative(basePath, entryPath);
     try {
-      const entryStats = await fs4.promises.stat(entryPath);
+      const entryStats = await fs5.promises.stat(entryPath);
       entries.push({
         name: relativePath,
         type: entry.isDirectory() ? "directory" : "file",
@@ -3426,7 +3587,7 @@ async function handleFileSearch(command, projectPath) {
     };
   }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "Directory not found"
@@ -3516,12 +3677,12 @@ function findClosingBracket(pattern, start) {
 }
 async function searchFilesRecursive(basePath, currentPath, pattern, files, maxResults) {
   if (files.length >= maxResults) return;
-  const entries = await fs4.promises.readdir(currentPath, { withFileTypes: true });
+  const entries = await fs5.promises.readdir(currentPath, { withFileTypes: true });
   for (const entry of entries) {
     if (files.length >= maxResults) return;
     if (entry.name.startsWith(".")) continue;
-    const entryPath = path5.join(currentPath, entry.name);
-    const relativePath = path5.relative(basePath, entryPath);
+    const entryPath = path6.join(currentPath, entry.name);
+    const relativePath = path6.relative(basePath, entryPath);
     try {
       if (entry.isDirectory()) {
         await searchFilesRecursive(basePath, entryPath, pattern, files, maxResults);
@@ -3549,7 +3710,7 @@ async function handleFileGrep(command, projectPath) {
     };
   }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "Path not found"
@@ -3558,7 +3719,7 @@ async function handleFileGrep(command, projectPath) {
     const matches = [];
     const searchRegex = new RegExp(pattern, caseSensitive ? "" : "i");
     const fileGlobRegex = globToRegex(filePattern);
-    const stats = fs4.statSync(validPath);
+    const stats = fs5.statSync(validPath);
     if (stats.isFile()) {
       await grepFile(validPath, validPath, searchRegex, matches, effectiveMaxResults);
     } else {
@@ -3579,8 +3740,8 @@ async function handleFileGrep(command, projectPath) {
 }
 async function grepFile(basePath, filePath, pattern, matches, maxResults) {
   if (matches.length >= maxResults) return;
-  const relativePath = path5.relative(basePath, filePath);
-  const fileStream = fs4.createReadStream(filePath, { encoding: "utf8" });
+  const relativePath = path6.relative(basePath, filePath);
+  const fileStream = fs5.createReadStream(filePath, { encoding: "utf8" });
   const rl = readline.createInterface({
     input: fileStream,
     crlfDelay: Infinity
@@ -3594,7 +3755,7 @@ async function grepFile(basePath, filePath, pattern, matches, maxResults) {
     }
     if (pattern.test(line)) {
       matches.push({
-        file: relativePath || path5.basename(filePath),
+        file: relativePath || path6.basename(filePath),
         line: lineNumber,
         content: line.slice(0, 500)
         // Truncate long lines
@@ -3604,11 +3765,11 @@ async function grepFile(basePath, filePath, pattern, matches, maxResults) {
 }
 async function grepDirectoryRecursive(basePath, currentPath, searchPattern, filePattern, matches, maxResults) {
   if (matches.length >= maxResults) return;
-  const entries = await fs4.promises.readdir(currentPath, { withFileTypes: true });
+  const entries = await fs5.promises.readdir(currentPath, { withFileTypes: true });
   for (const entry of entries) {
     if (matches.length >= maxResults) return;
     if (entry.name.startsWith(".")) continue;
-    const entryPath = path5.join(currentPath, entry.name);
+    const entryPath = path6.join(currentPath, entry.name);
     try {
       if (entry.isDirectory()) {
         await grepDirectoryRecursive(basePath, entryPath, searchPattern, filePattern, matches, maxResults);
@@ -3628,14 +3789,21 @@ async function handleFileEdit(command, projectPath) {
       error: "Invalid path: directory traversal not allowed"
     };
   }
+  const permission = checkWritePermission(validPath, projectPath);
+  if (!permission.allowed) {
+    return {
+      success: false,
+      error: formatPermissionDenied(permission)
+    };
+  }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "File not found"
       };
     }
-    const stats = fs4.statSync(validPath);
+    const stats = fs5.statSync(validPath);
     if (stats.isDirectory()) {
       return {
         success: false,
@@ -3649,7 +3817,7 @@ async function handleFileEdit(command, projectPath) {
         error: `File too large for edit operation: ${stats.size} bytes exceeds limit of ${MAX_EDIT_SIZE} bytes (10MB). Use write-file for large files.`
       };
     }
-    const content = fs4.readFileSync(validPath, "utf8");
+    const content = fs5.readFileSync(validPath, "utf8");
     const occurrences = content.split(oldString).length - 1;
     if (occurrences === 0) {
       return {
@@ -3666,8 +3834,8 @@ async function handleFileEdit(command, projectPath) {
     const newContent = replaceAll ? content.split(oldString).join(newString) : content.replace(oldString, newString);
     const replacements = replaceAll ? occurrences : 1;
     const tempPath = `${validPath}.tmp.${Date.now()}`;
-    fs4.writeFileSync(tempPath, newContent, "utf8");
-    fs4.renameSync(tempPath, validPath);
+    fs5.writeFileSync(tempPath, newContent, "utf8");
+    fs5.renameSync(tempPath, validPath);
     const newSize = Buffer.byteLength(newContent, "utf8");
     return {
       success: true,
@@ -3692,21 +3860,28 @@ async function handleFileDelete(command, projectPath) {
       error: "Invalid path: directory traversal not allowed"
     };
   }
-  const normalizedProjectPath = path5.resolve(projectPath);
+  const normalizedProjectPath = path6.resolve(projectPath);
   if (validPath === normalizedProjectPath) {
     return {
       success: false,
       error: "Cannot delete project root directory"
     };
   }
+  const permission = checkWritePermission(validPath, projectPath);
+  if (!permission.allowed) {
+    return {
+      success: false,
+      error: formatPermissionDenied(permission)
+    };
+  }
   try {
-    if (!fs4.existsSync(validPath)) {
+    if (!fs5.existsSync(validPath)) {
       return {
         success: false,
         error: "Path not found"
       };
     }
-    const stats = fs4.statSync(validPath);
+    const stats = fs5.statSync(validPath);
     const isDirectory = stats.isDirectory();
     if (isDirectory && !recursive) {
       return {
@@ -3715,9 +3890,9 @@ async function handleFileDelete(command, projectPath) {
       };
     }
     if (isDirectory) {
-      fs4.rmSync(validPath, { recursive: true, force: true });
+      fs5.rmSync(validPath, { recursive: true, force: true });
     } else {
-      fs4.unlinkSync(validPath);
+      fs5.unlinkSync(validPath);
     }
     return {
       success: true,
@@ -3742,9 +3917,16 @@ async function handleFileMkdir(command, projectPath) {
       error: "Invalid path: directory traversal not allowed"
     };
   }
+  const permission = checkWritePermission(validPath, projectPath);
+  if (!permission.allowed) {
+    return {
+      success: false,
+      error: formatPermissionDenied(permission)
+    };
+  }
   try {
-    if (fs4.existsSync(validPath)) {
-      const stats = fs4.statSync(validPath);
+    if (fs5.existsSync(validPath)) {
+      const stats = fs5.statSync(validPath);
       if (stats.isDirectory()) {
         return {
           success: true,
@@ -3759,7 +3941,7 @@ async function handleFileMkdir(command, projectPath) {
       }
     }
     const modeNum = parseInt(mode, 8);
-    fs4.mkdirSync(validPath, { recursive: true, mode: modeNum });
+    fs5.mkdirSync(validPath, { recursive: true, mode: modeNum });
     return {
       success: true,
       created: true
@@ -3786,7 +3968,7 @@ async function handleExec(command, projectPath) {
     env = {}
   } = command;
   const effectiveTimeout = Math.min(Math.max(timeout, 1e3), MAX_TIMEOUT);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -3794,7 +3976,7 @@ async function handleExec(command, projectPath) {
     const done = (result) => {
       if (resolved) return;
       resolved = true;
-      resolve3(result);
+      resolve4(result);
     };
     try {
       const proc = (0, import_child_process3.spawn)(cmd, {
@@ -3858,14 +4040,14 @@ async function handleExec(command, projectPath) {
 }
 
 // src/daemon/handlers/worktree-handlers.ts
-var path14 = __toESM(require("path"));
-var fs13 = __toESM(require("fs"));
+var path15 = __toESM(require("path"));
+var fs14 = __toESM(require("fs"));
 var import_child_process8 = require("child_process");
 var import_util = require("util");
 
