glimmervoid 0.35.1 → 0.36.0

package/dist/chunks/config-store-LqQ7MuyV.js

@@ -0,0 +1,4181 @@
+import { n as errorLabel, r as errorMessage } from "./text-DoirglWV.js";
+import { n as equalsIgnoringCaseOnWindows } from "./paths-Bu4eH1Yd.js";
+import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
+import { n as isRecord } from "./coerce-NSst8oRP.js";
+import { d as writeJsonAtomicSync, f as writeTextAtomic, p as writeTextAtomicSync } from "./json-file-BaxGcB2R.js";
+import { A as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, B as USAGE_BUDGET_RANGE, C as normalizeLegacyConfigNumbers, D as FLYING_ANIMALS_DURATION_RANGE, E as FLYING_ANIMALS_DEFAULTS, F as POSTHOG_TRAFFIC_BASELINE_RANGE, G as WORKFLOWS_MAX_CONCURRENT_SESSIONS_RANGE, H as USAGE_RETAIN_DAYS_RANGE, I as POSTHOG_TRAFFIC_MIN_USERS_RANGE, L as POSTHOG_TRAFFIC_MULTIPLIER_RANGE, M as PORT_RANGE, N as POSITIVE_NUMBER_RANGE, O as FLYING_ANIMALS_GAP_RANGE, P as POSTHOG_FIX_TIMEOUT_RANGE, R as REPLAY_BUFFER_KB_RANGE, T as FACTORY_MAX_LIVE_WORKERS_RANGE, U as USAGE_SCAN_INTERVAL_RANGE, V as USAGE_INTEGER_RANGES, W as WORKFLOWS_MAX_ACTIONS_PER_POLL_RANGE, d as CHANGE_MAP_NARRATOR_ENGINES, f as DEFAULT_FACTORY_CHECKS, h as UPDATE_CHANNELS, i as Config, j as NON_NEGATIVE_NUMBER_RANGE, k as FLYING_ANIMALS_SCALE_RANGE, l as configIssueMessage, m as POST_TURN_CHECK_MODES, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_PROTECTED_PATHS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE, u as BranchGcFileSettings, w as CHANGE_MAP_NARRATOR_TIMEOUT_RANGE, x as USAGE_COST_MODES, z as TASK_TITLE_TIMEOUT_RANGE } from "./config-CuZ16F9W.js";
+import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-BLZAOP57.js";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { promisify } from "node:util";
+import crypto, { createHash } from "node:crypto";
+//#region shared/canonical-paths.ts
+var realpathNative = promisify(fs.realpath.native);
+function canonicalizePath(p) {
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
+}
+function isSameDirectoryPath(a, b) {
+	const resolvedA = path.resolve(String(a || ""));
+	const resolvedB = path.resolve(String(b || ""));
+	if (equalsIgnoringCaseOnWindows(resolvedA, resolvedB)) return true;
+	if (process.platform !== "win32" && process.platform !== "darwin") return false;
+	return equalsIgnoringCaseOnWindows(canonicalizePath(resolvedA), canonicalizePath(resolvedB));
+}
+async function comparableDirectoryPath(candidatePath) {
+	const resolvedPath = path.resolve(String(candidatePath || ""));
+	let canonicalPath;
+	try {
+		canonicalPath = await realpathNative(resolvedPath);
+	} catch {
+		canonicalPath = resolvedPath;
+	}
+	if (process.platform !== "win32") return canonicalPath;
+	return canonicalPath.toLowerCase();
+}
+//#endregion
+//#region server/core/branch-gc-core.ts
+var SESSION_BRANCH_PREFIX = "glimmervoid/session/";
+var DEFAULT_BRANCH_GC_PREFIXES = [SESSION_BRANCH_PREFIX, "worktree-agent-"];
+var DAY_MS = 864e5;
+var MERGED_DELETION_REASON = "merged-into-integration";
+var STALE_DELETION_REASON = "stale-orphan";
+var UNMERGED_KEPT_REASON = "not-merged-and-unmerged-deletion-off";
+function sessionIdFromBranch(branchName) {
+	if (!branchName.startsWith(SESSION_BRANCH_PREFIX)) return null;
+	return branchName.slice(20);
+}
+function usablePrefixes(prefixes) {
+	return prefixes.filter((prefix) => prefix.length > 0);
+}
+function matchedPrefix(name, prefixes) {
+	for (const prefix of usablePrefixes(prefixes)) if (name.startsWith(prefix)) return prefix;
+	return null;
+}
+function protectedBranchNames(integrationTips) {
+	return /* @__PURE__ */ new Set([
+		"main",
+		"master",
+		...integrationTips.map((tip) => tip.branch)
+	]);
+}
+function planBranchGc({ remoteBranches = [], integrationTips = [], liveSessionIds = /* @__PURE__ */ new Set(), prefixes = DEFAULT_BRANCH_GC_PREFIXES, nowMs, staleDays = 14, deleteUnmerged = false }) {
+	const deletions = [];
+	const kept = [];
+	const protectedNames = protectedBranchNames(integrationTips);
+	const staleBeforeMs = nowMs - staleDays * DAY_MS;
+	for (const remoteBranch of remoteBranches) {
+		const { name, tipSha } = remoteBranch;
+		if (matchedPrefix(name, prefixes) === null) {
+			kept.push({
+				name,
+				reason: "foreign-prefix"
+			});
+			continue;
+		}
+		if (protectedNames.has(name)) {
+			kept.push({
+				name,
+				reason: "not-merged-and-fresh"
+			});
+			continue;
+		}
+		const sessionId = sessionIdFromBranch(name);
+		if (sessionId !== null && liveSessionIds.has(sessionId)) {
+			kept.push({
+				name,
+				reason: "live-session"
+			});
+			continue;
+		}
+		if (remoteBranch.mergedIntoIntegration === true) {
+			deletions.push({
+				name,
+				reason: remoteBranch.mergedReason ?? MERGED_DELETION_REASON,
+				tipSha
+			});
+			continue;
+		}
+		if (!deleteUnmerged) {
+			kept.push({
+				name,
+				reason: UNMERGED_KEPT_REASON
+			});
+			continue;
+		}
+		if (Number.isFinite(remoteBranch.tipCommitTimeMs) && remoteBranch.tipCommitTimeMs < staleBeforeMs) {
+			deletions.push({
+				name,
+				reason: STALE_DELETION_REASON,
+				tipSha
+			});
+			continue;
+		}
+		kept.push({
+			name,
+			reason: "not-merged-and-fresh"
+		});
+	}
+	return {
+		deletions,
+		kept
+	};
+}
+function worktreeIntegrationTips({ projectTips, worktreeOwnTips }) {
+	const tipBySha = /* @__PURE__ */ new Map();
+	for (const tip of [...projectTips, ...worktreeOwnTips]) {
+		if (!tip.sha) continue;
+		if (tipBySha.has(tip.sha)) continue;
+		tipBySha.set(tip.sha, tip);
+	}
+	return [...tipBySha.values()];
+}
+function protectedWorktreeBranchNames(integrationTips, worktrees) {
+	const ownIntegrationBranches = worktrees.map((worktree) => worktree.integrationBranch).filter((branch) => Boolean(branch)).map((branch) => ({ branch }));
+	return protectedBranchNames([...integrationTips, ...ownIntegrationBranches]);
+}
+function planWorktreeGc({ worktrees, liveWorktreePaths, integrationTips, prefixes }) {
+	const removals = [];
+	const kept = [];
+	const protectedNames = protectedWorktreeBranchNames(integrationTips, worktrees);
+	for (const worktree of worktrees) {
+		const decision = (disposition, reason) => ({
+			cwd: worktree.cwd,
+			branch: worktree.branch,
+			disposition,
+			reason
+		});
+		if (worktree.prunable === true) {
+			kept.push(decision("keep", "missing-directory"));
+			continue;
+		}
+		if (worktree.locked) {
+			kept.push(decision("keep", "locked"));
+			continue;
+		}
+		if (liveWorktreePaths.has(worktree.cwd)) {
+			kept.push(decision("keep", "live-session"));
+			continue;
+		}
+		if (protectedNames.has(worktree.branch)) {
+			kept.push(decision("keep", "protected"));
+			continue;
+		}
+		if (matchedPrefix(worktree.branch, prefixes) === null) {
+			kept.push(decision("keep", "foreign-prefix"));
+			continue;
+		}
+		if (worktree.dirty === null) {
+			kept.push(decision("keep", "status-probe-failed"));
+			continue;
+		}
+		if (worktree.dirty) {
+			kept.push(decision("keep", "uncommitted-changes"));
+			continue;
+		}
+		if (worktree.atIntegrationTip === true) {
+			kept.push(decision("keep", "no-commits"));
+			continue;
+		}
+		if (worktree.merged === null) {
+			kept.push(decision("keep", "merge-proof-failed"));
+			continue;
+		}
+		if (worktree.merged !== true) {
+			kept.push(decision("keep", "unmerged"));
+			continue;
+		}
+		removals.push(decision("remove", "merged"));
+	}
+	return {
+		removals,
+		kept
+	};
+}
+//#endregion
+//#region server/core/config-secrets-core.ts
+var ENV_SECRET_BINDINGS = Object.freeze([{
+	blockName: "posthog",
+	secretKey: "apiKey",
+	environmentVariable: "GLIMMERVOID_POSTHOG_API_KEY"
+}, {
+	blockName: "telegram",
+	secretKey: "botToken",
+	environmentVariable: "GLIMMERVOID_TELEGRAM_BOT_TOKEN"
+}]);
+function readEnvSecrets(env) {
+	const resolvedSecrets = [];
+	for (const binding of ENV_SECRET_BINDINGS) {
+		const value = env[binding.environmentVariable];
+		if (typeof value !== "string" || value.length === 0) continue;
+		resolvedSecrets.push({
+			...binding,
+			value
+		});
+	}
+	return resolvedSecrets;
+}
+function copyOfBlock(config, blockName) {
+	const block = config[blockName];
+	if (!isRecord(block)) return {};
+	return { ...block };
+}
+function withEnvSecrets(config, envSecrets) {
+	if (envSecrets.length === 0) return config;
+	const overlaid = { ...config };
+	for (const secret of envSecrets) overlaid[secret.blockName] = {
+		...copyOfBlock(overlaid, secret.blockName),
+		[secret.secretKey]: secret.value
+	};
+	return overlaid;
+}
+function withoutEnvSecrets(config, envSecrets) {
+	if (envSecrets.length === 0) return config;
+	const stripped = { ...config };
+	for (const secret of envSecrets) {
+		if (!isRecord(stripped[secret.blockName])) continue;
+		const remaining = copyOfBlock(stripped, secret.blockName);
+		delete remaining[secret.secretKey];
+		if (Object.keys(remaining).length === 0) {
+			delete stripped[secret.blockName];
+			continue;
+		}
+		stripped[secret.blockName] = remaining;
+	}
+	return stripped;
+}
+function withSortedKeys(value) {
+	if (Array.isArray(value)) return value.map(withSortedKeys);
+	if (!isRecord(value)) return value;
+	const sorted = {};
+	for (const key of Object.keys(value).sort()) sorted[key] = withSortedKeys(value[key]);
+	return sorted;
+}
+function stableConfigKey(value) {
+	return JSON.stringify(withSortedKeys(value));
+}
+//#endregion
+//#region server/core/telemetry-core.ts
+var POSTHOG_INGEST_HOST = "https://us.i.posthog.com";
+var TELEMETRY_BATCH_URL = `${POSTHOG_INGEST_HOST}/batch/`;
+var TELEMETRY_FLAGS_URL = `${POSTHOG_INGEST_HOST}/flags?v=2`;
+var MAX_STACK_LENGTH = 16384;
+var FIRST_RUN_NOTICE = ["Glimmervoid sends anonymous usage and error data to help improve it: app starts, daily activity, session starts and ends with the agent kind, exit kind and duration, errors as their type, error code and scrubbed stack frames, per session token counts, models and estimated cost, and factory outcomes as the kind of decision, how it came out, its duration and attempt number. No error messages, paths, repository names, prompts, objectives, model output or terminal output.", "Turn it off in Settings > Privacy, or set GLIMMERVOID_TELEMETRY=0 or DO_NOT_TRACK=1."].join("\n");
+var TRUTHY_FLAGS = /* @__PURE__ */ new Set([
+	"1",
+	"true",
+	"yes"
+]);
+var FALSY_FLAGS = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"no",
+	"off"
+]);
+function normalizedFlag(value) {
+	return (value ?? "").trim().toLowerCase();
+}
+function decideTelemetryConsent(env, config) {
+	if (TRUTHY_FLAGS.has(normalizedFlag(env.DO_NOT_TRACK))) return {
+		isEnabled: false,
+		source: "do-not-track"
+	};
+	if (FALSY_FLAGS.has(normalizedFlag(env.GLIMMERVOID_TELEMETRY))) return {
+		isEnabled: false,
+		source: "environment"
+	};
+	if (TRUTHY_FLAGS.has(normalizedFlag(env.CI))) return {
+		isEnabled: false,
+		source: "ci"
+	};
+	if (normalizedFlag(env.NODE_TEST_CONTEXT) !== "") return {
+		isEnabled: false,
+		source: "test-runner"
+	};
+	const configured = config.telemetry?.enabled;
+	if (typeof configured === "boolean") return {
+		isEnabled: configured,
+		source: "config"
+	};
+	return {
+		isEnabled: true,
+		source: "default"
+	};
+}
+function isTelemetryForcedOff(env) {
+	return decideTelemetryConsent(env, { telemetry: { enabled: true } }).isEnabled === false;
+}
+function resolveProjectToken(env) {
+	return env.GLIMMERVOID_TELEMETRY_PROJECT_TOKEN?.trim() || "phc_s68t9vWmeGcrWkx4NkLQaEiVZ9sMBxv8GjQBbAcix2Sf";
+}
+function toForwardSlashes(filePath) {
+	return filePath.replaceAll("\\", "/");
+}
+function isWindowsStylePath(filePath) {
+	return /^[A-Za-z]:\//.test(filePath);
+}
+function comparablePath(filePath) {
+	const forward = toForwardSlashes(filePath).replace(/\/+$/, "");
+	return isWindowsStylePath(forward) ? forward.toLowerCase() : forward;
+}
+function decodedFileUrlPath(fileUrl) {
+	const urlPath = fileUrl.slice(7).replace(/^\/([A-Za-z]:)/, "$1");
+	try {
+		return decodeURIComponent(urlPath);
+	} catch {
+		return urlPath;
+	}
+}
+function stripFileScheme(rawPath) {
+	if (!rawPath.startsWith("file://")) return toForwardSlashes(rawPath);
+	return toForwardSlashes(decodedFileUrlPath(rawPath));
+}
+function relativeUnder(filePath, root) {
+	if (!root) return null;
+	const comparableRoot = comparablePath(root);
+	if (!comparableRoot) return null;
+	if (!comparablePath(filePath).startsWith(`${comparableRoot}/`)) return null;
+	return toForwardSlashes(filePath).slice(comparableRoot.length + 1);
+}
+function scrubLocalPath(rawPath, packageRoot) {
+	const filePath = stripFileScheme(rawPath);
+	if (filePath.startsWith("node:")) return filePath;
+	const underPackage = relativeUnder(filePath, packageRoot);
+	if (underPackage !== null) return underPackage;
+	const nodeModulesAt = filePath.lastIndexOf("/node_modules/");
+	if (nodeModulesAt >= 0) return filePath.slice(nodeModulesAt + 1);
+	return filePath.slice(filePath.lastIndexOf("/") + 1);
+}
+function isInApp(rawPath, packageRoot) {
+	const filePath = stripFileScheme(rawPath);
+	if (filePath.startsWith("node:")) return false;
+	const underPackage = relativeUnder(filePath, packageRoot);
+	if (underPackage === null) return false;
+	return !underPackage.split("/").includes("node_modules");
+}
+var V8_FRAME_WITH_FUNCTION = /^\s*at (.+?) \((.+?):(\d+):(\d+)\)$/;
+var V8_FRAME_ANONYMOUS = /^\s*at (.+?):(\d+):(\d+)$/;
+function matchV8Frame(stackLine) {
+	const named = V8_FRAME_WITH_FUNCTION.exec(stackLine);
+	if (named) return {
+		functionName: named[1].replace(/^async /, ""),
+		filePath: named[2],
+		line: named[3],
+		column: named[4]
+	};
+	const anonymous = V8_FRAME_ANONYMOUS.exec(stackLine);
+	if (!anonymous) return null;
+	return {
+		functionName: "?",
+		filePath: anonymous[1].replace(/^async /, ""),
+		line: anonymous[2],
+		column: anonymous[3]
+	};
+}
+function parseV8StackFrames(stack, packageRoot, platform = "node:javascript") {
+	const frames = [];
+	for (const stackLine of stack.slice(0, MAX_STACK_LENGTH).split("\n")) {
+		const rawFrame = matchV8Frame(stackLine);
+		if (!rawFrame) continue;
+		frames.push({
+			platform,
+			function: rawFrame.functionName.slice(0, 512),
+			filename: scrubLocalPath(rawFrame.filePath, packageRoot).slice(0, 512),
+			lineno: Number(rawFrame.line),
+			colno: Number(rawFrame.column),
+			in_app: isInApp(rawFrame.filePath, packageRoot)
+		});
+		if (frames.length >= 64) break;
+	}
+	return frames.reverse();
+}
+var ERROR_CODE_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/;
+function safeErrorCode(error) {
+	const code = Reflect.get(error, "code");
+	if (typeof code !== "string") return "";
+	return ERROR_CODE_SHAPE.test(code) ? code : "";
+}
+function errorParts(error) {
+	if (error instanceof Error) return {
+		type: error.name || "Error",
+		code: safeErrorCode(error),
+		stack: error.stack ?? ""
+	};
+	return {
+		type: "NonError",
+		code: "",
+		stack: ""
+	};
+}
+function exceptionPropertiesOf({ type, code, handled, level, frames }) {
+	return {
+		$exception_list: [{
+			type: type.slice(0, 512),
+			value: code,
+			mechanism: {
+				handled,
+				synthetic: false,
+				type: "generic"
+			},
+			stacktrace: {
+				type: "raw",
+				frames
+			}
+		}],
+		$exception_level: level
+	};
+}
+function buildExceptionProperties(error, { handled, packageRoot }) {
+	const parts = errorParts(error);
+	return exceptionPropertiesOf({
+		type: parts.type,
+		code: parts.code,
+		handled,
+		level: handled ? "error" : "fatal",
+		frames: parseV8StackFrames(parts.stack, packageRoot)
+	});
+}
+var BROWSER_FRAME_GECKO = /^\s*([^@]*)@(.+?):(\d+):(\d+)$/;
+var URL_ORIGIN = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/]*/;
+var SAFE_ERROR_TYPE_NAME = /^[A-Za-z_$][\w$]{0,127}$/;
+function isWebUrl(rawUrl) {
+	return /^https?:\/\//i.test(rawUrl);
+}
+function lastPathSegment(urlPath) {
+	return urlPath.slice(urlPath.lastIndexOf("/") + 1);
+}
+function scrubWebPath(webPath) {
+	const nodeModulesAt = webPath.lastIndexOf("/node_modules/");
+	if (nodeModulesAt >= 0) return webPath.slice(nodeModulesAt + 1);
+	if (webPath.startsWith("/@fs/")) return lastPathSegment(webPath);
+	return webPath;
+}
+function urlPathOnly(rawUrl) {
+	const [withoutQueryOrHash] = rawUrl.split(/[?#]/, 1);
+	if (isWebUrl(withoutQueryOrHash)) return scrubWebPath(withoutQueryOrHash.replace(URL_ORIGIN, "") || "/");
+	return lastPathSegment(withoutQueryOrHash);
+}
+function matchBrowserFrame(stackLine) {
+	const v8Frame = matchV8Frame(stackLine);
+	if (v8Frame) return v8Frame;
+	const gecko = BROWSER_FRAME_GECKO.exec(stackLine);
+	if (!gecko) return null;
+	return {
+		functionName: gecko[1] || "?",
+		filePath: gecko[2],
+		line: gecko[3],
+		column: gecko[4]
+	};
+}
+function parseBrowserStackFrames(stack) {
+	const frames = [];
+	for (const stackLine of stack.slice(0, MAX_STACK_LENGTH).split("\n")) {
+		const rawFrame = matchBrowserFrame(stackLine);
+		if (!rawFrame) continue;
+		frames.push({
