mixdog 1.3.1 → 1.3.2

package/src/tui/dist/index.mjs

@@ -23113,10 +23113,10 @@ var require_stack_utils = __commonJS({
 });
 
 // src/runtime/shared/file-permissions.mjs
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
+import { dirname, join, resolve as resolve2 } from "node:path";
 import { execFile as execFile2, execFileSync as execFileSync2, spawn as spawn3 } from "node:child_process";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath } from "node:url";
 import { MessageChannel as MessageChannel2, receiveMessageOnPort, SHARE_ENV, Worker } from "node:worker_threads";
 function execFileAsync(file, args, options) {
   return new Promise((done, fail) => {
@@ -23169,7 +23169,7 @@ function startAclHelper(icacls, sid) {
   let child;
   try {
     child = spawn3(command.executable, command.args, {
-      cwd: dirname3(icacls),
+      cwd: dirname(icacls),
       stdio: ["pipe", "pipe", "ignore"],
       windowsHide: true
     });
@@ -23250,7 +23250,7 @@ function syncBridge() {
   if (aclSyncBridge || aclSyncBridgeBroken) return aclSyncBridge;
   try {
     const url = new URL("./file-permissions-worker.mjs", import.meta.url);
-    if (!existsSync4(fileURLToPath2(url))) throw new Error("Windows ACL bridge worker is not shipped here");
+    if (!existsSync3(fileURLToPath(url))) throw new Error("Windows ACL bridge worker is not shipped here");
     const { port1, port2 } = new MessageChannel2();
     const signal = new Int32Array(new SharedArrayBuffer(12));
     const worker = new Worker(url, {
@@ -23304,7 +23304,7 @@ function askSyncBridge(targetPath) {
 }
 function systemToolPath(name) {
   const systemRoot = process.env.SystemRoot || process.env.windir;
-  return systemRoot ? join3(systemRoot, "System32", name) : null;
+  return systemRoot ? join(systemRoot, "System32", name) : null;
 }
 function currentUserSid(output) {
   return String(output).trim().match(/^"(?:[^"]|"")*","(S-\d+(?:-\d+)+)"$/)?.[1] || null;
@@ -23316,7 +23316,7 @@ function unresolvedUserError() {
 }
 function resolveCurrentUserPrincipal() {
   const whoami = systemToolPath("whoami.exe");
-  if (whoami && existsSync4(whoami)) {
+  if (whoami && existsSync3(whoami)) {
     try {
       const output = execFileSync2(whoami, ["/user", "/fo", "csv", "/nh"], {
         encoding: "utf8",
@@ -23332,7 +23332,7 @@ function resolveCurrentUserPrincipal() {
 }
 async function resolveCurrentUserPrincipalAsync() {
   const whoami = systemToolPath("whoami.exe");
-  if (whoami && existsSync4(whoami)) {
+  if (whoami && existsSync3(whoami)) {
     try {
       const { stdout: stdout2 } = await execFileAsync(whoami, ["/user", "/fo", "csv", "/nh"], {
         encoding: "utf8",
@@ -23352,7 +23352,7 @@ function icaclsPath() {
     error.code = "EACLNOROOT";
     throw error;
   }
-  if (!existsSync4(path2)) {
+  if (!existsSync3(path2)) {
     const error = new Error(`icacls.exe not found at ${path2}; refusing to leave secret world-readable`);
     error.code = "EACLNOICACLS";
     throw error;
@@ -23361,7 +23361,7 @@ function icaclsPath() {
 }
 function powerShellCommand(icacls, script) {
   return {
-    executable: join3(dirname3(icacls), "WindowsPowerShell", "v1.0", "powershell.exe"),
+    executable: join(dirname(icacls), "WindowsPowerShell", "v1.0", "powershell.exe"),
     label: "Windows ACL update",
     args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")]
   };
@@ -23402,7 +23402,7 @@ function enforceOwnerOnlyAclWin32(targetPath, { fresh = false } = {}) {
   if (process.platform !== "win32") return;
   const icacls = icaclsPath();
   if (fresh) {
-    const reply = askSyncBridge(resolve3(targetPath));
+    const reply = askSyncBridge(resolve2(targetPath));
     if (reply.ok === true) return;
     if (reply.ok === false) throw Object.assign(new Error(reply.message), { code: reply.code || "EACLFAIL" });
     if (reply.timedOut) {
@@ -23425,7 +23425,7 @@ async function enforceOwnerOnlyAclWin32Async(targetPath, { fresh = false } = {})
   if (process.platform !== "win32") return;
   const icacls = icaclsPath();
   if (cachedUserSid === null) cachedUserSid = await resolveCurrentUserPrincipalAsync();
-  const reply = await askAclHelper(resolve3(targetPath), icacls, cachedUserSid);
+  const reply = await askAclHelper(resolve2(targetPath), icacls, cachedUserSid);
   if (reply.status === "ok" || reply.status === "fixed") return;
   if (reply.status === "err") {
     throw aclFailure(targetPath, new Error(reply.detail || "unknown error"), "Windows ACL helper");
@@ -23500,13 +23500,13 @@ var init_sleep = __esm({
 // src/runtime/shared/file-lock.mjs
 import {
   linkSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   readdirSync,
-  readFileSync as readFileSync3,
-  renameSync as renameSync2,
+  readFileSync as readFileSync2,
+  renameSync,
   statSync,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "node:fs";
 import {
   link as linkAsync,
@@ -23516,7 +23516,7 @@ import {
   unlink as unlinkAsync,
   writeFile as writeFileAsync
 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, join as join4 } from "node:path";
+import { basename as basename2, dirname as dirname2, join as join2 } from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 function markOsHeld(lockPath) {
@@ -23780,7 +23780,7 @@ function lockStaleMs(opts) {
 function sweepStagedLockFiles(lockPath, now = Date.now()) {
   if (sweptLockPaths.has(lockPath)) return 0;
   sweptLockPaths.add(lockPath);
-  const dir = dirname4(lockPath);
+  const dir = dirname2(lockPath);
   const prefix = `${basename2(lockPath)}.`;
   let removed = 0;
   let names;
@@ -23793,7 +23793,7 @@ function sweepStagedLockFiles(lockPath, now = Date.now()) {
     if (!name.startsWith(prefix)) continue;
     const match = /^(?:reclaim\.)?(\d+)\.[0-9a-f]{16}\.tmp$/.exec(name.slice(prefix.length));
     if (!match) continue;
-    const path2 = join4(dir, name);
+    const path2 = join2(dir, name);
     try {
       if (now - statSync(path2).mtimeMs < STAGED_LOCK_FILE_STALE_MS) continue;
       if (ownerIsLive({ pid: Number(match[1]), token: null })) continue;
@@ -23808,7 +23808,7 @@ function* acquireLock(lockPath, opts, mode, markHeld, timing = null) {
   const timeoutMs = lockTimeoutMs(opts);
   const staleMs = lockStaleMs(opts);
   const deadline = Date.now() + timeoutMs;
-  yield ["mkdirp", dirname4(lockPath)];
+  yield ["mkdirp", dirname2(lockPath)];
   sweepStagedLockFiles(lockPath);
   const waitStartedAt = Date.now();
   let attempt = 0;
@@ -23907,10 +23907,10 @@ var init_file_lock = __esm({
     SYNC_IO = {
       stat: (path2) => statSync(path2),
       statId: (path2) => statSync(path2, { bigint: true }),
-      rename: (from, to) => renameSync2(from, to),
-      read: (path2) => readFileSync3(path2, "utf8"),
-      mkdirp: (path2) => mkdirSync2(path2, { recursive: true }),
-      createExclusive: (path2, data) => writeFileSync2(path2, data, { encoding: "utf8", mode: 384, flag: "wx" }),
+      rename: (from, to) => renameSync(from, to),
+      read: (path2) => readFileSync2(path2, "utf8"),
+      mkdirp: (path2) => mkdirSync(path2, { recursive: true }),
+      createExclusive: (path2, data) => writeFileSync(path2, data, { encoding: "utf8", mode: 384, flag: "wx" }),
       link: (from, to) => linkSync(from, to),
       unlink: (path2) => unlinkSync2(path2),
       sleep: (ms) => sleepSync(ms)
@@ -23932,15 +23932,16 @@ var init_file_lock = __esm({
 // src/runtime/shared/atomic-file.mjs
 import {
   closeSync,
-  existsSync as existsSync5,
+  existsSync as existsSync4,
   fsyncSync,
   linkSync as linkSync2,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync2,
   openSync,
-  readFileSync as readFileSync4,
-  renameSync as renameSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  statSync as statSync2,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync2
 } from "node:fs";
 import {
   link as linkAsync2,
@@ -23948,11 +23949,10 @@ import {
   open as openAsync,
   readFile as readFileAsync3,
   rename as renameAsync,
-  unlink as unlinkAsync2,
-  writeFile as writeFileAsync2
+  unlink as unlinkAsync2
 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, basename as basename3, join as join5, relative, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
+import { dirname as dirname3, basename as basename3, join as join3, relative, isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function _drainAdaptiveFileIo() {
   while (_ioActive < _ioLimit && _ioQueue.length > 0) {
@@ -23987,16 +23987,25 @@ function _runAdaptiveFileIo(run) {
 function renameBackoffs(opts) {
   return Array.isArray(opts.backoffs) && opts.backoffs.length > 0 ? opts.backoffs : DEFAULT_BACKOFFS_MS;
 }
-function nextRenameDelayMs(err, attempt, backoffs) {
+function isReadOnlyFile(path2) {
+  try {
+    const stat2 = statSync2(path2);
+    return stat2.isFile() && (stat2.mode & 128) === 0;
+  } catch {
+    return false;
+  }
+}
+function nextRenameDelayMs(err, attempt, backoffs, dst) {
   if (!RETRY_CODES.has(err?.code) || attempt >= backoffs.length) return null;
+  if ((err.code === "EPERM" || err.code === "EACCES") && isReadOnlyFile(dst)) return null;
   return backoffs[attempt] + Math.floor(Math.random() * Math.min(50, Math.max(1, backoffs[attempt])));
 }
 function renameAttempt(src, dst, attempt, opts = {}) {
   try {
-    renameSync3(src, dst);
+    renameSync2(src, dst);
     return null;
   } catch (err) {
-    const delayMs = nextRenameDelayMs(err, attempt, renameBackoffs(opts));
+    const delayMs = nextRenameDelayMs(err, attempt, renameBackoffs(opts), dst);
     if (delayMs === null) throw err;
     return delayMs;
   }
@@ -24017,13 +24026,16 @@ async function renameWithRetry(src, dst, opts = {}) {
       return true;
     } catch (err) {
       lastErr = err;
-      const delayMs = nextRenameDelayMs(err, attempt, backoffs);
+      const delayMs = nextRenameDelayMs(err, attempt, backoffs, dst);
       if (delayMs === null) break;
       await sleep(Math.max(1, Number(delayMs) || 1));
     }
   }
   throw lastErr;
 }
+function isFileFsyncUnsupported(err) {
+  return FILE_FSYNC_TOLERATED.includes(err?.code);
+}
 function fsyncPathSync(path2, tolerated) {
   let fd = null;
   try {
@@ -24052,120 +24064,188 @@ async function fsyncPathAsync(path2, tolerated) {
     }
   }
 }
+function writeFileDurableSync(path2, data, opts) {
+  const fd = openSync(path2, opts.flag || "wx", opts.mode !== void 0 ? opts.mode : 384);
+  try {
+    writeFileSync2(fd, data, { encoding: opts.encoding || "utf8" });
+    if (opts.fsync !== false) {
+      try {
+        fsyncSync(fd);
+      } catch (err) {
+        if (!isFileFsyncUnsupported(err)) throw err;
+      }
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+async function writeFileDurableAsync(path2, data, opts) {
+  const handle = await openAsync(path2, opts.flag || "wx", opts.mode !== void 0 ? opts.mode : 384);
+  try {
+    await handle.writeFile(data, { encoding: opts.encoding || "utf8" });
+    if (opts.fsync !== false) {
+      try {
+        await handle.sync();
+      } catch (err) {
+        if (!isFileFsyncUnsupported(err)) throw err;
+      }
+    }
+  } finally {
+    await handle.close();
+  }
+}
+function holdsNoData(content) {
+  if (typeof content === "string") return /^[\0\s]*$/.test(content);
+  for (const byte of content) {
+    if (byte !== 0 && byte !== 32 && byte !== 9 && byte !== 10 && byte !== 13) return false;
+  }
+  return true;
+}
+function keepBackupSync(filePath, opts) {
+  let previous;
+  try {
+    previous = readFileSync3(filePath);
+  } catch (err) {
+    if (err?.code === "ENOENT") return;
+    throw err;
+  }
+  if (keepsAsBackup(opts, previous)) publishFileSync(`${filePath}.bak`, previous, backupWriteOpts(opts));
+}
+async function keepBackupAsync(filePath, opts) {
+  let previous;
+  try {
+    previous = await readFileAsync3(filePath);