 // src/daemon/worktree-manager.ts
-var fs5 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
+var fs6 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
 var import_core6 = __toESM(require_dist());
 function validateModuleUid(moduleUid) {
   if (!moduleUid || typeof moduleUid !== "string" || !moduleUid.trim()) {
@@ -3889,8 +4071,8 @@ var WorktreeManager = class _WorktreeManager {
     // ============================================================
     this.lockPath = "";
     this.projectRoot = projectRoot;
-    this.bareRepoPath = path6.join(projectRoot, ".bare");
-    this.configPath = path6.join(projectRoot, ".episoda", "config.json");
+    this.bareRepoPath = path7.join(projectRoot, ".bare");
+    this.configPath = path7.join(projectRoot, ".episoda", "config.json");
     this.gitExecutor = new import_core6.GitExecutor();
   }
   /**
@@ -3901,13 +4083,13 @@ var WorktreeManager = class _WorktreeManager {
    */
   async initialize() {
     const debug = process.env.EPISODA_DEBUG === "1" || process.env.GIT_CREDENTIAL_EPISODA_DEBUG === "1";
-    if (!fs5.existsSync(this.bareRepoPath)) {
+    if (!fs6.existsSync(this.bareRepoPath)) {
       if (debug) {
         console.log(`[WorktreeManager] initialize: .bare not found at ${this.bareRepoPath}`);
       }
       return false;
     }
-    if (!fs5.existsSync(this.configPath)) {
+    if (!fs6.existsSync(this.configPath)) {
       if (debug) {
         console.log(`[WorktreeManager] initialize: config not found at ${this.configPath}`);
       }
@@ -3966,8 +4148,8 @@ var WorktreeManager = class _WorktreeManager {
    */
   static async createProject(projectRoot, repoUrl, projectId, workspaceSlug, projectSlug) {
     const manager = new _WorktreeManager(projectRoot);
-    const episodaDir = path6.join(projectRoot, ".episoda");
-    fs5.mkdirSync(episodaDir, { recursive: true });
+    const episodaDir = path7.join(projectRoot, ".episoda");
+    fs6.mkdirSync(episodaDir, { recursive: true });
     const cloneResult = await manager.gitExecutor.execute({
       action: "clone_bare",
       url: repoUrl,
@@ -3998,7 +4180,7 @@ var WorktreeManager = class _WorktreeManager {
         error: `Invalid module UID: "${moduleUid}" - contains disallowed characters`
       };
     }
-    const worktreePath = path6.join(this.projectRoot, moduleUid);
+    const worktreePath = path7.join(this.projectRoot, moduleUid);
     const lockAcquired = await this.acquireLock();
     if (!lockAcquired) {
       return {
@@ -4189,7 +4371,7 @@ var WorktreeManager = class _WorktreeManager {
     let prunedCount = 0;
     await this.updateConfigSafe((config) => {
       const initialCount = config.worktrees.length;
-      config.worktrees = config.worktrees.filter((w) => fs5.existsSync(w.worktreePath));
+      config.worktrees = config.worktrees.filter((w) => fs6.existsSync(w.worktreePath));
       prunedCount = initialCount - config.worktrees.length;
       return config;
     });
@@ -4270,25 +4452,25 @@ var WorktreeManager = class _WorktreeManager {
     const retryInterval = 50;
     while (Date.now() - startTime < timeoutMs) {
       try {
-        fs5.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
+        fs6.writeFileSync(lockPath, String(process.pid), { flag: "wx" });
         return true;
       } catch (err) {
         if (err.code === "EEXIST") {
           try {
-            const stats = fs5.statSync(lockPath);
+            const stats = fs6.statSync(lockPath);
             const lockAge = Date.now() - stats.mtimeMs;
             if (lockAge > 3e4) {
               try {
-                const lockContent = fs5.readFileSync(lockPath, "utf-8").trim();
+                const lockContent = fs6.readFileSync(lockPath, "utf-8").trim();
                 const lockPid = parseInt(lockContent, 10);
                 if (!isNaN(lockPid) && this.isProcessRunning(lockPid)) {
-                  await new Promise((resolve3) => setTimeout(resolve3, retryInterval));
+                  await new Promise((resolve4) => setTimeout(resolve4, retryInterval));
                   continue;
                 }
               } catch {
               }
               try {
-                fs5.unlinkSync(lockPath);
+                fs6.unlinkSync(lockPath);
               } catch {
               }
               continue;
@@ -4296,7 +4478,7 @@ var WorktreeManager = class _WorktreeManager {
           } catch {
             continue;
           }
-          await new Promise((resolve3) => setTimeout(resolve3, retryInterval));
+          await new Promise((resolve4) => setTimeout(resolve4, retryInterval));
           continue;
         }
         throw err;
@@ -4309,7 +4491,7 @@ var WorktreeManager = class _WorktreeManager {
    */
   releaseLock() {
     try {
-      fs5.unlinkSync(this.getLockPath());
+      fs6.unlinkSync(this.getLockPath());
     } catch {
     }
   }
@@ -4333,11 +4515,11 @@ var WorktreeManager = class _WorktreeManager {
       // Turborepo cache
     ];
     for (const cacheDir of cacheDirs) {
-      const cachePath = path6.join(worktreePath, cacheDir);
+      const cachePath = path7.join(worktreePath, cacheDir);
       try {
-        if (fs5.existsSync(cachePath)) {
+        if (fs6.existsSync(cachePath)) {
           console.log(`[WorktreeManager] EP1070: Cleaning build cache: ${cacheDir}`);
-          fs5.rmSync(cachePath, { recursive: true, force: true });
+          fs6.rmSync(cachePath, { recursive: true, force: true });
         }
       } catch (error) {
         console.warn(`[WorktreeManager] EP1070: Failed to clean ${cacheDir} (non-blocking):`, error.message);
@@ -4346,10 +4528,10 @@ var WorktreeManager = class _WorktreeManager {
   }
   readConfig() {
     try {
-      if (!fs5.existsSync(this.configPath)) {
+      if (!fs6.existsSync(this.configPath)) {
         return null;
       }
-      const content = fs5.readFileSync(this.configPath, "utf-8");
+      const content = fs6.readFileSync(this.configPath, "utf-8");
       return JSON.parse(content);
     } catch (error) {
       if (error instanceof SyntaxError) {
@@ -4363,11 +4545,11 @@ var WorktreeManager = class _WorktreeManager {
   }
   writeConfig(config) {
     try {
-      const dir = path6.dirname(this.configPath);
-      if (!fs5.existsSync(dir)) {
-        fs5.mkdirSync(dir, { recursive: true });
+      const dir = path7.dirname(this.configPath);
+      if (!fs6.existsSync(dir)) {
+        fs6.mkdirSync(dir, { recursive: true });
       }
-      fs5.writeFileSync(this.configPath, JSON.stringify(config, null, 2), "utf-8");
+      fs6.writeFileSync(this.configPath, JSON.stringify(config, null, 2), "utf-8");
     } catch (error) {
       console.error("[WorktreeManager] Failed to write config:", error);
       throw error;
@@ -4449,14 +4631,14 @@ var WorktreeManager = class _WorktreeManager {
     }
     try {
       for (const file of files) {
-        const srcPath = path6.join(mainWorktree.worktreePath, file);
-        const destPath = path6.join(worktree.worktreePath, file);
-        if (fs5.existsSync(srcPath)) {
-          const destDir = path6.dirname(destPath);
-          if (!fs5.existsSync(destDir)) {
-            fs5.mkdirSync(destDir, { recursive: true });
-          }
-          fs5.copyFileSync(srcPath, destPath);
+        const srcPath = path7.join(mainWorktree.worktreePath, file);
+        const destPath = path7.join(worktree.worktreePath, file);
+        if (fs6.existsSync(srcPath)) {
+          const destDir = path7.dirname(destPath);
+          if (!fs6.existsSync(destDir)) {
+            fs6.mkdirSync(destDir, { recursive: true });
+          }
+          fs6.copyFileSync(srcPath, destPath);
           console.log(`[WorktreeManager] EP964: Copied ${file} to ${moduleUid} (deprecated)`);
         } else {
           console.log(`[WorktreeManager] EP964: Skipped ${file} (not found in main)`);
@@ -4539,10 +4721,10 @@ var WorktreeManager = class _WorktreeManager {
   }
 };
 function getEpisodaRoot() {
-  return process.env.EPISODA_ROOT || path6.join(require("os").homedir(), "episoda");
+  return process.env.EPISODA_ROOT || path7.join(require("os").homedir(), "episoda");
 }
 function getProjectPath(workspaceSlug, projectSlug) {
-  return path6.join(getEpisodaRoot(), workspaceSlug, projectSlug);
+  return path7.join(getEpisodaRoot(), workspaceSlug, projectSlug);
 }
 async function isWorktreeProject(projectRoot) {
   const debug = process.env.EPISODA_DEBUG === "1" || process.env.GIT_CREDENTIAL_EPISODA_DEBUG === "1";
@@ -4557,7 +4739,7 @@ async function isWorktreeProject(projectRoot) {
   return result;
 }
 async function findProjectRoot(startPath) {
-  let current = path6.resolve(startPath);
+  let current = path7.resolve(startPath);
   const episodaRoot = getEpisodaRoot();
   const debug = process.env.EPISODA_DEBUG === "1" || process.env.GIT_CREDENTIAL_EPISODA_DEBUG === "1";
   if (debug) {
@@ -4570,14 +4752,14 @@ async function findProjectRoot(startPath) {
     return null;
   }
   for (let i = 0; i < 10; i++) {
-    const bareDir = path6.join(current, ".bare");
-    const episodaDir = path6.join(current, ".episoda");
+    const bareDir = path7.join(current, ".bare");
+    const episodaDir = path7.join(current, ".episoda");
     if (debug) {
-      const bareExists = fs5.existsSync(bareDir);
-      const episodaExists = fs5.existsSync(episodaDir);
+      const bareExists = fs6.existsSync(bareDir);
+      const episodaExists = fs6.existsSync(episodaDir);
       console.log(`[WorktreeManager] findProjectRoot: checking ${current} (.bare=${bareExists}, .episoda=${episodaExists})`);
     }
-    if (fs5.existsSync(bareDir) && fs5.existsSync(episodaDir)) {
+    if (fs6.existsSync(bareDir) && fs6.existsSync(episodaDir)) {
       if (await isWorktreeProject(current)) {
         if (debug) {
           console.log(`[WorktreeManager] findProjectRoot: found valid project at ${current}`);
@@ -4585,7 +4767,7 @@ async function findProjectRoot(startPath) {
         return current;
       }
     }
-    const parent = path6.dirname(current);
+    const parent = path7.dirname(current);
     if (parent === current) {
       break;
     }
@@ -4623,39 +4805,39 @@ var import_fs = require("fs");
 // src/preview/dev-server-runner.ts
 var import_child_process5 = require("child_process");
 var http = __toESM(require("http"));
-var fs9 = __toESM(require("fs"));
-var path10 = __toESM(require("path"));
+var fs10 = __toESM(require("fs"));
+var path11 = __toESM(require("path"));
 var import_events = require("events");
 var import_core7 = __toESM(require_dist());
 
 // src/utils/port-check.ts
 var net2 = __toESM(require("net"));
 async function isPortInUse(port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const server = net2.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve3(true);
+        resolve4(true);
       } else {
-        resolve3(false);
+        resolve4(false);
       }
     });
     server.once("listening", () => {
       server.close();
-      resolve3(false);
+      resolve4(false);
     });
     server.listen(port);
   });
 }
 
 // src/utils/env-cache.ts
-var fs7 = __toESM(require("fs"));
-var path8 = __toESM(require("path"));
+var fs8 = __toESM(require("fs"));
+var path9 = __toESM(require("path"));
 var os = __toESM(require("os"));
 
 // src/utils/env-setup.ts
-var fs6 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var fs7 = __toESM(require("fs"));
+var path8 = __toESM(require("path"));
 async function fetchEnvVars(apiUrl, accessToken) {
   try {
     const url = `${apiUrl}/api/cli/env-vars`;
@@ -4690,29 +4872,29 @@ function writeEnvFile(targetPath, envVars) {
     }
     return `${key}=${value}`;
   }).join("\n") + "\n";
-  const envPath = path7.join(targetPath, ".env");
-  fs6.writeFileSync(envPath, envContent, { mode: 384 });
+  const envPath = path8.join(targetPath, ".env");
+  fs7.writeFileSync(envPath, envContent, { mode: 384 });
   console.log(`[env-setup] Wrote ${Object.keys(envVars).length} env vars to ${envPath}`);
 }
 
 // src/utils/env-cache.ts
 var DEFAULT_CACHE_TTL = 60;
-var CACHE_DIR = path8.join(os.homedir(), ".episoda", "cache");
+var CACHE_DIR = path9.join(os.homedir(), ".episoda", "cache");
 function getCacheFilePath(projectId) {
-  return path8.join(CACHE_DIR, `env-vars-${projectId}.json`);
+  return path9.join(CACHE_DIR, `env-vars-${projectId}.json`);
 }
 function ensureCacheDir() {
-  if (!fs7.existsSync(CACHE_DIR)) {
-    fs7.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
+  if (!fs8.existsSync(CACHE_DIR)) {
+    fs8.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
   }
 }
 function readCache(projectId) {
   try {
     const cacheFile = getCacheFilePath(projectId);
-    if (!fs7.existsSync(cacheFile)) {
+    if (!fs8.existsSync(cacheFile)) {
       return null;
     }
-    const content = fs7.readFileSync(cacheFile, "utf-8");
+    const content = fs8.readFileSync(cacheFile, "utf-8");
     const data = JSON.parse(content);
     if (!data.vars || typeof data.vars !== "object" || !data.fetchedAt) {
       return null;
@@ -4731,7 +4913,7 @@ function writeCache(projectId, vars) {
       fetchedAt: Date.now(),
       projectId
     };
-    fs7.writeFileSync(cacheFile, JSON.stringify(data, null, 2), { mode: 384 });
+    fs8.writeFileSync(cacheFile, JSON.stringify(data, null, 2), { mode: 384 });
   } catch (error) {
     console.warn("[env-cache] Failed to write cache:", error instanceof Error ? error.message : error);
   }
@@ -4800,11 +4982,11 @@ No cached values available as fallback.`
 }
 