+			platform: "web:javascript",
+			function: rawFrame.functionName.slice(0, 512),
+			filename: urlPathOnly(rawFrame.filePath).slice(0, 512),
+			lineno: Number(rawFrame.line),
+			colno: Number(rawFrame.column),
+			in_app: isWebUrl(rawFrame.filePath)
+		});
+		if (frames.length >= 64) break;
+	}
+	return frames.reverse();
+}
+function safeErrorTypeName(name) {
+	return SAFE_ERROR_TYPE_NAME.test(name) ? name : "Error";
+}
+function buildBrowserExceptionProperties({ name, stack }) {
+	return exceptionPropertiesOf({
+		type: safeErrorTypeName(name),
+		code: "",
+		handled: false,
+		level: "error",
+		frames: parseBrowserStackFrames(stack)
+	});
+}
+function exceptionFingerprint(properties) {
+	const [exception] = properties.$exception_list;
+	const inAppFrames = exception.stacktrace.frames.filter((frame) => frame.in_app).map((frame) => `${frame.function}@${frame.filename}`);
+	return [exception.type, ...inAppFrames].join("|");
+}
+function isBuiltinAgentId(agentId) {
+	return BUILTIN_AGENT_IDS.some((builtinAgentId) => builtinAgentId === agentId);
+}
+function adapterBucket(agentId) {
+	if (isBuiltinAgentId(agentId)) return agentId;
+	return "custom";
+}
+function classifySessionExit({ exitCode, signal, reason }) {
+	if (reason === "no_output_before_exit") return "no_output";
+	if (signal) return "signal";
+	if (exitCode === 0) return "clean";
+	return "error";
+}
+var AI_PROVIDER_BY_VENDOR = Object.freeze({
+	claude: "anthropic",
+	codex: "openai",
+	grok: "xai"
+});
+var AGENT_ID_BY_VENDOR = Object.freeze({
+	claude: "claude-code",
+	codex: "codex",
+	grok: "grok"
+});
+function aiTraceId(installId, sessionId) {
+	return createHash("sha256").update(`${installId}${sessionId}`).digest("hex");
+}
+function wholeTokenCount(tokens) {
+	return Math.max(0, Math.round(tokens));
+}
+function buildAiGenerationEvent(row, installId) {
+	const properties = {
+		$ai_trace_id: aiTraceId(installId, row.sessionId),
+		$ai_provider: (AI_PROVIDER_BY_VENDOR[row.vendor] ?? row.vendor).slice(0, 64),
+		$ai_model: row.isModelKnown ? row.model.slice(0, 128) : "unknown",
+		$ai_input_tokens: wholeTokenCount(row.input),
+		$ai_output_tokens: wholeTokenCount(row.output),
+		$ai_cache_read_input_tokens: wholeTokenCount(row.cacheRead),
+		$ai_cache_creation_input_tokens: wholeTokenCount(row.cacheCreate),
+		agent_adapter: adapterBucket(AGENT_ID_BY_VENDOR[row.vendor])
+	};
+	if (!row.hasKnownCost) return properties;
+	return {
+		...properties,
+		$ai_total_cost_usd: Math.max(0, row.costUSD)
+	};
+}
+function hasAnyTokens(row) {
+	return row.input + row.output + row.cacheRead + row.cacheCreate > 0;
+}
+function buildAiGenerationEvents(rows, installId) {
+	return rows.filter(hasAnyTokens).map((row) => buildAiGenerationEvent(row, installId));
+}
+function decideRemoteTelemetryState(previous, response) {
+	const parsed = FeatureFlagsResponse.safeParse(response);
+	if (!parsed.success || parsed.data.errorsWhileComputingFlags === true) return previous;
+	const killSwitchFlag = parsed.data.flags[TELEMETRY_KILL_SWITCH_FLAG];
+	if (!killSwitchFlag) return previous;
+	return killSwitchFlag.enabled ? "enabled" : "disabled";
+}
+var POSTHOG_RELEASE_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+function parsePosthogReleaseId(value) {
+	if (typeof value !== "string") return null;
+	return POSTHOG_RELEASE_ID_SHAPE.test(value) ? value : null;
+}
+function decideIsDevInstall({ installFlavor, isBundled, homeDir, defaultHomeDir }) {
+	if (installFlavor === "clone" || !isBundled) return true;
+	return comparablePath(homeDir) !== comparablePath(defaultHomeDir);
+}
+function buildFactoryDecisionEvent(decision) {
+	return {
+		kind: decision.kind,
+		outcome: decision.outcome,
+		failure_class: decision.failureClass,
+		duration_ms: decision.durationMs,
+		attempt: decision.attempt
+	};
+}
+function nodeMajorVersion(nodeVersion) {
+	const major = Number.parseInt(nodeVersion.replace(/^v/, ""), 10);
+	return Number.isFinite(major) ? major : 0;
+}
+//#endregion
+//#region shared/settings/registry.ts
+var BROWSER_NOW = {
+	scope: "browser",
+	access: "editable",
+	takesEffect: "now"
+};
+var BROWSER_ADVANCED = {
+	scope: "browser",
+	access: "advanced",
+	takesEffect: "now"
+};
+var MACHINE_NOW = {
+	scope: "machine",
+	access: "editable",
+	takesEffect: "now"
+};
+var MACHINE_NEW_SESSIONS = {
+	scope: "machine",
+	access: "editable",
+	takesEffect: "new-sessions"
+};
+var READOUT = {
+	scope: "machine",
+	access: "readout",
+	takesEffect: "now"
+};
+var FILE_ONLY = {
+	scope: "machine",
+	access: "file-only"
+};
+var MS_PER_SECOND = 1e3;
+var SECONDS_PER_MINUTE = 60;
+var MINUTES_PER_HOUR = 60;
+var MS_PER_MINUTE = MS_PER_SECOND * SECONDS_PER_MINUTE;
+var MS_PER_HOUR = MS_PER_MINUTE * MINUTES_PER_HOUR;
+var MS_PER_DAY = MS_PER_HOUR * 24;
+var INVESTIGATIONS = {
+	label: "investigations",
+	storedPerDisplay: 1
+};
+var SESSIONS = {
+	label: "sessions",
+	storedPerDisplay: 1
+};
+var WORKERS = {
+	label: "workers",
+	storedPerDisplay: 1
+};
+var RECURRENCES = {
+	label: "recurrences",
+	storedPerDisplay: 1
+};
+var ACTIONS = {
+	label: "actions",
+	storedPerDisplay: 1
+};
+var SECONDS = {
+	label: "seconds",
+	storedPerDisplay: 1
+};
+var MINUTES = {
+	label: "minutes",
+	storedPerDisplay: 1
+};
+var HOURS = {
+	label: "hours",
+	storedPerDisplay: 1
+};
+var DAYS = {
+	label: "days",
+	storedPerDisplay: 1
+};
+var MILLISECONDS = {
+	label: "ms",
+	storedPerDisplay: 1
+};
+var SECONDS_STORED_AS_MS = {
+	label: "seconds",
+	storedPerDisplay: MS_PER_SECOND,
+	storedLabel: "ms"
+};
+var MINUTES_STORED_AS_MS = {
+	label: "minutes",
+	storedPerDisplay: MS_PER_MINUTE,
+	storedLabel: "ms"
+};
+var MINUTES_STORED_AS_SECONDS = {
+	label: "minutes",
+	storedPerDisplay: SECONDS_PER_MINUTE,
+	storedLabel: "seconds"
+};
+var HOURS_STORED_AS_MS = {
+	label: "hours",
+	storedPerDisplay: MS_PER_HOUR,
+	storedLabel: "ms"
+};
+var HOURS_STORED_AS_MINUTES = {
+	label: "hours",
+	storedPerDisplay: MINUTES_PER_HOUR,
+	storedLabel: "minutes"
+};
+var DAYS_STORED_AS_MS = {
+	label: "days",
+	storedPerDisplay: MS_PER_DAY,
+	storedLabel: "ms"
+};
+var USD = {
+	label: "USD",
+	storedPerDisplay: 1
+};
+var USERS = {
+	label: "users",
+	storedPerDisplay: 1
+};
+var REVIEWS_PER_HOUR = {
+	label: "reviews per hour",
+	storedPerDisplay: 1
+};
+var MULTIPLIER = {
+	label: "times",
+	storedPerDisplay: 1
+};
+var TUNING_KNOB = "A tuning knob kept out of the Settings view; the default suits almost every install.";
+var DIAGNOSTIC = "A diagnostic switch kept out of the Settings view; change it in config.json while investigating.";
+var PROCESS_SETTING = "Changes how the server process or its worktrees behave, so it is set in config.json with a restart or new sessions in mind.";
+var STRUCTURED_VALUE = "A structured value with no dashboard control; edit it in config.json.";
+var BY_RULE = "Never editable from the dashboard by rule; edit it in config.json.";
+var LANES_SECTION_ID = "lanes";
+function capitalizedOptions(values) {
+	return values.map((value) => ({
+		value,
+		label: value[0].toUpperCase() + value.slice(1)
+	}));
+}
+var FILE_ONLY_GROUPS = Object.freeze({
+	"machine-terminal": {
+		title: "Terminal",
+		description: "Terminal behavior shared by dashboard clients."
+	},
+	"machine-detection-sessions": {
+		title: "Detection and sessions",
+		description: "Config-file-only detection, timing, worktree and process settings."
+	},
+	"lanes-ingest": {
+		title: "Ingest",
+		description: "The machine-context sources behind Visions."
+	}
+});
+var SECTIONS = Object.freeze([
+	{
+		id: "browser-appearance",
+		level: "browser",
+		title: "Appearance",
+		description: "How this browser draws the dashboard.",
+		legacyIds: [
+			"browser-flying-animals",
+			"animals",
+			"flying-animals"
+		],
+		settings: [
+			{
+				id: "theme",
+				path: "pref:themeId",
+				title: "Theme",
+				description: "Color scheme for the dashboard.",
+				control: "select",
+				optionsFrom: "themes",
+				keywords: ["color", "palette"],
+				defaultValue: "phyrexian",
+				...BROWSER_NOW
+			},
+			{
+				id: "compact-status",
+				path: "pref:compactStatusLabels",
+				title: "Hide status words in sidebar",
+				description: "Hide status words in the sidebar and on the phone Board while keeping the colored status mark and the phone Plan ready badge.",
+				control: "toggle",
+				keywords: [
+					"sidebar",
+					"status",
+					"compact"
+				],
+				defaultValue: false,
+				...BROWSER_NOW
+			},
+			{
+				id: "session-usage-chips",
+				path: "pref:sessionUsageChips",
+				title: "Show usage on session cards",
+				description: "Shows each card's transcript token count and CLI-reported cost when available, otherwise a calculated API list-price estimate.",
+				control: "toggle",
+				keywords: [
+					"usage",
+					"cost",
+					"tokens",
+					"card",
+					"price"
+				],
+				defaultValue: false,
+				...BROWSER_NOW
+			},
+			{
+				id: "flying-animals",
+				path: "pref:flyingAnimalsEnabled",
+				title: "Flying animals",
+				description: "Show animated animals flying across the dashboard.",
+				control: "toggle",
+				keywords: [
+					"animation",
+					"motion",
+					"animals"
+				],
+				defaultValue: false,
+				...BROWSER_NOW
+			},
+			{
+				id: "animals-min-gap",
+				path: "pref:flyingAnimalsMinGapSeconds",
+				title: "Time between flights: minimum",
+				description: "Shortest pause between flights.",
+				control: "number",
+				integer: false,
+				step: .1,
+				range: FLYING_ANIMALS_GAP_RANGE,
+				unit: SECONDS,
+				maximumSettingId: "animals-max-gap",
+				keywords: ["animals", "frequency"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsMinGapSeconds,
+				...BROWSER_ADVANCED
+			},
+			{
+				id: "animals-max-gap",
+				path: "pref:flyingAnimalsMaxGapSeconds",
+				title: "Time between flights: maximum",
+				description: "Longest pause between flights.",
+				control: "number",
+				integer: false,
+				step: .1,
+				range: FLYING_ANIMALS_GAP_RANGE,
+				unit: SECONDS,
+				keywords: ["animals", "frequency"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsMaxGapSeconds,
+				...BROWSER_ADVANCED
+			},
+			{
+				id: "animals-min-duration",
+				path: "pref:flyingAnimalsMinDurationSeconds",
+				title: "Flight duration: minimum",
+				description: "Shortest flight, for faster animals.",
+				control: "number",
+				integer: false,
+				step: .1,
+				range: FLYING_ANIMALS_DURATION_RANGE,
+				unit: SECONDS,
+				maximumSettingId: "animals-max-duration",
+				keywords: ["animals", "speed"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsMinDurationSeconds,
+				...BROWSER_ADVANCED
+			},
+			{
+				id: "animals-max-duration",
+				path: "pref:flyingAnimalsMaxDurationSeconds",
+				title: "Flight duration: maximum",
+				description: "Longest flight, for slower animals.",
+				control: "number",
+				integer: false,
+				step: .1,
+				range: FLYING_ANIMALS_DURATION_RANGE,
+				unit: SECONDS,
+				keywords: ["animals", "speed"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsMaxDurationSeconds,
+				...BROWSER_ADVANCED
+			},
+			{
+				id: "animals-scale",
+				path: "pref:flyingAnimalsScale",
+				title: "Size multiplier",
+				description: "Scale applied on top of the viewport size.",
+				control: "number",
+				integer: false,
+				step: .1,
+				range: FLYING_ANIMALS_SCALE_RANGE,
+				unit: MULTIPLIER,
+				keywords: ["animals", "size"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsScale,
+				...BROWSER_ADVANCED
+			},
+			{
+				id: "animals-on-phone",
+				path: "pref:flyingAnimalsOnPhone",
+				title: "Show on phone layout",
+				description: "Allow flights on the phone layout.",
+				control: "toggle",
+				keywords: ["animals", "mobile"],
+				defaultValue: FLYING_ANIMALS_DEFAULTS.flyingAnimalsOnPhone,
+				...BROWSER_ADVANCED
+			}
+		]
+	},
+	{
+		id: "browser-notifications",
+		level: "browser",
+		title: "Notifications",
+		description: "How this browser, and the Telegram bot shared by every lane, get your attention.",
+		settings: [
+			{
+				id: "alert-sounds-enabled",
+				path: "pref:soundEnabled",
+				title: "Alert sounds",
+				legacyIds: [{
+					sectionId: "browser-appearance",
+					settingId: "alert-sounds-enabled"
+				}],
+				description: "Play sounds when a session needs attention and when a merge celebration plays. The same switch as the note button in the desktop header.",
+				control: "toggle",
+				keywords: [
+					"audio",
+					"mute",
+					"sound",
+					"notification"
+				],
+				defaultValue: true,
+				...BROWSER_NOW
+			},
+			{
+				id: "alert-sound",
+				path: "pref:soundId",
+				title: "Alert sound",
+				legacyIds: [{
+					sectionId: "browser-appearance",
+					settingId: "alert-sound"
+				}],
+				description: "Sound played when a session needs attention. Your own .ogg, .mp3, .wav, .m4a or .webm files dropped into the sounds folder of the Glimmervoid home (~/.glimmervoid/sounds/, or $GLIMMERVOID_HOME/sounds/) are listed after the built-in sounds. Glimmervoid never creates that folder, so make it yourself; new files show up the next time Settings opens.",
+				control: "select",
+				optionsFrom: "sounds",
+				keywords: [
+					"audio",
+					"notification",
+					"custom"
+				],
+				defaultValue: "chime",
+				...BROWSER_NOW
+			},
+			{
+				id: "desktop-notifications",
+				path: "pref:notificationsEnabled",
+				title: "Desktop notifications",
+				legacyIds: [{
+					sectionId: "browser-appearance",
+					settingId: "desktop-notifications"
+				}],
+				description: "Raise a browser notification when a session needs attention while this dashboard is in the background.",
+				control: "toggle",
+				keywords: ["browser", "attention"],
+				defaultValue: true,
+				...BROWSER_NOW
+			}
+		]
+	},
+	{
+		id: "machine-telegram",
+		level: "machine",
+		parent: "browser-notifications",
+		title: "Telegram",
+		description: "One bot shared by session, PR review and PostHog notifications.",
+		legacyIds: ["telegram", "notifications"],
+		settings: [
+			{
+				id: "telegram-bot-token",
+				path: "telegram.botToken",
+				title: "Bot token",
+				description: "Credential used by the shared Telegram bot. When GLIMMERVOID_TELEGRAM_BOT_TOKEN supplies it, this field is read-only.",
+				control: "password",
+				keywords: ["credential", "api"],
+				defaultValue: "",
+				...MACHINE_NOW
+			},
+			{
+				id: "telegram-chat-id",
+				path: "telegram.chatId",
+				title: "Chat id",
+				description: "Destination chat for enabled Telegram lanes.",
+				control: "text",
+				keywords: ["destination", "channel"],
+				defaultValue: "",
+				...MACHINE_NOW
+			},
+			{
+				id: "telegram-session-notifications",
+				path: "telegramNotifications",
+				title: "Send session notifications",
+				description: "Send session completion, input and failure alerts when no dashboard is open. Unacknowledged alerts also escalate after the phone escalation delay while a dashboard remains open.",
+				control: "toggle",
+				keywords: ["phone", "off dashboard"],
+				defaultValue: false,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "machine-sessions",
+		level: "machine",
+		title: "Sessions",
+		description: "How sessions start, where projects are found, and what the dashboard shows for them.",
+		legacyIds: [
+			"machine-general",
+			"general",
+			"machine-repositories",
+			"repos",
+			"repositories"
+		],
+		settings: [
+			{
+				id: "auto-resume",
+				path: "autoResume",
+				title: "Auto-resume sessions on startup",
+				description: "Resume conversations that were live when Glimmervoid last shut down or crashed.",
+				control: "toggle",
+				keywords: ["startup", "conversation"],
+				defaultValue: true,
+				...MACHINE_NOW
+			},
+			{
+				id: "conversation-view",
+				path: "conversationView",
+				title: "Conversation view (experimental)",
+				description: "Let each Claude Code and Codex session turn on a Conversation face from its card menu, which renders the transcript as messages, approvals and a composer. Sessions stay on the terminal until you turn it on for them. A Codex session connects on its next start, through a local app-server so approvals can be answered from the dashboard; sandboxed Codex sessions and those that bypass Codex hook trust keep the terminal only.",
+				control: "toggle",
+				keywords: [
+					"experimental",
+					"transcript",
+					"chat",
+					"codex",
+					"claude"
+				],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "streamer-mode",
+				path: "streamerMode",
+				title: "Streamer mode",
+				description: "Hide sensitive details in the dashboard while screen sharing or streaming.",
+				control: "toggle",
+				keywords: [
+					"streaming",
+					"screen share",
+					"privacy"
+				],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "repository-roots",
+				path: "repoRoots",
+				title: "Repository roots",