+  } catch (err) {
+    if (err?.code === "ENOENT") return;
+    throw err;
+  }
+  if (keepsAsBackup(opts, previous)) await publishFileAsync(`${filePath}.bak`, previous, backupWriteOpts(opts));
+}
 function assertTestSecretWriteSafe(filePath, opts) {
   if (opts.secret !== true || !process.env.NODE_TEST_CONTEXT) return;
-  const rel = relative(resolve4(tmpdir2()).toLowerCase(), resolve4(filePath).toLowerCase());
+  const rel = relative(resolve3(tmpdir2()).toLowerCase(), resolve3(filePath).toLowerCase());
   if (rel === "" || !rel.startsWith("..") && !isAbsolute2(rel)) return;
   throw new Error(`refusing to write a secret outside the temp dir under node --test: ${filePath}`);
 }
 function writeFileAtomicSync(filePath, data, opts = {}) {
   assertTestSecretWriteSafe(filePath, opts);
-  const run = () => {
-    const dir = dirname5(filePath);
-    mkdirSync3(dir, { recursive: true });
-    const tmp = join5(dir, `.${basename3(filePath)}.${randomBytes3(12).toString("hex")}.tmp`);
-    try {
-      const writeOpts = {
-        encoding: opts.encoding || "utf8",
-        flag: "wx",
-        mode: opts.mode !== void 0 ? opts.mode : 384
-      };
-      writeFileSync3(tmp, data, writeOpts);
-      if (opts.secret === true) enforceOwnerOnlyAclWin32(tmp, { fresh: true });
-      if (opts.fsync !== false) fsyncPathSync(tmp, FILE_FSYNC_TOLERATED);
-      if (opts.createOnly === true) {
-        try {
-          linkSync2(tmp, filePath);
-        } catch (err) {
-          try {
-            unlinkSync3(tmp);
-          } catch {
-          }
-          if (err?.code === "EEXIST") return false;
-          throw err;
-        }
+  const run = () => publishFileSync(filePath, data, opts);
+  if (opts.lock === true) {
+    return withFileLockSync(`${filePath}.lock`, run, opts);
+  }
+  return run();
+}
+function publishTempPath(filePath) {
+  return join3(dirname3(filePath), `${basename3(filePath)}.mixdog-tmp-${randomBytes3(8).toString("hex")}`);
+}
+function publishFileSync(filePath, data, opts) {
+  const dir = dirname3(filePath);
+  mkdirSync2(dir, { recursive: true });
+  const tmp = publishTempPath(filePath);
+  try {
+    writeFileDurableSync(tmp, data, { ...opts, flag: "wx" });
+    if (opts.secret === true) enforceOwnerOnlyAclWin32(tmp, { fresh: true });
+    if (opts.backup === true && opts.createOnly !== true) keepBackupSync(filePath, opts);
+    if (opts.createOnly === true) {
+      try {
+        linkSync2(tmp, filePath);
+      } catch (err) {
         try {
           unlinkSync3(tmp);
         } catch {
         }
-      } else {
-        try {
-          renameWithRetrySync(tmp, filePath, opts);
-        } catch (err) {
-          if (opts.renameFallback === "truncate" && opts.secret !== true && process.platform === "win32" && RETRY_CODES.has(err?.code)) {
-            const data2 = readFileSync4(tmp);
-            writeFileSync3(filePath, data2, { mode: opts.mode !== void 0 ? opts.mode : 384 });
-            try {
-              unlinkSync3(tmp);
-            } catch {
-            }
-          } else {
-            throw err;
-          }
-        }
+        if (err?.code === "EEXIST") return false;
+        throw err;
       }
-      if (opts.fsyncDir === true) fsyncPathSync(dir, DIR_FSYNC_TOLERATED);
-      return true;
-    } catch (err) {
       try {
-        if (existsSync5(tmp)) unlinkSync3(tmp);
+        unlinkSync3(tmp);
       } catch {
       }
-      throw err;
+    } else {
+      try {
+        renameWithRetrySync(tmp, filePath, opts);
+      } catch (err) {
+        if (opts.renameFallback === "truncate" && opts.secret !== true && process.platform === "win32" && RETRY_CODES.has(err?.code)) {
+          writeFileDurableSync(filePath, readFileSync3(tmp), { ...opts, flag: "w", encoding: void 0 });
+          try {
+            unlinkSync3(tmp);
+          } catch {
+          }
+        } else {
+          throw err;
+        }
+      }
     }
-  };
-  if (opts.lock === true) {
-    return withFileLockSync(`${filePath}.lock`, run, opts);
+    if (opts.fsyncDir === true) fsyncPathSync(dir, DIR_FSYNC_TOLERATED);
+    return true;
+  } catch (err) {
+    try {
+      if (existsSync4(tmp)) unlinkSync3(tmp);
+    } catch {
+    }
+    throw err;
   }
-  return run();
 }
 function writeJsonAtomicSync(filePath, value, opts = {}) {
   return writeFileAtomicSync(filePath, `${JSON.stringify(value, null, opts.compact ? 0 : 2)}
-`, opts);
+`, jsonBackupOpts(opts));
+}
+function parseJsonText(text) {
+  return JSON.parse(text.charCodeAt(0) === 65279 ? text.slice(1) : text);
+}
+function isJsonContent(content) {
+  try {
+    parseJsonText(String(content));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readContentOrNullSync(filePath) {
+  try {
+    return readFileSync3(filePath);
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function reportDamaged(filePath, error, outcome) {
+  const reason = String(error?.message || error).replace(/[\0-\x1f]/g, (c) => `\\x${c.charCodeAt(0).toString(16)}`);
+  process.stderr.write(`[state] ${filePath} is damaged (${reason}); ${outcome}
+`);
+}
+function recoverDamagedSync(filePath, parse, opts) {
+  const current = parse(readContentOrNullSync(filePath));
+  if (current.state !== "damaged") return current;
+  const backup = opts.restoreBackup === false ? NO_BACKUP : parse(readContentOrNullSync(`${filePath}.bak`));
+  if (backup.state !== "ok" && opts.keepWithoutBackup) {
+    reportDamaged(filePath, current.error, KEPT_IN_PLACE);
+    return { state: "absent" };
+  }
+  const aside = quarantinePath(filePath);
+  renameWithRetrySync(filePath, aside, opts);
+  if (backup.state === "ok") publishFileSync(filePath, backup.content, restoreOpts(opts));
+  reportDamaged(filePath, current.error, recoveredOutcome(aside, backup));
+  return backup.state === "ok" ? backup : { state: "absent" };
+}
+function readJsonStateSync(filePath, { validate: validate2, decode, fallback = null, ...opts } = {}) {
+  const parse = stateParser(validate2, decode);
+  const first = parse(readContentOrNullSync(filePath));
+  if (first.state === "ok") return first.value;
+  if (first.state !== "damaged") return fallback;
+  let recovered;
+  try {
+    recovered = withFileLockSync(`${filePath}.lock`, () => recoverDamagedSync(filePath, parse, opts), opts);
+  } catch (err) {
+    if (!LOCK_BUSY_CODES.has(err?.code)) throw err;
+    reportDamaged(filePath, first.error, "left in place while another writer holds its lock");
+    return fallback;
+  }
+  return recovered.state === "ok" ? recovered.value : fallback;
 }
 async function writeFileAtomicAsync(filePath, data, opts = {}) {
   assertTestSecretWriteSafe(filePath, opts);
-  const run = async () => {
-    const dir = dirname5(filePath);
-    await mkdirAsync2(dir, { recursive: true });
-    const tmp = join5(dir, `.${basename3(filePath)}.${randomBytes3(12).toString("hex")}.tmp`);
-    try {
-      const writeOpts = {
-        encoding: opts.encoding || "utf8",
-        flag: "wx",
-        mode: opts.mode !== void 0 ? opts.mode : 384
-      };
-      await writeFileAsync2(tmp, data, writeOpts);
-      if (opts.secret === true) await enforceOwnerOnlyAclWin32Async(tmp, { fresh: true });
-      if (opts.fsync !== false) await fsyncPathAsync(tmp, FILE_FSYNC_TOLERATED);
-      if (opts.createOnly === true) {
-        try {
-          await linkAsync2(tmp, filePath);
-        } catch (err) {
-          try {
-            await unlinkAsync2(tmp);
-          } catch {
-          }
-          if (err?.code === "EEXIST") return false;
-          throw err;
-        }
-        try {
-          await unlinkAsync2(tmp);
-        } catch {
-        }
-      } else {
-        await renameWithRetry(tmp, filePath, opts);
-      }
-      if (opts.fsyncDir === true) await fsyncPathAsync(dir, DIR_FSYNC_TOLERATED);
-      return true;
-    } catch (err) {
-      try {
-        await unlinkAsync2(tmp);
-      } catch {
-      }
-      throw err;
-    }
-  };
+  const run = () => publishFileAsync(filePath, data, opts);
   if (opts.lock !== true) return _runAdaptiveFileIo(run);
   const lockPath = `${filePath}.lock`;
   return withFileLock(
@@ -24189,11 +24269,47 @@ async function writeFileAtomicAsync(filePath, data, opts = {}) {
     opts
   );
 }
+async function publishFileAsync(filePath, data, opts) {
+  const dir = dirname3(filePath);
+  await mkdirAsync2(dir, { recursive: true });
+  const tmp = publishTempPath(filePath);
+  try {
+    await writeFileDurableAsync(tmp, data, { ...opts, flag: "wx" });
+    if (opts.secret === true) await enforceOwnerOnlyAclWin32Async(tmp, { fresh: true });
+    if (opts.backup === true && opts.createOnly !== true) await keepBackupAsync(filePath, opts);
+    if (opts.createOnly === true) {
+      try {
+        await linkAsync2(tmp, filePath);
+      } catch (err) {
+        try {
+          await unlinkAsync2(tmp);
+        } catch {
+        }
+        if (err?.code === "EEXIST") return false;
+        throw err;
+      }
+      try {
+        await unlinkAsync2(tmp);
+      } catch {
+      }
+    } else {
+      await renameWithRetry(tmp, filePath, opts);
+    }
+    if (opts.fsyncDir === true) await fsyncPathAsync(dir, DIR_FSYNC_TOLERATED);
+    return true;
+  } catch (err) {
+    try {
+      await unlinkAsync2(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
 function writeJsonAtomicAsync(filePath, value, opts = {}) {
   return writeFileAtomicAsync(filePath, `${JSON.stringify(value, null, opts.compact ? 0 : 2)}
-`, opts);
+`, jsonBackupOpts(opts));
 }
-var _ioCeiling, _ioLimit, _ioActive, _ioFastStreak, _ioQueue, RETRY_CODES, FILE_FSYNC_TOLERATED, DIR_FSYNC_TOLERATED;
+var _ioCeiling, _ioLimit, _ioActive, _ioFastStreak, _ioQueue, RETRY_CODES, FILE_FSYNC_TOLERATED, DIR_FSYNC_TOLERATED, keepsAsBackup, backupWriteOpts, jsonBackupOpts, quarantinePath, LOCK_BUSY_CODES, STATE_UNSUPPORTED, acceptAny, utf8Text, stateParser, restoreOpts, KEPT_IN_PLACE, NO_BACKUP, recoveredOutcome, parseAnyJson;
 var init_atomic_file = __esm({
   "src/runtime/shared/atomic-file.mjs"() {
     init_file_lock();
@@ -24207,16 +24323,68 @@ var init_atomic_file = __esm({
     RETRY_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "EEXIST"]);
     FILE_FSYNC_TOLERATED = ["EPERM", "ENOTSUP", "EINVAL"];
     DIR_FSYNC_TOLERATED = ["EPERM", "ENOTSUP", "EINVAL", "EACCES"];
+    keepsAsBackup = (opts, content) => opts.backupAccepts ? opts.backupAccepts(content) : !holdsNoData(content);
+    backupWriteOpts = (opts) => ({ mode: opts.mode, secret: opts.secret, fsync: opts.fsync });
+    jsonBackupOpts = (opts) => opts.backup === true && !opts.backupAccepts ? { ...opts, backupAccepts: isJsonContent } : opts;
+    quarantinePath = (filePath) => {
+      let stamp = Date.now();
+      while (existsSync4(`${filePath}.corrupt-${stamp}`)) stamp += 1;
+      return `${filePath}.corrupt-${stamp}`;
+    };
+    LOCK_BUSY_CODES = /* @__PURE__ */ new Set(["ELOCKCONTENDED", "ELOCKTIMEOUT"]);
+    STATE_UNSUPPORTED = "ESTATEUNSUPPORTED";
+    acceptAny = (value) => value;
+    utf8Text = (content) => content.toString("utf8");
+    stateParser = (validate2 = acceptAny, decode = utf8Text) => (content) => {
+      if (content === null) return { state: "absent" };
+      try {
+        return { state: "ok", value: validate2(parseJsonText(decode(content))), content };
+      } catch (error) {
+        return { state: error?.code === STATE_UNSUPPORTED ? "unsupported" : "damaged", error };
+      }
+    };
+    restoreOpts = (opts) => ({ mode: opts.mode, secret: opts.secret });
+    KEPT_IN_PLACE = "left in place: no good copy to restore";
+    NO_BACKUP = { state: "absent" };
+    recoveredOutcome = (aside, backup) => `kept as ${aside}${backup.state === "ok" ? "; restored the last good copy" : "; starting empty"}`;
+    parseAnyJson = stateParser();
   }
 });
 
