glimmervoid 0.29.1 → 0.31.0

package/dist/chunks/{node-pty-preflight-CK1knGIR.js → node-pty-preflight-C8QIlrtU.js}

@@ -1,3 +1,4 @@
+import { r as errorMessage } from "./text-DoirglWV.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
@@ -62,14 +63,11 @@ function hostScope() {
 		arch: process.arch
 	};
 }
-function errorMessage(error) {
-	return firstLine(error instanceof Error ? error.message : String(error));
-}
 function resolveNodePtyPackageDir() {
 	try {
 		return { packageDir: path.dirname(createRequire(import.meta.url).resolve("node-pty/package.json")) };
 	} catch (err) {
-		return { error: errorMessage(err) };
+		return { error: firstLine(errorMessage(err)) };
 	}
 }
 var EXECUTABLE_MODE = 493;
@@ -98,7 +96,7 @@ function ensureSpawnHelperExecutable(packageDir, scope) {
 		try {
 			fs.chmodSync(helperPath, EXECUTABLE_MODE);
 		} catch (err) {
-			lastRepairError = `${helperPath}: ${errorMessage(err)}`;
+			lastRepairError = `${helperPath}: ${firstLine(errorMessage(err))}`;
 			continue;
 		}
 		if (isExecutableByThisProcess(helperPath)) {
@@ -146,7 +144,7 @@ async function probeNodePty() {
 	} catch (err) {
 		return {
 			ok: false,
-			reason: errorMessage(err),
+			reason: firstLine(errorMessage(err)),
 			packageDir: resolved.packageDir
 		};
 	}

package/dist/chunks/{pair-cli-BQQnhkkc.js → pair-cli-BbCBfd6l.js}

@@ -1,5 +1,6 @@
-import { l as resolveConfigPath } from "./config-store-DtPUFVaO.js";
-import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-BHoDFCpo.js";
+import { r as errorMessage } from "./text-DoirglWV.js";
+import { l as resolveConfigPath } from "./config-store-BCy4FHNG.js";
+import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-DKIH_VxM.js";
 import fs from "node:fs";
 //#region server/text-format.ts
 function trimIso(iso) {
@@ -21,7 +22,7 @@ function readConfig(configPath) {
 	try {
 		return JSON.parse(fs.readFileSync(configPath, "utf8"));
 	} catch (err) {
-		console.error(`Could not read ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+		console.error(`Could not read ${configPath}: ${errorMessage(err)}`);
 		return null;
 	}
 }

package/dist/chunks/paths-CeJl2Vcg.js

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+//#region shared/paths.ts
+var realpathNative = promisify(fs.realpath.native);
+function canonicalizePath(p) {
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
+}
+function caseFoldedPathKey(value) {
+	return process.platform === "win32" ? value.toLowerCase() : value;
+}
+function equalsIgnoringCaseOnWindows(a, b) {
+	return caseFoldedPathKey(a) === caseFoldedPathKey(b);
+}
+function isSameDirectoryPath(a, b) {
+	const resolvedA = path.resolve(String(a || ""));
+	const resolvedB = path.resolve(String(b || ""));
+	if (equalsIgnoringCaseOnWindows(resolvedA, resolvedB)) return true;
+	if (process.platform !== "win32" && process.platform !== "darwin") return false;
+	return equalsIgnoringCaseOnWindows(canonicalizePath(resolvedA), canonicalizePath(resolvedB));
+}
+async function comparableDirectoryPath(candidatePath) {
+	const resolvedPath = path.resolve(String(candidatePath || ""));
+	let canonicalPath;
+	try {
+		canonicalPath = await realpathNative(resolvedPath);
+	} catch {
+		canonicalPath = resolvedPath;
+	}
+	if (process.platform !== "win32") return canonicalPath;
+	return canonicalPath.toLowerCase();
+}
+function isPathInside(parent, child, { allowEqual = true, foldCase = false } = {}) {
+	if (!parent || !child) return false;
+	const resolvedParent = path.resolve(parent);
+	const resolvedChild = path.resolve(child);
+	const from = foldCase ? resolvedParent.toLowerCase() : resolvedParent;
+	const to = foldCase ? resolvedChild.toLowerCase() : resolvedChild;
+	const relative = path.relative(from, to);
+	if (relative === "") return allowEqual;
+	if (path.isAbsolute(relative)) return false;
+	return relative !== ".." && !relative.startsWith(`..${path.sep}`);
+}
+function safePathSegment(value) {
+	return String(value).replace(/[<>:"/\\|?*\x00-\x1f]/g, "-").replace(/[. ]+$/, "") || "_";
+}
+function sanitizeWorktreeName(value) {
+	return String(value || "").replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+//#endregion
+export { isPathInside as a, sanitizeWorktreeName as c, equalsIgnoringCaseOnWindows as i, caseFoldedPathKey as n, isSameDirectoryPath as o, comparableDirectoryPath as r, safePathSegment as s, canonicalizePath as t };

