glimmervoid 0.30.0 → 0.32.0

package/dist/chunks/{config-store-mm7MgzoL.js → config-store-BVtdHkDK.js}

@@ -1,50 +1,14 @@
+import { n as errorLabel, r as errorMessage } from "./text-DoirglWV.js";
+import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths-CeJl2Vcg.js";
 import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
-import { I as TELEMETRY_KILL_SWITCH_FLAG, N as FeatureFlagsResponse, R as AGENT_ID_SHAPE_MESSAGE, U as RUNTIME_CONFIG_SCALAR_KEYS, V as Config, W as configIssueMessage, q as BranchGcFileSettings, z as BUILTIN_AGENT_IDS } from "./contracts-DGkKNh9W.js";
-import { r as SOURCE_NAMES } from "./ingest-core-DWI1Mbu4.js";
+import { a as positiveIntOr, c as textOr, n as isRecord } from "./coerce-NSst8oRP.js";
+import { d as writeJsonAtomicSync, f as writeTextAtomic, p as writeTextAtomicSync } from "./json-file-oEH9vt-0.js";
+import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-CZ4H51D0.js";
+import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-DXujp-Zn.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-import { promisify } from "node:util";
 import crypto, { createHash } from "node:crypto";
-//#region shared/paths.ts
-var realpathNative = promisify(fs.realpath.native);
-function canonicalizePath(p) {
-	try {
-		return fs.realpathSync.native(p);
-	} catch {
-		return p;
-	}
-}
-function caseFoldedPathKey(value) {
-	return process.platform === "win32" ? value.toLowerCase() : value;
-}
-function equalsIgnoringCaseOnWindows(a, b) {
-	return caseFoldedPathKey(a) === caseFoldedPathKey(b);
-}
-function isSameDirectoryPath(a, b) {
-	const resolvedA = path.resolve(String(a || ""));
-	const resolvedB = path.resolve(String(b || ""));
-	if (equalsIgnoringCaseOnWindows(resolvedA, resolvedB)) return true;
-	if (process.platform !== "win32" && process.platform !== "darwin") return false;
-	return equalsIgnoringCaseOnWindows(canonicalizePath(resolvedA), canonicalizePath(resolvedB));
-}
-async function comparableDirectoryPath(candidatePath) {
-	const resolvedPath = path.resolve(String(candidatePath || ""));
-	let canonicalPath;
-	try {
-		canonicalPath = await realpathNative(resolvedPath);
-	} catch {
-		canonicalPath = resolvedPath;
-	}
-	if (process.platform !== "win32") return canonicalPath;
-	return canonicalPath.toLowerCase();
-}
-function safePathSegment(value) {
-	return String(value).replace(/[<>:"/\\|?*\x00-\x1f]/g, "-").replace(/[. ]+$/, "") || "_";
-}
-function sanitizeWorktreeName(value) {
-	return String(value || "").replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
-}
 var DEFAULT_BRANCH_GC_PREFIXES = ["glimmervoid/session/", "worktree-agent-"];
 var DAY_MS = 864e5;
 var STALE_DELETION_REASON = "stale-orphan";
@@ -201,23 +165,6 @@ function planWorktreeGc({ worktrees, liveWorktreePaths, integrationTips, prefixe
 	};
 }
 //#endregion
-//#region server/core/usage-number-core.ts
-function safeNumber(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return 0;
-	return value;
-}
-function numberOrNull(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return null;
-	return value;
-}
-function stringOrNull(value) {
-	if (typeof value !== "string" || value.length === 0) return null;
-	return value;
-}
-function isPlainObject(value) {
-	return value != null && typeof value === "object" && !Array.isArray(value);
-}
-//#endregion
 //#region server/core/config-secrets-core.ts
 var ENV_SECRET_BINDINGS = Object.freeze([{
 	blockName: "posthog",
@@ -242,7 +189,7 @@ function readEnvSecrets(env) {
 }
 function copyOfBlock(config, blockName) {
 	const block = config[blockName];
-	if (!isPlainObject(block)) return {};
+	if (!isRecord(block)) return {};
 	return { ...block };
 }
 function withEnvSecrets(config, envSecrets) {
@@ -258,7 +205,7 @@ function withoutEnvSecrets(config, envSecrets) {
 	if (envSecrets.length === 0) return config;
 	const stripped = { ...config };
 	for (const secret of envSecrets) {
-		if (!isPlainObject(stripped[secret.blockName])) continue;
+		if (!isRecord(stripped[secret.blockName])) continue;
 		const remaining = copyOfBlock(stripped, secret.blockName);
 		delete remaining[secret.secretKey];
 		if (Object.keys(remaining).length === 0) {
@@ -271,7 +218,7 @@ function withoutEnvSecrets(config, envSecrets) {
 }
 function withSortedKeys(value) {
 	if (Array.isArray(value)) return value.map(withSortedKeys);
-	if (!isPlainObject(value)) return value;
+	if (!isRecord(value)) return value;
 	const sorted = {};
 	for (const key of Object.keys(value).sort()) sorted[key] = withSortedKeys(value[key]);
 	return sorted;
@@ -285,7 +232,7 @@ var POSTHOG_INGEST_HOST = "https://us.i.posthog.com";
 var TELEMETRY_BATCH_URL = `${POSTHOG_INGEST_HOST}/batch/`;
 var TELEMETRY_FLAGS_URL = `${POSTHOG_INGEST_HOST}/flags?v=2`;
 var MAX_STACK_LENGTH = 16384;
-var FIRST_RUN_NOTICE = ["Glimmervoid sends anonymous usage and error data to help improve it: app starts, daily activity, session starts and ends with the agent kind, exit kind and duration, errors as their type, error code and scrubbed stack frames, and per session token counts, models and estimated cost. No error messages, paths, repository names, prompts, model output or terminal output.", "Turn it off in Settings > Privacy, or set GLIMMERVOID_TELEMETRY=0 or DO_NOT_TRACK=1."].join("\n");
+var FIRST_RUN_NOTICE = ["Glimmervoid sends anonymous usage and error data to help improve it: app starts, daily activity, session starts and ends with the agent kind, exit kind and duration, errors as their type, error code and scrubbed stack frames, per session token counts, models and estimated cost, and factory outcomes as the kind of decision, how it came out, its duration and attempt number. No error messages, paths, repository names, prompts, objectives, model output or terminal output.", "Turn it off in Settings > Privacy, or set GLIMMERVOID_TELEMETRY=0 or DO_NOT_TRACK=1."].join("\n");
