loki-mode 11.3.4 → 11.3.6

package/packages/control-plane/dist/server.js

@@ -7608,12 +7608,73 @@ var init_pr_body = __esm(() => {
   init_seal_group();
 });
 
+// ../../loki-ts/src/util/credential_env.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, statSync as statSync12, lstatSync as lstatSync4 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join28 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+function withheldSentinel(fresh = false) {
+  if (fresh)
+    sentinel = null;
+  return sentinel ??= `${SENTINEL_PREFIX}${process.pid}${randomBytes2(8).toString("hex")}INVALID`;
+}
+function emptyGhConfigDir(env = process.env) {
+  if (configDir && isDir(configDir))
+    return configDir;
+  const runTmp = env["LOKI_RUN_TMP"] ?? "";
+  const root = runTmp !== "" && isDir(runTmp) ? runTmp : tmpdir3();
+  try {
+    configDir = mkdtempSync2(join28(root, "loki-gh-config-"));
+  } catch {
+    return null;
+  }
+  if (!exitHooked) {
+    exitHooked = true;
+    process.once("exit", () => {
+      if (configDir)
+        try {
+          rmSync4(configDir, { recursive: true, force: true });
+        } catch {}
+    });
+  }
+  return configDir;
+}
+function hardenCredentialEnv(env, fresh = false) {
+  const s = withheldSentinel(fresh);
+  for (const v of GITHUB_TOKEN_VARS)
+    env[v] = s;
+  const dir = emptyGhConfigDir(env);
+  if (dir)
+    env["GH_CONFIG_DIR"] = dir;
+  const existing = Number(env["GIT_CONFIG_COUNT"]);
+  const n2 = Number.isInteger(existing) && existing >= 0 ? existing : 0;
+  const alreadyLast = n2 > 0 && env[`GIT_CONFIG_KEY_${n2 - 1}`] === "credential.helper" && env[`GIT_CONFIG_VALUE_${n2 - 1}`] === "";
+  if (!alreadyLast) {
+    env[`GIT_CONFIG_KEY_${n2}`] = "credential.helper";
+    env[`GIT_CONFIG_VALUE_${n2}`] = "";
+    env["GIT_CONFIG_COUNT"] = String(n2 + 1);
+  }
+  env["GIT_TERMINAL_PROMPT"] = "0";
+  env["GCM_INTERACTIVE"] = "never";
+}
+var GITHUB_TOKEN_VARS, SENTINEL_PREFIX = "ghp_LOKIWITHHELDsentinel", sentinel = null, configDir = null, exitHooked = false, isDir = (p) => {
+  try {
+    return !lstatSync4(p).isSymbolicLink() && statSync12(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var init_credential_env = __esm(() => {
+  GITHUB_TOKEN_VARS = ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
+});
+
 // ../../loki-ts/src/util/safe_git.ts
 import { execFileSync as execFileSync4, spawnSync } from "child_process";
 function tokenFreeEnv(env = process.env) {
   const out2 = { ...env };
   for (const k of SECRET_VARS)
     delete out2[k];
+  hardenCredentialEnv(out2);
   return out2;
 }
 function driverKeys(repoDir) {
@@ -7703,6 +7764,7 @@ var SAFE_GIT_CONFIG, CREDENTIAL_CONFIG, DRIVER_CONFIG, ATTRS_OFF = "core.attribu
   return env;
 };
 var init_safe_git = __esm(() => {
+  init_credential_env();
   SAFE_GIT_CONFIG = ["-c", "core.fsmonitor=", "-c", "core.hooksPath=/dev/null", "-c", "core.sshCommand=", "-c", "protocol.ext.allow=never", "-c", "credential.helper="];
   CREDENTIAL_CONFIG = ["-c", "core.fsmonitor=", "-c", "core.hooksPath=/dev/null", "-c", "protocol.ext.allow=never"];
   DRIVER_CONFIG = ["-c", "diff.external=", "-c", "commit.gpgSign=false", "-c", "core.attributesFile=/dev/null"];
@@ -7719,9 +7781,9 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, readFileSync as readFileSync19, rmSync as rmSync4, symlinkSync, writeFileSync as writeFileSync8 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { basename as basename8, dirname as dirname8, isAbsolute as isAbsolute2, join as join28, relative as relative2 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readFileSync as readFileSync19, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { basename as basename8, dirname as dirname8, isAbsolute as isAbsolute2, join as join29, relative as relative2 } from "path";
 function mutationProof(i) {
   const rels = i.wallFiles.map((f) => isAbsolute2(f.path) ? relative2(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
@@ -7739,25 +7801,25 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync2(join28(tmpdir3(), "loki-mutproof-"));
-    wt = join28(parent, "wt");
+    parent = mkdtempSync3(join29(tmpdir4(), "loki-mutproof-"));
+    wt = join29(parent, "wt");
     const add2 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
     added = existsSync16(wt) || add2.status === 0;
     if (add2.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join28(i.runDir, "wall", basename8(rel)), src = existsSync16(sealed) ? sealed : join28(i.repoDir, rel);
+      const sealed = join29(i.runDir, "wall", basename8(rel)), src = existsSync16(sealed) ? sealed : join29(i.repoDir, rel);
       if (!existsSync16(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync5(dirname8(join28(wt, rel)), { recursive: true });
-      writeFileSync8(join28(wt, rel), readFileSync19(src));
+      mkdirSync5(dirname8(join29(wt, rel)), { recursive: true });
+      writeFileSync8(join29(wt, rel), readFileSync19(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n2 = 0;n2 <= parts.length; n2++) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
-          const src = join28(i.repoDir, anc, d), dst = join28(wt, anc, d);
+          const src = join29(i.repoDir, anc, d), dst = join29(wt, anc, d);
           if (existsSync16(src) && !existsSync16(dst)) {
             try {
               symlinkSync(src, dst);
@@ -7788,7 +7850,7 @@ function mutationProof(i) {
     if (wt && added)
       git(i.repoDir, ["worktree", "remove", "--force", wt]);
     if (parent)
-      rmSync4(parent, { recursive: true, force: true });
+      rmSync5(parent, { recursive: true, force: true });
   }
 }
 var mutationStrict = (env = process.env) => (env["LOKI_MUTATION_STRICT"] ?? "").trim() === "1", mutationEnabled = (env = process.env) => (env["LOKI_MUTATION_PROOF"] ?? "").trim() !== "0", LABEL = "test fails without the fix: ", np = (reason) => ({ outcome: "inconclusive", line: `${LABEL}inconclusive (${reason})` }), MAX_TOTAL_S = 40, DEP_DIRS, git = (cwd, args, timeout = 30000) => {
@@ -7816,8 +7878,8 @@ var init_lean_prefix = __esm(() => {
 
 // ../../loki-ts/src/features/wall_manifest.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { accessSync, constants, statSync as statSync12 } from "fs";
-import { tmpdir as tmpdir4 } from "os";
