glimmervoid 0.34.0 → 0.34.1

package/dist/bin/glimmervoid.js

@@ -135,7 +135,7 @@ var SUBCOMMAND_RUNNERS = new Map([
 		return 0;
 	}],
 	["pair", async (subcommandArgs) => {
-		const { runPairCli } = await import("../chunks/pair-cli-Nnrd0il_.js");
+		const { runPairCli } = await import("../chunks/pair-cli-CI848omy.js");
 		return runPairCli(subcommandArgs);
 	}],
 	["agent", async (subcommandArgs) => {
@@ -209,7 +209,7 @@ async function readDeclaredCustomAgents() {
 		declared: [],
 		error: null
 	};
-	const { loadConfigFile } = await import("../chunks/config-store-BmdXeUz1.js");
+	const { loadConfigFile } = await import("../chunks/config-store-DwTxLe8Y.js");
 	try {
 		const loaded = loadConfigFile(decided.path, { exitOnError: false });
 		if (!loaded.config) return {
@@ -285,7 +285,7 @@ async function runDoctor() {
 	}
 	switchSection("Agents");
 	try {
-		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-_HwpLy0R.js");
+		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-CgbcceU3.js");
 		const declaredCustomAgents = await readDeclaredCustomAgents();
 		if (declaredCustomAgents.error) line("config", declaredCustomAgents.error);
 		setCustomAgents(declaredCustomAgents.declared);

package/dist/chunks/{adapters-_HwpLy0R.js → adapters-CgbcceU3.js}

@@ -1,2 +1,2 @@
-import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-BY8slY95.js";
+import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-D-cRFZ_Q.js";
 export { describeAgentResolvability, listAgentIds, setCustomAgents };

package/dist/chunks/{adapters-BY8slY95.js → adapters-D-cRFZ_Q.js}

@@ -5,7 +5,7 @@ import { n as resolveAgentCommand, t as buildAgentSpawnCommand } from "./spawn-c
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, t as grok } from "./grok-BYKnBgdr.js";
 import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
-import "./contracts-D1wLN5iO.js";
+import "./contracts-DZV9H8px.js";
 import { n as mergeCodexPreToolUse, t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import fs from "node:fs";
 //#region session/adapters/claude-code.ts

package/dist/chunks/{config-store-CggAQLUB.js → config-store-D0lRWsAM.js}

@@ -4,7 +4,7 @@ import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-
 import { a as positiveIntOr, c as textOr, n as isRecord } from "./coerce-NSst8oRP.js";
 import { d as writeJsonAtomicSync, f as writeTextAtomic, p as writeTextAtomicSync } from "./json-file-oEH9vt-0.js";
 import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-DTwMFUjx.js";
-import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-D1wLN5iO.js";
+import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-DZV9H8px.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";

package/dist/chunks/config-store-DwTxLe8Y.js

@@ -0,0 +1,2 @@
+import { c as loadConfigFile } from "./config-store-D0lRWsAM.js";
+export { loadConfigFile };

package/dist/chunks/{contracts-D1wLN5iO.js → contracts-DZV9H8px.js}

@@ -1370,6 +1370,15 @@ var clientVariants = [
 		id: sessionId,
 		newName: z.string()
 	}),
+	loose("get-workspace-repos", {
+		id: sessionId,
+		requestId
+	}),
+	loose("set-workspace-repos", {
+		id: sessionId,
+		repos: z.array(z.string()),
+		requestId
+	}),
 	loose("set-session-title", {
 		id: sessionId,
 		title: TaskTitle
@@ -1511,6 +1520,8 @@ Object.freeze([
 	"hooks-report",
 	"save-hook-result",
 	"delete-hook-result",
+	"workspace-repos",
+	"set-workspace-repos-result",
 	"hooks-updated",
 	"state-change",
 	"session-added",
@@ -1635,6 +1646,19 @@ var serverVariants = [
 		error: optionalError,
 		id: z.string().optional()
 	}),
+	loose("workspace-repos", {
+		requestId,
+		id: sessionId,
+		ok: z.boolean(),
+		repos: z.array(z.string()),
+		error: optionalError
+	}),
+	loose("set-workspace-repos-result", {
+		requestId,
+		id: sessionId,
+		ok: z.boolean(),
+		error: optionalError
+	}),
 	loose("hooks-updated", { count: z.number().int().nonnegative() }),
 	loose("state-change", {
 		id: sessionId,

