flavor-code 1.3.19 → 1.3.20

package/dist/desktop/main.js

@@ -2,7 +2,7 @@
 import { appendFileSync } from "fs";
 import { createHash as createHash28, randomUUID as randomUUID29 } from "crypto";
 import { readFile as readFile39, stat as stat18, writeFile as writeFile19 } from "fs/promises";
-import { basename as basename11, dirname as dirname25, join as join48, resolve as resolve40 } from "path";
+import { basename as basename11, dirname as dirname25, join as join48, resolve as resolve41 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { app, BrowserWindow as BrowserWindow2, clipboard, dialog, ipcMain, Menu, nativeImage, Notification, shell } from "electron";
 
@@ -272,7 +272,8 @@ var FlavorConfigSchema = z2.object({
     autoStoreThreshold: z2.number().int().min(0).max(12).default(11),
     ignoreStreakLimit: z2.number().int().min(2).max(100).default(5),
     reviewAutoDismissSeconds: z2.number().int().min(0).max(300).default(5),
-    maxCandidatesPerTask: z2.number().int().min(1).max(10).default(1),
+    // One candidate per task is a deliberate memory-quality boundary, not a tunable range.
+    maxCandidatesPerTask: z2.literal(1).default(1),
     retrievalTopK: z2.number().int().min(1).max(20).default(5),
     maxEntries: z2.number().int().min(1).max(1e4).default(200),
     maxEntryChars: z2.number().int().min(32).max(2e4).default(1e3),
@@ -1989,7 +1990,7 @@ function createEmbeddedD2cAutomation(getHost, options = {}) {
         const ready = await candidate.executeJavaScript("document.readyState", false).catch(() => void 0);
         if (ready === "complete" || ready === "interactive") return candidate;
       }
-      await new Promise((resolve41) => setTimeout(resolve41, pollIntervalMs));
+      await new Promise((resolve42) => setTimeout(resolve42, pollIntervalMs));
     }
     throw new Error(`D2C embedded preview did not navigate within ${navigationTimeoutMs} ms: ${url}${observedUrl === void 0 ? "" : `; last observed ${observedUrl}`}${observedFrames.length === 0 ? "; no live frames" : `; live frames ${observedFrames.join(", ")}`}`);
   };
@@ -2004,13 +2005,13 @@ function createEmbeddedD2cAutomation(getHost, options = {}) {
     while (Date.now() <= deadline) {
       last = await frame(baseUrl).executeJavaScript(assertionScript(step), true);
       if (last.passed) return last;
-      await new Promise((resolve41) => setTimeout(resolve41, 50));
+      await new Promise((resolve42) => setTimeout(resolve42, 50));
     }
     return last;
   };
   const settleAfterAction = async (previousUrl) => {
     const origin = new URL(previousUrl).origin;
-    await new Promise((resolve41) => setTimeout(resolve41, Math.min(180, Math.max(20, visualDelayMs * 0.25))));
+    await new Promise((resolve42) => setTimeout(resolve42, Math.min(180, Math.max(20, visualDelayMs * 0.25))));
     const deadline = Date.now() + Math.min(2e3, navigationTimeoutMs);
     while (Date.now() <= deadline) {
       const candidate = host().mainFrame.framesInSubtree.find((item) => !item.isDestroyed() && sameOrigin(item.url, origin));
@@ -2018,7 +2019,7 @@ function createEmbeddedD2cAutomation(getHost, options = {}) {
         const ready = await candidate.executeJavaScript("document.readyState", false).catch(() => void 0);
         if (ready === "complete" || ready === "interactive") return candidate;
       }
-      await new Promise((resolve41) => setTimeout(resolve41, pollIntervalMs));
+      await new Promise((resolve42) => setTimeout(resolve42, pollIntervalMs));
     }
     throw new Error("D2C preview frame was unavailable after an interaction action");
   };
@@ -2105,7 +2106,7 @@ function createEmbeddedD2cAutomation(getHost, options = {}) {
             return result;
           },
           settle: async () => {
-            await new Promise((resolve41) => setTimeout(resolve41, 150));
+            await new Promise((resolve42) => setTimeout(resolve42, 150));
             requests = await frame(activeUrl).executeJavaScript(`performance.getEntriesByType("resource").filter((entry) => {
               try { return ["fetch", "xmlhttprequest"].includes(entry.initiatorType) && new URL(entry.name).origin === ${JSON.stringify(mockOrigin)}; } catch { return false; }
             }).length`, false).catch(() => 0);
@@ -2191,7 +2192,7 @@ function responseText(protocol, value) {
   }
   throw new Error("D2C Judge response did not contain text output");
 }
-function createD2cJudgeClient(fetcher = globalThis.fetch, retryDelay = (ms) => new Promise((resolve41) => setTimeout(resolve41, ms))) {
+function createD2cJudgeClient(fetcher = globalThis.fetch, retryDelay = (ms) => new Promise((resolve42) => setTimeout(resolve42, ms))) {
   const request = async (config, prompt, images, maxTokens) => {
     const openAi = config.protocol === "openai-compatible";
     const imageContent = openAi ? images.map((image) => ({ type: "image_url", image_url: { url: dataUrl(image), detail: "high" } })) : images.map((image) => ({ type: "image", source: { type: "base64", media_type: "image/png", data: image.toString("base64") } }));
@@ -2550,7 +2551,7 @@ import { z as z7 } from "zod";
 import { Worker } from "worker_threads";
 function comparePngsInWorker(left, right, signal) {
   signal?.throwIfAborted();
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const worker = new Worker(new URL("./pixel-worker.js", import.meta.url));
     let settled = false;
     const finish = (callback) => {
@@ -2568,7 +2569,7 @@ function comparePngsInWorker(left, right, signal) {
         finish(() => reject(new Error(value.error ?? "D2C pixel worker failed")));
         return;
       }
-      finish(() => resolve41({ ...value.result, heatmapPng: Buffer.from(value.result.heatmapPng) }));
+      finish(() => resolve42({ ...value.result, heatmapPng: Buffer.from(value.result.heatmapPng) }));
     });
     worker.once("error", (error) => finish(() => reject(error)));
     worker.once("exit", (code) => {
@@ -4225,10 +4226,10 @@ ${summarizeReport(report2)}`).join("\n\n")
 
 // src/production.ts
 import { readFile as readFile27 } from "fs/promises";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { createHash as createHash21, randomUUID as randomUUID25 } from "crypto";
 import { homedir as homedir2, release as osRelease, tmpdir as tmpdir4, version as osVersion } from "os";
-import { basename as basename8, dirname as dirname24, join as join34, relative as relative23, resolve as resolve33, sep as sep23 } from "path";
+import { basename as basename8, dirname as dirname24, join as join35, relative as relative23, resolve as resolve34, sep as sep23 } from "path";
 
 // src/agent/subagents.ts
 import { z as z10 } from "zod";
@@ -4441,12 +4442,12 @@ function hasCycle(nodes) {
 
 // src/utils/async.ts
 function withTimeout(promise, ms) {
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
-      resolve41({ timedOut: true, value: void 0 });
+      resolve42({ timedOut: true, value: void 0 });
     }, ms);
     timer.unref?.();
     promise.then(
@@ -4454,7 +4455,7 @@ function withTimeout(promise, ms) {
         if (!settled) {
           settled = true;
           clearTimeout(timer);
-          resolve41({ timedOut: false, value });
+          resolve42({ timedOut: false, value });
         }
       },
       (error) => {
@@ -4469,13 +4470,13 @@ function withTimeout(promise, ms) {
 }
 function awaitWithSignal3(promise, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const onAbort = () => reject(signal.reason);
     signal.addEventListener("abort", onAbort, { once: true });
     promise.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve41(value);
+        resolve42(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -6524,10 +6525,10 @@ function sanitize(message2, secrets) {
 }
 function waitForRetry(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve41();
+      resolve42();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -7165,10 +7166,10 @@ function serializeToolInput(input) {
 }
 function waitForRetry2(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve41();
+      resolve42();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -8713,6 +8714,64 @@ var HookDecisionSchema = z16.object({
   additionalContext: z16.string().optional()
 });
 
+// src/utils/spawn-executable.ts
+import { existsSync as existsSync3, statSync as statSync2 } from "fs";
+import { extname as extname2, isAbsolute as isAbsolute6, resolve as resolve9 } from "path";
+var WINDOWS_EXECUTABLE = /\.(?:com|exe)$/iu;
+var WINDOWS_CMD_SHIM = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/iu;
+var CMD_META = /([()\][%!^"`<>&|;, *?])/gu;
+function prepareSpawnInvocation(command, args, options = {}) {
+  if ((options.platform ?? process.platform) !== "win32") return { command, args: [...args] };
+  const env = options.env ?? process.env;
+  const commandFile = resolveWindowsCommand(command, options.cwd, env);
+  if (commandFile === void 0 || WINDOWS_EXECUTABLE.test(commandFile)) {
+    return { command: commandFile ?? command, args: [...args] };
+  }
+  const doubleEscape = WINDOWS_CMD_SHIM.test(commandFile);
+  const shellCommand = [escapeCmdCommand(commandFile), ...args.map((arg) => escapeCmdArgument(arg, doubleEscape))].join(" ");
+  return {
+    command: environmentValue(env, "ComSpec") ?? "cmd.exe",
+    args: ["/d", "/s", "/c", `"${shellCommand}"`],
+    windowsVerbatimArguments: true
+  };
+}
+function resolveWindowsCommand(command, cwd, env) {
+  const pathValue = environmentValue(env, "PATH") ?? "";
+  const pathExt = (environmentValue(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const hasPath = isAbsolute6(command) || /[\\/]/u.test(command);
+  const bases = hasPath ? [isAbsolute6(command) ? command : resolve9(cwd ?? process.cwd(), command)] : pathValue.split(";").filter(Boolean).map((entry2) => resolve9(unquote(entry2), command));
+  for (const base of bases) {
+    const candidates = extname2(base).length > 0 ? [base] : [base, ...pathExt.map((extension2) => `${base}${extension2}`)];
+    for (const candidate of candidates) {
+      if (isRegularFile(candidate)) return resolve9(candidate);
+    }
+  }
+  return void 0;
+}
+function environmentValue(env, name) {
+  const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
+  return key === void 0 ? void 0 : env[key];
+}
+function unquote(value) {
+  const trimmed = value.trim();
+  return trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+}
+function isRegularFile(path) {
+  try {
+    return existsSync3(path) && statSync2(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function escapeCmdCommand(value) {
+  return value.replace(CMD_META, "^$1");
+}
+function escapeCmdArgument(value, doubleEscapeMetaCharacters) {
+  let escaped = value.replace(/(?=(\\+?)?)\1"/gu, '$1$1\\"').replace(/(?=(\\+?)?)\1$/gu, "$1$1");
+  escaped = `"${escaped}"`.replace(CMD_META, "^$1");
+  return doubleEscapeMetaCharacters ? escaped.replace(CMD_META, "^$1") : escaped;
+}
+
 // src/hooks/bus.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_MAX_OUTPUT_BYTES = 1048576;
@@ -8819,13 +8878,16 @@ function decoratePayload(payload, envelope) {
   return envelope === void 0 ? payload : { ...payload, ...envelope };
 }
 function runShellHandler(descriptor, event, signal) {
-  return new Promise((resolve41, reject) => {
-    const child = spawn(descriptor.command, [...descriptor.args ?? []], {
-      env: { ...process.env, ...descriptor.env },
+  return new Promise((resolve42, reject) => {
+    const env = { ...process.env, ...descriptor.env };
+    const invocation = prepareSpawnInvocation(descriptor.command, descriptor.args ?? [], { env });
+    const child = spawn(invocation.command, invocation.args, {
+      env,
       shell: false,
       detached: process.platform !== "win32",
       windowsHide: true,
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      ...invocation.windowsVerbatimArguments === void 0 ? {} : { windowsVerbatimArguments: invocation.windowsVerbatimArguments }
     });
     const maxOutputBytes = descriptor.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
     let stdout = "";
@@ -8862,7 +8924,7 @@ function runShellHandler(descriptor, event, signal) {
         return;
       }
       try {
-        resolve41(HookDecisionSchema.parse(JSON.parse(stdout)));
+        resolve42(HookDecisionSchema.parse(JSON.parse(stdout)));
       } catch (error) {
         reject(error);
       }
@@ -8901,7 +8963,7 @@ function zodRecord(payload) {
 // src/utils/execFileNoThrow.ts
 import { execFile } from "child_process";
 function execFileNoThrow(file, args, options = {}) {
-  return new Promise((resolve41) => {
+  return new Promise((resolve42) => {
     const child = execFile(file, args, {
       timeout: options.timeout,
       cwd: options.useCwd === false ? void 0 : process.cwd(),
@@ -8909,7 +8971,7 @@ function execFileNoThrow(file, args, options = {}) {
       encoding: "utf8",
       windowsHide: true
     }, (error, stdout, stderr) => {
-      resolve41({
+      resolve42({
         stdout,
         stderr,
         code: typeof error?.code === "number" ? error.code : error ? 1 : 0,
@@ -9081,14 +9143,14 @@ async function createIslandControlServer(options) {
       void dispatch(line, socket, options, token);
     });
   });
-  await new Promise((resolve41, reject) => {
+  await new Promise((resolve42, reject) => {
     const onError = (error) => {
       server.removeListener("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.removeListener("error", onError);
-      resolve41();
+      resolve42();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -9159,11 +9221,11 @@ function write(socket, payload) {
   }
 }
 function closeServer(server) {
-  return new Promise((resolve41) => {
+  return new Promise((resolve42) => {
     try {
-      server.close(() => resolve41());
+      server.close(() => resolve42());
     } catch {
-      resolve41();
+      resolve42();
     }
   });
 }
@@ -9177,13 +9239,13 @@ import { z as z19 } from "zod";
 // src/evolve/loader.ts
 import { cp as cp2, mkdir as mkdir7, mkdtemp, readdir as readdir3, rm as rm4, stat as stat5, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join10, resolve as resolve10 } from "path";
+import { join as join10, resolve as resolve11 } from "path";
 
 // src/plugins/host.ts
 import { createHash as createHash8 } from "crypto";
 import { lstatSync, realpathSync as realpathSync3 } from "fs";
 import { lstat as lstat3, open as open4, readFile as readFile7, readdir as readdir2, realpath as realpath6, stat as stat4, writeFile as writeFile4 } from "fs/promises";
-import { isAbsolute as isAbsolute6, relative as relative7, resolve as resolve9, sep as sep7 } from "path";
+import { isAbsolute as isAbsolute7, relative as relative7, resolve as resolve10, sep as sep7 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { z as z18 } from "zod";
 
@@ -9501,7 +9563,7 @@ var PluginHost = class {
     const roots = [];
     for (const directory of directories) {
       try {
-        for (const entry2 of await readdir2(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve9(directory, entry2.name));
+        for (const entry2 of await readdir2(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve10(directory, entry2.name));
       } catch (error) {
         this.#diagnose(directory, error, directory);
       }
@@ -9534,7 +9596,7 @@ var PluginHost = class {
       const rootInfo = await lstat3(inputRoot);
       if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new Error("Plugin root must be a static directory");
       const root = await realpath6(inputRoot);
-      const rawManifest = await readManifest2(resolve9(root, MANIFEST));
+      const rawManifest = await readManifest2(resolve10(root, MANIFEST));
       if (typeof rawManifest === "object" && rawManifest !== null && "name" in rawManifest && typeof rawManifest.name === "string") {
         diagnosticLabel = rawManifest.name;
       }
@@ -9720,7 +9782,7 @@ var PluginHost = class {
       assertActive();
       const permission = `filesystem:${operation}`;
       if (!manifest.permissions.includes(permission)) throw new Error(`Plugin ${manifest.name} lacks ${permission} permission`);
-      const path = resolve9(rawPath);
+      const path = resolve10(rawPath);
       const authorized = await this.#options.authorizeFilesystem?.({ plugin: manifest.name, operation, path });
       assertActive();
       if (authorized !== true) throw new Error(`Filesystem ${operation} denied for plugin ${manifest.name}`);
@@ -9851,14 +9913,14 @@ function assertSnapshot(expected, actual, label) {
   for (const key of ["dev", "ino", "mode", "size", "mtimeNs", "ctimeNs"]) if (expected[key] !== actual[key]) throw new Error(`${label} changed during validation`);
 }
 function resolveContained(root, value, label) {
-  if (isAbsolute6(value)) throw new Error(`${label} must be relative to the plugin root`);
-  const candidate = resolve9(root, value);
+  if (isAbsolute7(value)) throw new Error(`${label} must be relative to the plugin root`);
+  const candidate = resolve10(root, value);
   assertContained2(root, candidate, label);
   return candidate;
 }
 function assertContained2(root, candidate, label) {
   const delta = relative7(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep7}`) || isAbsolute6(delta)) throw new Error(`${label} escapes the plugin root`);
+  if (delta === ".." || delta.startsWith(`..${sep7}`) || isAbsolute7(delta)) throw new Error(`${label} escapes the plugin root`);
 }
 function scopedLogger(logger, plugin) {
   const prefix = `[plugin:${plugin}] `;
@@ -9908,10 +9970,10 @@ function sanitizePluginName(tool) {
   return base.startsWith("fix-") ? base : `fix-${base}`;
 }
 function fixPluginDir(workspace, name) {
-  return resolve10(workspace, PLUGIN_DIR, name);
+  return resolve11(workspace, PLUGIN_DIR, name);
 }
 function versionsDirFor(workspace, name) {
-  return resolve10(workspace, VERSIONS_DIR, name);
+  return resolve11(workspace, VERSIONS_DIR, name);
 }
 function timestamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-");
@@ -10348,7 +10410,7 @@ var USAGE = [
   "  clear     reset signals, done markers, and verified markers"
 ].join("\n");
 function runCommand(command, cwd, timeoutMs) {
-  return new Promise((resolve41) => {
+  return new Promise((resolve42) => {
     const isWindows = process.platform === "win32";
     const child = spawn2(isWindows ? "cmd.exe" : "/bin/sh", isWindows ? ["/d", "/s", "/c", command] : ["-c", command], {
       cwd,
@@ -10358,7 +10420,7 @@ function runCommand(command, cwd, timeoutMs) {
     let stderr = "";
     const timer = setTimeout(() => {
       child.kill();
-      resolve41({ ok: false, stdout, stderr: `${stderr}
+      resolve42({ ok: false, stdout, stderr: `${stderr}
 [killed: exceeded ${timeoutMs}ms]`, code: "timeout" });
     }, timeoutMs);
     child.stdout.on("data", (chunk) => {
@@ -10369,12 +10431,12 @@ function runCommand(command, cwd, timeoutMs) {
     });
     child.on("error", (error) => {
       clearTimeout(timer);
-      resolve41({ ok: false, stdout, stderr: `${stderr}
+      resolve42({ ok: false, stdout, stderr: `${stderr}
 ${error.message}`, code: "spawn" });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve41({ ok: code === 0, stdout, stderr, code: code ?? "unknown" });
+      resolve42({ ok: code === 0, stdout, stderr, code: code ?? "unknown" });
     });
   });
 }
@@ -10784,7 +10846,7 @@ ${result.stderr.slice(-4e3)}` : ""}`;
 // src/init/project.ts
 import { lstat as lstat4, mkdir as mkdir9, readdir as readdir4, readFile as readFile9, realpath as realpath7, writeFile as writeFile8 } from "fs/promises";
 import { copyFileSync, mkdirSync as mkdirSync2, readdirSync } from "fs";
-import { basename as basename4, dirname as dirname9, isAbsolute as isAbsolute7, join as join13, relative as relative8, sep as sep8 } from "path";
+import { basename as basename4, dirname as dirname9, isAbsolute as isAbsolute8, join as join13, relative as relative8, sep as sep8 } from "path";
 import { fileURLToPath } from "url";
 var GENERATED_START = "<!-- flavor-code:start -->";
 var GENERATED_END = "<!-- flavor-code:end -->";
@@ -10834,7 +10896,7 @@ var CONFIG_FILES = [
 ];
 function isContainedPath(root, candidate) {
   const pathFromRoot = relative8(root, candidate);
-  return pathFromRoot === "" || pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep8}`) && !isAbsolute7(pathFromRoot);
+  return pathFromRoot === "" || pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep8}`) && !isAbsolute8(pathFromRoot);
 }
 async function pathKind(path, root) {
   try {
@@ -12353,14 +12415,14 @@ function formatPriorGaps(gaps) {
 import { constants as constants3 } from "fs";
 import { randomUUID as randomUUID11 } from "crypto";
 import { lstat as lstat5, mkdir as mkdir11, open as open5, rename as rename4, rm as rm6 } from "fs/promises";
-import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve11, sep as sep9 } from "path";
+import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve12, sep as sep9 } from "path";
 var DEFAULT_MAX_BYTES = 1024 * 1024;
 var GoalStore = class {
   #workspace;
   #root;
   #maxBytes;
   constructor(options) {
-    this.#workspace = resolve11(options.workspace);
+    this.#workspace = resolve12(options.workspace);
     this.#root = join16(this.#workspace, ".flavor", "goals");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
   }
@@ -12391,8 +12453,8 @@ var GoalStore = class {
   }
 };
 async function assertNoSymlink(root, target) {
-  let cursor = resolve11(target);
-  const stop = resolve11(root);
+  let cursor = resolve12(target);
+  const stop = resolve12(root);
   const value = relative9(stop, cursor);
   if (value === ".." || value.startsWith(`..${sep9}`) || value.includes(":")) {
     throw new Error("Goal path escapes workspace");
@@ -12416,7 +12478,7 @@ function isCode4(error, code) {
 