+import { accessSync, constants, statSync as statSync13 } from "fs";
+import { tmpdir as tmpdir5 } from "os";
 function templateEnd(s, i) {
   for (let j = i + 1;j < s.length; ) {
     const c = s[j];
@@ -8550,7 +8612,7 @@ function resolvePython3() {
     const cand = `${dir}/python3`;
     try {
       accessSync(cand, constants.X_OK);
-      if (statSync12(cand).isFile())
+      if (statSync13(cand).isFile())
         return cand;
     } catch {}
   }
@@ -8563,7 +8625,7 @@ function pySignatures(src) {
       return [];
     const r = spawnSync2(py, ["-I", "-S", "-c", PY_SCRIPT], {
       input: norm2(src),
-      cwd: tmpdir4(),
+      cwd: tmpdir5(),
       timeout: PY_TIMEOUT_MS,
       encoding: "utf8",
       env: { PATH: process.env.PATH ?? "/usr/bin:/bin" },
@@ -9056,7 +9118,7 @@ var init_hooks = __esm(() => {
 
 // ../../loki-ts/src/engine10/cost.ts
 import { mkdirSync as mkdirSync7, readdirSync as readdirSync10, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function routerTelemetryOn(env = process.env) {
   return routerEnabled(env);
 }
@@ -9064,7 +9126,7 @@ function num4(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
 }
 function resultCostPath(lokiRoot, iteration) {
-  return join29(lokiRoot, "metrics", `result-cost-${iteration}.json`);
+  return join30(lokiRoot, "metrics", `result-cost-${iteration}.json`);
 }
 function sumResultCosts(lokiRoot, iterations, context = []) {
   const out2 = {
@@ -9201,7 +9263,7 @@ var init_cost = __esm(() => {
 
 // ../../loki-ts/src/runner/budget.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync8, readdirSync as readdirSync11, readFileSync as readFileSync23, renameSync as renameSync4, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname10, join as join30, resolve as resolve10 } from "path";
+import { dirname as dirname10, join as join31, resolve as resolve10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function _loadPricing() {
   try {
@@ -9358,8 +9420,8 @@ var init_sizing = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/schema.ts
-import { existsSync as existsSync20, lstatSync as lstatSync4, realpathSync as realpathSync14, statSync as statSync13 } from "fs";
-import { isAbsolute as isAbsolute3, join as join32, normalize, sep as sep9 } from "path";
+import { existsSync as existsSync20, lstatSync as lstatSync5, realpathSync as realpathSync14, statSync as statSync14 } from "fs";
+import { isAbsolute as isAbsolute3, join as join33, normalize, sep as sep9 } from "path";
 function safeRel(p) {
   const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
   if (n2 === "" || isAbsolute3(n2) || n2 === ".." || n2.startsWith("../"))
@@ -9368,7 +9430,7 @@ function safeRel(p) {
 }
 function insideRepo(repoDir, rel) {
   try {
-    const real2 = realpathSync14(join32(repoDir, rel));
+    const real2 = realpathSync14(join33(repoDir, rel));
     const base = realpathSync14(repoDir);
     return real2 === base || real2.startsWith(base + sep9);
   } catch {
@@ -9381,8 +9443,8 @@ function checkCitation(repoDir, raw2) {
   const rel = safeRel(raw2.replace(/:\d+(?:-\d+)?$/, ""));
   if (rel === null)
     return `citation "${raw2}" is not a repo-relative path`;
-  const abs = join32(repoDir, rel);
-  if (!existsSync20(abs) || !statSync13(abs).isFile() || !insideRepo(repoDir, rel))
+  const abs = join33(repoDir, rel);
+  if (!existsSync20(abs) || !statSync14(abs).isFile() || !insideRepo(repoDir, rel))
     return `citation "${raw2}" names a file that does not exist`;
   return null;
 }
@@ -9393,7 +9455,7 @@ function checkFingerprint(repoDir, raw2) {
   if (rel === null)
     return `fingerprint "${raw2}" is not a repo-relative path`;
   try {
-    if (!lstatSync4(join32(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
+    if (!lstatSync5(join33(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
       return `fingerprint "${raw2}" is not a regular file inside the repo`;
   } catch {
     return `fingerprint "${raw2}" names a file that does not exist`;
@@ -9421,8 +9483,8 @@ function checkDir(repoDir, v, where, errs) {
     errs.push(`${where}: must be a repo-relative directory ("." for the repo root)`);
     return ".";
   }
-  const abs = join32(repoDir, rel);
-  if (!existsSync20(abs) || !statSync13(abs).isDirectory() || !insideRepo(repoDir, rel))
+  const abs = join33(repoDir, rel);
+  if (!existsSync20(abs) || !statSync14(abs).isDirectory() || !insideRepo(repoDir, rel))
     errs.push(`${where}: directory "${rel}" does not exist`);
   return rel;
 }
@@ -9525,8 +9587,8 @@ var init_schema = __esm(() => {
 
 // ../../loki-ts/src/project_model/gather.ts
 import { createHash as createHash9 } from "crypto";
-import { closeSync as closeSync5, lstatSync as lstatSync5, openSync as openSync5, readFileSync as readFileSync25, readSync as readSync4 } from "fs";
-import { dirname as dirname11, join as join33 } from "path";
+import { closeSync as closeSync5, lstatSync as lstatSync6, openSync as openSync5, readFileSync as readFileSync25, readSync as readSync4 } from "fs";
+import { dirname as dirname11, join as join34 } from "path";
 function listShallow(repoDir) {
   try {
     const out2 = safeGit(repoDir, ["ls-files", "-z"], { maxBuffer: 256 * 1024 * 1024 });
@@ -9552,8 +9614,8 @@ function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
       if (checkFingerprint(repoDir, f) !== null)
         h.update("invalid");
       else {
-        const abs = join33(repoDir, f);
-        const size = lstatSync5(abs).size;
+        const abs = join34(repoDir, f);
+        const size = lstatSync6(abs).size;
         h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync25(abs) : `too-large:${size}`);
       }
     } catch {
@@ -9597,14 +9659,14 @@ var init_gather = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/discover.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync26, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync26, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
+import { join as join35 } from "path";
 function projectModelEnabled(env = process.env) {
   return env["LOKI_E10_PROJECT_MODEL"] !== "0";
 }
 function loadCached(repoDir, now2 = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8")), now2);