 var TRUTHY_FLAGS = /* @__PURE__ */ new Set([
 	"1",
 	"true",
@@ -594,11 +541,395 @@ function decideIsDevInstall({ installFlavor, isBundled, homeDir, defaultHomeDir
 	if (installFlavor === "clone" || !isBundled) return true;
 	return comparablePath(homeDir) !== comparablePath(defaultHomeDir);
 }
+function buildFactoryDecisionEvent(decision) {
+	return {
+		kind: decision.kind,
+		outcome: decision.outcome,
+		failure_class: decision.failureClass,
+		duration_ms: decision.durationMs,
+		attempt: decision.attempt
+	};
+}
 function nodeMajorVersion(nodeVersion) {
 	const major = Number.parseInt(nodeVersion.replace(/^v/, ""), 10);
 	return Number.isFinite(major) ? major : 0;
 }
 //#endregion
+//#region shared/display-text.ts
+var SECONDS_PER_MINUTE = 60;
+var HOURS_PER_DAY = 24;
+var UNIT_WORDS = {
+	compact: {
+		second: (count) => `${count}s`,
+		minute: (count) => `${count}m`,
+		hour: (count) => `${count}h`,
+		day: (count) => `${count}d`
+	},
+	abbreviated: {
+		second: (count) => `${count} sec`,
+		minute: (count) => `${count} min`,
+		hour: (count) => `${count} hr`,
+		day: (count) => `${count} ${count === 1 ? "day" : "days"}`
+	},
+	spelled: {
+		second: (count) => `${count} ${count === 1 ? "second" : "seconds"}`,
+		minute: (count) => `${count} ${count === 1 ? "minute" : "minutes"}`,
+		hour: (count) => `${count} ${count === 1 ? "hour" : "hours"}`,
+		day: (count) => `${count} ${count === 1 ? "day" : "days"}`
+	}
+};
+var COMPACT_FLOORED_AGO = {
+	rounding: "floor",
+	wording: "compact",
+	suffix: " ago",
+	justNowBelowSeconds: 0
+};
+function pad2(value) {
+	return String(value).padStart(2, "0");
+}
+function wholeSeconds(elapsedMs, rounding) {
+	return Math.max(0, Math[rounding](elapsedMs / 1e3));
+}
+function largestUnitText(totalSeconds, wording) {
+	const words = UNIT_WORDS[wording];
+	if (totalSeconds < SECONDS_PER_MINUTE) return words.second(totalSeconds);
+	const minutes = Math.floor(totalSeconds / SECONDS_PER_MINUTE);
+	if (minutes < 60) return words.minute(minutes);
+	const hours = Math.floor(minutes / 60);
+	if (hours < HOURS_PER_DAY) return words.hour(hours);
+	return words.day(Math.floor(hours / HOURS_PER_DAY));
+}
+function elapsedText(elapsedMs, options) {
+	const totalSeconds = wholeSeconds(elapsedMs, options.rounding);
+	if (totalSeconds < options.justNowBelowSeconds) return "just now";
+	return `${largestUnitText(totalSeconds, options.wording)}${options.suffix}`;
+}
+function localDayKey(moment) {
+	const date = new Date(moment);
+	return `${date.getFullYear()}-${pad2(date.getMonth() + 1)}-${pad2(date.getDate())}`;
+}
+//#endregion
+//#region server/core/ingest-core.ts
+var SOURCE_NAMES = [
+	"terminal",
+	"agentLogs",
+	"git",
+	"fs",
+	"shellHistory",
+	"editor"
+];
+var SOURCE_DEFAULTS = Object.freeze({
+	terminal: Object.freeze({
+		maxEntries: 200,
+		maxBytes: 262144,
+		digestQuota: 8,
+		flushMs: 500,
+		accumulatorBytes: 8192,
+		windowBytes: 65536
+	}),
+	agentLogs: Object.freeze({
+		maxEntries: 200,
+		maxBytes: 131072,
+		digestQuota: 8,
+		pollMs: 2e3
+	}),
+	git: Object.freeze({
+		maxEntries: 100,
+		maxBytes: 65536,
+		digestQuota: 6,
+		debounceMs: 1e3,
+		pollMs: 6e4
+	}),
+	fs: Object.freeze({
+		maxEntries: 500,
+		maxBytes: 131072,
+		digestQuota: 8,
+		batchMs: 500
+	}),
+	shellHistory: Object.freeze({
+		maxEntries: 100,
+		maxBytes: 32768,
+		digestQuota: 6,
+		pollMs: 2e3
+	}),
+	editor: Object.freeze({
+		maxEntries: 100,
+		maxBytes: 32768,
+		digestQuota: 6
+	})
+});
+var KINDS_BY_SOURCE = Object.freeze({
+	terminal: Object.freeze(["output"]),
+	agentLogs: Object.freeze(["agent-turn", "agent-tool"]),
+	git: Object.freeze([
+		"commit",
+		"status-change",
+		"branch-change"
+	]),
+	fs: Object.freeze(["file-change"]),
+	shellHistory: Object.freeze(["command"]),
+	editor: Object.freeze([
+		"doc-save",
+		"doc-open",
+		"doc-close"
+	])
+});
+var MAX_DETAIL_CHARS = 1e3;
+var MAX_DETAIL_KEYS = 12;
+var DEFAULT_DIGEST_BUDGET_CHARS = 2e3;
+var SCRUB_PLACEHOLDER = "[scrubbed]";
+var DIGEST_HEADER = "Recent activity on this machine, newest first:";
+var LIST_KEYS = Object.freeze({
+	fs: "roots",
+	shellHistory: "shells"
+});
+function stringList(raw) {
+	if (!Array.isArray(raw)) return [];
+	const values = [];
+	for (const entry of raw) {
+		if (typeof entry !== "string" || !entry.trim() || values.includes(entry.trim())) continue;
+		values.push(entry.trim());
+	}
+	return values;
+}
+function disabledSource(name) {
+	const source = {
+		enabled: false,
+		...SOURCE_DEFAULTS[name]
+	};
+	const listKey = LIST_KEYS[name];
+	if (listKey) source[listKey] = [];
+	return source;
+}
+function disabledConfig() {
+	const sources = {};
+	for (const name of SOURCE_NAMES) sources[name] = disabledSource(name);
+	return {
+		enabled: false,
+		sources
+	};
+}
+function resolveSource(name, raw) {
+	const defaults = SOURCE_DEFAULTS[name];
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return disabledSource(name);
+	const rawSource = raw;
+	const resolved = { enabled: rawSource.enabled === true };
+	for (const [key, value] of Object.entries(defaults)) resolved[key] = positiveIntOr(rawSource[key], value);
+	const listKey = LIST_KEYS[name];
+	if (listKey) resolved[listKey] = stringList(rawSource[listKey]);
+	return resolved;
+}
+function resolveIngestConfig(raw) {
+	if (!isRecord(raw)) return disabledConfig();
+	if (raw.enabled !== true) return disabledConfig();
+	const rawSourcesValue = raw.sources;
+	const rawSources = isRecord(rawSourcesValue) ? rawSourcesValue : {};
+	const sources = {};
+	for (const name of SOURCE_NAMES) sources[name] = resolveSource(name, rawSources[name]);
+	return {
+		enabled: true,
+		sources
+	};
+}
+function enabledSourceNames(config) {
+	if (!config || config.enabled !== true) return [];