 // src/loop/isolation.ts
 import { appendFile as appendFile2, mkdir as mkdir12, readFile as readFile11 } from "fs/promises";
-import { join as join17, resolve as resolve12 } from "path";
+import { join as join17, resolve as resolve13 } from "path";
 var CODE_CHANGE = /\b(?:fix|implement|add|update|change|modify|refactor|build|create|remove|delete|write|migrate)\b|修复|实现|添加|更新|修改|重构|创建|删除|迁移/i;
 var READ_ONLY = /\b(?:review|analy[sz]e|inspect|explain|research|investigate|audit|summari[sz]e|report)\b|调研|分析|审查|检查|解释|研究|总结|报告/i;
 function inferGoalIntent(goal) {
@@ -12426,7 +12488,7 @@ function inferGoalIntent(goal) {
 }
 async function prepareLoopWorkspace(options) {
   options.signal?.throwIfAborted();
-  const root = resolve12(options.root);
+  const root = resolve13(options.root);
   const intent = inferGoalIntent(options.goal);
   if (intent === "read_only") return { kind: "ready", workspace: { root, mode: "current" } };
   const inside = await git(root, ["rev-parse", "--is-inside-work-tree"]);
@@ -12469,7 +12531,7 @@ async function ensureWorktreeDirectoryIgnored(root) {
   if (ignored2.code === 0) return;
   const commonDirectory = await git(root, ["rev-parse", "--git-common-dir"]);
   if (commonDirectory.code !== 0) throw new Error(commonDirectory.stderr.trim() || "Git common directory is unavailable");
-  const gitDirectory = resolve12(root, commonDirectory.stdout.trim());
+  const gitDirectory = resolve13(root, commonDirectory.stdout.trim());
   const infoDirectory = join17(gitDirectory, "info");
   const excludePath = join17(infoDirectory, "exclude");
   await mkdir12(infoDirectory, { recursive: true });
@@ -12487,7 +12549,7 @@ async function ensureWorktreeDirectoryIgnored(root) {
 // src/loop/store.ts
 import { constants as constants4 } from "fs";
 import { lstat as lstat6, mkdir as mkdir13, open as open6, readFile as readFile12, realpath as realpath8, rename as rename5, rm as rm7, stat as stat6 } from "fs/promises";
-import { dirname as dirname11, join as join18, relative as relative10, resolve as resolve13, sep as sep10 } from "path";
+import { dirname as dirname11, join as join18, relative as relative10, resolve as resolve14, sep as sep10 } from "path";
 import { randomUUID as randomUUID12 } from "crypto";
 var LOOP_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var DEFAULT_MAX_BYTES2 = 5 * 1024 * 1024;
@@ -12497,7 +12559,7 @@ var LoopStore = class {
   #maxBytes;
   #appendTails = /* @__PURE__ */ new Map();
   constructor(options) {
-    this.#workspace = resolve13(options.workspace);
+    this.#workspace = resolve14(options.workspace);
     this.#root = join18(this.#workspace, ".flavor", "loops");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES2;
   }
@@ -12596,8 +12658,8 @@ function validateId(loopId) {
   if (!LOOP_ID.test(loopId)) throw new Error("Invalid loop id");
 }
 async function assertNoSymlink2(root, target) {
-  let cursor = resolve13(target);
-  const stop = resolve13(root);
+  let cursor = resolve14(target);
+  const stop = resolve14(root);
   if (!isWithin3(stop, cursor)) throw new Error("Loop path escapes workspace");
   const chain = [];
   while (cursor !== stop) {
@@ -12613,14 +12675,14 @@ async function assertNoSymlink2(root, target) {
   }
 }
 function isWithin3(root, path) {
-  const value = relative10(resolve13(root), resolve13(path));
+  const value = relative10(resolve14(root), resolve14(path));
   return value === "" || !value.startsWith(`..${sep10}`) && value !== ".." && !value.includes(":");
 }
 async function canonical(path) {
   try {
-    return await realpath8(resolve13(path));
+    return await realpath8(resolve14(path));
   } catch {
-    return resolve13(path);
+    return resolve14(path);
   }
 }
 function isCode5(error, code) {
@@ -12633,7 +12695,7 @@ import { join as join19 } from "path";
 
 // src/tools/shell.ts
 import { spawn as spawn3, spawnSync } from "child_process";
-import { isAbsolute as isAbsolute8, relative as relative11, resolve as resolve14, sep as sep11 } from "path";
+import { isAbsolute as isAbsolute9, relative as relative11, resolve as resolve15, sep as sep11 } from "path";
 import { z as z23 } from "zod";
 
 // src/tools/jobs.ts
@@ -12786,7 +12848,7 @@ function buildWindowsCommandLine(kind, commandLine, command, args) {
   return `chcp 65001>nul & ${executable} -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encoded}`;
 }
 function createShellTool(workspace, options = {}) {
-  const root = resolve14(workspace);
+  const root = resolve15(workspace);
   const maxBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
   const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
   if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("maxOutputBytes must be a positive integer");
@@ -13085,9 +13147,9 @@ function backgroundFlag(value) {
   return value === true || value === "true";
 }
 function workingDirectory(root, cwd = ".") {
-  const candidate = resolve14(root, cwd);
+  const candidate = resolve15(root, cwd);
   const delta = relative11(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep11}`) || isAbsolute8(delta)) throw new Error("Working directory is outside the workspace");
+  if (delta === ".." || delta.startsWith(`..${sep11}`) || isAbsolute9(delta)) throw new Error("Working directory is outside the workspace");
   return candidate;
 }
 async function terminateTree(pid) {
@@ -13340,7 +13402,7 @@ function isEnvTruthy(value) {
 
 // src/utils/log.ts
 import { appendFile as appendFile3, mkdir as mkdir14 } from "fs/promises";
-import { dirname as dirname12, join as join20, resolve as resolve15 } from "path";
+import { dirname as dirname12, join as join20, resolve as resolve16 } from "path";
 var pending = Promise.resolve();
 var usagePending = Promise.resolve();
 function usageLogPath() {
@@ -13373,7 +13435,7 @@ var AuditLogger = class {
   #path;
   #closed = false;
   constructor(workspace) {
-    this.#path = join20(resolve15(workspace), ".flavor", "audit.jsonl");
+    this.#path = join20(resolve16(workspace), ".flavor", "audit.jsonl");
   }
   get path() {
     return this.#path;
@@ -14235,7 +14297,7 @@ function isRecord4(value) {
 }
 
 // src/mcp/sdk.ts
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   getDefaultEnvironment,
@@ -14283,7 +14345,7 @@ async function connectSdkMcpClient(input, dependencies2 = DEFAULT_DEPENDENCIES)
     command: config.command,
     args: [...config.args],
     env: { ...dependencies2.defaultEnvironment(), ...config.env },
-    cwd: resolve16(input.workspace, config.cwd ?? "."),
+    cwd: resolve17(input.workspace, config.cwd ?? "."),
     // MCP servers frequently log startup banners to stderr. Inheriting that
     // stream corrupts Ink's input area, so connection errors are surfaced
     // through McpManager diagnostics instead.
@@ -14488,8 +14550,8 @@ var OAuthCallbackAuthProvider = class {
   async #startCallbackServer(expectedState, signal) {
     let serverResolve;
     let serverReject;
-    const codePromise = new Promise((resolve41, reject) => {
-      serverResolve = resolve41;
+    const codePromise = new Promise((resolve42, reject) => {
+      serverResolve = resolve42;
       serverReject = reject;
     });
     const server = createServer3((req, res) => {
@@ -14523,7 +14585,7 @@ var OAuthCallbackAuthProvider = class {
       );
       serverResolve(code);
     });
-    return new Promise((resolve41, reject) => {
+    return new Promise((resolve42, reject) => {
       server.once("error", (error) => {
         reject(new Error(`OAuth callback server failed: ${error.message}`));
       });
@@ -14540,7 +14602,7 @@ var OAuthCallbackAuthProvider = class {
         signal.addEventListener("abort", () => {
           serverReject(new Error("OAuth flow aborted"));
         }, { once: true });
-        resolve41({ redirectUri, promise: codePromise });
+        resolve42({ redirectUri, promise: codePromise });
       });
     });
   }
@@ -14683,7 +14745,7 @@ function isStoredToken(value) {
 
 // src/permissions/policy.ts
 import { readFile as readFile16 } from "fs/promises";
-import { join as join22, resolve as resolve17 } from "path";
+import { join as join22, resolve as resolve18 } from "path";
 import { z as z25 } from "zod";
 var DecisionSchema2 = z25.enum(["allow", "ask", "deny"]);
 var PrefixSchema = z25.array(z25.string().min(1).max(1024)).min(1).max(64);
@@ -14719,10 +14781,10 @@ var CompiledPermissionPolicy = class {
 };
 async function loadPermissionPolicy(options) {
   const sources = [
-    ...options.managedPath === void 0 ? [] : [{ tier: "managed", path: resolve17(options.managedPath) }],
-    { tier: "user", path: join22(resolve17(options.home), ".flavor-code", "permissions.json") },
-    { tier: "project", path: join22(resolve17(options.workspace), ".flavor", "permissions.json") },
-    { tier: "local", path: join22(resolve17(options.workspace), ".flavor", "permissions.local.json") }
+    ...options.managedPath === void 0 ? [] : [{ tier: "managed", path: resolve18(options.managedPath) }],
+    { tier: "user", path: join22(resolve18(options.home), ".flavor-code", "permissions.json") },
+    { tier: "project", path: join22(resolve18(options.workspace), ".flavor", "permissions.json") },
+    { tier: "local", path: join22(resolve18(options.workspace), ".flavor", "permissions.local.json") }
   ];
   const rules = [];
   for (const source of sources) {
@@ -14944,7 +15006,7 @@ function data(value) {
 // src/skills/registry.ts
 import { constants as constants5 } from "fs";
 import { lstat as lstat7, open as defaultOpen, readdir as readdir5, realpath as realpath9 } from "fs/promises";
-import { isAbsolute as isAbsolute9, relative as relative12, resolve as resolve18, sep as sep12 } from "path";
+import { isAbsolute as isAbsolute10, relative as relative12, resolve as resolve19, sep as sep12 } from "path";
 import { marked } from "marked";
 import { parseDocument } from "yaml";
 var SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -15069,13 +15131,13 @@ var SkillRegistry = class {
     const record3 = await this.#recordFor(skill);
     const normalized = normalizeReference(reference);
     const parts = normalized.split("/");
-    if (isAbsolute9(reference) || parts.includes("..") || parts.length !== 2 || !RESOURCE_DIRECTORIES.has(parts[0] ?? "") || !RESOURCE_NAME.test(parts[1] ?? "")) {
+    if (isAbsolute10(reference) || parts.includes("..") || parts.length !== 2 || !RESOURCE_DIRECTORIES.has(parts[0] ?? "") || !RESOURCE_NAME.test(parts[1] ?? "")) {
       throw new Error(`Resource reference escapes the skill root or is not a direct resource: ${reference}`);
     }
     const body = await this.loadBody(record3.metadata);
     const references = extractResourceReferences(body);
     if (!references.has(normalized)) throw new Error(`Skill resource is not directly referenced: ${reference}`);
-    const candidate = resolve18(record3.metadata.root, ...parts);
+    const candidate = resolve19(record3.metadata.root, ...parts);
     const file = await openVerifiedFile(candidate, record3.metadata.root, "Resource", this.#options.openFile);
     try {
       if (file.snapshot.size > BigInt(this.#options.maxResourceBytes)) throw new Error(`Skill resource is too large: ${reference}`);
@@ -15104,7 +15166,7 @@ var SkillRegistry = class {
   async #discoverSource(roots, source) {
     const found = [];
     for (const configuredRoot of roots) {
-      const root = resolve18(configuredRoot);
+      const root = resolve19(configuredRoot);
       let entries;
       let physicalRoot = root;
       try {
@@ -15119,13 +15181,13 @@ var SkillRegistry = class {
       }
       entries.sort((left, right) => compareCodePoints(left.name, right.name));
       for (const entry2 of entries) {
-        const skillRoot = resolve18(root, entry2.name);
+        const skillRoot = resolve19(root, entry2.name);
         try {
           if (entry2.isSymbolicLink()) throw new Error("Symlinked skill directories are not allowed");
           if (!entry2.isDirectory()) continue;
           const physicalSkillRoot = await realpath9(skillRoot);
           if (!isWithin4(physicalRoot, physicalSkillRoot)) throw new Error("Skill directory escapes its registry root");
-          const skillFile = resolve18(skillRoot, "SKILL.md");
+          const skillFile = resolve19(skillRoot, "SKILL.md");
           const parsed = await readFrontmatterFile(
             skillFile,
             physicalSkillRoot,
@@ -15327,7 +15389,7 @@ function decodeUtf8(content, label) {
 }
 function isWithin4(root, candidate) {
   const delta = relative12(root, candidate);
-  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep12}`) && !isAbsolute9(delta);
+  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep12}`) && !isAbsolute10(delta);
 }
 function isMissing(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -15491,7 +15553,7 @@ function createSkillResourceTool(registry) {
 // src/session/store.ts
 import { constants as constants6 } from "fs";
 import { lstat as lstat8, mkdir as mkdir15, open as open7, readFile as readFile17, readdir as readdir6, realpath as realpath10, rename as rename6, rm as rm8, stat as stat7 } from "fs/promises";
-import { basename as basename5, dirname as dirname15, join as join23, relative as relative13, resolve as resolve19, sep as sep13 } from "path";
+import { basename as basename5, dirname as dirname15, join as join23, relative as relative13, resolve as resolve20, sep as sep13 } from "path";
 import { randomUUID as randomUUID13 } from "crypto";
 import { z as z27 } from "zod";
 
