glimmervoid 0.33.0 → 0.34.1

package/dist/chunks/{main-J6y2RTri.js → main-VMWdsGC6.js}

@@ -4,8 +4,8 @@ import { a as isPathInside, c as sanitizeWorktreeName, n as caseFoldedPathKey, o
 import { a as packageRoot, n as cliPath, o as relayPath, r as clientDir, s as resolvePackageBin, t as bundled } from "./runtime-paths-BPoxENmK.js";
 import { A as KILLABLE_STATES, C as SshSignRequest, E as isSamePromptQuestion, M as RESTARTABLE_STATES, N as STATES, T as TaskTitle, _ as SIGN_URL_ENV, a as AgentDispatchRequest, c as AgentTicketRequest, h as SESSION_DOC_BODY_CAP_BYTES, j as MERGEABLE_LIVE_STATES, k as toolDetailLine, l as ORCHESTRATOR_AGENT_VERBS, m as RefinedTaskTitle, n as AGENT_URL_ENV, r as ASK_USER_QUESTION_TOOL_NAME, v as SSH_SIGN_BODY_CAP_BYTES, w as TASK_TITLE_CONTROL_CHARACTERS } from "./session-C7rstCmA.js";
 import { n as execFileAsync, o as spawn, r as execFileSync, t as execFile } from "./child-process-safe-DDELk9XC.js";
-import { n as glimmervoidHomeDir } from "./config-path-core-DFt-TemS.js";
-import { n as checkSandboxDependencies, t as allowSandboxedSpawn } from "./sandbox-deps-DuaNFq7n.js";
+import { n as glimmervoidHomeDir, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
+import { n as checkSandboxDependencies, t as allowSandboxedSpawn } from "./sandbox-deps-C63o3mZs.js";
 import { n as warnWhenGitIsTooOld } from "./git-version-CrLW4a6r.js";
 import { t as HOOK_URL_ENV } from "./hook-relay-core-DA_bz2KA.js";
 import { t as HOOK_VIA_SANDBOX_PROXY_ENV } from "./sandbox-proxy-core-hnQgKR0T.js";
@@ -19,13 +19,13 @@ import { n as unrefTimer, t as DEFAULT_TIMER_FNS } from "./timer-deps-u2DAQLok.j
 import { a as decideTicketAction, i as decideSpawnAllowance, l as isOrchestratorAgentVerb, n as REFUSAL_REASON, o as deriveChildSessionName, r as decideAgentRequest, s as describePushLanding, t as PUSH_UNAVAILABLE_REASON, u as parseAgentVerb } from "./agent-api-core-Ddg15j2j.js";
 import { s as GLIMMERVOID_SECRET_KEYS } from "./grok-BYKnBgdr.js";
 import { _ as isQueueAdmissionTimeout, a as jsonStateLoadError, c as loadedJsonValue, d as writeJsonAtomicSync, f as writeTextAtomic, g as createSpawnGate, h as createSerialQueue, i as createJsonStateWriter, m as createKeyedSerialQueue, n as appendJsonLines, o as loadJsonStateFile, p as writeTextAtomicSync, r as createJsonStateStore, s as loadJsonStateFileSync, t as appendJsonLine, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
-import { $ as TeamReviewCompareFiles, A as MyPrSearchResponse, At as CoherenceWorkInspect, B as PostingPlan, C as MyPrMergeMethod, Ct as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, D as MyPrMergeWhenReadyRequest, E as MyPrMergeStateResponse, F as CommitSha, G as ReviewDraft, H as QueuedReview, I as DECIDING_REVIEW_STATES, J as ReviewThreadId, K as ReviewFinding, L as FindingSeverity, M as MyPrThreadsResponse, N as MyPrsState, Ot as CoherenceTicketCreated, P as MyPrsStatus, R as GithubReviewDecision, Tt as CoherenceOrient, U as ReviewChecksState, V as PrDetail, W as ReviewComment, X as SearchedPr, Y as ReviewVerdict, Z as TeamReviewActionRequest, _ as WorkflowSearchNode, a as ConfigUpdate, at as TeamReviewThreadsRepository, b as MyPrAutoRebase, bt as USAGE_COST_MODES, c as TASK_TITLE_SOURCE_PRIORITY, ct as hasStandingViewerApproval, d as BRANCH_GC_CONTROL_NUMERIC_KEYS, dt as shortSha$1, et as TeamReviewResolveResponse, ft as GH_SEGMENT, g as WorkflowLabelName, h as WorkflowCommentBody, ht as repoParts, it as TeamReviewThreadResult, j as MyPrThreadNode, k as MyPrSearchNode, kt as CoherenceWorkCreated, l as configIssueMessage, lt as FULL_SHA_RE, m as DEFAULT_FACTORY_PROTECTED_PATHS, mt as REPO_SLUG_RE, nt as TeamReviewStatus, o as PersistedTaskTitle, ot as canApproveAfterComment, p as DEFAULT_FACTORY_CHECKS, pt as NODE_ID_RE, q as ReviewResult, r as BrowserConfig, rt as TeamReviewThreadCommentsResponse, s as RUNTIME_CONFIG_SCALAR_KEYS, st as decisionAsIfApprovalRequired, tt as TeamReviewStateEntry, u as BRANCH_GC_CONTROL_BOOLEAN_KEYS, ut as HEX_SHA_RE, v as WorkflowsSettings, w as MyPrMergeRequest, wt as USAGE_INTEGER_RANGES, x as MyPrKeepMergeableRequest, xt as USAGE_VENDOR_KEYS, y as WorkflowsState, yt as USAGE_BUDGET_KEYS, z as GithubReviewState } from "./config-Cneb8Ujj.js";
-import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-DYsZJDux.js";
-import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryWorkerEvent, b as planTitle, c as UpdateJournal, d as TraceRecord, et as FactoryLaneState, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryReviewerOutput, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryQueueIntentRequest, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as isSingleFactoryPathSegment, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryReviewVerdict, s as InstallFlavor, t as HTTP_URL_RE, tt as FactoryProjectState, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-DWv6q8ir.js";
-import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-CUBEhjOR.js";
+import { $ as TeamReviewCompareFiles, A as MyPrSearchResponse, At as CoherenceWorkInspect, B as PostingPlan, C as MyPrMergeMethod, Ct as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, D as MyPrMergeWhenReadyRequest, E as MyPrMergeStateResponse, F as CommitSha, G as ReviewDraft, H as QueuedReview, I as DECIDING_REVIEW_STATES, J as ReviewThreadId, K as ReviewFinding, L as FindingSeverity, M as MyPrThreadsResponse, N as MyPrsState, Ot as CoherenceTicketCreated, P as MyPrsStatus, R as GithubReviewDecision, Tt as CoherenceOrient, U as ReviewChecksState, V as PrDetail, W as ReviewComment, X as SearchedPr, Y as ReviewVerdict, Z as TeamReviewActionRequest, _ as WorkflowSearchNode, a as ConfigUpdate, at as TeamReviewThreadsRepository, b as MyPrAutoRebase, bt as USAGE_COST_MODES, c as TASK_TITLE_SOURCE_PRIORITY, ct as hasStandingViewerApproval, d as BRANCH_GC_CONTROL_NUMERIC_KEYS, dt as shortSha$1, et as TeamReviewResolveResponse, ft as GH_SEGMENT, g as WorkflowLabelName, h as WorkflowCommentBody, ht as repoParts, it as TeamReviewThreadResult, j as MyPrThreadNode, k as MyPrSearchNode, kt as CoherenceWorkCreated, l as configIssueMessage, lt as FULL_SHA_RE, m as DEFAULT_FACTORY_PROTECTED_PATHS, mt as REPO_SLUG_RE, nt as TeamReviewStatus, o as PersistedTaskTitle, ot as canApproveAfterComment, p as DEFAULT_FACTORY_CHECKS, pt as NODE_ID_RE, q as ReviewResult, r as BrowserConfig, rt as TeamReviewThreadCommentsResponse, s as RUNTIME_CONFIG_SCALAR_KEYS, st as decisionAsIfApprovalRequired, tt as TeamReviewStateEntry, u as BRANCH_GC_CONTROL_BOOLEAN_KEYS, ut as HEX_SHA_RE, v as WorkflowsSettings, w as MyPrMergeRequest, wt as USAGE_INTEGER_RANGES, x as MyPrKeepMergeableRequest, xt as USAGE_VENDOR_KEYS, y as WorkflowsState, yt as USAGE_BUDGET_KEYS, z as GithubReviewState } from "./config-DTwMFUjx.js";