+				description: "Directories scanned for projects when adding sessions.",
+				control: "list",
+				keywords: ["folders", "project discovery"],
+				defaultValue: [],
+				listPlaceholder: "Repository root path",
+				listEmptyText: "No repository roots configured.",
+				...MACHINE_NOW
+			},
+			{
+				id: "custom-agents",
+				path: "status:custom-agents",
+				title: "Custom agents",
+				description: "Extra agent CLIs a session can be spawned with, declared under customAgents in config.json.",
+				control: "readonly",
+				keywords: ["adapters", "cli"],
+				status: "custom-agents",
+				...READOUT
+			}
+		]
+	},
+	{
+		id: "machine-guardrails",
+		level: "machine",
+		title: "Guardrails and unattended",
+		description: "What a guarded session may touch, and which unattended actions automated work may take. Claude Code sessions on Linux and macOS write anywhere this account can, except credentials, Glimmervoid's own state and the blocked folders here.",
+		legacyIds: ["lanes-unattended", "unattended"],
+		settings: [
+			{
+				id: "skip-permissions-by-default",
+				path: "skipPermissionsByDefault",
+				title: "Skip permission prompts by default",
+				description: "Start sessions whose project sets no permission choice with the agent CLI permission bypass flag.",
+				control: "toggle",
+				keywords: [
+					"permissions",
+					"yolo",
+					"dangerously"
+				],
+				danger: true,
+				warning: "Enabling this control lets agents edit files and run shell commands without asking, and restarts running sessions that inherit it.",
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "sane-yolo",
+				path: "saneYolo",
+				title: "Sane YOLO",
+				description: "Block catastrophic commands in sessions that skip permission prompts when the cc-safety-net executable is available and trusted hooks are installed. Missing or untrusted hooks leave a session unprotected.",
+				control: "toggle",
+				keywords: [
+					"permissions",
+					"yolo",
+					"safety"
+				],
+				defaultValue: true,
+				...MACHINE_NEW_SESSIONS
+			},
+			{
+				id: "rtk-compression",
+				path: "rtk",
+				title: "rtk output compression",
+				description: "Compress Bash output with the rtk executable.",
+				control: "toggle",
+				keywords: ["bash", "tokens"],
+				danger: true,
+				status: "rtk-install",
+				warning: "Enabling this control permits Glimmervoid to install the pinned rtk executable automatically.",
+				defaultValue: false,
+				...MACHINE_NEW_SESSIONS
+			},
+			{
+				id: "post-turn-checks-mode",
+				path: "postTurnChecks.mode",
+				title: "Post-turn checks mode",
+				description: "Default mode for post-turn checks. Project and individual rule modes override it, so Report can still allow file fixes.",
+				control: "select",
+				options: capitalizedOptions(POST_TURN_CHECK_MODES),
+				keywords: ["quality", "fixes"],
+				defaultValue: "report",
+				...MACHINE_NOW
+			},
+			{
+				id: "branch-gc-delete-unmerged",
+				path: "branchGc.deleteUnmerged",
+				title: "Delete unmerged branches",
+				description: "Also delete stale remote branches with no merge proof. Off keeps every unmerged branch.",
+				control: "toggle",
+				keywords: [
+					"git",
+					"cleanup",
+					"orphan"
+				],
+				danger: true,
+				warning: "Enabling this control lets branch cleanup delete stale remote branches without merge proof.",
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "guardrails-unguarded-repos",
+				path: "guardrails.unguardedRepos",
+				title: "Unguarded repositories",
+				description: "Folders whose sessions run without guardrails. A session started in one of these folders, or below it, is not guarded.",
+				control: "list",
+				keywords: [
+					"guardrails",
+					"opt out",
+					"dotfiles"
+				],
+				danger: true,
+				warning: "A session without guardrails can read credentials and write anywhere this account can.",
+				defaultValue: [],
+				listPlaceholder: "Folder path",
+				listEmptyText: "Every repository is guarded.",
+				...MACHINE_NEW_SESSIONS
+			},
+			{
+				id: "guardrails-blocked-paths",
+				path: "guardrails.blockedPaths",
+				title: "Blocked folders",
+				description: "Extra folders and files a guarded session cannot write, on top of credentials and Glimmervoid's own state. A leading ~ means the home folder.",
+				control: "list",
+				keywords: [
+					"guardrails",
+					"block",
+					"protect"
+				],
+				defaultValue: [],
+				listPlaceholder: "~/folder",
+				listEmptyText: "Only the built-in list is blocked.",
+				...MACHINE_NEW_SESSIONS
+			},
+			{
+				id: "guardrails-unreadable-paths",
+				path: "guardrails.unreadablePaths",
+				title: "Unreadable folders",
+				description: "Extra folders and files a guarded session cannot read, on top of the built-in credential list. A leading ~ means the home folder.",
+				control: "list",
+				keywords: [
+					"guardrails",
+					"secrets",
+					"credentials"
+				],
+				defaultValue: [],
+				listPlaceholder: "~/folder",
+				listEmptyText: "Only the built-in credential list is unreadable.",
+				...MACHINE_NEW_SESSIONS
+			}
+		]
+	},
+	{
+		id: "machine-updates",
+		level: "machine",
+		title: "Updates",
+		description: "See which Glimmervoid version is running, which one is newest, and update in one step.",
+		legacyIds: ["updates"],
+		settings: [
+			{
+				id: "update-actions",
+				path: "status:update-actions",
+				title: "Status and actions",
+				legacyIds: [
+					"update-summary",
+					"update-installed",
+					"update-latest",
+					"update-last-checked"
+				].map((settingId) => ({
+					sectionId: "machine-updates",
+					settingId
+				})),
+				description: "Whether this install is up to date, the running and newest versions, the last check, and the update and restart actions.",
+				control: "readonly",
+				keywords: [
+					"version",
+					"available",
+					"current",
+					"check",
+					"restart",
+					"commit",
+					"installed",
+					"release",
+					"failure"
+				],
+				status: "update-actions",
+				...READOUT
+			},
+			{
+				id: "update-channel",
+				path: "updateChannel",
+				title: "Channel",
+				description: "Track tagged releases or the upstream of the checked-out branch.",
+				control: "select",
+				options: capitalizedOptions(UPDATE_CHANNELS),
+				keywords: ["release", "branch"],
+				defaultValue: "release",
+				...MACHINE_NOW
+			},
+			{
+				id: "check-updates",
+				path: "checkForUpdates",
+				title: "Check for updates automatically",
+				description: "Check for a newer Glimmervoid at launch, while a dashboard is connected, and when this page opens.",
+				control: "toggle",
+				keywords: ["release", "github"],
+				defaultValue: true,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "machine-usage",
+		level: "machine",
+		title: "Usage",
+		description: "Local transcript accounting and estimated-cost budgets.",
+		legacyIds: ["usage"],
+		settings: [
+			{
+				id: "usage-enabled",
+				path: "usage.enabled",
+				title: "Track token usage",
+				description: "Read local CLI transcripts and roll them into the Usage view and session chips.",
+				control: "toggle",
+				keywords: ["tokens", "cost"],
+				defaultValue: true,
+				status: "usage-last-report",
+				...MACHINE_NOW
+			},
+			{
+				id: "usage-retain-days",
+				path: "usage.retainDays",
+				title: "Retain transcript detail",
+				description: "How long live transcript detail stays available. A monthly budget keeps detail from the start of the current month when that is longer.",
+				control: "number",
+				range: USAGE_RETAIN_DAYS_RANGE,
+				unit: DAYS,
+				keywords: ["history", "retention"],
+				defaultValue: 90,
+				...MACHINE_NOW
+			},
+			{
+				id: "usage-daily-budget",
+				path: "usage.budget.dailyUsd",
+				title: "Daily budget",
+				description: "Estimated daily spend alert threshold. Alerts at 50%, 75% and 100% do not stop spending. Zero or below disables the threshold.",
+				control: "number",
+				range: USAGE_BUDGET_RANGE,
+				unit: USD,
+				keywords: ["spend", "alert"],
+				defaultValue: null,
+				integer: false,
+				nullable: true,
+				zeroIsNull: true,
+				step: .01,
+				...MACHINE_NOW
+			},
+			{
+				id: "usage-monthly-budget",
+				path: "usage.budget.monthlyUsd",
+				title: "Monthly budget",
+				description: "Estimated monthly spend alert threshold. Alerts at 50%, 75% and 100% do not stop spending. Zero or below disables the threshold.",
+				control: "number",
+				range: USAGE_BUDGET_RANGE,
+				unit: USD,
+				keywords: ["spend", "alert"],
+				defaultValue: null,
+				integer: false,
+				nullable: true,
+				zeroIsNull: true,
+				step: .01,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: LANES_SECTION_ID,
+		level: "lanes",
+		title: "Lanes",
+		description: "The background work Glimmervoid runs for you, one sub-section per lane.",
+		settings: []
+	},
+	{
+		id: "lanes-visions",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Visions",
+		description: "Editor-buffer findings, bounded model comments, and the machine-context ingest behind them.",
+		legacyIds: [
+			"visions",
+			"lanes-ingest",
+			"ingest"
+		],
+		settings: [
+			{
+				id: "visions-enabled",
+				path: "visions.enabled",
+				title: "Enable Visions",
+				description: "Set up supported editors detected on this machine, then show their buffer findings in the Visions view.",
+				control: "toggle",
+				keywords: [
+					"editor",
+					"findings",
+					"lsp"
+				],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "visions-dispatch-enabled",
+				path: "visions.dispatch.enabled",
+				title: "Enable model comments",
+				description: "Start bounded review sessions for local editor buffers.",
+				control: "toggle",
+				keywords: ["review", "dispatch"],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "visions-max-per-hour",
+				path: "visions.dispatch.maxPerHour",
+				title: "Max per hour",
+				description: "Maximum review sessions dispatched per hour. One slot is reserved for edit reviews; activity-driven reviews take the rest, up to the activity cap set by visions.dispatch.activityMaxPerHour.",
+				control: "number",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: REVIEWS_PER_HOUR,
+				keywords: ["rate limit", "reviews"],
+				defaultValue: 6,
+				...MACHINE_NOW
+			},
+			{
+				id: "visions-model",
+				path: "visions.dispatch.model",
+				title: "Model override",
+				description: "Leave blank to use the opus model alias.",
+				control: "text",
+				keywords: ["claude", "override"],
+				defaultValue: "",
+				...MACHINE_NOW
+			},
+			{
+				id: "visions-projects",
+				path: "visions.projects",
+				title: "Projects",
+				description: "Clear every selection, including unavailable projects, to accept buffers from every configured project.",
+				control: "projects",
+				keywords: ["repositories", "filter"],
+				defaultValue: [],
+				...MACHINE_NOW
+			},
+			{
+				id: "visions-auto-fix",
+				path: "visions.autoFix",
+				title: "Apply tier 1 fixes",
+				description: "Allow Visions to edit eligible open Markdown buffers, including inactive buffers, without asking.",
+				control: "toggle",
+				keywords: ["automatic", "edits"],
+				danger: true,
+				warning: "Enabling this control lets Visions edit eligible buffers without a carbon unit present.",
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "ingest-enabled",
+				path: "ingest.enabled",
+				title: "Enable machine context ingest",
+				description: "Enable the local activity feed behind Visions. Turning Visions on enables ingest unless ingest.enabled is explicitly false.",
+				control: "toggle",
+				keywords: [
+					"events",
+					"activity",
+					"ingest"
+				],
+				defaultValue: false,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "lanes-posthog",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "PostHog",
+		description: "Error monitoring, investigations and traffic-spike alerts.",
+		legacyIds: ["posthog"],
+		settings: [
+			{
+				id: "posthog-enabled",
+				path: "posthog.enabled",
+				title: "Enable PostHog monitoring",
+				description: "Poll PostHog error tracking and investigate issues that move.",
+				control: "toggle",
+				keywords: ["errors", "monitoring"],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-host",
+				path: "posthog.host",
+				title: "Host",
+				description: "PostHog cloud or self-hosted HTTP URL.",
+				control: "text",
+				keywords: ["url", "server"],
+				defaultValue: "https://us.posthog.com",
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-api-key",
+				path: "posthog.apiKey",
+				title: "Personal API key",
+				description: "Credential with read access to PostHog projects. When GLIMMERVOID_POSTHOG_API_KEY supplies it, this field is read-only.",
+				control: "password",
+				keywords: ["credential", "token"],
+				defaultValue: "",
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-projects",
+				path: "posthog.projects",
+				title: "Projects",
+				description: "PostHog project ids to monitor. config.json holds \"all\" or an array of ids, and an empty array monitors no project. In Settings that empty array shows as none, and an empty list saves \"all\".",
+				control: "list",
+				keywords: ["project ids", "filter"],
+				defaultValue: "all",
+				valueKind: "posthog-projects",
+				listPlaceholder: "Project id",
+				listEmptyText: "Every project the key can read.",
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-interval",
+				path: "posthog.intervalMinutes",
+				title: "Poll interval",
+				description: "Delay between PostHog polling passes.",
+				control: "number",
+				integer: false,
+				step: "any",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: MINUTES,
+				keywords: ["refresh", "schedule"],
+				defaultValue: 15,
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-max-investigations",
+				path: "posthog.maxConcurrentInvestigations",
+				title: "Max concurrent investigations",
+				description: "Maximum investigation sessions running together.",
+				control: "number",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: INVESTIGATIONS,
+				keywords: ["parallel", "workers"],
+				defaultValue: 2,
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-min-users",
+				path: "posthog.minUsersToInvestigate",
+				title: "Min users to investigate",
+				description: "Minimum affected users for a new issue investigation. Regressions, worsening issues and eligible error spikes bypass this minimum.",
+				control: "number",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: USERS,
+				keywords: ["threshold", "affected"],
+				defaultValue: 1,
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-traffic-enabled",
+				path: "posthog.trafficSpikeEnabled",
+				title: "Traffic spike alerts",
+				description: "Ping when recent unique users exceed a project baseline.",
+				control: "toggle",
+				keywords: ["analytics", "alert"],
+				defaultValue: true,
+				...MACHINE_NOW
+			},
+			{
+				id: "posthog-auto-fix",
+				path: "posthog.autoFix",
+				title: "Attempt fixes for major issues",
+				description: "Allow an isolated agent to fix an issue, push a branch and open a pull request.",
+				control: "toggle",
+				keywords: ["automatic", "pull request"],
+				danger: true,
+				warning: "Enabling this control lets PostHog fixes commit, push and open pull requests automatically.",
+				defaultValue: false,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "lanes-team-review",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Team review",
+		description: "Draft reviews of teammates' pull requests for you to post from the Reviews tab.",
+		legacyIds: ["team-review", "reviews"],
+		settings: [
+			{
+				id: "team-review-enabled",
+				path: "teamReview.enabled",
+				title: "Enable team review",
+				description: "Poll open pull requests from the team and draft a review of each one. Nothing is posted until you choose Approve or Comment.",
+				control: "toggle",
+				keywords: ["pull requests", "github"],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "github-teams",
+				path: "github.teams",
+				title: "GitHub teams",
+				description: "Teams to search for review requests and members, one org/slug per entry. Leave empty to fall back to the legacy teamReview.org and teamReview.team keys in config.json.",
+				control: "list",
+				keywords: [
+					"github",
+					"teams",
+					"review requests"
+				],
+				defaultValue: [],
+				listPlaceholder: "org/team-slug",
+				listEmptyText: "No GitHub teams configured.",
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-re-review-after-hours",
+				path: "teamReview.reReviewAfterHours",
+				title: "Re-review after",
+				description: "When a reviewed PR has a new head, review it again after this long since its last review. Queue review runs it at any time.",