 // src/preview/dev-server-registry.ts
-var fs8 = __toESM(require("fs"));
-var path9 = __toESM(require("path"));
+var fs9 = __toESM(require("fs"));
+var path10 = __toESM(require("path"));
 var os2 = __toESM(require("os"));
 var import_child_process4 = require("child_process");
-var DEV_SERVER_REGISTRY_DIR = path9.join(os2.homedir(), ".episoda", "dev-servers");
+var DEV_SERVER_REGISTRY_DIR = path10.join(os2.homedir(), ".episoda", "dev-servers");
 var DevServerRegistry = class {
   constructor() {
     this.ensureRegistryDir();
@@ -4814,9 +4996,9 @@ var DevServerRegistry = class {
    */
   ensureRegistryDir() {
     try {
-      if (!fs8.existsSync(DEV_SERVER_REGISTRY_DIR)) {
+      if (!fs9.existsSync(DEV_SERVER_REGISTRY_DIR)) {
         console.log(`[DevServerRegistry] EP1042: Creating registry directory: ${DEV_SERVER_REGISTRY_DIR}`);
-        fs8.mkdirSync(DEV_SERVER_REGISTRY_DIR, { recursive: true });
+        fs9.mkdirSync(DEV_SERVER_REGISTRY_DIR, { recursive: true });
       }
     } catch (error) {
       console.error(`[DevServerRegistry] EP1042: Failed to create registry directory:`, error);
@@ -4827,7 +5009,7 @@ var DevServerRegistry = class {
    * Get the registry file path for a module
    */
   getEntryPath(moduleUid) {
-    return path9.join(DEV_SERVER_REGISTRY_DIR, `${moduleUid}.json`);
+    return path10.join(DEV_SERVER_REGISTRY_DIR, `${moduleUid}.json`);
   }
   /**
    * Register a dev server
@@ -4838,7 +5020,7 @@ var DevServerRegistry = class {
     try {
       this.ensureRegistryDir();
       const entryPath = this.getEntryPath(entry.moduleUid);
-      fs8.writeFileSync(entryPath, JSON.stringify(entry, null, 2), "utf8");
+      fs9.writeFileSync(entryPath, JSON.stringify(entry, null, 2), "utf8");
       console.log(`[DevServerRegistry] EP1042: Registered ${entry.moduleUid} (PID ${entry.pid}, port ${entry.port})`);
     } catch (error) {
       console.error(`[DevServerRegistry] EP1042: Failed to register ${entry.moduleUid}:`, error);
@@ -4852,8 +5034,8 @@ var DevServerRegistry = class {
   unregister(moduleUid) {
     try {
       const entryPath = this.getEntryPath(moduleUid);
-      if (fs8.existsSync(entryPath)) {
-        fs8.unlinkSync(entryPath);
+      if (fs9.existsSync(entryPath)) {
+        fs9.unlinkSync(entryPath);
         console.log(`[DevServerRegistry] EP1042: Unregistered ${moduleUid}`);
       }
     } catch (error) {
@@ -4869,10 +5051,10 @@ var DevServerRegistry = class {
   getByModule(moduleUid) {
     try {
       const entryPath = this.getEntryPath(moduleUid);
-      if (!fs8.existsSync(entryPath)) {
+      if (!fs9.existsSync(entryPath)) {
         return null;
       }
-      const content = fs8.readFileSync(entryPath, "utf8");
+      const content = fs9.readFileSync(entryPath, "utf8");
       const entry = JSON.parse(content);
       if (!entry.pid || !entry.port || !entry.worktreePath) {
         console.warn(`[DevServerRegistry] EP1042: Invalid entry for ${moduleUid}, removing`);
@@ -4910,7 +5092,7 @@ var DevServerRegistry = class {
     const entries = [];
     try {
       this.ensureRegistryDir();
-      const files = fs8.readdirSync(DEV_SERVER_REGISTRY_DIR).filter((f) => f.endsWith(".json"));
+      const files = fs9.readdirSync(DEV_SERVER_REGISTRY_DIR).filter((f) => f.endsWith(".json"));
       for (const file of files) {
         const moduleUid = file.replace(".json", "");
         const entry = this.getByModule(moduleUid);
@@ -4968,7 +5150,7 @@ var DevServerRegistry = class {
       return null;
     } catch {
       try {
-        return fs8.readlinkSync(`/proc/${pid}/cwd`);
+        return fs9.readlinkSync(`/proc/${pid}/cwd`);
       } catch {
         return null;
       }
@@ -5078,7 +5260,7 @@ var DevServerRegistry = class {
     return killed;
   }
   wait(ms) {
-    return new Promise((resolve3) => setTimeout(resolve3, ms));
+    return new Promise((resolve4) => setTimeout(resolve4, ms));
   }
 };
 var registryInstance = null;
@@ -5338,8 +5520,8 @@ var DevServerRunner = class extends import_events.EventEmitter {
         cacheTtl: 300
       });
       console.log(`[DevServerRunner] Loaded ${Object.keys(result.envVars).length} env vars`);
-      const envFilePath = path10.join(projectPath, ".env");
-      if (!fs9.existsSync(envFilePath) && Object.keys(result.envVars).length > 0) {
+      const envFilePath = path11.join(projectPath, ".env");
+      if (!fs10.existsSync(envFilePath) && Object.keys(result.envVars).length > 0) {
         console.log(`[DevServerRunner] Writing .env file`);
         writeEnvFile(projectPath, result.envVars);
       }
@@ -5454,7 +5636,7 @@ var DevServerRunner = class extends import_events.EventEmitter {
     return Math.min(delay, DEV_SERVER_CONSTANTS.MAX_RESTART_DELAY_MS);
   }
   async checkHealth(port) {
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const req = http.request(
         {
           hostname: "localhost",
@@ -5463,12 +5645,12 @@ var DevServerRunner = class extends import_events.EventEmitter {
           method: "HEAD",
           timeout: DEV_SERVER_CONSTANTS.HEALTH_CHECK_TIMEOUT_MS
         },
-        () => resolve3(true)
+        () => resolve4(true)
       );
-      req.on("error", () => resolve3(false));
+      req.on("error", () => resolve4(false));
       req.on("timeout", () => {
         req.destroy();
-        resolve3(false);
+        resolve4(false);
       });
       req.end();
     });
@@ -5485,28 +5667,28 @@ var DevServerRunner = class extends import_events.EventEmitter {
     return false;
   }
   wait(ms) {
-    return new Promise((resolve3) => setTimeout(resolve3, ms));
+    return new Promise((resolve4) => setTimeout(resolve4, ms));
   }
   getLogsDir() {
-    const logsDir = path10.join((0, import_core7.getConfigDir)(), "logs");
-    if (!fs9.existsSync(logsDir)) {
-      fs9.mkdirSync(logsDir, { recursive: true });
+    const logsDir = path11.join((0, import_core7.getConfigDir)(), "logs");
+    if (!fs10.existsSync(logsDir)) {
+      fs10.mkdirSync(logsDir, { recursive: true });
     }
     return logsDir;
   }
   getLogFilePath(moduleUid) {
-    return path10.join(this.getLogsDir(), `dev-${moduleUid}.log`);
+    return path11.join(this.getLogsDir(), `dev-${moduleUid}.log`);
   }
   rotateLogIfNeeded(logPath) {
     try {
-      if (fs9.existsSync(logPath)) {
-        const stats = fs9.statSync(logPath);
+      if (fs10.existsSync(logPath)) {
+        const stats = fs10.statSync(logPath);
         if (stats.size > DEV_SERVER_CONSTANTS.MAX_LOG_SIZE_BYTES) {
           const backupPath = `${logPath}.1`;
-          if (fs9.existsSync(backupPath)) {
-            fs9.unlinkSync(backupPath);
+          if (fs10.existsSync(backupPath)) {
+            fs10.unlinkSync(backupPath);
           }
-          fs9.renameSync(logPath, backupPath);
+          fs10.renameSync(logPath, backupPath);
         }
       }
     } catch {
@@ -5517,7 +5699,7 @@ var DevServerRunner = class extends import_events.EventEmitter {
     try {
       const timestamp = (/* @__PURE__ */ new Date()).toISOString();
       const prefix = isError ? "ERR" : "OUT";
-      fs9.appendFileSync(logPath, `[${timestamp}] [${prefix}] ${line}
+      fs10.appendFileSync(logPath, `[${timestamp}] [${prefix}] ${line}
 `);
     } catch {
     }
@@ -5547,14 +5729,14 @@ function getDevServerRunner() {
 // src/tunnel/tunnel-manager.ts
 var import_child_process7 = require("child_process");
 var import_events2 = require("events");
-var fs11 = __toESM(require("fs"));
-var path12 = __toESM(require("path"));
+var fs12 = __toESM(require("fs"));
+var path13 = __toESM(require("path"));
 var os4 = __toESM(require("os"));
 
 // src/tunnel/cloudflared-manager.ts
 var import_child_process6 = require("child_process");
-var fs10 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path12 = __toESM(require("path"));
 var os3 = __toESM(require("os"));
 var https = __toESM(require("https"));
 var tar = __toESM(require("tar"));
@@ -5573,11 +5755,11 @@ var DOWNLOAD_URLS = {
   }
 };
 function getEpisodaBinDir() {
-  return path11.join(os3.homedir(), ".episoda", "bin");
+  return path12.join(os3.homedir(), ".episoda", "bin");
 }
 function getCloudflaredPath() {
   const binaryName = os3.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
-  return path11.join(getEpisodaBinDir(), binaryName);
+  return path12.join(getEpisodaBinDir(), binaryName);
 }
 function isCloudflaredInPath() {
   try {
@@ -5594,7 +5776,7 @@ function isCloudflaredInPath() {
 function isCloudflaredInstalled() {
   const cloudflaredPath = getCloudflaredPath();
   try {
-    fs10.accessSync(cloudflaredPath, fs10.constants.X_OK);
+    fs11.accessSync(cloudflaredPath, fs11.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -5618,7 +5800,7 @@ function getDownloadUrl() {
   return platformUrls[arch3] || null;
 }
 async function downloadFile(url, destPath) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const followRedirect = (currentUrl, redirectCount = 0) => {
       if (redirectCount > 5) {
         reject(new Error("Too many redirects"));
@@ -5644,14 +5826,14 @@ async function downloadFile(url, destPath) {
           reject(new Error(`Failed to download: HTTP ${response.statusCode}`));
           return;
         }
-        const file = fs10.createWriteStream(destPath);
+        const file = fs11.createWriteStream(destPath);
         response.pipe(file);
         file.on("finish", () => {
           file.close();
-          resolve3();
+          resolve4();
         });
         file.on("error", (err) => {
-          fs10.unlinkSync(destPath);
+          fs11.unlinkSync(destPath);
           reject(err);
         });
       }).on("error", reject);
@@ -5672,21 +5854,21 @@ async function downloadCloudflared() {
   }
   const binDir = getEpisodaBinDir();
   const cloudflaredPath = getCloudflaredPath();
-  fs10.mkdirSync(binDir, { recursive: true });
+  fs11.mkdirSync(binDir, { recursive: true });
   const isTgz = url.endsWith(".tgz");
   if (isTgz) {
-    const tempFile = path11.join(binDir, "cloudflared.tgz");
+    const tempFile = path12.join(binDir, "cloudflared.tgz");
     console.log(`[Tunnel] Downloading cloudflared from ${url}...`);
     await downloadFile(url, tempFile);
     console.log("[Tunnel] Extracting cloudflared...");
     await extractTgz(tempFile, binDir);
-    fs10.unlinkSync(tempFile);
+    fs11.unlinkSync(tempFile);
   } else {
     console.log(`[Tunnel] Downloading cloudflared from ${url}...`);
     await downloadFile(url, cloudflaredPath);
   }
   if (os3.platform() !== "win32") {
-    fs10.chmodSync(cloudflaredPath, 493);
+    fs11.chmodSync(cloudflaredPath, 493);
   }
   if (!verifyCloudflared(cloudflaredPath)) {
     throw new Error("Downloaded cloudflared binary failed verification");
@@ -5850,7 +6032,7 @@ function getDaemonModeConfig() {
 }
 