package/dist/chunks/{main-Dh4udE7P.js → main-VMWdsGC6.js}

@@ -20,12 +20,12 @@ import { a as decideTicketAction, i as decideSpawnAllowance, l as isOrchestrator
 import { s as GLIMMERVOID_SECRET_KEYS } from "./grok-BYKnBgdr.js";
 import { _ as isQueueAdmissionTimeout, a as jsonStateLoadError, c as loadedJsonValue, d as writeJsonAtomicSync, f as writeTextAtomic, g as createSpawnGate, h as createSerialQueue, i as createJsonStateWriter, m as createKeyedSerialQueue, n as appendJsonLines, o as loadJsonStateFile, p as writeTextAtomicSync, r as createJsonStateStore, s as loadJsonStateFileSync, t as appendJsonLine, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
 import { $ as TeamReviewCompareFiles, A as MyPrSearchResponse, At as CoherenceWorkInspect, B as PostingPlan, C as MyPrMergeMethod, Ct as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, D as MyPrMergeWhenReadyRequest, E as MyPrMergeStateResponse, F as CommitSha, G as ReviewDraft, H as QueuedReview, I as DECIDING_REVIEW_STATES, J as ReviewThreadId, K as ReviewFinding, L as FindingSeverity, M as MyPrThreadsResponse, N as MyPrsState, Ot as CoherenceTicketCreated, P as MyPrsStatus, R as GithubReviewDecision, Tt as CoherenceOrient, U as ReviewChecksState, V as PrDetail, W as ReviewComment, X as SearchedPr, Y as ReviewVerdict, Z as TeamReviewActionRequest, _ as WorkflowSearchNode, a as ConfigUpdate, at as TeamReviewThreadsRepository, b as MyPrAutoRebase, bt as USAGE_COST_MODES, c as TASK_TITLE_SOURCE_PRIORITY, ct as hasStandingViewerApproval, d as BRANCH_GC_CONTROL_NUMERIC_KEYS, dt as shortSha$1, et as TeamReviewResolveResponse, ft as GH_SEGMENT, g as WorkflowLabelName, h as WorkflowCommentBody, ht as repoParts, it as TeamReviewThreadResult, j as MyPrThreadNode, k as MyPrSearchNode, kt as CoherenceWorkCreated, l as configIssueMessage, lt as FULL_SHA_RE, m as DEFAULT_FACTORY_PROTECTED_PATHS, mt as REPO_SLUG_RE, nt as TeamReviewStatus, o as PersistedTaskTitle, ot as canApproveAfterComment, p as DEFAULT_FACTORY_CHECKS, pt as NODE_ID_RE, q as ReviewResult, r as BrowserConfig, rt as TeamReviewThreadCommentsResponse, s as RUNTIME_CONFIG_SCALAR_KEYS, st as decisionAsIfApprovalRequired, tt as TeamReviewStateEntry, u as BRANCH_GC_CONTROL_BOOLEAN_KEYS, ut as HEX_SHA_RE, v as WorkflowsSettings, w as MyPrMergeRequest, wt as USAGE_INTEGER_RANGES, x as MyPrKeepMergeableRequest, xt as USAGE_VENDOR_KEYS, y as WorkflowsState, yt as USAGE_BUDGET_KEYS, z as GithubReviewState } from "./config-DTwMFUjx.js";
-import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-CggAQLUB.js";
-import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryWorkerEvent, b as planTitle, c as UpdateJournal, d as TraceRecord, et as FactoryLaneState, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryReviewerOutput, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryQueueIntentRequest, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as isSingleFactoryPathSegment, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryReviewVerdict, s as InstallFlavor, t as HTTP_URL_RE, tt as FactoryProjectState, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-D1wLN5iO.js";
-import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-BY8slY95.js";
+import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-D0lRWsAM.js";
+import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryWorkerEvent, b as planTitle, c as UpdateJournal, d as TraceRecord, et as FactoryLaneState, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryReviewerOutput, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryQueueIntentRequest, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as isSingleFactoryPathSegment, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryReviewVerdict, s as InstallFlavor, t as HTTP_URL_RE, tt as FactoryProjectState, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-DZV9H8px.js";