 // src/runtime/shared/json-file.mjs
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 var init_json_file = __esm({
   "src/runtime/shared/json-file.mjs"() {
   }
 });
 
+// src/runtime/shared/file-has-data.mjs
+import { closeSync as closeSync2, openSync as openSync2, readSync } from "node:fs";
+function fileHasData(path2) {
+  let fd;
+  try {
+    fd = openSync2(path2, "r");
+    const head = Buffer.alloc(PROBE_BYTES);
+    return !holdsNoData(head.subarray(0, readSync(fd, head, 0, PROBE_BYTES, 0)));
+  } catch (err) {
+    return err?.code !== "ENOENT" && err?.code !== "ENOTDIR";
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+    }
+  }
+}
+var PROBE_BYTES;
+var init_file_has_data = __esm({
+  "src/runtime/shared/file-has-data.mjs"() {
+    init_atomic_file();
+    PROBE_BYTES = 4096;
+  }
+});
+
 // src/runtime/shared/bounded-download.mjs
 import { createWriteStream, rmSync as rmSync2 } from "node:fs";
 import { Transform as Transform2 } from "node:stream";
@@ -24241,7 +24409,7 @@ function responseByteLength(response, maximum, label) {
   }
   return advertised;
 }
-async function streamResponseToFile(response, destPath, { maxBytes, expectedBytes = 0, label = "download", onProgress = null } = {}) {
+async function streamResponseToFile(response, destPath, { maxBytes, expectedBytes = 0, label = "download", onProgress = null, signal = void 0 } = {}) {
   const { maximum, expected } = downloadBounds(maxBytes, expectedBytes, label);
   const advertised = responseByteLength(response, maximum, label);
   if (expected && advertised && advertised !== expected) {
@@ -24277,7 +24445,7 @@ async function streamResponseToFile(response, destPath, { maxBytes, expectedByte
     }
   });
   try {
-    await pipeline(response.body, guard, createWriteStream(destPath));
+    await pipeline(response.body, guard, createWriteStream(destPath, { flush: true }), { signal });
     return downloaded;
   } catch (error) {
     try {
@@ -24298,13 +24466,13 @@ var init_bounded_download = __esm({
 // src/runtime/shared/native-asset.mjs
 import { createHash as createHash5 } from "node:crypto";
 import {
-  chmodSync as chmodSync2,
+  chmodSync,
   createReadStream,
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync13,
-  readdirSync as readdirSync3,
-  renameSync as renameSync4,
+  readFileSync as readFileSync12,
+  readdirSync as readdirSync4,
+  renameSync as renameSync3,
   rmSync as rmSync3
 } from "node:fs";
 import { join as join13 } from "node:path";
@@ -24368,21 +24536,21 @@ __export(voice_runtime_fetcher_exports, {
 });
 import { createHash as createHash6 } from "node:crypto";
 import {
-  chmodSync as chmodSync3,
-  closeSync as closeSync2,
+  chmodSync as chmodSync2,
+  closeSync as closeSync3,
   createReadStream as createReadStream2,
   createWriteStream as createWriteStream2,
-  existsSync as existsSync13,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync7,
-  openSync as openSync2,
-  readFileSync as readFileSync14,
-  readdirSync as readdirSync4,
+  openSync as openSync3,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync5,
   rmSync as rmSync4,
-  statSync as statSync5,
-  writeFileSync as writeFileSync5
+  statSync as statSync6,
+  writeFileSync as writeFileSync3
 } from "node:fs";
 import { setTimeout as sleep2 } from "node:timers/promises";
-import { join as join14, dirname as dirname11 } from "node:path";
+import { join as join14, dirname as dirname10 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { spawnSync } from "node:child_process";
@@ -24400,7 +24568,7 @@ function lockAgeMs(holderTs, waitSince) {
 }
 function _readInstallLockToken(lockPath) {
   try {
-    const raw = readFileSync14(lockPath, "utf8").trim();
+    const raw = readFileSync13(lockPath, "utf8").trim();
     if (!raw) return null;
     const [pidLine, tsLine = ""] = raw.split(/\r?\n/);
     const pid = Number(pidLine);
@@ -24418,7 +24586,7 @@ function _installLockTokenMatches(lockPath, expectedPid, expectedTs, expectedTok
 }
 function chmodExtractedBinariesPosix(rootDir, executable) {
   if (process.platform === "win32") return;
-  const execDir = join14(rootDir, dirname11(executable));
+  const execDir = join14(rootDir, dirname10(executable));
   const targets = /* @__PURE__ */ new Set([
     join14(rootDir, executable),
     join14(execDir, "whisper-cli"),
@@ -24426,9 +24594,9 @@ function chmodExtractedBinariesPosix(rootDir, executable) {
     join14(execDir, "ffmpeg")
   ]);
   for (const p of targets) {
-    if (existsSync13(p)) {
+    if (existsSync12(p)) {
       try {
-        chmodSync3(p, 493);
+        chmodSync2(p, 493);
       } catch {
       }
     }
@@ -24450,9 +24618,9 @@ async function _withInstallLock(rootDir, lockName, fn, { pollMs = 250 } = {}) {
   };
   while (true) {
     try {
-      fd = openSync2(lockPath, "wx");
+      fd = openSync3(lockPath, "wx");
       try {
-        writeFileSync5(lockPath, `${process.pid}
+        writeFileSync3(lockPath, `${process.pid}
 ${Date.now()}`);
       } catch {
       }
@@ -24505,7 +24673,7 @@ ${Date.now()}`);
     if (released) return;
     released = true;
     try {
-      if (fd != null) closeSync2(fd);
+      if (fd != null) closeSync3(fd);
     } catch {
     }
     try {
@@ -24522,21 +24690,21 @@ ${Date.now()}`);
   }
 }
 function readBundledManifest() {
-  return JSON.parse(readFileSync14(BUNDLED_MANIFEST_PATH, "utf8"));
+  return JSON.parse(readFileSync13(BUNDLED_MANIFEST_PATH, "utf8"));
 }
 function readActiveName(rootDir) {
   const activeFile = join14(rootDir, "active-version");
-  if (!existsSync13(activeFile)) return "";
-  return readFileSync14(activeFile, "utf8").trim();
+  if (!existsSync12(activeFile)) return "";
+  return readFileSync13(activeFile, "utf8").trim();
 }
 async function loadManifest(dataDir2) {
-  if (existsSync13(BUNDLED_MANIFEST_PATH)) {
+  if (existsSync12(BUNDLED_MANIFEST_PATH)) {
     return readBundledManifest();
   }
   const cachedPath = join14(dataDir2, "voice-runtime", "manifest.json");
-  if (existsSync13(cachedPath)) {
+  if (existsSync12(cachedPath)) {
     try {
-      return JSON.parse(readFileSync14(cachedPath, "utf8"));
+      return JSON.parse(readFileSync13(cachedPath, "utf8"));
     } catch {
     }
   }
@@ -24544,7 +24712,7 @@ async function loadManifest(dataDir2) {
   if (!res.ok) throw new Error(`[voice-runtime] manifest fetch failed: ${res.status} ${res.statusText}`);
   const manifest = await res.json();
   mkdirSync7(join14(dataDir2, "voice-runtime"), { recursive: true });
-  writeFileSync5(cachedPath, JSON.stringify(manifest, null, 2));
+  writeJsonAtomicSync(cachedPath, manifest);
   return manifest;
 }
 function verifySha256(filePath, expected) {
@@ -24560,18 +24728,18 @@ function detectCudaMajorsWin32() {
   }
   for (const root of windowsProgramRoots()) {
     const standardRoot = join14(root, "NVIDIA GPU Computing Toolkit", "CUDA");
-    if (!existsSync13(standardRoot)) continue;
+    if (!existsSync12(standardRoot)) continue;
     try {
-      for (const e of readdirSync4(standardRoot)) {
+      for (const e of readdirSync5(standardRoot)) {
         if (/^v\d+\.\d+/.test(e)) dirs.push(join14(standardRoot, e, "bin"));
       }
     } catch {
     }
   }
   for (const d of dirs) {
-    if (!existsSync13(d)) continue;
+    if (!existsSync12(d)) continue;
     try {
-      for (const f of readdirSync4(d)) {
+      for (const f of readdirSync5(d)) {
         const m = /^cublas64_(\d+)\.dll$/i.exec(f);
         if (m) found.add(Number(m[1]));
       }
@@ -24591,9 +24759,9 @@ function detectCudaMajorsLinux() {
   const cudaPath = process.env.CUDA_PATH;
   if (cudaPath) dirs.push(`${cudaPath}/lib64`);
   for (const d of dirs) {
-    if (!existsSync13(d)) continue;
+    if (!existsSync12(d)) continue;
     try {
-      for (const f of readdirSync4(d)) {
+      for (const f of readdirSync5(d)) {
         const m = /^libcublas\.so\.(\d+)$/.exec(f);
         if (m) found.add(Number(m[1]));
       }
@@ -24614,7 +24782,7 @@ function hasNvidiaDriver() {
   const sys = windowsSystemRoot();
   if (!sys) return false;
   for (const f of ["System32\\nvidia-smi.exe", "System32\\nvml.dll"]) {
-    if (existsSync13(join14(sys, f))) return true;
+    if (existsSync12(join14(sys, f))) return true;
   }
   return false;
 }
@@ -24652,10 +24820,10 @@ async function processExtras(extras, stagingDir, onProgress) {
     for (const f of extra.files) {
       const src = join14(extractDir, f.from);
       const dst = join14(stagingDir, f.to);
-      if (!existsSync13(src)) {
+      if (!existsSync12(src)) {
         throw new Error(`[voice-runtime] extra ${tag}: expected file ${f.from} not present after extract`);
       }
-      mkdirSync7(dirname11(dst), { recursive: true });
+      mkdirSync7(dirname10(dst), { recursive: true });
       renameWithRetrySync(src, dst);
     }
     try {
@@ -24669,8 +24837,8 @@ async function processExtras(extras, stagingDir, onProgress) {
   }
 }
 function gcStaleVersions(rootDir, activeName, prefix) {
-  if (!existsSync13(rootDir)) return;
-  for (const entry of readdirSync4(rootDir)) {
+  if (!existsSync12(rootDir)) return;
+  for (const entry of readdirSync5(rootDir)) {
     if (entry === activeName || entry === "active-version" || entry === "manifest.json") continue;
     if (!entry.startsWith(prefix) && !entry.startsWith("staging-")) continue;
     try {
@@ -24682,18 +24850,18 @@ function gcStaleVersions(rootDir, activeName, prefix) {