+import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-D0lRWsAM.js";
+import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryWorkerEvent, b as planTitle, c as UpdateJournal, d as TraceRecord, et as FactoryLaneState, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryReviewerOutput, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryQueueIntentRequest, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as isSingleFactoryPathSegment, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryReviewVerdict, s as InstallFlavor, t as HTTP_URL_RE, tt as FactoryProjectState, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-DZV9H8px.js";
+import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-D-cRFZ_Q.js";
 import { t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import { a as formatSshPublicKey, c as orderAgentSockets, i as commitSigningShimText, l as parseSshPublicKey, n as NO_AGENT_HOLDS_KEY, o as isForwardedAgentDirName, r as agentListsKey, s as isSignableGitObject, t as COMMIT_SIGNING_SHIM_NAME } from "./ssh-signing-core-CRhVVWNW.js";
-import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-DJHVb-HU.js";
+import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-Y6YtqoiO.js";
 import { _ as escapeMarkup, g as createLaneLog, n as createVisionsSetup } from "./visions-setup-CfgNHiG3.js";
 import { t as getRtkPath } from "./rtk-resolver-jJxy_Mrt.js";
 import { createRequire } from "node:module";
@@ -37,7 +37,7 @@ import { z } from "zod";
 import http from "node:http";
 import { WebSocketServer } from "ws";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
-import fsp, { access, chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, symlink } from "node:fs/promises";
+import fsp, { access, chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, symlink } from "node:fs/promises";
 import { pipeline } from "node:stream";
 import express from "express";
 import pty from "node-pty";
@@ -2039,7 +2039,6 @@ function projectSessionSnapshots(source) {
 //#region server/core/sandbox-roles-core.ts
 var SESSION_VENDORS = Object.freeze(["claude", "codex"]);
 var CONFINED_SESSION_VENDORS = Object.freeze(["claude"]);
-var UNSHARED_WORKTREE_ENTRIES = Object.freeze([".claude"]);
 var LANE_CREDENTIAL_ENV = Object.freeze({
 	SSH_AUTH_SOCK: "",
 	SSH_ASKPASS: "",
@@ -2088,14 +2087,16 @@ function workRole({ vendor, cwd, checkout, readablePaths, writablePaths = [], ag
 		readableWithinDenied: [...readablePaths]
 	};
 }
-function sessionRole({ commitCheckouts, writableRoots, readDenied, readablePaths }) {
+function sessionRole({ writableRoots, readDenied, readablePaths, blockedPaths }) {
 	return {
+		guardrailLevel: "standard",
+		blockedPaths: [...blockedPaths],
 		vendors: SESSION_VENDORS,
 		vendorHome: { scope: "state" },
 		network: { access: "open" },
 		writableRoots: [...new Set(writableRoots)],
 		lockedCheckouts: [],
-		commitCheckouts,
+		commitCheckouts: [],
 		readDenied: [...readDenied],
 		readableWithinDenied: [...readablePaths]
 	};
@@ -2298,7 +2299,7 @@ function createAgentApiWiring({ config, agentSessions, listAllSessions, listBoar
 			name,
 			path: parent.path,
 			dangerouslySkipPermissions: parent.dangerouslySkipPermissions,
-			unconfined: !parent.isConfined
+			unguarded: !parent.isConfined
 		};
 		let child = null;
 		let released = false;
@@ -3464,6 +3465,11 @@ function decideWasActiveFlip(to, event, pendingRestart) {
 	if (!pendingRestart && (event === "user_kill" || to === STATES.DONE || to === STATES.FAILED)) return false;
 	return null;
 }
+function haveSameWorkspaceRepos(projectRepos, sessionRepos) {
+	const configured = projectRepos ?? [];
+	const running = sessionRepos ?? [];
+	return configured.length === running.length && configured.every((repoPath, index) => repoPath === running[index]);
+}
 function shouldStartAfterModify(previousState) {
 	return previousState !== STATES.DORMANT;
 }
@@ -3491,7 +3497,8 @@ function diffProjects(currentSessions, newProjects, dependencies) {
 		const resolvedAgentId = dependencies.resolveAgentId(project.agent);
 		const agentChanged = resolvedAgentId !== session.agentId || agentFingerprintOf(resolvedAgentId) !== capturedAgentFingerprintOf(id);
 		const hookTrustChanged = project.codexBypassHookTrust === true !== session.bypassHookTrust;
-		if (pathChanged || permissionsChanged || agentChanged || hookTrustChanged) {
+		const workspaceReposChanged = !haveSameWorkspaceRepos(project.repos, session.workspaceRepos);
+		if (pathChanged || permissionsChanged || agentChanged || hookTrustChanged || workspaceReposChanged) {
 			modified.push(project);
 			continue;
 		}
@@ -3975,7 +3982,7 @@ function runGh(args, options = {}) {
 }
 //#endregion
 //#region server/post-turn-checker.ts
-var GIT_TIMEOUT_MS$2 = 5e3;
+var GIT_TIMEOUT_MS$1 = 5e3;
 var DEFAULTS = Object.freeze({
 	enabled: true,
 	mode: "report",
@@ -4077,7 +4084,7 @@ var GIT_MAX_BUFFER_BYTES$1 = 8388608;
 async function execGit(args, cwd) {
 	const result = await runGit(args, {
 		cwd,
-		timeoutMs: GIT_TIMEOUT_MS$2,
+		timeoutMs: GIT_TIMEOUT_MS$1,
 		maxBuffer: GIT_MAX_BUFFER_BYTES$1,
 		trim: false
 	});
@@ -4792,7 +4799,15 @@ function runAutoResume(sessions, config, spawnGate, logger = console) {
 	}
 	return Promise.all(runs);
 }
-function carryWorktreeAcrossRecreate(oldSession, newSession) {
+function releaseDroppedWorkspaceMembers(oldSession, newSession, currentSessionFor) {
+	return Promise.resolve(oldSession._killReap).catch(() => {}).then(() => {
+		const liveSession = currentSessionFor?.(oldSession.id) ?? newSession;
+		const keepRepoPaths = isSameDirectoryPath(liveSession.path, oldSession.path) ? liveSession.workspaceRepos ?? [] : [];
+		return oldSession.releaseDroppedWorkspaceMembers(keepRepoPaths);
+	}).catch((error) => console.warn(`[config] releasing dropped workspace members failed for ${oldSession.name}: ${errorMessage(error)}`));
+}