@@ -16179,13 +16241,14 @@ var SessionDocumentSchema = SessionBaseSchema.extend({
   }).strict(),
   timeline: TimelineSchema
 }).strict();
+var INVALID_SESSION_LOCK_STALE_MS = 3e4;
 var SessionStore = class {
   #workspace;
   #sessions;
   #maxBytes;
   #maxSessions;
   constructor(options) {
-    this.#workspace = resolve19(options.workspace);
+    this.#workspace = resolve20(options.workspace);
     this.#sessions = join23(this.#workspace, ".flavor", "sessions");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_SESSION_BYTES;
     if (!Number.isSafeInteger(this.#maxBytes) || this.#maxBytes < 256) throw new Error("maxBytes must be an integer of at least 256");
@@ -16233,6 +16296,47 @@ var SessionStore = class {
     }
     await this.#prune().catch(() => void 0);
   }
+  /** Hold this lease for the full lifetime of a writable session runtime. */
+  async acquireLease(sessionId) {
+    SessionIdSchema.parse(sessionId);
+    await this.#prepareDirectory();
+    const path = join23(this.#sessions, `.${sessionId}.lock`);
+    const token = JSON.stringify({ pid: process.pid, nonce: randomUUID13(), createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      let handle;
+      let created = false;
+      try {
+        handle = await open7(path, constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY, 384);
+        created = true;
+        await handle.writeFile(token, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = void 0;
+        let released = false;
+        return {
+          sessionId,
+          release: async () => {
+            if (released) return;
+            try {
+              if (await readFile17(path, "utf8") === token) await rm8(path, { force: true });
+            } catch (error) {
+              if (!isCode8(error, "ENOENT")) throw error;
+            }
+            released = true;
+          }
+        };
+      } catch (error) {
+        await handle?.close().catch(() => void 0);
+        if (created) await rm8(path, { force: true }).catch(() => void 0);
+        if (!isCode8(error, "EEXIST")) throw error;
+        const owner2 = await reclaimStaleSessionLock(path);
+        if (owner2 !== void 0) {
+          throw new Error(`Session "${sessionId}" is already active in process ${owner2}. Close that session before resuming it here.`);
+        }
+      }
+    }
+    throw new Error(`Session "${sessionId}" could not acquire its writer lease because the lock kept changing`);
+  }
   async load(sessionId) {
     if (sessionId === void 0) {
       const [latest] = await this.list();
@@ -16330,6 +16434,8 @@ var SessionStore = class {
       if (isCode8(error, "ENOENT")) return;
       throw error;
     }
+    const owner2 = await reclaimStaleSessionLock(join23(this.#sessions, `.${sessionId}.lock`));
+    if (owner2 !== void 0) throw new Error(`Session "${sessionId}" is active in process ${owner2} and cannot be deleted`);
     const path = this.#path(sessionId);
     try {
       const metadata = await lstat8(path);
@@ -16342,15 +16448,21 @@ var SessionStore = class {
   }
   #path(sessionId) {
     SessionIdSchema.parse(sessionId);
-    const path = resolve19(this.#sessions, `${sessionId}.jsonl`);
+    const path = resolve20(this.#sessions, `${sessionId}.jsonl`);
     if (!isWithin5(this.#sessions, path)) throw new Error("Invalid session id");
     return path;
   }
   async #prune() {
     const entries = await this.list();
     if (entries.length <= this.#maxSessions) return;
-    const excess = entries.slice(this.#maxSessions);
-    for (const entry2 of excess) {
+    let retained = 0;
+    for (const entry2 of entries) {
+      const owner2 = await reclaimStaleSessionLock(join23(this.#sessions, `.${entry2.sessionId}.lock`));
+      if (owner2 !== void 0) continue;
+      if (retained < this.#maxSessions) {
+        retained += 1;
+        continue;
+      }
       await rm8(this.#path(entry2.sessionId), { force: true }).catch(() => void 0);
       await rm8(join23(this.#sessions, `${entry2.sessionId}.events.jsonl`), { force: true }).catch(() => void 0);
     }
@@ -16398,6 +16510,47 @@ function storedSessionVersion(raw) {
   const candidate = first.__meta === true ? first.version : JSON.parse(trimmed).version;
   return typeof candidate === "number" && Number.isInteger(candidate) ? candidate : 0;
 }
+async function reclaimStaleSessionLock(path) {
+  try {
+    const token = await readFile17(path, "utf8");
+    const metadata = await stat7(path);
+    const owner2 = parseSessionLockOwner(token);
+    if (owner2 !== void 0 && isProcessAlive2(owner2)) return owner2;
+    if (owner2 === void 0 && Date.now() - metadata.mtimeMs <= INVALID_SESSION_LOCK_STALE_MS) {
+      throw new Error(`Session writer lock ${path} is incomplete or invalid; retry after the owning process exits`);
+    }
+    if (await readFile17(path, "utf8") !== token) return void 0;
+    const stale = `${path}.stale-${process.pid}-${randomUUID13()}`;
+    try {
+      await rename6(path, stale);
+      await rm8(stale, { force: true });
+    } catch (error) {
+      if (!isCode8(error, "ENOENT")) throw error;
+    }
+    return void 0;
+  } catch (error) {
+    if (isCode8(error, "ENOENT")) return void 0;
+    throw error;
+  }
+}
+function parseSessionLockOwner(token) {
+  try {
+    const value = JSON.parse(token);
+    if (typeof value !== "object" || value === null || !("pid" in value)) return void 0;
+    const pid = value.pid;
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return isCode8(error, "EPERM");
+  }
+}
 async function boundedRead(path, maxBytes) {
   const metadata = await stat7(path);
   if (!metadata.isFile()) throw new Error("Session path is not a regular file");
@@ -16544,8 +16697,8 @@ function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function assertNoSymlink3(root, target) {
-  let cursor = resolve19(target);
-  const stop = resolve19(root);
+  let cursor = resolve20(target);
+  const stop = resolve20(root);
   if (!isWithin5(stop, cursor)) throw new Error("Session path escapes the workspace");
   const chain = [];
   while (cursor !== stop) {
@@ -16561,14 +16714,14 @@ async function assertNoSymlink3(root, target) {
   }
 }
 function isWithin5(root, path) {
-  const value = relative13(resolve19(root), resolve19(path));
+  const value = relative13(resolve20(root), resolve20(path));
   return value === "" || !value.startsWith(`..${sep13}`) && value !== ".." && !value.includes(":");
 }
 async function canonical2(path) {
   try {
-    return await realpath10(resolve19(path));
+    return await realpath10(resolve20(path));
   } catch {
-    return resolve19(path);
+    return resolve20(path);
   }
 }
 function isCode8(error, code) {
@@ -16595,13 +16748,13 @@ function sanitize2(input, seen = /* @__PURE__ */ new WeakSet()) {
 // src/session/tree.ts
 import { randomUUID as randomUUID15 } from "crypto";
 import { mkdir as mkdir17, readFile as readFile19, rename as rename8, writeFile as writeFile11 } from "fs/promises";
-import { dirname as dirname17, join as join25, resolve as resolve21 } from "path";
+import { dirname as dirname17, join as join25, resolve as resolve22 } from "path";
 
 // src/session/checkpoint.ts
 import { createHash as createHash15, randomUUID as randomUUID14 } from "crypto";
 import { execFile as execFile2 } from "child_process";
 import { lstat as lstat9, mkdir as mkdir16, open as open8, readFile as readFile18, readdir as readdir7, rename as rename7, rm as rm9, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname16, join as join24, relative as relative14, resolve as resolve20, sep as sep14 } from "path";
+import { dirname as dirname16, join as join24, relative as relative14, resolve as resolve21, sep as sep14 } from "path";
 var EXCLUDED = /* @__PURE__ */ new Set([".git", ".flavor", "node_modules", "dist", "build", "release", ".worktrees"]);
 var MAX_FILE_BYTES = 16 * 1024 * 1024;
 var MAX_TOTAL_BYTES = 128 * 1024 * 1024;
@@ -16613,7 +16766,7 @@ var WorkspaceCheckpointStore = class {
   #maxFileBytes;
   #maxTotalBytes;
   constructor(options) {
-    this.#workspace = resolve20(options.workspace);
+    this.#workspace = resolve21(options.workspace);
     this.#root = join24(this.#workspace, ".flavor", "checkpoints");
     this.#objects = join24(this.#root, "objects");
     this.#manifests = join24(this.#root, "manifests");
@@ -16751,9 +16904,9 @@ function normalizeRelative(path) {
 }
 function contained(workspace, path) {
   if (path.length === 0 || path.includes("\0")) throw new Error("Invalid checkpoint path");
-  const absolute = resolve20(workspace, path);
+  const absolute = resolve21(workspace, path);
   const delta = relative14(workspace, absolute);
-  if (delta === ".." || delta.startsWith(`..${sep14}`) || delta === "" || resolve20(absolute) !== absolute) {
+  if (delta === ".." || delta.startsWith(`..${sep14}`) || delta === "" || resolve21(absolute) !== absolute) {
     throw new Error(`Checkpoint path escapes workspace: ${path}`);
   }
   return absolute;
@@ -16780,14 +16933,14 @@ var SessionHistory = class _SessionHistory {
   #leafId;
   #unrevert;
   constructor(options, document) {
-    this.#path = join25(resolve21(options.workspace), ".flavor", "session-trees", options.sessionId, "tree.json");
+    this.#path = join25(resolve22(options.workspace), ".flavor", "session-trees", options.sessionId, "tree.json");
     this.#checkpoints = new WorkspaceCheckpointStore({ workspace: options.workspace });
     this.#restoreContext = options.restoreContext;
     this.#nodes = boundedNodes(document.nodes);
     this.#leafId = document.leafId !== null && this.#nodes.some((node) => node.id === document.leafId) ? document.leafId : this.#nodes.at(-1)?.id ?? null;
   }
   static async open(options) {
-    const path = join25(resolve21(options.workspace), ".flavor", "session-trees", options.sessionId, "tree.json");
+    const path = join25(resolve22(options.workspace), ".flavor", "session-trees", options.sessionId, "tree.json");
     let document = { version: 1, sessionId: options.sessionId, leafId: null, nodes: [] };
     try {
       const parsed = JSON.parse(await readFile19(path, "utf8"));
@@ -16945,7 +17098,7 @@ function parseMemoryRestartMarker(json) {
 import { constants as constants7 } from "fs";
 import { randomUUID as randomUUID16 } from "crypto";
 import { lstat as lstat10, mkdir as mkdir18, open as open9, readdir as readdir8, realpath as realpath11, rename as rename9, rm as rm10 } from "fs/promises";
-import { isAbsolute as isAbsolute10, join as join27, relative as relative15, resolve as resolve22, sep as sep15 } from "path";
+import { isAbsolute as isAbsolute11, join as join27, relative as relative15, resolve as resolve23, sep as sep15 } from "path";
 import { z as z28 } from "zod";
 var DateKeySchema = z28.string().regex(/^\d{4}-\d{2}-\d{2}$/);
 var ReviewSchema = z28.object({
@@ -16999,7 +17152,7 @@ var ProjectSleepOrganizer = class {
   #sessions;
   #generate;
   constructor(options) {
-    this.#workspace = resolve22(options.workspace);
+    this.#workspace = resolve23(options.workspace);
     this.#sleepDirectory = join27(this.#workspace, ".flavor", "sleep");
     this.#sessions = options.sessions ?? new SessionStore({ workspace: this.#workspace });
     this.#generate = options.generate;
@@ -17424,8 +17577,8 @@ async function assertNotSymlink(path) {
 function isWithin6(root, candidate) {
   const path = relative15(root, candidate);
   if (path === "") return true;
-  if (path === ".." || path.startsWith(`..${sep15}`) || isAbsolute10(path)) return false;
-  return process.platform !== "win32" || resolve22(root, path).toLowerCase().startsWith(`${resolve22(root).toLowerCase()}${sep15}`);
+  if (path === ".." || path.startsWith(`..${sep15}`) || isAbsolute11(path)) return false;
+  return process.platform !== "win32" || resolve23(root, path).toLowerCase().startsWith(`${resolve23(root).toLowerCase()}${sep15}`);
 }
 function hasCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -17475,7 +17628,7 @@ function computeSessionStats(documents) {
 // src/tools/files.ts
 import { constants as constants8 } from "fs";
 import { mkdir as mkdir19, open as open10, readFile as readFile20, realpath as realpath12, rename as rename10, rm as rm11, stat as stat8 } from "fs/promises";
-import { dirname as dirname18, isAbsolute as isAbsolute11, relative as relative16, resolve as resolve23, sep as sep16 } from "path";
+import { dirname as dirname18, isAbsolute as isAbsolute12, relative as relative16, resolve as resolve24, sep as sep16 } from "path";
 import { randomUUID as randomUUID17 } from "crypto";
 import { z as z29 } from "zod";
 
@@ -17792,9 +17945,9 @@ function createApplyPatchTool(workspace, options = {}) {
   };
 }
 function createPathGuard(workspace) {
-  const root = resolve23(workspace);
+  const root = resolve24(workspace);
   const lexical = (input) => {
-    const candidate = resolve23(root, input);
+    const candidate = resolve24(root, input);
     if (!within2(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
@@ -17964,7 +18117,7 @@ async function readBounded2(path, maxBytes, signal, openFile2) {
 }
 function within2(root, candidate) {
   const delta = relative16(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep16}`) && delta !== ".." && !isAbsolute11(delta);
+  return delta === "" || !delta.startsWith(`..${sep16}`) && delta !== ".." && !isAbsolute12(delta);
 }
 function forceFlag(value) {
   return value === true || value === "true";
@@ -18188,7 +18341,7 @@ function matchesLines(source, start, expected) {
 // src/tools/search.ts
 import { spawn as spawn4 } from "child_process";
 import { open as open11, opendir, stat as stat9 } from "fs/promises";
-import { dirname as dirname19, isAbsolute as isAbsolute12, relative as relative17, resolve as resolve24, sep as sep17 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute13, relative as relative17, resolve as resolve25, sep as sep17 } from "path";
 import { rgPath as bundledRgPath } from "@vscode/ripgrep";
 import createIgnore from "ignore";
 import { z as z30 } from "zod";
@@ -18288,7 +18441,7 @@ var GrepInput = z30.object({
   limit: z30.coerce.number().int().positive().max(1e5).nullable().optional()
 });
 function createGlobTool(workspace, options = {}) {
-  const root = resolve24(workspace);
+  const root = resolve25(workspace);
   const resources = searchResources(options);
   return {
     name: "Glob",
@@ -18325,7 +18478,7 @@ function createGlobTool(workspace, options = {}) {
   };
 }
 function createGrepTool(workspace, options = {}) {
-  const root = resolve24(workspace);
+  const root = resolve25(workspace);
   const resources = searchResources(options);
   return {
     name: "Grep",
@@ -18371,7 +18524,7 @@ async function rgFiles(root, start, pattern, signal, executable, argsPrefix, lim
   const paths = [];
   const parser = delimitedParser(0, (record3) => {
     if (record3.length === 0) return true;
-    const path = normalizedRelative(root, resolve24(root, decodeUtf82(record3, "ripgrep path")));
+    const path = normalizedRelative(root, resolve25(root, decodeUtf82(record3, "ripgrep path")));
     if (!matcher.test(path) || ignored(path, false, ignoreLayers)) return true;
     retainTopK(paths, path, limit, comparePaths);
     return true;
@@ -18436,7 +18589,7 @@ async function hydrateContext(root, matches, context, signal, maxFileBytes, maxT
   let totalBytes = 0;
   for (const [path, pathMatches] of byPath) {
     abort(signal);
-    const absolute = resolve24(root, path);
+    const absolute = resolve25(root, path);
     const contents = await readBoundedFile(absolute, maxFileBytes, signal);
     if (contents === void 0) continue;
     totalBytes += contents.length;
@@ -18463,7 +18616,7 @@ async function nodeGrep(root, start, glob, type, expression, context, signal, ma
     if (searchedBytes >= maxSearchBytes) break;
     if (matcher !== void 0 && !matcher.test(path)) continue;
     if (extension2 !== void 0 && !extension2.some((suffix) => path.endsWith(suffix))) continue;
-    const absolute = resolve24(root, path);
+    const absolute = resolve25(root, path);
     const bytes = await readBoundedFile(absolute, Math.min(maxFileBytes, maxSearchBytes - searchedBytes), signal);
     if (bytes === void 0) continue;
     searchedBytes += bytes.length;
@@ -18503,7 +18656,7 @@ async function nodeFiles(root, start, signal, accept, limit, resources, ignoreBu
     for (let index = 0; index < segments.length; index += 1) {
       noteIgnoreDirectory(ignoreBudget);
       await loadIgnoreFiles(ancestor, normalizedRelative(root, ancestor), ignores, ignoreBudget, signal);
-      ancestor = resolve24(ancestor, segments[index]);
+      ancestor = resolve25(ancestor, segments[index]);
     }
   }
   async function walk(directory) {
@@ -18522,7 +18675,7 @@ async function nodeFiles(root, start, signal, accept, limit, resources, ignoreBu
     entries.sort((a, b) => comparePaths(a.isDirectory() ? `${a.name}/` : a.name, b.isDirectory() ? `${b.name}/` : b.name));
     for (const entry2 of entries) {
       abort(signal);
-      const absolute = resolve24(directory, entry2.name);
+      const absolute = resolve25(directory, entry2.name);
       const path = normalizedRelative(root, absolute);
       if (entry2.name === ".git" || !includeIgnored && ignored(path, entry2.isDirectory(), ignores)) continue;
       if (entry2.isDirectory()) await walk(absolute);
@@ -18542,7 +18695,7 @@ async function collectIgnoreLayers(root, start, signal, resources, ignoreBudget)
   for (let index = 0; index < segments.length; index += 1) {
     noteIgnoreDirectory(ignoreBudget);
     await loadIgnoreFiles(ancestor, normalizedRelative(root, ancestor), layers, ignoreBudget, signal);
-    ancestor = resolve24(ancestor, segments[index]);
+    ancestor = resolve25(ancestor, segments[index]);
   }
   async function walk(directory) {
     abort(signal);
@@ -18556,7 +18709,7 @@ async function collectIgnoreLayers(root, start, signal, resources, ignoreBudget)
       noteIgnoreEntry(ignoreBudget);
       if (count > resources.maxEntriesPerDirectory) throw new Error(`Per-directory entry limit of ${resources.maxEntriesPerDirectory} exceeded: ${relativeDirectory}`);
       if (!entry2.isDirectory() || entry2.name === ".git") continue;
-      const absolute = resolve24(directory, entry2.name);
+      const absolute = resolve25(directory, entry2.name);
       const path = normalizedRelative(root, absolute);
       if (!ignored(path, true, layers)) await walk(absolute);
     }
@@ -18566,7 +18719,7 @@ async function collectIgnoreLayers(root, start, signal, resources, ignoreBudget)
 }
 async function loadIgnoreFiles(directory, base, rules, budget, signal) {
   for (const name of [".gitignore", ".ignore"]) {
-    const path = resolve24(directory, name);
+    const path = resolve25(directory, name);
     const contents = await readOptionalIgnoreFile(path, budget.limits.maxIgnoreFileBytes, signal);
     if (contents === void 0) continue;
     budget.totalBytes += contents.length;
@@ -18672,9 +18825,9 @@ function searchPath(path) {
   return path?.trim().toLowerCase() === "null" ? void 0 : path ?? void 0;
 }
 function scope(root, path = ".") {
-  const candidate = resolve24(root, path);
+  const candidate = resolve25(root, path);
   const delta = relative17(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep17}`) || isAbsolute12(delta)) throw new Error("Path is outside the workspace");
+  if (delta === ".." || delta.startsWith(`..${sep17}`) || isAbsolute13(delta)) throw new Error("Path is outside the workspace");
   return candidate;
 }
 async function resolveGrepPath(root, path = ".") {
@@ -18723,7 +18876,7 @@ var SearchSpawnError = class extends Error {
   }
   fallbackSafe;
 };
-function delimitedParser(delimiter, onRecord) {
+function delimitedParser(delimiter2, onRecord) {
   let pending2 = Buffer.alloc(0);
   let stopped = false;
   return {
@@ -18732,7 +18885,7 @@ function delimitedParser(delimiter, onRecord) {
       pending2 = pending2.length === 0 ? chunk : Buffer.concat([pending2, chunk]);
       let offset = 0;
       while (true) {
-        const end = pending2.indexOf(delimiter, offset);
+        const end = pending2.indexOf(delimiter2, offset);
         if (end < 0) break;
         if (!onRecord(pending2.subarray(offset, end))) {
           stopped = true;
@@ -19184,9 +19337,9 @@ function charset(contentType) {
 