 function gcPublishedRuntimeSiblings(rootDir, prefix) {
   try {
     const activeName = readActiveName(rootDir);
-    if (!activeName.startsWith(prefix) || !existsSync13(join14(rootDir, activeName))) return;
+    if (!activeName.startsWith(prefix) || !existsSync12(join14(rootDir, activeName))) return;
     gcStaleVersions(rootDir, activeName, prefix);
   } catch {
   }
 }
 async function extractGz(gzPath, destPath) {
-  await pipeline2(createReadStream2(gzPath), createGunzip(), createWriteStream2(destPath));
+  await pipeline2(createReadStream2(gzPath), createGunzip(), createWriteStream2(destPath, { flush: true }));
 }
 function gcStagingPartials(dir) {
-  if (!existsSync13(dir)) return;
+  if (!existsSync12(dir)) return;
   try {
-    for (const entry of readdirSync4(dir)) {
+    for (const entry of readdirSync5(dir)) {
       if (!entry.startsWith(".staging-")) continue;
       try {
         rmSync4(join14(dir, entry), { force: true });
@@ -24771,12 +24939,12 @@ async function ensureWhisperRuntime(dataDir2, onProgress = null) {
   const activeName = `whisper-${ver}-${variant.id}`;
   const activeDir = join14(rootDir, activeName);
   const whisperCmd = join14(activeDir, variant.executable);
-  if (existsSync13(whisperCmd)) {
+  if (fileHasData(whisperCmd)) {
     gcStaleVersions(rootDir, activeName, "whisper-");
     return { whisperCmd, version: ver, variantId: variant.id };
   }
   return _withInstallLock(rootDir, "install", async () => {
-    if (existsSync13(whisperCmd)) {
+    if (fileHasData(whisperCmd)) {
       gcStaleVersions(rootDir, activeName, "whisper-");
       return { whisperCmd, version: ver, variantId: variant.id };
     }
@@ -24800,7 +24968,7 @@ async function ensureWhisperRuntime(dataDir2, onProgress = null) {
       rmSync4(archivePath, { force: true });
       chmodExtractedBinariesPosix(stagingDir, variant.executable);
       const stagedExec = join14(stagingDir, variant.executable);
-      if (!existsSync13(stagedExec)) {
+      if (!existsSync12(stagedExec)) {
         throw new Error(`[voice-runtime] expected executable ${variant.executable} not present after extract`);
       }
       await processExtras(variant.extras, stagingDir, onProgress);
@@ -24822,7 +24990,7 @@ async function ensureWhisperRuntime(dataDir2, onProgress = null) {
 function isManagedWhisperStale(dataDir2) {
   const activeName = readActiveName(join14(dataDir2, "voice-runtime"));
   if (!activeName) return false;
-  if (!existsSync13(BUNDLED_MANIFEST_PATH)) return false;
+  if (!existsSync12(BUNDLED_MANIFEST_PATH)) return false;
   try {
     const manifest = readBundledManifest();
     if (!manifest?.version) return false;
@@ -24835,7 +25003,7 @@ function resolveManagedWhisperCmd(dataDir2) {
   const activeName = readActiveName(join14(dataDir2, "voice-runtime"));
   if (!activeName) return null;
   const activeDir = join14(dataDir2, "voice-runtime", activeName);
-  if (existsSync13(BUNDLED_MANIFEST_PATH)) {
+  if (existsSync12(BUNDLED_MANIFEST_PATH)) {
     try {
       const manifest = readBundledManifest();
       const key = platformEntryKey(manifest.platforms);
@@ -24846,7 +25014,7 @@ function resolveManagedWhisperCmd(dataDir2) {
         const variant = variants.find((v) => v.id === variantId);
         if (variant?.executable) {
           const p = join14(activeDir, variant.executable);
-          if (existsSync13(p)) return p;
+          if (fileHasData(p)) return p;
         }
       }
     } catch {
@@ -24854,17 +25022,17 @@ function resolveManagedWhisperCmd(dataDir2) {
   }
   for (const c of ["Release/whisper-cli.exe", "Release/whisper-cli"]) {
     const p = join14(activeDir, c);
-    if (existsSync13(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
 function resolveManagedWhisperModelById(dataDir2, modelId = "standard") {
-  if (!existsSync13(BUNDLED_MANIFEST_PATH)) return null;
+  if (!existsSync12(BUNDLED_MANIFEST_PATH)) return null;
   const entry = manifestModelEntry(readBundledManifest(), modelId);
   if (!entry?.filename) return null;
   const modelDir = join14(dataDir2, "voice", "models");
   const p = join14(modelDir, entry.filename);
-  return existsSync13(p) ? p : null;
+  return fileHasData(p) ? p : null;
 }
 function gcUnknownModelFiles(manifest, modelDir) {
   const keep = /* @__PURE__ */ new Set();
@@ -24874,7 +25042,7 @@ function gcUnknownModelFiles(manifest, modelDir) {
   if (keep.size === 0) return;
   let names = [];
   try {
-    names = readdirSync4(modelDir);
+    names = readdirSync5(modelDir);
   } catch {
     return;
   }
@@ -24903,12 +25071,12 @@ async function ensureFfmpegRuntime(dataDir2, onProgress = null) {
   const activeName = `ffmpeg-${ver}`;
   const activeDir = join14(rootDir, activeName);
   const ffmpegPath = join14(activeDir, platformEntry.executable);
-  if (existsSync13(ffmpegPath)) {
+  if (fileHasData(ffmpegPath)) {
     gcStaleVersions(rootDir, activeName, "ffmpeg-");
     return { ffmpegPath, version: ver };
   }
   return _withInstallLock(rootDir, "install", async () => {
-    if (existsSync13(ffmpegPath)) {
+    if (fileHasData(ffmpegPath)) {
       gcStaleVersions(rootDir, activeName, "ffmpeg-");
       return { ffmpegPath, version: ver };
     }
@@ -24937,13 +25105,13 @@ async function ensureFfmpegRuntime(dataDir2, onProgress = null) {
         throw new Error(`[voice-runtime] ffmpeg manifest format must be "gz" or "zip", got "${platformEntry.format}"`);
       }
       rmSync4(archivePath, { force: true });
-      if (!existsSync13(stagedExec)) {
+      if (!existsSync12(stagedExec)) {
         throw new Error(
           `[voice-runtime] expected ffmpeg executable ${platformEntry.executable} not present after extract`
         );
       }
       if (process.platform !== "win32") {
-        chmodSync3(stagedExec, 493);
+        chmodSync2(stagedExec, 493);
       }
       renameWithRetrySync(stagingDir, activeDir);
       writeFileAtomicSync(join14(rootDir, "active-version"), activeName, { fsyncDir: true });
@@ -24964,21 +25132,21 @@ function resolveManagedFfmpegPath(dataDir2) {
   const activeName = readActiveName(join14(dataDir2, "ffmpeg-runtime"));
   if (!activeName) return null;
   const activeDir = join14(dataDir2, "ffmpeg-runtime", activeName);
-  if (existsSync13(BUNDLED_MANIFEST_PATH)) {
+  if (existsSync12(BUNDLED_MANIFEST_PATH)) {
     try {
       const manifest = readBundledManifest();
       const key = platformEntryKey(manifest.ffmpeg?.platforms);
       const platformEntry = manifest.ffmpeg?.platforms?.[key];
       if (platformEntry?.executable) {
         const p = join14(activeDir, platformEntry.executable);
-        if (existsSync13(p)) return p;
+        if (fileHasData(p)) return p;
       }
     } catch {
     }
   }
   for (const c of ["ffmpeg.exe", "ffmpeg"]) {
     const p = join14(activeDir, c);
-    if (existsSync13(p)) return p;
+    if (fileHasData(p)) return p;
   }
   return null;
 }
@@ -24993,7 +25161,7 @@ function voiceRuntimeInfo(runtime) {
   let modelBytes = model?.size || 0;
   if (runtime.modelPath) {
     try {
-      modelBytes = statSync5(runtime.modelPath).size;
+      modelBytes = statSync6(runtime.modelPath).size;
     } catch {
       modelBytes = 0;
     }
@@ -25016,8 +25184,8 @@ function resolveVoiceRuntime(dataDir2, { modelId = "standard", cleanup = true }
   const managedModelPath = resolveManagedWhisperModelById(dataDir2, modelId);
   const managedFfmpegPath = resolveManagedFfmpegPath(dataDir2);
   const ext = process.platform === "win32" ? ".exe" : "";
-  const managedServerCmd = managedWhisperCmd ? join14(dirname11(managedWhisperCmd), `whisper-server${ext}`) : null;
-  const serverCmd = managedServerCmd && existsSync13(managedServerCmd) ? managedServerCmd : null;
+  const managedServerCmd = managedWhisperCmd ? join14(dirname10(managedWhisperCmd), `whisper-server${ext}`) : null;
+  const serverCmd = managedServerCmd && fileHasData(managedServerCmd) ? managedServerCmd : null;
   return {
     kind: "managed-whisper.cpp",
     label: "whisper.cpp",
@@ -25044,7 +25212,7 @@ async function ensureWhisperModel(dataDir2, onProgress = null, modelId = "standa
   }
   const modelDir = join14(dataDir2, "voice", "models");
   const modelPath = join14(modelDir, model.filename);
-  if (existsSync13(modelPath)) {
+  if (existsSync12(modelPath)) {
     const actual = await sha256File(modelPath);
     if (actual === model.sha256) {
       return { modelPath, modelId: model.id, size: model.size };
@@ -25059,7 +25227,7 @@ async function ensureWhisperModel(dataDir2, onProgress = null, modelId = "standa
     }
   }
   return _withInstallLock(modelDir, "install", async () => {
-    if (existsSync13(modelPath)) {
+    if (existsSync12(modelPath)) {
       const actual = await sha256File(modelPath);
       if (actual === model.sha256) {
         gcUnknownModelFiles(manifest, modelDir);
@@ -25101,6 +25269,7 @@ var BUNDLED_MANIFEST_PATH, MANIFEST_URL, LOCK_WAIT_CODES2, LOCK_MAX_AGE_MS, Voic
 var init_voice_runtime_fetcher = __esm({
   "src/runtime/channels/lib/voice-runtime-fetcher.mjs"() {
     init_atomic_file();
+    init_file_has_data();
     init_bounded_download();
     init_native_asset();
     init_windows_roots();
@@ -35336,9 +35505,9 @@ import { useState as useState4, useEffect as useEffect5 } from "react";
 import { useState as useState5, useEffect as useEffect6, useCallback as useCallback4, useMemo as useMemo4 } from "react";
 