+	return SOURCE_NAMES.filter((name) => config.sources[name] && config.sources[name].enabled === true);
+}
+var SECRET_WORD = "(?:password|passwd|pwd|token|api[_-]?key|secret|credential|auth[_-]?token|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|connection[_-]?string)";
+var QUOTED_OR_BARE = "(?:\"[^\"\\r\\n]*\"|'[^'\\r\\n]*'|[^\\s\\r\\n]+)";
+var GAP = "[^\\S\\r\\n]";
+var FLAG_REACH = "[^\\r\\n;&|]{0,200}?";
+var SCRUB_PATTERNS = [
+	new RegExp(`(${SECRET_WORD}${GAP}*(?:=>|[:=])${GAP}*)${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`((?:^|\\s)--?${SECRET_WORD}${GAP}+)${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`((?:^|\\s)-(?:pwd|pw)(?![a-z])${GAP}*=?${GAP}*)${QUOTED_OR_BARE}`, "g"),
+	new RegExp(`(-AsPlainText${GAP}+)${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`((?:^|\\s)setx${GAP}+[^\\s\\r\\n]*${SECRET_WORD}[^\\s\\r\\n]*${GAP}+)${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`(\\bBearer${GAP}+)[A-Za-z0-9._~+/=-]{8,}`, "gi"),
+	new RegExp(`(\\bauthorization${GAP}*:${GAP}*Basic${GAP}+)[A-Za-z0-9+/=_-]{8,}`, "gi"),
+	new RegExp(`(\\bdocker${GAP}+login\\b${FLAG_REACH}${GAP}-p(?:${GAP}+|=))${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`(\\bcurl\\b${FLAG_REACH}${GAP}(?:--user|-u)(?:${GAP}+|=)[^\\s:\\r\\n]+:)${QUOTED_OR_BARE}`, "gi"),
+	new RegExp(`(\\b(?:mysql|mysqldump|mysqladmin|mysqlshow|mariadb|mariadb-dump)\\b${FLAG_REACH}${GAP}-p)${QUOTED_OR_BARE}`, "g"),
+	/\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+(?=@)/gi
+];
+var SECRET_SHAPE_PATTERNS = [
+	/\bAKIA[0-9A-Z]{16}\b/g,
+	/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+	/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+	/\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g,
+	/\beyJ[A-Za-z0-9_=-]{6,}\.[A-Za-z0-9_=-]{6,}\.[A-Za-z0-9_=-]{4,}/g,
+	/-----BEGIN(?:[A-Z0-9 ]+)? PRIVATE KEY-----/g
+];
+function scrubText(text) {
+	if (typeof text !== "string" || !text) return typeof text === "string" ? text : "";
+	let scrubbed = text;
+	for (const pattern of SCRUB_PATTERNS) {
+		pattern.lastIndex = 0;
+		scrubbed = scrubbed.replace(pattern, (_match, prefix) => `${prefix}${SCRUB_PLACEHOLDER}`);
+	}
+	for (const pattern of SECRET_SHAPE_PATTERNS) {
+		pattern.lastIndex = 0;
+		scrubbed = scrubbed.replace(pattern, SCRUB_PLACEHOLDER);
+	}
+	return scrubbed;
+}
+function scrubDetail(detail) {
+	if (!detail || typeof detail !== "object" || Array.isArray(detail)) return null;
+	const scrubbed = {};
+	let keys = 0;
+	for (const [key, value] of Object.entries(detail)) {
+		if (keys >= MAX_DETAIL_KEYS) break;
+		keys += 1;
+		if (typeof value === "string") {
+			scrubbed[key] = scrubText(value).slice(0, MAX_DETAIL_CHARS);
+			continue;
+		}
+		if (typeof value === "number" && Number.isFinite(value)) scrubbed[key] = value;
+		if (typeof value === "boolean") scrubbed[key] = value;
+	}
+	return scrubbed;
+}
+function normalizeScope(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {
+		root: null,
+		sessionId: null
+	};
+	const rawScope = raw;
+	return {
+		root: textOr(rawScope.root, null),
+		sessionId: textOr(rawScope.sessionId, null)
+	};
+}
+function normalizeEvent(raw, { seq, now }) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const rawEvent = raw;
+	const source = textOr(rawEvent.source, null);
+	if (!source || !KINDS_BY_SOURCE[source]) return null;
+	const kind = textOr(rawEvent.kind, null);
+	if (!kind || !KINDS_BY_SOURCE[source].includes(kind)) return null;
+	const summary = scrubText(typeof rawEvent.summary === "string" ? rawEvent.summary : "").replace(/\s+/g, " ").trim().slice(0, 400);
+	if (!summary) return null;
+	const ts = Number(rawEvent.ts);
+	return {
+		source,
+		kind,
+		ts: Number.isFinite(ts) && ts > 0 ? Math.floor(ts) : now,
+		seq,
+		scope: normalizeScope(rawEvent.scope),
+		summary,
+		detail: scrubDetail(rawEvent.detail)
+	};
+}
+function eventBytes(event) {
+	return Buffer.byteLength(JSON.stringify(event), "utf8");
+}
+function createRing({ maxEntries, maxBytes }) {
+	return {
+		entries: [],
+		totalBytes: 0,
+		maxEntries,
+		maxBytes
+	};
+}
+function pushToRing(ring, event) {
+	const bytes = eventBytes(event);
+	ring.entries.push({
+		event,
+		bytes
+	});
+	ring.totalBytes += bytes;
+	while (ring.entries.length > 1 && (ring.entries.length > ring.maxEntries || ring.totalBytes > ring.maxBytes)) {
+		const evicted = ring.entries.shift();
+		ring.totalBytes -= evicted ? evicted.bytes : 0;
+	}
+	return event;
+}
+function createIngestStore(config) {
+	const resolved = config?.sources ? config : disabledConfig();
+	const rings = /* @__PURE__ */ new Map();
+	for (const name of enabledSourceNames(resolved)) rings.set(name, createRing(resolved.sources[name]));
+	return {
+		config: resolved,
+		rings,
+		seq: 0
+	};
+}
+function publishEvent(store, raw, now) {
+	const source = textOr((raw ?? null)?.source, null);
+	if (!source) return null;
+	const ring = store.rings.get(source);
+	if (!ring) return null;
+	const event = normalizeEvent(raw, {
+		seq: store.seq + 1,
+		now
+	});
+	if (!event) return null;
+	store.seq += 1;
+	return pushToRing(ring, event);
+}
+function latestSeq(store) {
+	const seq = Number(store?.seq);
+	if (!Number.isFinite(seq)) return 0;
+	return seq;
+}
+function snapshotEvents(store, { limit = 200 } = {}) {
+	const all = [];
+	for (const ring of store.rings.values()) for (const entry of ring.entries) all.push(entry.event);
+	all.sort((left, right) => right.seq - left.seq);
+	return all.slice(0, Math.max(0, Math.floor(limit)));
+}
+function ringStats(store) {
+	const stats = [];
+	for (const [source, ring] of store.rings) stats.push({
+		source,
+		events: ring.entries.length,
+		bytes: ring.totalBytes
+	});
+	return stats;
+}
+var SOURCE_LABELS = Object.freeze({
+	terminal: "terminal",
+	agentLogs: "agent",
+	git: "git",
+	fs: "files",
+	shellHistory: "shell",
+	editor: "editor"
+});
+function digestLine(event, now) {