+    return parseCached(repoDir, JSON.parse(readFileSync26(join35(repoDir, PROJECT_FILE), "utf8")), now2);
   } catch {
     return null;
   }
@@ -9619,7 +9681,7 @@ function loadCommitted(repoDir) {
   };
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8"));
+    raw2 = JSON.parse(readFileSync26(join35(repoDir, PROJECT_FILE), "utf8"));
   } catch (e) {
     return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -9692,7 +9754,7 @@ var clean2 = (p) => typeof p === "string" ? posix.normalize(p.replace(/\\/g, "/"
 var init_api = () => {};
 
 // ../../loki-ts/src/project_model/resolve.ts
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 function loadProjectApi(repoDir, env = process.env) {
   if (!projectModelEnabled(env))
     return null;
@@ -9714,7 +9776,7 @@ function siteFor(api, repoDir, file) {
   const rel = api.relativeToRoot(file);
   if (!pkg || pkg.root === "." || rel === null)
     return null;
-  return { pkg, root: pkg.root, cwd: join35(repoDir, pkg.root), file: rel };
+  return { pkg, root: pkg.root, cwd: join36(repoDir, pkg.root), file: rel };
 }
 function groupByPackage(api, repoDir, files) {
   const out2 = new Map;
@@ -9747,9 +9809,9 @@ var init_scope = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync27, rmSync as rmSync6 } from "fs";
-import { tmpdir as tmpdir5 } from "os";
-import { join as join36 } from "path";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync27, rmSync as rmSync7 } from "fs";
+import { tmpdir as tmpdir6 } from "os";
+import { join as join37 } from "path";
 import { basename as basename11 } from "path";
 function classifyAssertDelta(inp) {
   const f = basename11(inp.path);
@@ -9759,7 +9821,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync3(join36(tmpdir5(), "loki-ad-"));
+    cwd = mkdtempSync4(join37(tmpdir6(), "loki-ad-"));
     const raw2 = execFileSync5("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -9782,7 +9844,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   } finally {
     if (cwd)
-      rmSync6(cwd, { recursive: true, force: true });
+      rmSync7(cwd, { recursive: true, force: true });
   }
 }
 function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, headCounts) {
@@ -9790,7 +9852,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync27(join36(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync27(join37(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -10225,12 +10287,12 @@ var init_check_result = __esm(() => {
 
 // ../../loki-ts/src/runner/load_owner.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync4, realpathSync as realpathSync15, rmSync as rmSync7 } from "fs";
-import { tmpdir as tmpdir6 } from "os";
-import { basename as basename13, extname, join as join37 } from "path";
+import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync15, rmSync as rmSync8 } from "fs";
+import { tmpdir as tmpdir7 } from "os";
+import { basename as basename13, extname, join as join38 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
   return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join37(repoDir, f)))
+    if (out2.includes(f) || out2.includes(join38(repoDir, f)))
       return true;
     const segs = f.split("/");
     if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
@@ -10341,7 +10403,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync4(join37(tmpdir6(), "e10-loadown-"));
+  const dir = mkdtempSync5(join38(tmpdir7(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -10355,7 +10417,7 @@ async function loadErrorIsHarnessOwned(i) {
     try {
       git3(["worktree", "remove", "--force", dir]);
     } catch {}
-    rmSync7(dir, { recursive: true, force: true });
+    rmSync8(dir, { recursive: true, force: true });
     try {
       git3(["worktree", "prune"]);
     } catch {}
@@ -10373,7 +10435,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { basename as basename14, extname as extname2, join as join38, relative as relative3, sep as sep10 } from "path";
+import { basename as basename14, extname as extname2, join as join39, relative as relative3, sep as sep10 } from "path";
 function isTestFile(rel) {
   const name = basename14(rel);
   return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
@@ -10403,7 +10465,7 @@ var init_testmap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute4, join as join39, relative as relative4 } from "path";
+import { isAbsolute as isAbsolute4, join as join40, relative as relative4 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -10435,7 +10497,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative4(repoDir, isAbsolute4(f) ? f : join39(cwd, f)));
+  return [...files].map((f) => relative4(repoDir, isAbsolute4(f) ? f : join40(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -10447,9 +10509,9 @@ var init_wall_owned = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync22, mkdtempSync as mkdtempSync5, realpathSync as realpathSync16, rmSync as rmSync8 } from "fs";
-import { tmpdir as tmpdir7 } from "os";
-import { dirname as dirname12, isAbsolute as isAbsolute5, join as join40, relative as relative5 } from "path";
+import { existsSync as existsSync22, mkdtempSync as mkdtempSync6, realpathSync as realpathSync16, rmSync as rmSync9 } from "fs";
+import { tmpdir as tmpdir8 } from "os";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join41, relative as relative5 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
@@ -10460,7 +10522,7 @@ function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join40(repoDir, ".venv", "bin", bin), join40(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join40(venvEnv, "bin", bin)] : []].find(existsSync22);
+  const project = [join41(repoDir, ".venv", "bin", bin), join41(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join41(venvEnv, "bin", bin)] : []].find(existsSync22);
   return project ? [project, "project"] : [Bun.which(fallback) ? fallback : lastResort, "system"];
 }
 function runnerCmd(t, repoDir) {
@@ -10585,7 +10647,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync5(join40(tmpdir7(), "e10-base-"));
+  const dir = mkdtempSync6(join41(tmpdir8(), "e10-base-"));
   const git3 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -10612,7 +10674,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