 // src/tunnel/tunnel-manager.ts
-var TUNNEL_PID_DIR = path12.join(os4.homedir(), ".episoda", "tunnels");
+var TUNNEL_PID_DIR = path13.join(os4.homedir(), ".episoda", "tunnels");
 var TUNNEL_TIMEOUTS = {
   /** Time to wait for Named Tunnel connection (includes API token fetch + connect) */
   NAMED_TUNNEL_CONNECT: 6e4,
@@ -5882,9 +6064,9 @@ var TunnelManager = class extends import_events2.EventEmitter {
    */
   ensurePidDir() {
     try {
-      if (!fs11.existsSync(TUNNEL_PID_DIR)) {
+      if (!fs12.existsSync(TUNNEL_PID_DIR)) {
         console.log(`[Tunnel] EP904: Creating PID directory: ${TUNNEL_PID_DIR}`);
-        fs11.mkdirSync(TUNNEL_PID_DIR, { recursive: true });
+        fs12.mkdirSync(TUNNEL_PID_DIR, { recursive: true });
         console.log(`[Tunnel] EP904: PID directory created successfully`);
       }
     } catch (error) {
@@ -5896,7 +6078,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
    * EP877: Get PID file path for a module
    */
   getPidFilePath(moduleUid) {
-    return path12.join(TUNNEL_PID_DIR, `${moduleUid}.pid`);
+    return path13.join(TUNNEL_PID_DIR, `${moduleUid}.pid`);
   }
   /**
    * EP877: Write PID to file for tracking across restarts
@@ -5906,7 +6088,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
     try {
       this.ensurePidDir();
       const pidPath = this.getPidFilePath(moduleUid);
-      fs11.writeFileSync(pidPath, pid.toString(), "utf8");
+      fs12.writeFileSync(pidPath, pid.toString(), "utf8");
       console.log(`[Tunnel] EP904: Wrote PID ${pid} for ${moduleUid} to ${pidPath}`);
     } catch (error) {
       console.error(`[Tunnel] EP904: Failed to write PID file for ${moduleUid}:`, error);
@@ -5919,10 +6101,10 @@ var TunnelManager = class extends import_events2.EventEmitter {
   readPidFile(moduleUid) {
     try {
       const pidPath = this.getPidFilePath(moduleUid);
-      if (!fs11.existsSync(pidPath)) {
+      if (!fs12.existsSync(pidPath)) {
         return null;
       }
-      const content = fs11.readFileSync(pidPath, "utf8").trim();
+      const content = fs12.readFileSync(pidPath, "utf8").trim();
       const pid = parseInt(content, 10);
       if (isNaN(pid) || pid <= 0) {
         console.warn(`[Tunnel] EP948: Invalid PID file content for ${moduleUid}: "${content}", removing stale file`);
@@ -5950,8 +6132,8 @@ var TunnelManager = class extends import_events2.EventEmitter {
   removePidFile(moduleUid) {
     try {
       const pidPath = this.getPidFilePath(moduleUid);
-      if (fs11.existsSync(pidPath)) {
-        fs11.unlinkSync(pidPath);
+      if (fs12.existsSync(pidPath)) {
+        fs12.unlinkSync(pidPath);
         console.log(`[Tunnel] EP877: Removed PID file for ${moduleUid}`);
       }
     } catch (error) {
@@ -6026,10 +6208,10 @@ var TunnelManager = class extends import_events2.EventEmitter {
       const isTracked = Array.from(this.tunnelStates.values()).some((s) => s.info.pid === pid);
       console.log(`[Tunnel] EP904: Found cloudflared PID ${pid} on port ${port} (tracked: ${isTracked})`);
       this.killByPid(pid, "SIGTERM");
-      await new Promise((resolve3) => setTimeout(resolve3, 500));
+      await new Promise((resolve4) => setTimeout(resolve4, 500));
       if (this.isProcessRunning(pid)) {
         this.killByPid(pid, "SIGKILL");
-        await new Promise((resolve3) => setTimeout(resolve3, 200));
+        await new Promise((resolve4) => setTimeout(resolve4, 200));
       }
       killed.push(pid);
     }
@@ -6055,7 +6237,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
     }
     try {
       this.ensurePidDir();
-      const pidFiles = fs11.readdirSync(TUNNEL_PID_DIR).filter((f) => f.endsWith(".pid"));
+      const pidFiles = fs12.readdirSync(TUNNEL_PID_DIR).filter((f) => f.endsWith(".pid"));
       for (const pidFile of pidFiles) {
         const moduleUid = pidFile.replace(".pid", "");
         const pid = this.readPidFile(moduleUid);
@@ -6063,7 +6245,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
           if (!this.tunnelStates.has(moduleUid)) {
             console.log(`[Tunnel] EP877: Found orphaned process PID ${pid} for ${moduleUid}, killing...`);
             this.killByPid(pid, "SIGTERM");
-            await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+            await new Promise((resolve4) => setTimeout(resolve4, 1e3));
             if (this.isProcessRunning(pid)) {
               this.killByPid(pid, "SIGKILL");
             }
@@ -6078,7 +6260,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
         if (!trackedPids.includes(pid) && !cleaned.includes(pid)) {
           console.log(`[Tunnel] EP877: Found untracked cloudflared process PID ${pid}, killing...`);
           this.killByPid(pid, "SIGTERM");
-          await new Promise((resolve3) => setTimeout(resolve3, 500));
+          await new Promise((resolve4) => setTimeout(resolve4, 500));
           if (this.isProcessRunning(pid)) {
             this.killByPid(pid, "SIGKILL");
           }
@@ -6168,7 +6350,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
         return { success: false, error: `Failed to get cloudflared: ${errorMessage}` };
       }
     }
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const tunnelInfo = {
         moduleUid,
         url: previewUrl || "",
@@ -6234,7 +6416,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
             moduleUid,
             url: tunnelInfo.url
           });
-          resolve3({ success: true, url: tunnelInfo.url });
+          resolve4({ success: true, url: tunnelInfo.url });
         }
       };
       process2.stderr?.on("data", (data) => {
@@ -6261,7 +6443,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
             onStatusChange?.("error", errorMsg);
             this.emitEvent({ type: "error", moduleUid, error: errorMsg });
           }
-          resolve3({ success: false, error: errorMsg });
+          resolve4({ success: false, error: errorMsg });
         } else if (wasConnected) {
           if (currentState && !currentState.intentionallyStopped) {
             console.log(`[Tunnel] EP948: Named tunnel ${moduleUid} crashed unexpectedly, attempting reconnect...`);
@@ -6292,7 +6474,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
           this.emitEvent({ type: "error", moduleUid, error: error.message });
         }
         if (!connected) {
-          resolve3({ success: false, error: error.message });
+          resolve4({ success: false, error: error.message });
         }
       });
       setTimeout(() => {
@@ -6315,7 +6497,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
             onStatusChange?.("error", errorMsg);
             this.emitEvent({ type: "error", moduleUid, error: errorMsg });
           }
-          resolve3({ success: false, error: errorMsg });
+          resolve4({ success: false, error: errorMsg });
         }
       }, TUNNEL_TIMEOUTS.NAMED_TUNNEL_CONNECT);
     });
@@ -6376,7 +6558,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
     if (orphanPid && this.isProcessRunning(orphanPid)) {
       console.log(`[Tunnel] EP877: Killing orphaned process ${orphanPid} for ${moduleUid} before starting new tunnel`);
       this.killByPid(orphanPid, "SIGTERM");
-      await new Promise((resolve3) => setTimeout(resolve3, 500));
+      await new Promise((resolve4) => setTimeout(resolve4, 500));
       if (this.isProcessRunning(orphanPid)) {
         this.killByPid(orphanPid, "SIGKILL");
       }
@@ -6385,7 +6567,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
     const killedOnPort = await this.killCloudflaredOnPort(port);
     if (killedOnPort.length > 0) {
       console.log(`[Tunnel] EP904: Pre-start port cleanup killed ${killedOnPort.length} process(es) on port ${port}`);
-      await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+      await new Promise((resolve4) => setTimeout(resolve4, 1e3));
     }
     const cleanup = await this.cleanupOrphanedProcesses();
     if (cleanup.cleaned > 0) {
@@ -6425,7 +6607,7 @@ var TunnelManager = class extends import_events2.EventEmitter {
       if (orphanPid && this.isProcessRunning(orphanPid)) {
         console.log(`[Tunnel] EP877: Stopping orphaned process ${orphanPid} for ${moduleUid} via PID file`);
         this.killByPid(orphanPid, "SIGTERM");
-        await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+        await new Promise((resolve4) => setTimeout(resolve4, 1e3));
         if (this.isProcessRunning(orphanPid)) {
           this.killByPid(orphanPid, "SIGKILL");
         }
@@ -6441,16 +6623,16 @@ var TunnelManager = class extends import_events2.EventEmitter {
     const tunnel = state.info;
     if (tunnel.process && !tunnel.process.killed) {
       tunnel.process.kill("SIGTERM");
-      await new Promise((resolve3) => {
+      await new Promise((resolve4) => {
         const timeout = setTimeout(() => {
           if (tunnel.process && !tunnel.process.killed) {
             tunnel.process.kill("SIGKILL");
           }
-          resolve3();
+          resolve4();
         }, 3e3);
         tunnel.process.once("exit", () => {
           clearTimeout(timeout);
-          resolve3();
+          resolve4();
         });
       });
     }
@@ -6511,21 +6693,21 @@ function getTunnelManager() {
 }
 