 // src/tui/index.jsx
-import { closeSync as closeSync3, constants as fsConstants, createWriteStream as createWriteStream3, mkdirSync as mkdirSync8, openSync as openSync3, readSync } from "node:fs";
+import { closeSync as closeSync4, constants as fsConstants, createWriteStream as createWriteStream3, mkdirSync as mkdirSync8, openSync as openSync4, readSync as readSync2 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname12, join as join17 } from "node:path";
+import { dirname as dirname11, join as join17 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { format } from "node:util";
 
@@ -35664,7 +35833,7 @@ var SLASH_COMMANDS = [
   {
     name: "autoclear",
     usage: "/autoclear",
-    params: "[on|off|duration]",
+    params: "[on|off|duration|unlimited]",
     description: "Reduce cache-miss cost after long idle gaps"
   },
   { name: "resume", usage: "/resume", params: "[id]", description: "Resume a saved chat" },
@@ -41995,7 +42164,8 @@ function pathOrId(path2, id, max) {
 }
 
 // src/tui/transcript-tool-failures.mjs
-var HOOK_DENIAL_RE = /^Error:\s*tool\s*"[^"]*"\s*denied by hook\b/im;
+var HOOK_DENIAL_RE = /^Error:\s*tool\s*"[^"]*"\s*(?:denied by hook|was not approved)\b/im;
+var NOT_APPROVED_INSTRUCTION_RE = /\s*Do not retry it or reach the same result another way; report it\.\s*$/;
 var APPROVAL_UNAVAILABLE_RE = /denied by hook:\s*approval required but no approval UI is available/i;
 function toolItemResultText(item) {
   if (!item) return "";
@@ -42019,7 +42189,7 @@ function isHookApprovalDenialToolItem(item) {
 function formatHookDenialDetail(text) {
   const raw = String(text ?? "").trim();
   if (!raw) return "";
-  const stripped = raw.replace(/^Error:\s*tool\s*"[^"]*"\s*/i, "").trim();
+  const stripped = raw.replace(/^Error:\s*tool\s*"[^"]*"\s*/i, "").replace(NOT_APPROVED_INSTRUCTION_RE, "").trim();
   return stripped || raw;
 }
 function isFullyFailedToolBatch(item) {
@@ -42759,6 +42929,7 @@ var DETERMINISTIC_KINDS = /* @__PURE__ */ new Set([
 // src/runtime/shared/error-presentation.mjs
 var DETAILS_LIMIT = 12e3;
 var SUMMARY_LIMIT = 180;
+var LATEST_TURN_RE = /The latest message cannot fit this model \(LATEST_TURN_EXCEEDS_CONTEXT\)(: it needs about [\d,]+ tokens, but the [^.]* window leaves [\d,]+ for it\.)([\s\S]*)$/;
 function safeErrorDetails(value) {
   let text = String(value ?? "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/\r\n?/g, "\n").replace(/\b((?:https?|ssh):\/\/)[^/\s@]+@/gi, "$1[redacted]@").replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1 [redacted]").replace(/([?&](?:token|access_token|refresh_token|api_key|key|code|signature|sig)=)[^&\s"'<>]+/gi, "$1[redacted]").replace(
     /(["']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|authorization|cookie|password|secret|client_secret)["']?\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;}]+)/gi,
@@ -42951,11 +43122,15 @@ function describeError(value) {
   let recoveryTemplate = "";
   let params = null;
   const transport = transportErrorText(value) || typed && transportErrorText({ code: code.toUpperCase(), status }) || (!typed || descriptor.kind === "transient" ? transportErrorText(raw) : null);
-  if (value?.reauthRequired === true || !typed && /invalid_grant|refresh token (?:expired|revoked|not available)|sign in again|sign-in expired|Reauth Required/i.test(raw)) {
+  if (value?.reauthRequired === true || !typed && /invalid_grant|refresh token (?:expired|revoked|not available)|sign in again|sign-in expired|Reauth Required/i.test(
+    raw
+  )) {
     kind = "reauth";
     summary = "Sign-in expired.";
     recovery = "Sign in again from Providers.";
-  } else if (descriptor.kind === "auth" || descriptor.kind === "unknown" && /\b(?:invalid|expired)\s+(?:api[ _-]?key|access token|credentials?)\b|Provider authentication failed/i.test(clean3)) {
+  } else if (descriptor.kind === "auth" || descriptor.kind === "unknown" && /\b(?:invalid|expired)\s+(?:api[ _-]?key|access token|credentials?)\b|Provider authentication failed/i.test(
+    clean3
+  )) {
     kind = "authentication";
     summary = "Provider authentication failed";
     recovery = "Check your sign-in or API key, then try again.";
@@ -42977,6 +43152,11 @@ function describeError(value) {
     kind = "not-found";
     summary = firstReadableLine(clean3) || NOT_FOUND_SUMMARY;
     recovery = MODEL_UNAVAILABLE_COPY[2];
+  } else if (LATEST_TURN_RE.test(clean3)) {
+    const [, headline, rest] = LATEST_TURN_RE.exec(clean3);
+    kind = "latest-turn-size";
+    summary = `The latest message cannot fit this model${headline}`;
+    recovery = rest.trim();
   } else if (descriptor.kind === "unknown" && /payload too large|request (?:body )?too large|The request exceeds the size limit/i.test(clean3)) {
     [kind, summary, recovery] = KIND_COPY.request_too_large;
   } else if (copy) {
@@ -43003,6 +43183,7 @@ function describeError(value) {
   }
   summary = summary.replace(/\s+/g, " ").trim() || "Something went wrong.";
   if (summary.length > SUMMARY_LIMIT) summary = `${summary.slice(0, SUMMARY_LIMIT - 1).trimEnd()}\u2026`;
+  const fingerprintStatus = kind === "reauth" ? "" : status || "";
   return {
     kind,
     summary,
@@ -43015,7 +43196,7 @@ function describeError(value) {
     details,
     // Known structured failures ignore volatile indexes; unknown failures
     // retain their diagnostic identity rather than merging unrelated work.
-    fingerprint: kind === "unknown" ? details : `${kind}:${kind === "reauth" ? "" : status || ""}`
+    fingerprint: kind === "unknown" ? details : `${kind}:${fingerprintStatus}`
   };
 }
 
@@ -43228,6 +43409,8 @@ function presentErrorText(error, options = {}) {
   if (code === "TOOL_SURFACE_EXCEEDS_CONTEXT" || /\(TOOL_SURFACE_EXCEEDS_CONTEXT\)/.test(text)) {
     return stripErrorPrefix(text);
   }
+  const latestTurn = /The latest message cannot fit this model \(LATEST_TURN_EXCEEDS_CONTEXT\)[\s\S]*$/.exec(text);
+  if (latestTurn) return latestTurn[0].replace(" (LATEST_TURN_EXCEEDS_CONTEXT)", "");
   const jsonError = extractJsonError(text);
   if (jsonError) text = jsonError;
   const embeddedError = extractEmbeddedError(text);
@@ -47944,15 +48127,16 @@ function projectNameFromPath(value) {
 }
 