package/dist/chunks/{remote-config-BHoDFCpo.js → remote-config-DKIH_VxM.js}

@@ -1,4 +1,9 @@
-import { X as equalsIgnoringCaseOnWindows, g as writeJsonAtomicSync, h as writeJsonAtomic, q as canonicalizePath, s as glimmervoidHomeDir } from "./config-store-DtPUFVaO.js";
+import { n as errorLabel, r as errorMessage } from "./text-DoirglWV.js";
+import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths-CeJl2Vcg.js";
+import { n as isRecord } from "./coerce-NSst8oRP.js";
+import { n as unrefTimer, t as DEFAULT_TIMER_FNS } from "./timer-deps-u2DAQLok.js";
+import { a as jsonStateLoadError, d as writeJsonAtomicSync, l as sleepSync, s as loadJsonStateFileSync, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
+import { s as glimmervoidHomeDir } from "./config-store-BCy4FHNG.js";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
@@ -89,16 +94,6 @@ var LOCK_SUFFIX = ".lock";
 var LOCK_RETRY_MS = 50;
 var LOCK_MAX_ATTEMPTS = 10;
 var LOCK_STALE_MS = 5e3;
-function errorLabel(err) {
-	const failure = err ?? {};
-	return String(failure.code || failure.message || err);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
 function emptyDoc() {
 	return {
 		version: 1,
@@ -129,40 +124,41 @@ function pairingsSignature(doc) {
 	const safe = coerceDoc(doc);
 	return JSON.stringify(safe);
 }
-function createPairingsStore({ filePath = defaultPairingsPath(), now = Date.now, randomBytes, warn = console.warn, setIntervalFn = (fn, ms) => setInterval(fn, ms), clearIntervalFn = (handle) => clearInterval(handle) } = {}) {
+function createPairingsStore({ filePath = defaultPairingsPath(), now = Date.now, randomBytes, warn = console.warn, setIntervalFn = DEFAULT_TIMER_FNS.setIntervalFn, clearIntervalFn = DEFAULT_TIMER_FNS.clearIntervalFn } = {}) {
 	const pairingsPath = filePath;
 	let snapshot = emptyDoc();
 	function readDocSync() {
-		let raw;
-		try {
-			raw = fs.readFileSync(pairingsPath, "utf8");
-		} catch (err) {
-			if (err?.code === "ENOENT") return {
-				doc: emptyDoc(),
-				missing: true,
-				corrupt: false
-			};
-			warn(`[pairings] Failed to read ${pairingsPath}: ${errorLabel(err)}`);
-			return {
-				doc: emptyDoc(),
-				missing: false,
-				corrupt: true
-			};
-		}
-		try {
-			return {
-				doc: coerceDoc(JSON.parse(raw)),
-				missing: false,
-				corrupt: false
-			};
-		} catch (err) {
-			warn(`[pairings] Invalid JSON in ${pairingsPath}: ${errorMessage(err)} - treating as no paired devices`);
+		const outcome = loadJsonStateFileSync({
+			filePath: pairingsPath,
+			fsSync: fs,
+			parse: coerceDoc,
+			quarantine: false,
+			includeNotDir: false
+		});
+		if (outcome.status === "missing") return {
+			doc: emptyDoc(),
+			missing: true,
+			corrupt: false
+		};
+		if (outcome.status === "loaded") return {