+function carryWorktreeAcrossRecreate(oldSession, newSession, currentSessionFor) {
+	if (oldSession?.workspaceRepos) return releaseDroppedWorkspaceMembers(oldSession, newSession, currentSessionFor);
 	const carry = oldSession?.getWorktreeCarry?.();
 	if (!oldSession || !carry) return;
 	if (isSameDirectoryPath(newSession.path, oldSession.path)) {
@@ -4960,7 +4975,7 @@ function createSessionRegistry(dependencies) {
 			sessions.set(project.id, newSession);
 			captureAgentFingerprint(project);
 			dependencies.wireSessionEvents(newSession);
-			dependencies.carryWorktreeAcrossRecreate(oldSession, newSession);
+			dependencies.carryWorktreeAcrossRecreate(oldSession, newSession, getSession);
 			dependencies.broadcastControl({
 				type: "session-modified",
 				...projectSessionCard(newSession, {
@@ -14091,6 +14106,7 @@ var CLOUD_CREDENTIAL_HOME_ENTRIES = Object.freeze([
 	".netrc",
 	".npmrc"
 ]);
+var STANDARD_LEVEL_USABLE_CREDENTIAL_ENTRIES = Object.freeze(["Library/Keychains"]);
 var XDG_CONFIG_DEFAULT_HOME_PREFIX = ".config/";
 var SHARED_TEMP_DIRS = Object.freeze(["/tmp/claude", "/private/tmp/claude"]);
 var SHARED_HOME_WRITE_ENTRIES = Object.freeze([".npm/_logs"]);
@@ -14108,10 +14124,60 @@ var SANDBOX_PLACEHOLDER_NAMES = Object.freeze([
 	".zprofile",
 	".zshrc"
 ]);
+var WHOLE_FILESYSTEM = "/";
+var GLIMMERVOID_CONFIG_SIBLING_ENTRIES = Object.freeze([
+	"bin",
+	"pairings.json",
+	"pairings-seen.json",
+	"plans",
+	"telegram-outbox.json",
+	"traces",
+	"uploads",
+	"usage-budget-state.json",
+	"usage-lanes.json",
+	"usage-warehouse.json",
+	"visions-intent.json"
+]);
+var GLIMMERVOID_HOME_STATE_ENTRIES = Object.freeze([
+	"benchmark-runs",
+	"benchmarks",
+	"config.json",
+	"factory",
+	"issues-cache.json",
+	"knowledge-graph",
+	"litellm-pricing.json",
+	"my-prs-state.json",
+	"my-prs-work",
+	"posthog-reports",
+	"posthog-state.json",
+	"posthog-work",
+	"recordings",
+	"sandbox-homes",
+	"sandbox-policies",
+	"sane-yolo",
+	"scratch",
+	"sounds",
+	"team-review-repos",
+	"team-review-state.json",
+	"team-review-work",
+	"team-review-worktrees",
+	"telemetry-pending-crash.json",
+	"telemetry.json",
+	"tmp",
+	"update-check.json",
+	"update-journal.json",
+	"workflows-state.json",
+	"workflows-work"
+]);
 var RUNTIME_MANDATORY_CLAUDE_DENY_FOLDERS = Object.freeze(["commands", "agents"]);
 var SANDBOXED_PROXY_BYPASS = "localhost,::1,169.254.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16";
 var HOOK_LOOPBACK_HOST = "127.0.0.1";
 var AGENT_SESSION_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
+var STANDARD_OPEN_NETWORK = Object.freeze({
+	allowAllUnixSockets: true,
+	allowMachLookup: ["*"]
+});
+var STRICT_OPEN_NETWORK = Object.freeze({ allowAllUnixSockets: false });
 function unique(entries) {
 	return [...new Set(entries)];
 }
@@ -14226,10 +14292,45 @@ function relocatedXdgConfigPaths(host, homeEntries) {
 	if (xdgConfigHome === null) return [];
 	return homeEntries.filter((entry) => entry.startsWith(XDG_CONFIG_DEFAULT_HOME_PREFIX)).map((entry) => path.join(xdgConfigHome, entry.slice(8)));
 }
+function isStandardLevel(role) {
+	return role.guardrailLevel === "standard";
+}
+function blockedCredentialHomeEntries(role) {
+	const credentialHomeEntries = [...CREDENTIAL_HOME_ENTRIES, ...CLOUD_CREDENTIAL_HOME_ENTRIES];
+	if (!isStandardLevel(role)) return credentialHomeEntries;
+	return credentialHomeEntries.filter((entry) => !STANDARD_LEVEL_USABLE_CREDENTIAL_ENTRIES.includes(entry));
+}
+function credentialWriteBlocks(role, host) {
+	const credentialHomeEntries = blockedCredentialHomeEntries(role);
+	return [...homePaths(host, credentialHomeEntries), ...relocatedXdgConfigPaths(host, credentialHomeEntries)];
+}
+function glimmervoidStateWriteBlocks(role, host) {
+	const keptWritable = alwaysWritablePaths(role, host);
+	const configFolder = path.dirname(host.glimmervoidConfigFile);
+	const homeEntries = [
+		...GLIMMERVOID_HOME_STATE_ENTRIES,
+		...GLIMMERVOID_CONFIG_SIBLING_ENTRIES,
+		...host.glimmervoidHomeEntryNames
+	].map((entryName) => path.join(host.glimmervoidHome, entryName));
+	const configSiblings = GLIMMERVOID_CONFIG_SIBLING_ENTRIES.map((entryName) => path.join(configFolder, entryName));
+	return unique([
+		host.glimmervoidConfigFile,
+		...homeEntries,
+		...configSiblings
+	]).filter((entryPath) => !keptWritable.some((writable) => isPathInside(entryPath, writable)));
+}
+function standardWriteBlockCandidates(role, host) {
+	if (!isStandardLevel(role)) return [];
+	return unique([
+		...credentialWriteBlocks(role, host),
+		...glimmervoidStateWriteBlocks(role, host),
+		...role.blockedPaths ?? []
+	]);
+}
 function readDeniedPaths(role, host) {
 	const otherVendors = SANDBOX_VENDORS.filter((vendor) => !role.vendors.includes(vendor));
 	const otherVendorHomeEntries = [...otherVendors.flatMap((vendor) => VENDOR_PROFILES[vendor].homeEntries), ...UNWRAPPED_VENDOR_HOME_ENTRIES];
-	const credentialHomeEntries = [...CREDENTIAL_HOME_ENTRIES, ...CLOUD_CREDENTIAL_HOME_ENTRIES];
+	const credentialHomeEntries = blockedCredentialHomeEntries(role);
 	return [
 		...homePaths(host, [
 			...credentialHomeEntries,
@@ -14259,6 +14360,7 @@ function hostNamedPaths(host) {
 	return [
 		host.homeDir,
 		host.glimmervoidHome,
+		host.glimmervoidConfigFile,
 		host.tempDir,
 		host.launchHomeDir,
 		...relocatedXdgConfigHomes,
@@ -14287,7 +14389,7 @@ function sandboxRoleRefusal(role, host) {
 	return null;
 }
 function networkPolicy(role) {
-	if (role.network.access === "open") return { allowAllUnixSockets: false };
+	if (role.network.access === "open") return isStandardLevel(role) ? { ...STANDARD_OPEN_NETWORK } : { ...STRICT_OPEN_NETWORK };
 	if (role.network.access === "none") return {
 		allowedDomains: [],
 		deniedDomains: [],
@@ -14317,6 +14419,17 @@ function sandboxedEnvFor(role, host) {
 	if (role.network.access === "open") return { TMPDIR: host.tempDir };
 	return {};
 }
+function filesystemWrites(role, host, writablePaths) {
+	if (isStandardLevel(role)) return {
+		allowWrite: literalEntries([WHOLE_FILESYSTEM, ...writablePaths]),
+		denyWrite: literalEntries(host.writeBlockedPaths)
+	};
+	const isPresent = (candidate) => host.existingPaths.has(candidate);
+	return {
+		allowWrite: literalEntries(writablePaths),
+		denyWrite: literalEntries([...writeDeniesWhenPresent(role, host).filter(isPresent), ...lockedCheckoutWriteDenies(role)])
+	};
+}