 // src/tui/prompt-history-store.mjs
+init_atomic_file();
 import { createHash as createHash2 } from "node:crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
-import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import { mkdirSync as mkdirSync3 } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { dirname as dirname5, join as join5, resolve as resolve4 } from "node:path";
 
 // src/runtime/shared/plugin-paths.mjs
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname as dirname4, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var homeBase = null;
 var homePath = null;
 var dataBase = null;
@@ -47963,7 +48147,7 @@ function mixdogHome() {
   const home = homedir();
   if (home !== homeBase) {
     homeBase = home;
-    homePath = join(home, ".mixdog");
+    homePath = join4(home, ".mixdog");
   }
   return homePath;
 }
@@ -47973,7 +48157,7 @@ function resolvePluginData() {
   const home = mixdogHome();
   if (home !== dataBase) {
     dataBase = home;
-    dataPath = join(home, "data");
+    dataPath = join4(home, "data");
   }
   return dataPath;
 }
@@ -47985,10 +48169,16 @@ function promptHistoryKey(value) {
   return String(value || "").trim().replace(/\s+/g, " ");
 }
 function readEntries(filePath) {
-  if (!filePath || !existsSync3(filePath)) return [];
+  if (!filePath) return [];
   try {
-    const parsed = JSON.parse(readFileSync2(filePath, "utf8"));
-    const entries = Array.isArray(parsed?.entries) ? parsed.entries : [];
+    const parsed = readJsonStateSync(filePath, {
+      mode: 384,
+      validate: (value) => {
+        if (!Array.isArray(value?.entries)) throw new TypeError("prompt history has no entries");
+        return value;
+      }
+    });
+    const entries = parsed ? parsed.entries : [];
     return entries.map((entry) => String(entry || "").trim()).filter((entry) => promptHistoryKey(entry));
   } catch {
     return [];
@@ -48001,14 +48191,8 @@ function buildPayload(entries) {
 function writeEntriesSync(filePath, entries) {
   if (!filePath) return false;
   try {
-    mkdirSync(dirname2(filePath), { recursive: true, mode: 448 });
-    const tmp = `${filePath}.${process.pid}.tmp`;
-    writeFileSync(tmp, buildPayload(entries), { encoding: "utf8", mode: 384 });
-    renameSync(tmp, filePath);
-    try {
-      chmodSync(filePath, 384);
-    } catch {
-    }
+    mkdirSync3(dirname5(filePath), { recursive: true, mode: 448 });
+    writeFileAtomicSync(filePath, buildPayload(entries), { mode: 384 });
     return true;
   } catch {
     return false;
@@ -48402,8 +48586,11 @@ function compactElapsed(value) {
   if (!Number.isFinite(n) || n <= 0) return "";
   return `${Math.max(1, Math.ceil(n / 1e3))}s`;
 }
+function compactionRunning(compaction) {
+  return compaction.inProgress === true || compaction.lastStage === "compacting";
+}
 function compactionState(compaction) {
-  const compactRunning = compaction.inProgress === true || compaction.lastStage === "compacting";
+  const compactRunning = compactionRunning(compaction);
   const autoClearFailed = compaction.lastStage === "auto_clear_failed" || !!compaction.lastClearCompactError;
   const autoClearStage = compaction.lastStage === "auto_clear" || compaction.lastClearAt;
   const compactInterrupted = compaction.lastStage === "interrupted";
@@ -48452,7 +48639,7 @@ function contextMetrics({ toolsStatus, mcpStatus, skillsStatus, pluginsStatus, c
   );
   const cacheDenom = Number(usage.lastContextTokens || 0) || cachedRead + freshInput + cacheWrite;
   const compactState = compactionState(compaction);
-  const compactDuration = compactElapsed(compaction.lastDurationMs);
+  const compactDuration = compactionRunning(compaction) ? "" : compactElapsed(compaction.lastDurationMs);
   return {
     tools,
     mcp,
@@ -50026,7 +50213,7 @@ function useGlobalKeyInput({
 // src/runtime/shared/update-checker.mjs
 init_atomic_file();
 init_json_file();
-import { existsSync as existsSync6, readFileSync as readFileSync6, realpathSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync } from "node:fs";
 import { basename as basename4, delimiter, dirname as dirname6, join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PACKAGE_NAME = "mixdog";
@@ -50039,7 +50226,7 @@ var _localVersionCache = null;
 function localPackageVersion() {
   if (_localVersionCache) return _localVersionCache;
   try {
-    const raw = JSON.parse(readFileSync6(_PACKAGE_JSON_PATH, "utf8"));
+    const raw = JSON.parse(readFileSync5(_PACKAGE_JSON_PATH, "utf8"));
     _localVersionCache = String(raw?.version || "0.0.0");
   } catch {
     _localVersionCache = "0.0.0";
@@ -50786,13 +50973,13 @@ import { homedir as homedir2 } from "node:os";
 import { join as join10 } from "node:path";
 
 // src/runtime/shared/llm/model-catalog.mjs
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { join as join8 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 init_atomic_file();
 
 // src/runtime/shared/llm/provider-catalog-cache.mjs
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 
 // src/runtime/shared/llm/provider-model-identities.mjs
@@ -51187,8 +51374,8 @@ var PRICING_CATALOG_REFRESH_MS = 6 * 60 * 60 * 1e3;
 var PRICING_CATALOG_RETRY_MS = 6e4;
 function readDiskCatalog(filePath) {
   try {
-    if (!existsSync8(filePath)) return null;
-    const raw = JSON.parse(readFileSync8(filePath, "utf-8"));
+    if (!existsSync7(filePath)) return null;
+    const raw = JSON.parse(readFileSync7(filePath, "utf-8"));
     return raw?.data ? raw : null;
   } catch {
     return null;
@@ -51268,7 +51455,7 @@ function createCatalogSource({ url, cacheFile, project, label = "" }) {
     warmFromDiskSync() {
       if (cache3) return;
       try {
-        const raw = JSON.parse(readFileSync8(cachePath(), "utf-8"));
+        const raw = JSON.parse(readFileSync7(cachePath(), "utf-8"));
         if (raw?.data) {
           cache3 = project(raw.data);
           cacheAt = raw.fetchedAt || Date.now();
@@ -51392,11 +51579,11 @@ function isPidAlive(value) {
 }
 
 // src/runtime/shared/worktrees/git-head.mjs
-import { readFileSync as readFileSync9, statSync as statSync2, watch } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync3, watch } from "node:fs";
 import { dirname as dirname8, resolve as resolve6 } from "node:path";
 
 // src/runtime/shared/worktrees/paths.mjs
-import { existsSync as existsSync9, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync8, realpathSync as realpathSync2 } from "node:fs";
 import { dirname as dirname7, isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve5, sep } from "node:path";
 
 // src/runtime/shared/statusline/statusline-segments.mjs
@@ -51485,8 +51672,7 @@ async function refreshShellJobsStatus(ownerPid) {
         continue;
       }
       const unconfirmed = detail?.terminationUnconfirmed === true;
-      if (unconfirmed ? !isHeldShellJobAlive(detail, ownerByJob.get(id)) : !await isShellJobAlive(detail, p, dir, id))
-        continue;
+      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !await isShellJobAlive(detail, p, dir, id)) continue;
       if (detail?.foreground === true && !unconfirmed) continue;
       const ownedByThisHost = ownerByJob.get(id) === ownerPid;
       if (ownedByThisHost) count++;
@@ -51575,12 +51761,6 @@ function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
   }
   return { count, elapsedLabel, jobs, sessions };
 }
-function isHeldShellJobAlive(detail, ownerPid) {
-  if (!isPidAlive(ownerPid || 0)) return false;
-  if (detail?.ownerSessionClosed !== true) return true;
-  const survivors = Array.isArray(detail?.survivorPids) ? detail.survivorPids : [];
-  return [detail?.pid, ...survivors].some((pid) => isPidAlive(positiveInt(pid)));
-}
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;
@@ -58611,7 +58791,9 @@ function createExtensionPickers({
 
 // src/tui/app/maintenance-pickers/auto-clear-picker.mjs
 var HOUR_MS = 60 * 60 * 1e3;
-var formatDurationInput = (ms) => {
+var UNLIMITED_INPUT = "unlimited";
+var formatDurationInput = (ms, unlimited = false) => {
+  if (unlimited) return UNLIMITED_INPUT;
   const value = Math.max(0, Math.round(Number(ms) || 0));
   if (value > 0 && value % HOUR_MS === 0) return `${value / HOUR_MS}h`;
   if (value > 0 && value % 6e4 === 0) return `${value / 6e4}m`;
@@ -58642,7 +58824,7 @@ function createAutoClearPicker({
       label: entry.provider,
       marker: entry.provider === provider ? "\u2713" : "",
       markerColor: theme2.success,
-      meta: `${formatDuration2(entry.idleMs)}${entry.custom ? " custom" : ""}`,
+      meta: `${entry.unlimited ? "Unlimited" : formatDuration2(entry.idleMs)}${entry.custom ? " custom" : ""}`,
       description: `Default idle window for ${entry.provider}. Enter to edit as text.`,
       _action: "provider-default",
       _entry: entry
@@ -58661,10 +58843,10 @@ function createAutoClearPicker({
           store.pushNotice("autoclear unavailable", "warn");
           return;
         }
-        store.pushNotice(
-          next.enabled ? `autoclear on \xB7 idle ${formatDuration2(next.idleMs)}` : "autoclear off",
-          "info"
-        );
+        let notice = "autoclear off";
+        if (next.enabled)
+          notice = next.unlimited ? "autoclear on \xB7 unlimited" : `autoclear on \xB7 idle ${formatDuration2(next.idleMs)}`;
+        store.pushNotice(notice, "info");
       }).catch((e) => store.pushNotice(`autoclear failed: ${e?.message || e}`, "error")).finally(settled);
     };
     const openProviderDurationEditor = (entry) => {
@@ -58673,8 +58855,8 @@ function createAutoClearPicker({
       setSettingsPrompt({
         kind: "autoclear-provider",
         label: `Auto-clear \xB7 ${entry.provider}`,
-        hint: `Type a duration like 10m, 1h, or 24h. Empty resets to built-in ${formatDurationInput(entry.builtInMs)}.`,
-        initialValue: formatDurationInput(entry.idleMs),
+        hint: `Type a duration like 10m, 1h, or 24h, or ${UNLIMITED_INPUT} to never auto-clear. Empty resets to built-in ${formatDurationInput(entry.builtInMs, entry.builtInUnlimited)}.`,
+        initialValue: formatDurationInput(entry.idleMs, entry.unlimited),
         provider: entry.provider,
         builtInMs: entry.builtInMs,
         returnTo
@@ -58702,16 +58884,18 @@ function createAutoClearPicker({
       const current = await readCurrent();
       const enabled = current?.enabled !== false;
       const idleMs = Number(current?.idleMs || HOUR_MS);
+      const unlimited = current?.unlimited === true;
       const cacheTtlLabel = !enabled || idleMs >= HOUR_MS ? "1h" : "5m";
       let sourceLabel = `${current?.provider || "default"} default`;
       if (current?.providerCustom) sourceLabel = `${current.provider} override`;
       else if (current?.custom) sourceLabel = "global";
+      const clearText = unlimited ? `Never clear idle sessions (${sourceLabel})` : `Clear idle sessions after ${formatDuration2(idleMs)} (${sourceLabel})`;
       const items = [
         {
           value: "toggle",
           label: "Auto-clear",
           meta: enabled ? "On" : "Off",
-          description: enabled ? `Clear idle sessions after ${formatDuration2(idleMs)} (${sourceLabel}) \xB7 lead cache TTL ${cacheTtlLabel}.` : "Idle auto-clear disabled.",
+          description: enabled ? `${clearText} \xB7 lead cache TTL ${cacheTtlLabel}.` : "Idle auto-clear disabled.",
           _action: "toggle"
         },
         {
@@ -58723,7 +58907,7 @@ function createAutoClearPicker({
       ];
       own.paint({
         title: "Auto-clear",
-        description: `Clear idle context after ${enabled ? `${formatDuration2(idleMs)} (${sourceLabel})` : "never"} \xB7 lead cache TTL ${cacheTtlLabel}.`,
+        description: `Clear idle context after ${enabled && !unlimited ? `${formatDuration2(idleMs)} (${sourceLabel})` : "never"} \xB7 lead cache TTL ${cacheTtlLabel}.`,
         help: "\u2191/\u2193 Select \xB7 \u2190/\u2192 Toggle On/Off \xB7 Enter Open/Toggle \xB7 Esc Close",
         indexMode: "always",
         labelWidth: 10,
@@ -59891,7 +60075,7 @@ function createOnboardingSteps({
 import { spawn as spawn4 } from "node:child_process";
 