+				control: "number",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: HOURS,
+				keywords: ["review", "delay"],
+				defaultValue: 24,
+				integer: false,
+				step: .5,
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-skip-idle-after-days",
+				path: "teamReview.skipIdleAfterDays",
+				title: "Skip PRs idle for",
+				description: "Leave pull requests without GitHub activity for this long out of automatic review.",
+				control: "number",
+				range: POSITIVE_NUMBER_RANGE,
+				unit: DAYS,
+				keywords: ["idle", "activity"],
+				defaultValue: 14,
+				integer: false,
+				step: .5,
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-skill",
+				path: "teamReview.skill",
+				title: "Review skill",
+				description: "Name of a Claude Code skill installed for the review agent, for example your own PR review skill. Leave empty to let the agent review with whatever skills it has.",
+				control: "text",
+				keywords: [
+					"skill",
+					"claude code",
+					"pr review"
+				],
+				defaultValue: "",
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-auto-rebase-my-prs",
+				path: "teamReview.autoRebaseMyPrs",
+				title: "Keep my pull requests rebased",
+				description: "On each poll, rebase your open, non-draft pull requests that are behind their base branch. A pull request with conflicts or checks still running is left alone, and a failed rebase is not retried until you push again.",
+				control: "toggle",
+				keywords: [
+					"rebase",
+					"update branch",
+					"behind",
+					"my prs"
+				],
+				danger: true,
+				warning: "Enabling this control rewrites your pull request branches on GitHub. Pull before you push from a local checkout of one.",
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-keep-mergeable-enabled",
+				path: "teamReview.keepMergeableEnabled",
+				title: "Keep mergeable",
+				description: "Offer Keep mergeable on your pull requests: a sandboxed agent repairs conflicts and failing checks and pushes the repair. Off hides the control and starts no repair; the pull requests you chose stay chosen for when you turn it back on.",
+				control: "toggle",
+				keywords: [
+					"repair",
+					"conflicts",
+					"my prs"
+				],
+				defaultValue: true,
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-keep-mergeable-timeout",
+				path: "teamReview.keepMergeableTimeoutMinutes",
+				title: "Keep mergeable deadline",
+				description: "Longest a Keep mergeable repair session may run before it is stopped and nothing is pushed.",
+				control: "number",
+				range: KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE,
+				unit: MINUTES,
+				keywords: ["timeout", "repair"],
+				defaultValue: 30,
+				...MACHINE_NOW
+			},
+			{
+				id: "team-review-merge-queue-enabled",
+				path: "teamReview.mergeQueueEnabled",
+				title: "Merge when ready",
+				description: "Offer Merge when ready on your pull requests: queued pull requests are rebased when behind and merged once ready, one per repository per poll. Off hides the control and merges nothing; the queue is kept for when you turn it back on.",
+				control: "toggle",
+				keywords: [
+					"merge queue",
+					"auto merge",
+					"my prs"
+				],
+				defaultValue: true,
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "lanes-workflows",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Workflows",
+		description: "Rules that act on pull request events in the repositories you choose.",
+		legacyIds: ["workflows"],
+		settings: [
+			{
+				id: "workflows-enabled",
+				path: "workflows.enabled",
+				title: "Run workflows",
+				description: "Poll the repositories your enabled rules watch and run their actions. Off stops polling and every action, whatever each rule says.",
+				control: "toggle",
+				keywords: [
+					"pull requests",
+					"automation",
+					"master switch"
+				],
+				defaultValue: true,
+				...MACHINE_NOW
+			},
+			{
+				id: "workflows-max-concurrent-sessions",
+				path: "workflows.maxConcurrentSessions",
+				title: "Concurrent agent sessions",
+				description: "Most workflow agent sessions running at once. Up to twenty later spawns wait for a free slot; additional spawns are dropped and logged.",
+				control: "number",
+				range: WORKFLOWS_MAX_CONCURRENT_SESSIONS_RANGE,
+				unit: SESSIONS,
+				keywords: ["parallel", "spawn"],
+				defaultValue: 2,
+				...MACHINE_NOW
+			},
+			{
+				id: "workflows-rules",
+				path: "status:workflow-rules",
+				title: "Workflow rules",
+				description: "Each rule watches repositories for one pull request event (opened, checks-failed, review-requested, approved, commented or merged), narrows it by author, labels, base branch, your own pull requests or a review request to your team, and then notifies you, labels or comments on the pull request, or starts a sandboxed agent session that pushes nothing. Rules start disabled. Turn each rule on or off here; everything else about a rule is set in config.json under workflows.rules.",
+				control: "readonly",
+				keywords: [
+					"pull requests",
+					"automation",
+					"github",
+					"rules"
+				],
+				status: "workflows",
+				...READOUT
+			}
+		]
+	},
+	{
+		id: "lanes-factory",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Factory",
+		description: "Read Coherence reports from repositories whose integration branch holds a coherence.config.json and show their status in the Factory tab.",
+		legacyIds: ["factory"],
+		settings: [
+			{
+				id: "factory-enabled",
+				path: "factory.enabled",
+				title: "Enable the factory",
+				description: "Enable Coherence status polling and show the Factory tab. Off by default.",
+				control: "toggle",
+				keywords: [
+					"orchestrator",
+					"intents",
+					"queue",
+					"coherence",
+					"guardrails"
+				],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-max-risk",
+				path: "factory.maxRisk",
+				title: "Worker risk ceiling",
+				description: "Highest risk admitted for a ticket.",
+				control: "select",
+				defaultValue: "medium",
+				options: [
+					"low",
+					"medium",
+					"high",
+					"critical"
+				].map((value) => ({
+					value,
+					label: value
+				})),
+				keywords: ["risk", "admission"],
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-max-live-workers",
+				path: "factory.maxLiveWorkers",
+				title: "Live worker cap",
+				description: "Most live workers per factory project.",
+				control: "number",
+				range: FACTORY_MAX_LIVE_WORKERS_RANGE,
+				unit: WORKERS,
+				defaultValue: 2,
+				keywords: ["workers", "parallel"],
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-checks",
+				path: "factory.checks",
+				title: "Worker checks",
+				description: "Commands glimmervoid runs before merging worker commits.",
+				control: "list",
+				defaultValue: [
+					"npm run typecheck",
+					"npm run lint",
+					"npm test"
+				],
+				keywords: ["tests", "checks"],
+				listPlaceholder: "npm test",
+				listEmptyText: "No checks run before a merge.",
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-protected-paths",
+				path: "factory.protectedPaths",
+				title: "Protected paths",
+				description: "Repo-relative files, directory prefixes ending in /, or **/NAME basenames workers cannot change.",
+				control: "list",
+				defaultValue: [
+					"coherence.config.json",
+					".coherence/",
+					"package.json",
+					"package-lock.json",
+					"**/AGENTS.md",
+					"**/CLAUDE.md",
+					"**/CLAUDE.local.md",
+					".claude/",
+					".github/"
+				],
+				keywords: ["fence", "scope"],
+				listPlaceholder: "path, prefix/ or **/NAME",
+				listEmptyText: "Workers may change any path.",
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-reviewer-model",
+				path: "factory.reviewerModel",
+				title: "Reviewer model",
+				description: "Claude model for independent worker review. Blank uses the CLI default.",
+				control: "text",
+				defaultValue: null,
+				nullable: true,
+				keywords: ["claude", "review"],
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-daily-budget",
+				path: "factory.dailyBudgetUsd",
+				title: "Factory daily budget",
+				description: "Factory lane spend ceiling. Blank means no ceiling. Needs usage tracking: with it off, dispatch refuses.",
+				control: "number",
+				range: NON_NEGATIVE_NUMBER_RANGE,
+				unit: USD,
+				integer: false,
+				nullable: true,
+				step: .01,
+				defaultValue: null,
+				keywords: ["spend", "budget"],
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-verifier-model",
+				path: "factory.verifierModel",
+				title: "Verifier model",
+				description: "Claude model for independent intent verification. Blank uses the CLI default.",
+				control: "text",
+				nullable: true,
+				defaultValue: null,
+				keywords: ["claude", "verification"],
+				...MACHINE_NOW
+			},
+			{
+				id: "factory-mirror-harness-runs",
+				path: "factory.mirrorHarnessRuns",
+				title: "Mirror harness runs",
+				description: "Show the latest factory harness run as a read-only project in the Factory tab while it runs and for a day after. Needs factory.enabled on. The harness turns it off on the instance it boots.",
+				control: "toggle",
+				defaultValue: true,
+				keywords: [
+					"harness",
+					"test",
+					"read-only"
+				],
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "lanes-benchmarks",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Benchmarks",
+		description: "Compare agent setups on frozen cases from the suites in the benchmarks folder of the Glimmervoid home.",
+		legacyIds: ["benchmarks"],
+		settings: [{
+			id: "benchmarks-enabled",
+			path: "benchmarks.enabled",
+			title: "Enable benchmarks",
+			description: "Show the Bench tab. Nothing runs until you choose Mine or Run there.",
+			control: "toggle",
+			keywords: [
+				"eval",
+				"arms",
+				"recall",
+				"compare"
+			],
+			defaultValue: false,
+			...MACHINE_NOW
+		}]
+	},
+	{
+		id: "lanes-knowledge-graph",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Knowledge graph (experimental)",
+		description: "A typed local graph of projects, tasks, notes, references and questions, driven from the glimmervoid kg command. Its SQLite database defaults to the Glimmervoid home; --db selects another path.",
+		legacyIds: ["knowledge-graph"],
+		settings: [{
+			id: "knowledge-graph-enabled",
+			path: "knowledgeGraph.enabled",
+			title: "Enable the knowledge graph",
+			description: "Allow the glimmervoid kg command. It reads Coherence ledgers to report where your tasks and the agents' tickets disagree, without modifying those ledgers. Graph writes go to the selected SQLite database, which can be inside a repository when --db names that path. Off by default.",
+			control: "toggle",
+			keywords: [
+				"experimental",
+				"kg",
+				"tasks",
+				"notes",
+				"references",
+				"coherence"
+			],
+			defaultValue: false,
+			...MACHINE_NOW
+		}]
+	},
+	{
+		id: "lanes-change-map",
+		level: "lanes",
+		parent: LANES_SECTION_ID,
+		title: "Change map",
+		description: "Optional model narration for deterministic change facts.",
+		legacyIds: ["change-map"],
+		settings: [
+			{
+				id: "change-map-narrator-enabled",
+				path: "changeMap.narrator.enabled",
+				title: "Enable narration",
+				description: "Add cited model claims to the change map.",
+				control: "toggle",
+				keywords: ["review", "claims"],
+				defaultValue: false,
+				...MACHINE_NOW
+			},
+			{
+				id: "change-map-narrator-engine",
+				path: "changeMap.narrator.engine",
+				title: "Narrator engine",
+				description: "CLI used to generate change map claims.",
+				control: "select",
+				options: capitalizedOptions(CHANGE_MAP_NARRATOR_ENGINES),
+				keywords: ["claude", "codex"],
+				defaultValue: "claude",
+				...MACHINE_NOW
+			},
+			{
+				id: "change-map-narrator-model",
+				path: "changeMap.narrator.model",
+				title: "Narrator model",
+				description: "Blank uses the engine default: haiku for Claude, the configured Codex model for Codex.",
+				control: "text",
+				keywords: [
+					"claude",
+					"codex",
+					"haiku"
+				],
+				defaultValue: "",
+				...MACHINE_NOW
+			}
+		]
+	},
+	{
+		id: "machine-privacy",
+		level: "machine",
+		title: "Privacy",
+		description: "What Glimmervoid sends about itself.",
+		legacyIds: ["privacy", "telemetry"],
+		settings: [{
+			id: "telemetry-enabled",
+			path: "telemetry.enabled",
+			title: "Send anonymous usage and error data",
+			description: "Version, platform, app starts, daily activity, session starts and ends with agent kind, exit kind and duration, errors as their type, error code and scrubbed stack frames, per session token counts, models and estimated costs from the usage scan, and factory outcomes as the kind of decision, how it came out, its duration and attempt number, under a random install id. Never error messages, paths, repository or branch names, prompts, objectives or terminal output. GLIMMERVOID_TELEMETRY=0, DO_NOT_TRACK=1 or CI=true turn it off regardless.",
+			control: "toggle",
+			keywords: [
+				"telemetry",
+				"analytics",
+				"tracking",
+				"opt out"
+			],
+			defaultValue: true,
+			...MACHINE_NOW
+		}]
+	},
+	{
+		id: "browser-shortcuts",
+		level: "browser",
+		title: "Shortcuts and about",
+		description: "Keyboard reference and build information.",
+		legacyIds: ["shortcuts"],
+		settings: []
+	}
+]);
+var FILE_ONLY_SETTINGS = Object.freeze([
+	{
+		id: "file-debug-mode",
+		path: "debugMode",
+		title: "Debug mode",
+		group: "machine-sessions",
+		description: "Show session-card diagnostics for state, transitions and detection signals.",
+		control: "toggle",
+		keywords: ["diagnostics", "state"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: DIAGNOSTIC,
+		...FILE_ONLY
+	},
+	{
+		id: "file-replay-buffer",
+		path: "replayBufferKB",
+		title: "Replay buffer",
+		group: "machine-terminal",
+		description: "PTY output retained for clients that reconnect or join late.",
+		control: "number",
+		range: REPLAY_BUFFER_KB_RANGE,
+		unit: {
+			label: "KB",
+			storedPerDisplay: 1
+		},
+		keywords: ["history", "backfill"],
+		defaultValue: 512,
+		takesEffect: "new-sessions",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-cursor-blink",
+		path: "cursorBlink",
+		title: "Cursor blink",
+		group: "machine-terminal",
+		description: "Blink the cursor in every terminal.",
+		control: "toggle",
+		keywords: ["caret", "terminal"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-detect-background-agents",
+		path: "detectBackgroundAgents",
+		title: "Detect background agents",
+		group: "machine-detection-sessions",
+		description: "Hold completion while tracked background work is active.",
+		control: "toggle",
+		keywords: ["subagents", "completion"],
+		defaultValue: true,
+		takesEffect: "new-sessions",
+		fileOnlyReason: DIAGNOSTIC,
+		...FILE_ONLY
+	},
+	{
+		id: "file-record-signals",
+		path: "recordSignals",
+		title: "Record structural signals",
+		group: "machine-detection-sessions",
+		description: "Keep forensic status and hook recordings for each session. Full capture (capture.enabled) records these signals even when this is off.",
+		control: "toggle",
+		keywords: ["recordings", "diagnostics"],
+		defaultValue: true,
+		takesEffect: "new-sessions",
+		fileOnlyReason: DIAGNOSTIC,
+		...FILE_ONLY
+	},
+	{
+		id: "file-trace-enabled",
+		path: "trace.enabled",
+		title: "Capture session traces",
+		group: "machine-detection-sessions",
+		description: "Keep normalized Claude transcript traces for session debugging.",
+		control: "toggle",
+		keywords: ["transcripts", "diagnostics"],
+		defaultValue: true,
+		takesEffect: "restart",
+		fileOnlyReason: DIAGNOSTIC,
+		...FILE_ONLY
+	},
+	{
+		id: "file-detect-scheduled-wakeups",
+		path: "detectScheduledWakeups",
+		title: "Detect scheduled wakeups",
+		group: "machine-detection-sessions",
+		description: "Surface advisory wakeup timing for scheduled sessions.",
+		control: "toggle",
+		keywords: ["schedule", "sleep"],
+		defaultValue: true,
+		takesEffect: "restart",
+		fileOnlyReason: DIAGNOSTIC,
+		...FILE_ONLY
+	},
+	{
+		id: "file-worktree-auto-rebase",
+		path: "worktreeAutoRebase",
+		title: "Worktree auto-rebase",
+		group: "machine-detection-sessions",
+		description: "Rebase eligible session worktrees when the integration branch moves.",
+		control: "toggle",
+		keywords: ["git", "branch"],
+		defaultValue: true,
+		takesEffect: "new-sessions",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-worktree-sync-on-start",
+		path: "worktreeSyncOnStart",
+		title: "Worktree sync on start",
+		group: "machine-detection-sessions",
+		description: "Fetch origin and fast-forward the local integration branch before a session starts its worktree.",
+		control: "toggle",
+		keywords: [
+			"git",
+			"fetch",
+			"fast-forward"
+		],
+		defaultValue: true,