 function buildSandboxLaunchPlan(role, host) {
 	const refusal = sandboxRoleRefusal(role, host);
 	if (refusal !== null) return {
@@ -14336,9 +14449,10 @@ function buildSandboxLaunchPlan(role, host) {
 				filesystem: {
 					denyRead: literalEntries(readDenied),
 					allowRead: literalEntries([...writableWithinDenied, ...role.readableWithinDenied]),
-					allowWrite: literalEntries(writablePaths),
-					denyWrite: literalEntries([...writeDeniesWhenPresent(role, host).filter(isPresent), ...lockedCheckoutWriteDenies(role)])
-				}
+					...filesystemWrites(role, host, writablePaths)
+				},
+				terminalScope: isStandardLevel(role) ? "any" : "own",
+				allowAppleEvents: isStandardLevel(role)
 			},
 			launchEnv: Object.assign({ CLAUDE_CODE_TMPDIR: host.tempDir }, ...role.vendors.map((vendor) => VENDOR_PROFILES[vendor].launchEnv), launchHomeEnv(role, host)),
 			sandboxedEnv: sandboxedEnvFor(role, host),
@@ -14386,33 +14500,6 @@ function parseTagVersion(ref) {
 	if (!matched) return null;
 	return matched[1];
 }
-function parseLsRemoteTags(stdout) {
-	if (typeof stdout !== "string") return null;
-	const tagsByVersion = /* @__PURE__ */ new Map();
-	for (const line of stdout.split("\n")) {
-		const fields = line.trim().split(/\s+/);
-		if (fields.length < 2) continue;
-		const sha = normalizeSha(fields[0]);
-		if (!sha) continue;
-		const ref = fields[1];
-		const version = parseTagVersion(ref);
-		if (!version) continue;
-		if (tagsByVersion.get(version) && !ref.endsWith("^{}")) continue;
-		tagsByVersion.set(version, {
-			version,
-			sha
-		});
-	}
-	let latest = null;
-	for (const entry of tagsByVersion.values()) {
-		if (!latest) {
-			latest = entry;
-			continue;
-		}
-		if (compareSemver(entry.version, latest.version) > 0) latest = entry;
-	}
-	return latest;
-}
 function isNpxCachePath(packageRoot) {
 	if (typeof packageRoot !== "string") return false;
 	return packageRoot.split(/[\\/]/).includes(NPX_CACHE_DIRECTORY_NAME);
@@ -14487,19 +14574,6 @@ function compareSemver(a, b) {
 	}
 	return 0;
 }
-function parseLatestReleaseTag(doc) {
-	if (!doc || typeof doc !== "object") return null;
-	const version = parseTagVersion(doc.tag_name);
-	if (!version) return null;
-	return {
-		version,
-		sha: null
-	};
-}
-function decideReleaseSource(flavor) {
-	if (flavor === "npm-global" || flavor === "npx") return "npm-registry";
-	return "github-tags";
-}
 function parseRegistryLatest(doc) {
 	if (!doc || typeof doc !== "object") return null;
 	const registryDocument = doc;
@@ -17182,6 +17256,10 @@ function planWorkspaceMembers({ folder, sessionId, repoPaths }) {
 		}
 	};
 }
+function listDroppedRepoPaths(previousRepoPaths, nextRepoPaths) {
+	const nextRepoKeys = new Set(nextRepoPaths.map((repoPath) => caseFoldedPathKey(path.resolve(repoPath))));
+	return previousRepoPaths.filter((repoPath) => !nextRepoKeys.has(caseFoldedPathKey(path.resolve(repoPath))));
+}
 function renderWorkspaceAgentsMd({ sessionName, branch, members }) {
 	const lines = [
 		`# ${sessionName}`,
@@ -17204,6 +17282,34 @@ async function writeWhenAbsent(filePath, contents) {
 		if (error.code !== "EEXIST") throw error;
 	});
 }
+var WORKSPACE_MAP_FILE = "AGENTS.md";
+var WORKSPACE_POINTER_FILE = "CLAUDE.md";
+var WORKSPACE_MAP_HASH_FILE = ".glimmervoid-map-hash";
+var GENERATED_WORKSPACE_FILES = /* @__PURE__ */ new Set([
+	WORKSPACE_MAP_FILE,
+	WORKSPACE_POINTER_FILE,
+	WORKSPACE_MAP_HASH_FILE
+]);
+function hashWorkspaceMap(contents) {
+	return crypto.createHash("sha256").update(contents).digest("hex");
+}
+async function readWhenPresent(filePath) {
+	return fs.promises.readFile(filePath, "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+}
+async function writeWorkspaceMap(folder, contents) {
+	const mapPath = path.join(folder, WORKSPACE_MAP_FILE);
+	const hashPath = path.join(folder, WORKSPACE_MAP_HASH_FILE);
+	const existingMap = await readWhenPresent(mapPath);
+	const recordedHash = (await readWhenPresent(hashPath))?.trim() ?? null;
+	const renderedHash = hashWorkspaceMap(contents);
+	if (existingMap !== null && existingMap !== contents && hashWorkspaceMap(existingMap) !== recordedHash) return;
+	if (existingMap === contents && recordedHash === renderedHash) return;
+	await fs.promises.writeFile(mapPath, contents);
+	await fs.promises.writeFile(hashPath, `${renderedHash}\n`);
+}
 function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorkspace }) {
 	let activeProvision = null;
 	async function provisionBody() {
@@ -17226,12 +17332,12 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 					base: ensured.base
 				});
 			}
-			await writeWhenAbsent(path.join(plan.folder, "AGENTS.md"), renderWorkspaceAgentsMd({
+			await writeWorkspaceMap(plan.folder, renderWorkspaceAgentsMd({
 				sessionName,
 				branch: plan.branch,
 				members
 			}));
-			await writeWhenAbsent(path.join(plan.folder, "CLAUDE.md"), WORKSPACE_CLAUDE_MD);
+			await writeWhenAbsent(path.join(plan.folder, WORKSPACE_POINTER_FILE), WORKSPACE_CLAUDE_MD);
 			return {
 				ok: true,
 				members
@@ -17252,10 +17358,12 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 		});
 		return attempt;
 	}
-	async function release() {
+	async function release({ keepRepoPaths = [] } = {}) {
 		if (activeProvision) await activeProvision;
+		const keptRepoKeys = new Set(keepRepoPaths.map((repoPath) => caseFoldedPathKey(path.resolve(repoPath))));
 		const keptDirs = [];
 		for (const member of plan.members) {
+			if (keptRepoKeys.has(caseFoldedPathKey(member.repoPath))) continue;
 			if (!await fs.promises.stat(member.dir).then(() => true, () => false)) continue;
 			if (!(await gitWorkspace.removeWorkspaceMember({
 				projectPath: member.repoPath,
@@ -17264,7 +17372,7 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 			})).ok) keptDirs.push(member.dir);
 		}
 		const entries = await fs.promises.readdir(plan.folder).catch(() => []);
-		if (entries.some((entry) => entry !== "AGENTS.md" && entry !== "CLAUDE.md")) return { keptDirs };
+		if (entries.some((entry) => !GENERATED_WORKSPACE_FILES.has(entry))) return { keptDirs };
 		for (const entry of entries) await fs.promises.rm(path.join(plan.folder, entry), { force: true });
 		await fs.promises.rmdir(plan.folder).catch(() => {});
 		return { keptDirs };
@@ -17738,10 +17846,14 @@ function createSessionWorktreeLifecycle({ id, projectPath, integrationBranch = n