 // src/tools/lsp.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { access as access2, constants as constants9, readFile as readFile21 } from "fs/promises";
-import { basename as basename6, dirname as dirname20, extname as extname2, isAbsolute as isAbsolute13, relative as relative18, resolve as resolve25, sep as sep18 } from "path";
+import { basename as basename6, dirname as dirname20, extname as extname3, isAbsolute as isAbsolute14, relative as relative18, resolve as resolve26, sep as sep18 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL3 } from "url";
 import { z as z32 } from "zod";
 var LSP_REQUEST_TIMEOUT_MS = 15e3;
@@ -19200,10 +19353,12 @@ var LspConnection = class {
   #disposed = false;
   #initError;
   constructor(command, args, cwd) {
-    this.#process = spawn5(command, args, {
+    const invocation = prepareSpawnInvocation(command, args, { cwd });
+    this.#process = spawn5(invocation.command, invocation.args, {
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
-      windowsHide: true
+      windowsHide: true,
+      ...invocation.windowsVerbatimArguments === void 0 ? {} : { windowsVerbatimArguments: invocation.windowsVerbatimArguments }
     });
     this.#process.on("error", (err) => {
       this.#initError = new Error(`LSP server "${command}" failed to start: ${err.message}`);
@@ -19285,8 +19440,8 @@ var LspConnection = class {
     const id = this.#nextId++;
     const request = { jsonrpc: "2.0", id, method, params };
     const timeout = AbortSignal.timeout(LSP_REQUEST_TIMEOUT_MS);
-    const promise = new Promise((resolve41, reject) => {
-      this.#pending.set(id, { resolve: resolve41, reject });
+    const promise = new Promise((resolve42, reject) => {
+      this.#pending.set(id, { resolve: resolve42, reject });
       timeout.addEventListener("abort", () => {
         if (this.#pending.has(id)) {
           this.#pending.delete(id);
@@ -19402,7 +19557,7 @@ var LspBuffer = class {
     }
   }
 };
-var TYPESCRIPT_CLI = resolve25(
+var TYPESCRIPT_CLI = resolve26(
   dirname20(fileURLToPath3(import.meta.resolve("typescript/package.json"))),
   "lib",
   "tsc.js"
@@ -19444,7 +19599,7 @@ var RealLspManager = class {
   #serverConfigs;
   #onStatus;
   constructor(options) {
-    this.#workspace = resolve25(options.workspace);
+    this.#workspace = resolve26(options.workspace);
     this.#serverConfigs = options.serverConfigs ?? KNOWN_SERVERS;
     this.#onStatus = options.onStatus;
   }
@@ -19493,7 +19648,7 @@ var RealLspManager = class {
     if (pending2 !== void 0) return pending2;
     const config = this.#serverConfigs.find((c) => c.language === language);
     if (config === void 0) return void 0;
-    const hasRoot = config.rootFiles.some((file) => existsSync3(resolve25(this.#workspace, file)));
+    const hasRoot = config.rootFiles.some((file) => existsSync4(resolve26(this.#workspace, file)));
     if (!hasRoot) return void 0;
     const startPromise = this.#startServer(config);
     this.#pendingStarts.set(language, startPromise);
@@ -19536,10 +19691,10 @@ var LspDiagnosticsInput = z32.object({
   file: z32.string().min(1)
 });
 function createLspTools(workspace, options = {}) {
-  const root = resolve25(workspace);
+  const root = resolve26(workspace);
   const manager = options.manager ?? new RealLspManager({ workspace: root, onStatus: options.onStatus });
   const guard = (input) => {
-    const candidate = resolve25(root, input);
+    const candidate = resolve26(root, input);
     if (!isWithin7(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
@@ -19603,7 +19758,7 @@ function createLspTools(workspace, options = {}) {
   return [findRefs, hover, diagnostics];
 }
 function languageIdForPath(filePath) {
-  switch (extname2(filePath).toLowerCase()) {
+  switch (extname3(filePath).toLowerCase()) {
     case ".tsx":
       return "typescriptreact";
     case ".mts":
@@ -19616,7 +19771,7 @@ function languageIdForPath(filePath) {
 }
 function isWithin7(root, candidate) {
   const delta = relative18(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep18}`) && delta !== ".." && !isAbsolute13(delta);
+  return delta === "" || !delta.startsWith(`..${sep18}`) && delta !== ".." && !isAbsolute14(delta);
 }
 function uriToPath(uri) {
   try {
@@ -20004,12 +20159,12 @@ ${explanation}` : "";
 // src/desktop/astgraph-service.ts
 import { stat as stat10 } from "fs/promises";
 import { createRequire as nodeCreateRequire } from "module";
-import { join as join28, resolve as resolve26 } from "path";
+import { join as join28, resolve as resolve27 } from "path";
 var FIELDS = "id, kind, name, qualified_name, file_path, language, start_line, end_line, signature";
 var DesktopAstGraphService = class {
   #path;
   constructor(workspace) {
-    this.#path = join28(resolve26(workspace), ".flavor", "astgraph", "index.db");
+    this.#path = join28(resolve27(workspace), ".flavor", "astgraph", "index.db");
   }
   async status() {
     if ((await stat10(this.#path).catch(() => void 0))?.isFile() !== true) {
@@ -20171,7 +20326,7 @@ var QuestionBridge = class {
     }
   }
   #askLocally(questions, signal) {
-    return new Promise((resolve41, reject) => {
+    return new Promise((resolve42, reject) => {
       const onAbort = () => {
         this.#pending = void 0;
         this.#active = false;
@@ -20185,7 +20340,7 @@ var QuestionBridge = class {
           this.#pending = void 0;
           this.#active = false;
           this.#onChange?.();
-          resolve41(answers);
+          resolve42(answers);
         },
         reject: (error) => {
           signal.removeEventListener("abort", onAbort);
@@ -20278,7 +20433,7 @@ function createTodoWriteTool() {
 // src/tools/managed.ts
 import { randomUUID as randomUUID18 } from "crypto";
 import { link, lstat as lstat11, mkdir as mkdir20, readFile as readFile22, readdir as readdir9, unlink as unlink3, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname21, join as join29, resolve as resolve27 } from "path";
+import { dirname as dirname21, join as join29, resolve as resolve28 } from "path";
 import { z as z37 } from "zod";
 var MANAGED_TOOL_VERSION = 1;
 var MAX_RECORD_BYTES = 256 * 1024;
@@ -20320,9 +20475,9 @@ var ManagedToolStore = class {
   #entries = /* @__PURE__ */ new Map();
   #diagnostics = [];
   constructor(options) {
-    this.#workspace = resolve27(options.workspace);
+    this.#workspace = resolve28(options.workspace);
     this.#projectRoot = join29(this.#workspace, ".flavor", "tools");
-    this.#globalRoot = join29(resolve27(options.home), ".flavor-code", "tools");
+    this.#globalRoot = join29(resolve28(options.home), ".flavor-code", "tools");
     this.#now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   }
   get diagnostics() {
@@ -21874,9 +22029,9 @@ Address this now (for example run the required verification or fix), then finish
   }
   #waitForPlanningIdle(key) {
     if (!this.#activePlanning.has(key)) return Promise.resolve();
-    return new Promise((resolve41) => {
+    return new Promise((resolve42) => {
       const check2 = () => {
-        if (!this.#activePlanning.has(key)) resolve41();
+        if (!this.#activePlanning.has(key)) resolve42();
         else this.#planningIdleWaiters.add(check2);
       };
       this.#planningIdleWaiters.add(check2);
@@ -22025,6 +22180,101 @@ var LANG_LABELS = /* @__PURE__ */ new Map([
   ["id-ID", "Indonesian (id-ID)"]
 ]);
 
+// src/utils/crash-guard.ts
+import { mkdirSync as mkdirSync3, writeFileSync } from "fs";
+import { join as join30 } from "path";
+var installed = false;
+var crashing = false;
+var crashCleanups = /* @__PURE__ */ new Set();
+function registerCrashCleanup(cleanup) {
+  crashCleanups.add(cleanup);
+  return () => {
+    crashCleanups.delete(cleanup);
+  };
+}
+async function runCrashCleanups(timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new Error("Crash cleanup timeout must be non-negative");
+  const cleanup = Promise.allSettled([...crashCleanups].map(async (callback) => callback()));
+  if (timeoutMs === 0) return;
+  let timer;
+  try {
+    await Promise.race([
+      cleanup,
+      new Promise((resolvePromise) => {
+        timer = setTimeout(resolvePromise, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function installCrashGuard(options = {}) {
+  if (installed) return;
+  installed = true;
+  const crashLogDir = () => {
+    try {
+      return join30((options.workspace ?? process.cwd)(), ".flavor");
+    } catch {
+      return process.cwd();
+    }
+  };
+  const writeCrashLog = (kind, detail) => {
+    try {
+      const dir = crashLogDir();
+      mkdirSync3(dir, { recursive: true });
+      const path = join30(dir, `crash-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "")}-${process.pid}.log`);
+      writeFileSync(path, [
+        `kind: ${kind}`,
+        `version: ${process.version}`,
+        `platform: ${process.platform}`,
+        `time: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+        "",
+        detail
+      ].join("\n"), { encoding: "utf8", mode: 384 });
+      return path;
+    } catch {
+      return void 0;
+    }
+  };
+  const restoreTerminal = () => {
+    try {
+      if (process.stdout.isTTY === true) process.stdout.write("\x1B[?25h\x1B[?1049l");
+    } catch {
+    }
+  };
+  const describe = (reason) => {
+    if (reason instanceof Error) return `${reason.name}: ${reason.message}
+${reason.stack ?? ""}`;
+    return String(reason);
+  };
+  const crash = (kind, reason) => {
+    if (crashing) {
+      process.exit(1);
+      return;
+    }
+    crashing = true;
+    const detail = describe(reason);
+    const logPath = writeCrashLog(kind, detail);
+    restoreTerminal();
+    try {
+      const safe = redactErrorText(detail.split("\n").slice(0, 3).join("\n"));
+      process.stderr.write(`flavor crashed (${kind}): ${safe}
+`);
+      if (logPath !== void 0) process.stderr.write(`crash log: ${logPath}
+`);
+    } catch {
+    }
+    const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 1e3;
+    const watchdog = setTimeout(() => process.exit(1), cleanupTimeoutMs + 50);
+    void runCrashCleanups(cleanupTimeoutMs).finally(() => {
+      clearTimeout(watchdog);
+      process.exit(1);
+    });
+  };
+  process.on("unhandledRejection", (reason) => crash("unhandledRejection", reason));
+  process.on("uncaughtException", (error) => crash("uncaughtException", error));
+}
+
 // src/hallucination/confidence.ts
 import { z as z39 } from "zod";
 
@@ -22744,7 +22994,7 @@ ${total}`;
 // src/memory/store.ts
 import { createHash as createHash17 } from "crypto";
 import { readFile as readFile23, rm as rm12 } from "fs/promises";
-import { resolve as resolve28, join as join30, relative as relative19, sep as sep19 } from "path";
+import { resolve as resolve29, join as join31, relative as relative19, sep as sep19 } from "path";
 
 // src/memory/similarity.ts
 function normalizeForSimilarity(value) {
@@ -22846,10 +23096,10 @@ var MemoryStore = class {
   constructor(options) {
     if (!Number.isSafeInteger(options.maxEntries) || options.maxEntries < 1) throw new Error("maxEntries must be an integer of at least 1");
     if (!Number.isSafeInteger(options.maxEntryChars) || options.maxEntryChars < 1) throw new Error("maxEntryChars must be an integer of at least 1");
-    this.workspace = resolve28(options.workspace);
-    this.#memoryRoot = join30(this.workspace, ".flavor", "memory");
-    this.path = join30(this.#memoryRoot, "MEMORY.md");
-    this.#behaviorPath = join30(this.#memoryRoot, "behavior.json");
+    this.workspace = resolve29(options.workspace);
+    this.#memoryRoot = join31(this.workspace, ".flavor", "memory");
+    this.path = join31(this.#memoryRoot, "MEMORY.md");
+    this.#behaviorPath = join31(this.#memoryRoot, "behavior.json");
     this.#maxEntries = options.maxEntries;
     this.#maxEntryChars = options.maxEntryChars;
   }
@@ -23072,7 +23322,7 @@ var MemoryStore = class {
   }
   #resolveContentPath(contentPath) {
     if (!/^tasks\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.md$/.test(contentPath)) throw new Error("Invalid memory content path");
-    const path = resolve28(this.#memoryRoot, ...contentPath.split("/"));
+    const path = resolve29(this.#memoryRoot, ...contentPath.split("/"));
     const rel = relative19(this.#memoryRoot, path);
     if (rel === ".." || rel.startsWith(`..${sep19}`)) throw new Error("Memory content path escapes the memory directory");
     return path;
@@ -23532,12 +23782,12 @@ var MemoryReviewBridge = class {
 
 // src/execution/docker.ts
 import { spawn as spawn6 } from "child_process";
-import { relative as relative20, resolve as resolve29, sep as sep20, win32 } from "path";
+import { relative as relative20, resolve as resolve30, sep as sep20, win32 } from "path";
 function buildDockerInvocation(options) {
   const workspace = options.workspace;
   const cwd = options.request.cwd;
   const windows = /^[A-Za-z]:[\\/]/.test(workspace);
-  const delta = windows ? win32.relative(workspace, cwd) : relative20(resolve29(workspace), resolve29(cwd));
+  const delta = windows ? win32.relative(workspace, cwd) : relative20(resolve30(workspace), resolve30(cwd));
   if (delta === ".." || delta.startsWith(`..${windows ? "\\" : sep20}`)) throw new Error("Docker cwd escapes workspace");
   const containerCwd = delta.length === 0 ? "/workspace" : `/workspace/${delta.replaceAll("\\", "/")}`;
   const args = [
@@ -23638,7 +23888,7 @@ function createExecutionEnvironment(workspace, config) {
 
 // src/ide/client.ts
 import { readFile as readFile24, readdir as readdir10, stat as stat11 } from "fs/promises";
-import { basename as basename7, join as join31, relative as relative21, resolve as resolve30, sep as sep21 } from "path";
+import { basename as basename7, join as join32, relative as relative21, resolve as resolve31, sep as sep21 } from "path";
 var FlavorIdeClient = class {
   #workspace;
   #home;
@@ -23649,8 +23899,8 @@ var FlavorIdeClient = class {
   #sessionId;
   #eventTail = Promise.resolve();
   constructor(options) {
-    this.#workspace = resolve30(options.workspace);
-    this.#home = resolve30(options.home);
+    this.#workspace = resolve31(options.workspace);
+    this.#home = resolve31(options.home);
     this.#environment = options.environment ?? process.env;
     this.#fetch = options.fetch ?? fetch;
   }
@@ -23734,7 +23984,7 @@ var FlavorIdeClient = class {
       };
       if (await this.#healthy(configured)) return configured;
     }
-    const directory = join31(this.#home, ".flavor-code", "ide");
+    const directory = join32(this.#home, ".flavor-code", "ide");
     let entries;
     try {
       entries = (await readdir10(directory)).filter((name) => name.endsWith(".lock"));
@@ -23742,7 +23992,7 @@ var FlavorIdeClient = class {
       return void 0;
     }
     const candidates = (await Promise.all(entries.map(async (name) => {
-      const path = join31(directory, name);
+      const path = join32(directory, name);
       try {
         const [contents, info] = await Promise.all([readFile24(path, "utf8"), stat11(path)]);
         const lock = parseLockfile(contents);
@@ -23848,8 +24098,8 @@ function parsePort(value) {
   return Number.isInteger(port2) && port2 > 0 && port2 <= 65535 ? port2 : void 0;
 }
 function isWithin8(parent, child) {
-  const base = normalize(resolve30(parent));
-  const target = normalize(resolve30(child));
+  const base = normalize(resolve31(parent));
+  const target = normalize(resolve31(child));
   return target === base || target.startsWith(`${base}${sep21}`);
 }
 function normalize(path) {
@@ -23879,8 +24129,8 @@ var JobRegistry = class {
     const id = `job-${randomUUID19().slice(0, 12)}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let settle;
-    const done = new Promise((resolve41) => {
-      settle = resolve41;
+    const done = new Promise((resolve42) => {
+      settle = resolve42;
     });
     const record3 = {
       id,
@@ -24004,7 +24254,7 @@ function snapshot2(job) {
 // src/terminal/service.ts
 import { randomUUID as randomUUID20 } from "crypto";
 import { createRequire as nodeCreateRequire2 } from "module";
-import { isAbsolute as isAbsolute14, relative as relative22, resolve as resolve31, sep as sep22 } from "path";
+import { isAbsolute as isAbsolute15, relative as relative22, resolve as resolve32, sep as sep22 } from "path";
 var TerminalService = class {
   #root;
   #factory;
@@ -24012,7 +24262,7 @@ var TerminalService = class {
   #maxOutputChars;
   #sessions = /* @__PURE__ */ new Map();
   constructor(workspace, options = {}) {
-    this.#root = resolve31(workspace);
+    this.#root = resolve32(workspace);
     this.#factory = options.factory ?? defaultFactory;
     this.#jobs = options.jobs;
     this.#maxOutputChars = options.maxOutputChars ?? 2e5;
@@ -24130,15 +24380,15 @@ function cleanEnvironment(environment) {
   return Object.fromEntries(Object.entries(environment).filter((entry2) => entry2[1] !== void 0));
 }
 function workspacePath(root, input) {
-  const path = resolve31(root, input);
+  const path = resolve32(root, input);
   const delta = relative22(root, path);
-  if (delta === ".." || delta.startsWith(`..${sep22}`) || isAbsolute14(delta)) throw new Error("Terminal cwd is outside the workspace");
+  if (delta === ".." || delta.startsWith(`..${sep22}`) || isAbsolute15(delta)) throw new Error("Terminal cwd is outside the workspace");
   return path;
 }
 
 // src/tools/terminal.ts
 import { z as z40 } from "zod";
-import { resolve as resolve32 } from "path";
+import { resolve as resolve33 } from "path";
 var Id = z40.string().regex(/^term-[a-f0-9-]+$/);
 var OpenInput = z40.object({ cwd: z40.string().optional(), shell: z40.string().optional(), args: z40.array(z40.string()).optional(), columns: z40.coerce.number().int().min(10).max(500).optional(), rows: z40.coerce.number().int().min(2).max(300).optional() });
 var OptionalBoolean = z40.union([z40.boolean(), z40.string().refine((value) => value === "true" || value === "false")]);
@@ -24152,8 +24402,8 @@ function createTerminalTools(terminals, workspace = process.cwd()) {
       name: "TerminalOpen",
       description: "Open a persistent interactive pseudo-terminal in the workspace",
       inputSchema: OpenInput,
-      paths: (input) => [resolve32(workspace, input.cwd ?? ".")],
-      permissions: (input) => ({ paths: [resolve32(workspace, input.cwd ?? ".")], command: input.shell ?? "system-shell", args: input.args ?? [], cwd: resolve32(workspace, input.cwd ?? ".") }),
+      paths: (input) => [resolve33(workspace, input.cwd ?? ".")],
+      permissions: (input) => ({ paths: [resolve33(workspace, input.cwd ?? ".")], command: input.shell ?? "system-shell", args: input.args ?? [], cwd: resolve33(workspace, input.cwd ?? ".") }),
       execute: async (input, _signal, context) => terminals.open({
         owner: owner(context),
         ...input.cwd === void 0 ? {} : { cwd: input.cwd },
@@ -24249,7 +24499,7 @@ function palSocketAddress(options) {
 import { createHash as createHash20 } from "crypto";
 import { Socket as Socket2 } from "net";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 import { spawn as spawn7 } from "child_process";
 