+		takesEffect: "new-sessions",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-worktree-rerere",
+		path: "worktreeRerere",
+		title: "Worktree rerere",
+		group: "machine-detection-sessions",
+		description: "Reuse recorded Git conflict resolutions.",
+		control: "toggle",
+		keywords: ["git", "conflicts"],
+		defaultValue: true,
+		takesEffect: "restart",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-integration-branch",
+		path: "integrationBranch",
+		title: "Integration branch",
+		group: "machine-detection-sessions",
+		description: "Base branch for session worktrees. Empty = each repo's default branch. Existing sessions are never retargeted.",
+		control: "text",
+		nullable: true,
+		keywords: ["git", "merge"],
+		defaultValue: null,
+		takesEffect: "new-sessions",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-worktree-root",
+		path: "worktreeRoot",
+		title: "Worktree root",
+		group: "machine-detection-sessions",
+		description: "Directory that contains session worktrees. Existing worktrees are never relocated.",
+		control: "text",
+		keywords: ["git", "directory"],
+		defaultValue: "",
+		takesEffect: "new-sessions",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-worktree-share",
+		path: "worktreeShare",
+		title: "Shared worktree paths",
+		group: "machine-detection-sessions",
+		description: "Local paths copied or linked during worktree preparation.",
+		control: "list",
+		keywords: ["files", "context"],
+		defaultValue: [
+			"node_modules",
+			".env",
+			".env.local",
+			".claude"
+		],
+		takesEffect: "new-sessions",
+		fileOnlyReason: BY_RULE,
+		...FILE_ONLY
+	},
+	{
+		id: "file-port",
+		path: "port",
+		title: "Local port",
+		group: "machine-detection-sessions",
+		description: "Port used by the local dashboard listener.",
+		control: "number",
+		range: PORT_RANGE,
+		unit: {
+			label: "port",
+			storedPerDisplay: 1
+		},
+		keywords: ["server", "listener"],
+		defaultValue: 3e3,
+		takesEffect: "restart",
+		fileOnlyReason: BY_RULE,
+		...FILE_ONLY
+	},
+	{
+		id: "file-auto-recover-seconds",
+		path: "autoRecoverSeconds",
+		title: "Auto-recovery delay",
+		group: "machine-detection-sessions",
+		description: "Delay before an interrupted state can recover.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: SECONDS,
+		keywords: ["timer", "recovery"],
+		defaultValue: 3,
+		takesEffect: "new-sessions",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-input-grace-seconds",
+		path: "inputGraceSeconds",
+		title: "Input grace period",
+		group: "machine-detection-sessions",
+		description: "Grace window around operator input.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: SECONDS,
+		keywords: ["timer", "prompt"],
+		defaultValue: 5,
+		takesEffect: "new-sessions",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-prompt-detection-ms",
+		path: "promptDetectionMs",
+		title: "Prompt detection delay",
+		group: "machine-detection-sessions",
+		description: "Timing threshold used by prompt detection.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: MILLISECONDS,
+		keywords: ["timer", "detection"],
+		defaultValue: 1500,
+		takesEffect: "new-sessions",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-notify-debounce-ms",
+		path: "notifyDebounceMs",
+		title: "Notification debounce",
+		group: "machine-detection-sessions",
+		description: "Delay used to coalesce notification state changes.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: SECONDS_STORED_AS_MS,
+		keywords: ["timer", "alerts"],
+		defaultValue: 3e3,
+		takesEffect: "new-sessions",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-phone-escalation-ms",
+		path: "phoneEscalationMs",
+		title: "Phone escalation delay",
+		group: "machine-detection-sessions",
+		description: "Delay before off-dashboard escalation.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: MINUTES_STORED_AS_MS,
+		keywords: ["timer", "telegram"],
+		defaultValue: 3e5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-post-turn-checks",
+		path: "postTurnChecks",
+		title: "Post-turn checks",
+		group: "machine-detection-sessions",
+		description: "Deterministic checks run after eligible turns. The global mode is a default; project and individual rule modes can select fixes even when the global mode is report.",
+		control: "json",
+		keywords: ["quality", "fixes"],
+		defaultValue: {
+			enabled: true,
+			mode: "report",
+			rules: {
+				trailingWs: true,
+				finalNewline: true,
+				bom: true,
+				slop: false
+			}
+		},
+		takesEffect: "now",
+		fileOnlyReason: STRUCTURED_VALUE,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-enabled",
+		path: "branchGc.enabled",
+		title: "Branch cleanup",
+		group: "machine-detection-sessions",
+		description: "Enable cleanup of eligible session branches.",
+		control: "toggle",
+		keywords: ["git", "cleanup"],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-worktrees",
+		path: "branchGc.worktrees",
+		title: "Local worktree cleanup",
+		group: "machine-detection-sessions",
+		description: "Enable cleanup of eligible local worktrees.",
+		control: "toggle",
+		keywords: [
+			"git",
+			"worktree",
+			"cleanup"
+		],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-prefixes",
+		path: "branchGc.prefixes",
+		title: "Branch cleanup prefixes",
+		group: "machine-detection-sessions",
+		description: "Branch prefixes that filter both remote branch cleanup and local worktree cleanup.",
+		control: "list",
+		keywords: ["git", "branch"],
+		defaultValue: ["glimmervoid/session/", "worktree-agent-"],
+		takesEffect: "now",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-dry-run",
+		path: "branchGc.dryRun",
+		title: "Branch cleanup dry run",
+		group: "machine-detection-sessions",
+		description: "Report planned cleanup without deleting remote branches.",
+		control: "toggle",
+		keywords: ["git", "safety"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: PROCESS_SETTING,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-stale-days",
+		path: "branchGc.staleDays",
+		title: "Branch stale days",
+		group: "machine-detection-sessions",
+		description: "Age threshold for orphan branch cleanup when unmerged deletion is on.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: DAYS,
+		keywords: ["git", "retention"],
+		defaultValue: 14,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-branch-gc-interval-ms",
+		path: "branchGc.intervalMs",
+		title: "Branch cleanup interval",
+		group: "machine-detection-sessions",
+		description: "Delay between branch cleanup passes.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: HOURS_STORED_AS_MS,
+		keywords: ["git", "schedule"],
+		defaultValue: 216e5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-custom-agents",
+		path: "customAgents",
+		title: "Custom agents",
+		group: "machine-detection-sessions",
+		description: "Extra agent CLIs a session can be spawned with. The Sessions section lists the declared agents and whether each command resolves.",
+		control: "json",
+		keywords: ["adapters", "cli"],
+		defaultValue: [],
+		takesEffect: "new-sessions",
+		fileOnlyReason: BY_RULE,
+		...FILE_ONLY
+	},
+	{
+		id: "file-task-title-refiner-enabled",
+		path: "taskTitle.refiner.enabled",
+		title: "Refine task titles",
+		group: "machine-detection-sessions",
+		description: "Keep session card titles useful when prompts change topic by asking a model for a short title.",
+		control: "toggle",
+		keywords: [
+			"title",
+			"refiner",
+			"card"
+		],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-task-title-refiner-model",
+		path: "taskTitle.refiner.model",
+		title: "Task title model",
+		group: "machine-detection-sessions",
+		description: "Claude model alias the title refiner asks.",
+		control: "text",
+		keywords: [
+			"title",
+			"refiner",
+			"model"
+		],
+		defaultValue: "haiku",
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-task-title-refiner-min-interval",
+		path: "taskTitle.refiner.minIntervalSeconds",
+		title: "Task title refresh interval",
+		group: "machine-detection-sessions",
+		description: "Shortest pause between two title refinements of one session.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: NON_NEGATIVE_NUMBER_RANGE,
+		unit: SECONDS,
+		keywords: [
+			"title",
+			"refiner",
+			"interval"
+		],
+		defaultValue: 60,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-task-title-refiner-timeout",
+		path: "taskTitle.refiner.timeoutSeconds",
+		title: "Task title timeout",
+		group: "machine-detection-sessions",
+		description: "Maximum time allowed for one title refinement.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: TASK_TITLE_TIMEOUT_RANGE,
+		unit: SECONDS,
+		keywords: [
+			"title",
+			"refiner",
+			"deadline"
+		],
+		defaultValue: 60,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-codex",
+		path: "usage.vendors.codex",
+		title: "Track Codex usage",
+		group: "machine-usage",
+		description: "Include local Codex CLI transcripts in usage reports.",
+		control: "toggle",
+		keywords: ["openai", "vendor"],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-grok",
+		path: "usage.vendors.grok",
+		title: "Track Grok usage",
+		group: "machine-usage",
+		description: "Include local Grok CLI transcripts in usage reports.",
+		control: "toggle",
+		keywords: ["xai", "vendor"],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-fetch-pricing",
+		path: "usage.fetchPricing",
+		title: "Fetch current model prices",
+		group: "machine-usage",
+		description: "Load public model prices when usage tracking starts, using a cached table for up to one day. Falls back to cached or bundled prices if the fetch fails; no daily refresh runs while tracking continues.",
+		control: "toggle",
+		keywords: ["rates", "models"],
+		defaultValue: true,
+		takesEffect: "restart",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-plan-limits",
+		path: "usage.planLimits",
+		title: "Show plan limits",
+		group: "machine-usage",
+		description: "Read the Claude plan limit the CLI reports and show it beside usage.",
+		control: "toggle",
+		keywords: [
+			"plan",
+			"limits",
+			"quota"
+		],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-rtk-savings",
+		path: "usage.rtkSavings",
+		title: "Estimate rtk savings",
+		group: "machine-usage",
+		description: "Estimate the tokens rtk output compression saved and show it in the Usage view.",
+		control: "toggle",
+		keywords: [
+			"rtk",
+			"savings",
+			"tokens"
+		],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-scan-interval",
+		path: "usage.scanIntervalMinutes",
+		title: "Scan interval",
+		group: "machine-usage",
+		description: "Periodic transcript polling interval. Session activity can also trigger scans between timer ticks.",
+		control: "number",
+		range: USAGE_SCAN_INTERVAL_RANGE,
+		unit: MINUTES,
+		keywords: ["poll", "refresh"],
+		defaultValue: 5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-warehouse-retain-days",
+		path: "usage.warehouseRetainDays",
+		title: "Retain usage history",
+		group: "machine-usage",
+		description: "How long the daily usage warehouse keeps rolled-up totals after transcript detail expires.",
+		control: "number",
+		range: USAGE_INTEGER_RANGES.warehouseRetainDays,
+		unit: DAYS,
+		keywords: [
+			"history",
+			"warehouse",
+			"retention"
+		],
+		defaultValue: 365,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-session-block-hours",
+		path: "usage.sessionBlockHours",
+		title: "Session block length",
+		group: "machine-usage",
+		description: "Length of the rolling block the Usage view groups activity into.",
+		control: "number",
+		range: USAGE_INTEGER_RANGES.sessionBlockHours,
+		unit: HOURS,
+		keywords: [
+			"block",
+			"window",
+			"hours"
+		],
+		defaultValue: 5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-cost-mode",
+		path: "usage.costMode",
+		title: "Cost mode",
+		group: "machine-usage",
+		description: "Choose whether recorded costs, calculated costs or both can appear.",
+		control: "select",
+		options: capitalizedOptions(USAGE_COST_MODES),
+		keywords: ["pricing", "estimate"],
+		defaultValue: "auto",
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-usage-extra-projects-dirs",
+		path: "usage.extraProjectsDirs",
+		title: "Extra transcript folders",
+		group: "machine-usage",
+		description: "Absolute paths of additional Claude projects folders the usage scan reads.",
+		control: "list",
+		keywords: [
+			"transcripts",
+			"folders",
+			"scan"
+		],
+		defaultValue: [],
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-change-map-narrator-timeout",
+		path: "changeMap.narrator.timeoutSeconds",
+		title: "Narrator timeout",
+		group: "lanes-change-map",
+		description: "Maximum time allowed for one narration.",
+		control: "number",
+		range: CHANGE_MAP_NARRATOR_TIMEOUT_RANGE,
+		unit: SECONDS,
+		keywords: ["deadline", "narration"],
+		defaultValue: 90,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-visions-quiet-delay",
+		path: "visions.dispatch.quietMs",
+		title: "Quiet delay",
+		group: "lanes-visions",
+		description: "Editor quiet time before a scheduled review. Saves and blank-line boundaries can dispatch immediately, subject to the other review limits.",
+		control: "number",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: SECONDS_STORED_AS_MS,
+		keywords: ["debounce", "idle"],
+		defaultValue: 3e4,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-visions-cooldown",
+		path: "visions.dispatch.cooldownMs",
+		title: "Cooldown",
+		group: "lanes-visions",
+		description: "Minimum delay between reviews of the same document. Initial orientation reviews bypass this delay.",
+		control: "number",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: MINUTES_STORED_AS_MS,
+		keywords: ["rate limit", "delay"],
+		defaultValue: 3e5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-visions-activity-max-per-hour",
+		path: "visions.dispatch.activityMaxPerHour",
+		title: "Activity max per hour",
+		group: "lanes-visions",
+		description: "Maximum activity-driven reviews dispatched per hour, capped at the overall hourly limit minus one to reserve an edit-review slot.",
+		control: "number",
+		range: NON_NEGATIVE_NUMBER_RANGE,
+		unit: REVIEWS_PER_HOUR,
+		keywords: ["rate limit", "events"],
+		defaultValue: 2,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-visions-dispatch-timeout",
+		path: "visions.dispatch.dispatchTimeoutSeconds",
+		title: "Dispatch timeout",
+		group: "lanes-visions",
+		description: "Maximum time allowed for one review session.",
+		control: "number",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: MINUTES_STORED_AS_SECONDS,
+		keywords: ["deadline", "review"],
+		defaultValue: 180,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-visions-intent-thread-ttl",
+		path: "visions.intent.threadTtlMs",
+		title: "Intent thread lifetime",
+		group: "lanes-visions",
+		description: "How long an intent thread nobody advanced stays live before it retires.",
+		control: "number",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: DAYS_STORED_AS_MS,
+		keywords: [
+			"intent",
+			"decay",
+			"thread"
+		],
+		defaultValue: 2592e5,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-terminal",
+		path: "ingest.sources.terminal.enabled",
+		title: "Terminal output source",
+		group: "lanes-ingest",
+		description: "Include terminal output in the ingest feed.",
+		control: "toggle",
+		keywords: ["pty", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-agent-logs",
+		path: "ingest.sources.agentLogs.enabled",
+		title: "Agent logs source",
+		group: "lanes-ingest",
+		description: "Include local agent logs in the ingest feed.",
+		control: "toggle",
+		keywords: ["transcript", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-git",
+		path: "ingest.sources.git.enabled",
+		title: "Git activity source",
+		group: "lanes-ingest",
+		description: "Include local Git activity in the ingest feed.",
+		control: "toggle",
+		keywords: ["commits", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-fs",
+		path: "ingest.sources.fs.enabled",
+		title: "File changes source",
+		group: "lanes-ingest",
+		description: "Include watched file changes in the ingest feed.",
+		control: "toggle",
+		keywords: ["filesystem", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-shell-history",
+		path: "ingest.sources.shellHistory.enabled",
+		title: "Shell history source",
+		group: "lanes-ingest",
+		description: "Include local shell history in the ingest feed.",
+		control: "toggle",
+		keywords: ["commands", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-ingest-editor",
+		path: "ingest.sources.editor.enabled",
+		title: "Editor events source",
+		group: "lanes-ingest",
+		description: "Include local editor events in the ingest feed.",
+		control: "toggle",
+		keywords: ["buffers", "source"],