 		lifecycleState.isWorktree = false;
 		setMergeStatus(status);
 	}
-	async function releaseWorkspaceMembers(members) {
-		const released = await members.release();
+	async function releaseWorkspaceMembers(members, keepRepoPaths = []) {
+		const released = await members.release({ keepRepoPaths });
 		if (released.keptDirs.length > 0) console.warn(`[session ${id}] kept workspace members with uncommitted work: ${released.keptDirs.join(", ")}`);
 	}
+	async function releaseDroppedWorkspaceMembers(keepRepoPaths) {
+		if (!workspaceMembers?.ok) return;
+		await releaseWorkspaceMembers(workspaceMembers.members, keepRepoPaths);
+	}
 	async function discardWorktree() {
 		if (workspaceMembers?.ok) return releaseWorkspaceMembers(workspaceMembers.members);
 		stopWatching();
@@ -18514,7 +18626,8 @@ function createSessionWorktreeLifecycle({ id, projectPath, integrationBranch = n
 		mergeWorktree,
 		mergeAndContinue,
 		adoptWorktree,
-		discardWorktree
+		discardWorktree,
+		releaseDroppedWorkspaceMembers
 	};
 	return api;
 }
@@ -18935,8 +19048,8 @@ var KILL_MAX_WAIT_MS = 3e3;
 var KILL_REAP_MAX_WAIT_MS = 2400;
 var SLEEP_KILL_TIMEOUT_MS = 9e5;
 var MAX_PENDING_ATTENTION_NOTES = 5;
-var SANDBOX_UNAPPLIED_ERROR = "sandbox settings could not be applied, session not started";
-var SANDBOX_REFUSED_PREFIX = "session not started, the sandbox refused: ";
+var SANDBOX_UNAPPLIED_ERROR = "guardrail settings could not be applied, session not started";
+var SANDBOX_REFUSED_PREFIX = "session not started, the guardrails refused: ";
 var INNER_SANDBOX_OFF = Object.freeze({ enabled: false });
 function settingsSandboxForHooks(adapter, hasOuterSandbox, requestedSettingsSandbox) {
 	if (!hasOuterSandbox) return requestedSettingsSandbox;
@@ -19019,6 +19132,7 @@ var Session = class extends EventEmitter {
 	_initialPrompt;
 	_extraClaudeArgs;
 	_resumeSessionId;
+	workspaceRepos;
 	_transcriptPath;
 	_lastClaudeSessionReport;
 	_suppressResumeCapture;
@@ -19152,6 +19266,7 @@ var Session = class extends EventEmitter {
 		this._initialPrompt = initialPrompt;
 		this._extraClaudeArgs = Array.isArray(extraClaudeArgs) ? extraClaudeArgs : [];
 		this._resumeSessionId = resumeSessionId || null;
+		this.workspaceRepos = workspaceRepos ? [...workspaceRepos] : null;
 		this._transcriptPath = null;
 		this._lastClaudeSessionReport = null;
 		this._suppressResumeCapture = false;
@@ -19762,6 +19877,9 @@ var Session = class extends EventEmitter {
 	discardWorktreeIfClean() {
 		return this.worktreeLifecycle.discardIfClean();
 	}
+	releaseDroppedWorkspaceMembers(keepRepoPaths) {
+		return this.worktreeLifecycle.releaseDroppedWorkspaceMembers(keepRepoPaths);
+	}
 	pasteMergePrompt() {
 		return this.worktreeLifecycle.pasteMergePrompt();
 	}
@@ -20128,7 +20246,7 @@ var Session = class extends EventEmitter {
 		if (!launch || launch !== this._sandboxLaunch) return;
 		this._sandboxLaunch = null;
 		launch.dispose().catch((error) => {
-			console.warn(`[session ${this.id}] sandbox cleanup failed: ${errorMessage(error)}`);
+			console.warn(`[session ${this.id}] guardrails cleanup failed: ${errorMessage(error)}`);
 		});
 	}
 	_guardPtyInputSocket() {
@@ -20689,6 +20807,7 @@ var LAUNCH_HOME_FOLDER = "sandbox-homes";
 var START_FOLDER = "start";
 var ENTER_FOLDER_SCRIPT = "cd \"$1\" && shift && exec \"$@\"";
 var LOGIN_FILE_MODE = 384;
+var ABSENT_PATH_DENY_PLATFORM = "darwin";
 async function isPresent(candidate) {
 	try {
 		await access(candidate);
@@ -20714,6 +20833,32 @@ async function realPathWhenPresent(candidate) {
 function realPathsWhenPresent(candidates) {
 	return Promise.all(candidates.map(realPathWhenPresent));
 }
+async function symlinkTargetsInside(folder) {
+	const symlinkEntries = (await readdir(folder, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isSymbolicLink());
+	return (await Promise.all(symlinkEntries.map((entry) => realpath(path.join(folder, entry.name)).catch(() => null)))).filter((target) => target !== null);
+}
+async function blockedPathsWithRealTargets(candidates, operatorBlockedPaths) {
+	const resolved = await Promise.all(candidates.map(async (candidate) => {
+		const isPresentEntry = await lstat(candidate).then(() => true, (error) => !isMissingFileError(error));
+		const isKeptWhenAbsent = process.platform === ABSENT_PATH_DENY_PLATFORM || operatorBlockedPaths.includes(candidate);
+		if (!isPresentEntry) return isKeptWhenAbsent ? [candidate] : [];
+		const realCandidate = await realpath(candidate).catch(() => candidate);
+		return [
+			candidate,
+			realCandidate,
+			...await symlinkTargetsInside(realCandidate)
+		];
+	}));
+	return [...new Set(resolved.flat())];
+}
+async function configuredConfigFile(glimmervoidHome) {
+	const { envPath, homePath } = decideConfigPath({
+		env: process.env,
+		homeDir: glimmervoidHome
+	}, () => false);
+	const configFile = envPath ?? homePath;
+	return path.join(await realPathWhenPresent(path.dirname(configFile)), path.basename(configFile));
+}
 function scannedClaudeHomes(env, homeDir) {
 	return [env, {
 		...env,
@@ -20858,20 +21003,30 @@ async function prepareSandboxLaunch({ role, launchId, tempDir, enterDir }) {
 			reason: "CODEX_HOME names no folder"
 		};
 		const xdgConfigHomeOverride = rawTextOr(process.env.XDG_CONFIG_HOME, null);
-		const hostPaths = {
+		const stableHostPaths = {
 			homeDir,
 			glimmervoidHome,
+			glimmervoidConfigFile: await configuredConfigFile(glimmervoidHome),
 			tempDir: launchTempDir,
 			launchHomeDir,
-			homeEntryNames: await readdir(homeDir),
 			vendorLocations,
 			unwrappedVendorHomes: await realPathsWhenPresent(grokHomes(process.env, homeDir)),
 			relocatedXdgConfigHome: xdgConfigHomeOverride === null ? null : await realPathWhenPresent(xdgConfigHomeOverride)
 		};
-		const buildPlanFromCurrentDisk = async () => buildSandboxLaunchPlan(realRole, {
-			...hostPaths,
-			existingPaths: await presentPaths$1(sandboxPolicyProbePaths(realRole, hostPaths))
-		});
+		const buildPlanFromCurrentDisk = async () => {
+			const [homeEntryNames, glimmervoidHomeEntryNames] = await Promise.all([readdir(homeDir), readdir(glimmervoidHome)]);
+			const hostPaths = {
+				...stableHostPaths,
+				homeEntryNames,
+				glimmervoidHomeEntryNames
+			};
+			const [existingPaths, writeBlockedPaths] = await Promise.all([presentPaths$1(sandboxPolicyProbePaths(realRole, hostPaths)), blockedPathsWithRealTargets(standardWriteBlockCandidates(realRole, hostPaths), realRole.blockedPaths ?? [])]);