     try {
       git3(["worktree", "remove", "--force", dir]);
     } catch {}
-    rmSync8(dir, { recursive: true, force: true });
+    rmSync9(dir, { recursive: true, force: true });
     try {
       git3(["worktree", "prune"]);
     } catch {}
@@ -10620,7 +10682,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync22(join40(repoDir, "scripts", "select-tests.sh"));
+  return existsSync22(join41(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -10637,9 +10699,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync22(join40(g.cwd, "tsconfig.json")))
+    if (existsSync22(join41(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync22(join40(g.cwd, f))))
+    if (ESLINT_CONFIGS.some((f) => existsSync22(join41(g.cwd, f))))
       await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
   }
 }
@@ -10741,7 +10803,7 @@ var init_verify = __esm(() => {
 
 // ../../loki-ts/src/project_model/conventions.ts
 import { existsSync as existsSync23, readdirSync as readdirSync12, readFileSync as readFileSync28 } from "fs";
-import { dirname as dirname13, join as join41 } from "path";
+import { dirname as dirname13, join as join42 } from "path";
 function parseJsonc(text3) {
   let out2 = "", i = 0;
   while (i < text3.length) {
@@ -10776,7 +10838,7 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join41(dirname13(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  const next = join42(dirname13(file), ext.endsWith(".json") ? ext : `${ext}.json`);
   return existsSync23(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
@@ -10788,13 +10850,13 @@ function readPackageConventions(pkgDir, runner = null) {
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson5(join41(pkgDir, n2));
+    const j = readJson5(join42(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join41(pkgDir, n2));
+      tsModule = moduleOf(join42(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -10826,15 +10888,15 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync24, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync29, readdirSync as readdirSync13, realpathSync as realpathSync17, rmSync as rmSync9, writeFileSync as writeFileSync13 } from "fs";
-import { tmpdir as tmpdir8 } from "os";
-import { dirname as dirname14, isAbsolute as isAbsolute6, join as join42, relative as relative6 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync7, readFileSync as readFileSync29, readdirSync as readdirSync13, realpathSync as realpathSync17, rmSync as rmSync10, writeFileSync as writeFileSync13 } from "fs";
+import { tmpdir as tmpdir9 } from "os";
+import { dirname as dirname14, isAbsolute as isAbsolute6, join as join43, relative as relative6 } from "path";
 function pytestCollectionIsRed(output, repoDir) {
   if (/ModuleNotFoundError/.test(output))
     return false;
   const real2 = (p) => {
     try {
-      return realpathSync17(isAbsolute6(p) ? p : join42(repoDir, p));
+      return realpathSync17(isAbsolute6(p) ? p : join43(repoDir, p));
     } catch {
       return null;
     }
@@ -10871,7 +10933,7 @@ function pytestCollectionIsRed(output, repoDir) {
 }
 function moduleUnderRepo(repoDir, name) {
   const rel = name.replace(/\./g, "/");
-  return existsSync24(join42(repoDir, `${rel}.py`)) || existsSync24(join42(repoDir, rel, "__init__.py"));
+  return existsSync24(join43(repoDir, `${rel}.py`)) || existsSync24(join43(repoDir, rel, "__init__.py"));
 }
 function pytestExit1IsRed(output) {
   if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
@@ -10966,7 +11028,7 @@ ${repomapText}`] : [],
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join42(ctx.runDir, "issue.json");
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join43(ctx.runDir, "issue.json");
   if (existsSync24(issueJsonPath)) {
     try {
       const issue = JSON.parse(readFileSync29(issueJsonPath, "utf8"));
@@ -10981,7 +11043,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join42(repoDir, dirname14(first.path)) : join42(repoDir, "tests");
+  return first ? join43(repoDir, dirname14(first.path)) : join43(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -11012,11 +11074,11 @@ async function wallAuthor(ctx, signal) {
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
   const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative6(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join42(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync6(join42(tmpdir8(), "loki-e15-wall-"));
+  const conv2 = readPackageConventions(join43(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync7(join43(tmpdir9(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync13(join42(cwd, n2), c, "utf8");
+    writeFileSync13(join43(cwd, n2), c, "utf8");
   const session = await ctx.sessions.run({
     stage: "wall",
     brief: buildWallBrief(task, repomapText, runners, !!wm, conventionsBrief(conv2)),
@@ -11028,24 +11090,24 @@ async function wallAuthor(ctx, signal) {
     cwd
   });
   if (session.killed || session.exit === null) {
-    rmSync9(cwd, { recursive: true, force: true });
+    rmSync10(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: {}, reason: "wall session aborted, killed, or timed out", killed: true });
   }
   const generated = readdirSync13(cwd).filter((f) => f.startsWith(WALL_PREFIX));
-  const sealedDir = join42(ctx.runDir, "wall");
+  const sealedDir = join43(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync10(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync29(join42(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync13(join42(sealedDir, name), content, "utf8");
+    const content = readFileSync29(join43(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync13(join43(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
       contents.set(name, content);
   }
-  rmSync9(cwd, { recursive: true, force: true });
+  rmSync10(cwd, { recursive: true, force: true });
   return { kind: "authored", task, sizeName: sz.size, runners, targetDir, generated, contents, discarded, ...wm ? { manifestSha256: wm.sha256 } : {} };
 }
 function installWall(ctx, a, baseDir, opts = {}) {
@@ -11059,7 +11121,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join42(targetDir, name), runner = guessRunner(name, runners);