+		defaultValue: false,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-investigation-timeout",
+		path: "posthog.investigationTimeoutSeconds",
+		title: "Investigation timeout",
+		group: "lanes-posthog",
+		description: "Maximum time allowed for one investigation.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: MINUTES_STORED_AS_SECONDS,
+		keywords: ["deadline", "session"],
+		defaultValue: 900,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-escalation",
+		path: "posthog.userEscalationThreshold",
+		title: "Escalation threshold",
+		group: "lanes-posthog",
+		description: "Affected-user count that escalates an issue.",
+		control: "number",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: USERS,
+		keywords: ["threshold", "severity"],
+		defaultValue: 25,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-fix-timeout",
+		path: "posthog.fixTimeoutSeconds",
+		title: "Fix timeout",
+		group: "lanes-posthog",
+		description: "Maximum time allowed for one fix session.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSTHOG_FIX_TIMEOUT_RANGE,
+		unit: MINUTES_STORED_AS_SECONDS,
+		keywords: ["deadline", "repair"],
+		defaultValue: 1800,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-traffic-multiplier",
+		path: "posthog.trafficSpikeMultiplier",
+		title: "Spike multiplier",
+		group: "lanes-posthog",
+		description: "Baseline multiplier required to classify a traffic spike.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSTHOG_TRAFFIC_MULTIPLIER_RANGE,
+		unit: MULTIPLIER,
+		keywords: ["baseline", "ratio"],
+		defaultValue: 3,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-traffic-min-users",
+		path: "posthog.trafficSpikeMinUsers",
+		title: "Min users to alert",
+		group: "lanes-posthog",
+		description: "Minimum recent unique users for an initial traffic-spike alert. Escalation and recovery alerts bypass this minimum.",
+		control: "number",
+		range: POSTHOG_TRAFFIC_MIN_USERS_RANGE,
+		unit: USERS,
+		keywords: ["threshold", "analytics"],
+		defaultValue: 10,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-traffic-cooldown",
+		path: "posthog.trafficSpikeCooldownMinutes",
+		title: "Spike cooldown",
+		group: "lanes-posthog",
+		description: "Cooldown for new traffic spikes. Escalation and recovery alerts bypass it. Zero removes the time delay; repeated active-spike alerts are still suppressed.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: NON_NEGATIVE_NUMBER_RANGE,
+		unit: HOURS_STORED_AS_MINUTES,
+		keywords: ["silence", "delay"],
+		defaultValue: 360,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-traffic-baseline",
+		path: "posthog.trafficSpikeBaselineDays",
+		title: "Baseline window",
+		group: "lanes-posthog",
+		description: "Historical window used to calculate normal hourly traffic.",
+		control: "number",
+		range: POSTHOG_TRAFFIC_BASELINE_RANGE,
+		unit: DAYS,
+		keywords: ["history", "analytics"],
+		defaultValue: 7,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-recurrence-dedupe",
+		path: "posthog.recurrenceDedupe",
+		title: "Deduplicate recurring issues",
+		group: "lanes-posthog",
+		description: "Treat an issue seen again inside the recurrence window as the same investigation instead of opening a new one.",
+		control: "toggle",
+		keywords: [
+			"recurrence",
+			"dedupe",
+			"issues"
+		],
+		defaultValue: true,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-recurrence-window-days",
+		path: "posthog.recurrenceWindowDays",
+		title: "Recurrence window",
+		group: "lanes-posthog",
+		description: "How far back an issue counts as a recurrence of an investigated one.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: DAYS,
+		keywords: ["recurrence", "window"],
+		defaultValue: 7,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-transient-recurrence-limit",
+		path: "posthog.transientRecurrenceLimit",
+		title: "Transient recurrence limit",
+		group: "lanes-posthog",
+		description: "How many times a transient issue may recur before it is investigated again.",
+		control: "number",
+		integer: false,
+		step: "any",
+		range: POSITIVE_NUMBER_RANGE,
+		unit: RECURRENCES,
+		keywords: [
+			"recurrence",
+			"transient",
+			"limit"
+		],
+		defaultValue: 3,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-repo-path",
+		path: "posthog.repoPath",
+		title: "Repository path",
+		group: "lanes-posthog",
+		description: "Absolute path of the local checkout investigations read and fixes branch from, for every project the project map does not name.",
+		control: "text",
+		keywords: [
+			"repository",
+			"checkout",
+			"path"
+		],
+		defaultValue: "",
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-posthog-project-map",
+		path: "posthog.projectMap",
+		title: "Project map",
+		group: "lanes-posthog",
+		description: "PostHog project id to a label: the name shown for that project, and, when it is an absolute path to a checkout, the repository its issues are investigated in.",
+		control: "json",
+		keywords: [
+			"projects",
+			"repositories",
+			"map"
+		],
+		defaultValue: {},
+		takesEffect: "now",
+		fileOnlyReason: STRUCTURED_VALUE,
+		...FILE_ONLY
+	},
+	{
+		id: "file-team-review-org",
+		path: "teamReview.org",
+		title: "GitHub organization (legacy)",
+		group: "lanes-team-review",
+		description: "Organization login that owns the team, for example PostHog. Read only when github.teams is empty.",
+		control: "text",
+		keywords: [
+			"github",
+			"owner",
+			"legacy"
+		],
+		defaultValue: "",
+		takesEffect: "now",
+		fileOnlyReason: "A legacy key: github.teams names teams as org/slug entries and wins whenever it is set.",
+		...FILE_ONLY
+	},
+	{
+		id: "file-team-review-team",
+		path: "teamReview.team",
+		title: "GitHub team (legacy)",
+		group: "lanes-team-review",
+		description: "Team slug whose members and review requests are polled. Read only when github.teams is empty.",
+		control: "text",
+		keywords: [
+			"github",
+			"slug",
+			"legacy"
+		],
+		defaultValue: "",
+		takesEffect: "now",
+		fileOnlyReason: "A legacy key: github.teams names teams as org/slug entries and wins whenever it is set.",
+		...FILE_ONLY
+	},
+	{
+		id: "file-workflows-max-actions-per-poll",
+		path: "workflows.maxActionsPerPoll",
+		title: "Actions per poll",
+		group: "lanes-workflows",
+		description: "Most actions run in one poll. The rest are dropped and logged.",
+		control: "number",
+		range: WORKFLOWS_MAX_ACTIONS_PER_POLL_RANGE,
+		unit: ACTIONS,
+		keywords: ["cap", "rate limit"],
+		defaultValue: 20,
+		takesEffect: "now",
+		fileOnlyReason: TUNING_KNOB,
+		...FILE_ONLY
+	},
+	{
+		id: "file-workflows-rules",
+		path: "workflows.rules",
+		title: "Workflow rule definitions",
+		group: "lanes-workflows",
+		description: "The rules the Workflows section switches on and off: each names its repositories, one pull request event, its filters and its actions.",
+		control: "json",
+		keywords: [
+			"pull requests",
+			"automation",
+			"rules"
+		],
+		defaultValue: [],
+		takesEffect: "now",
+		fileOnlyReason: "Rule definitions are written in config.json; the Workflows section only switches each rule on or off.",
+		...FILE_ONLY
+	}
+]);
+var SETTINGS_REGISTRY = Object.freeze({
+	sections: SECTIONS,
+	fileOnly: FILE_ONLY_SETTINGS
+});
+Object.freeze(Object.fromEntries(SECTIONS.flatMap((section) => (section.legacyIds ?? []).map((legacyId) => [legacyId, section.id]))));
+Object.freeze(SECTIONS.reduce((moved, section) => {
+	for (const setting of section.settings) for (const legacy of setting.legacyIds ?? []) moved[legacy.sectionId] = {
+		...moved[legacy.sectionId],
+		[legacy.settingId]: section.id
+	};
+	return moved;
+}, {}));
+//#endregion
+//#region shared/settings/registry-core.ts
+function cloneValue(value) {
+	const containersToFill = [];
+	const startCopyOf = (original) => {
+		if (!original || typeof original !== "object") return original;
+		const copy = Array.isArray(original) ? [] : {};
+		containersToFill.push([original, copy]);
+		return copy;
+	};
+	const root = startCopyOf(value);
+	for (let next = containersToFill.pop(); next; next = containersToFill.pop()) {
+		const [original, copy] = next;
+		for (const [key, nested] of Object.entries(original)) Object.defineProperty(copy, key, {
+			value: startCopyOf(nested),
+			writable: true,
+			enumerable: true,
+			configurable: true
+		});
+	}
+	return root;
+}
+function valueAtPath(source, path) {
+	let value = source;
+	for (const part of path.split(".")) {
+		if (value == null || typeof value !== "object") return void 0;
+		value = value[part];
+	}
+	return value;
+}
+function deleteValueAtPath(target, path) {
+	const parts = path.split(".");
+	let cursor = target;
+	for (const part of parts.slice(0, -1)) {
+		if (!cursor || typeof cursor !== "object") return;
+		cursor = cursor[part];
+	}
+	if (cursor && typeof cursor === "object") delete cursor[parts.at(-1)];
+}
+function setValueAtPath(target, path, value) {
+	const parts = path.split(".");
+	let cursor = target;
+	for (const part of parts.slice(0, -1)) {
+		if (!cursor[part] || typeof cursor[part] !== "object" || Array.isArray(cursor[part])) cursor[part] = {};
+		cursor = cursor[part];
+	}
+	cursor[parts.at(-1)] = cloneValue(value);
+}
+function settingsOf(sections) {
+	return sections.flatMap((section) => section.settings);
+}
+function parsePosthogProjectSelection(value) {
+	const text = String(value ?? "").trim().toLowerCase();
+	if (!text || text === "all") return "all";
+	if (text === "none") return [];
+	const tokens = text.split(",").map((token) => token.trim());
+	if (!tokens.every((token) => /^\d+$/.test(token) && Number.isSafeInteger(Number(token)) && Number(token) > 0)) return null;
+	return tokens.map(Number);
+}
+var DISPLAY_DECIMALS = 6;
+function displayValue(setting, value) {
+	if (setting.control === "number" && typeof value === "number") return value / (setting.unit?.storedPerDisplay ?? 1);
+	if (setting.valueKind !== "posthog-projects") return cloneValue(value);
+	if (!Array.isArray(value)) return [];
+	if (value.length === 0) return ["none"];
+	return value.map(String);
+}
+function hasScaledUnit(setting) {
+	return setting.control === "number" && (setting.unit?.storedPerDisplay ?? 1) !== 1;
+}
+function formatDisplayNumber(value) {
+	return String(Number(value.toFixed(DISPLAY_DECIMALS)));
+}
+function displayText(setting, value) {
+	const shown = displayValue(setting, value);
+	if (setting.valueKind === "posthog-projects" && Array.isArray(shown)) return shown.join(", ") || "all";
+	if (typeof shown === "number" && setting.unit) return `${formatDisplayNumber(shown)} ${setting.unit.label}`;
+	return JSON.stringify(shown ?? null);
+}
+function searchTokens(value) {
+	return String(value || "").toLowerCase().match(/[a-z0-9]+/g) || [];
+}
+var EXACT_MATCH_QUALITY = 3;
+var PREFIX_MATCH_QUALITY = 2;
+var INFIX_MATCH_QUALITY = 1;
+var MIN_INFIX_QUERY_LENGTH = 3;
+var SEARCH_RESULT_LIMIT = 30;
+var MAX_SEARCH_QUERY_TOKENS = 16;
+function tokenMatchQuality(fieldToken, queryToken) {
+	if (fieldToken === queryToken) return EXACT_MATCH_QUALITY;
+	if (fieldToken.startsWith(queryToken)) return PREFIX_MATCH_QUALITY;
+	if (queryToken.length >= MIN_INFIX_QUERY_LENGTH && fieldToken.includes(queryToken)) return INFIX_MATCH_QUALITY;
+	return 0;
+}
+function fieldScore(tokens, queryTokens, weight) {
+	let totalMatchQuality = 0;
+	for (const queryToken of queryTokens) {
+		const bestMatchQuality = Math.max(0, ...tokens.map((fieldToken) => tokenMatchQuality(fieldToken, queryToken)));
+		if (bestMatchQuality === 0) return 0;
+		totalMatchQuality += bestMatchQuality;
+	}
+	return totalMatchQuality * weight;
+}
+function optionLabelsText(setting) {
+	return setting.options?.map((option) => option.label).join(", ") ?? "";
+}
+function fileOnlyGroupTitle(setting) {
+	return settingsGroupOf(setting.group ?? "")?.title ?? "";
+}
+function settingScore(setting, sectionTokens, queryTokens) {
+	const titleScore = fieldScore(searchTokens(setting.title), queryTokens, 1e3);
+	const keywordScore = fieldScore(searchTokens(setting.keywords.join(" ")), queryTokens, 100);
+	const sectionScore = fieldScore(sectionTokens, queryTokens, 10);
+	const pathScore = fieldScore(searchTokens(setting.path), queryTokens, 10);
+	const optionScore = fieldScore(searchTokens(optionLabelsText(setting)), queryTokens, 10);
+	const descriptionScore = fieldScore(searchTokens(setting.description), queryTokens, 1);
+	return titleScore + keywordScore + sectionScore + pathScore + optionScore + descriptionScore;
+}
+function resultGroupTitle(result) {
+	return result.section?.title ?? "";
+}
+function compareEditableFirst(left, right) {
+	return Number(left.section === null) - Number(right.section === null);
+}
+function searchMatches(setting, section, queryTokens) {
+	return [
+		["title", setting.title],
+		["keywords", setting.keywords.join(" ")],
+		["section", section?.title ?? fileOnlyGroupTitle(setting)],
+		["description", setting.description],
+		["path", setting.path],
+		["options", optionLabelsText(setting)]
+	].flatMap(([field, text]) => {
+		const spans = [];
+		for (const token of text.matchAll(/[a-z0-9]+/gi)) {
+			const fieldToken = token[0].toLowerCase();
+			for (const queryToken of queryTokens) {
+				if (tokenMatchQuality(fieldToken, queryToken) === 0) continue;
+				const start = token.index + fieldToken.indexOf(queryToken);
+				spans.push({
+					start,
+					end: start + queryToken.length
+				});
+			}
+		}
+		const mergedSpans = [];
+		for (const span of spans.sort((left, right) => left.start - right.start || left.end - right.end)) {
+			const previous = mergedSpans.at(-1);
+			if (previous && span.start <= previous.end) {
+				previous.end = Math.max(previous.end, span.end);
+				continue;
+			}
+			mergedSpans.push({ ...span });
+		}
+		return mergedSpans.length ? [{
+			field,
+			text,
+			spans: mergedSpans
+		}] : [];
+	});
+}
+function scoreSettingsSearch(sections, query, fileOnly = []) {
+	const queryTokens = searchTokens(query).slice(0, MAX_SEARCH_QUERY_TOKENS);
+	if (queryTokens.length === 0) return [];
+	const results = [];
+	for (const section of sections) {
+		const sectionTokens = searchTokens(section.title);
+		for (const setting of section.settings) {
+			const score = settingScore(setting, sectionTokens, queryTokens);
+			if (score === 0) continue;
+			results.push({
+				section,
+				setting,
+				score,
+				matches: searchMatches(setting, section, queryTokens)
+			});
+		}
+	}
+	for (const setting of fileOnly) {
+		const score = settingScore(setting, searchTokens(fileOnlyGroupTitle(setting)), queryTokens);
+		if (score === 0) continue;
+		results.push({
+			section: null,
+			setting,
+			score,
+			matches: searchMatches(setting, null, queryTokens)
+		});
+	}
+	return results.sort((left, right) => right.score - left.score || compareEditableFirst(left, right) || resultGroupTitle(left).localeCompare(resultGroupTitle(right)) || left.setting.title.localeCompare(right.setting.title)).slice(0, SEARCH_RESULT_LIMIT);
+}
+function indexSettings(registry) {
+	const byId = /* @__PURE__ */ new Map();
+	const byPath = /* @__PURE__ */ new Map();
+	for (const setting of [...settingsOf(registry.sections), ...registry.fileOnly]) {
+		byId.set(setting.id, setting);
+		byPath.set(setting.path, setting);
+	}
+	return {
+		byId,
+		byPath
+	};
+}
+var SETTINGS_INDEX = indexSettings(SETTINGS_REGISTRY);
+function settingsGroupOf(groupId, registry = SETTINGS_REGISTRY) {
+	const section = registry.sections.find((candidate) => candidate.id === groupId);
+	if (section) return {
+		title: section.title,
+		description: section.description
+	};
+	return FILE_ONLY_GROUPS[groupId] ?? null;
+}
+//#endregion
+//#region server/core/settings-block-core.ts
+var SECRET_PRESENCE_SUFFIX = "Configured";
+var NO_VALUES = Object.freeze({});
+var MAX_SETTINGS_VALUE_DEPTH = 32;
+function valueSpecOf(setting, control) {
+	const spec = {
+		control,
+		nullable: setting.nullable === true
+	};
+	if (setting.valueKind) spec.valueKind = setting.valueKind;
+	return spec;
+}
+function freezeSpec(spec) {
+	for (const nested of Object.values(spec.blocks)) freezeSpec(nested);
+	Object.freeze(spec.booleans);
+	Object.freeze(spec.blocks);
+	if (spec.values) Object.freeze(spec.values);
+	return Object.freeze(spec);
+}
+function buildBlockSpec(topLevelKey, registry) {
+	const root = {
+		name: topLevelKey,
+		booleans: [],
+		blocks: {}
+	};
+	const prefix = `${topLevelKey}.`;
+	for (const setting of [...settingsOf(registry.sections), ...registry.fileOnly]) {
+		const control = setting.control;
+		if (control === "readonly") continue;
+		if (setting.path === topLevelKey) {
+			root.passthrough = true;
+			continue;
+		}
+		if (!setting.path.startsWith(prefix)) continue;
+		const parts = setting.path.slice(prefix.length).split(".");
+		let node = root;
+		for (const part of parts.slice(0, -1)) {
+			node.blocks[part] ??= {