+			return buildSandboxLaunchPlan(realRole, {
+				...hostPaths,
+				existingPaths,
+				writeBlockedPaths
+			});
+		};
 		const built = await buildPlanFromCurrentDisk();
 		if (!built.ok) return built;
 		const { plan } = built;
@@ -46850,7 +47005,7 @@ function computeCrossRepoLinks(repos) {
 }
 //#endregion
 //#region server/change-map-wiring.ts
-var GIT_TIMEOUT_MS$1 = 15e3;
+var GIT_TIMEOUT_MS = 15e3;
 var GIT_MAX_BUFFER_BYTES = 67108864;
 var FILE_READ_BATCH = 64;
 var MAX_CACHED_FILES = 5e4;
@@ -46862,11 +47017,11 @@ var MAX_MEMOIZED_REPO_FACTS = 64;
 async function runGitAsync(args, cwd) {
 	const result = await runGit(args, {
 		cwd,
-		timeoutMs: GIT_TIMEOUT_MS$1,
+		timeoutMs: GIT_TIMEOUT_MS,
 		maxBuffer: GIT_MAX_BUFFER_BYTES,
 		trim: false
 	});
-	if (!result.ok) throw gitCommandFailure(args, result, GIT_TIMEOUT_MS$1);
+	if (!result.ok) throw gitCommandFailure(args, result, GIT_TIMEOUT_MS);
 	return result.out;
 }
 function yieldToEventLoop() {
@@ -47371,9 +47526,9 @@ Object.freeze([
 	...USAGE_BUDGET_KEYS.map((key) => `usage.budget.${key}`),
 	...TELEGRAM_STRING_KEYS.map((key) => `telegram.${key}`),
 	"agentApi.enabled",
-	"sandbox.unconfinedRepos",
-	"sandbox.writablePaths",
-	"sandbox.unreadablePaths",
+	"guardrails.unguardedRepos",
+	"guardrails.blockedPaths",
+	"guardrails.unreadablePaths",
 	"telemetry.enabled"
 ]);
 var USAGE_REPORT_MAX_DAYS = 3650;
@@ -47759,6 +47914,89 @@ function registerControlHandlers(controlWss, deps) {
 		});
 		if (freshConfig) applyConfigReload(freshConfig);
 	}
+	function handleGetWorkspaceRepos(msg, ws) {
+		const project = findConfiguredProject(msg.id);
+		if (!project?.repos) {
+			replyTo(ws, msg, "workspace-repos", {
+				id: msg.id,
+				ok: false,
+				repos: [],
+				error: "This session is not a workspace"
+			});
+			return;
+		}
+		replyTo(ws, msg, "workspace-repos", {
+			id: msg.id,
+			ok: true,
+			repos: project.repos,
+			error: null
+		});
+	}
+	async function findDroppedMemberWithUncommittedWork(workspaceFolder, droppedRepoPaths) {
+		for (const repoPath of droppedRepoPaths) {
+			const memberName = path.basename(path.resolve(repoPath));
+			const memberDir = path.join(workspaceFolder, memberName);
+			if (!await fs.promises.stat(memberDir).then(() => true, () => false)) continue;
+			const memberStatus = await runGit([
+				"--no-optional-locks",
+				"status",
+				"--porcelain"
+			], { cwd: memberDir });
+			if (!memberStatus.ok) throw memberStatus.error;
+			if (memberStatus.out !== "") return memberName;
+		}
+		return null;
+	}
+	async function handleSetWorkspaceRepos(msg, ws) {
+		const reply = (error) => replyTo(ws, msg, "set-workspace-repos-result", {
+			id: msg.id,
+			ok: error === null,
+			error
+		});
+		const project = findConfiguredProject(msg.id);
+		const session = sessions.get(msg.id);
+		if (!project?.repos || !session) {
+			reply("This session is not a workspace");
+			return;
+		}
+		const missingRepo = msg.repos.find((repoPath) => !isExistingDirectory(repoPath));
+		if (missingRepo) {
+			reply(`Repository path does not exist: ${missingRepo}`);
+			return;
+		}
+		const planned = planWorkspaceMembers({
+			folder: project.path,
+			sessionId: project.id,
+			repoPaths: msg.repos
+		});
+		if (!planned.ok) {
+			reply(planned.error);
+			return;
+		}
+		const nextRepos = planned.plan.members.map((member) => member.repoPath);
+		try {
+			const dirtyMemberName = await findDroppedMemberWithUncommittedWork(project.path, listDroppedRepoPaths(project.repos, nextRepos));
+			if (dirtyMemberName) {
+				reply(`${dirtyMemberName} has uncommitted changes. Commit or discard them before removing it from the workspace.`);
+				return;
+			}
+		} catch (error) {
+			reply(`Could not check the workspace for uncommitted changes: ${errorMessage(error)}`);
+			return;
+		}
+		const freshConfig = configStore.save((cfg) => {
+			const configured = cfg.projects.find((entry) => entry.id === project.id);
+			if (!configured) return ABORT_CONFIG_SAVE;
+			configured.repos = nextRepos;
+		});
+		if (!freshConfig) {
+			reply(`Could not save session "${project.name}"`);
+			return;
+		}
+		applyConfigReload(freshConfig);
+		console.log(`[control] Workspace repositories updated via UI: ${project.name} (${nextRepos.length} repos)`);
+		reply(null);
+	}
 	function handleSetSessionTitle(msg, ws) {
 		const session = findSession(msg);
 		const parsedTitle = TaskTitle.safeParse(msg.title);
@@ -47954,7 +48192,7 @@ function registerControlHandlers(controlWss, deps) {
 			if (incoming.ingest != null) cfg.ingest = mergeSettingsBlock(cfg.ingest, incoming.ingest, INGEST_SPEC);
 			if (s.telegram != null) cfg.telegram = mergeSettingsBlockOverStored(cfg.telegram, s.telegram);
 			if (s.agentApi != null) cfg.agentApi = mergeSettingsBlockOverStored(cfg.agentApi, s.agentApi);
-			if (s.sandbox != null) cfg.sandbox = mergeSettingsBlockOverStored(cfg.sandbox, s.sandbox);
+			if (s.guardrails != null) cfg.guardrails = mergeSettingsBlockOverStored(cfg.guardrails, s.guardrails);
 			if (s.telemetry != null) cfg.telemetry = mergeSettingsBlockOverStored(cfg.telemetry, s.telemetry);
 			if (!workflowsUpdate) return void 0;
 			const storedWorkflowsMerge = mergeWorkflowsUpdateOverStored(cfg.workflows, workflowsUpdate);
@@ -48108,7 +48346,7 @@ function registerControlHandlers(controlWss, deps) {
 		};
 		if (workspaceRepos) project.repos = workspaceRepos;
 		if (typeof dangerouslySkipPermissions === "boolean") project.dangerouslySkipPermissions = dangerouslySkipPermissions;
-		if (unconfined) project.unconfined = true;
+		if (unconfined) project.unguarded = true;
 		if (agent) project.agent = agent;
 		const freshConfig = configStore.save((cfg) => {
 			cfg.projects.push(project);
@@ -48222,7 +48460,7 @@ function registerControlHandlers(controlWss, deps) {
 				path: project.path,
 				agent: project.agent,
 				dangerouslySkipPermissions: project.dangerouslySkipPermissions,
-				unconfined: project.unconfined
+				unconfined: project.unguarded
 			});
 			if (!created.ok) {
 				reply({ error: created.error });
@@ -48716,6 +48954,8 @@ function registerControlHandlers(controlWss, deps) {
 		"resume-conversation": handleResumeConversation,
 		"remove-session": handleRemoveSession,