 // src/runtime/shared/wsl.mjs
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 var _isWSL;
 function isWSL() {
   if (_isWSL !== void 0) return _isWSL;
@@ -59904,7 +60088,7 @@ function isWSL() {
     return _isWSL;
   }
   try {
-    const v = readFileSync10("/proc/version", "utf8").toLowerCase();
+    const v = readFileSync9("/proc/version", "utf8").toLowerCase();
     _isWSL = v.includes("microsoft") || v.includes("wsl");
   } catch {
     _isWSL = false;
@@ -61481,8 +61665,8 @@ function createSettingsNavigation({ openers, openSettingsPicker, setSettingsProm
 }
 
 // src/runtime/shared/config.mjs
-import { readFileSync as readFileSync12, statSync as statSync4, mkdirSync as mkdirSync5, existsSync as existsSync11, watch as fsWatch } from "node:fs";
-import { join as join12, dirname as dirname10 } from "node:path";
+import { readFileSync as readFileSync11, readdirSync as readdirSync3, statSync as statSync5, mkdirSync as mkdirSync5, existsSync as existsSync10, watch as fsWatch } from "node:fs";
+import { basename as basename6, join as join12, dirname as dirname9 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 
 // src/runtime/shared/object.mjs
@@ -61497,24 +61681,16 @@ function isPlainObject(value) {
 init_atomic_file();
 