 // src/utils/port-allocator.ts
-var fs12 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
+var fs13 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
 var os5 = __toESM(require("os"));
 var PORT_RANGE_START = 3100;
 var PORT_RANGE_END = 3199;
 var PORT_WARNING_THRESHOLD = 80;
-var PORTS_FILE = path13.join(os5.homedir(), ".episoda", "ports.json");
+var PORTS_FILE = path14.join(os5.homedir(), ".episoda", "ports.json");
 var portAssignments = /* @__PURE__ */ new Map();
 var initialized = false;
 function loadFromDisk() {
   if (initialized) return;
   initialized = true;
   try {
-    if (fs12.existsSync(PORTS_FILE)) {
-      const content = fs12.readFileSync(PORTS_FILE, "utf8");
+    if (fs13.existsSync(PORTS_FILE)) {
+      const content = fs13.readFileSync(PORTS_FILE, "utf8");
       const data = JSON.parse(content);
       for (const [moduleUid, port] of Object.entries(data)) {
         if (typeof port === "number" && port >= PORT_RANGE_START && port <= PORT_RANGE_END) {
@@ -6542,15 +6724,15 @@ function loadFromDisk() {
 }
 function saveToDisk() {
   try {
-    const dir = path13.dirname(PORTS_FILE);
-    if (!fs12.existsSync(dir)) {
-      fs12.mkdirSync(dir, { recursive: true });
+    const dir = path14.dirname(PORTS_FILE);
+    if (!fs13.existsSync(dir)) {
+      fs13.mkdirSync(dir, { recursive: true });
     }
     const data = {};
     for (const [moduleUid, port] of portAssignments) {
       data[moduleUid] = port;
     }
-    fs12.writeFileSync(PORTS_FILE, JSON.stringify(data, null, 2), "utf8");
+    fs13.writeFileSync(PORTS_FILE, JSON.stringify(data, null, 2), "utf8");
   } catch (error) {
     console.warn(`[PortAllocator] EP1042: Failed to save ports.json:`, error);
   }
@@ -6734,7 +6916,7 @@ var PreviewManager = class extends import_events3.EventEmitter {
       for (let attempt = 1; attempt <= MAX_TUNNEL_RETRIES; attempt++) {
         if (attempt > 1) {
           console.log(`[PreviewManager] Retrying tunnel for ${moduleUid} (attempt ${attempt}/${MAX_TUNNEL_RETRIES})...`);
-          await new Promise((resolve3) => setTimeout(resolve3, 2e3));
+          await new Promise((resolve4) => setTimeout(resolve4, 2e3));
         }
         tunnelResult = await this.tunnel.startTunnel({
           moduleUid,
@@ -6855,7 +7037,7 @@ var PreviewManager = class extends import_events3.EventEmitter {
     }
     console.log(`[PreviewManager] Restarting preview for ${moduleUid}`);
     await this.stopPreview(moduleUid);
-    await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
     return this.startPreview({
       moduleUid,
       worktreePath: state.worktreePath,
@@ -7126,18 +7308,18 @@ async function handleWorktreeCreate(request2) {
   }
   try {
     const projectPath = getProjectPath(workspaceSlug, projectSlug);
-    const bareRepoPath = path14.join(projectPath, ".bare");
-    if (!fs13.existsSync(bareRepoPath)) {
+    const bareRepoPath = path15.join(projectPath, ".bare");
+    if (!fs14.existsSync(bareRepoPath)) {
       console.log(`[Worktree] K1273: Project not found, cloning lazily...`);
       console.log(`[Worktree]   Repo URL: ${repoUrl.replace(/\/\/[^@]*@/, "//***@")}`);
-      const episodaDir = path14.join(projectPath, ".episoda");
-      fs13.mkdirSync(episodaDir, { recursive: true });
+      const episodaDir = path15.join(projectPath, ".episoda");
+      fs14.mkdirSync(episodaDir, { recursive: true });
       try {
         console.log(`[Worktree] K1273: Starting git clone...`);
         await execAsync(`git clone --bare "${repoUrl}" "${bareRepoPath}"`);
         console.log(`[Worktree] K1273: Clone successful`);
         await execAsync(`git -C "${bareRepoPath}" config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"`);
-        const configPath = path14.join(episodaDir, "config.json");
+        const configPath = path15.join(episodaDir, "config.json");
         const config2 = {
           projectId,
           workspaceSlug,
@@ -7146,7 +7328,7 @@ async function handleWorktreeCreate(request2) {
           createdAt: (/* @__PURE__ */ new Date()).toISOString(),
           worktrees: []
         };
-        fs13.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf-8");
+        fs14.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf-8");
         console.log(`[Worktree] K1273: Project initialized at ${projectPath}`);
       } catch (cloneError) {
         console.error(`[Worktree] K1273: Git clone failed: ${cloneError.message}`);
@@ -7194,8 +7376,8 @@ async function handleWorktreeCreate(request2) {
     }
     if (envVars && Object.keys(envVars).length > 0) {
       const envContent = Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join("\n");
-      const envPath = path14.join(worktreePath, ".env");
-      fs13.writeFileSync(envPath, envContent + "\n", "utf-8");
+      const envPath = path15.join(worktreePath, ".env");
+      fs14.writeFileSync(envPath, envContent + "\n", "utf-8");
       console.log(`[Worktree] EP1143: Wrote ${Object.keys(envVars).length} env vars to .env`);
     }
     if (setupScript) {
@@ -7368,12 +7550,12 @@ async function handleProjectEject(request2) {
   console.log(`[Worktree] EP1144: Ejecting project ${projectSlug} from workspace ${workspaceSlug}`);
   try {
     const projectPath = getProjectPath(workspaceSlug, projectSlug);
-    const bareRepoPath = path14.join(projectPath, ".bare");
-    if (!fs13.existsSync(projectPath)) {
+    const bareRepoPath = path15.join(projectPath, ".bare");
+    if (!fs14.existsSync(projectPath)) {
       console.log(`[Worktree] EP1144: Project path not found, nothing to eject: ${projectPath}`);
       return { success: true };
     }
-    if (!fs13.existsSync(bareRepoPath)) {
+    if (!fs14.existsSync(bareRepoPath)) {
       console.log(`[Worktree] EP1144: Bare repo not found, nothing to eject: ${bareRepoPath}`);
       return { success: true };
     }
@@ -7388,12 +7570,12 @@ async function handleProjectEject(request2) {
         };
       }
     }
-    const artifactsPath = path14.join(projectPath, "artifacts");
-    if (fs13.existsSync(artifactsPath)) {
+    const artifactsPath = path15.join(projectPath, "artifacts");
+    if (fs14.existsSync(artifactsPath)) {
       await persistArtifactsBeforeEject(artifactsPath, projectId, projectSlug);
     }
     console.log(`[Worktree] EP1144: Removing project directory: ${projectPath}`);
-    await fs13.promises.rm(projectPath, { recursive: true, force: true });
+    await fs14.promises.rm(projectPath, { recursive: true, force: true });
     console.log(`[Worktree] EP1144: Successfully ejected project ${projectSlug}`);
     return { success: true };
   } catch (error) {
@@ -7407,7 +7589,7 @@ async function handleProjectEject(request2) {
 async function persistArtifactsBeforeEject(artifactsPath, projectId, projectSlug) {
   const MAX_ARTIFACT_SIZE = 10 * 1024 * 1024;
   try {
-    const files = await fs13.promises.readdir(artifactsPath);
+    const files = await fs14.promises.readdir(artifactsPath);
     if (files.length === 0) {
       return;
     }
@@ -7421,8 +7603,8 @@ async function persistArtifactsBeforeEject(artifactsPath, projectId, projectSlug
     }
     const artifacts = [];
     for (const fileName of files) {
-      const filePath = path14.join(artifactsPath, fileName);
-      const stat = await fs13.promises.stat(filePath);
+      const filePath = path15.join(artifactsPath, fileName);
+      const stat = await fs14.promises.stat(filePath);
       if (stat.isDirectory()) {
         continue;
       }
@@ -7431,9 +7613,9 @@ async function persistArtifactsBeforeEject(artifactsPath, projectId, projectSlug
         continue;
       }
       try {
-        const content = await fs13.promises.readFile(filePath);
+        const content = await fs14.promises.readFile(filePath);
         const base64Content = content.toString("base64");
-        const ext = path14.extname(fileName).toLowerCase();
+        const ext = path15.extname(fileName).toLowerCase();
         const mimeTypes = {
           ".json": "application/json",
           ".txt": "text/plain",
@@ -7585,12 +7767,12 @@ async function cleanupStaleCommits(projectPath) {
 
 // src/agent/claude-binary.ts
 var import_child_process10 = require("child_process");
-var path15 = __toESM(require("path"));
-var fs14 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
+var fs15 = __toESM(require("fs"));
 var cachedBinaryPath = null;
 function isValidClaudeBinary(binaryPath) {
   try {
-    fs14.accessSync(binaryPath, fs14.constants.X_OK);
+    fs15.accessSync(binaryPath, fs15.constants.X_OK);
     const version = (0, import_child_process10.execSync)(`"${binaryPath}" --version`, {
       encoding: "utf-8",
       timeout: 5e3,
@@ -7623,14 +7805,14 @@ async function ensureClaudeBinary() {
   }
   const bundledPaths = [
     // In production: node_modules/.bin/claude
-    path15.join(__dirname, "..", "..", "node_modules", ".bin", "claude"),
+    path16.join(__dirname, "..", "..", "node_modules", ".bin", "claude"),
     // In monorepo development: packages/episoda/node_modules/.bin/claude
-    path15.join(__dirname, "..", "..", "..", "..", "node_modules", ".bin", "claude"),
+    path16.join(__dirname, "..", "..", "..", "..", "node_modules", ".bin", "claude"),
     // Root monorepo node_modules
-    path15.join(__dirname, "..", "..", "..", "..", "..", "node_modules", ".bin", "claude")
+    path16.join(__dirname, "..", "..", "..", "..", "..", "node_modules", ".bin", "claude")
   ];
   for (const bundledPath of bundledPaths) {
-    if (fs14.existsSync(bundledPath) && isValidClaudeBinary(bundledPath)) {
+    if (fs15.existsSync(bundledPath) && isValidClaudeBinary(bundledPath)) {
       cachedBinaryPath = bundledPath;
       return cachedBinaryPath;
     }
@@ -7656,12 +7838,12 @@ async function ensureClaudeBinary() {
 
 // src/agent/codex-binary.ts
 var import_child_process11 = require("child_process");
-var path16 = __toESM(require("path"));
-var fs15 = __toESM(require("fs"));
+var path17 = __toESM(require("path"));
+var fs16 = __toESM(require("fs"));
 var cachedBinaryPath2 = null;
 function isValidCodexBinary(binaryPath) {
   try {
-    fs15.accessSync(binaryPath, fs15.constants.X_OK);
+    fs16.accessSync(binaryPath, fs16.constants.X_OK);
     const version = (0, import_child_process11.execSync)(`"${binaryPath}" --version`, {
       encoding: "utf-8",
       timeout: 5e3,
@@ -7694,14 +7876,14 @@ async function ensureCodexBinary() {
   }
   const bundledPaths = [
     // In production: node_modules/.bin/codex
-    path16.join(__dirname, "..", "..", "node_modules", ".bin", "codex"),
+    path17.join(__dirname, "..", "..", "node_modules", ".bin", "codex"),
     // In monorepo development: packages/episoda/node_modules/.bin/codex
-    path16.join(__dirname, "..", "..", "..", "..", "node_modules", ".bin", "codex"),
+    path17.join(__dirname, "..", "..", "..", "..", "node_modules", ".bin", "codex"),
     // Root monorepo node_modules
-    path16.join(__dirname, "..", "..", "..", "..", "..", "node_modules", ".bin", "codex")
+    path17.join(__dirname, "..", "..", "..", "..", "..", "node_modules", ".bin", "codex")
   ];
   for (const bundledPath of bundledPaths) {
-    if (fs15.existsSync(bundledPath) && isValidCodexBinary(bundledPath)) {
+    if (fs16.existsSync(bundledPath) && isValidCodexBinary(bundledPath)) {
       cachedBinaryPath2 = bundledPath;
       return cachedBinaryPath2;
     }
@@ -7768,8 +7950,8 @@ function generateCodexConfig(credentials, projectPath) {
 
 // src/agent/agent-manager.ts
 var import_child_process12 = require("child_process");
-var path17 = __toESM(require("path"));
-var fs16 = __toESM(require("fs"));
+var path18 = __toESM(require("path"));
+var fs17 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
 