+import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-D-cRFZ_Q.js";
 import { t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import { a as formatSshPublicKey, c as orderAgentSockets, i as commitSigningShimText, l as parseSshPublicKey, n as NO_AGENT_HOLDS_KEY, o as isForwardedAgentDirName, r as agentListsKey, s as isSignableGitObject, t as COMMIT_SIGNING_SHIM_NAME } from "./ssh-signing-core-CRhVVWNW.js";
-import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-DKMQEIZh.js";
+import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-Y6YtqoiO.js";
 import { _ as escapeMarkup, g as createLaneLog, n as createVisionsSetup } from "./visions-setup-CfgNHiG3.js";
 import { t as getRtkPath } from "./rtk-resolver-jJxy_Mrt.js";
 import { createRequire } from "node:module";
@@ -3465,6 +3465,11 @@ function decideWasActiveFlip(to, event, pendingRestart) {
 	if (!pendingRestart && (event === "user_kill" || to === STATES.DONE || to === STATES.FAILED)) return false;
 	return null;
 }
+function haveSameWorkspaceRepos(projectRepos, sessionRepos) {
+	const configured = projectRepos ?? [];
+	const running = sessionRepos ?? [];
+	return configured.length === running.length && configured.every((repoPath, index) => repoPath === running[index]);
+}
 function shouldStartAfterModify(previousState) {
 	return previousState !== STATES.DORMANT;
 }
@@ -3492,7 +3497,8 @@ function diffProjects(currentSessions, newProjects, dependencies) {
 		const resolvedAgentId = dependencies.resolveAgentId(project.agent);
 		const agentChanged = resolvedAgentId !== session.agentId || agentFingerprintOf(resolvedAgentId) !== capturedAgentFingerprintOf(id);
 		const hookTrustChanged = project.codexBypassHookTrust === true !== session.bypassHookTrust;
-		if (pathChanged || permissionsChanged || agentChanged || hookTrustChanged) {
+		const workspaceReposChanged = !haveSameWorkspaceRepos(project.repos, session.workspaceRepos);
+		if (pathChanged || permissionsChanged || agentChanged || hookTrustChanged || workspaceReposChanged) {
 			modified.push(project);
 			continue;
 		}
@@ -4793,7 +4799,15 @@ function runAutoResume(sessions, config, spawnGate, logger = console) {
 	}
 	return Promise.all(runs);
 }
-function carryWorktreeAcrossRecreate(oldSession, newSession) {
+function releaseDroppedWorkspaceMembers(oldSession, newSession, currentSessionFor) {
+	return Promise.resolve(oldSession._killReap).catch(() => {}).then(() => {
+		const liveSession = currentSessionFor?.(oldSession.id) ?? newSession;
+		const keepRepoPaths = isSameDirectoryPath(liveSession.path, oldSession.path) ? liveSession.workspaceRepos ?? [] : [];
+		return oldSession.releaseDroppedWorkspaceMembers(keepRepoPaths);
+	}).catch((error) => console.warn(`[config] releasing dropped workspace members failed for ${oldSession.name}: ${errorMessage(error)}`));
+}
+function carryWorktreeAcrossRecreate(oldSession, newSession, currentSessionFor) {
+	if (oldSession?.workspaceRepos) return releaseDroppedWorkspaceMembers(oldSession, newSession, currentSessionFor);
 	const carry = oldSession?.getWorktreeCarry?.();
 	if (!oldSession || !carry) return;
 	if (isSameDirectoryPath(newSession.path, oldSession.path)) {
@@ -4961,7 +4975,7 @@ function createSessionRegistry(dependencies) {
 			sessions.set(project.id, newSession);
 			captureAgentFingerprint(project);
 			dependencies.wireSessionEvents(newSession);
-			dependencies.carryWorktreeAcrossRecreate(oldSession, newSession);
+			dependencies.carryWorktreeAcrossRecreate(oldSession, newSession, getSession);
 			dependencies.broadcastControl({
 				type: "session-modified",
 				...projectSessionCard(newSession, {
@@ -14092,6 +14106,7 @@ var CLOUD_CREDENTIAL_HOME_ENTRIES = Object.freeze([
 	".netrc",
 	".npmrc"
 ]);
+var STANDARD_LEVEL_USABLE_CREDENTIAL_ENTRIES = Object.freeze(["Library/Keychains"]);