+	const label = SOURCE_LABELS[event.source] || event.source;
+	const scope = event.scope.root ? "" : " (machine scope)";
+	return `- ${label} ${elapsedText(now - event.ts, COMPACT_FLOORED_AGO)}${scope}: ${event.summary}`;
+}
+function matchesScopes(event, scopes) {
+	if (!Array.isArray(scopes) || scopes.length === 0) return true;
+	if (!event.scope.root) return true;
+	return scopes.includes(event.scope.root);
+}
+function buildContextDigest(store, { scopes = null, budgetChars = DEFAULT_DIGEST_BUDGET_CHARS, now = NaN } = {}) {
+	const budget = positiveIntOr(budgetChars, DEFAULT_DIGEST_BUDGET_CHARS);
+	const candidates = [];
+	const takenBySource = /* @__PURE__ */ new Map();
+	for (const event of snapshotEvents(store, { limit: Number.MAX_SAFE_INTEGER })) {
+		if (!matchesScopes(event, scopes)) continue;
+		const quota = store.config.sources[event.source].digestQuota;
+		const taken = takenBySource.get(event.source) || 0;
+		if (taken >= quota) continue;
+		takenBySource.set(event.source, taken + 1);
+		candidates.push(event);
+	}
+	if (candidates.length === 0) return "";
+	const lines = [DIGEST_HEADER];
+	let used = 46;
+	for (const event of candidates) {
+		const line = scrubText(digestLine(event, now));
+		if (used + line.length + 1 > budget) break;
+		lines.push(line);
+		used += line.length + 1;
+	}
+	if (lines.length === 1) return "";
+	return lines.join("\n");
+}
+//#endregion
 //#region server/core/settings-block-core.ts
 var NO_BLOCKS = Object.freeze({});
 var INGEST_SOURCES_SPEC = Object.freeze({
@@ -617,7 +948,7 @@ var INGEST_SPEC = Object.freeze({
 });
 function validateSettingsBlock(block, spec) {
 	if (block == null) return null;
-	if (!isPlainObject(block)) return `${spec.name} must be an object`;
+	if (!isRecord(block)) return `${spec.name} must be an object`;
 	for (const [key, value] of Object.entries(block)) {
 		if (value == null) continue;
 		if (spec.booleans.includes(key)) {
@@ -634,7 +965,7 @@ function validateSettingsBlock(block, spec) {
 	return null;
 }
 function pickSettingsBlock(stored, spec) {
-	if (!isPlainObject(stored)) return null;
+	if (!isRecord(stored)) return null;
 	const fields = stored;
 	const out = {};
 	for (const key of spec.booleans) if (fields[key] != null) out[key] = !!fields[key];
@@ -645,8 +976,8 @@ function pickSettingsBlock(stored, spec) {
 	return out;
 }
 function mergeSettingsBlock(stored, incoming, spec) {
-	const out = isPlainObject(stored) ? { ...stored } : {};
-	if (!isPlainObject(incoming)) return out;
+	const out = isRecord(stored) ? { ...stored } : {};
+	if (!isRecord(incoming)) return out;
 	const fields = incoming;
 	for (const key of spec.booleans) if (fields[key] != null) out[key] = !!fields[key];
 	for (const [key, nested] of Object.entries(spec.blocks)) {
@@ -656,230 +987,89 @@ function mergeSettingsBlock(stored, incoming, spec) {
 	return out;
 }
 //#endregion
-//#region server/json-file.ts
-var tmpCounter = 0;
-function tmpPathFor(filePath) {
-	tmpCounter += 1;
-	return `${filePath}.tmp.${process.pid}.${tmpCounter}`;
-}
-function writeOptions(mode, encoding) {
-	if (mode == null) return { encoding };
+//#region server/core/rtk-install-core.ts
+var RTK_VERSION = "0.45.0";
+var RTK_RELEASE_BASE_URL = "https://github.com/rtk-ai/rtk/releases/download/v0.45.0/";
+var RTK_ASSETS = {
+	"linux-x64": {
+		file: "rtk-x86_64-unknown-linux-musl.tar.gz",
+		sha256: "c4c036fbf181fc55ef329786c8c17e0d427972b053b825944d968a6aafef1ba4"
+	},
+	"linux-arm64": {
+		file: "rtk-aarch64-unknown-linux-gnu.tar.gz",
+		sha256: "80a746dd305ef944ff50ef011ae4ce3878dd5ba88dfe35d859d05498191637c3"
+	},
+	"win32-x64": {
+		file: "rtk-x86_64-pc-windows-msvc.zip",
+		sha256: "34cea9009a8099acdaf85147b971d95f65efabfa63fb3aea7d3e2b73e6f517c3"
+	},
+	"darwin-x64": {
+		file: "rtk-x86_64-apple-darwin.tar.gz",
+		sha256: "9ea02f889d5a2779e4fb700df4587824303c5a57cda22e903e30058079fca0ef"
+	},
+	"darwin-arm64": {
+		file: "rtk-aarch64-apple-darwin.tar.gz",
+		sha256: "064151cfc2d50b24d810b06a0af2e41b9c945e83534e4c438c3d3eae607fc3f4"
+	}
+};
+var INSTALL_FAILURE_COOLDOWN_MS = 6e5;
+function assetForPlatform(platform, arch) {
+	const entry = RTK_ASSETS[`${platform}-${arch}`];
+	if (!entry) return null;
 	return {
-		encoding,
-		mode
+		...entry,
+		version: RTK_VERSION,
+		url: `${RTK_RELEASE_BASE_URL}${entry.file}`
 	};
 }
-var RENAME_RETRY_CODES = /* @__PURE__ */ new Set([
-	"EPERM",
-	"EACCES",
-	"EBUSY"
-]);
-function renameRetryDelayMs(attempt) {
-	return Math.min(10 * 2 ** attempt, 50);
-}
-function isRetryableRename(error, attempt) {
-	if (attempt >= 4) return false;
-	const code = error?.code;
-	return typeof code === "string" && RENAME_RETRY_CODES.has(code);
-}
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function renameRetryPlan(error, attempt) {
-	if (!isRetryableRename(error, attempt)) return null;
-	return renameRetryDelayMs(attempt);
-}
-function isMissingFileError(error) {
-	const code = error?.code;
-	return code === "ENOENT" || code === "ENOTDIR";
-}
-function errorText(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-async function loadJsonStateFile({ filePath, fsPromises, parse, nowMs }) {
-	let text;
-	try {
-		text = await fsPromises.readFile(filePath, "utf8");
-	} catch (error) {
-		if (isMissingFileError(error)) return { status: "missing" };
-		return {
-			status: "unreadable",
-			error
-		};
-	}
-	let value;
-	try {
-		value = parse(JSON.parse(text));
-	} catch {
-		value = null;
-	}
-	if (value !== null) return {
-		status: "loaded",
-		value
+function decideRtkInstall({ rtkEnabled, resolvedPath, platform, arch, inFlight = false, lastFailureAt = null, nowMs = 0, cooldownMs = INSTALL_FAILURE_COOLDOWN_MS } = {}) {
+	if (!rtkEnabled) return {
+		action: "skip",
+		reason: "rtk-disabled"
+	};
+	if (resolvedPath) return {
+		action: "skip",