 // src/agent/claude-config.ts
@@ -7780,8 +7962,8 @@ function generateStatsigHash() {
 function generateNumericHash() {
   return Math.floor(1e9 + Math.random() * 9e9).toString();
 }
-function generateSettings() {
-  return {
+function generateSettings(options = {}) {
+  const settings = {
     permissions: {
       allow: [
         "Bash",
@@ -7790,7 +7972,9 @@ function generateSettings() {
         "Edit",
         "Glob",
         "Grep",
-        "WebFetch"
+        "WebFetch",
+        "mcp__github"
+        // EP1146: Allow GitHub MCP tools
       ],
       deny: [],
       ask: [],
@@ -7798,6 +7982,20 @@ function generateSettings() {
     },
     alwaysThinkingEnabled: true
   };
+  if (options.githubToken) {
+    const mcpEnv = {
+      GITHUB_PERSONAL_ACCESS_TOKEN: options.githubToken
+    };
+    settings.mcpServers = {
+      github: {
+        command: "npx",
+        args: ["-y", "@modelcontextprotocol/server-github"],
+        env: mcpEnv
+      }
+    };
+    console.log("[ClaudeConfig] EP1146: GitHub MCP server configured");
+  }
+  return settings;
 }
 function generateStableId() {
   return JSON.stringify((0, import_crypto.randomUUID)());
@@ -8039,13 +8237,13 @@ function generateCachedEvaluations(stableId, sessionId) {
     fullUserHash: Math.floor(Math.random() * 1e10).toString()
   };
 }
-function generateClaudeConfig() {
+function generateClaudeConfig(options = {}) {
   const hash = generateStatsigHash();
   const numericHash = generateNumericHash();
   const stableId = (0, import_crypto.randomUUID)();
   const sessionId = (0, import_crypto.randomUUID)();
   return {
-    "settings.json": JSON.stringify(generateSettings(), null, 2),
+    "settings.json": JSON.stringify(generateSettings(options), null, 2),
     statsig: {
       [`statsig.stable_id.${numericHash}`]: generateStableId(),
       [`statsig.session_id.${numericHash}`]: JSON.stringify(
@@ -8076,7 +8274,7 @@ var AgentManager = class {
     this.initialized = false;
     // EP1133: Lock for config file writes to prevent race conditions
     this.configWriteLock = Promise.resolve();
-    this.pidDir = path17.join(os6.homedir(), ".episoda", "agent-pids");
+    this.pidDir = path18.join(os6.homedir(), ".episoda", "agent-pids");
   }
   /**
    * EP1133: Acquire lock for config file writes
@@ -8085,8 +8283,8 @@ var AgentManager = class {
   async withConfigLock(fn) {
     const previousLock = this.configWriteLock;
     let releaseLock;
-    this.configWriteLock = new Promise((resolve3) => {
-      releaseLock = resolve3;
+    this.configWriteLock = new Promise((resolve4) => {
+      releaseLock = resolve4;
     });
     try {
       await previousLock;
@@ -8105,8 +8303,8 @@ var AgentManager = class {
       return;
     }
     console.log("[AgentManager] Initializing...");
-    if (!fs16.existsSync(this.pidDir)) {
-      fs16.mkdirSync(this.pidDir, { recursive: true });
+    if (!fs17.existsSync(this.pidDir)) {
+      fs17.mkdirSync(this.pidDir, { recursive: true });
     }
     await this.cleanupOrphanedProcesses();
     try {
@@ -8272,9 +8470,9 @@ ${message}`;
       const useApiKey = !useOAuth && !!session.credentials.apiKey;
       if (provider === "codex") {
         await this.withConfigLock(async () => {
-          const codexDir = path17.join(os6.homedir(), ".codex");
-          if (!fs16.existsSync(codexDir)) {
-            fs16.mkdirSync(codexDir, { recursive: true });
+          const codexDir = path18.join(os6.homedir(), ".codex");
+          if (!fs17.existsSync(codexDir)) {
+            fs17.mkdirSync(codexDir, { recursive: true });
           }
           if (useOAuth) {
             const codexConfig = generateCodexConfig({
@@ -8284,21 +8482,21 @@ ${message}`;
               accountId: session.credentials.accountId,
               expiresAt: session.credentials.expiresAt
             }, session.projectPath);
-            const authJsonPath = path17.join(codexDir, "auth.json");
-            fs16.writeFileSync(authJsonPath, codexConfig["auth.json"], { mode: 384 });
+            const authJsonPath = path18.join(codexDir, "auth.json");
+            fs17.writeFileSync(authJsonPath, codexConfig["auth.json"], { mode: 384 });
             console.log("[AgentManager] EP1133: Wrote Codex auth.json to ~/.codex/auth.json");
             if (codexConfig["config.toml"]) {
-              const configTomlPath = path17.join(codexDir, "config.toml");
+              const configTomlPath = path18.join(codexDir, "config.toml");
               let existingConfig = "";
               try {
-                existingConfig = fs16.readFileSync(configTomlPath, "utf-8");
+                existingConfig = fs17.readFileSync(configTomlPath, "utf-8");
               } catch {
               }
               const escapedPathForRegex = session.projectPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
               const projectKeyPattern = new RegExp(`\\[projects\\."${escapedPathForRegex}"\\]`);
               const projectAlreadyTrusted = projectKeyPattern.test(existingConfig);
               if (!projectAlreadyTrusted) {
-                fs16.writeFileSync(configTomlPath, existingConfig + "\n" + codexConfig["config.toml"], { mode: 420 });
+                fs17.writeFileSync(configTomlPath, existingConfig + "\n" + codexConfig["config.toml"], { mode: 420 });
                 console.log("[AgentManager] EP1133: Updated Codex config.toml with project trust");
               }
             }
@@ -8308,14 +8506,14 @@ ${message}`;
         });
       } else {
         await this.withConfigLock(async () => {
-          const claudeDir = path17.join(os6.homedir(), ".claude");
-          const credentialsPath = path17.join(claudeDir, ".credentials.json");
-          const statsigDir = path17.join(claudeDir, "statsig");
-          if (!fs16.existsSync(claudeDir)) {
-            fs16.mkdirSync(claudeDir, { recursive: true });
+          const claudeDir = path18.join(os6.homedir(), ".claude");
+          const credentialsPath = path18.join(claudeDir, ".credentials.json");
+          const statsigDir = path18.join(claudeDir, "statsig");
+          if (!fs17.existsSync(claudeDir)) {
+            fs17.mkdirSync(claudeDir, { recursive: true });
           }
-          if (!fs16.existsSync(statsigDir)) {
-            fs16.mkdirSync(statsigDir, { recursive: true });
+          if (!fs17.existsSync(statsigDir)) {
+            fs17.mkdirSync(statsigDir, { recursive: true });
           }
           if (useOAuth) {
             const oauthCredentials = {
@@ -8333,21 +8531,26 @@ ${message}`;
             const credentialsContent = JSON.stringify({
               claudeAiOauth: oauthCredentials
             }, null, 2);
-            fs16.writeFileSync(credentialsPath, credentialsContent, { mode: 384 });
+            fs17.writeFileSync(credentialsPath, credentialsContent, { mode: 384 });
             console.log("[AgentManager] Wrote OAuth credentials to ~/.claude/.credentials.json");
             try {
-              const claudeConfig = generateClaudeConfig();
+              const claudeConfig = generateClaudeConfig({
+                githubToken: session.credentials.githubToken
+              });
               const statsigFiles = Object.keys(claudeConfig.statsig);
               const hasEvaluations = statsigFiles.some((f) => f.includes("cached.evaluations"));
               const hasStableId = statsigFiles.some((f) => f.includes("stable_id"));
               if (!hasEvaluations || !hasStableId) {
                 throw new Error(`Invalid statsig config: missing required files`);
               }
-              const settingsPath = path17.join(claudeDir, "settings.json");
-              fs16.writeFileSync(settingsPath, claudeConfig["settings.json"], { mode: 384 });
+              const settingsPath = path18.join(claudeDir, "settings.json");
+              fs17.writeFileSync(settingsPath, claudeConfig["settings.json"], { mode: 384 });
               for (const [filename, content] of Object.entries(claudeConfig.statsig)) {
-                const filePath = path17.join(statsigDir, filename);
-                fs16.writeFileSync(filePath, content, { mode: 420 });
+                const filePath = path18.join(statsigDir, filename);
+                fs17.writeFileSync(filePath, content, { mode: 420 });
+              }
+              if (session.credentials.githubToken) {
+                console.log("[AgentManager] EP1146: GitHub MCP server enabled with installation token");
               }
               console.log("[AgentManager] Wrote Claude config files");
             } catch (configError) {
@@ -8542,17 +8745,17 @@ ${message}`;
     if (agentProcess && !agentProcess.killed) {
       console.log(`[AgentManager] Stopping session ${sessionId}`);
       agentProcess.kill("SIGINT");
-      await new Promise((resolve3) => {
+      await new Promise((resolve4) => {
         const timeout = setTimeout(() => {
           if (!agentProcess.killed) {
             console.log(`[AgentManager] Force killing session ${sessionId}`);
             agentProcess.kill("SIGTERM");
           }
-          resolve3();
+          resolve4();
         }, 5e3);
         agentProcess.once("exit", () => {
           clearTimeout(timeout);
-          resolve3();
+          resolve4();
         });
       });
     }
@@ -8594,14 +8797,14 @@ ${message}`;
    */
   async cleanupOrphanedProcesses() {
     let cleaned = 0;
-    if (!fs16.existsSync(this.pidDir)) {
+    if (!fs17.existsSync(this.pidDir)) {
       return { cleaned };
     }
-    const pidFiles = fs16.readdirSync(this.pidDir).filter((f) => f.endsWith(".pid"));
+    const pidFiles = fs17.readdirSync(this.pidDir).filter((f) => f.endsWith(".pid"));
     for (const pidFile of pidFiles) {
-      const pidPath = path17.join(this.pidDir, pidFile);
+      const pidPath = path18.join(this.pidDir, pidFile);
       try {
-        const pidStr = fs16.readFileSync(pidPath, "utf-8").trim();
+        const pidStr = fs17.readFileSync(pidPath, "utf-8").trim();
         const pid = parseInt(pidStr, 10);
         if (!isNaN(pid)) {
           try {
@@ -8612,7 +8815,7 @@ ${message}`;
           } catch {
           }
         }
-        fs16.unlinkSync(pidPath);
+        fs17.unlinkSync(pidPath);
       } catch (error) {
         console.warn(`[AgentManager] Error cleaning PID file ${pidFile}:`, error);
       }
@@ -8626,17 +8829,17 @@ ${message}`;
    * Write PID file for session tracking
    */
   writePidFile(sessionId, pid) {
-    const pidPath = path17.join(this.pidDir, `${sessionId}.pid`);
-    fs16.writeFileSync(pidPath, pid.toString());
+    const pidPath = path18.join(this.pidDir, `${sessionId}.pid`);
+    fs17.writeFileSync(pidPath, pid.toString());
   }
   /**
    * Remove PID file for session
    */
   removePidFile(sessionId) {
-    const pidPath = path17.join(this.pidDir, `${sessionId}.pid`);
+    const pidPath = path18.join(this.pidDir, `${sessionId}.pid`);
     try {
-      if (fs16.existsSync(pidPath)) {
-        fs16.unlinkSync(pidPath);
+      if (fs17.existsSync(pidPath)) {
+        fs17.unlinkSync(pidPath);
       }
     } catch {
     }
@@ -8646,8 +8849,8 @@ ${message}`;
 // src/utils/dev-server.ts
 var import_child_process13 = require("child_process");
 var import_core11 = __toESM(require_dist());
-var fs17 = __toESM(require("fs"));
-var path18 = __toESM(require("path"));
+var fs18 = __toESM(require("fs"));
+var path19 = __toESM(require("path"));
 var MAX_RESTART_ATTEMPTS = 5;
 var INITIAL_RESTART_DELAY_MS = 2e3;
 var MAX_RESTART_DELAY_MS = 3e4;
@@ -8655,26 +8858,26 @@ var MAX_LOG_SIZE_BYTES = 5 * 1024 * 1024;
 var NODE_MEMORY_LIMIT_MB = 2048;
 var activeServers = /* @__PURE__ */ new Map();
 function getLogsDir() {
-  const logsDir = path18.join((0, import_core11.getConfigDir)(), "logs");
-  if (!fs17.existsSync(logsDir)) {
-    fs17.mkdirSync(logsDir, { recursive: true });
+  const logsDir = path19.join((0, import_core11.getConfigDir)(), "logs");
+  if (!fs18.existsSync(logsDir)) {
+    fs18.mkdirSync(logsDir, { recursive: true });
   }
   return logsDir;
 }
 function getLogFilePath(moduleUid) {
-  return path18.join(getLogsDir(), `dev-${moduleUid}.log`);
+  return path19.join(getLogsDir(), `dev-${moduleUid}.log`);
 }
 function rotateLogIfNeeded(logPath) {
   try {
-    if (fs17.existsSync(logPath)) {
-      const stats = fs17.statSync(logPath);
+    if (fs18.existsSync(logPath)) {
+      const stats = fs18.statSync(logPath);
       if (stats.size > MAX_LOG_SIZE_BYTES) {
         const backupPath = `${logPath}.1`;
-        if (fs17.existsSync(backupPath)) {
-          fs17.unlinkSync(backupPath);
+        if (fs18.existsSync(backupPath)) {
+          fs18.unlinkSync(backupPath);
         }
-        fs17.renameSync(logPath, backupPath);
-        console.log(`[DevServer] EP932: Rotated log file for ${path18.basename(logPath)}`);
+        fs18.renameSync(logPath, backupPath);
+        console.log(`[DevServer] EP932: Rotated log file for ${path19.basename(logPath)}`);
       }
     }
   } catch (error) {
@@ -8687,7 +8890,7 @@ function writeToLog(logPath, line, isError = false) {
     const prefix = isError ? "ERR" : "OUT";
     const logLine = `[${timestamp}] [${prefix}] ${line}
 `;
-    fs17.appendFileSync(logPath, logLine);
+    fs18.appendFileSync(logPath, logLine);
   } catch {
   }
 }
@@ -8707,7 +8910,7 @@ async function killProcessOnPort(port) {
       } catch {
       }
     }
-    await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
     for (const pid of pids) {
       try {
         (0, import_child_process13.execSync)(`kill -0 ${pid} 2>/dev/null`, { encoding: "utf8" });
@@ -8716,7 +8919,7 @@ async function killProcessOnPort(port) {
       } catch {
       }
     }
-    await new Promise((resolve3) => setTimeout(resolve3, 500));
+    await new Promise((resolve4) => setTimeout(resolve4, 500));
     const stillInUse = await isPortInUse(port);
     if (stillInUse) {
       console.error(`[DevServer] EP929: Port ${port} still in use after kill attempts`);
@@ -8736,7 +8939,7 @@ async function waitForPort(port, timeoutMs = 3e4) {
     if (await isPortInUse(port)) {
       return true;
     }
-    await new Promise((resolve3) => setTimeout(resolve3, checkInterval));
+    await new Promise((resolve4) => setTimeout(resolve4, checkInterval));
   }
   return false;
 }
@@ -8808,7 +9011,7 @@ async function handleProcessExit(moduleUid, code, signal) {
   const delay = calculateRestartDelay(serverInfo.restartCount);
   console.log(`[DevServer] EP932: Restarting ${moduleUid} in ${delay}ms (attempt ${serverInfo.restartCount + 1}/${MAX_RESTART_ATTEMPTS})`);
   writeToLog(serverInfo.logFile || "", `Scheduling restart in ${delay}ms (attempt ${serverInfo.restartCount + 1})`, false);
-  await new Promise((resolve3) => setTimeout(resolve3, delay));
+  await new Promise((resolve4) => setTimeout(resolve4, delay));
   if (!activeServers.has(moduleUid)) {
     console.log(`[DevServer] EP932: Server ${moduleUid} was removed during restart delay, aborting restart`);
     return;
@@ -8866,8 +9069,8 @@ async function startDevServer(projectPath, port = 3e3, moduleUid = "default", op
       });
       injectedEnvVars = result.envVars;
       console.log(`[DevServer] EP998: Loaded ${Object.keys(injectedEnvVars).length} env vars (from ${result.fromCache ? "cache" : "server"})`);
-      const envFilePath = path18.join(projectPath, ".env");
-      if (!fs17.existsSync(envFilePath) && Object.keys(injectedEnvVars).length > 0) {
+      const envFilePath = path19.join(projectPath, ".env");
+      if (!fs18.existsSync(envFilePath) && Object.keys(injectedEnvVars).length > 0) {
         console.log(`[DevServer] EP1004: .env file missing, writing ${Object.keys(injectedEnvVars).length} vars to ${envFilePath}`);
         writeEnvFile(projectPath, injectedEnvVars);
       }
@@ -8933,7 +9136,7 @@ async function stopDevServer(moduleUid) {
       writeToLog(serverInfo.logFile, `Stopping server (manual stop)`, false);
     }
     serverInfo.process.kill("SIGTERM");
-    await new Promise((resolve3) => setTimeout(resolve3, 2e3));
+    await new Promise((resolve4) => setTimeout(resolve4, 2e3));
     if (!serverInfo.process.killed) {
       serverInfo.process.kill("SIGKILL");
     }
@@ -8951,7 +9154,7 @@ async function restartDevServer(moduleUid) {
     writeToLog(logFile, `Manual restart requested`, false);
   }
   await stopDevServer(moduleUid);
-  await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+  await new Promise((resolve4) => setTimeout(resolve4, 1e3));
   if (await isPortInUse(port)) {
     await killProcessOnPort(port);
   }
@@ -8973,19 +9176,19 @@ function getDevServerStatus() {
 }
 