 var XDG_CONFIG_DEFAULT_HOME_PREFIX = ".config/";
 var SHARED_TEMP_DIRS = Object.freeze(["/tmp/claude", "/private/tmp/claude"]);
 var SHARED_HOME_WRITE_ENTRIES = Object.freeze([".npm/_logs"]);
@@ -14158,6 +14173,11 @@ var RUNTIME_MANDATORY_CLAUDE_DENY_FOLDERS = Object.freeze(["commands", "agents"]
 var SANDBOXED_PROXY_BYPASS = "localhost,::1,169.254.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16";
 var HOOK_LOOPBACK_HOST = "127.0.0.1";
 var AGENT_SESSION_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
+var STANDARD_OPEN_NETWORK = Object.freeze({
+	allowAllUnixSockets: true,
+	allowMachLookup: ["*"]
+});
+var STRICT_OPEN_NETWORK = Object.freeze({ allowAllUnixSockets: false });
 function unique(entries) {
 	return [...new Set(entries)];
 }
@@ -14275,8 +14295,13 @@ function relocatedXdgConfigPaths(host, homeEntries) {
 function isStandardLevel(role) {
 	return role.guardrailLevel === "standard";
 }
-function credentialWriteBlocks(host) {
+function blockedCredentialHomeEntries(role) {
 	const credentialHomeEntries = [...CREDENTIAL_HOME_ENTRIES, ...CLOUD_CREDENTIAL_HOME_ENTRIES];
+	if (!isStandardLevel(role)) return credentialHomeEntries;
+	return credentialHomeEntries.filter((entry) => !STANDARD_LEVEL_USABLE_CREDENTIAL_ENTRIES.includes(entry));
+}
+function credentialWriteBlocks(role, host) {
+	const credentialHomeEntries = blockedCredentialHomeEntries(role);
 	return [...homePaths(host, credentialHomeEntries), ...relocatedXdgConfigPaths(host, credentialHomeEntries)];
 }
 function glimmervoidStateWriteBlocks(role, host) {
@@ -14297,7 +14322,7 @@ function glimmervoidStateWriteBlocks(role, host) {
 function standardWriteBlockCandidates(role, host) {
 	if (!isStandardLevel(role)) return [];
 	return unique([
-		...credentialWriteBlocks(host),
+		...credentialWriteBlocks(role, host),
 		...glimmervoidStateWriteBlocks(role, host),
 		...role.blockedPaths ?? []
 	]);
@@ -14305,7 +14330,7 @@ function standardWriteBlockCandidates(role, host) {
 function readDeniedPaths(role, host) {
 	const otherVendors = SANDBOX_VENDORS.filter((vendor) => !role.vendors.includes(vendor));
 	const otherVendorHomeEntries = [...otherVendors.flatMap((vendor) => VENDOR_PROFILES[vendor].homeEntries), ...UNWRAPPED_VENDOR_HOME_ENTRIES];
-	const credentialHomeEntries = [...CREDENTIAL_HOME_ENTRIES, ...CLOUD_CREDENTIAL_HOME_ENTRIES];
+	const credentialHomeEntries = blockedCredentialHomeEntries(role);
 	return [
 		...homePaths(host, [
 			...credentialHomeEntries,
@@ -14364,7 +14389,7 @@ function sandboxRoleRefusal(role, host) {
 	return null;
 }
 function networkPolicy(role) {
-	if (role.network.access === "open") return { allowAllUnixSockets: false };
+	if (role.network.access === "open") return isStandardLevel(role) ? { ...STANDARD_OPEN_NETWORK } : { ...STRICT_OPEN_NETWORK };
 	if (role.network.access === "none") return {
 		allowedDomains: [],
 		deniedDomains: [],
@@ -14425,7 +14450,9 @@ function buildSandboxLaunchPlan(role, host) {
 					denyRead: literalEntries(readDenied),
 					allowRead: literalEntries([...writableWithinDenied, ...role.readableWithinDenied]),
 					...filesystemWrites(role, host, writablePaths)
-				}
+				},
+				terminalScope: isStandardLevel(role) ? "any" : "own",
+				allowAppleEvents: isStandardLevel(role)
 			},
 			launchEnv: Object.assign({ CLAUDE_CODE_TMPDIR: host.tempDir }, ...role.vendors.map((vendor) => VENDOR_PROFILES[vendor].launchEnv), launchHomeEnv(role, host)),
 			sandboxedEnv: sandboxedEnvFor(role, host),
@@ -14473,33 +14500,6 @@ function parseTagVersion(ref) {
 	if (!matched) return null;
 	return matched[1];
 }
-function parseLsRemoteTags(stdout) {
-	if (typeof stdout !== "string") return null;
-	const tagsByVersion = /* @__PURE__ */ new Map();
-	for (const line of stdout.split("\n")) {
-		const fields = line.trim().split(/\s+/);
-		if (fields.length < 2) continue;