+		reason: "already-resolved"
+	};
+	if (inFlight) return {
+		action: "skip",
+		reason: "install-in-flight"
+	};
+	const asset = assetForPlatform(String(platform), String(arch));
+	if (!asset) return {
+		action: "skip",
+		reason: `unsupported-platform:${platform}-${arch}`
+	};
+	if (typeof lastFailureAt === "number" && nowMs - lastFailureAt < cooldownMs) return {
+		action: "skip",
+		reason: "failure-cooldown"
 	};
-	const movedTo = `${filePath}.corrupt-${nowMs()}`;
-	try {
-		await fsPromises.rename(filePath, movedTo);
-	} catch (error) {
-		return {
-			status: "unreadable",
-			error
-		};
-	}
 	return {
-		status: "quarantined",
-		movedTo
+		action: "install",
+		reason: "missing-binary",
+		asset
 	};
 }
-function renameWithRetrySync(fsSync, tmpPath, filePath) {
-	for (let attempt = 0;; attempt += 1) try {
-		fsSync.renameSync(tmpPath, filePath);
-		return;
-	} catch (error) {
-		const delayMs = renameRetryPlan(error, attempt);
-		if (delayMs === null) throw error;
-		sleepSync(delayMs);
-	}
+function verifyDigest(expectedHex, actualHex) {
+	if (typeof expectedHex !== "string" || typeof actualHex !== "string") return false;
+	if (expectedHex.length !== actualHex.length) return false;
+	return crypto.timingSafeEqual(Buffer.from(expectedHex, "utf8"), Buffer.from(actualHex, "utf8"));
 }
-async function renameWithRetry(fsPromises, tmpPath, filePath) {
-	for (let attempt = 0;; attempt += 1) try {
-		await fsPromises.rename(tmpPath, filePath);
-		return;
-	} catch (error) {
-		const delayMs = renameRetryPlan(error, attempt);
-		if (delayMs === null) throw error;
-		await new Promise((resolve) => {
-			setTimeout(resolve, delayMs);
-		});
-	}
+function installTargetPath(glimmervoidHome, platform) {
+	const binaryName = platform === "win32" ? "rtk.exe" : "rtk";
+	return path.join(glimmervoidHome, "bin", binaryName);
 }
-function writeTextAtomicSync(filePath, content, { mode, encoding = "utf8", mkdir = false, fsSync = fs } = {}) {
-	if (mkdir) fsSync.mkdirSync(path.dirname(filePath), { recursive: true });
-	const tmpPath = tmpPathFor(filePath);
-	fsSync.writeFileSync(tmpPath, content, writeOptions(mode, encoding));
-	try {
-		renameWithRetrySync(fsSync, tmpPath, filePath);
-	} catch (error) {
-		fsSync.rmSync(tmpPath, { force: true });
-		throw error;
-	}
+function isRtkBinaryName(name, platform) {
+	const wanted = platform === "win32" ? "rtk.exe" : "rtk";
+	return name.toLowerCase() === wanted;
 }
-function writeJsonAtomicSync(filePath, value, options) {
-	writeTextAtomicSync(filePath, JSON.stringify(value, null, 2), options);
-}
-async function writeTextAtomic(filePath, content, { mode, encoding = "utf8", mkdir = false, fsPromises = fs.promises } = {}) {
-	if (mkdir) await fsPromises.mkdir(path.dirname(filePath), { recursive: true });
-	const tmpPath = tmpPathFor(filePath);
-	await fsPromises.writeFile(tmpPath, content, writeOptions(mode, encoding));
-	try {
-		await renameWithRetry(fsPromises, tmpPath, filePath);
-	} catch (error) {
-		try {
-			await fsPromises.rm(tmpPath, { force: true });
-		} catch {}
-		throw error;
-	}
-}
-async function writeJsonAtomic(filePath, value, options) {
-	await writeTextAtomic(filePath, JSON.stringify(value, null, 2), options);
-}
-var appendChains = /* @__PURE__ */ new Map();
-function appendChained(filePath, payload, { fsPromises = fs.promises, mkdir = false, encoding = "utf8", mode } = {}) {
-	const next = (appendChains.get(filePath) || Promise.resolve()).then(async () => {
-		if (mkdir) await fsPromises.mkdir(path.dirname(filePath), { recursive: true });
-		await fsPromises.appendFile(filePath, payload, writeOptions(mode, encoding));
-	});
-	const settled = next.then(() => {}, () => {});
-	appendChains.set(filePath, settled);
-	settled.then(() => {
-		if (appendChains.get(filePath) === settled) appendChains.delete(filePath);
-	});
-	return next;
-}
-function appendJsonLine(filePath, value, options) {
-	return appendChained(filePath, `${JSON.stringify(value)}\n`, options);
-}
-function appendJsonLines(filePath, values, options) {
-	if (values.length === 0) return Promise.resolve();
-	return appendChained(filePath, values.map((value) => `${JSON.stringify(value)}\n`).join(""), options);
-}
-function createJsonStateWriter({ filePath, fsPromises = fs.promises, warn = () => {} }) {
-	let signature = null;
-	let writeChain = Promise.resolve();
-	async function commit(payload) {
-		try {
-			await writeTextAtomic(filePath, payload, {
-				fsPromises,
-				mkdir: true
-			});
-		} catch (error) {
-			warn(error);
-			signature = null;
-		}
-	}
-	async function write(subject, buildPayload) {
-		const next = JSON.stringify(subject);
-		if (next === signature) return;
-		signature = next;
-		writeChain = writeChain.then(() => commit(buildPayload())).catch(() => {});
-		await writeChain;
-	}
-	function reset() {
-		signature = null;
-	}
-	return {
-		write,
-		reset,
-		idle: () => writeChain
-	};
-}
-function createJsonStateStore({ name, filePath, fsPromises = fs.promises, parse, adopt, nowMs = Date.now, warn = () => {} }) {
-	const writer = filePath ? createJsonStateWriter({
-		filePath,
-		fsPromises,
-		warn: (error) => warn(`${name} write failed`, { error: errorText(error) })
-	}) : null;
-	let isFileReadable = true;
-	let loadPromise = null;
-	function load() {
-		const statePath = filePath;
-		if (!statePath) return Promise.resolve();
-		if (loadPromise) return loadPromise;
-		loadPromise = (async () => {
-			const outcome = await loadJsonStateFile({
-				filePath: statePath,
-				fsPromises,
-				parse,
-				nowMs
-			});
-			if (outcome.status === "unreadable") {
-				isFileReadable = false;
-				loadPromise = null;
-				warn(`${name} unreadable`, {
-					path: statePath,
-					error: errorText(outcome.error)
-				});
-				return;
-			}
-			if (outcome.status === "quarantined") warn(`${name} quarantined`, {