 // src/pals/broker.ts
@@ -24262,16 +24512,16 @@ import { dirname as dirname23 } from "path";
 import { randomBytes as randomBytes3, randomUUID as randomUUID21 } from "crypto";
 import { chmod as chmod2, link as link2, mkdir as mkdir21, open as open12, readFile as readFile25, unlink as unlink4 } from "fs/promises";
 import { homedir } from "os";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var PAL_AUTH_TOKEN_BYTES = 32;
 var TOKEN_PATTERN = /^[a-f0-9]{64}$/;
 async function loadOrCreatePalAuthToken(options = {}) {
-  const directory = join32(options.home ?? homedir(), ".flavor-code", "pals");
-  const tokenPath = join32(directory, "auth-token");
+  const directory = join33(options.home ?? homedir(), ".flavor-code", "pals");
+  const tokenPath = join33(directory, "auth-token");
   await mkdir21(directory, { recursive: true, mode: 448 });
   await chmod2(directory, 448);
   const token = (options.random ?? randomBytes3)(PAL_AUTH_TOKEN_BYTES).toString("hex");
-  const temporaryPath = join32(directory, `.auth-token-${process.pid}-${randomUUID21()}.tmp`);
+  const temporaryPath = join33(directory, `.auth-token-${process.pid}-${randomUUID21()}.tmp`);
   let handle;
   try {
     handle = await open12(temporaryPath, "wx", 384);
@@ -24384,15 +24634,15 @@ async function acquirePalFileLock(options) {
 // src/pals/broker-cli.ts
 var startupAttempts = /* @__PURE__ */ new Map();
 function delay3(milliseconds) {
-  return new Promise((resolve41) => setTimeout(resolve41, milliseconds));
+  return new Promise((resolve42) => setTimeout(resolve42, milliseconds));
 }
 function canConnect(address) {
-  return new Promise((resolve41) => {
+  return new Promise((resolve42) => {
     const socket = new Socket2();
     const finish = (connected) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve41(connected);
+      resolve42(connected);
     };
     socket.once("connect", () => finish(true));
     socket.once("error", () => finish(false));
@@ -24401,7 +24651,7 @@ function canConnect(address) {
 }
 function startupLockPath(address) {
   const digest = createHash20("sha256").update(address, "utf8").digest("hex").slice(0, 24);
-  return join33(tmpdir3(), `flavor-code-pals-${digest}.startup.lock`);
+  return join34(tmpdir3(), `flavor-code-pals-${digest}.startup.lock`);
 }
 async function spawnProductionBroker(address) {
   const entry2 = process.argv[1];
@@ -24583,8 +24833,8 @@ var PalClient = class {
       let disconnectTimer;
       await Promise.race([
         this.request({ version: 1, type: "disconnect", requestId: randomUUID24() }).catch(() => void 0),
-        new Promise((resolve41) => {
-          disconnectTimer = setTimeout(resolve41, Math.min(this.requestTimeoutMs, 250));
+        new Promise((resolve42) => {
+          disconnectTimer = setTimeout(resolve42, Math.min(this.requestTimeoutMs, 250));
         })
       ]);
       if (disconnectTimer !== void 0) clearTimeout(disconnectTimer);
@@ -24630,7 +24880,7 @@ var PalClient = class {
     return presence;
   }
   openSocket() {
-    return new Promise((resolve41, reject) => {
+    return new Promise((resolve42, reject) => {
       let settled = false;
       const rejectConnection = (error) => {
         if (settled) return;
@@ -24653,7 +24903,7 @@ var PalClient = class {
         settled = true;
         if (this.connectingReject === rejectConnection) this.connectingReject = void 0;
         socket.off("error", onInitialError);
-        resolve41();
+        resolve42();
       };
       const onInitialError = (error) => {
         socket.off("connect", onConnect);
@@ -24684,12 +24934,12 @@ var PalClient = class {
     if (this.closed || socket === void 0 || socket.destroyed || !socket.writable) {
       return Promise.reject(new Error(this.closed ? "Pal client is closed" : "Pal client is not connected"));
     }
-    return new Promise((resolve41, reject) => {
+    return new Promise((resolve42, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(request.requestId);
         reject(new Error(`Pal request '${request.type}' timed out`));
       }, this.requestTimeoutMs);
-      this.pending.set(request.requestId, { resolve: resolve41, reject, timer });
+      this.pending.set(request.requestId, { resolve: resolve42, reject, timer });
       let frame;
       try {
         frame = encodeControlFrame(BrokerRequestSchema.parse(request));
@@ -25093,8 +25343,8 @@ var ApprovalBridge = class {
   }
 };
 async function createProductionRuntime(options) {
-  const workspace = resolve33(options.workspace ?? process.cwd());
-  const home = resolve33(options.home ?? homedir2());
+  const workspace = resolve34(options.workspace ?? process.cwd());
+  const home = resolve34(options.home ?? homedir2());
   const environment = options.environment ?? process.env;
   const ide = new FlavorIdeClient({ workspace, home, environment });
   const ideReady = ide.initialize();
@@ -25337,8 +25587,8 @@ async function createProductionRuntime(options) {
   const registeredProviders = registration.registered;
   let effectiveLlm = registration.effectiveLlm;
   const pluginHost = new PluginHost({
-    globalPluginDirs: [join34(home, ".flavor-code", "plugins")],
-    projectPluginDirs: [join34(workspace, ".flavor", "plugins")],
+    globalPluginDirs: [join35(home, ".flavor-code", "plugins")],
+    projectPluginDirs: [join35(workspace, ".flavor", "plugins")],
     config,
     // Existing project plugins (including astgraph and superharness) use Node.js
     // built-ins. The Worker/vm sandbox deliberately blocks those imports, so it
@@ -25413,6 +25663,7 @@ async function createProductionRuntime(options) {
   let collaborationEventPump;
   let collaborationEventsOpen = true;
   let islandControlServer;
+  let sessionLease;
   const pumpCollaborationEvents = () => {
     if (collaborationEventPump !== void 0 || collaborationSession === void 0 || deliverCollaborationEvent === void 0) return;
     collaborationEventPump = (async () => {
@@ -25446,7 +25697,7 @@ async function createProductionRuntime(options) {
       const address = palSocketAddress({
         platform: process.platform,
         userScope: home,
-        runtimeDir: join34(tmpdir4(), `flavor-code-pals-${createHash21("sha256").update(home).digest("hex").slice(0, 16)}`)
+        runtimeDir: join35(tmpdir4(), `flavor-code-pals-${createHash21("sha256").update(home).digest("hex").slice(0, 16)}`)
       });
       const baseCollaborationClient = collaboration.client ?? collaboration.createClient?.({
         instanceId: collaboration.instanceId,
@@ -25557,8 +25808,8 @@ async function createProductionRuntime(options) {
       diagnostics.push(`MCP servers could not start: ${message(error)}`);
     });
     const skills = new SkillRegistry({
-      globalRoots: [join34(home, ".flavor-code", "skills")],
-      projectRoots: [join34(workspace, ".flavor", "skills"), ...pluginSkillRoots],
+      globalRoots: [join35(home, ".flavor-code", "skills")],
+      projectRoots: [join35(workspace, ".flavor", "skills"), ...pluginSkillRoots],
       authorizeResource: async () => true,
       disabledNames: config.skills.disabled
     });
@@ -25566,7 +25817,7 @@ async function createProductionRuntime(options) {
     skillsReady.catch(() => void 0);
     tools.push(createSkillTool(skills), createSkillResourceTool(skills));
     if (options.extraTools !== void 0) tools.push(...options.extraTools);
-    const flavor = await optionalText2(join34(workspace, "FLAVOR.md"));
+    const flavor = await optionalText2(join35(workspace, "FLAVOR.md"));
     const instructionBaseline = await workspaceInstructions.baseline();
     let memoryContext;
     if (memoryStore !== void 0) {
@@ -25591,6 +25842,7 @@ async function createProductionRuntime(options) {
     const subagentStartedAt = {};
     const subagentElapsedMs = {};
     let sessionId = recovered?.sessionId ?? `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID25().slice(0, 8)}`;
+    sessionLease = await sessionStore.acquireLease(sessionId);
     hookSessionId = sessionId;
     let harnessJournal = new HarnessJournal({ workspace, sessionId });
     const harnessRecovery = harnessJournal.recover();
@@ -25908,7 +26160,7 @@ async function createProductionRuntime(options) {
       maxEntryChars: config.memory.maxEntryChars,
       scoreThreshold: config.memory.scoreThreshold,
       autoStoreThreshold: config.memory.autoStoreThreshold,
-      maxCandidates: Math.min(config.memory.maxCandidatesPerTask, 1),
+      maxCandidates: config.memory.maxCandidatesPerTask,
       ...config.language === void 0 ? {} : { language: config.language },
       generate: (prompt, signal) => generateMemoryExtraction(registry, childModel, prompt, signal)
     }) : void 0;
@@ -26147,7 +26399,7 @@ async function createProductionRuntime(options) {
         evolveService.toolDefinition(),
         ...mcpTools
       ];
-      const loopFlavor = await optionalText2(join34(input.workspace, "FLAVOR.md"));
+      const loopFlavor = await optionalText2(join35(input.workspace, "FLAVOR.md"));
       const loopInstructionBaseline = await loopInstructions.baseline();
       const loopEnvironment = createPromptEnvironment({
         now: /* @__PURE__ */ new Date(),
@@ -26506,8 +26758,8 @@ async function createProductionRuntime(options) {
       explain: (query, focus, signal, onText) => runExplain({
         graph: new DesktopAstGraphService(workspace),
         readFile: async (path) => {
-          const root = resolve33(workspace);
-          const abs = resolve33(root, path);
+          const root = resolve34(workspace);
+          const abs = resolve34(root, path);
           if (abs !== root && !abs.startsWith(root + sep23)) throw new Error(`path outside workspace: ${path}`);
           return readFile27(abs, "utf8");
         },
@@ -26588,7 +26840,12 @@ ${summary2}`;
         for (const key of Object.keys(subagentStartedAt)) delete subagentStartedAt[key];
         for (const key of Object.keys(subagentElapsedMs)) delete subagentElapsedMs[key];
         const previousIdeSessionId = ideSessionId;
-        sessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID25().slice(0, 8)}`;
+        const nextSessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID25().slice(0, 8)}`;
+        const nextLease = await sessionStore.acquireLease(nextSessionId);
+        const previousLease = sessionLease;
+        sessionLease = nextLease;
+        sessionId = nextSessionId;
+        await previousLease?.release();
         hookSessionId = sessionId;
         harnessJournal = new HarnessJournal({ workspace, sessionId });
         setUsageSession(sessionId);
@@ -26708,7 +26965,7 @@ ${renderMemoryDocument(entries)}`;
           return `Provider "${providerName}" is missing authorizationUrl, tokenUrl, or clientId.`;
         }
         try {
-          const tokenStore = createFileTokenStore(join34(home, ".flavor-code", "auth.json"));
+          const tokenStore = createFileTokenStore(join35(home, ".flavor-code", "auth.json"));
           const credentialId = oauthCredentialId(oauthConfig.tokenUrl, oauthConfig.clientId);
           await migrateLegacyOAuthToken(tokenStore, providerName, credentialId);
           const oauth = new OAuthCallbackAuthProvider({
@@ -26755,7 +27012,7 @@ ${renderMemoryDocument(entries)}`;
         }
       },
       async logout() {
-        const tokenStore = createFileTokenStore(join34(home, ".flavor-code", "auth.json"));
+        const tokenStore = createFileTokenStore(join35(home, ".flavor-code", "auth.json"));
         const tokens2 = await tokenStore.load();
         const hadCredentials = Object.keys(tokens2).length > 0 || effectiveLlm !== void 0;
         if (!hadCredentials) {
@@ -26835,24 +27092,13 @@ ${renderMemoryDocument(entries)}`;
       setPermissionProfile: (profile) => harness.setPermissionProfile(profile)
     };
     let disposed = false;
-    return {
-      session,
-      services,
-      authorization,
-      approvals,
-      memoryReviews,
-      restoredTranscript,
-      jobs: { list: () => jobs.list(), read: (id, owner2, cursor) => jobs.read(id, owner2, cursor), subscribe: (listener) => jobs.subscribe(listener) },
-      get sessionId() {
-        return sessionId;
-      },
-      get diagnostics() {
-        return diagnostics.map((item) => redactSecrets(item, secrets));
-      },
-      async dispose() {
-        if (disposed) return;
-        disposed = true;
-        const stepTimeoutMs = options.shutdownStepTimeoutMs ?? DEFAULT_SHUTDOWN_STEP_TIMEOUT_MS;
+    let unregisterCrashCleanup = () => void 0;
+    const disposeRuntime = async () => {
+      if (disposed) return;
+      disposed = true;
+      unregisterCrashCleanup();
+      const stepTimeoutMs = options.shutdownStepTimeoutMs ?? DEFAULT_SHUTDOWN_STEP_TIMEOUT_MS;
+      try {
         collaborationEventsOpen = false;
         unsubscribeCollaboration?.();
         if (collaborationEventPump !== void 0) await boundedStep(stepTimeoutMs, diagnostics, "collaboration-event-pump", collaborationEventPump);
@@ -26871,8 +27117,29 @@ ${renderMemoryDocument(entries)}`;
         memoryReviews.dispose();
         if (collaborationClient !== void 0) await boundedStep(stepTimeoutMs, diagnostics, "collaboration-close", collaborationClient.close());
         await cleanupProduction(approvals, questions, pluginHost, mcpManager, harness, { stepTimeoutMs });
+      } finally {
+        const lease = sessionLease;
+        sessionLease = void 0;
+        await lease?.release();
       }
     };
+    unregisterCrashCleanup = registerCrashCleanup(disposeRuntime);
+    return {
+      session,
+      services,
+      authorization,
+      approvals,
+      memoryReviews,
+      restoredTranscript,
+      jobs: { list: () => jobs.list(), read: (id, owner2, cursor) => jobs.read(id, owner2, cursor), subscribe: (listener) => jobs.subscribe(listener) },
+      get sessionId() {
+        return sessionId;
+      },
+      get diagnostics() {
+        return diagnostics.map((item) => redactSecrets(item, secrets));
+      },
+      dispose: disposeRuntime
+    };
   } catch (primaryError) {
     collaborationEventsOpen = false;
     mcpDiscarded = true;
@@ -26893,6 +27160,12 @@ ${renderMemoryDocument(entries)}`;
     } catch (cleanupError) {
       attachCleanupError(primaryError, cleanupError);
     }
+    try {
+      await sessionLease?.release();
+    } catch (leaseError) {
+      attachCleanupError(primaryError, leaseError);
+    }
+    sessionLease = void 0;
     throw primaryError;
   }
 }
@@ -27031,8 +27304,8 @@ async function workspaceFingerprint(workspace) {
   let remaining = 5 * 1024 * 1024;
   for (const name of untracked.stdout.split("\0").filter(Boolean).sort()) {
     if (name === ".flavor/loops" || name.startsWith(".flavor/loops/")) continue;
-    const path = resolve33(workspace, name);
-    const relativePath = relative23(resolve33(workspace), path);
+    const path = resolve34(workspace, name);
+    const relativePath = relative23(resolve34(workspace), path);
     if (relativePath === ".." || relativePath.startsWith(`..${sep23}`)) continue;
     hash.update(name);
     if (remaining <= 0) continue;
@@ -27165,8 +27438,8 @@ function requestMemoryRestart(workspace, sessionId, emitOutput) {
       previous = parseMemoryRestartMarker(readFileSync3(markerPath, "utf8"));
     } catch {
     }
-    mkdirSync3(dirname24(markerPath), { recursive: true });
-    writeFileSync(markerPath, `${JSON.stringify(nextMemoryRestartMarker(previous, sessionId, /* @__PURE__ */ new Date()))}
+    mkdirSync4(dirname24(markerPath), { recursive: true });
+    writeFileSync2(markerPath, `${JSON.stringify(nextMemoryRestartMarker(previous, sessionId, /* @__PURE__ */ new Date()))}
 `, "utf8");
   } catch {
   }
@@ -27267,7 +27540,7 @@ async function registerConfiguredAdapters(providers, registry, environment, diag
   const configured = { ...providers };
   if (configured.openai === void 0 && environment.OPENAI_API_KEY) configured.openai = { type: "openai", apiKey: environment.OPENAI_API_KEY };
   if (configured.anthropic === void 0 && environment.ANTHROPIC_API_KEY) configured.anthropic = { type: "anthropic", apiKey: environment.ANTHROPIC_API_KEY };
-  const oauthTokenStore = createFileTokenStore(join34(home, ".flavor-code", "auth.json"));
+  const oauthTokenStore = createFileTokenStore(join35(home, ".flavor-code", "auth.json"));
   const registered = [];
   let effectiveLlm;
   for (const [name, provider] of Object.entries(configured)) {
@@ -27700,11 +27973,11 @@ function createMemoryTaskId() {
 import { createHash as createHash27 } from "crypto";
 import { mkdir as mkdir27, readFile as readFile35, readdir as readdir12, rm as rm15, stat as stat15, writeFile as writeFile17 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { basename as basename9, join as join44, resolve as resolve36 } from "path";
+import { basename as basename9, join as join45, resolve as resolve37 } from "path";
 
 // src/d2c/workflow.ts
 import { createHash as createHash22 } from "crypto";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 import { z as z42 } from "zod";
 
 // src/d2c/workflow-shared.ts
@@ -27850,7 +28123,7 @@ function reviewsFor(report, previous) {
 function implementationDirectory(report) {
   const source = report.implementation.source;
   if (!/^https?:\/\//i.test(source)) return source;
-  return join35("src", "d2c-output", report.task);
+  return join36("src", "d2c-output", report.task);
 }
 function createWorkflow(report, framework) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -27974,7 +28247,7 @@ function applyQualityIssueDecision(workflow, issueId2, decision) {
   };
 }
 function workflowPath(workspace, task) {
-  return join35(taskDir(workspace, task), "workflow.json");
+  return join36(taskDir(workspace, task), "workflow.json");
 }
 async function readWorkflow(workspace, task) {
   return (await readRecoverableFile(workflowPath(workspace, task), decodeWorkflow))?.value;
@@ -28228,7 +28501,7 @@ function confirmApiMapping(mapping, operationKey, operations) {
 
 // src/d2c/modules.ts
 import { readFile as readFile28 } from "fs/promises";
-import { isAbsolute as isAbsolute15, join as join36, normalize as normalize2, posix, sep as sep24, win32 as win322 } from "path";
+import { isAbsolute as isAbsolute16, join as join37, normalize as normalize2, posix, sep as sep24, win32 as win322 } from "path";
 import { z as z43 } from "zod";
 var ModuleSchema = z43.object({
   id: z43.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
@@ -28240,20 +28513,20 @@ var ModuleSchema = z43.object({
 }).strict();
 var ManifestSchema3 = z43.object({ schema: z43.literal(1), modules: z43.array(ModuleSchema).min(1).max(500) }).passthrough();
 function safeSource(path) {
-  if (isAbsolute15(path) || posix.isAbsolute(path) || win322.isAbsolute(path) || path.includes("\0")) return false;
+  if (isAbsolute16(path) || posix.isAbsolute(path) || win322.isAbsolute(path) || path.includes("\0")) return false;
   const value = normalize2(path);
   const portableSegments = path.replaceAll("\\", "/").split("/");
   return value !== ".." && !value.startsWith(`..${sep24}`) && !portableSegments.includes("..");
 }
 function d2cOutputDirectory(workspace, task) {
   if (!D2C_TASK_PATTERN.test(task)) throw new Error(`Invalid D2C task: ${task}`);
-  return join36(workspace, "src", "d2c-output", task);
+  return join37(workspace, "src", "d2c-output", task);
 }
 async function readD2cModules(workspace, task) {
   const project = d2cOutputDirectory(workspace, task);
   let raw;
   try {
-    raw = await readFile28(join36(project, "d2c.modules.json"), "utf8");
+    raw = await readFile28(join37(project, "d2c.modules.json"), "utf8");
   } catch {
     return [{ id: "page", label: task, sourceFiles: ["src/App.vue", "src/App.jsx"], keywords: [task] }];
   }
@@ -28274,7 +28547,7 @@ async function readD2cModules(workspace, task) {
 