 		"rename-session": handleRenameSession,
+		"get-workspace-repos": handleGetWorkspaceRepos,
+		"set-workspace-repos": handleSetWorkspaceRepos,
 		"set-session-title": handleSetSessionTitle,
 		"reorder-sessions": handleReorderSessions,
 		"ping": handlePing,
@@ -49477,12 +49717,9 @@ function markInterrupted(journal, { reason, now }) {
 }
 //#endregion
 //#region server/update-check.ts
-var GIT_REMOTE_URL = `https://github.com/${REPO_SLUG}.git`;
-var GITHUB_LATEST_RELEASE_URL = `https://api.github.com/repos/${REPO_SLUG}/releases/latest`;
 var NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/glimmervoid/latest";
 var DEFAULT_TIMEOUT_MS = 8e3;
 var GIT_HEAD_TIMEOUT_MS = 3e3;
-var LS_REMOTE_TIMEOUT_MS = 5e3;
 var RELEASE_ANCESTRY_TIMEOUT_MS = 3e3;
 var MAIN_CHANNEL_BUDGET_MS = DEFAULT_TIMEOUT_MS;
 var MAIN_FETCH_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 2);
@@ -49490,6 +49727,7 @@ var MAIN_REMOTE_TIP_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 4);
 var MAIN_BEHIND_COUNT_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 4);
 var STATE_FILE_NAME = "update-check.json";
 var STATE_TTL_MS = 216e5;
+var RELEASE_SOURCE = "npm-registry";
 function defaultStatePath() {
 	return path.join(glimmervoidHomeDir$1(), STATE_FILE_NAME);
 }
@@ -49633,59 +49871,6 @@ async function resolveLatestRegistryVersion({ fetchFn, signal }) {
 		};
 	}
 }
-async function resolveLatestRelease({ flavor, runCommand, fetchFn, signal }) {
-	if (decideReleaseSource(flavor) === "npm-registry") return resolveLatestRegistryVersion({
-		fetchFn,
-		signal
-	});
-	const fromRemote = parseLsRemoteTags((await runGitProbe(runCommand, [
-		"ls-remote",
-		"--tags",
-		GIT_REMOTE_URL
-	], {
-		timeout: LS_REMOTE_TIMEOUT_MS,
-		signal
-	})).out);
-	if (fromRemote) return {
-		...fromRemote,
-		behindCount: null,
-		reason: null
-	};
-	try {
-		const response = await fetchFn(GITHUB_LATEST_RELEASE_URL, {
-			signal,
-			headers: {
-				Accept: "application/vnd.github+json",
-				"User-Agent": "glimmervoid-update-check"
-			}
-		});
-		if (!response?.ok) return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-		const release = parseLatestReleaseTag(await response.json());
-		if (!release) return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-		return {
-			...release,
-			behindCount: null,
-			reason: null
-		};
-	} catch {
-		return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-	}
-}
 function upstreamBranch(upstream) {
 	const slashIndex = upstream.indexOf("/");
 	if (slashIndex < 0 || slashIndex === upstream.length - 1) return null;
@@ -49858,13 +50043,11 @@ async function checkForUpdate({ currentVersion, updateChannel = "release", fetch
 		});
 		const cached = readCheckState(statePath);
 		const cacheOutrunByInstall = normalizeSha(cached?.latestSha) !== null && normalizeSha(cached?.latestSha) === installed.installedSha;
-		const expectedReleaseSource = updateChannel === "release" ? decideReleaseSource(installed.flavor) : null;
+		const expectedReleaseSource = updateChannel === "release" ? RELEASE_SOURCE : null;
 		const isCacheFromSameSource = expectedReleaseSource === null || cached?.releaseSource === expectedReleaseSource;
 		if (cached?.channel === updateChannel && isCacheFromSameSource && !cacheOutrunByInstall && isCheckFresh(cached.lastCheckAt, now, ttlMs)) return finish(installed, targetFromCache(cached), currentVersion, updateChannel, platform, now, packageRoot$1, runCommand, signal);
 		signal.throwIfAborted();
-		const latestTarget = updateChannel === "main" ? await resolveLatestMain(installed, packageRoot$1, runCommand, fetchOrigin, signal) : await resolveLatestRelease({
-			flavor: installed.flavor,
-			runCommand,
+		const latestTarget = updateChannel === "main" ? await resolveLatestMain(installed, packageRoot$1, runCommand, fetchOrigin, signal) : await resolveLatestRegistryVersion({
 			fetchFn,
 			signal
 		});
@@ -50769,10 +50952,10 @@ function createSessionFactory(dependencies) {
 	}
 	function defaultSandboxFor(project, config, overrides) {
 		if (!dependencies.sessionSandbox) return null;
-		const unconfinedRepos = (config.sandbox?.unconfinedRepos ?? []).map((repo) => expandTilde(repo, process.env, dependencies.homeDir ?? null));
+		const unconfinedRepos = (config.guardrails?.unguardedRepos ?? []).map((repo) => expandTilde(repo, process.env, dependencies.homeDir ?? null));
 		return isSessionConfined({
 			usageVendor: getAdapter(overrides.agent ?? project.agent)?.usageVendor ?? null,
-			isMarkedUnconfined: project.unconfined === true,
+			isMarkedUnconfined: project.unguarded === true,
 			sessionFolders: [project.path, ...project.repos ?? []],
 			unconfinedRepos
 		}) ? dependencies.sessionSandbox.prepareFor({
@@ -50829,8 +51012,7 @@ function createSessionFactory(dependencies) {
 //#region server/session-sandbox.ts
 var UNWRAPPED_PLATFORM = "win32";
 var GITHUB_TOKEN_TIMEOUT_MS = 5e3;
-var GIT_TIMEOUT_MS = 3e4;
-var OPT_OUT_HINT = "Mark the session or its repository unconfined to start it outside the sandbox.";
+var OPT_OUT_HINT = "Mark the session or its repository unguarded to start it without guardrails.";
 async function readGithubCliToken(env) {
 	if (rawTextOr(env.GH_TOKEN, null) || rawTextOr(env.GITHUB_TOKEN, null)) return null;
 	return await execFileAsync("gh", ["auth", "token"], {
@@ -50838,65 +51020,9 @@ async function readGithubCliToken(env) {
 		encoding: "utf8"
 	}).then(({ stdout }) => stdout.trim(), () => "") || null;
 }
-async function gitCheckoutOf(startFolder) {
-	const toplevel = await runHardenedGit(["rev-parse", "--show-toplevel"], {
-		cwd: startFolder,
-		timeout: GIT_TIMEOUT_MS
-	}).then(({ stdout }) => stdout.trim(), () => "");
-	if (!toplevel) return null;
-	const checkout = await existingRealPath(toplevel);
-	if (checkout === null || !isPathInside(checkout, startFolder)) return null;
-	return checkout;
-}
-async function isRegisteredGitEntry(gitEntry, worktreeAdminDir) {
-	return await readFile(path.join(worktreeAdminDir, "gitdir"), "utf8").then((registeredPath) => realpath(path.resolve(worktreeAdminDir, registeredPath.trim()))).catch(() => null) === gitEntry;
-}
-async function ownGitDirOf(checkout, startFolder) {
-	const gitDirs = await readGitDirsOfOwnCheckout(startFolder).catch(() => null);
-	if (gitDirs === null) return null;
-	const { commonGitDir, worktreeAdminDir } = gitDirs;