+			doc: outcome.value,
+			missing: false,
+			corrupt: false
+		};
+		if (outcome.status === "corrupt") {
+			warn(`[pairings] Invalid JSON in ${pairingsPath}: ${errorMessage(outcome.error)} - treating as no paired devices`);
 			return {
 				doc: emptyDoc(),
 				missing: false,
 				corrupt: true
 			};
 		}
+		warn(`[pairings] Failed to read ${pairingsPath}: ${errorLabel(jsonStateLoadError(outcome))}`);
+		return {
+			doc: emptyDoc(),
+			missing: false,
+			corrupt: true
+		};
 	}
 	function load() {
 		snapshot = readDocSync().doc;
@@ -365,14 +361,14 @@ function createPairingsStore({ filePath = defaultPairingsPath(), now = Date.now,
 			if (onChange) onChange(snapshot);
 		}
 		const reloadInterval = setIntervalFn(refresh, SNAPSHOT_RELOAD_MS);
-		if (reloadInterval.unref) reloadInterval.unref();
+		unrefTimer(reloadInterval);
 		try {
 			ensureDir();
 			watcher = fs.watch(canonicalizePath(dir), (_event, filename) => {
 				if (filename && !equalsIgnoringCaseOnWindows(path.basename(String(filename)), path.basename(pairingsPath))) return;
 				if (timer) clearTimeout(timer);
 				timer = setTimeout(refresh, 200);
-				if (timer.unref) timer.unref();
+				unrefTimer(timer);
 			});
 		} catch (err) {
 			warn(`[pairings] Failed to watch ${dir}: ${errorMessage(err)} - falling back to the ${REVOCATION_PROPAGATION_SECONDS}s reload interval`);
@@ -409,7 +405,7 @@ function createSeenStore({ filePath = defaultSeenPath(), throttleMs = 6e4, now =
 	function readAll() {
 		try {
 			const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+			if (isRecord(parsed)) return parsed;
 			return {};
 		} catch {
 			return {};
@@ -441,28 +437,32 @@ function toPort(value) {
 	return null;
 }
 function normalizeRemoteConfig(raw) {
-	const src = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+	const src = isRecord(raw) ? raw : {};
 	const enabled = src.enabled === true;
 	const port = toPort(src.port);
 	const publicHost = typeof src.publicHost === "string" ? src.publicHost.trim() : "";
+	const ownerLogin = typeof src.ownerLogin === "string" ? src.ownerLogin.trim().toLowerCase() : "";
 	if (!enabled) return {
 		enabled,
 		port,
 		publicHost,
-		allowedOrigins: []
+		allowedOrigins: [],
+		ownerLogin
 	};
 	const listed = Array.isArray(src.allowedOrigins) ? src.allowedOrigins.filter((o) => typeof o === "string" && o.trim() !== "").map((o) => o.trim()) : [];
 	if (listed.length === 0 && publicHost !== "") return {
 		enabled,
 		port,
 		publicHost,
-		allowedOrigins: [`https://${publicHost}`]
+		allowedOrigins: [`https://${publicHost}`],
+		ownerLogin
 	};
 	return {
 		enabled,
 		port,
 		publicHost,
-		allowedOrigins: listed
+		allowedOrigins: listed,
+		ownerLogin
 	};
 }
 function validateRemoteConfig(remote, localPort) {