 // src/d2c/integration.ts
 import { mkdir as mkdir24, readFile as readFile29, writeFile as writeFile13 } from "fs/promises";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
@@ -28410,7 +28683,7 @@ async def reset_acceptance(request: Request):
 }
 async function generateIntegrationArtifacts(projectDir, document, mappings, options = {}) {
   if (mappings.some((mapping) => mapping.status === "needs-confirmation")) throw new Error("Confirm every uncertain OpenAPI mapping before generating integration code");
-  const packagePath = join37(projectDir, "package.json");
+  const packagePath = join38(projectDir, "package.json");
   let pkg;
   try {
     pkg = JSON.parse(await readFile29(packagePath, "utf8"));
@@ -28420,9 +28693,9 @@ async function generateIntegrationArtifacts(projectDir, document, mappings, opti
   const scripts = options.pythonServer ? { ...record2(pkg.scripts) ?? {} } : { ...record2(pkg.scripts) ?? {}, mock: "node mock/server.mjs" };
   const dependencies2 = options.pythonServer ? { ...record2(pkg.dependencies) ?? {}, axios: "^1.7.9" } : { ...record2(pkg.dependencies) ?? {}, axios: "^1.7.9", express: "^5.2.1" };
   const selected = [...new Set(mappings.map((mapping) => mapping.operationKey))].map((key) => document.operations.find((operation) => operation.id === key)).filter((operation) => operation !== void 0);
-  const apiDir = join37(projectDir, "src", "api");
-  const mockDir = join37(projectDir, "mock");
-  const serverDir = join37(projectDir, "server");
+  const apiDir = join38(projectDir, "src", "api");
+  const mockDir = join38(projectDir, "mock");
+  const serverDir = join38(projectDir, "server");
   await Promise.all([
     mkdir24(apiDir, { recursive: true }),
     ...options.pythonServer ? [] : [mkdir24(mockDir, { recursive: true })],
@@ -28432,23 +28705,23 @@ async function generateIntegrationArtifacts(projectDir, document, mappings, opti
   if (options.pythonServer) files.push("server/main.py", "server/requirements.txt", "server/README.md", "server/flavor-runtime.json");
   else files.push("mock/server.mjs");
   await Promise.all([
-    writeFile13(join37(apiDir, "http.js"), `import axios from "axios";
+    writeFile13(join38(apiDir, "http.js"), `import axios from "axios";
 
 export const http = axios.create({ baseURL: import.meta.env.VITE_API_BASE_URL || ${JSON.stringify(document.baseUrl ?? "")}, timeout: 15000 });
 
 http.interceptors.response.use((response) => response, (error) => Promise.reject({ name: "ApiError", status: error.response?.status, message: error.response?.data?.message || error.message, cause: error }));
 `),
-    writeFile13(join37(apiDir, "d2c-api.js"), apiModule(selected)),
-    writeFile13(join37(apiDir, "d2c-bindings.json"), `${JSON.stringify({ schema: 1, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), mappings }, null, 2)}
+    writeFile13(join38(apiDir, "d2c-api.js"), apiModule(selected)),
+    writeFile13(join38(apiDir, "d2c-bindings.json"), `${JSON.stringify({ schema: 1, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), mappings }, null, 2)}
 `),
-    ...options.pythonServer ? [] : [writeFile13(join37(mockDir, "server.mjs"), mockModule({ ...document, operations: selected }))],
+    ...options.pythonServer ? [] : [writeFile13(join38(mockDir, "server.mjs"), mockModule({ ...document, operations: selected }))],
     writeFile13(packagePath, `${JSON.stringify({ ...pkg, scripts, dependencies: dependencies2 }, null, 2)}
 `),
     ...options.pythonServer ? [
-      writeFile13(join37(serverDir, "main.py"), pythonServerModule({ ...document, operations: selected })),
-      writeFile13(join37(serverDir, "requirements.txt"), "fastapi>=0.116,<1\nuvicorn[standard]>=0.35,<1\nsqlalchemy>=2.0,<3\n"),
-      writeFile13(join37(serverDir, "README.md"), "# Python API service\n\nThis is the real integration service, not a mock. Development defaults to SQLite through `DATABASE_URL=sqlite:///./data/app.db`. Set the same environment variable to a SQLAlchemy MySQL or PostgreSQL URL for deployment; keep schema changes in migrations instead of database-specific SQL. Flavor Code starts the service automatically for acceptance.\n"),
-      writeFile13(join37(serverDir, "flavor-runtime.json"), `${JSON.stringify({
+      writeFile13(join38(serverDir, "main.py"), pythonServerModule({ ...document, operations: selected })),
+      writeFile13(join38(serverDir, "requirements.txt"), "fastapi>=0.116,<1\nuvicorn[standard]>=0.35,<1\nsqlalchemy>=2.0,<3\n"),
+      writeFile13(join38(serverDir, "README.md"), "# Python API service\n\nThis is the real integration service, not a mock. Development defaults to SQLite through `DATABASE_URL=sqlite:///./data/app.db`. Set the same environment variable to a SQLAlchemy MySQL or PostgreSQL URL for deployment; keep schema changes in migrations instead of database-specific SQL. Flavor Code starts the service automatically for acceptance.\n"),
+      writeFile13(join38(serverDir, "flavor-runtime.json"), `${JSON.stringify({
         schema: 1,
         kind: "python-fastapi",
         cwd: "server",
@@ -28469,7 +28742,7 @@ http.interceptors.response.use((response) => response, (error) => Promise.reject
 import { spawn as spawn8 } from "child_process";
 import { access as access3, readFile as readFile30 } from "fs/promises";
 import { createServer as createServer5 } from "net";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 async function exists3(path) {
   try {
     await access3(path);
@@ -28577,7 +28850,7 @@ ${output.trim()}` : ""}`);
   }
 }
 async function runPythonBackend(projectDir, options) {
-  const serverDir = join38(projectDir, "server");
+  const serverDir = join39(projectDir, "server");
   if (options.installDependencies !== false) await installPython(serverDir, options.signal);
   const selectedPort = await port();
   const url = `http://127.0.0.1:${selectedPort}`;
@@ -28623,7 +28896,7 @@ ${managed.output().slice(-4e3)}`);
   };
 }
 async function runD2cMockServer(projectDir, options = {}) {
-  const runtimePath = join38(projectDir, "server", "flavor-runtime.json");
+  const runtimePath = join39(projectDir, "server", "flavor-runtime.json");
   if (await exists3(runtimePath)) {
     let runtime;
     try {
@@ -28634,9 +28907,9 @@ async function runD2cMockServer(projectDir, options = {}) {
     if (runtime.schema !== 1 || runtime.kind !== "python-fastapi") throw new Error("Unsupported E2E backend runtime manifest");
     return runPythonBackend(projectDir, options);
   }
-  const serverPath = join38(projectDir, "mock", "server.mjs");
+  const serverPath = join39(projectDir, "mock", "server.mjs");
   if (!await exists3(serverPath)) throw new Error(`D2C mock server is not generated at ${serverPath}`);
-  if (options.installDependencies === false && !await exists3(join38(projectDir, "node_modules", "express", "package.json"))) {
+  if (options.installDependencies === false && !await exists3(join39(projectDir, "node_modules", "express", "package.json"))) {
     throw new Error("D2C mock server dependencies are not installed");
   }
   if (options.installDependencies !== false) await install(projectDir, options.signal);
@@ -28679,7 +28952,7 @@ ${managed.output().slice(-4e3)}`);
 // src/d2c/product.ts
 import { createHash as createHash24, randomUUID as randomUUID27 } from "crypto";
 import { copyFile as copyFile2, mkdir as mkdir25, readFile as readFile32, rename as rename13, stat as stat13, unlink as unlink7, writeFile as writeFile15 } from "fs/promises";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 import { z as z44 } from "zod";
 
 // src/e2e/prd-governance.ts
@@ -28834,13 +29107,13 @@ var PlanSchema2 = z44.object({
 }).strict();
 function d2cProductDirectory(workspace, task) {
   if (!D2C_TASK_PATTERN.test(task)) throw new Error("Invalid D2C task name");
-  return join39(taskDir(workspace, task), "product");
+  return join40(taskDir(workspace, task), "product");
 }
 function d2cProductPrototypeDirectory(workspace, task) {
-  return join39(d2cProductDirectory(workspace, task), "prototype");
+  return join40(d2cProductDirectory(workspace, task), "prototype");
 }
 function planPath(workspace, task) {
-  return join39(taskDir(workspace, task), "product-plan.json");
+  return join40(taskDir(workspace, task), "product-plan.json");
 }
 function resolveD2cProductTechnology(requirement, fallbackFramework = "vue") {
   const frontendCandidates = [
@@ -29023,16 +29296,16 @@ async function readD2cProductPlan(workspace, task) {
 }
 async function discoverD2cProductArtifacts(workspace, plan) {
   const product = d2cProductDirectory(workspace, plan.task);
-  const prdUpdatedAt = await fileTimestamp(join39(product, "prd.md"));
-  const prdHash = await fileHash(join39(product, "prd.md"));
-  const prototypeUpdatedAt = await fileTimestamp(join39(product, "prototype", "index.html"));
-  const prototypeHash = await fileHash(join39(product, "prototype", "index.html"));
-  const expectedManifest = join39(product, "prototype", "interaction-manifest.json");
+  const prdUpdatedAt = await fileTimestamp(join40(product, "prd.md"));
+  const prdHash = await fileHash(join40(product, "prd.md"));
+  const prototypeUpdatedAt = await fileTimestamp(join40(product, "prototype", "index.html"));
+  const prototypeHash = await fileHash(join40(product, "prototype", "index.html"));
+  const expectedManifest = join40(product, "prototype", "interaction-manifest.json");
   let manifestUpdatedAt = await fileTimestamp(expectedManifest);
   if (manifestUpdatedAt === void 0) {
-    const misplacedManifest = join39(product, "interaction-manifest.json");
+    const misplacedManifest = join40(product, "interaction-manifest.json");
     if (await fileTimestamp(misplacedManifest) !== void 0) {
-      await mkdir25(join39(product, "prototype"), { recursive: true });
+      await mkdir25(join40(product, "prototype"), { recursive: true });
       await copyFile2(misplacedManifest, expectedManifest);
       manifestUpdatedAt = await fileTimestamp(expectedManifest);
     }
@@ -29065,8 +29338,8 @@ async function readD2cProductPlanView(workspace, task) {
   if (stored === void 0) return void 0;
   const plan = await discoverD2cProductArtifacts(workspace, stored);
   if (plan.revision !== stored.revision) await writeD2cProductPlan(workspace, plan);
-  const prdMarkdown = plan.prd === void 0 ? void 0 : await readFile32(join39(taskDir(workspace, task), plan.prd.path), "utf8");
-  const manifestPath = join39(d2cProductDirectory(workspace, task), "prototype", "interaction-manifest.json");
+  const prdMarkdown = plan.prd === void 0 ? void 0 : await readFile32(join40(taskDir(workspace, task), plan.prd.path), "utf8");
+  const manifestPath = join40(d2cProductDirectory(workspace, task), "prototype", "interaction-manifest.json");
   const validationError = plan.phase === "design-generating" && await fileTimestamp(manifestPath) !== void 0 ? await validateAndNormalizePrototypeManifest(manifestPath) : void 0;
   return {
     plan,
@@ -29225,7 +29498,7 @@ function createAcceptanceEvidence(coverage, run, now = /* @__PURE__ */ new Date(
 
 // src/e2e/delivery-run.ts
 import { createHash as createHash26 } from "crypto";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 import { z as z45 } from "zod";
 var DELIVERY_NODE_IDS = ["requirement", "prd", "design", "d2c", "api", "acceptance", "delivery"];
 var ArtifactSchema = z45.object({
@@ -29342,7 +29615,7 @@ function completeDeliveryNode(run, node, outputs, now = /* @__PURE__ */ new Date
   return { ...run, nodes, updatedAt: timestamp2 };
 }
 function deliveryRunPath(workspace, task) {
-  return join40(taskDir(workspace, task), "delivery-run.json");
+  return join41(taskDir(workspace, task), "delivery-run.json");
 }
 function decodeDeliveryRun(raw) {
   return DeliveryRunSchema.parse(JSON.parse(raw));
@@ -29385,14 +29658,14 @@ async function updateDeliveryRun(workspace, task, expectedRevision, mutation) {
 // src/skills/manager.ts
 import { lstat as lstat13, mkdir as mkdir26, readFile as readFile34, readdir as readdir11, realpath as realpath13, rm as rm14, writeFile as writeFile16 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute16, join as join41, relative as relative24, resolve as resolve34, sep as sep25 } from "path";
+import { isAbsolute as isAbsolute17, join as join42, relative as relative24, resolve as resolve35, sep as sep25 } from "path";
 import { stringify } from "yaml";
 var SkillManager = class {
   #workspace;
   #home;
   constructor(options) {
-    this.#workspace = resolve34(options.workspace);
-    this.#home = resolve34(options.home ?? homedir3());
+    this.#workspace = resolve35(options.workspace);
+    this.#home = resolve35(options.home ?? homedir3());
   }
   async list() {
     const { registry, disabled } = await this.#registry();
@@ -29408,7 +29681,7 @@ var SkillManager = class {
   async create(draft) {
     const value = parseDraft(draft);
     const projectRoot = this.#projectRoot();
-    const directory = join41(projectRoot, value.name);
+    const directory = join42(projectRoot, value.name);
     await mkdir26(projectRoot, { recursive: true, mode: 448 });
     try {
       await mkdir26(directory, { mode: 448 });
@@ -29417,7 +29690,7 @@ var SkillManager = class {
       throw error;
     }
     try {
-      await writeFile16(join41(directory, "SKILL.md"), renderSkill(value), { encoding: "utf8", flag: "wx", mode: 384 });
+      await writeFile16(join42(directory, "SKILL.md"), renderSkill(value), { encoding: "utf8", flag: "wx", mode: 384 });
       await this.#persistEnabled(value.name, true);
       return this.get(value.name);
     } catch (error) {
@@ -29435,7 +29708,7 @@ var SkillManager = class {
       throw error;
     });
     if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Project skill path is not a real directory: ${validName}`);
-    const skillFile = join41(directory, "SKILL.md");
+    const skillFile = join42(directory, "SKILL.md");
     const fileInfo = await lstat13(skillFile);
     if (!fileInfo.isFile() || fileInfo.isSymbolicLink()) throw new Error(`Project skill file is not a real file: ${validName}`);
     await writeFile16(skillFile, renderSkill(value), { encoding: "utf8", mode: 384 });
@@ -29467,12 +29740,12 @@ var SkillManager = class {
   async #registry() {
     const loaded = await loadConfig({ cwd: this.#workspace, home: this.#home });
     const [globalPluginRoots, projectPluginRoots] = await Promise.all([
-      discoverPluginSkillRoots(join41(this.#home, ".flavor-code", "plugins")),
-      discoverPluginSkillRoots(join41(this.#workspace, ".flavor", "plugins"))
+      discoverPluginSkillRoots(join42(this.#home, ".flavor-code", "plugins")),
+      discoverPluginSkillRoots(join42(this.#workspace, ".flavor", "plugins"))
     ]);
     return {
       registry: new SkillRegistry({
-        globalRoots: [join41(this.#home, ".flavor-code", "skills"), ...globalPluginRoots],
+        globalRoots: [join42(this.#home, ".flavor-code", "skills"), ...globalPluginRoots],
         projectRoots: [this.#projectRoot(), ...projectPluginRoots]
       }),
       disabled: new Set(loaded.config.skills.disabled)
@@ -29488,10 +29761,10 @@ var SkillManager = class {
     };
   }
   #projectRoot() {
-    return join41(this.#workspace, ".flavor", "skills");
+    return join42(this.#workspace, ".flavor", "skills");
   }
   #projectSkillDirectory(name) {
-    return join41(this.#projectRoot(), name);
+    return join42(this.#projectRoot(), name);
   }
 };
 function parseName(value) {
@@ -29532,16 +29805,16 @@ async function discoverPluginSkillRoots(directory) {
   const roots = [];
   for (const entry2 of entries) {
     if (!entry2.isDirectory() || entry2.isSymbolicLink()) continue;
-    const pluginRoot = await realpath13(join41(directory, entry2.name));
+    const pluginRoot = await realpath13(join42(directory, entry2.name));
     try {
-      const manifest = PluginManifestSchema.parse(JSON.parse(await readFile34(join41(pluginRoot, "flavor-plugin.json"), "utf8")));
+      const manifest = PluginManifestSchema.parse(JSON.parse(await readFile34(join42(pluginRoot, "flavor-plugin.json"), "utf8")));
       for (const contribution of manifest.contributes.skillRoots) {
-        const candidate = resolve34(pluginRoot, contribution.path);
+        const candidate = resolve35(pluginRoot, contribution.path);
         const info = await lstat13(candidate);
         if (!info.isDirectory() || info.isSymbolicLink()) continue;
         const physical = await realpath13(candidate);
         const relation = relative24(pluginRoot, physical);
-        if (relation === ".." || relation.startsWith(`..${sep25}`) || isAbsolute16(relation)) continue;
+        if (relation === ".." || relation.startsWith(`..${sep25}`) || isAbsolute17(relation)) continue;
         roots.push(physical);
       }
     } catch {
@@ -29609,11 +29882,11 @@ async function createProjectMemoryManager(options) {
 }
 
 // src/mcp/config-manager.ts
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var ProjectMcpConfigManager = class {
   path;
   constructor(workspace) {
-    this.path = join42(workspace, ".flavor", "flavor.json");
+    this.path = join43(workspace, ".flavor", "flavor.json");
   }
   async list() {
     const document = await readRecoverableFile(this.path, (raw) => parseDocument2(this.path, raw));
@@ -29710,7 +29983,7 @@ function isRecord7(value) {
 }
 