+				name: `${node.name}.${part}`,
+				booleans: [],
+				blocks: {}
+			};
+			node = node.blocks[part];
+		}
+		const leaf = parts.at(-1);
+		if (control === "toggle") {
+			node.booleans.push(leaf);
+			continue;
+		}
+		node.values ??= {};
+		node.values[leaf] = valueSpecOf(setting, control);
+	}
+	return freezeSpec(root);
+}
+var registrySpecs = /* @__PURE__ */ new Map();
+function settingsBlockSpecFor(topLevelKey, registry = SETTINGS_REGISTRY) {
+	if (registry !== SETTINGS_REGISTRY) return buildBlockSpec(topLevelKey, registry);
+	const cached = registrySpecs.get(topLevelKey);
+	if (cached) return cached;
+	const built = buildBlockSpec(topLevelKey, registry);
+	registrySpecs.set(topLevelKey, built);
+	return built;
+}
+settingsBlockSpecFor("ingest");
+function isNestedDeeperThan(value, maxDepth) {
+	const pending = [[value, 0]];
+	for (let next = pending.pop(); next; next = pending.pop()) {
+		const [node, depth] = next;
+		if (!node || typeof node !== "object") continue;
+		if (depth >= maxDepth) return true;
+		for (const nested of Object.values(node)) pending.push([nested, depth + 1]);
+	}
+	return false;
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function valueError(path, spec, value) {
+	if (value === null) return spec.nullable ? null : `${path} must not be null`;
+	if (isNestedDeeperThan(value, MAX_SETTINGS_VALUE_DEPTH)) return `${path} is nested too deeply`;
+	if (spec.valueKind) return null;
+	if (spec.control === "number") return typeof value === "number" && Number.isFinite(value) ? null : `${path} must be a number`;
+	if (spec.control === "list" || spec.control === "projects") return isStringArray(value) ? null : `${path} must be an array of strings`;
+	if (spec.control === "json") return isRecord(value) || Array.isArray(value) ? null : `${path} must be an object`;
+	return typeof value === "string" ? null : `${path} must be a string`;
+}
+function validateSettingsBlock(block, spec) {
+	if (block == null) return null;
+	if (!isRecord(block)) return `${spec.name} must be an object`;
+	const values = spec.values ?? NO_VALUES;
+	for (const [key, value] of Object.entries(block)) {
+		if (value === void 0) continue;
+		if (Object.hasOwn(values, key)) {
+			const error = valueError(`${spec.name}.${key}`, values[key], value);
+			if (error) return error;
+			continue;
+		}
+		if (value === null) continue;
+		if (spec.booleans.includes(key)) {
+			if (typeof value !== "boolean") return `${spec.name}.${key} must be a boolean`;
+			continue;
+		}
+		if (Object.hasOwn(spec.blocks, key)) {
+			const error = validateSettingsBlock(value, spec.blocks[key]);
+			if (error) return error;
+			continue;
+		}
+		if (!spec.passthrough) return `${spec.name}.${key} is not settable from the dashboard`;
+		if (isNestedDeeperThan(value, MAX_SETTINGS_VALUE_DEPTH)) return `${spec.name}.${key} is nested too deeply`;
+	}
+	return null;
+}
+function isStoredSecret(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function clonedEntries(source) {
+	const out = {};
+	for (const [key, value] of Object.entries(source)) if (value !== void 0) out[key] = cloneValue(value);
+	return out;
+}
+function isCopiedIntoPick(key, spec) {
+	const values = spec.values ?? NO_VALUES;
+	if (!Object.hasOwn(values, key)) return spec.passthrough === true;
+	return values[key].control !== "password";
+}
+function pickSettingsBlock(stored, spec, tooDeepPaths = []) {
+	if (!isRecord(stored)) return null;
+	const tooDeepKeys = Object.keys(stored).filter((key) => isCopiedIntoPick(key, spec) && isNestedDeeperThan(stored[key], MAX_SETTINGS_VALUE_DEPTH));
+	tooDeepPaths.push(...tooDeepKeys.map((key) => `${spec.name}.${key}`));
+	const pickable = Object.fromEntries(Object.entries(stored).filter(([key]) => !tooDeepKeys.includes(key)));
+	const out = spec.passthrough ? clonedEntries(pickable) : {};
+	for (const key of spec.booleans) if (typeof pickable[key] === "boolean") out[key] = pickable[key];
+	for (const [key, value] of Object.entries(spec.values ?? NO_VALUES)) {
+		if (value.control === "password") {
+			delete out[key];
+			out[`${key}${SECRET_PRESENCE_SUFFIX}`] = isStoredSecret(pickable[key]);
+			continue;
+		}
+		if (pickable[key] !== void 0) out[key] = cloneValue(pickable[key]);
+	}
+	for (const [key, nested] of Object.entries(spec.blocks)) {
+		const picked = pickSettingsBlock(pickable[key], nested, tooDeepPaths);
+		if (picked) out[key] = picked;
+	}
+	return out;
+}
+function mergeSettingsBlock(stored, incoming, spec) {
+	const out = isRecord(stored) ? { ...stored } : {};
+	if (!isRecord(incoming)) return out;
+	if (spec.passthrough) Object.assign(out, clonedEntries(incoming));
+	for (const key of spec.booleans) if (incoming[key] != null) out[key] = !!incoming[key];
+	for (const [key, value] of Object.entries(spec.values ?? NO_VALUES)) {
+		if (incoming[key] === void 0) continue;
+		if (incoming[key] === null) {
+			if (value.nullable) out[key] = null;
+			continue;
+		}
+		out[key] = cloneValue(incoming[key]);
+	}
+	for (const [key, nested] of Object.entries(spec.blocks)) {
+		if (incoming[key] === void 0) continue;
+		out[key] = incoming[key] === null ? null : mergeSettingsBlock(out[key], incoming[key], nested);
+	}
+	return out;
+}
+//#endregion
+//#region server/core/rtk-install-core.ts
+var RTK_VERSION = "0.45.0";
+var RTK_RELEASE_BASE_URL = "https://github.com/rtk-ai/rtk/releases/download/v0.45.0/";
+var RTK_ASSETS = {
+	"linux-x64": {
+		file: "rtk-x86_64-unknown-linux-musl.tar.gz",
+		sha256: "c4c036fbf181fc55ef329786c8c17e0d427972b053b825944d968a6aafef1ba4"
+	},
+	"linux-arm64": {
+		file: "rtk-aarch64-unknown-linux-gnu.tar.gz",
+		sha256: "80a746dd305ef944ff50ef011ae4ce3878dd5ba88dfe35d859d05498191637c3"
+	},
+	"win32-x64": {
+		file: "rtk-x86_64-pc-windows-msvc.zip",
+		sha256: "34cea9009a8099acdaf85147b971d95f65efabfa63fb3aea7d3e2b73e6f517c3"
+	},
+	"darwin-x64": {
+		file: "rtk-x86_64-apple-darwin.tar.gz",
+		sha256: "9ea02f889d5a2779e4fb700df4587824303c5a57cda22e903e30058079fca0ef"
+	},
+	"darwin-arm64": {
+		file: "rtk-aarch64-apple-darwin.tar.gz",
+		sha256: "064151cfc2d50b24d810b06a0af2e41b9c945e83534e4c438c3d3eae607fc3f4"
+	}
+};
+var INSTALL_FAILURE_COOLDOWN_MS = 6e5;
+function assetForPlatform(platform, arch) {
+	const entry = RTK_ASSETS[`${platform}-${arch}`];
+	if (!entry) return null;
+	return {
+		...entry,
+		version: RTK_VERSION,
+		url: `${RTK_RELEASE_BASE_URL}${entry.file}`
+	};
+}
+function decideRtkInstall({ rtkEnabled, resolvedPath, platform, arch, inFlight = false, lastFailureAt = null, nowMs = 0, cooldownMs = INSTALL_FAILURE_COOLDOWN_MS } = {}) {
+	if (!rtkEnabled) return {
+		action: "skip",
+		reason: "rtk-disabled"
+	};
+	if (resolvedPath) return {
+		action: "skip",
+		reason: "already-resolved"
+	};
+	if (inFlight) return {
+		action: "skip",
+		reason: "install-in-flight"
+	};
+	const asset = assetForPlatform(String(platform), String(arch));
+	if (!asset) return {
+		action: "skip",
+		reason: `unsupported-platform:${platform}-${arch}`
+	};
+	if (typeof lastFailureAt === "number" && nowMs - lastFailureAt < cooldownMs) return {
+		action: "skip",
+		reason: "failure-cooldown"
+	};
+	return {
+		action: "install",
+		reason: "missing-binary",
+		asset
+	};
+}
+function verifyDigest(expectedHex, actualHex) {
+	if (typeof expectedHex !== "string" || typeof actualHex !== "string") return false;
+	if (expectedHex.length !== actualHex.length) return false;
+	return crypto.timingSafeEqual(Buffer.from(expectedHex, "utf8"), Buffer.from(actualHex, "utf8"));
+}
+function installTargetPath(glimmervoidHome, platform) {
+	const binaryName = platform === "win32" ? "rtk.exe" : "rtk";
+	return path.join(glimmervoidHome, "bin", binaryName);
+}
+function isRtkBinaryName(name, platform) {
+	const wanted = platform === "win32" ? "rtk.exe" : "rtk";
+	return name.toLowerCase() === wanted;
+}
+function findEscapingArchiveMember(listingText) {
+	const members = String(listingText || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const member of members) {
+		if (member.split(/[\\/]+/).includes("..")) return member;
+		if (member.startsWith("/") || member.startsWith("\\") || /^[A-Za-z]:/.test(member)) return member;
+	}
+	return null;
+}
+//#endregion
+//#region server/config-store.ts
+var DEFAULT_CONFIG = {
+	port: 3e3,
+	autoRecoverSeconds: 3,
+	inputGraceSeconds: 5,
+	promptDetectionMs: 1500,
+	notifyDebounceMs: 3e3,
+	phoneEscalationMs: 3e5,
+	cursorBlink: false,
+	debugMode: false,
+	conversationView: false,
+	streamerMode: false,
+	detectBackgroundAgents: true,
+	detectScheduledWakeups: true,
+	replayBufferKB: 512,
+	recordSignals: true,
+	trace: { enabled: true },
+	planReview: { enabled: true },
+	taskTitle: { refiner: {
+		enabled: true,
+		model: "haiku",
+		minIntervalSeconds: 60,
+		timeoutSeconds: 60
+	} },
+	changeMap: { narrator: {
+		enabled: false,
+		engine: "claude",
+		model: "",
+		timeoutSeconds: 90
+	} },
+	factory: {
+		enabled: false,
+		maxRisk: "medium",
+		maxLiveWorkers: 2,
+		checks: DEFAULT_FACTORY_CHECKS,
+		protectedPaths: DEFAULT_FACTORY_PROTECTED_PATHS,
+		reviewerModel: null,
+		dailyBudgetUsd: null,
+		verifierModel: null,
+		mirrorHarnessRuns: true
+	},
+	guardrails: {
+		unguardedRepos: [],
+		blockedPaths: [],
+		unreadablePaths: []
+	},
+	telemetry: { enabled: true },
+	checkForUpdates: true,
+	updateChannel: "release",
+	autoResume: true,
+	skipPermissionsByDefault: false,
+	rtk: false,
+	saneYolo: true,
+	telegramNotifications: false,
+	integrationBranch: null,
+	worktreeRoot: "",
+	worktreeShare: [
+		"node_modules",
+		".env",
+		".env.local",
+		".claude"
+	],
+	worktreeAutoRebase: true,
+	worktreeSyncOnStart: true,
+	worktreeRerere: true,
+	branchGc: {
+		enabled: true,
+		worktrees: true,
+		prefixes: [...DEFAULT_BRANCH_GC_PREFIXES],
+		dryRun: false,
+		staleDays: 14,
+		deleteUnmerged: false,
+		intervalMs: 216e5
+	},
+	repoRoots: [],
+	customAgents: [],
+	postTurnChecks: {
+		enabled: true,
+		mode: "report",
+		rules: {
+			trailingWs: true,
+			finalNewline: true,
+			bom: true,
+			slop: false
+		}
+	},
+	remote: {
+		enabled: false,
+		port: null,
+		publicHost: "",
+		allowedOrigins: []
+	},
+	workflows: {
+		enabled: true,
+		maxConcurrentSessions: 2,
+		maxActionsPerPoll: 20,
+		rules: []
+	},
+	projects: []
+};
+var DEFAULT_CONFIG_BY_KEY = DEFAULT_CONFIG;
+var ABORT_CONFIG_SAVE = "abort-config-save";
+var CONFIG_DIR_MODE = 448;
+function glimmervoidHomeDir() {
+	return glimmervoidHomeDir$1(os.homedir(), process.env);
+}
+function restrictMode(target, mode) {
+	try {
+		fs.chmodSync(target, mode);
+	} catch {}
+}
+function resolveConfigPath() {
+	const homeDir = glimmervoidHomeDir();
+	const decided = decideConfigPath({
+		env: process.env,
+		homeDir
+	}, (candidate) => fs.existsSync(candidate));
+	if (decided.path) return decided.path;
+	if (decided.source === "env") {
+		console.error(`Config file not found: ${decided.envPath}`);
+		process.exit(1);
+	}
+	const homeConfig = decided.homePath;
+	fs.mkdirSync(homeDir, {
+		recursive: true,
+		mode: CONFIG_DIR_MODE
+	});
+	restrictMode(homeDir, CONFIG_DIR_MODE);
+	writeJsonAtomicSync(homeConfig, DEFAULT_CONFIG, {
+		mode: 384,
+		enforceMode: true
+	});
+	console.log(`Created default config at ${homeConfig}`);
+	return homeConfig;
+}
+function generateProjectId() {
+	return crypto.randomUUID();
+}
+function validateConfig(candidate) {
+	if (!isRecord(candidate)) return {
+		ok: false,
+		errors: ["config must be a plain object"]
+	};
+	const parsedConfig = Config.safeParse(candidate);
+	if (!parsedConfig.success) return {
+		ok: false,
+		errors: parsedConfig.error.issues.map((issue) => {
+			if (issue.code === "custom") return issue.message;
+			const [root, index, field] = issue.path;
+			if (root === "port") return "port must be an integer from 0 to 65535";
+			if (root === "replayBufferKB") return issue.message;
+			if (root === "repoRoots" || root === "worktreeShare") return `${root} must be an array of strings`;
+			if (root === "remote") return "remote must be a plain object";
+			if (root !== "projects" && typeof DEFAULT_CONFIG_BY_KEY[String(root)] === "number") return `${String(root)} must be a finite number greater than or equal to 0`;
+			if (root !== "projects") return issue.message;
+			if (typeof index !== "number") return "projects must be an array";
+			if (!field) return `projects[${index}] must be a plain object`;
+			if (field === "agent") return `projects[${index}].agent must be ${AGENT_ID_SHAPE_MESSAGE}`;
+			if (field === "codexBypassHookTrust") return `projects[${index}].codexBypassHookTrust must be a boolean`;
+			if (field === "conversationView") return `projects[${index}].conversationView must be a boolean`;
+			return `projects[${index}].${String(field)} must be a string`;
+		})
+	};
+	return {
+		ok: true,
+		config: parsedConfig.data
+	};
+}
+function normalizeConfigFile(candidate) {
+	if (!isRecord(candidate)) throw new Error("config must be a plain object");
+	const draft = normalizeLegacyConfigNumbers(candidate);
+	for (const [key, fallback] of Object.entries(DEFAULT_CONFIG_BY_KEY)) {
+		if (fallback === null || typeof fallback === "object") continue;
+		if (!Object.hasOwn(draft, key)) continue;
+		const fieldSchema = Config.shape[key];
+		if (!fieldSchema || fieldSchema.safeParse(draft[key]).success) continue;
+		console.warn(`[config] ${key} value ${JSON.stringify(draft[key])} is invalid; using ${JSON.stringify(fallback)}`);
+		draft[key] = fallback;
+	}
+	const validation = validateConfig(draft);
+	if (!validation.ok) throw new Error(`validation failed: ${validation.errors.join("; ")}`);
+	return validation.config;
+}
+function writeBackupContent(backupPath, content) {
+	try {
+		writeTextAtomicSync(backupPath, content, {
+			mode: 384,
+			enforceMode: true
+		});
+	} catch (err) {
+		console.warn(`[config] Failed to write backup ${backupPath}:`, errorLabel(err));
+	}
+}
+function loadConfigFile(configPath, { exitOnError = true, envSecrets = readEnvSecrets(process.env) } = {}) {
+	const loadedContent = fs.readFileSync(configPath, "utf8");
+	try {
+		return {
+			config: withEnvSecrets(normalizeConfigFile(JSON.parse(loadedContent)), envSecrets),
+			loadedContent
+		};
+	} catch (err) {
+		const invalidBackupPath = `${configPath}.invalid.bak`;
+		try {
+			writeTextAtomicSync(invalidBackupPath, loadedContent, {
+				mode: 384,
+				enforceMode: true
+			});
+		} catch (backupErr) {
+			console.warn(`[config] Failed to save invalid config copy ${invalidBackupPath}:`, errorLabel(backupErr));
+		}
+		const message = `[config] Could not load ${configPath}: ${errorMessage(err)}. The broken file was copied to ${invalidBackupPath} when possible. Restore from ${configPath}.boot.bak or ${configPath}.bak, then restart Glimmervoid.`;
+		if (!exitOnError) return {
+			error: err,
+			message,
+			invalidBackupPath
+		};
+		console.error(message);
+		process.exit(1);
+	}
+}
+function writeMutatedConfigFile(configPath, mutatorFn) {
+	const loaded = loadConfigFile(configPath, {
+		exitOnError: false,
+		envSecrets: []
+	});
+	if ("error" in loaded) return {
+		ok: false,
+		message: loaded.message
+	};
+	mutatorFn(loaded.config);
+	const validation = validateConfig(loaded.config);
+	if (!validation.ok) return {
+		ok: false,
+		message: `config.json at ${configPath} was not written; validation failed: ${validation.errors.join("; ")}`
+	};
+	const nextContent = JSON.stringify(validation.config, null, 2);
+	if (nextContent !== loaded.loadedContent) writeBackupContent(`${configPath}.bak`, loaded.loadedContent);
+	writeTextAtomicSync(configPath, nextContent, { mode: 384 });
+	return {
+		ok: true,
+		config: validation.config
+	};
+}
+function saveConfigFileOnce(configPath, mutatorFn) {
+	try {
+		return writeMutatedConfigFile(configPath, mutatorFn);
+	} catch (error) {
+		return {
+			ok: false,
+			message: `config.json at ${configPath} was not written: ${errorMessage(error)}`
+		};
+	}
+}
+function topLevelKeyCount(candidate) {
+	if (!isRecord(candidate)) return 0;
+	return Object.keys(candidate).length;
+}
+function isSuspectedExternalWipe(candidate, currentConfig) {
+	const currentKeyCount = topLevelKeyCount(currentConfig);
+	if (currentKeyCount === 0) return false;
+	return topLevelKeyCount({
+		...candidate,
+		branchGc: resolveBranchGc(candidate.branchGc)
+	}) * 2 < currentKeyCount;
+}
+function warnInvalidConfig(action, validation) {
+	console.warn(`[config] Refusing to ${action}; validation failed: ${validation.errors.join("; ")}. Recovery sources: config.json.bak and config.json.boot.bak.`);
+}
+function warnSuspectedWipe(action) {
+	console.warn(`[config] Refusing to ${action}; config.json has fewer than half the top-level keys of the in-memory config. This looks like an external wipe. Recovery sources: config.json.bak and config.json.boot.bak.`);
+}
+function ensureProjectIds(projects) {
+	let changed = false;
+	for (const p of projects) if (!p.id) {