package/dist/chunks/rtk-hook-core-BmEz2aq9.js

@@ -0,0 +1,131 @@
+import { n as isRecord } from "./coerce-NSst8oRP.js";
+//#region session/core/sane-yolo.ts
+var SANE_YOLO_PATH_ENV = "GLIMMERVOID_SANE_YOLO_PATH";
+var SANE_YOLO_POLICY = {
+	version: 1,
+	destructive_command_protection: {
+		enabled: true,
+		overrides: {
+			"git.branch-force-delete": "off",
+			"git.merge-abort": "off",
+			"git.rebase-abort": "off",
+			"rm.recursive-force-dynamic-target": "on"
+		}
+	},
+	secret_protection: { enabled: false }
+};
+var SANE_YOLO_RULES = {
+	version: 1,
+	rules: ["infra"],
+	overrides: {},
+	transparent_wrappers: ["rtk", "npx"]
+};
+var INFRA_REASON = "Sane YOLO blocks infrastructure teardown; run this command by hand.";
+var TERRAFORM_DESTROY_FLAGS = [
+	"-destroy",
+	"--destroy",
+	"-destroy=true",
+	"--destroy=true"
+];
+var SANE_YOLO_FILES = {
+	"policy.json": SANE_YOLO_POLICY,
+	"rules/rule.json": SANE_YOLO_RULES,
+	"rules/infra/rulebook.json": {
+		rulebook_version: 1,
+		name: "infra",
+		version: "1.1.0",
+		allowed_commands: [
+			"terraform",
+			"tofu",
+			"pulumi",
+			"kubectl"
+		],
+		rules: [
+			{
+				name: "terraform-destroy",
+				command: "terraform",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "terraform-apply-destroy",
+				command: "terraform",
+				subcommand: "apply",
+				block_args: TERRAFORM_DESTROY_FLAGS,
+				reason: INFRA_REASON
+			},
+			{
+				name: "tofu-destroy",
+				command: "tofu",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "tofu-apply-destroy",
+				command: "tofu",
+				subcommand: "apply",
+				block_args: TERRAFORM_DESTROY_FLAGS,
+				reason: INFRA_REASON
+			},
+			{
+				name: "pulumi-destroy",
+				command: "pulumi",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "pulumi-down",
+				command: "pulumi",
+				subcommand: "down",
+				block_args: ["down"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "kubectl-delete-namespace",
+				command: "kubectl",
+				subcommand: "delete",
+				block_args: [
+					"ns",
+					"namespace",
+					"namespaces"
+				],
+				reason: INFRA_REASON
+			}
+		]
+	}
+};
+function saneYoloEnv(homeDir) {
+	return {
+		CC_SAFETY_NET_HOME: homeDir,
+		CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY: "1",
+		CC_SAFETY_NET_AUDIT_HOME: homeDir,
+		CC_SAFETY_NET_AUDIT_SCOPE: "blocked"
+	};
+}
+//#endregion
+//#region session/core/rtk-hook-core.ts
+var RTK_PATH_ENV = "GLIMMERVOID_RTK_PATH";
+var MAX_RTK_STDOUT_BYTES = 65536;
+function normalizeRtkHookResponse(stdoutText) {
+	if (typeof stdoutText !== "string") return "";
+	const trimmed = stdoutText.trim();
+	if (!trimmed) return "";
+	if (Buffer.byteLength(trimmed) > 65536) return "";
+	let parsed = null;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return "";
+	}
+	if (!isRecord(parsed)) return "";
+	const hookSpecificOutput = parsed.hookSpecificOutput;
+	if (isRecord(hookSpecificOutput) && isRecord(hookSpecificOutput.updatedInput)) {
+		if (typeof hookSpecificOutput.permissionDecision !== "string") hookSpecificOutput.permissionDecision = "allow";
+	}
+	return JSON.stringify(parsed);
+}
+//#endregion
+export { SANE_YOLO_PATH_ENV as a, SANE_YOLO_FILES as i, RTK_PATH_ENV as n, saneYoloEnv as o, normalizeRtkHookResponse as r, MAX_RTK_STDOUT_BYTES as t };

package/dist/chunks/rtk-resolver-BGDzw5XK.js

@@ -0,0 +1,21 @@
+import { i as execSync } from "./child-process-safe-Ch-Zgxqs.js";
+import { n as glimmervoidHomeDir } from "./config-path-core-DFt-TemS.js";
+import { r as resolveRtkPath } from "./hook-tools-UX2fmt81.js";
+import fs from "node:fs";
+import os from "node:os";
+//#region server/rtk-resolver.ts
+function resolveRtkPathFromSystem() {
+	return resolveRtkPath({
+		glimmervoidHome: glimmervoidHomeDir(os.homedir(), process.env),
+		platform: process.platform,
+		exec: execSync,
+		fsApi: fs
+	});
+}
+var cachedRtkPath = null;
+function getRtkPath(resolve = resolveRtkPathFromSystem) {
+	if (!cachedRtkPath) cachedRtkPath = resolve();
+	return cachedRtkPath;
+}
+//#endregion
+export { getRtkPath as t };