-		const sha = normalizeSha(fields[0]);
-		if (!sha) continue;
-		const ref = fields[1];
-		const version = parseTagVersion(ref);
-		if (!version) continue;
-		if (tagsByVersion.get(version) && !ref.endsWith("^{}")) continue;
-		tagsByVersion.set(version, {
-			version,
-			sha
-		});
-	}
-	let latest = null;
-	for (const entry of tagsByVersion.values()) {
-		if (!latest) {
-			latest = entry;
-			continue;
-		}
-		if (compareSemver(entry.version, latest.version) > 0) latest = entry;
-	}
-	return latest;
-}
 function isNpxCachePath(packageRoot) {
 	if (typeof packageRoot !== "string") return false;
 	return packageRoot.split(/[\\/]/).includes(NPX_CACHE_DIRECTORY_NAME);
@@ -14574,19 +14574,6 @@ function compareSemver(a, b) {
 	}
 	return 0;
 }
-function parseLatestReleaseTag(doc) {
-	if (!doc || typeof doc !== "object") return null;
-	const version = parseTagVersion(doc.tag_name);
-	if (!version) return null;
-	return {
-		version,
-		sha: null
-	};
-}
-function decideReleaseSource(flavor) {
-	if (flavor === "npm-global" || flavor === "npx") return "npm-registry";
-	return "github-tags";
-}
 function parseRegistryLatest(doc) {
 	if (!doc || typeof doc !== "object") return null;
 	const registryDocument = doc;
@@ -17269,6 +17256,10 @@ function planWorkspaceMembers({ folder, sessionId, repoPaths }) {
 		}
 	};
 }
+function listDroppedRepoPaths(previousRepoPaths, nextRepoPaths) {
+	const nextRepoKeys = new Set(nextRepoPaths.map((repoPath) => caseFoldedPathKey(path.resolve(repoPath))));
+	return previousRepoPaths.filter((repoPath) => !nextRepoKeys.has(caseFoldedPathKey(path.resolve(repoPath))));
+}
 function renderWorkspaceAgentsMd({ sessionName, branch, members }) {
 	const lines = [
 		`# ${sessionName}`,
@@ -17291,6 +17282,34 @@ async function writeWhenAbsent(filePath, contents) {
 		if (error.code !== "EEXIST") throw error;
 	});
 }
+var WORKSPACE_MAP_FILE = "AGENTS.md";
+var WORKSPACE_POINTER_FILE = "CLAUDE.md";
+var WORKSPACE_MAP_HASH_FILE = ".glimmervoid-map-hash";
+var GENERATED_WORKSPACE_FILES = /* @__PURE__ */ new Set([
+	WORKSPACE_MAP_FILE,
+	WORKSPACE_POINTER_FILE,
+	WORKSPACE_MAP_HASH_FILE
+]);
+function hashWorkspaceMap(contents) {
+	return crypto.createHash("sha256").update(contents).digest("hex");
+}
+async function readWhenPresent(filePath) {
+	return fs.promises.readFile(filePath, "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+}
+async function writeWorkspaceMap(folder, contents) {
+	const mapPath = path.join(folder, WORKSPACE_MAP_FILE);
+	const hashPath = path.join(folder, WORKSPACE_MAP_HASH_FILE);
+	const existingMap = await readWhenPresent(mapPath);
+	const recordedHash = (await readWhenPresent(hashPath))?.trim() ?? null;
+	const renderedHash = hashWorkspaceMap(contents);
+	if (existingMap !== null && existingMap !== contents && hashWorkspaceMap(existingMap) !== recordedHash) return;
+	if (existingMap === contents && recordedHash === renderedHash) return;
+	await fs.promises.writeFile(mapPath, contents);
+	await fs.promises.writeFile(hashPath, `${renderedHash}\n`);
+}
 function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorkspace }) {
 	let activeProvision = null;
 	async function provisionBody() {
@@ -17313,12 +17332,12 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 					base: ensured.base
 				});
 			}
-			await writeWhenAbsent(path.join(plan.folder, "AGENTS.md"), renderWorkspaceAgentsMd({
+			await writeWorkspaceMap(plan.folder, renderWorkspaceAgentsMd({
 				sessionName,
 				branch: plan.branch,
 				members
 			}));
-			await writeWhenAbsent(path.join(plan.folder, "CLAUDE.md"), WORKSPACE_CLAUDE_MD);
+			await writeWhenAbsent(path.join(plan.folder, WORKSPACE_POINTER_FILE), WORKSPACE_CLAUDE_MD);
 			return {
 				ok: true,
 				members
@@ -17339,10 +17358,12 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 		});
 		return attempt;