 // src/utils/worktree.ts
-var path19 = __toESM(require("path"));
-var fs18 = __toESM(require("fs"));
+var path20 = __toESM(require("path"));
+var fs19 = __toESM(require("fs"));
 var os7 = __toESM(require("os"));
 var import_core12 = __toESM(require_dist());
 function getEpisodaRoot2() {
-  return process.env.EPISODA_ROOT || path19.join(os7.homedir(), "episoda");
+  return process.env.EPISODA_ROOT || path20.join(os7.homedir(), "episoda");
 }
 function getWorktreeInfo(moduleUid, workspaceSlug, projectSlug) {
   const root = getEpisodaRoot2();
-  const worktreePath = path19.join(root, workspaceSlug, projectSlug, moduleUid);
+  const worktreePath = path20.join(root, workspaceSlug, projectSlug, moduleUid);
   return {
     path: worktreePath,
-    exists: fs18.existsSync(worktreePath),
+    exists: fs19.existsSync(worktreePath),
     moduleUid
   };
 }
@@ -8999,15 +9202,15 @@ async function getWorktreeInfoForModule(moduleUid) {
     return null;
   }
   const root = getEpisodaRoot2();
-  const workspaceRoot = path19.join(root, config.workspace_slug);
+  const workspaceRoot = path20.join(root, config.workspace_slug);
   try {
-    const entries = fs18.readdirSync(workspaceRoot, { withFileTypes: true });
+    const entries = fs19.readdirSync(workspaceRoot, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) {
         continue;
       }
-      const worktreePath = path19.join(workspaceRoot, entry.name, moduleUid);
-      if (fs18.existsSync(worktreePath)) {
+      const worktreePath = path20.join(workspaceRoot, entry.name, moduleUid);
+      if (fs19.existsSync(worktreePath)) {
         return {
           path: worktreePath,
           exists: true,
@@ -9024,61 +9227,61 @@ async function getWorktreeInfoForModule(moduleUid) {
 }
 
 // src/framework-detector.ts
-var fs19 = __toESM(require("fs"));
-var path20 = __toESM(require("path"));
+var fs20 = __toESM(require("fs"));
+var path21 = __toESM(require("path"));
 function getInstallCommand(cwd) {
-  if (fs19.existsSync(path20.join(cwd, "bun.lockb"))) {
+  if (fs20.existsSync(path21.join(cwd, "bun.lockb"))) {
     return {
       command: ["bun", "install"],
       description: "Installing dependencies with bun",
       detectedFrom: "bun.lockb"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "pnpm-lock.yaml"))) {
+  if (fs20.existsSync(path21.join(cwd, "pnpm-lock.yaml"))) {
     return {
       command: ["pnpm", "install"],
       description: "Installing dependencies with pnpm",
       detectedFrom: "pnpm-lock.yaml"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "yarn.lock"))) {
+  if (fs20.existsSync(path21.join(cwd, "yarn.lock"))) {
     return {
       command: ["yarn", "install"],
       description: "Installing dependencies with yarn",
       detectedFrom: "yarn.lock"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "package-lock.json"))) {
+  if (fs20.existsSync(path21.join(cwd, "package-lock.json"))) {
     return {
       command: ["npm", "ci"],
       description: "Installing dependencies with npm ci",
       detectedFrom: "package-lock.json"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "package.json"))) {
+  if (fs20.existsSync(path21.join(cwd, "package.json"))) {
     return {
       command: ["npm", "install"],
       description: "Installing dependencies with npm",
       detectedFrom: "package.json"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "Pipfile.lock")) || fs19.existsSync(path20.join(cwd, "Pipfile"))) {
+  if (fs20.existsSync(path21.join(cwd, "Pipfile.lock")) || fs20.existsSync(path21.join(cwd, "Pipfile"))) {
     return {
       command: ["pipenv", "install"],
       description: "Installing dependencies with pipenv",
-      detectedFrom: fs19.existsSync(path20.join(cwd, "Pipfile.lock")) ? "Pipfile.lock" : "Pipfile"
+      detectedFrom: fs20.existsSync(path21.join(cwd, "Pipfile.lock")) ? "Pipfile.lock" : "Pipfile"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "poetry.lock"))) {
+  if (fs20.existsSync(path21.join(cwd, "poetry.lock"))) {
     return {
       command: ["poetry", "install"],
       description: "Installing dependencies with poetry",
       detectedFrom: "poetry.lock"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "pyproject.toml"))) {
-    const pyprojectPath = path20.join(cwd, "pyproject.toml");
-    const content = fs19.readFileSync(pyprojectPath, "utf-8");
+  if (fs20.existsSync(path21.join(cwd, "pyproject.toml"))) {
+    const pyprojectPath = path21.join(cwd, "pyproject.toml");
+    const content = fs20.readFileSync(pyprojectPath, "utf-8");
     if (content.includes("[tool.poetry]")) {
       return {
         command: ["poetry", "install"],
@@ -9087,41 +9290,41 @@ function getInstallCommand(cwd) {
       };
     }
   }
-  if (fs19.existsSync(path20.join(cwd, "requirements.txt"))) {
+  if (fs20.existsSync(path21.join(cwd, "requirements.txt"))) {
     return {
       command: ["pip", "install", "-r", "requirements.txt"],
       description: "Installing dependencies with pip",
       detectedFrom: "requirements.txt"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "Gemfile.lock")) || fs19.existsSync(path20.join(cwd, "Gemfile"))) {
+  if (fs20.existsSync(path21.join(cwd, "Gemfile.lock")) || fs20.existsSync(path21.join(cwd, "Gemfile"))) {
     return {
       command: ["bundle", "install"],
       description: "Installing dependencies with bundler",
-      detectedFrom: fs19.existsSync(path20.join(cwd, "Gemfile.lock")) ? "Gemfile.lock" : "Gemfile"
+      detectedFrom: fs20.existsSync(path21.join(cwd, "Gemfile.lock")) ? "Gemfile.lock" : "Gemfile"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "go.sum")) || fs19.existsSync(path20.join(cwd, "go.mod"))) {
+  if (fs20.existsSync(path21.join(cwd, "go.sum")) || fs20.existsSync(path21.join(cwd, "go.mod"))) {
     return {
       command: ["go", "mod", "download"],
       description: "Downloading Go modules",
-      detectedFrom: fs19.existsSync(path20.join(cwd, "go.sum")) ? "go.sum" : "go.mod"
+      detectedFrom: fs20.existsSync(path21.join(cwd, "go.sum")) ? "go.sum" : "go.mod"
     };
   }
-  if (fs19.existsSync(path20.join(cwd, "Cargo.lock")) || fs19.existsSync(path20.join(cwd, "Cargo.toml"))) {
+  if (fs20.existsSync(path21.join(cwd, "Cargo.lock")) || fs20.existsSync(path21.join(cwd, "Cargo.toml"))) {
     return {
       command: ["cargo", "build"],
       description: "Building Rust project (downloads dependencies)",
-      detectedFrom: fs19.existsSync(path20.join(cwd, "Cargo.lock")) ? "Cargo.lock" : "Cargo.toml"
+      detectedFrom: fs20.existsSync(path21.join(cwd, "Cargo.lock")) ? "Cargo.lock" : "Cargo.toml"
     };
   }
   return null;
 }
 