+    const dest = join43(targetDir, name), runner = guessRunner(name, runners);
     writeFileSync13(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
@@ -11069,13 +11131,13 @@ function installWall(ctx, a, baseDir, opts = {}) {
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const t of wallTests) {
-    const r = baseRunner.run(baseDir, [t]), abs = join42(ctx.repoDir, t.path);
+    const r = baseRunner.run(baseDir, [t]), abs = join43(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
     notRunFiles.push(...baseRunner.lastNotRunFiles ?? []);
     if (r.pass + r.fail === 0) {
-      rmSync9(abs, { force: true });
+      rmSync10(abs, { force: true });
       for (const l of [sealedFiles, readOnlyFiles])
         l.splice(0, l.length, ...l.filter((f) => f.path !== abs));
     }
@@ -11120,18 +11182,18 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync4, closeSync as closeSync6, lstatSync as lstatSync6, mkdirSync as mkdirSync11, openSync as openSync6, readFileSync as readFileSync30, realpathSync as realpathSync18, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname15, join as join43, relative as relative7, sep as sep11 } from "path";
+import { chmodSync as chmodSync4, closeSync as closeSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync11, openSync as openSync6, readFileSync as readFileSync30, realpathSync as realpathSync18, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname15, join as join44, relative as relative7, sep as sep11 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync18(repoDir), fp = join43(root, f), rel = relative7(root, dirname15(fp));
+  const root = realpathSync18(repoDir), fp = join44(root, f), rel = relative7(root, dirname15(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
   for (const part of rel === "" ? [] : rel.split(sep11)) {
-    cur = join43(cur, part);
+    cur = join44(cur, part);
     let st2;
     try {
-      st2 = lstatSync6(cur);
+      st2 = lstatSync7(cur);
     } catch {
       mkdirSync11(cur);
       continue;
@@ -11141,7 +11203,7 @@ function safeRestore(repoDir, f, want, mode) {
   }
   let st;
   try {
-    st = lstatSync6(fp);
+    st = lstatSync7(fp);
   } catch {
     st = null;
   }
@@ -11183,10 +11245,10 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join43(repoDir, f);
+    const fp = join44(repoDir, f);
     try {
       if (v.startsWith("!")) {
-        const st = lstatSync6(fp);
+        const st = lstatSync7(fp);
         if (`!${st.size}:${st.mtimeMs}:${st.ctimeMs}` !== v)
           throw new Error("changed, not snapshotted");
         continue;
@@ -11202,7 +11264,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync6(join43(repoDir, f));
+          const l = lstatSync7(join44(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -11246,9 +11308,9 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/features/speed/unit_mode.ts
-import { closeSync as closeSync7, constants as constants2, fstatSync as fstatSync4, lstatSync as lstatSync7, openSync as openSync7, readSync as readSync5, realpathSync as realpathSync19 } from "fs";
+import { closeSync as closeSync7, constants as constants2, fstatSync as fstatSync4, lstatSync as lstatSync8, openSync as openSync7, readSync as readSync5, realpathSync as realpathSync19 } from "fs";
 function readBounded(path) {
-  const l = lstatSync7(path);
+  const l = lstatSync8(path);
   if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
     return null;
   const fd = openSync7(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
@@ -11348,13 +11410,13 @@ import {
   closeSync as closeSync8,
   fstatSync as fstatSync5,
   fsyncSync as fsyncSync2,
-  lstatSync as lstatSync8,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync12,
   openSync as openSync8,
   readSync as readSync6,
   renameSync as renameSync5,
-  rmSync as rmSync10,
-  statSync as statSync14,
+  rmSync as rmSync11,
+  statSync as statSync15,
   unlinkSync as unlinkSync4,
   writeSync as writeSync3
 } from "fs";
@@ -11396,7 +11458,7 @@ var init_atomic = __esm(() => {
 
 // ../../loki-ts/src/util/pr_lessons.ts
 import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync31 } from "fs";
-import { dirname as dirname19, join as join44 } from "path";
+import { dirname as dirname19, join as join45 } from "path";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
   if (!existsSync25(p))
@@ -11425,17 +11487,17 @@ function recordRunVerdict(repoDir, runId, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join44(repoDir, ".loki", "memory", "semantic", "pr-lessons.json");
+var lessonsPath = (repoDir) => join45(repoDir, ".loki", "memory", "semantic", "pr-lessons.json");
 var init_pr_lessons = __esm(() => {
   init_atomic();
 });
 
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
-import { createHash as createHash10, randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync26, lstatSync as lstatSync9, mkdirSync as mkdirSync14, readdirSync as readdirSync14, readFileSync as readFileSync32, writeFileSync as writeFileSync15 } from "fs";
+import { createHash as createHash10, randomBytes as randomBytes3 } from "crypto";
+import { existsSync as existsSync26, lstatSync as lstatSync10, mkdirSync as mkdirSync14, readdirSync as readdirSync14, readFileSync as readFileSync32, writeFileSync as writeFileSync15 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname20, isAbsolute as isAbsolute7, join as join45, normalize as normalize2, relative as relative8, sep as sep12 } from "path";
+import { dirname as dirname20, isAbsolute as isAbsolute7, join as join46, normalize as normalize2, relative as relative8, sep as sep12 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -11445,7 +11507,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join45(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join46(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -11458,10 +11520,10 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute7(s.path) || normalize2(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join45(runDir, s.path);
+    const file = join46(runDir, s.path);
     let cur = runDir;
     for (const seg of normalize2(s.path).split(sep12)) {
-      cur = join45(cur, seg);
+      cur = join46(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