 	}
-	async function release() {
+	async function release({ keepRepoPaths = [] } = {}) {
 		if (activeProvision) await activeProvision;
+		const keptRepoKeys = new Set(keepRepoPaths.map((repoPath) => caseFoldedPathKey(path.resolve(repoPath))));
 		const keptDirs = [];
 		for (const member of plan.members) {
+			if (keptRepoKeys.has(caseFoldedPathKey(member.repoPath))) continue;
 			if (!await fs.promises.stat(member.dir).then(() => true, () => false)) continue;
 			if (!(await gitWorkspace.removeWorkspaceMember({
 				projectPath: member.repoPath,
@@ -17351,7 +17372,7 @@ function createSessionWorkspaceMembers({ plan, sessionName, shareList, gitWorksp
 			})).ok) keptDirs.push(member.dir);
 		}
 		const entries = await fs.promises.readdir(plan.folder).catch(() => []);
-		if (entries.some((entry) => entry !== "AGENTS.md" && entry !== "CLAUDE.md")) return { keptDirs };
+		if (entries.some((entry) => !GENERATED_WORKSPACE_FILES.has(entry))) return { keptDirs };
 		for (const entry of entries) await fs.promises.rm(path.join(plan.folder, entry), { force: true });
 		await fs.promises.rmdir(plan.folder).catch(() => {});
 		return { keptDirs };
@@ -17825,10 +17846,14 @@ function createSessionWorktreeLifecycle({ id, projectPath, integrationBranch = n
 		lifecycleState.isWorktree = false;
 		setMergeStatus(status);
 	}
-	async function releaseWorkspaceMembers(members) {
-		const released = await members.release();
+	async function releaseWorkspaceMembers(members, keepRepoPaths = []) {
+		const released = await members.release({ keepRepoPaths });
 		if (released.keptDirs.length > 0) console.warn(`[session ${id}] kept workspace members with uncommitted work: ${released.keptDirs.join(", ")}`);
 	}
+	async function releaseDroppedWorkspaceMembers(keepRepoPaths) {
+		if (!workspaceMembers?.ok) return;
+		await releaseWorkspaceMembers(workspaceMembers.members, keepRepoPaths);
+	}
 	async function discardWorktree() {
 		if (workspaceMembers?.ok) return releaseWorkspaceMembers(workspaceMembers.members);
 		stopWatching();
@@ -18601,7 +18626,8 @@ function createSessionWorktreeLifecycle({ id, projectPath, integrationBranch = n
 		mergeWorktree,
 		mergeAndContinue,
 		adoptWorktree,
-		discardWorktree
+		discardWorktree,
+		releaseDroppedWorkspaceMembers
 	};
 	return api;
 }
@@ -19106,6 +19132,7 @@ var Session = class extends EventEmitter {
 	_initialPrompt;
 	_extraClaudeArgs;
 	_resumeSessionId;
+	workspaceRepos;
 	_transcriptPath;
 	_lastClaudeSessionReport;
 	_suppressResumeCapture;
@@ -19239,6 +19266,7 @@ var Session = class extends EventEmitter {
 		this._initialPrompt = initialPrompt;
 		this._extraClaudeArgs = Array.isArray(extraClaudeArgs) ? extraClaudeArgs : [];
 		this._resumeSessionId = resumeSessionId || null;
+		this.workspaceRepos = workspaceRepos ? [...workspaceRepos] : null;
 		this._transcriptPath = null;
 		this._lastClaudeSessionReport = null;
 		this._suppressResumeCapture = false;
@@ -19849,6 +19877,9 @@ var Session = class extends EventEmitter {
 	discardWorktreeIfClean() {
 		return this.worktreeLifecycle.discardIfClean();
 	}
+	releaseDroppedWorkspaceMembers(keepRepoPaths) {
+		return this.worktreeLifecycle.releaseDroppedWorkspaceMembers(keepRepoPaths);
+	}
 	pasteMergePrompt() {
 		return this.worktreeLifecycle.pasteMergePrompt();
 	}
@@ -47883,6 +47914,89 @@ function registerControlHandlers(controlWss, deps) {
 		});
 		if (freshConfig) applyConfigReload(freshConfig);
 	}
+	function handleGetWorkspaceRepos(msg, ws) {
+		const project = findConfiguredProject(msg.id);
+		if (!project?.repos) {
+			replyTo(ws, msg, "workspace-repos", {
+				id: msg.id,
+				ok: false,
+				repos: [],
+				error: "This session is not a workspace"
+			});
+			return;
+		}
+		replyTo(ws, msg, "workspace-repos", {
+			id: msg.id,
+			ok: true,
+			repos: project.repos,
+			error: null
+		});
+	}