package/dist/chunks/rtk-resolver-D4Nke1Fr.js

@@ -0,0 +1,2 @@
+import { t as getRtkPath } from "./rtk-resolver-BGDzw5XK.js";
+export { getRtkPath };

package/dist/chunks/{runtime-paths-CVvq20A4.js → runtime-paths-BPoxENmK.js}

@@ -1,12 +1,9 @@
+import { a as isPathInside } from "./paths-CeJl2Vcg.js";
+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 //#region server/core/runtime-paths.ts
-function isUnder(candidate, parent) {
-	const relative = path.relative(parent, candidate);
-	if (relative === "" || relative.startsWith("..")) return false;
-	return !path.isAbsolute(relative);
-}
 function findPackageRoot(startDirectory, hasPackageJson) {
 	let directory = startDirectory;
 	for (;;) {
@@ -19,7 +16,7 @@ function findPackageRoot(startDirectory, hasPackageJson) {
 function computeRuntimePaths({ moduleFile, hasPackageJson }) {
 	const packageRoot = findPackageRoot(path.dirname(path.resolve(moduleFile)), hasPackageJson);
 	const distDir = path.join(packageRoot, "dist");
-	const bundled = isUnder(path.resolve(moduleFile), distDir);
+	const bundled = isPathInside(distDir, path.resolve(moduleFile), { allowEqual: false });
 	const assetRoot = bundled ? distDir : packageRoot;
 	const sourceExtension = bundled ? ".js" : ".ts";
 	return {
@@ -43,9 +40,32 @@ function hasPackageManifest(directory) {
 		return false;
 	}
 }
-var { assetRoot, bundled, cliPath, clientDir, extensionDir, packageRoot, relayPath } = computeRuntimePaths({
+var runtimePaths = computeRuntimePaths({
 	moduleFile: fileURLToPath(import.meta.url),
 	hasPackageJson: hasPackageManifest
 });
+var { assetRoot, bundled, cliPath, clientDir, extensionDir, packageRoot, relayPath } = runtimePaths;
+var packageBins = /* @__PURE__ */ new Map();
+function resolvePackageBin(packageName, binName) {
+	const cacheKey = `${packageName}:${binName}`;
+	if (packageBins.has(cacheKey)) return packageBins.get(cacheKey) ?? null;
+	const resolvedBin = readPackageBin(packageName, binName);
+	packageBins.set(cacheKey, resolvedBin);
+	return resolvedBin;
+}
+function readPackageBin(packageName, binName) {
+	try {
+		const manifestPath = createRequire(path.join(packageRoot, "package.json")).resolve(`${packageName}/package.json`);
+		const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+		if (!manifest || typeof manifest !== "object" || !("bin" in manifest)) return null;
+		const bins = manifest.bin;
+		const relativeBin = typeof bins === "string" ? bins : bins && typeof bins === "object" ? Reflect.get(bins, binName) : null;
+		if (typeof relativeBin !== "string") return null;
+		const binPath = path.join(path.dirname(manifestPath), relativeBin);
+		return fs.statSync(binPath).isFile() ? binPath : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
-export { packageRoot as a, extensionDir as i, cliPath as n, relayPath as o, clientDir as r, bundled as t };
+export { packageRoot as a, runtimePaths as c, extensionDir as i, cliPath as n, relayPath as o, clientDir as r, resolvePackageBin as s, bundled as t };

package/dist/chunks/runtime-paths-DU5jBEEO.js

@@ -0,0 +1,2 @@
+import { s as resolvePackageBin } from "./runtime-paths-BPoxENmK.js";
+export { resolvePackageBin };