-				path: statePath,
-				movedTo: outcome.movedTo
-			});
-			isFileReadable = true;
-			adopt(outcome.status === "loaded" ? outcome.value : null);
-			writer?.reset();
-		})();
-		return loadPromise;
-	}
-	async function write(subject, buildPayload) {
-		if (!writer || !isFileReadable) return;
-		await writer.write(subject, buildPayload);
+function findEscapingArchiveMember(listingText) {
+	const members = String(listingText || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const member of members) {
+		if (member.split(/[\\/]+/).includes("..")) return member;
+		if (member.startsWith("/") || member.startsWith("\\") || /^[A-Za-z]:/.test(member)) return member;
 	}
-	return {
-		load,
-		write,
-		idle: () => writer ? writer.idle() : Promise.resolve()
-	};
+	return null;
 }
 //#endregion
 //#region server/config-store.ts
@@ -911,13 +1101,30 @@ var DEFAULT_CONFIG = {
 		model: "",
 		timeoutSeconds: 90
 	} },
+	factory: {
+		enabled: false,
+		maxRisk: "medium",
+		maxLiveWorkers: 2,
+		checks: DEFAULT_FACTORY_CHECKS,
+		protectedPaths: DEFAULT_FACTORY_PROTECTED_PATHS,
+		reviewerModel: null,
+		watchWindowMinutes: 30,
+		watchProjects: [],
+		dailyBudgetUsd: null,
+		verifierModel: null,
+		mirrorHarnessRuns: false
+	},
 	agentApi: { enabled: false },
+	sandbox: {
+		unconfinedRepos: [],
+		writablePaths: ["~/.npm", "~/.cache"],
+		unreadablePaths: []
+	},
 	telemetry: { enabled: true },
 	checkForUpdates: true,
 	updateChannel: "release",
 	autoResume: true,
 	skipPermissionsByDefault: false,
-	antiSlopPrompt: false,
 	rtk: false,
 	saneYolo: true,
 	telegramNotifications: false,
@@ -969,14 +1176,6 @@ var DEFAULT_CONFIG = {
 };
 var DEFAULT_CONFIG_BY_KEY = DEFAULT_CONFIG;
 var ABORT_CONFIG_SAVE = "abort-config-save";
-function errorCode(error) {
-	const source = error ?? {};
-	if (typeof source.code === "string") return source.code;
-	return typeof source.message === "string" ? source.message : String(error);
-}
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 function glimmervoidHomeDir() {
 	return glimmervoidHomeDir$1(os.homedir(), process.env);
 }
@@ -1002,11 +1201,10 @@ function resolveConfigPath() {
 		mode: 448
 	});
 	restrictMode(homeDir, 448);
-	fs.writeFileSync(homeConfig, JSON.stringify(DEFAULT_CONFIG, null, 2), {
-		encoding: "utf8",
-		mode: 384
+	writeJsonAtomicSync(homeConfig, DEFAULT_CONFIG, {
+		mode: 384,
+		enforceMode: true
 	});
-	restrictMode(homeConfig, 384);
 	console.log(`Created default config at ${homeConfig}`);
 	return homeConfig;
 }
@@ -1014,7 +1212,7 @@ function generateProjectId() {
 	return crypto.randomUUID();
 }
 function validateConfig(candidate) {
-	if (!isPlainObject(candidate)) return {
+	if (!isRecord(candidate)) return {
 		ok: false,
 		errors: ["config must be a plain object"]
 	};
@@ -1025,6 +1223,7 @@ function validateConfig(candidate) {
 			if (issue.code === "custom") return issue.message;
 			const [root, index, field] = issue.path;
 			if (root === "port") return "port must be an integer from 0 to 65535";
+			if (root === "replayBufferKB") return issue.message;
 			if (root === "repoRoots" || root === "worktreeShare") return `${root} must be an array of strings`;
 			if (root === "remote") return "remote must be a plain object";
 			if (root !== "projects" && typeof DEFAULT_CONFIG_BY_KEY[String(root)] === "number") return `${String(root)} must be a finite number greater than or equal to 0`;
@@ -1042,8 +1241,8 @@ function validateConfig(candidate) {
 	};
 }
 function normalizeConfigFile(candidate) {
-	if (!isPlainObject(candidate)) throw new Error("config must be a plain object");
-	const draft = candidate;
+	if (!isRecord(candidate)) throw new Error("config must be a plain object");
+	const draft = normalizeLegacyConfigNumbers(candidate);
 	for (const [key, fallback] of Object.entries(DEFAULT_CONFIG_BY_KEY)) {
 		if (fallback === null || typeof fallback === "object") continue;
 		if (!Object.hasOwn(draft, key)) continue;
@@ -1058,13 +1257,12 @@ function normalizeConfigFile(candidate) {
 }
 function writeBackupContent(backupPath, content) {
 	try {
-		fs.writeFileSync(backupPath, content, {
-			encoding: "utf8",
-			mode: 384
+		writeTextAtomicSync(backupPath, content, {
+			mode: 384,
+			enforceMode: true
 		});
-		restrictMode(backupPath, 384);
 	} catch (err) {
-		console.warn(`[config] Failed to write backup ${backupPath}:`, errorCode(err));
+		console.warn(`[config] Failed to write backup ${backupPath}:`, errorLabel(err));
 	}
 }
 function loadConfigFile(configPath, { exitOnError = true } = {}) {
@@ -1077,13 +1275,12 @@ function loadConfigFile(configPath, { exitOnError = true } = {}) {
 	} catch (err) {
 		const invalidBackupPath = `${configPath}.invalid.bak`;
 		try {
-			fs.writeFileSync(invalidBackupPath, loadedContent, {
-				encoding: "utf8",
-				mode: 384
+			writeTextAtomicSync(invalidBackupPath, loadedContent, {
+				mode: 384,
+				enforceMode: true
 			});
-			restrictMode(invalidBackupPath, 384);
 		} catch (backupErr) {
-			console.warn(`[config] Failed to save invalid config copy ${invalidBackupPath}:`, errorCode(backupErr));
+			console.warn(`[config] Failed to save invalid config copy ${invalidBackupPath}:`, errorLabel(backupErr));
 		}
 		const message = `[config] Could not load ${configPath}: ${errorMessage(err)}. The broken file was copied to ${invalidBackupPath} when possible. Restore from ${configPath}.boot.bak or ${configPath}.bak, then restart Glimmervoid.`;
 		if (!exitOnError) return {
@@ -1096,7 +1293,7 @@ function loadConfigFile(configPath, { exitOnError = true } = {}) {
 	}
 }
 function topLevelKeyCount(candidate) {
-	if (!isPlainObject(candidate)) return 0;
+	if (!isRecord(candidate)) return 0;
 	return Object.keys(candidate).length;
 }
 function isSuspectedExternalWipe(candidate, currentConfig) {
@@ -1122,7 +1319,7 @@ function ensureProjectIds(projects) {