+	async function findDroppedMemberWithUncommittedWork(workspaceFolder, droppedRepoPaths) {
+		for (const repoPath of droppedRepoPaths) {
+			const memberName = path.basename(path.resolve(repoPath));
+			const memberDir = path.join(workspaceFolder, memberName);
+			if (!await fs.promises.stat(memberDir).then(() => true, () => false)) continue;
+			const memberStatus = await runGit([
+				"--no-optional-locks",
+				"status",
+				"--porcelain"
+			], { cwd: memberDir });
+			if (!memberStatus.ok) throw memberStatus.error;
+			if (memberStatus.out !== "") return memberName;
+		}
+		return null;
+	}
+	async function handleSetWorkspaceRepos(msg, ws) {
+		const reply = (error) => replyTo(ws, msg, "set-workspace-repos-result", {
+			id: msg.id,
+			ok: error === null,
+			error
+		});
+		const project = findConfiguredProject(msg.id);
+		const session = sessions.get(msg.id);
+		if (!project?.repos || !session) {
+			reply("This session is not a workspace");
+			return;
+		}
+		const missingRepo = msg.repos.find((repoPath) => !isExistingDirectory(repoPath));
+		if (missingRepo) {
+			reply(`Repository path does not exist: ${missingRepo}`);
+			return;
+		}
+		const planned = planWorkspaceMembers({
+			folder: project.path,
+			sessionId: project.id,
+			repoPaths: msg.repos
+		});
+		if (!planned.ok) {
+			reply(planned.error);
+			return;
+		}
+		const nextRepos = planned.plan.members.map((member) => member.repoPath);
+		try {
+			const dirtyMemberName = await findDroppedMemberWithUncommittedWork(project.path, listDroppedRepoPaths(project.repos, nextRepos));
+			if (dirtyMemberName) {
+				reply(`${dirtyMemberName} has uncommitted changes. Commit or discard them before removing it from the workspace.`);
+				return;
+			}
+		} catch (error) {
+			reply(`Could not check the workspace for uncommitted changes: ${errorMessage(error)}`);
+			return;
+		}
+		const freshConfig = configStore.save((cfg) => {
+			const configured = cfg.projects.find((entry) => entry.id === project.id);
+			if (!configured) return ABORT_CONFIG_SAVE;
+			configured.repos = nextRepos;
+		});
+		if (!freshConfig) {
+			reply(`Could not save session "${project.name}"`);
+			return;
+		}
+		applyConfigReload(freshConfig);
+		console.log(`[control] Workspace repositories updated via UI: ${project.name} (${nextRepos.length} repos)`);
+		reply(null);
+	}
 	function handleSetSessionTitle(msg, ws) {
 		const session = findSession(msg);
 		const parsedTitle = TaskTitle.safeParse(msg.title);
@@ -48840,6 +48954,8 @@ function registerControlHandlers(controlWss, deps) {
 		"resume-conversation": handleResumeConversation,
 		"remove-session": handleRemoveSession,
 		"rename-session": handleRenameSession,
+		"get-workspace-repos": handleGetWorkspaceRepos,
+		"set-workspace-repos": handleSetWorkspaceRepos,
 		"set-session-title": handleSetSessionTitle,
 		"reorder-sessions": handleReorderSessions,
 		"ping": handlePing,
@@ -49601,12 +49717,9 @@ function markInterrupted(journal, { reason, now }) {
 }
 //#endregion
 //#region server/update-check.ts
-var GIT_REMOTE_URL = `https://github.com/${REPO_SLUG}.git`;
-var GITHUB_LATEST_RELEASE_URL = `https://api.github.com/repos/${REPO_SLUG}/releases/latest`;
 var NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/glimmervoid/latest";
 var DEFAULT_TIMEOUT_MS = 8e3;
 var GIT_HEAD_TIMEOUT_MS = 3e3;
-var LS_REMOTE_TIMEOUT_MS = 5e3;
 var RELEASE_ANCESTRY_TIMEOUT_MS = 3e3;
 var MAIN_CHANNEL_BUDGET_MS = DEFAULT_TIMEOUT_MS;
 var MAIN_FETCH_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 2);
@@ -49614,6 +49727,7 @@ var MAIN_REMOTE_TIP_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 4);
 var MAIN_BEHIND_COUNT_TIMEOUT_MS = Math.floor(MAIN_CHANNEL_BUDGET_MS / 4);
 var STATE_FILE_NAME = "update-check.json";
 var STATE_TTL_MS = 216e5;
+var RELEASE_SOURCE = "npm-registry";
 function defaultStatePath() {