 // src/desktop/model-config.ts
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 var DEFAULT_DESKTOP_MODELS = [
   {
     id: "anthropic:deepseek-v4-pro",
@@ -29731,7 +30004,7 @@ var DEFAULT_DESKTOP_MODELS = [
 ];
 async function loadDesktopModels(workspace, home) {
   try {
-    const tokens2 = await createFileTokenStore(join43(home, ".flavor-code", "auth.json")).load();
+    const tokens2 = await createFileTokenStore(join44(home, ".flavor-code", "auth.json")).load();
     const pkceModels = [];
     const knownPkce = /* @__PURE__ */ new Set();
     for (const token of Object.values(tokens2)) {
@@ -29801,7 +30074,7 @@ function protocolLabel(type) {
 import { createReadStream as createReadStream2 } from "fs";
 import { realpath as realpath14, stat as stat14 } from "fs/promises";
 import { createServer as createServer6 } from "http";
-import { extname as extname3, isAbsolute as isAbsolute17, relative as relative25, resolve as resolve35, sep as sep26 } from "path";
+import { extname as extname4, isAbsolute as isAbsolute18, relative as relative25, resolve as resolve36, sep as sep26 } from "path";
 var MIME_TYPES = {
   ".css": "text/css; charset=utf-8",
   ".gif": "image/gif",
@@ -29820,10 +30093,10 @@ function sendNotFound(response2) {
 }
 function isInside(root, candidate) {
   const delta = relative25(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep26}`) && delta !== ".." && !isAbsolute17(delta);
+  return delta === "" || !delta.startsWith(`..${sep26}`) && delta !== ".." && !isAbsolute18(delta);
 }
 async function startD2cProductPreview(rootDirectory) {
-  const root = await realpath14(resolve35(rootDirectory));
+  const root = await realpath14(resolve36(rootDirectory));
   const rootInfo = await stat14(root);
   if (!rootInfo.isDirectory()) throw new Error("D2C product prototype directory is unavailable");
   const server = createServer6(async (request, response2) => {
@@ -29835,7 +30108,7 @@ async function startD2cProductPreview(rootDirectory) {
       let pathname = decodeURIComponent(url.pathname);
       if (pathname === "/") pathname = "/index.html";
       if (pathname.includes("\0")) return sendNotFound(response2);
-      const unresolved = resolve35(root, `.${pathname}`);
+      const unresolved = resolve36(root, `.${pathname}`);
       if (!isInside(root, unresolved)) return sendNotFound(response2);
       const target = await realpath14(unresolved).catch(() => void 0);
       if (target === void 0 || !isInside(root, target)) return sendNotFound(response2);
@@ -29843,7 +30116,7 @@ async function startD2cProductPreview(rootDirectory) {
       if (!info.isFile()) return sendNotFound(response2);
       response2.writeHead(200, {
         "content-length": info.size,
-        "content-type": MIME_TYPES[extname3(target).toLowerCase()] ?? "application/octet-stream"
+        "content-type": MIME_TYPES[extname4(target).toLowerCase()] ?? "application/octet-stream"
       });
       createReadStream2(target).on("error", () => response2.destroy()).pipe(response2);
     } catch {
@@ -29876,33 +30149,33 @@ function pngDataUrl(png) {
 }
 async function detectD2cFramework(workspace, task) {
   try {
-    const pkg = JSON.parse(await readFile35(join44(d2cOutputDirectory(workspace, task), "package.json"), "utf8"));
+    const pkg = JSON.parse(await readFile35(join45(d2cOutputDirectory(workspace, task), "package.json"), "utf8"));
     return pkg.dependencies?.react === void 0 ? "vue" : "react";
   } catch {
     return "vue";
   }
 }
 function integrationDirectory(workspace, task) {
-  return join44(workspace, ".flavor", "d2c", task, "integration");
+  return join45(workspace, ".flavor", "d2c", task, "integration");
 }
 var D2C_BACKEND_SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".cfg", ".env", ".ini", ".js", ".json", ".lock", ".mjs", ".py", ".toml", ".txt", ".yaml", ".yml"]);
 var D2C_BACKEND_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".venv", "__pycache__", "data", "node_modules", "venv"]);
 async function d2cBackendSourceFingerprint(project) {
-  const runtimeManifest = join44(project, "server", "flavor-runtime.json");
+  const runtimeManifest = join45(project, "server", "flavor-runtime.json");
   const realBackend = (await stat15(runtimeManifest).catch(() => void 0))?.isFile() === true;
-  const root = realBackend ? join44(project, "server") : join44(project, "mock");
+  const root = realBackend ? join45(project, "server") : join45(project, "mock");
   if ((await stat15(root).catch(() => void 0))?.isDirectory() !== true) return void 0;
   const files = [];
   const visit = async (directory) => {
     const entries = await readdir12(directory, { withFileTypes: true });
     for (const entry2 of entries) {
       if (entry2.isDirectory()) {
-        if (!D2C_BACKEND_IGNORED_DIRECTORIES.has(entry2.name)) await visit(join44(directory, entry2.name));
+        if (!D2C_BACKEND_IGNORED_DIRECTORIES.has(entry2.name)) await visit(join45(directory, entry2.name));
         continue;
       }
       if (!entry2.isFile()) continue;
       const extension2 = entry2.name.includes(".") ? `.${entry2.name.split(".").pop().toLowerCase()}` : "";
-      if (D2C_BACKEND_SOURCE_EXTENSIONS.has(extension2)) files.push(join44(directory, entry2.name));
+      if (D2C_BACKEND_SOURCE_EXTENSIONS.has(extension2)) files.push(join45(directory, entry2.name));
     }
   };
   await visit(root);
@@ -29954,7 +30227,7 @@ var DesktopRuntimeController = class {
   /** Backend source digest observed when the managed process was started. */
   #d2cMockSourceFingerprints = /* @__PURE__ */ new Map();
   constructor(options) {
-    this.#home = resolve36(options.home ?? homedir4());
+    this.#home = resolve37(options.home ?? homedir4());
     this.#createRuntime = options.createRuntime ?? (async (runtimeOptions) => createProductionRuntime(runtimeOptions));
     this.#createTerminalService = options.createTerminalService ?? ((workspace) => new TerminalService(workspace));
     this.#listSessions = options.listSessions ?? (async (workspace) => {
@@ -30029,7 +30302,7 @@ var DesktopRuntimeController = class {
     };
   }
   async openWorkspace(path) {
-    const workspace = resolve36(path);
+    const workspace = resolve37(path);
     if (workspace !== this.#workspace) {
       await this.#disposeRuntime();
       await this.#stopAllD2cPreviews();
@@ -30456,7 +30729,7 @@ var DesktopRuntimeController = class {
     if (workflow === void 0 || !reviewProgress(workflow).complete || workflow.stage === "visual-review") {
       throw new Error("Complete visual review before importing OpenAPI");
     }
-    const moduleManifest = join44(d2cOutputDirectory(workspace, task), "d2c.modules.json");
+    const moduleManifest = join45(d2cOutputDirectory(workspace, task), "d2c.modules.json");
     const moduleManifestInfo = await stat15(moduleManifest).catch(() => void 0);
     if (moduleManifestInfo === void 0 || !moduleManifestInfo.isFile()) {
       throw new Error("D2C implementation must write d2c.modules.json before API mapping; ask the agent to split the project into modules first");
@@ -30469,8 +30742,8 @@ var DesktopRuntimeController = class {
     await mkdir27(dir, { recursive: true });
     const hash = createHash27("sha256").update(raw).digest("hex");
     await Promise.all([
-      writeFile17(join44(dir, "swagger.json"), raw),
-      writeFile17(join44(dir, "openapi.normalized.json"), `${JSON.stringify(document, null, 2)}
+      writeFile17(join45(dir, "swagger.json"), raw),
+      writeFile17(join45(dir, "openapi.normalized.json"), `${JSON.stringify(document, null, 2)}
 `)
     ]);
     const next = {
@@ -30505,7 +30778,7 @@ var DesktopRuntimeController = class {
     let workflow = await readWorkflow(workspace, task);
     if (workflow?.openapi === void 0 && workflow !== void 0 && reviewProgress(workflow).complete && await readD2cProductPlanView(workspace, task) !== void 0) {
       const modules = await readD2cModules(workspace, task);
-      const productOpenApiPath = join44(taskDir(workspace, task), "product", "openapi.json");
+      const productOpenApiPath = join45(taskDir(workspace, task), "product", "openapi.json");
       const authored = await readFile35(productOpenApiPath, "utf8").catch(() => void 0);
       const generated = authored === void 0;
       const prepared = await this.#storeD2cOpenApi(
@@ -30518,7 +30791,7 @@ var DesktopRuntimeController = class {
       return prepared;
     }
     if (workflow?.openapi === void 0 || workflow.mappings === void 0) return void 0;
-    const document = JSON.parse(await readFile35(join44(integrationDirectory(workspace, task), "openapi.normalized.json"), "utf8"));
+    const document = JSON.parse(await readFile35(join45(integrationDirectory(workspace, task), "openapi.normalized.json"), "utf8"));
     return { workflow, document, mappings: workflow.mappings };
   }
   async confirmD2cMapping(task, moduleId, operationKey) {
@@ -30585,7 +30858,7 @@ var DesktopRuntimeController = class {
     ].join("\n");
     const delivery = await readDeliveryRun(workspace, task);
     if (delivery?.nodes.api.status === "running") {
-      const apiArtifacts = await Promise.all(generated.files.map(async (file) => artifactRef(file, await readFile35(join44(project, file)))));
+      const apiArtifacts = await Promise.all(generated.files.map(async (file) => artifactRef(file, await readFile35(join45(project, file)))));
       const completed = await updateDeliveryRun(
         workspace,
         task,
@@ -30612,7 +30885,7 @@ var DesktopRuntimeController = class {
     try {
       const fingerprint2 = await d2cBackendSourceFingerprint(project);
       if (fingerprint2 !== void 0) this.#d2cMockSourceFingerprints.set(task, fingerprint2);
-      const environmentPath = join44(project, ".env.local");
+      const environmentPath = join45(project, ".env.local");
       const existingEnvironment = await readFile35(environmentPath, "utf8").catch(() => "");
       const environment = `${existingEnvironment.split(/\r?\n/).filter((line) => !/^\s*VITE_API_BASE_URL\s*=/.test(line)).join("\n").trim()}
 VITE_API_BASE_URL=${running.url}
@@ -30693,7 +30966,7 @@ VITE_API_BASE_URL=${running.url}
     const readyPreview = this.#d2cPreviews.get(task);
     const readyMock = this.#d2cMocks.get(task);
     if (readyPreview === void 0 || readyMock === void 0) throw new Error("D2C preview or backend service is unavailable after synchronization");
-    const manifestPath = join44(taskDir(workspace, task), "design", "interaction-manifest.json");
+    const manifestPath = join45(taskDir(workspace, task), "design", "interaction-manifest.json");
     const manifest = parseInteractionManifest(await readFile35(manifestPath, "utf8"));
     const baseline = await this.#verifyAcceptanceBaseline(workspace, task);
     const coverage = baseline === void 0 ? void 0 : verifyRequirementCoverage(baseline.approvedPrd.criteria, manifest);
@@ -30705,7 +30978,7 @@ VITE_API_BASE_URL=${running.url}
       await mkdir27(planDir, { recursive: true });
       try {
         const observations = await this.#observeD2cPages(manifest, readyPreview.url);
-        const prd = await readFile35(join44(taskDir(workspace, task), "product", "prd.md"), "utf8").catch(() => void 0);
+        const prd = await readFile35(join45(taskDir(workspace, task), "product", "prd.md"), "utf8").catch(() => void 0);
         const apiContext = JSON.stringify({ openapi: workflow.openapi, mappings: workflow.mappings }, null, 2);
         const plan = await this.#d2cJudge.planInteractions({ task, seed: manifest, observations, ...prd === void 0 ? {} : { prd }, apiContext });
         executableManifest = mergeInteractionManifests(manifest, plan.manifest);
@@ -30716,9 +30989,9 @@ VITE_API_BASE_URL=${running.url}
           plannedScenarios: executableManifest.pages.reduce((total, page) => total + page.scenarios.length, 0),
           pageAnalyses: plan.pageAnalyses
         };
-        await writeFile17(join44(planDir, "autonomous-interaction-plan.json"), `${JSON.stringify({ ...plan, manifest: executableManifest }, null, 2)}
+        await writeFile17(join45(planDir, "autonomous-interaction-plan.json"), `${JSON.stringify({ ...plan, manifest: executableManifest }, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await rm15(join44(planDir, "autonomous-interaction-diagnostic.json"), { force: true });
+        await rm15(join45(planDir, "autonomous-interaction-diagnostic.json"), { force: true });
       } catch (cause) {
         const detail = message(cause);
         review = {
@@ -30726,8 +30999,8 @@ VITE_API_BASE_URL=${running.url}
           plannedScenarios: manifest.pages.reduce((total, page) => total + page.scenarios.length, 0),
           warning: `\u591A\u6A21\u6001\u81EA\u4E3B\u89C4\u5212\u5931\u8D25\uFF0C\u5DF2\u7EE7\u7EED\u6267\u884C\u5DF2\u786E\u8BA4\u7684\u8BBE\u8BA1\u5951\u7EA6\uFF1A${detail}`
         };
-        await rm15(join44(planDir, "autonomous-interaction-plan.json"), { force: true });
-        await writeFile17(join44(planDir, "autonomous-interaction-diagnostic.json"), `${JSON.stringify({
+        await rm15(join45(planDir, "autonomous-interaction-plan.json"), { force: true });
+        await writeFile17(join45(planDir, "autonomous-interaction-diagnostic.json"), `${JSON.stringify({
           schema: 1,
           stage: "planning",
           occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -30741,13 +31014,13 @@ VITE_API_BASE_URL=${running.url}
     let result = { ...rawResult, evidenceMode: review.mode };
     if (coverage !== void 0) {
       const evidence = createAcceptanceEvidence(coverage, result);
-      await writeFile17(join44(taskDir(workspace, task), "acceptance-evidence.json"), `${JSON.stringify({ ...evidence, baseline }, null, 2)}
+      await writeFile17(join45(taskDir(workspace, task), "acceptance-evidence.json"), `${JSON.stringify({ ...evidence, baseline }, null, 2)}
 `, { encoding: "utf8", mode: 384 });
       if (!evidence.passed) result = { ...result, passed: false, failures: Math.max(1, result.failures) };
     }
     const dir = integrationDirectory(workspace, task);
     await mkdir27(dir, { recursive: true });
-    await writeFile17(join44(dir, "interaction-results.json"), `${JSON.stringify(result, null, 2)}
+    await writeFile17(join45(dir, "interaction-results.json"), `${JSON.stringify(result, null, 2)}
 `);
     const next = await updateWorkflow(workspace, task, workflow.revision, (current) => applyInteractionRun(current, result));
     return { workflow: next, result, review };
@@ -30760,7 +31033,7 @@ VITE_API_BASE_URL=${running.url}
     if (mock === void 0 || !mock.exited() || result.failures === 0) return result;
     const output = mock.output().trim();
     try {
-      const dir = join44(d2cOutputDirectory(workspace, task), "mock-server.log");
+      const dir = join45(d2cOutputDirectory(workspace, task), "mock-server.log");
       await writeFile17(dir, `${output}
 `);
     } catch {
@@ -30855,7 +31128,7 @@ VITE_API_BASE_URL=${running.url}
     if (current === void 0) throw new Error("D2C product plan is unavailable");
     if (current.plan.approvedPrd !== void 0) throw new Error("The approved PRD is immutable and cannot be edited");
     if (current.plan.phase !== "prd-review") throw new Error("PRD sections can only be edited during PRD review");
-    const path = join44(taskDir(workspace, task), "product", "prd.md");
+    const path = join45(taskDir(workspace, task), "product", "prd.md");
     const updated = await updatePrdSectionFile(path, { sectionId, body, expectedHash });
     const now = (/* @__PURE__ */ new Date()).toISOString();
     await writeD2cProductPlan(workspace, {
@@ -30875,15 +31148,15 @@ VITE_API_BASE_URL=${running.url}
   async #assertProductPrdLocked(workspace, task) {
     const current = await readD2cProductPlanView(workspace, task);
     if (current?.plan.approvedPrd === void 0) return;
-    await assertApprovedPrd(join44(taskDir(workspace, task), "product", "prd.md"), current.plan.approvedPrd);
+    await assertApprovedPrd(join45(taskDir(workspace, task), "product", "prd.md"), current.plan.approvedPrd);
   }
   async #acceptancePaths(workspace, task) {
-    const product = join44(taskDir(workspace, task), "product");
-    const openapi = join44(product, "openapi.json");
+    const product = join45(taskDir(workspace, task), "product");
+    const openapi = join45(product, "openapi.json");
     return {
-      prd: join44(product, "prd.md"),
-      prototype: join44(product, "prototype", "index.html"),
-      interaction: join44(product, "prototype", "interaction-manifest.json"),
+      prd: join45(product, "prd.md"),
+      prototype: join45(product, "prototype", "index.html"),
+      interaction: join45(product, "prototype", "interaction-manifest.json"),
       ...await stat15(openapi).catch(() => void 0) === void 0 ? {} : { openapi }
     };
   }
@@ -30891,17 +31164,17 @@ VITE_API_BASE_URL=${running.url}
     const product = await readD2cProductPlanView(workspace, task);
     if (product?.plan.approvedPrd === void 0) return void 0;
     await this.#assertProductPrdLocked(workspace, task);
-    const baseline = JSON.parse(await readFile35(join44(taskDir(workspace, task), "acceptance-baseline.json"), "utf8"));
+    const baseline = JSON.parse(await readFile35(join45(taskDir(workspace, task), "acceptance-baseline.json"), "utf8"));
     await verifyAcceptanceBaseline(await this.#acceptancePaths(workspace, task), baseline);
-    const design = join44(taskDir(workspace, task), "design");
+    const design = join45(taskDir(workspace, task), "design");
     await Promise.all([
-      verifyAcceptanceArtifact(join44(design, "index.html"), baseline.artifacts.prototype, "runtime prototype"),
-      verifyAcceptanceArtifact(join44(design, "interaction-manifest.json"), baseline.artifacts.interaction, "runtime interaction contract")
+      verifyAcceptanceArtifact(join45(design, "index.html"), baseline.artifacts.prototype, "runtime prototype"),
+      verifyAcceptanceArtifact(join45(design, "interaction-manifest.json"), baseline.artifacts.interaction, "runtime interaction contract")
     ]);
     const workflow = await readWorkflow(workspace, task);
     if (workflow?.openapi !== void 0) {
       await verifyAcceptanceArtifact(
-        join44(taskDir(workspace, task), "integration", "swagger.json"),
+        join45(taskDir(workspace, task), "integration", "swagger.json"),
         { hash: workflow.openapi.hash },
         "runtime OpenAPI contract"
       );
@@ -30922,14 +31195,14 @@ VITE_API_BASE_URL=${running.url}
       throw new Error("D2C PRD is empty and cannot be accepted");
     }
     if (stage === "design" && accepted) {
-      const manifest = join44(d2cProductPrototypeDirectory(workspace, task), "interaction-manifest.json");
+      const manifest = join45(d2cProductPrototypeDirectory(workspace, task), "interaction-manifest.json");
       const normalizedManifest = parseInteractionManifest(await readFile35(manifest, "utf8"));
       if (current.plan.approvedPrd === void 0) throw new Error("Approve the PRD before confirming the design");
       verifyRequirementCoverage(current.plan.approvedPrd.criteria, normalizedManifest);
       await writeFile17(manifest, `${JSON.stringify(normalizedManifest, null, 2)}
 `, { encoding: "utf8", mode: 384 });
       const baseline = await captureAcceptanceBaseline(await this.#acceptancePaths(workspace, task), current.plan.approvedPrd);
-      await writeFile17(join44(taskDir(workspace, task), "acceptance-baseline.json"), `${JSON.stringify(baseline, null, 2)}
+      await writeFile17(join45(taskDir(workspace, task), "acceptance-baseline.json"), `${JSON.stringify(baseline, null, 2)}
 `, { encoding: "utf8", mode: 384 });
     }
     const plan = await writeD2cProductPlan(
@@ -30963,8 +31236,8 @@ VITE_API_BASE_URL=${running.url}
     const imported = await this.importD2cDesign(task, d2cProductPrototypeDirectory(workspace, task));
     const delivery = await readDeliveryRun(workspace, task);
     if (delivery !== void 0) {
-      const prototype = await readFile35(join44(d2cProductPrototypeDirectory(workspace, task), "index.html"), "utf8");
-      const interaction = await readFile35(join44(d2cProductPrototypeDirectory(workspace, task), "interaction-manifest.json"), "utf8");
+      const prototype = await readFile35(join45(d2cProductPrototypeDirectory(workspace, task), "index.html"), "utf8");
+      const interaction = await readFile35(join45(d2cProductPrototypeDirectory(workspace, task), "interaction-manifest.json"), "utf8");
       const completed = await updateDeliveryRun(workspace, task, delivery.revision, (run) => completeDeliveryNode(run, "design", [
         artifactRef("product/prototype/index.html", prototype),
         artifactRef("product/prototype/interaction-manifest.json", interaction)
@@ -31048,10 +31321,10 @@ VITE_API_BASE_URL=${running.url}
     const next = await updateWorkflow(workspace, task, workflow.revision, (current) => applyQualityJudgment(current, judgment));
     const qualityContent = `${JSON.stringify(judgment, null, 2)}
 `;
-    await writeFile17(join44(taskDir(workspace, task), "quality-judge.json"), qualityContent, { encoding: "utf8", mode: 384 });
+    await writeFile17(join45(taskDir(workspace, task), "quality-judge.json"), qualityContent, { encoding: "utf8", mode: 384 });
     const delivery = await readDeliveryRun(workspace, task);
     if (next.stage === "completed" && delivery?.nodes.acceptance.status === "running") {
-      const interactionContent = await readFile35(join44(integrationDirectory(workspace, task), "interaction-results.json"), "utf8");
+      const interactionContent = await readFile35(join45(integrationDirectory(workspace, task), "interaction-results.json"), "utf8");
       const accepted = await updateDeliveryRun(workspace, task, delivery.revision, (run) => completeDeliveryNode(run, "acceptance", [
         artifactRef("integration/interaction-results.json", interactionContent),
         artifactRef("quality-judge.json", qualityContent)
@@ -31231,70 +31504,9 @@ function desktopWindowChrome(platform = process.platform) {
   };
 }
 