-	const gitEntry = path.join(checkout, ".git");
-	const gitEntryStats = await lstat(gitEntry).catch(() => null);
-	if (gitEntryStats?.isDirectory()) return worktreeAdminDir === gitEntry && commonGitDir === gitEntry ? commonGitDir : null;
-	const isLinkedWorktree = worktreeAdminDir !== commonGitDir;
-	if (!gitEntryStats?.isFile() || !isLinkedWorktree) return null;
-	if ((checkout === startFolder ? gitDirs : await readGitDirsOfOwnCheckout(checkout).catch(() => null))?.worktreeAdminDir !== worktreeAdminDir) return null;
-	return await isRegisteredGitEntry(gitEntry, worktreeAdminDir) ? commonGitDir : null;
-}
-async function commitCheckoutOf(startFolder) {
-	const checkout = await gitCheckoutOf(startFolder);
-	if (checkout === null) return null;
-	const gitDir = await ownGitDirOf(checkout, startFolder);
-	return gitDir === null ? null : {
-		checkout,
-		gitDir
-	};
-}
-async function memberCommitCheckoutOf(memberFolder) {
-	const commitCheckout = await commitCheckoutOf(memberFolder);
-	return commitCheckout?.checkout === memberFolder ? commitCheckout : null;
-}
-async function workspaceMemberCheckouts(workspaceFolder) {
-	const memberFolders = (await readdir(workspaceFolder, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => path.join(workspaceFolder, entry.name));
-	const gitPointers = await Promise.all(memberFolders.map((memberFolder) => existingRealPath(path.join(memberFolder, ".git"))));
-	return (await Promise.all(memberFolders.filter((_memberFolder, index) => gitPointers[index] !== null).map(memberCommitCheckoutOf))).filter((commitCheckout) => commitCheckout !== null);
-}
-async function sessionCheckouts(cwd, isWorkspace) {
-	if (isWorkspace) return workspaceMemberCheckouts(cwd);
-	const commitCheckout = await commitCheckoutOf(cwd);
-	return commitCheckout === null ? [] : [commitCheckout];
-}
-async function sharedFolderBehind(linkPath, repositoryFolder) {
-	if (!(await lstat(linkPath).catch(() => null))?.isSymbolicLink()) return null;
-	const sharedPath = await existingRealPath(linkPath);
-	if (sharedPath !== repositoryFolder) return null;
-	return (await stat(sharedPath)).isDirectory() ? sharedPath : null;
-}
-async function sharedFoldersOf({ checkout, gitDir }, worktreeShare) {
-	const repositoryRoot = repositoryRootOfCommonGitDir(gitDir);
-	if (repositoryRoot === null) return [];
-	const sharedEntries = worktreeShare.filter((entry) => !UNSHARED_WORKTREE_ENTRIES.includes(entry));
-	return (await Promise.all(sharedEntries.map((entry) => sharedFolderBehind(path.join(checkout, entry), path.resolve(path.join(repositoryRoot, entry)))))).filter((sharedFolder) => sharedFolder !== null);
+async function repositoryRootOf(cwd) {
+	const gitDirs = await readGitDirsOfOwnCheckout(cwd).catch(() => null);
+	return gitDirs === null ? null : repositoryRootOfCommonGitDir(gitDirs.commonGitDir);
 }
 function createSessionSandbox({ getSettings, uploadsRoot, sandboxRefusal = allowSandboxedSpawn, prepareSandbox = prepareSandboxLaunch, trustClaudeFolder, platform = process.platform, homeDir = os.homedir(), env = process.env, readGithubToken = () => readGithubCliToken(env), log = console }) {
 	const expandHome = (candidates) => candidates.map((candidate) => expandTilde(candidate.trim(), env, homeDir)).filter(Boolean);
@@ -50906,27 +51032,24 @@ function createSessionSandbox({ getSettings, uploadsRoot, sandboxRefusal = allow
 		const sessionUploads = path.join(uploadsRoot, sessionId);
 		await mkdir(sessionUploads, { recursive: true });
 		const cwd = await realpath(facts.cwd);
-		const commitCheckouts = await sessionCheckouts(cwd, isWorkspace);
-		const sharedFolders = (await Promise.all(commitCheckouts.map((commitCheckout) => sharedFoldersOf(commitCheckout, settings.worktreeShare)))).flat();
-		const startFolderRoots = commitCheckouts.length === 0 ? [cwd] : [];
+		const ownRepositoryRoot = isWorkspace ? null : await repositoryRootOf(cwd);
+		const expandedBlockedPaths = expandHome(settings.blockedPaths);
+		const ignoredBlockedPaths = expandedBlockedPaths.filter((blockedPath) => !path.isAbsolute(blockedPath));
+		if (ignoredBlockedPaths.length > 0) log.warn(`[guardrails] ignoring guardrails.blockedPaths entries that are not absolute paths: ${ignoredBlockedPaths.join(", ")}`);
 		return {
 			cwd,
-			trustFolder: (isWorkspace || commitCheckouts[0] === void 0 ? null : repositoryRootOfCommonGitDir(commitCheckouts[0].gitDir)) ?? cwd,
+			trustFolder: ownRepositoryRoot ?? cwd,
 			role: sessionRole({
-				commitCheckouts,
-				writableRoots: [
-					...startFolderRoots,
-					...sharedFolders,
-					...await existingRealPaths([...expandHome(settings.writablePaths), ...facts.writablePaths])
-				],
+				writableRoots: await existingRealPaths(facts.writablePaths),
 				readDenied: expandHome(settings.unreadablePaths).filter((unreadablePath) => path.isAbsolute(unreadablePath)),
+				blockedPaths: expandedBlockedPaths.filter((blockedPath) => path.isAbsolute(blockedPath)),
 				readablePaths: [...facts.readablePaths, ...await existingRealPaths([sessionUploads, githubCliConfigDir()])]
 			})
 		};
 	}
 	async function recordClaudeFolderTrust(folder) {
 		if (!trustClaudeFolder) return;
-		await trustClaudeFolder(folder).catch((error) => log.warn(`[sandbox] ${errorMessage(error)}`));
+		await trustClaudeFolder(folder).catch((error) => log.warn(`[guardrails] ${errorMessage(error)}`));
 	}
 	function prepareFor(request) {
 		if (platform === UNWRAPPED_PLATFORM) return null;
@@ -51023,11 +51146,10 @@ function createBackendSessionRuntime(dependencies) {
 			getUserHooks: (projectId) => hooksForProject(dependencies.config.hooks, projectId),
 			sessionSandbox: createSessionSandbox({
 				getSettings: () => {
-					const { sandbox, worktreeShare } = dependencies.configStore.config;
+					const { guardrails } = dependencies.configStore.config;
 					return {
-						writablePaths: sandbox?.writablePaths ?? DEFAULT_CONFIG.sandbox.writablePaths,
-						unreadablePaths: sandbox?.unreadablePaths ?? DEFAULT_CONFIG.sandbox.unreadablePaths,
-						worktreeShare: worktreeShare ?? DEFAULT_CONFIG.worktreeShare
+						blockedPaths: guardrails?.blockedPaths ?? DEFAULT_CONFIG.guardrails.blockedPaths,
+						unreadablePaths: guardrails?.unreadablePaths ?? DEFAULT_CONFIG.guardrails.unreadablePaths
 					};
 				},
 				uploadsRoot: configSiblingPath(dependencies.configStore.configPath, "uploads"),