@@ -11508,7 +11570,7 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join45(repoDir, f);
+    const p = join46(repoDir, f);
     if (!existsSync26(p))
       continue;
     try {
@@ -11526,24 +11588,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join45(runDir, relDir, "e2e");
+    const dir = join46(runDir, relDir, "e2e");
     mkdirSync14(dir, { recursive: true });
-    writeFileSync15(join45(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync15(join45(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync15(join46(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync15(join46(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join45(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join46(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
       for (const e of readdirSync14(d, { withFileTypes: true })) {
-        const full = join45(d, e.name);
+        const full = join46(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join45(relDir, "e2e", relative8(dir, full)));
+          rels.push(join46(relDir, "e2e", relative8(dir, full)));
       }
     };
-    walk(join45(dir, "out"));
+    walk(join46(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -11612,8 +11674,8 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join45(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join45(appDir, "package.json");
+    const appDir = boot ? join46(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join46(appDir, "package.json");
     let script = null;
     if (!boot) {
       if (!existsSync26(pkgPath))
@@ -11645,20 +11707,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join45(runDir, "evidence");
+    const evRoot = join46(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync14(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join45("evidence", randomBytes2(6).toString("hex"));
-      mkdirSync14(join45(runDir, rel0));
+      const rel0 = join46("evidence", randomBytes3(6).toString("hex"));
+      mkdirSync14(join46(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join45(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join45(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join45(runDir, rel)) && existsSync26(join45(runDir, rel)))
+        const rel = join46(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join46(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join46(runDir, rel)) && existsSync26(join46(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -11683,9 +11745,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join45(evRoot, randomBytes2(6).toString("hex"));
+    const hdir = join46(evRoot, randomBytes3(6).toString("hex"));
     mkdirSync14(hdir);
-    writeFileSync15(join45(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync15(join46(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -11711,24 +11773,24 @@ function receiptScreensProblem(receiptPath, receipt) {
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname20(receiptPath), receipt["evidence_screens"]);
 }
 var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash10("sha256").update(readFileSync32(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join45(repoDir, "node_modules", ".bin", "playwright");
+  const bin = join46(repoDir, "node_modules", ".bin", "playwright");
   return existsSync26(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join45(repoDir, "node_modules", "@playwright", "test");
-  return existsSync26(join45(d, "package.json")) ? d : null;
+  const d = join46(repoDir, "node_modules", "@playwright", "test");
+  return existsSync26(join46(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
 });
 `, DEFAULT_BUDGET_MS = 25000, MAX_ROUTES = 5, isSymlink = (p) => {
   try {
-    return lstatSync9(p).isSymbolicLink();
+    return lstatSync10(p).isSymbolicLink();
   } catch {
     return false;
   }
 }, isRegularFile = (p) => {
   try {
-    return lstatSync9(p).isFile();
+    return lstatSync10(p).isFile();
   } catch {
     return false;
   }
@@ -11818,7 +11880,7 @@ var init_shell = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
 import { existsSync as existsSync27, readFileSync as readFileSync33 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK2[ceiling] < RANK2[verdict] ? ceiling : verdict;
@@ -11831,7 +11893,7 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join46(repoDir, f);
+    const p = join47(repoDir, f);
     if (!existsSync27(p))
       continue;
     try {
@@ -11916,12 +11978,12 @@ var init_xreview = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync28, lstatSync as lstatSync10, mkdirSync as mkdirSync15, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync28, lstatSync as lstatSync11, mkdirSync as mkdirSync15, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "fs";
+import { join as join48 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join47(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync28(p) || !lstatSync10(p).isFile())
+    const p = join48(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync28(p) || !lstatSync11(p).isFile())
       return;
     const v = JSON.parse(readFileSync34(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
@@ -11933,7 +11995,7 @@ var ROUTE_RECORD_FILE = "route.json";
 var init_route_record = () => {};
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync35, renameSync as renameSync6, rmSync as rmSync11, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync35, renameSync as renameSync6, rmSync as rmSync12, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve11 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
@@ -11966,7 +12028,7 @@ function appendRunOutcome(key, outcome, cacheRoot) {
       writeFileSync17(tmp, JSON.stringify({ runs: runs2 }));
       renameSync6(tmp, target);
     } catch (e) {
-      rmSync11(tmp, { force: true, recursive: false });
+      rmSync12(tmp, { force: true, recursive: false });
       throw e;
     }
     return true;
@@ -11983,7 +12045,7 @@ var init_history_store = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname21, join as join48, resolve as resolve12 } from "path";
+import { dirname as dirname21, join as join49, resolve as resolve12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
@@ -12061,8 +12123,8 @@ var init_cost_preview = __esm(() => {