 	return changed;
 }
 function collectBranchGcIssues(branchGc) {
-	if (!isPlainObject(branchGc)) return {
+	if (!isRecord(branchGc)) return {
 		block: { ...DEFAULT_CONFIG.branchGc },
 		issues: []
 	};
@@ -1183,7 +1380,7 @@ var TELEGRAM_SETTINGS_KEYS = Object.freeze(["chatId"]);
 var TELEGRAM_SECRET_KEYS = Object.freeze(["botToken"]);
 var SECRET_PRESENCE_SUFFIX = "Configured";
 function pickRedactedBlock(stored, allowedKeys, secretKeys) {
-	if (!isPlainObject(stored)) return null;
+	if (!isRecord(stored)) return null;
 	const source = stored;
 	const redacted = {};
 	for (const key of allowedKeys) if (source[key] !== void 0) redacted[key] = source[key];
@@ -1214,20 +1411,10 @@ function createConfigStore({ settingsDefaults } = {}) {
 	}
 	let _lastWrittenContent = null;
 	let _lastAppliedContent = loadedConfig.loadedContent;
-	function save(mutatorFn) {
-		let loaded;
-		try {
-			loaded = loadConfigFile(configPath, { exitOnError: false });
-		} catch (err) {
-			console.warn("[config] Failed to read config.json for save:", errorCode(err));
-			return null;
-		}
-		if ("error" in loaded) {
-			console.warn(loaded.message);
-			return null;
-		}
-		const freshConfig = loaded.config;
-		const freshContent = loaded.loadedContent;
+	let synchronousWriteRevision = 0;
+	let lastSynchronousContent = null;
+	let pendingSaves = Promise.resolve();
+	function prepareSave(freshConfig, mutatorFn) {
 		const freshValidation = validateConfig(freshConfig);
 		if (!freshValidation.ok) {
 			warnInvalidConfig("save config.json", freshValidation);
@@ -1238,23 +1425,86 @@ function createConfigStore({ settingsDefaults } = {}) {
 			return null;
 		}
 		if (mutatorFn(freshConfig) === "abort-config-save") return null;
-		const effectiveConfig = withEnvSecrets(freshConfig, envSecrets);
-		const mutatedValidation = validateConfig(effectiveConfig);
+		const mutatedValidation = validateConfig(withEnvSecrets(freshConfig, envSecrets));
 		if (!mutatedValidation.ok) {
 			warnInvalidConfig("save config.json", mutatedValidation);
 			return null;
 		}
+		return mutatedValidation.config;
+	}
+	function save(mutatorFn) {
+		let loaded;
+		try {
+			loaded = loadConfigFile(configPath, { exitOnError: false });
+		} catch (err) {
+			console.warn("[config] Failed to read config.json for save:", errorLabel(err));
+			return null;
+		}
+		if ("error" in loaded) {
+			console.warn(loaded.message);
+			return null;
+		}
+		const freshConfig = loaded.config;
+		const freshContent = loaded.loadedContent;
+		const effectiveConfig = prepareSave(freshConfig, mutatorFn);
+		if (!effectiveConfig) return null;
 		try {
 			const nextContent = JSON.stringify(withoutEnvSecrets(effectiveConfig, envSecrets), null, 2);
 			if (freshContent !== nextContent) writeBackupContent(`${configPath}.bak`, freshContent);
 			_lastWrittenContent = nextContent;
 			_lastAppliedContent = null;
 			writeTextAtomicSync(configPath, nextContent, { mode: 384 });
+			lastSynchronousContent = nextContent;
+			synchronousWriteRevision++;
 		} catch (err) {
-			console.warn("[config] Failed to write config.json:", errorCode(err));
+			console.warn("[config] Failed to write config.json:", errorLabel(err));
 			return null;
 		}
-		return mutatedValidation.config;
+		return effectiveConfig;
+	}
+	function saveAsync(mutatorFn) {
+		const scheduledSave = pendingSaves.then(async () => {
+			let concurrentContent = null;
+			for (;;) {
+				const revision = synchronousWriteRevision;
+				try {
+					const diskContent = await fs.promises.readFile(configPath, "utf8");
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					const freshContent = concurrentContent ?? diskContent;
+					const effectiveConfig = prepareSave(withEnvSecrets(normalizeConfigFile(JSON.parse(freshContent)), envSecrets), mutatorFn);
+					if (!effectiveConfig) return null;
+					const nextContent = JSON.stringify(withoutEnvSecrets(effectiveConfig, envSecrets), null, 2);
+					if (freshContent !== nextContent) try {
+						await writeTextAtomic(`${configPath}.bak`, freshContent, {
+							mode: 384,
+							enforceMode: process.platform !== "win32"
+						});
+					} catch (error) {
+						console.warn(`[config] Failed to write backup ${configPath}.bak:`, errorLabel(error));
+					}
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					await writeTextAtomic(configPath, nextContent, { mode: 384 });
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					_lastWrittenContent = nextContent;
+					_lastAppliedContent = null;
+					return effectiveConfig;
+				} catch (error) {
+					console.warn("[config] Failed to save config.json asynchronously:", errorMessage(error));
+					return null;
+				}
+			}
+		});
+		pendingSaves = scheduledSave;
+		return scheduledSave;
 	}
 	function getSettings() {
 		return {
@@ -1272,10 +1522,14 @@ function createConfigStore({ settingsDefaults } = {}) {
 			recordSignals: config.recordSignals ?? effectiveDefaults.recordSignals,
 			trace: { enabled: config.trace?.enabled ?? DEFAULT_CONFIG.trace.enabled },
 			agentApi: { enabled: config.agentApi?.enabled ?? DEFAULT_CONFIG.agentApi.enabled },
+			sandbox: {
+				...DEFAULT_CONFIG.sandbox,
+				...config.sandbox
+			},
 			telemetry: { enabled: config.telemetry?.enabled ?? DEFAULT_CONFIG.telemetry.enabled },
 			telemetryForcedOff: isTelemetryForcedOff(process.env),
-			antiSlopPrompt: config.antiSlopPrompt ?? effectiveDefaults.antiSlopPrompt,
 			rtk: config.rtk ?? effectiveDefaults.rtk,
+			rtkInstallSupported: assetForPlatform(process.platform, process.arch) !== null,
 			saneYolo: config.saneYolo ?? effectiveDefaults.saneYolo,
 			checkForUpdates: config.checkForUpdates ?? effectiveDefaults.checkForUpdates,
 			updateChannel: config.updateChannel ?? effectiveDefaults.updateChannel,
@@ -1286,15 +1540,20 @@ function createConfigStore({ settingsDefaults } = {}) {