 // src/daemon/daemon-process.ts
-var fs20 = __toESM(require("fs"));
+var fs21 = __toESM(require("fs"));
 var os8 = __toESM(require("os"));
-var path21 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 var packageJson = require_package();
 async function ensureValidToken(config, bufferMs = 5 * 60 * 1e3) {
   const now = Date.now();
@@ -9371,7 +9574,7 @@ var Daemon = class _Daemon {
           if (attempt < MAX_RETRIES) {
             const delay = INITIAL_DELAY * Math.pow(2, attempt - 1);
             console.log(`[Daemon] Retrying in ${delay / 1e3}s...`);
-            await new Promise((resolve3) => setTimeout(resolve3, delay));
+            await new Promise((resolve4) => setTimeout(resolve4, delay));
             await this.disconnectProject(projectPath);
           }
         }
@@ -9572,8 +9775,8 @@ var Daemon = class _Daemon {
       }
     }
     let releaseLock;
-    const lockPromise = new Promise((resolve3) => {
-      releaseLock = resolve3;
+    const lockPromise = new Promise((resolve4) => {
+      releaseLock = resolve4;
     });
     this.tunnelOperationLocks.set(moduleUid, lockPromise);
     try {
@@ -9599,7 +9802,7 @@ var Daemon = class _Daemon {
         const maxWait = 35e3;
         const startTime = Date.now();
         while (this.pendingConnections.has(projectPath) && Date.now() - startTime < maxWait) {
-          await new Promise((resolve3) => setTimeout(resolve3, 500));
+          await new Promise((resolve4) => setTimeout(resolve4, 500));
         }
         if (this.liveConnections.has(projectPath)) {
           console.log(`[Daemon] Pending connection succeeded for ${projectPath}`);
@@ -9647,7 +9850,7 @@ var Daemon = class _Daemon {
         client.updateActivity();
         try {
           const gitCmd = message.command;
-          const bareRepoPath = path21.join(projectPath, ".bare");
+          const bareRepoPath = path22.join(projectPath, ".bare");
           const cwd = gitCmd.worktreePath || bareRepoPath;
           if (gitCmd.worktreePath) {
             console.log(`[Daemon] Routing command to worktree: ${gitCmd.worktreePath}`);
@@ -10191,21 +10394,21 @@ var Daemon = class _Daemon {
       let daemonPid;
       try {
         const pidPath = getPidFilePath();
-        if (fs20.existsSync(pidPath)) {
-          const pidStr = fs20.readFileSync(pidPath, "utf-8").trim();
+        if (fs21.existsSync(pidPath)) {
+          const pidStr = fs21.readFileSync(pidPath, "utf-8").trim();
           daemonPid = parseInt(pidStr, 10);
         }
       } catch (pidError) {
         console.warn(`[Daemon] Could not read daemon PID:`, pidError instanceof Error ? pidError.message : pidError);
       }
-      const authSuccessPromise = new Promise((resolve3, reject) => {
+      const authSuccessPromise = new Promise((resolve4, reject) => {
         const AUTH_TIMEOUT = 3e4;
         const timeout = setTimeout(() => {
           reject(new Error("Authentication timeout after 30s - server may be under heavy load. Try again in a few seconds."));
         }, AUTH_TIMEOUT);
         const authHandler = () => {
           clearTimeout(timeout);
-          resolve3();
+          resolve4();
         };
         client.once("auth_success", authHandler);
         const errorHandler = (message) => {
@@ -10273,28 +10476,28 @@ var Daemon = class _Daemon {
    * - workDir: The directory to run git commands in (cwd)
    */
   getGitDirs(projectPath) {
-    const bareDir = path21.join(projectPath, ".bare");
-    const gitPath = path21.join(projectPath, ".git");
-    if (fs20.existsSync(bareDir) && fs20.statSync(bareDir).isDirectory()) {
+    const bareDir = path22.join(projectPath, ".bare");
+    const gitPath = path22.join(projectPath, ".git");
+    if (fs21.existsSync(bareDir) && fs21.statSync(bareDir).isDirectory()) {
       return { gitDir: bareDir, workDir: projectPath };
     }
-    if (fs20.existsSync(gitPath) && fs20.statSync(gitPath).isDirectory()) {
+    if (fs21.existsSync(gitPath) && fs21.statSync(gitPath).isDirectory()) {
       return { gitDir: null, workDir: projectPath };
     }
-    if (fs20.existsSync(gitPath) && fs20.statSync(gitPath).isFile()) {
+    if (fs21.existsSync(gitPath) && fs21.statSync(gitPath).isFile()) {
       return { gitDir: null, workDir: projectPath };
     }
-    const entries = fs20.readdirSync(projectPath, { withFileTypes: true });
+    const entries = fs21.readdirSync(projectPath, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name.startsWith("EP")) {
-        const worktreePath = path21.join(projectPath, entry.name);
-        const worktreeGit = path21.join(worktreePath, ".git");
-        if (fs20.existsSync(worktreeGit)) {
+        const worktreePath = path22.join(projectPath, entry.name);
+        const worktreeGit = path22.join(worktreePath, ".git");
+        if (fs21.existsSync(worktreeGit)) {
           return { gitDir: null, workDir: worktreePath };
         }
       }
     }
-    if (fs20.existsSync(bareDir)) {
+    if (fs21.existsSync(bareDir)) {
       return { gitDir: bareDir, workDir: projectPath };
     }
     return { gitDir: null, workDir: projectPath };
@@ -10358,24 +10561,24 @@ var Daemon = class _Daemon {
   async installGitHooks(projectPath) {
     const hooks = ["post-checkout", "pre-commit", "post-commit"];
     let hooksDir;
-    const bareHooksDir = path21.join(projectPath, ".bare", "hooks");
-    const gitHooksDir = path21.join(projectPath, ".git", "hooks");
-    if (fs20.existsSync(bareHooksDir)) {
+    const bareHooksDir = path22.join(projectPath, ".bare", "hooks");
+    const gitHooksDir = path22.join(projectPath, ".git", "hooks");
+    if (fs21.existsSync(bareHooksDir)) {
       hooksDir = bareHooksDir;
-    } else if (fs20.existsSync(gitHooksDir) && fs20.statSync(path21.join(projectPath, ".git")).isDirectory()) {
+    } else if (fs21.existsSync(gitHooksDir) && fs21.statSync(path22.join(projectPath, ".git")).isDirectory()) {
       hooksDir = gitHooksDir;
     } else {
-      const parentBareHooks = path21.join(projectPath, "..", ".bare", "hooks");
-      if (fs20.existsSync(parentBareHooks)) {
+      const parentBareHooks = path22.join(projectPath, "..", ".bare", "hooks");
+      if (fs21.existsSync(parentBareHooks)) {
         hooksDir = parentBareHooks;
       } else {
         console.warn(`[Daemon] Hooks directory not found for: ${projectPath}`);
         return;
       }
     }
-    if (!fs20.existsSync(hooksDir)) {
+    if (!fs21.existsSync(hooksDir)) {
       try {
-        fs20.mkdirSync(hooksDir, { recursive: true });
+        fs21.mkdirSync(hooksDir, { recursive: true });
       } catch (error) {
         console.warn(`[Daemon] Hooks directory not found and could not create: ${hooksDir}`);
         return;
@@ -10383,20 +10586,20 @@ var Daemon = class _Daemon {
     }
     for (const hookName of hooks) {
       try {
-        const hookPath = path21.join(hooksDir, hookName);
-        const bundledHookPath = path21.join(__dirname, "..", "hooks", hookName);
-        if (!fs20.existsSync(bundledHookPath)) {
+        const hookPath = path22.join(hooksDir, hookName);
+        const bundledHookPath = path22.join(__dirname, "..", "hooks", hookName);
+        if (!fs21.existsSync(bundledHookPath)) {
           console.warn(`[Daemon] Bundled hook not found: ${bundledHookPath}`);
           continue;
         }
-        const hookContent = fs20.readFileSync(bundledHookPath, "utf-8");
-        if (fs20.existsSync(hookPath)) {
-          const existingContent = fs20.readFileSync(hookPath, "utf-8");
+        const hookContent = fs21.readFileSync(bundledHookPath, "utf-8");
+        if (fs21.existsSync(hookPath)) {
+          const existingContent = fs21.readFileSync(hookPath, "utf-8");
           if (existingContent === hookContent) {
             continue;
           }
         }
-        fs20.writeFileSync(hookPath, hookContent, { mode: 493 });
+        fs21.writeFileSync(hookPath, hookContent, { mode: 493 });
         console.log(`[Daemon] Installed git hook: ${hookName}`);
       } catch (error) {
         console.warn(`[Daemon] Failed to install ${hookName} hook:`, error instanceof Error ? error.message : error);
@@ -11500,8 +11703,8 @@ var Daemon = class _Daemon {
     await this.shutdown();
     try {
       const pidPath = getPidFilePath();
-      if (fs20.existsSync(pidPath)) {
-        fs20.unlinkSync(pidPath);
+      if (fs21.existsSync(pidPath)) {
+        fs21.unlinkSync(pidPath);
         console.log("[Daemon] PID file cleaned up");
       }
     } catch (error) {