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync30, lstatSync as lstatSync11, mkdirSync as mkdirSync17, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname22, join as join49 } from "path";
+import { existsSync as existsSync30, lstatSync as lstatSync12, mkdirSync as mkdirSync17, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname22, join as join50 } from "path";
 import { createHash as createHash11 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -12094,13 +12156,13 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join49(repoDir, ".loki", "contract.json");
+  return join50(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
   let st;
   try {
-    st = lstatSync11(p);
+    st = lstatSync12(p);
   } catch {
     return { contract: null, notes: [], sha256: null };
   }
@@ -12145,7 +12207,7 @@ function sealContract(repoDir, body, rawDiff, checks, env = process.env, snap) {
     const live2 = readContract(repoDir);
     let exists2 = true;
     try {
-      lstatSync11(contractPath(repoDir));
+      lstatSync12(contractPath(repoDir));
     } catch {
       exists2 = false;
     }
@@ -12179,8 +12241,8 @@ var init_contract = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync31, readFileSync as readFileSync37, statSync as statSync15 } from "fs";
-import { basename as basename17, join as join50 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync37, statSync as statSync16 } from "fs";
+import { basename as basename17, join as join51 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -12195,11 +12257,11 @@ function isManifestPath(path) {
   return MANIFESTS.test(basename17(path));
 }
 function readDeclared(repoDir) {
-  const p = join50(repoDir, ".loki", DECLARED_FILE);
+  const p = join51(repoDir, ".loki", DECLARED_FILE);
   if (!existsSync31(p))
     return { deps: [], problem: null };
   try {
-    if (statSync15(p).size > MAX_FILE_BYTES)
+    if (statSync16(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
     const j = JSON.parse(readFileSync37(p, "utf8"));
     if (!Array.isArray(j))
@@ -12221,7 +12283,7 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join50(repoDir, ".loki", "supply-allowlist");
+  const p = join51(repoDir, ".loki", "supply-allowlist");
   if (!existsSync31(p))
     return new Set;
   try {
@@ -12266,7 +12328,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join50(repoDir, ".npmrc"), home ? join50(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join51(repoDir, ".npmrc"), home ? join51(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -12275,7 +12337,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join50(home, ".config", "pip", "pip.conf") : "", home ? join50(home, ".pip", "pip.conf") : "", join50(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join51(home, ".config", "pip", "pip.conf") : "", home ? join51(home, ".pip", "pip.conf") : "", join51(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -12285,7 +12347,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join50(repoDir, ".cargo", "config.toml"), join50(repoDir, ".cargo", "config"), home ? join50(home, ".cargo", "config.toml") : "", home ? join50(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join51(repoDir, ".cargo", "config.toml"), join51(repoDir, ".cargo", "config"), home ? join51(home, ".cargo", "config.toml") : "", home ? join51(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -12408,7 +12470,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync15(p).size <= MAX_FILE_BYTES ? readFileSync37(p, "utf8") : "";
+    return statSync16(p).size <= MAX_FILE_BYTES ? readFileSync37(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -12423,10 +12485,10 @@ var init_supply_guard = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/seal.ts
-import { createHash as createHash12, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync32, readdirSync as readdirSync15, linkSync, mkdirSync as mkdirSync18, readFileSync as readFileSync38, statSync as statSync16, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "fs";
+import { createHash as createHash12, randomBytes as randomBytes4, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
+import { chmodSync as chmodSync5, existsSync as existsSync32, readdirSync as readdirSync15, linkSync, mkdirSync as mkdirSync18, readFileSync as readFileSync38, statSync as statSync17, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { basename as basename18, dirname as dirname23, isAbsolute as isAbsolute8, join as join51, relative as relative9 } from "path";
+import { basename as basename18, dirname as dirname23, isAbsolute as isAbsolute8, join as join52, relative as relative9 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -12454,12 +12516,12 @@ function loadSigningKey(generate = true) {
     let pem = inline ?? "";
     if (!inline) {
       const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
-      const file = given || join51(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
+      const file = given || join52(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
       try {
         pem = readFileSync38(file);
         if (!given) {
           for (const [f, m] of [[file, 384], [dirname23(file), 448]])
-            if (statSync16(f).mode & 63)
+            if (statSync17(f).mode & 63)
               chmodSync5(f, m);
         }
       } catch (e) {
@@ -12467,7 +12529,7 @@ function loadSigningKey(generate = true) {
           return null;
         mkdirSync18(dirname23(dirname23(file)), { recursive: true, mode: 448 });
         mkdirSync18(dirname23(file), { recursive: true, mode: 448 });
-        const tmp = `${file}.${randomBytes3(6).toString("hex")}.tmp`;
+        const tmp = `${file}.${randomBytes4(6).toString("hex")}.tmp`;
         writeFileSync19(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
         try {
           linkSync(tmp, file);
@@ -12559,7 +12621,7 @@ function renderReceiptMd(r) {
 `);
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash12("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash12("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest()), receiptRel = (ctx) => {
-  const r = relative9(ctx.repoDir, join51(ctx.runDir, "receipt.json"));