package/dist/chunks/{sandbox-deps-BwvbDBDl.js → sandbox-deps-BPKE-ylr.js}

@@ -1,15 +1,14 @@
-import { i as execSync } from "./child-process-safe-Cz22RwlG.js";
+import { i as execSync } from "./child-process-safe-Ch-Zgxqs.js";
 import { r as resolvePathCommandMatches } from "./spawn-command-Cc40FiZI.js";
 //#region server/core/sandbox-deps-core.ts
-var LINUX_SANDBOX_BINARIES = Object.freeze(["bwrap", "socat"]);
-var NO_SANDBOX_BINARIES = Object.freeze([]);
-var SANDBOX_INSTALL_HINT = "Install bubblewrap and socat, for example: sudo apt install bubblewrap socat";
-var SANDBOXED_LANE_NAMES = Object.freeze([
-	"team review",
-	"Keep mergeable repairs",
-	"workflow sessions",
-	"benchmark runs"
+var LINUX_SANDBOX_BINARIES = Object.freeze([
+	"bwrap",
+	"socat",
+	"rg"
 ]);
+var NO_SANDBOX_BINARIES = Object.freeze([]);
+var SANDBOX_INSTALL_HINT = "Install bubblewrap, socat and ripgrep, for example: sudo apt install bubblewrap socat ripgrep";
+var SANDBOXED_WORK = "sandboxed sessions and factory checks";
 function requiredSandboxBinaries(platform) {
 	return platform === "linux" ? LINUX_SANDBOX_BINARIES : NO_SANDBOX_BINARIES;
 }
@@ -23,16 +22,20 @@ function sandboxDependencyReport({ platform, binariesOnPath }) {
 		installHint: missingBinaries.length > 0 ? SANDBOX_INSTALL_HINT : null
 	};
 }
+function namesList(names) {
+	if (names.length <= 1) return names.join("");
+	return `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
+}
 function missingBinariesPhrase(report) {
-	return `${report.missingBinaries.join(" and ")} ${report.missingBinaries.length === 1 ? "is" : "are"} not on PATH`;
+	return `${namesList(report.missingBinaries)} ${report.missingBinaries.length === 1 ? "is" : "are"} not on PATH`;
 }
 function sandboxSpawnRefusal(report) {
 	if (report.missingBinaries.length === 0) return null;
-	return `not started: the Claude Code sandbox needs ${report.requiredBinaries.join(" and ")}, and ${missingBinariesPhrase(report)}. ${report.installHint}`;
+	return `not started: the sandbox needs ${namesList(report.requiredBinaries)}, and ${missingBinariesPhrase(report)}. ${report.installHint}`;
 }
 function sandboxBootWarning(report) {
 	if (report.missingBinaries.length === 0) return null;
-	return `[sandbox] ${missingBinariesPhrase(report)}, so ${SANDBOXED_LANE_NAMES.join(", ")} will refuse to start sandboxed sessions. ${report.installHint}`;
+	return `[sandbox] ${missingBinariesPhrase(report)}, so ${SANDBOXED_WORK} will refuse to start. ${report.installHint}`;
 }
 function sandboxDoctorRows(report) {
 	if (report.requiredBinaries.length === 0) return [["sandbox", `nothing to check on ${report.platform}`]];
@@ -42,7 +45,7 @@ function sandboxDoctorRows(report) {
 }
 function sandboxInstallNotice(report) {
 	if (report.installHint === null) return null;
-	return `glimmervoid: ${missingBinariesPhrase(report)}; team review, Keep mergeable, workflow sessions and benchmark runs need ${report.requiredBinaries.join(" and ")}. ${report.installHint}`;
+	return `glimmervoid: ${missingBinariesPhrase(report)}; ${SANDBOXED_WORK} need ${namesList(report.requiredBinaries)}. ${report.installHint}`;
 }
 //#endregion
 //#region server/sandbox-deps.ts