-// src/utils/crash-guard.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "fs";
-import { join as join45 } from "path";
-var installed = false;
-function installCrashGuard(options = {}) {
-  if (installed) return;
-  installed = true;
-  const crashLogDir = () => {
-    try {
-      return join45((options.workspace ?? process.cwd)(), ".flavor");
-    } catch {
-      return process.cwd();
-    }
-  };
-  const writeCrashLog = (kind, detail) => {
-    try {
-      const dir = crashLogDir();
-      mkdirSync4(dir, { recursive: true });
-      const path = join45(dir, `crash-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "")}-${process.pid}.log`);
-      writeFileSync2(path, [
-        `kind: ${kind}`,
-        `version: ${process.version}`,
-        `platform: ${process.platform}`,
-        `time: ${(/* @__PURE__ */ new Date()).toISOString()}`,
-        "",
-        detail
-      ].join("\n"), { encoding: "utf8", mode: 384 });
-      return path;
-    } catch {
-      return void 0;
-    }
-  };
-  const restoreTerminal = () => {
-    try {
-      if (process.stdout.isTTY === true) process.stdout.write("\x1B[?25h\x1B[?1049l");
-    } catch {
-    }
-  };
-  const describe = (reason) => {
-    if (reason instanceof Error) return `${reason.name}: ${reason.message}
-${reason.stack ?? ""}`;
-    return String(reason);
-  };
-  const crash = (kind, reason) => {
-    const detail = describe(reason);
-    const logPath = writeCrashLog(kind, detail);
-    restoreTerminal();
-    try {
-      const safe = redactErrorText(detail.split("\n").slice(0, 3).join("\n"));
-      process.stderr.write(`flavor crashed (${kind}): ${safe}
-`);
-      if (logPath !== void 0) process.stderr.write(`crash log: ${logPath}
-`);
-    } catch {
-    }
-    process.exit(1);
-  };
-  process.on("unhandledRejection", (reason) => crash("unhandledRejection", reason));
-  process.on("uncaughtException", (error) => crash("uncaughtException", error));
-}
-
 // src/desktop/git-manager.ts
 import { readFile as readFile36, rm as rm16 } from "fs/promises";
-import { isAbsolute as isAbsolute18, relative as relative26, resolve as resolve37 } from "path";
+import { isAbsolute as isAbsolute19, relative as relative26, resolve as resolve38 } from "path";
 function failure(action, stderr, stdout) {
   return new Error(`${action}\u5931\u8D25\uFF1A${(stderr.trim() || stdout.trim() || "\u672A\u77E5 Git \u9519\u8BEF").split("\n")[0]}`);
 }
@@ -31387,13 +31599,13 @@ async function desktopLastTurnDiff(workspace, sessionId, paths = []) {
     return path.replaceAll("\\", "/");
   }));
   try {
-    const tree = JSON.parse(await readFile36(resolve37(workspace, ".flavor", "session-trees", sessionId, "tree.json"), "utf8"));
+    const tree = JSON.parse(await readFile36(resolve38(workspace, ".flavor", "session-trees", sessionId, "tree.json"), "utf8"));
     const leaf = tree.nodes?.find((node) => node.id === tree.leafId);
     const parent = leaf?.parentId == null ? void 0 : tree.nodes?.find((node) => node.id === leaf.parentId);
     if (leaf === void 0 || parent === void 0) return desktopGitReviewDiff(workspace, { scope: "last-turn", paths });
     const load = async (id) => {
       if (!/^checkpoint-[A-Za-z0-9-]+$/.test(id)) throw new Error("Invalid checkpoint id");
-      return JSON.parse(await readFile36(resolve37(workspace, ".flavor", "checkpoints", "manifests", `${id}.json`), "utf8"));
+      return JSON.parse(await readFile36(resolve38(workspace, ".flavor", "checkpoints", "manifests", `${id}.json`), "utf8"));
     };
     const [before, after] = await Promise.all([load(parent.checkpointId), load(leaf.checkpointId)]);
     const oldFiles = new Map(before.files.map((file) => [file.path, file.digest]));
@@ -31402,7 +31614,7 @@ async function desktopLastTurnDiff(workspace, sessionId, paths = []) {
     const object = async (digest) => {
       if (digest === void 0) return "";
       if (!/^[a-f0-9]{64}$/.test(digest)) throw new Error("Invalid checkpoint object");
-      const value = await readFile36(resolve37(workspace, ".flavor", "checkpoints", "objects", digest));
+      const value = await readFile36(resolve38(workspace, ".flavor", "checkpoints", "objects", digest));
       return value.includes(0) ? "[binary content]" : value.toString("utf8");
     };
     const chunks = await Promise.all(changed.map(async (path) => wholeFileDiff(path, await object(oldFiles.get(path)), await object(newFiles.get(path)))));
@@ -31426,11 +31638,11 @@ async function assertListed(workspace, path) {
   return file;
 }
 function safeWorkspacePath(workspace, path) {
-  if (isAbsolute18(path)) throw new Error("Git \u6587\u4EF6\u8DEF\u5F84\u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684\u76F8\u5BF9\u8DEF\u5F84");
-  const root = resolve37(workspace);
-  const target = resolve37(root, path);
+  if (isAbsolute19(path)) throw new Error("Git \u6587\u4EF6\u8DEF\u5F84\u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684\u76F8\u5BF9\u8DEF\u5F84");
+  const root = resolve38(workspace);
+  const target = resolve38(root, path);
   const child = relative26(root, target);
-  if (child === "" || child.startsWith("..") || isAbsolute18(child)) throw new Error("\u62D2\u7EDD\u8BBF\u95EE\u9879\u76EE\u4E4B\u5916\u7684\u8DEF\u5F84");
+  if (child === "" || child.startsWith("..") || isAbsolute19(child)) throw new Error("\u62D2\u7EDD\u8BBF\u95EE\u9879\u76EE\u4E4B\u5916\u7684\u8DEF\u5F84");
   return target;
 }
 function safeGitTarget(value) {
@@ -31442,13 +31654,13 @@ function safeGitTarget(value) {
 // src/desktop/worktree-manager.ts
 import { randomUUID as randomUUID28 } from "crypto";
 import { mkdir as mkdir28, readFile as readFile37, readdir as readdir13, rm as rm17, stat as stat16, writeFile as writeFile18 } from "fs/promises";
-import { basename as basename10, isAbsolute as isAbsolute19, join as join46, relative as relative27, resolve as resolve38, sep as sep27 } from "path";
+import { basename as basename10, isAbsolute as isAbsolute20, join as join46, relative as relative27, resolve as resolve39, sep as sep27 } from "path";
 var DesktopWorktreeManager = class {
   #repository;
   #storage;
   constructor(options) {
-    this.#repository = resolve38(options.repository);
-    this.#storage = resolve38(options.storage);
+    this.#repository = resolve39(options.repository);
+    this.#storage = resolve39(options.storage);
   }
   async create(label) {
     if (!await isGitRepository(this.#repository)) throw new Error("Task worktrees require a Git repository");
@@ -31529,21 +31741,21 @@ var DesktopWorktreeManager = class {
     return this.#safeStoragePath(`${id}.json`);
   }
   #safeStoragePath(name) {
-    const target = resolve38(this.#storage, name);
+    const target = resolve39(this.#storage, name);
     const delta = relative27(this.#storage, target);
-    if (delta === "" || delta === ".." || delta.startsWith(`..${sep27}`) || isAbsolute19(delta)) throw new Error("Worktree path escapes storage");
+    if (delta === "" || delta === ".." || delta.startsWith(`..${sep27}`) || isAbsolute20(delta)) throw new Error("Worktree path escapes storage");
     return target;
   }
 };
 function validateStored(value, repository, storage) {
   if (typeof value !== "object" || value === null) throw new Error("Invalid worktree metadata");
   const item = value;
-  if (item.version !== 1 || item.mode !== "worktree" || typeof item.id !== "string" || typeof item.path !== "string" || typeof item.branch !== "string" || typeof item.createdAt !== "string" || resolve38(item.repository ?? "") !== repository) {
+  if (item.version !== 1 || item.mode !== "worktree" || typeof item.id !== "string" || typeof item.path !== "string" || typeof item.branch !== "string" || typeof item.createdAt !== "string" || resolve39(item.repository ?? "") !== repository) {
     throw new Error("Invalid worktree metadata");
   }
-  const path = resolve38(item.path);
+  const path = resolve39(item.path);
   const delta = relative27(storage, path);
-  if (delta === "" || delta === ".." || delta.startsWith(`..${sep27}`) || isAbsolute19(delta) || basename10(path) !== item.id) {
+  if (delta === "" || delta === ".." || delta.startsWith(`..${sep27}`) || isAbsolute20(delta) || basename10(path) !== item.id) {
     throw new Error("Worktree metadata escapes storage");
   }
   return { version: 1, id: item.id, mode: "worktree", repository, path, branch: item.branch, createdAt: item.createdAt };
@@ -31552,15 +31764,15 @@ function validateStored(value, repository, storage) {
 // src/desktop/workbench-service.ts
 import { readFile as readFile38, readdir as readdir14, stat as stat17 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { join as join47, resolve as resolve39 } from "path";
+import { join as join47, resolve as resolve40 } from "path";
 var MAX_TEXT = 128e3;
 var MAX_ITEMS = 200;
 var DesktopWorkbenchService = class {
   #workspace;
   #home;
   constructor(workspace, home = homedir5()) {
-    this.#workspace = resolve39(workspace);
-    this.#home = resolve39(home);
+    this.#workspace = resolve40(workspace);
+    this.#home = resolve40(home);
   }
   async inspect(sessionId) {
     const [goals, instructions, permissionFiles, audit, context] = await Promise.all([
@@ -31611,7 +31823,7 @@ var DesktopWorkbenchService = class {
   }
   async #permissionFiles() {
     const candidates = [
-      ...process.env.FLAVOR_MANAGED_PERMISSIONS ? [{ tier: "managed", path: resolve39(process.env.FLAVOR_MANAGED_PERMISSIONS), content: "" }] : [],
+      ...process.env.FLAVOR_MANAGED_PERMISSIONS ? [{ tier: "managed", path: resolve40(process.env.FLAVOR_MANAGED_PERMISSIONS), content: "" }] : [],
       { tier: "user", path: join47(this.#home, ".flavor-code", "permissions.json"), content: "" },
       { tier: "project", path: join47(this.#workspace, ".flavor", "permissions.json"), content: "" },
       { tier: "local", path: join47(this.#workspace, ".flavor", "permissions.local.json"), content: "" }
@@ -31741,7 +31953,7 @@ function sessionMetaKey(workspace, sessionId) {
   return `${workspace}\0${sessionId}`;
 }
 function worktreeManager(workspace) {
-  const key = createHash28("sha256").update(resolve40(workspace)).digest("hex").slice(0, 20);
+  const key = createHash28("sha256").update(resolve41(workspace)).digest("hex").slice(0, 20);
   return new DesktopWorktreeManager({ repository: workspace, storage: join48(app.getPath("userData"), "task-worktrees", key) });
 }
 function activeWorkingDirectory() {
@@ -31947,6 +32159,9 @@ async function savePersistedProjects() {
   await writeFile19(statePath(), `${JSON.stringify({ workspace: activeWorkspace, projects: projectOrder, ...workbench })}
 `, { encoding: "utf8", mode: 384 });
 }
+function savePersistedProjectsInBackground() {
+  void savePersistedProjects().catch((error) => logStartup("persist-projects-failed", String(error)));
+}
 function validRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
@@ -31954,7 +32169,7 @@ async function assertDirectory(path) {
   if (!(await stat18(path)).isDirectory()) throw new Error("The selected project is not a directory");
 }
 async function openWorkspace(path) {
-  const workspace = resolve40(path);
+  const workspace = resolve41(path);
   await assertDirectory(workspace);
   let project = managedProjects.get(workspace);
   if (project === void 0) {
@@ -31965,10 +32180,10 @@ async function openWorkspace(path) {
     activeWorkspace = workspace;
     controller = nextController;
     project.snapshot = await nextController.openWorkspace(workspace);
-    for (const saved of workbench.taskCheckouts.filter((item) => resolve40(item.workspace) === workspace)) {
+    for (const saved of workbench.taskCheckouts.filter((item) => resolve41(item.workspace) === workspace)) {
       try {
         await assertDirectory(saved.workingDirectory);
-        const task = { environment: "worktree", workingDirectory: resolve40(saved.workingDirectory), worktreeId: saved.worktreeId };
+        const task = { environment: "worktree", workingDirectory: resolve41(saved.workingDirectory), worktreeId: saved.worktreeId };
         task.controller = createDesktopController(workspace, task);
         task.snapshot = await task.controller.openWorkspace(task.workingDirectory);
         task.sessionId = saved.sessionId;
@@ -32002,7 +32217,7 @@ function trackTaskTransition(workspace, task, previous, next) {
   const needsAttention = next.approval !== void 0 || (next.questions?.length ?? 0) > 0;
   const hadAttention = previous?.approval !== void 0 || (previous?.questions?.length ?? 0) > 0;
   if (needsAttention && !hadAttention) addActivity(workspace, sessionId, "attention", "\u4EFB\u52A1\u7B49\u5F85\u4F60\u7684\u786E\u8BA4");
-  void savePersistedProjects();
+  savePersistedProjectsInBackground();
 }
 function addActivity(workspace, sessionId, kind, title, detail) {
   const item = { id: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`, workspace, ...sessionId === void 0 ? {} : { sessionId }, kind, title, ...detail === void 0 ? {} : { detail }, createdAt: (/* @__PURE__ */ new Date()).toISOString(), unread: true };
@@ -32014,7 +32229,7 @@ function addActivity(workspace, sessionId, kind, title, detail) {
     });
     notification.show();
   }
-  void savePersistedProjects();
+  savePersistedProjectsInBackground();
 }
 async function startManagedSession(resumeSession, environment = "local") {
   if (activeWorkspace === void 0) throw new Error("Open a project before starting a session");
@@ -32098,7 +32313,7 @@ function installIpcHandlers() {
       } catch {
       }
     }
-    if (persisted.workspace !== void 0 && managedProjects.has(resolve40(persisted.workspace))) {
+    if (persisted.workspace !== void 0 && managedProjects.has(resolve41(persisted.workspace))) {
       try {
         return await openWorkspace(persisted.workspace);
       } catch {
@@ -32159,7 +32374,7 @@ function installIpcHandlers() {
   });
   ipcMain.handle(DESKTOP_CHANNELS.updateProject, async (_event, value) => {
     const input = UpdateProjectInputSchema.parse(value);
-    const workspace = resolve40(input.workspace);
+    const workspace = resolve41(input.workspace);
     if (!managedProjects.has(workspace)) throw new Error("\u9879\u76EE\u672A\u6253\u5F00");
     workbench.projectMeta[workspace] = { ...workbench.projectMeta[workspace], ...input.label === void 0 ? {} : { label: input.label || void 0 }, ...input.pinned === void 0 ? {} : { pinned: input.pinned } };
     await savePersistedProjects();
@@ -32167,7 +32382,7 @@ function installIpcHandlers() {
   });
   ipcMain.handle(DESKTOP_CHANNELS.closeProject, async (_event, value) => {
     const input = CloseProjectInputSchema.parse(value);
-    const workspace = resolve40(input.workspace);
+    const workspace = resolve41(input.workspace);
     const project = managedProjects.get(workspace);
     if (project === void 0) return decorateSnapshot(controller.snapshot());
     if ([...project.tasks].some((task) => task.snapshot.activeSession?.busy) && !input.force) throw new Error("\u9879\u76EE\u4E2D\u4ECD\u6709\u4EFB\u52A1\u8FD0\u884C\uFF1B\u786E\u8BA4\u540E\u518D\u5173\u95ED\u9879\u76EE");
@@ -32183,12 +32398,12 @@ function installIpcHandlers() {
     return decorateSnapshot(controller.snapshot());
   });
   ipcMain.handle(DESKTOP_CHANNELS.revealProject, async (_event, value) => {
-    const workspace = resolve40(ProjectPathInputSchema.parse(value).workspace);
+    const workspace = resolve41(ProjectPathInputSchema.parse(value).workspace);
     await assertDirectory(workspace);
     await shell.openPath(workspace);
   });
   ipcMain.handle(DESKTOP_CHANNELS.copyProjectPath, async (_event, value) => {
-    clipboard.writeText(resolve40(ProjectPathInputSchema.parse(value).workspace));
+    clipboard.writeText(resolve41(ProjectPathInputSchema.parse(value).workspace));
   });
   ipcMain.handle(DESKTOP_CHANNELS.dismissRecovery, async (_event, value) => {
     const { sessionId } = DeleteSessionInputSchema.parse(value);