 	return path.join(glimmervoidHomeDir$1(), STATE_FILE_NAME);
 }
@@ -49757,59 +49871,6 @@ async function resolveLatestRegistryVersion({ fetchFn, signal }) {
 		};
 	}
 }
-async function resolveLatestRelease({ flavor, runCommand, fetchFn, signal }) {
-	if (decideReleaseSource(flavor) === "npm-registry") return resolveLatestRegistryVersion({
-		fetchFn,
-		signal
-	});
-	const fromRemote = parseLsRemoteTags((await runGitProbe(runCommand, [
-		"ls-remote",
-		"--tags",
-		GIT_REMOTE_URL
-	], {
-		timeout: LS_REMOTE_TIMEOUT_MS,
-		signal
-	})).out);
-	if (fromRemote) return {
-		...fromRemote,
-		behindCount: null,
-		reason: null
-	};
-	try {
-		const response = await fetchFn(GITHUB_LATEST_RELEASE_URL, {
-			signal,
-			headers: {
-				Accept: "application/vnd.github+json",
-				"User-Agent": "glimmervoid-update-check"
-			}
-		});
-		if (!response?.ok) return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-		const release = parseLatestReleaseTag(await response.json());
-		if (!release) return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-		return {
-			...release,
-			behindCount: null,
-			reason: null
-		};
-	} catch {
-		return {
-			version: null,
-			sha: null,
-			behindCount: null,
-			reason: "release-check-failed"
-		};
-	}
-}
 function upstreamBranch(upstream) {
 	const slashIndex = upstream.indexOf("/");
 	if (slashIndex < 0 || slashIndex === upstream.length - 1) return null;
@@ -49982,13 +50043,11 @@ async function checkForUpdate({ currentVersion, updateChannel = "release", fetch
 		});
 		const cached = readCheckState(statePath);
 		const cacheOutrunByInstall = normalizeSha(cached?.latestSha) !== null && normalizeSha(cached?.latestSha) === installed.installedSha;
-		const expectedReleaseSource = updateChannel === "release" ? decideReleaseSource(installed.flavor) : null;
+		const expectedReleaseSource = updateChannel === "release" ? RELEASE_SOURCE : null;
 		const isCacheFromSameSource = expectedReleaseSource === null || cached?.releaseSource === expectedReleaseSource;
 		if (cached?.channel === updateChannel && isCacheFromSameSource && !cacheOutrunByInstall && isCheckFresh(cached.lastCheckAt, now, ttlMs)) return finish(installed, targetFromCache(cached), currentVersion, updateChannel, platform, now, packageRoot$1, runCommand, signal);
 		signal.throwIfAborted();
-		const latestTarget = updateChannel === "main" ? await resolveLatestMain(installed, packageRoot$1, runCommand, fetchOrigin, signal) : await resolveLatestRelease({
-			flavor: installed.flavor,
-			runCommand,
+		const latestTarget = updateChannel === "main" ? await resolveLatestMain(installed, packageRoot$1, runCommand, fetchOrigin, signal) : await resolveLatestRegistryVersion({
 			fetchFn,
 			signal
 		});

package/dist/chunks/{pair-cli-Nnrd0il_.js → pair-cli-CI848omy.js}

@@ -1,6 +1,6 @@
 import { r as errorMessage } from "./text-DoirglWV.js";
-import { l as resolveConfigPath } from "./config-store-CggAQLUB.js";
-import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-DKMQEIZh.js";
+import { l as resolveConfigPath } from "./config-store-D0lRWsAM.js";
+import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-Y6YtqoiO.js";
 import fs from "node:fs";
 //#region server/text-format.ts
 function trimIso(iso) {

package/dist/chunks/{remote-config-DKMQEIZh.js → remote-config-Y6YtqoiO.js}

@@ -3,7 +3,7 @@ import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import { n as unrefTimer, t as DEFAULT_TIMER_FNS } from "./timer-deps-u2DAQLok.js";
 import { a as jsonStateLoadError, d as writeJsonAtomicSync, l as sleepSync, s as loadJsonStateFileSync, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
-import { s as glimmervoidHomeDir } from "./config-store-CggAQLUB.js";
+import { s as glimmervoidHomeDir } from "./config-store-D0lRWsAM.js";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";