 // src/runtime/shared/user-data-guard.mjs
+init_atomic_file();
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync10, rmSync, statSync as statSync4 } from "node:fs";
 import {
-  copyFileSync,
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync11,
-  rmSync,
-  statSync as statSync3,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import {
-  copyFile as copyFileP,
   mkdir as mkdirP,
+  readFile as readFileP,
   readdir as readdirP,
   rm as rmP,
   stat as statP
 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname9, join as join11, resolve as resolve7 } from "node:path";
+import { basename as basename5, join as join11, resolve as resolve7 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { createHash as createHash4, randomUUID } from "node:crypto";
 function getBackupRoot() {
@@ -61601,12 +61777,24 @@ function safeReason(reason) {
 }
 function readInitInstanceId(dataDir2) {
   if (!dataDir2) return null;
+  const path2 = join11(dataDir2, INIT_MARKER);
+  let raw;
   try {
-    const marker = JSON.parse(readFileSync11(join11(dataDir2, INIT_MARKER), "utf8"));
-    return typeof marker?.instanceId === "string" && marker.instanceId ? marker.instanceId : null;
-  } catch {
-    return null;
+    raw = readFileSync10(path2, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+  let marker;
+  try {
+    marker = JSON.parse(raw);
+  } catch (error) {
+    throw new SyntaxError(`[user-data] invalid initialization marker at ${path2}`, { cause: error });
   }
+  if (typeof marker?.instanceId !== "string" || !marker.instanceId) {
+    throw new SyntaxError(`[user-data] initialization marker at ${path2} must have a non-empty instanceId`);
+  }
+  return marker.instanceId;
 }
 function hasUserDataInitMarker(dataDir2) {
   return readInitInstanceId(dataDir2) != null;
@@ -61618,7 +61806,7 @@ function legacyBackupRoots() {
 }
 function manifestDataDirMatches(backupDir, dataDirKey) {
   try {
-    const manifest = JSON.parse(readFileSync11(join11(backupDir, BACKUP_MANIFEST), "utf8"));
+    const manifest = JSON.parse(readFileSync10(join11(backupDir, BACKUP_MANIFEST), "utf8"));
     return typeof manifest?.dataDir === "string" && normalizeDataDir(manifest.dataDir) === dataDirKey;
   } catch {
     return false;
@@ -61639,7 +61827,7 @@ function legacyMarkersFor(root, dataDir2, dataDirKey) {
   return names.filter((name) => {
     if (hashed.has(name)) return true;
     try {
-      const marker = JSON.parse(readFileSync11(join11(root, name), "utf8"));
+      const marker = JSON.parse(readFileSync10(join11(root, name), "utf8"));
       return typeof marker?.dataDir === "string" && normalizeDataDir(marker.dataDir) === dataDirKey;
     } catch {
       return false;
@@ -61700,10 +61888,10 @@ function backupDirsNewestFirst(dir) {
 }
 function readRestorableConfig(backupDir, dataDirKey, instanceId) {
   try {
-    const manifest = JSON.parse(readFileSync11(join11(backupDir, BACKUP_MANIFEST), "utf8"));
+    const manifest = JSON.parse(readFileSync10(join11(backupDir, BACKUP_MANIFEST), "utf8"));
     if (typeof manifest?.dataDir !== "string" || normalizeDataDir(manifest.dataDir) !== dataDirKey) return null;
     if (manifest.instanceId !== instanceId) return null;
-    const parsed = JSON.parse(readFileSync11(join11(backupDir, "mixdog-config.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync10(join11(backupDir, "mixdog-config.json"), "utf8"));
     return isStructurallyCompleteMixdogConfigBackup(parsed) ? parsed : null;
   } catch (error) {
     if (isAbsentBackupError(error)) return null;
@@ -61743,7 +61931,7 @@ function loadLegacyMixdogConfigFromBackup(dataDir2, options) {
   const evidence = findLegacyUserDataEvidence(dataDir2, options);
   for (const backupDir of evidence?.backups || []) {
     try {
-      const parsed = JSON.parse(readFileSync11(join11(backupDir, "mixdog-config.json"), "utf8"));
+      const parsed = JSON.parse(readFileSync10(join11(backupDir, "mixdog-config.json"), "utf8"));
       if (isStructurallyCompleteMixdogConfigBackup(parsed)) return parsed;
     } catch {
     }
@@ -61751,7 +61939,7 @@ function loadLegacyMixdogConfigFromBackup(dataDir2, options) {
   return null;
 }
 function copyTree(src, dst, copied) {
-  const st = statSync3(src);
+  const st = statSync4(src);
   if (st.isDirectory()) {
     for (const name of readdirSync2(src)) {
       copyTree(join11(src, name), join11(dst, name), copied);
@@ -61759,8 +61947,7 @@ function copyTree(src, dst, copied) {
     return;
   }
   if (!st.isFile()) return;
-  mkdirSync4(dirname9(dst), { recursive: true });
-  copyFileSync(src, dst);
+  writeFileAtomicSync(dst, readFileSync10(src), { mode: st.mode & 511 });
   copied.push(dst);
 }
 function pruneBackups(scopeDir, names, own) {
@@ -61773,18 +61960,14 @@ function pruneBackups(scopeDir, names, own) {
 }
 function markUserDataInitialized(dataDir2) {
   const existing = readInitInstanceId(dataDir2);
-  if (existing || !dataDir2 || !existsSync10(dataDir2)) return existing;
+  if (existing || !dataDir2 || !existsSync9(dataDir2)) return existing;
   try {
-    writeFileSync4(
-      join11(dataDir2, INIT_MARKER),
-      `${JSON.stringify(
-        { instanceId: randomUUID(), dataDir: resolve7(dataDir2), createdAt: (/* @__PURE__ */ new Date()).toISOString() },
-        null,
-        2
-      )}
-`,
-      // An unreadable marker is replaced; a concurrent creator's valid one wins.
-      { encoding: "utf8", flag: existsSync10(join11(dataDir2, INIT_MARKER)) ? "w" : "wx" }
+    const marker = join11(dataDir2, INIT_MARKER);
+    writeJsonAtomicSync(
+      marker,
+      { instanceId: randomUUID(), dataDir: resolve7(dataDir2), createdAt: (/* @__PURE__ */ new Date()).toISOString() },
+      // Another creator may have published since the absent read; it wins.
+      { createOnly: true }
     );
   } catch {
   }
@@ -61795,40 +61978,36 @@ function ensureUserDataInitialized(dataDir2) {
   if (!dataDir2) return;
   const key = normalizeDataDir(dataDir2);
   if (ensuredDataDirs.has(key)) return;
-  ensuredDataDirs.add(key);
   if (!hasUserDataInitMarker(dataDir2)) backupUserData(dataDir2, "initial-snapshot");
+  ensuredDataDirs.add(key);
 }
 function skipBackups() {
   return process.env.MIXDOG_SKIP_USER_DATA_BACKUP === "1" || process.env.MIXDOG_SKIP_USER_DATA_BACKUP === "true";
 }
 function finishBackup(dataDir2, backupDir, reason) {
   const instanceId = markUserDataInitialized(dataDir2);
-  writeFileSync4(
-    join11(backupDir, BACKUP_MANIFEST),
-    `${JSON.stringify(
-      { dataDir: resolve7(dataDir2), instanceId, reason, createdAt: (/* @__PURE__ */ new Date()).toISOString() },
-      null,
-      2
-    )}
-`,
-    "utf8"
-  );
+  writeJsonAtomicSync(join11(backupDir, BACKUP_MANIFEST), {
+    dataDir: resolve7(dataDir2),
+    instanceId,
+    reason,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
   restoreLookupCache.delete(normalizeDataDir(dataDir2));
   legacyEvidenceCache.delete(normalizeDataDir(dataDir2));
 }
 function backupUserData(dataDir2, reason = "snapshot", { dirs = [] } = {}) {
   if (skipBackups()) return { dir: null, copied: [] };
-  if (!dataDir2 || !existsSync10(dataDir2)) return { dir: null, copied: [] };
+  if (!dataDir2 || !existsSync9(dataDir2)) return { dir: null, copied: [] };
   const scopeDir = scopeDirFor(dataDir2);
   const { backupDir, names } = reserveBackupDir(scopeDir, reason);
   const copied = [];
   for (const rel of USER_DATA_FILES) {
     const src = join11(dataDir2, rel);
-    if (existsSync10(src)) copyTree(src, join11(backupDir, rel), copied);
+    if (existsSync9(src)) copyTree(src, join11(backupDir, rel), copied);
   }
   for (const rel of [...USER_DATA_DIRS, ...dirs]) {
     const src = join11(dataDir2, rel);
-    if (existsSync10(src)) copyTree(src, join11(backupDir, rel), copied);
+    if (existsSync9(src)) copyTree(src, join11(backupDir, rel), copied);
   }
   if (copied.length > 0) {
     finishBackup(dataDir2, backupDir, reason);
@@ -61851,8 +62030,7 @@ async function copyTreeAsync(src, dst, copied) {
     return;
   }
   if (!st.isFile()) return;
-  await mkdirP(dirname9(dst), { recursive: true });
-  await copyFileP(src, dst);
+  await writeFileAtomicAsync(dst, await readFileP(src), { mode: st.mode & 511 });
   copied.push(dst);
 }
 async function pruneBackupsAsync(scopeDir, names, own) {
@@ -61865,17 +62043,17 @@ async function pruneBackupsAsync(scopeDir, names, own) {
 }
 async function backupUserDataAsync(dataDir2, reason = "snapshot") {
   if (skipBackups()) return { dir: null, copied: [] };
-  if (!dataDir2 || !existsSync10(dataDir2)) return { dir: null, copied: [] };
+  if (!dataDir2 || !existsSync9(dataDir2)) return { dir: null, copied: [] };
   const scopeDir = scopeDirFor(dataDir2);
   const { backupDir, names } = await reserveBackupDirAsync(scopeDir, reason);
   const copied = [];
   for (const rel of USER_DATA_FILES) {
     const src = join11(dataDir2, rel);
-    if (existsSync10(src)) await copyTreeAsync(src, join11(backupDir, rel), copied);
+    if (existsSync9(src)) await copyTreeAsync(src, join11(backupDir, rel), copied);
   }
   for (const rel of USER_DATA_DIRS) {
     const src = join11(dataDir2, rel);
-    if (existsSync10(src)) await copyTreeAsync(src, join11(backupDir, rel), copied);
+    if (existsSync9(src)) await copyTreeAsync(src, join11(backupDir, rel), copied);
   }
   if (copied.length > 0) {
     finishBackup(dataDir2, backupDir, reason);
@@ -61950,7 +62128,7 @@ function readConfigRawCached() {
       return _configReadCache.raw;
     }
     try {
-      const st2 = statSync4(configPath());
+      const st2 = statSync5(configPath());
       if (st2.mtimeMs === _configReadCache.mtimeMs && st2.size === _configReadCache.size) {
         _configReadCache.atMs = now;
         return _configReadCache.raw;
@@ -61960,7 +62138,7 @@ function readConfigRawCached() {
   }
   let st = null;
   try {
-    st = statSync4(configPath());
+    st = statSync5(configPath());
   } catch (err) {
     if (err.code === "ENOENT") {
       _configReadCache = null;
@@ -61972,7 +62150,7 @@ function readConfigRawCached() {
   }
   let raw;
   try {
-    raw = readFileSync12(configPath(), "utf8");
+    raw = readFileSync11(configPath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       _configReadCache = null;
@@ -62039,7 +62217,7 @@ function readConfigFile() {
   const raw = readConfigRawCached();
   if (raw == null) return null;
   try {
-    return JSON.parse(raw);
+    return parseJsonText(raw);
   } catch (err) {
     invalidateConfigReadCache();
     quarantineMalformedConfig(err);
@@ -62047,7 +62225,7 @@ function readConfigFile() {
   }
 }
 function writeConfigFile(data, postBackupReason = "post-config-write") {
-  mkdirSync5(dirname10(configPath()), { recursive: true, mode: 448 });
+  mkdirSync5(dirname9(configPath()), { recursive: true, mode: 448 });
   try {
     backupUserData(resolvePluginData(), "pre-config-write");
   } catch {
@@ -62071,7 +62249,7 @@ function persistRestoredConfig(restored) {
     const wrote = withFileLockSync(
       `${path2}.lock`,
       () => {
-        if (existsSync11(path2)) return false;
+        if (existsSync10(path2)) return false;
         writeAll(restored, "post-restore");
         return true;
       },
@@ -62117,23 +62295,42 @@ function readAll() {
   return {};
 }
 function quarantineMalformedConfig(parseErr) {
-  const corrupt = `${configPath()}.corrupt-${Date.now()}`;
+  const corrupt = quarantinePath(configPath());
+  let keptAside = false;
   try {
-    if (existsSync11(configPath())) renameWithRetrySync(configPath(), corrupt);
+    if (existsSync10(configPath())) renameWithRetrySync(configPath(), corrupt);
+    keptAside = existsSync10(corrupt);
   } catch {
   }
   process.stderr.write(
     `[config] mixdog-config.json is malformed (${parseErr.message}). Renamed to ${corrupt}. Restore it or delete to start fresh.
 `
   );
+  return keptAside;
+}
+function hasQuarantinedCopy() {
+  const dir = dirname9(configPath());
+  const prefix = `${basename6(configPath())}.corrupt-`;
+  try {
+    return readdirSync3(dir).some((name) => name.startsWith(prefix));
+  } catch {
+    return false;
+  }
 }
-function restoreAllForRmWOrThrow(reason) {
+function restoreAllForRmWOrThrow(reason, keptAside = false) {
   const restored = loadLatestMixdogConfigFromBackup(resolvePluginData(), { fresh: true });
   if (restored && isPlainObject(restored)) {
     process.stderr.write(`[config] RMW read: restored mixdog-config.json from latest user-data backup (${reason})
 `);
     return restored;
   }
+  if (keptAside) {
+    process.stderr.write(
+      `[config] RMW read: mixdog-config.json is unusable (${reason}); its bytes are kept aside and no backup exists; starting empty
+`
+    );
+    return {};
+  }
   const legacy = findLegacyUserDataEvidence(resolvePluginData(), { fresh: true });
   if (legacy) {
     const err = new Error(
@@ -62149,11 +62346,11 @@ function restoreAllForRmWOrThrow(reason) {
 function readAllForRmW() {
   let raw;
   try {
-    raw = readFileSync12(configPath(), "utf8");
+    raw = readFileSync11(configPath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       if (isUserDataRecoveryExpected(resolvePluginData(), { fresh: true })) {
-        return restoreAllForRmWOrThrow("config file missing after user-data was initialized");
+        return restoreAllForRmWOrThrow("config file missing after user-data was initialized", hasQuarantinedCopy());
       }
       return {};
     }
@@ -62162,12 +62359,11 @@ function readAllForRmW() {
     throw err;
   }
   try {
-    const parsed = JSON.parse(raw);
+    const parsed = parseJsonText(raw);
     if (!isPlainObject(parsed)) throw new SyntaxError("config root must be a JSON object");
     return parsed;
   } catch (parseErr) {
-    quarantineMalformedConfig(parseErr);
-    return restoreAllForRmWOrThrow(parseErr.message);
+    return restoreAllForRmWOrThrow(parseErr.message, quarantineMalformedConfig(parseErr));
   }
 }
 var CONFIG_CHANGE_DEBOUNCE_MS = 100;
@@ -62196,7 +62392,7 @@ function readSection(section) {
   return stripGeneratedMarker(readAll()[section] ?? null) ?? {};
 }
 async function writeConfigFileAsync(data) {
-  mkdirSync5(dirname10(configPath()), { recursive: true, mode: 448 });
+  mkdirSync5(dirname9(configPath()), { recursive: true, mode: 448 });
   try {
     await backupUserDataAsync(resolvePluginData(), "pre-config-write");
   } catch {
@@ -62517,8 +62713,8 @@ function buildSettingsItems({
     {
       value: "autoclear",
       label: "Auto-clear",
-      meta: autoClearEnabled ? `On (${formatDuration2(autoClear.idleMs)})` : "Off",
-      description: autoClearEnabled ? `Clear idle sessions after ${formatDuration2(autoClear.idleMs)}${autoClearSource}. Enter for options.` : "Idle auto-clear disabled. Enter for options.",
+      meta: autoClearEnabled ? `On (${autoClear.unlimited ? "Unlimited" : formatDuration2(autoClear.idleMs)})` : "Off",
+      description: autoClearEnabled ? `${autoClear.unlimited ? "Never clear idle sessions" : `Clear idle sessions after ${formatDuration2(autoClear.idleMs)}`}${autoClearSource}. Enter for options.` : "Idle auto-clear disabled. Enter for options.",
       _action: "autoclear"
     },
     {
@@ -63907,13 +64103,13 @@ import { useCallback as useCallback21, useEffect as useEffect27, useLayoutEffect
 
 // src/tui/session/transcript-spill.mjs
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { join as join16 } from "node:path";
 import { Worker as Worker2 } from "node:worker_threads";
 
 // src/tui/session/transcript-spill/spill-dir.mjs
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdtempSync, readdirSync as readdirSync5, readFileSync as readFileSync15, rmSync as rmSync5, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdtempSync, readdirSync as readdirSync6, readFileSync as readFileSync14, rmSync as rmSync5, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join15 } from "node:path";
 var STALE_MS = 24 * 60 * 60 * 1e3;
@@ -66364,16 +66560,16 @@ function drainStdin(stdin = process.stdin) {
   let fd = -1;
   try {
     if (!wasRaw) tty3.setRawMode?.(true);
-    fd = openSync3("/dev/tty", fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+    fd = openSync4("/dev/tty", fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
     const buf = Buffer.alloc(1024);
     for (let i = 0; i < 64; i++) {
-      if (readSync(fd, buf, 0, buf.length, null) <= 0) break;
+      if (readSync2(fd, buf, 0, buf.length, null) <= 0) break;
     }
   } catch {
   } finally {
     if (fd >= 0) {
       try {
-        closeSync3(fd);
+        closeSync4(fd);
       } catch {
       }
     }
@@ -66391,7 +66587,7 @@ function installTuiStderrGuard() {
   const originalWrite = process.stderr.write.bind(process.stderr);
   const logPath = resolveTuiStderrLogPath();
   try {
-    mkdirSync8(dirname12(logPath), { recursive: true });
+    mkdirSync8(dirname11(logPath), { recursive: true });
   } catch {
   }
   (0, import_mixdog_debug.rotateBoundedLog)(logPath, import_mixdog_debug.PLUGIN_LOG_MAX_BYTES, import_mixdog_debug.PLUGIN_LOG_KEEP_BYTES);