 			worktreeRoot: config.worktreeRoot ?? effectiveDefaults.worktreeRoot,
 			worktreeShare: config.worktreeShare ?? effectiveDefaults.worktreeShare,
 			repoRoots: config.repoRoots,
+			repositoryRootCaseInsensitive: equalsIgnoringCaseOnWindows("root", "ROOT"),
 			taskTitle: config.taskTitle ? { ...config.taskTitle } : { ...DEFAULT_CONFIG.taskTitle },
 			changeMap: config.changeMap ? { ...config.changeMap } : null,
 			branchGc: { ...config.branchGc },
 			postTurnChecks: config.postTurnChecks ? { ...config.postTurnChecks } : { ...DEFAULT_CONFIG.postTurnChecks },
 			visions: config.visions ? { ...config.visions } : null,
+			github: config.github ? { ...config.github } : null,
 			teamReview: config.teamReview ? { ...config.teamReview } : null,
 			benchmarks: config.benchmarks ? { ...config.benchmarks } : null,
+			factory: config.factory ? { ...config.factory } : null,
+			knowledgeGraph: config.knowledgeGraph ? { ...config.knowledgeGraph } : null,
 			workflows: config.workflows ?? null,
 			posthog: pickRedactedBlock(config.posthog, POSTHOG_SETTINGS_KEYS, POSTHOG_SECRET_KEYS),
+			secretSources: Object.fromEntries(readEnvSecrets(process.env).map((secret) => [`${secret.blockName}.${secret.secretKey}`, secret.environmentVariable])),
 			usage: config.usage ? { ...config.usage } : null,
 			telegram: pickRedactedBlock(config.telegram, TELEGRAM_SETTINGS_KEYS, TELEGRAM_SECRET_KEYS),
 			ingest: pickSettingsBlock(config.ingest, INGEST_SPEC),
@@ -1331,13 +1590,17 @@ function createConfigStore({ settingsDefaults } = {}) {
 		if (newConfig.changeMap != null) config.changeMap = newConfig.changeMap;
 		if (newConfig.branchGc != null) config.branchGc = resolveBranchGc(newConfig.branchGc);
 		if (newConfig.visions != null) config.visions = newConfig.visions;
+		if (newConfig.github != null) config.github = newConfig.github;
 		if (newConfig.teamReview != null) config.teamReview = newConfig.teamReview;
 		if (newConfig.benchmarks != null) config.benchmarks = newConfig.benchmarks;
+		if (newConfig.factory != null) config.factory = newConfig.factory;
+		if (newConfig.knowledgeGraph != null) config.knowledgeGraph = newConfig.knowledgeGraph;
 		if (newConfig.posthog != null) config.posthog = newConfig.posthog;
 		if (newConfig.usage != null) config.usage = newConfig.usage;
 		if (newConfig.telegram != null) config.telegram = newConfig.telegram;
 		if (newConfig.ingest != null) config.ingest = newConfig.ingest;
 		if (newConfig.agentApi != null) config.agentApi = newConfig.agentApi;
+		if (newConfig.sandbox != null) config.sandbox = newConfig.sandbox;
 		if (newConfig.telemetry != null) config.telemetry = newConfig.telemetry;
 		if (newConfig.workflows == null) delete config.workflows;
 		if (newConfig.workflows != null) config.workflows = newConfig.workflows;
@@ -1401,6 +1664,8 @@ function createConfigStore({ settingsDefaults } = {}) {
 		config,
 		configPath,
 		save,
+		saveAsync,
+		idle: () => pendingSaves,
 		getSettings,
 		applySettings,
 		isUnchosenLaunchDefault,
@@ -1409,4 +1674,4 @@ function createConfigStore({ settingsDefaults } = {}) {
 	};
 }
 //#endregion
-export { sanitizeWorktreeName as $, decideTelemetryConsent as A, DEFAULT_BRANCH_GC_PREFIXES as B, adapterBucket as C, classifySessionExit as D, buildExceptionProperties as E, stableConfigKey as F, usablePrefixes as G, planBranchGc as H, isPlainObject as I, caseFoldedPathKey as J, worktreeIntegrationTips as K, numberOrNull as L, nodeMajorVersion as M, parsePosthogReleaseId as N, decideIsDevInstall as O, resolveProjectToken as P, safePathSegment as Q, safeNumber as R, TELEMETRY_FLAGS_URL as S, buildBrowserExceptionProperties as T, planWorktreeGc as U, matchedPrefix as V, sessionIdFromBranch as W, equalsIgnoringCaseOnWindows as X, comparableDirectoryPath as Y, isSameDirectoryPath as Z, INGEST_SPEC as _, ensureProjectIds as a, FIRST_RUN_NOTICE as b, loadConfigFile as c, appendJsonLine as d, appendJsonLines as f, writeJsonAtomicSync as g, writeJsonAtomic as h, createConfigStore as i, exceptionFingerprint as j, decideRemoteTelemetryState as k, resolveConfigPath as l, createJsonStateWriter as m, DEFAULT_CONFIG as n, generateProjectId as o, createJsonStateStore as p, canonicalizePath as q, SECRET_PRESENCE_SUFFIX as r, glimmervoidHomeDir as s, ABORT_CONFIG_SAVE as t, validateConfig as u, mergeSettingsBlock as v, buildAiGenerationEvents as w, TELEMETRY_BATCH_URL as x, validateSettingsBlock as y, stringOrNull as z };
+export { sessionIdFromBranch as $, snapshotEvents as A, classifySessionExit as B, createIngestStore as C, resolveIngestConfig as D, publishEvent as E, adapterBucket as F, nodeMajorVersion as G, decideRemoteTelemetryState as H, buildAiGenerationEvents as I, stableConfigKey as J, parsePosthogReleaseId as K, buildBrowserExceptionProperties as L, FIRST_RUN_NOTICE as M, TELEMETRY_BATCH_URL as N, ringStats as O, TELEMETRY_FLAGS_URL as P, planWorktreeGc as Q, buildExceptionProperties as R, buildContextDigest as S, latestSeq as T, decideTelemetryConsent as U, decideIsDevInstall as V, exceptionFingerprint as W, matchedPrefix as X, DEFAULT_BRANCH_GC_PREFIXES as Y, planBranchGc as Z, INGEST_SPEC as _, ensureProjectIds as a, DEFAULT_DIGEST_BUDGET_CHARS as b, loadConfigFile as c, assetForPlatform as d, usablePrefixes as et, decideRtkInstall as f, verifyDigest as g, isRtkBinaryName as h, createConfigStore as i, localDayKey as j, scrubText as k, resolveConfigPath as l, installTargetPath as m, DEFAULT_CONFIG as n, generateProjectId as o, findEscapingArchiveMember as p, resolveProjectToken as q, SECRET_PRESENCE_SUFFIX as r, glimmervoidHomeDir as s, ABORT_CONFIG_SAVE as t, worktreeIntegrationTips as tt, validateConfig as u, mergeSettingsBlock as v, enabledSourceNames as w, SOURCE_DEFAULTS as x, validateSettingsBlock as y, buildFactoryDecisionEvent as z };