package/dist/chunks/sandbox-proxy-core-hnQgKR0T.js

@@ -0,0 +1,27 @@
+import { a as isLoopbackHostname } from "./hook-relay-core-DA_bz2KA.js";
+//#region session/core/sandbox-proxy-core.ts
+var HOOK_VIA_SANDBOX_PROXY_ENV = "GLIMMERVOID_HOOK_VIA_SANDBOX_PROXY";
+function decodeProxyCredential(percentEncoded) {
+	try {
+		return decodeURIComponent(percentEncoded);
+	} catch {
+		return null;
+	}
+}
+function decideSandboxProxy(env) {
+	if (env.SANDBOX_RUNTIME !== "1") return null;
+	const rawProxyUrl = env.HTTP_PROXY || env.http_proxy || "";
+	if (!URL.canParse(rawProxyUrl)) return null;
+	const proxyUrl = new URL(rawProxyUrl);
+	if (proxyUrl.protocol !== "http:" || !proxyUrl.port || !isLoopbackHostname(proxyUrl.hostname)) return null;
+	const username = decodeProxyCredential(proxyUrl.username);
+	const password = decodeProxyCredential(proxyUrl.password);
+	if (username === null || password === null) return null;
+	return {
+		hostname: proxyUrl.hostname.replace(/^\[|\]$/g, ""),
+		port: Number(proxyUrl.port),
+		authorization: username ? `Basic ${Buffer.from(`${username}:${password}`, "utf8").toString("base64")}` : null
+	};
+}
+//#endregion
+export { decideSandboxProxy as n, HOOK_VIA_SANDBOX_PROXY_ENV as t };

package/dist/chunks/{session-CJtOveHl.js → session-fc4pFbon.js}

@@ -81,6 +81,7 @@ function toolDetailLine(toolName, toolInput) {
 var TASK_TITLE_CONTROL_CHARACTERS = /[\x00-\x1f\x7f-\x9f]/;
 var PROMPT_DETAIL_HIDDEN_CHARACTERS = new RegExp(`${TASK_TITLE_CONTROL_CHARACTERS.source}|[\\p{Cf}\\u2028\\u2029]`, "u");
 var TaskTitle = z.string().refine((title) => !TASK_TITLE_CONTROL_CHARACTERS.test(title)).trim().max(120);
+var RefinedTaskTitle = z.object({ title: z.string().nullable() }).strict();
 var SessionState = z.enum(STATES);
 var PendingWakeup = z.object({
 	at: z.number().finite().nullable(),
@@ -111,12 +112,14 @@ var SessionSnapshot = z.object({
 	stateSince: z.number(),
 	sleeping: z.boolean(),
 	dangerouslySkipPermissions: z.boolean(),
+	saneYolo: z.boolean().default(false),
 	ephemeral: z.boolean(),
 	isWorktree: z.boolean(),
 	isWorkspace: z.boolean().default(false),
 	resumeSessionId: z.string().nullable(),
 	activeAgents: z.number().int().nonnegative(),
 	awaitingBackgroundTasks: z.boolean(),
+	isCompacting: z.boolean().default(false),
 	hasEndedTurn: z.boolean().default(false),
 	pendingWakeup: PendingWakeup.nullable(),
 	pendingPromptKind: z.string().nullable(),
@@ -136,7 +139,8 @@ var AGENT_URL_ENV = "GLIMMERVOID_AGENT_URL";
 var AGENT_API_VERBS = [
 	"spawn",
 	"attention",
-	"board"
+	"board",
+	"dispatch"
 ];
 var AgentSpawnRequest = z.object({
 	prompt: z.string({ error: "prompt must be a string" }).min(1, { error: "prompt must not be empty" }).max(2e4, { error: "prompt must be at most 20000 characters" }).refine((prompt) => !prompt.trimStart().startsWith("-"), { message: "prompt must not start with a dash, which the agent CLI would read as an option" }),
@@ -158,5 +162,9 @@ z.object({
 	state: SessionSnapshot.shape.state,
 	ephemeral: SessionSnapshot.shape.ephemeral
 }).strict();
+var AgentDispatchRequest = z.object({
+	workId: z.string().regex(/^wrk-[0-9a-f]{16}$/).optional(),
+	readyIntent: z.string().regex(/^wrk-[0-9a-f]{16}$/).optional()
+}).strict().refine((request) => Boolean(request.workId) !== Boolean(request.readyIntent), "Expected exactly one work id or ready intent");
 //#endregion
-export { toolDetailLine as _, AgentSpawnRequest as a, RESTARTABLE_STATES as b, PendingPromptQuestion as c, SessionState as d, TASK_TITLE_CONTROL_CHARACTERS as f, toolDetailFieldValue as g, firstDetailLine as h, AgentAttentionRequest as i, PendingWakeup as l, isSamePromptQuestion as m, AGENT_URL_ENV as n, PROMPT_DETAIL_HIDDEN_CHARACTERS as o, TaskTitle as p, ASK_USER_QUESTION_TOOL_NAME as r, PendingPromptDetail as s, AGENT_API_VERBS as t, SessionSnapshot as u, KILLABLE_STATES as v, STATES as x, MERGEABLE_LIVE_STATES as y };
+export { STATES as C, RESTARTABLE_STATES as S, firstDetailLine as _, AgentDispatchRequest as a, KILLABLE_STATES as b, PendingPromptDetail as c, RefinedTaskTitle as d, SessionSnapshot as f, isSamePromptQuestion as g, TaskTitle as h, AgentAttentionRequest as i, PendingPromptQuestion as l, TASK_TITLE_CONTROL_CHARACTERS as m, AGENT_URL_ENV as n, AgentSpawnRequest as o, SessionState as p, ASK_USER_QUESTION_TOOL_NAME as r, PROMPT_DETAIL_HIDDEN_CHARACTERS as s, AGENT_API_VERBS as t, PendingWakeup as u, toolDetailFieldValue as v, MERGEABLE_LIVE_STATES as x, toolDetailLine as y };