+		p.id = generateProjectId();
+		changed = true;
+	}
+	return changed;
+}
+function collectBranchGcIssues(branchGc) {
+	if (!isRecord(branchGc)) return {
+		block: { ...DEFAULT_CONFIG.branchGc },
+		issues: []
+	};
+	const accepted = {};
+	const issues = [];
+	for (const [field, value] of Object.entries(branchGc)) {
+		if (!Object.hasOwn(BranchGcFileSettings.shape, field)) {
+			issues.push(`[config] Ignoring unknown branchGc.${field}; it is not a branchGc setting, so the default block applies.`);
+			continue;
+		}
+		const parsed = BranchGcFileSettings.safeParse({ [field]: value });
+		if (!parsed.success) {
+			issues.push(`[config] Ignoring invalid branchGc.${field}; using the default instead: ${configIssueMessage(parsed.error)}`);
+			continue;
+		}
+		accepted[field] = value;
+	}
+	return {
+		block: {
+			...DEFAULT_CONFIG.branchGc,
+			...accepted
+		},
+		issues
+	};
+}
+function resolveBranchGc(branchGc) {
+	return collectBranchGcIssues(branchGc).block;
+}
+function resolveBranchGcAndWarn(branchGc) {
+	const resolved = collectBranchGcIssues(branchGc);
+	for (const issue of resolved.issues) console.warn(issue);
+	return resolved.block;
+}
+function secretSourcesOf(env) {
+	return Object.fromEntries(readEnvSecrets(env).map((secret) => [`${secret.blockName}.${secret.secretKey}`, secret.environmentVariable]));
+}
+function retiredGuardrailKeysWarning(config) {
+	const projects = Array.isArray(config.projects) ? config.projects : [];
+	const retiredKeys = [...Object.hasOwn(config, "sandbox") ? ["sandbox (move it to guardrails, renaming unconfinedRepos to unguardedRepos)"] : [], ...projects.some((project) => isRecord(project) && Object.hasOwn(project, "unconfined")) ? ["projects[].unconfined (rename it to unguarded)"] : []];
+	if (retiredKeys.length === 0) return null;
+	return `[guardrails] config.json still has ${retiredKeys.join(" and ")}. These keys are ignored, so their unreadable paths and opt-outs do not apply until you move them.`;
+}
+function createConfigStore({ settingsDefaults } = {}) {
+	const configPath = resolveConfigPath();
+	const effectiveDefaults = {
+		...DEFAULT_CONFIG,
+		...settingsDefaults || {}
+	};
+	const launchDefaultKeys = new Set(Object.keys(settingsDefaults || {}));
+	const envSecrets = readEnvSecrets(process.env);
+	const loadedConfig = loadConfigFile(configPath);
+	const config = loadedConfig.config;
+	writeBackupContent(`${configPath}.boot.bak`, loadedConfig.loadedContent);
+	config.repoRoots = config.repoRoots || [];
+	config.branchGc = resolveBranchGcAndWarn(config.branchGc);
+	const retiredGuardrailKeys = retiredGuardrailKeysWarning(config);
+	if (retiredGuardrailKeys !== null) console.warn(retiredGuardrailKeys);
+	if (Array.isArray(config.projects) && ensureProjectIds(config.projects)) try {
+		writeJsonAtomicSync(configPath, withoutEnvSecrets(config, envSecrets), { mode: 384 });
+		console.log("[config] Auto-assigned IDs to projects missing them");
+	} catch (err) {
+		console.warn("[config] Failed to persist auto-assigned project IDs:", errorMessage(err));
+	}
+	let _lastWrittenContent = null;
+	let _lastAppliedContent = loadedConfig.loadedContent;
+	let synchronousWriteRevision = 0;
+	let lastSynchronousContent = null;
+	let pendingSaves = Promise.resolve();
+	function prepareSave(freshConfig, mutatorFn) {
+		const freshValidation = validateConfig(freshConfig);
+		if (!freshValidation.ok) {
+			warnInvalidConfig("save config.json", freshValidation);
+			return null;
+		}
+		if (isSuspectedExternalWipe(freshConfig, config)) {
+			warnSuspectedWipe("save config.json");
+			return null;
+		}
+		if (mutatorFn(freshConfig) === "abort-config-save") return null;
+		const mutatedValidation = validateConfig(withEnvSecrets(freshConfig, envSecrets));
+		if (!mutatedValidation.ok) {
+			warnInvalidConfig("save config.json", mutatedValidation);
+			return null;
+		}
+		return mutatedValidation.config;
+	}
+	function save(mutatorFn) {
+		let loaded;
+		try {
+			loaded = loadConfigFile(configPath, { exitOnError: false });
+		} catch (err) {
+			console.warn("[config] Failed to read config.json for save:", errorLabel(err));
+			return null;
+		}
+		if ("error" in loaded) {
+			console.warn(loaded.message);
+			return null;
+		}
+		const freshConfig = loaded.config;
+		const freshContent = loaded.loadedContent;
+		const effectiveConfig = prepareSave(freshConfig, mutatorFn);
+		if (!effectiveConfig) return null;
+		try {
+			const nextContent = JSON.stringify(withoutEnvSecrets(effectiveConfig, envSecrets), null, 2);
+			if (freshContent !== nextContent) writeBackupContent(`${configPath}.bak`, freshContent);
+			_lastWrittenContent = nextContent;
+			_lastAppliedContent = null;
+			writeTextAtomicSync(configPath, nextContent, { mode: 384 });
+			lastSynchronousContent = nextContent;
+			synchronousWriteRevision++;
+		} catch (err) {
+			console.warn("[config] Failed to write config.json:", errorLabel(err));
+			return null;
+		}
+		return effectiveConfig;
+	}
+	function saveAsync(mutatorFn) {
+		const scheduledSave = pendingSaves.then(async () => {
+			let concurrentContent = null;
+			for (;;) {
+				const revision = synchronousWriteRevision;
+				try {
+					const diskContent = await fs.promises.readFile(configPath, "utf8");
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					const freshContent = concurrentContent ?? diskContent;
+					const effectiveConfig = prepareSave(withEnvSecrets(normalizeConfigFile(JSON.parse(freshContent)), envSecrets), mutatorFn);
+					if (!effectiveConfig) return null;
+					const nextContent = JSON.stringify(withoutEnvSecrets(effectiveConfig, envSecrets), null, 2);
+					if (freshContent !== nextContent) try {
+						await writeTextAtomic(`${configPath}.bak`, freshContent, {
+							mode: 384,
+							enforceMode: process.platform !== "win32"
+						});
+					} catch (error) {
+						console.warn(`[config] Failed to write backup ${configPath}.bak:`, errorLabel(error));
+					}
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					await writeTextAtomic(configPath, nextContent, { mode: 384 });
+					if (revision !== synchronousWriteRevision) {
+						concurrentContent = lastSynchronousContent;
+						continue;
+					}
+					_lastWrittenContent = nextContent;
+					_lastAppliedContent = null;
+					return effectiveConfig;
+				} catch (error) {
+					console.warn("[config] Failed to save config.json asynchronously:", errorMessage(error));
+					return null;
+				}
+			}
+		});
+		pendingSaves = scheduledSave;
+		return scheduledSave;
+	}
+	const warnedTooDeepPaths = /* @__PURE__ */ new Set();
+	function pickBlock(blockName, stored) {
+		const tooDeepPaths = [];
+		const picked = pickSettingsBlock(stored, settingsBlockSpecFor(blockName), tooDeepPaths);
+		for (const tooDeepPath of tooDeepPaths) {
+			if (warnedTooDeepPaths.has(tooDeepPath)) continue;
+			warnedTooDeepPaths.add(tooDeepPath);
+			console.warn(`[config] ${tooDeepPath} is nested too deeply to send to the dashboard, so Settings leaves it out; config.json keeps it as it is.`);
+		}
+		return picked;
+	}
+	function getSettings() {
+		return {
+			port: config.port,
+			autoRecoverSeconds: config.autoRecoverSeconds,
+			inputGraceSeconds: config.inputGraceSeconds,
+			promptDetectionMs: config.promptDetectionMs,
+			notifyDebounceMs: config.notifyDebounceMs,
+			phoneEscalationMs: config.phoneEscalationMs ?? DEFAULT_CONFIG.phoneEscalationMs,
+			replayBufferKB: config.replayBufferKB,
+			cursorBlink: config.cursorBlink ?? effectiveDefaults.cursorBlink,
+			debugMode: config.debugMode ?? effectiveDefaults.debugMode,
+			conversationView: config.conversationView ?? effectiveDefaults.conversationView,
+			streamerMode: config.streamerMode ?? effectiveDefaults.streamerMode,
+			detectBackgroundAgents: config.detectBackgroundAgents ?? effectiveDefaults.detectBackgroundAgents,
+			recordSignals: config.recordSignals ?? effectiveDefaults.recordSignals,
+			trace: pickBlock("trace", {
+				...DEFAULT_CONFIG.trace,
+				...config.trace
+			}),
+			guardrails: pickBlock("guardrails", {
+				...DEFAULT_CONFIG.guardrails,
+				...config.guardrails
+			}),
+			telemetry: pickBlock("telemetry", {
+				...DEFAULT_CONFIG.telemetry,
+				...config.telemetry
+			}),
+			telemetryForcedOff: isTelemetryForcedOff(process.env),
+			rtk: config.rtk ?? effectiveDefaults.rtk,
+			rtkInstallSupported: assetForPlatform(process.platform, process.arch) !== null,
+			saneYolo: config.saneYolo ?? effectiveDefaults.saneYolo,
+			checkForUpdates: config.checkForUpdates ?? effectiveDefaults.checkForUpdates,
+			updateChannel: config.updateChannel ?? effectiveDefaults.updateChannel,
+			autoResume: config.autoResume ?? effectiveDefaults.autoResume,
+			skipPermissionsByDefault: config.skipPermissionsByDefault ?? effectiveDefaults.skipPermissionsByDefault,
+			telegramNotifications: config.telegramNotifications ?? effectiveDefaults.telegramNotifications,
+			integrationBranch: config.integrationBranch === void 0 ? effectiveDefaults.integrationBranch : config.integrationBranch,
+			worktreeRoot: config.worktreeRoot ?? effectiveDefaults.worktreeRoot,
+			worktreeShare: config.worktreeShare ?? effectiveDefaults.worktreeShare,
+			repoRoots: config.repoRoots,
+			repositoryRootCaseInsensitive: equalsIgnoringCaseOnWindows("root", "ROOT"),
+			taskTitle: pickBlock("taskTitle", config.taskTitle ?? DEFAULT_CONFIG.taskTitle),
+			changeMap: pickBlock("changeMap", config.changeMap),
+			branchGc: pickBlock("branchGc", config.branchGc),
+			postTurnChecks: pickBlock("postTurnChecks", config.postTurnChecks ?? DEFAULT_CONFIG.postTurnChecks),
+			visions: pickBlock("visions", config.visions),
+			github: pickBlock("github", config.github),
+			teamReview: pickBlock("teamReview", config.teamReview),
+			benchmarks: pickBlock("benchmarks", config.benchmarks),
+			factory: pickBlock("factory", config.factory),
+			knowledgeGraph: pickBlock("knowledgeGraph", config.knowledgeGraph),
+			workflows: config.workflows ?? null,
+			posthog: pickBlock("posthog", config.posthog),
+			secretSources: secretSourcesOf(process.env),
+			usage: pickBlock("usage", config.usage),
+			telegram: pickBlock("telegram", config.telegram),
+			ingest: pickBlock("ingest", config.ingest),
+			projectChoices: (config.projects || []).map((p) => ({
+				id: p.id,
+				name: p.name,
+				path: p.path
+			}))
+		};
+	}
+	function isUnchosenLaunchDefault(target, key, value) {
+		if (!launchDefaultKeys.has(key)) return false;
+		if (key in target) return false;
+		return value === effectiveDefaults[key];
+	}
+	function applySettings(newConfig) {
+		for (const key of RUNTIME_CONFIG_SCALAR_KEYS) {
+			if (key === "integrationBranch" && newConfig[key] !== void 0) {
+				config[key] = newConfig[key] === null || String(newConfig[key]) === "" ? null : String(newConfig[key]);
+				continue;
+			}
+			if (newConfig[key] == null) {
+				delete config[key];
+				continue;
+			}
+			let nextValue = newConfig[key];
+			if (typeof DEFAULT_CONFIG_BY_KEY[key] === "boolean") nextValue = !!nextValue;
+			if (typeof DEFAULT_CONFIG_BY_KEY[key] === "string") nextValue = String(nextValue);
+			if (typeof nextValue === "boolean" && isUnchosenLaunchDefault(config, key, nextValue)) continue;
+			config[key] = nextValue;
+		}
+		config.repoRoots = newConfig.repoRoots || [];
+		if (newConfig.postTurnChecks == null) delete config.postTurnChecks;
+		if (newConfig.postTurnChecks != null) config.postTurnChecks = newConfig.postTurnChecks;
+		if (newConfig.worktreeShare == null) delete config.worktreeShare;
+		if (newConfig.worktreeShare != null) config.worktreeShare = newConfig.worktreeShare;
+		if (newConfig.taskTitle != null) config.taskTitle = newConfig.taskTitle;
+		if (newConfig.changeMap != null) config.changeMap = newConfig.changeMap;
+		if (newConfig.branchGc != null) config.branchGc = resolveBranchGc(newConfig.branchGc);
+		if (newConfig.visions != null) config.visions = newConfig.visions;
+		if (newConfig.github != null) config.github = newConfig.github;
+		if (newConfig.teamReview != null) config.teamReview = newConfig.teamReview;
+		if (newConfig.benchmarks != null) config.benchmarks = newConfig.benchmarks;
+		if (newConfig.factory != null) config.factory = newConfig.factory;
+		if (newConfig.knowledgeGraph != null) config.knowledgeGraph = newConfig.knowledgeGraph;
+		if (newConfig.posthog != null) config.posthog = newConfig.posthog;
+		if (newConfig.usage != null) config.usage = newConfig.usage;
+		if (newConfig.telegram != null) config.telegram = newConfig.telegram;
+		if (newConfig.ingest != null) config.ingest = newConfig.ingest;
+		if (newConfig.guardrails != null) config.guardrails = newConfig.guardrails;
+		if (newConfig.telemetry != null) config.telemetry = newConfig.telemetry;
+		if (newConfig.workflows == null) delete config.workflows;
+		if (newConfig.workflows != null) config.workflows = newConfig.workflows;
+		if (newConfig.coder == null) delete config.coder;
+		if (newConfig.coder != null) config.coder = newConfig.coder;
+		config.customAgents = newConfig.customAgents ?? [];
+		config.hooks = Array.isArray(newConfig.hooks) ? newConfig.hooks : [];
+		if (newConfig.port != null && newConfig.port !== config.port) console.log(`[settings] Port changed to ${newConfig.port} - restart required to take effect`);
+	}
+	function watchForChanges(callback) {
+		let reloadTimer = null;
+		let watcher = null;
+		function handleConfigChange(err, data) {
+			if (err) {
+				console.warn("[config] Failed to read config.json:", err.code);
+				return;
+			}
+			if (_lastWrittenContent !== null && data === _lastWrittenContent) return;
+			if (_lastAppliedContent !== null && data === _lastAppliedContent) return;
+			let newConfig;
+			try {
+				newConfig = withEnvSecrets(normalizeConfigFile(JSON.parse(data)), envSecrets);
+			} catch (parseErr) {
+				console.warn("[config] Invalid config.json:", errorMessage(parseErr));
+				return;
+			}
+			newConfig.branchGc = resolveBranchGcAndWarn(newConfig.branchGc);
+			if (isSuspectedExternalWipe(newConfig, config)) {
+				warnSuspectedWipe("reload config.json");
+				return;
+			}
+			_lastAppliedContent = data;
+			_lastWrittenContent = null;
+			callback(newConfig);
+			console.log("[config] Reloaded config.json");
+		}
+		try {
+			const canonicalConfigPath = canonicalizePath(configPath);
+			const watchDir = path.dirname(canonicalConfigPath);
+			const targetName = path.basename(canonicalConfigPath);
+			watcher = fs.watch(watchDir, (_event, filename) => {
+				if (filename != null && !equalsIgnoringCaseOnWindows(path.basename(String(filename)), targetName)) return;
+				if (reloadTimer) clearTimeout(reloadTimer);
+				reloadTimer = setTimeout(() => {
+					fs.readFile(configPath, "utf8", handleConfigChange);
+				}, 500);
+			});
+			console.log("[config] Watching config.json for changes");
+		} catch (watchErr) {
+			console.warn("[config] Failed to watch config.json:", errorMessage(watchErr));
+		}
+		return function stop() {
+			if (reloadTimer) clearTimeout(reloadTimer);
+			if (watcher) try {
+				watcher.close();
+			} catch {}
+			watcher = null;
+		};
+	}
+	return {
+		config,
+		configPath,
+		save,
+		saveAsync,
+		idle: () => pendingSaves,
+		getSettings,
+		applySettings,
+		isUnchosenLaunchDefault,
+		watchForChanges,
+		DEFAULT_CONFIG
+	};
+}
+//#endregion
+export { withEnvSecrets as $, settingsOf as A, buildExceptionProperties as B, deleteValueAtPath as C, scoreSettingsSearch as D, parsePosthogProjectSelection as E, TELEMETRY_BATCH_URL as F, decideTelemetryConsent as G, classifySessionExit as H, TELEMETRY_FLAGS_URL as I, parsePosthogReleaseId as J, exceptionFingerprint as K, adapterBucket as L, FILE_ONLY_GROUPS as M, SETTINGS_REGISTRY as N, setValueAtPath as O, FIRST_RUN_NOTICE as P, stableConfigKey as Q, buildAiGenerationEvents as R, cloneValue as S, hasScaledUnit as T, decideIsDevInstall as U, buildFactoryDecisionEvent as V, decideRemoteTelemetryState as W, ENV_SECRET_BINDINGS as X, resolveProjectToken as Y, readEnvSecrets as Z, SECRET_PRESENCE_SUFFIX as _, generateProjectId as a, usablePrefixes as at, validateSettingsBlock as b, resolveConfigPath as c, comparableDirectoryPath as ct, assetForPlatform as d, DEFAULT_BRANCH_GC_PREFIXES as et, decideRtkInstall as f, verifyDigest as g, isRtkBinaryName as h, ensureProjectIds as i, sessionIdFromBranch as it, valueAtPath as j, settingsGroupOf as k, saveConfigFileOnce as l, isSameDirectoryPath as lt, installTargetPath as m, DEFAULT_CONFIG as n, planBranchGc as nt, glimmervoidHomeDir as o, worktreeIntegrationTips as ot, findEscapingArchiveMember as p, nodeMajorVersion as q, createConfigStore as r, planWorktreeGc as rt, loadConfigFile as s, canonicalizePath as st, ABORT_CONFIG_SAVE as t, matchedPrefix as tt, validateConfig as u, mergeSettingsBlock as v, displayText as w, SETTINGS_INDEX as x, settingsBlockSpecFor as y, buildBrowserExceptionProperties as z };