+  const r = relative9(ctx.repoDir, join52(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute8(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, sealStage;
 var init_seal = __esm(() => {
@@ -12662,7 +12724,7 @@ var init_seal = __esm(() => {
       if (wallNotRun > 0) {
         try {
           const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename18(String(f.path))));
-          for (const n2 of readdirSync15(join51(ctx.runDir, "wall")).sort())
+          for (const n2 of readdirSync15(join52(ctx.runDir, "wall")).sort())
             if (!kept.has(n2))
               notProven.add(`wall test discarded: ${n2} (not_run)`);
         } catch {}
@@ -12721,19 +12783,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join51(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join52(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]);
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join51(ctx.runDir, "events.jsonl");
+      const eventsPath = join52(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join51(ctx.repoDir, ".loki"), iterIds).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join52(ctx.repoDir, ".loki"), iterIds).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -12796,10 +12858,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync18(ctx.runDir, { recursive: true });
-      const path = join51(ctx.runDir, "receipt.json");
+      const path = join52(ctx.runDir, "receipt.json");
       writeFileSync19(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync19(join51(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync19(join52(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ctx.model, verdict, cost.usd, cost.unmetered === true, totalS);
       const signed = sig.jwt !== null;
       const data = { receipt_path: path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven, ...mp ? { mutation_line: mp.line } : {}, ...routeBlock ? { route_line: routePrLine(routeBlock) } : {} };
@@ -12905,8 +12967,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync33, readdirSync as readdirSync16, readFileSync as readFileSync40, statSync as statSync17 } from "fs";
-import { dirname as dirname24, join as join52 } from "path";
+import { existsSync as existsSync33, readdirSync as readdirSync16, readFileSync as readFileSync40, statSync as statSync18 } from "fs";
+import { dirname as dirname24, join as join53 } from "path";
 import { createHash as createHash13, createPublicKey as createPublicKey4, verify as verify3 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -12946,7 +13008,7 @@ function checkEventLog(receiptPath, receipt) {
   const bound = receipt["events_sha256"];
   if (typeof bound !== "string" || bound === createHash13("sha256").digest("hex"))
     return null;
-  const path = join52(dirname24(receiptPath), "events.jsonl");
+  const path = join53(dirname24(receiptPath), "events.jsonl");
   if (!existsSync33(path))
     return "events.jsonl is missing";
   const raw2 = readFileSync40(path, "utf8"), events2 = readEvents(path), lines = raw2.split(`
@@ -12965,7 +13027,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join52(dirname24(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join53(dirname24(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -13042,8 +13104,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync35, readFileSync as readFileSync43, statSync as statSync18 } from "fs";
-import { join as join55, resolve as resolve13, sep as sep14 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync43, statSync as statSync19 } from "fs";
+import { join as join56, resolve as resolve13, sep as sep14 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -23292,7 +23354,7 @@ function mount20(ctx) {
 // src/server/routes/verify.ts
 import { readFileSync as readFileSync41, realpathSync as realpathSync20 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join53, sep as sep13 } from "path";
+import { join as join54, sep as sep13 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -23319,11 +23381,11 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync20(join53(repo.p, ".loki", "runs"));
-      runDir = realpathSync20(join53(root, run2));
-      if (runDir !== join53(root, run2))
+      const root = realpathSync20(join54(repo.p, ".loki", "runs"));
+      runDir = realpathSync20(join54(root, run2));
+      if (runDir !== join54(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync20(join53(runDir, "receipt.json"));
+      file = realpathSync20(join54(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
@@ -23405,7 +23467,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 
 // src/server/legacy/shim.ts
 import { existsSync as existsSync34, readFileSync as readFileSync42 } from "fs";
-import { join as join54 } from "path";
+import { join as join55 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -23777,7 +23839,7 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join54(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join55(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync34(f))
         return readFileSync42(f, "utf8").trim();
@@ -23962,7 +24024,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join55(import.meta.dir, "../../ui/dist"), join55(import.meta.dir, "../ui/dist")].find((d) => existsSync35(join55(d, "index.html")));
+var defaultUiDir = () => [join56(import.meta.dir, "../../ui/dist"), join56(import.meta.dir, "../ui/dist")].find((d) => existsSync35(join56(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -23991,7 +24053,7 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join55(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join56(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
           return readFileSync43(f, "utf8").trim() || "unknown";
@@ -24105,11 +24167,11 @@ function createApp(opts) {
       return c.json({ error: "not found" }, 404);
     const root = resolve13(uiDir);
     const f = resolve13(root, `.${p}`);
-    if (f.startsWith(root + sep14) && existsSync35(f) && statSync18(f).isFile())
+    if (f.startsWith(root + sep14) && existsSync35(f) && statSync19(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join55(root, "index.html")));
+    return new Response(Bun.file(join56(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);