package/dist/chunks/text-DoirglWV.js

@@ -0,0 +1,21 @@
+//#region shared/text.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function errorText(error) {
+	const failure = error ?? {};
+	return failure.message ? String(failure.message) : String(error);
+}
+function errorCode(error) {
+	const code = error?.code;
+	return typeof code === "string" ? code : void 0;
+}
+function errorLabel(error) {
+	return errorCode(error) || errorText(error);
+}
+function isMissingFileError(error, { includeNotDir = true } = {}) {
+	const code = errorCode(error);
+	return code === "ENOENT" || includeNotDir && code === "ENOTDIR";
+}
+//#endregion
+export { isMissingFileError as a, errorText as i, errorLabel as n, errorMessage as r, errorCode as t };

package/dist/chunks/timer-deps-u2DAQLok.js

@@ -0,0 +1,15 @@
+//#region shared/timer-deps.ts
+var DEFAULT_TIMER_FNS = Object.freeze({
+	setTimeoutFn: (fn, ms) => setTimeout(fn, ms),
+	clearTimeoutFn: (handle) => clearTimeout(handle),
+	setIntervalFn: (fn, ms) => setInterval(fn, ms),
+	clearIntervalFn: (handle) => clearInterval(handle)
+});
+function unrefTimer(handle) {
+	if (typeof handle !== "object" || handle === null) return handle;
+	if (!("unref" in handle) || typeof handle.unref !== "function") return handle;
+	handle.unref();
+	return handle;
+}
+//#endregion
+export { unrefTimer as n, DEFAULT_TIMER_FNS as t };

package/dist/chunks/{visions-cli-DUZnopGY.js → visions-cli-CT5rjiwf.js}

@@ -1,5 +1,5 @@
 import { t as renderTable } from "./ascii-figure-core-pDAwtlKO.js";
-import { a as relayInvocationOptions, c as unwireEverything, d as extensionIdOf, f as buildSetupGuide, h as isExtensionInstalled, i as packVsix, l as wireEverything, m as recipeIds, o as resolveRelayInvocation, p as commandLine, r as editorExtensions, s as resolvedEditorPaths, t as RELAY_PATH, u as editorTargets } from "./visions-setup-C_kJobsy.js";
+import { a as relayInvocationOptions, c as unwireEverything, d as extensionIdOf, f as buildSetupGuide, h as isExtensionInstalled, i as packVsix, l as wireEverything, m as recipeIds, o as resolveRelayInvocation, p as commandLine, r as editorExtensions, s as resolvedEditorPaths, t as RELAY_PATH, u as editorTargets } from "./visions-setup-BmOkI-QE.js";
 import fs from "node:fs";
 //#region server/visions-cli.ts
 function fileOutcomeRows(files) {