open-tag 0.0.3 → 0.0.5

package/dist/{program-CY6rrPEk.mjs → program-CpPCcBDJ.mjs}

@@ -5522,7 +5522,7 @@ function date(params) {
 	return /* @__PURE__ */ _coercedDate(ZodDate, params);
 }
 //#endregion
-//#region ../../packages/shared/dist/task-DaUY_qJd.mjs
+//#region ../../packages/shared/dist/task-AnMGJdep.mjs
 const RUNTIME_INSTRUCTIONS_MAX_BYTES = 24576;
 const RUNTIME_DEFAULT_MAX_DURATION_MS = 18e5;
 const RUNTIME_MAX_DURATION_MS = 864e5;
@@ -5901,7 +5901,35 @@ const PROVIDER_CLI_VALIDATION_RETRY_REASONS = [
 ];
 _enum(PROVIDER_CLI_VALIDATION_RETRY_REASONS);
 const ProviderCliValidationResultReasonSchema = _enum([...INTEGRATION_CREDENTIAL_EXECUTION_REASONS, ...PROVIDER_CLI_VALIDATION_RETRY_REASONS]);
+/** Allowlisted artifact failure reasons that may leave the machine. */
+const PROVIDER_CLI_ARTIFACT_PUBLIC_REASONS = [
+	"unsupported_platform",
+	"global_bin_unavailable",
+	"integrity_failed",
+	"version_incompatible"
+];
+const ProviderCliArtifactPublicReasonSchema = _enum(PROVIDER_CLI_ARTIFACT_PUBLIC_REASONS);
+const ProviderCliPublicFailureReasonSchema = _enum([...INTEGRATION_CREDENTIAL_EXECUTION_REASONS, ...PROVIDER_CLI_ARTIFACT_PUBLIC_REASONS]);
 const PROVIDER_READINESS_V1_HEADER = "x-opentag-provider-readiness";
+const PROVIDER_CLI_REASON_V2_HEADER = "x-opentag-provider-cli-reason";
+const PROVIDER_CLI_ALWAYS_MANUAL_ARTIFACT_REASONS = /* @__PURE__ */ new Set([
+	"unsupported_platform",
+	"global_bin_unavailable",
+	"integrity_failed"
+]);
+/** Map a local diagnostic code onto the public artifact allowlist. Unknown codes stay unpublished. */
+function publicProviderCliArtifactReason(code) {
+	if (code === "unsupported_platform" || code === "global_bin_unavailable" || code === "integrity_failed" || code === "version_incompatible") return code;
+}
+/**
+* Manual failures need a user or release change. `version_incompatible` is manual only after a
+* final ensure: an inspection may still be repaired by installing a supported managed artifact.
+*/
+function providerCliArtifactFailureIsManual(input) {
+	if (!input.reason) return false;
+	if (PROVIDER_CLI_ALWAYS_MANUAL_ARTIFACT_REASONS.has(input.reason)) return true;
+	return input.reason === "version_incompatible" && input.stage === "ensure";
+}
 const ComputerConnectCodeModeSchema = _enum(["create", "repair"]);
 /**
 * Exchange identifies the local installation, not an existing Computer. The Server decides create vs
@@ -6039,7 +6067,8 @@ const ComputerProviderReadinessCollectionSchema = array(object({
 const ComputerImCliReadinessCollectionSchema = array(object({
 	provider: ImCliProviderSchema,
 	status: ImCliReadinessStatusSchema,
-	observedAt: string().datetime().nullable()
+	observedAt: string().datetime().nullable(),
+	reason: ProviderCliArtifactPublicReasonSchema.optional()
 }).strict()).max(IM_CLI_PROVIDERS.length).superRefine((observations, context) => {
 	const seen = /* @__PURE__ */ new Set();
 	for (const [index, observation] of observations.entries()) {
@@ -6259,7 +6288,7 @@ const ProviderCliHandoffProgressSchema = object({
 		"checking_credentials",
 		"needs_attention"
 	]),
-	reason: IntegrationCredentialExecutionReasonSchema.optional()
+	reason: ProviderCliPublicFailureReasonSchema.optional()
 }).strict();
 /**
 * The machine-readable identity a cross-Provider messaging start fails with: unbind this exact current binding,
@@ -6406,6 +6435,7 @@ const ImBindingDiagnosticsSchema = object({
 		"ready",
 		"unavailable"
 	]),
+	providerCliReason: ProviderCliArtifactPublicReasonSchema.optional(),
 	credentialExecutionReadiness: IntegrationCredentialExecutionStatusSchema,
 	credentialExecutionReason: IntegrationCredentialExecutionReasonSchema.optional(),
 	credentialGeneration: number().int().min(0),
@@ -7003,6 +7033,7 @@ const MeResponseSchema = object({
 	user: UserProfileSchema,
 	setupCompletedAt: string().datetime().nullable()
 }).strict();
+object({ authenticated: boolean() }).strict();
 /** Not `.trim()`: leading and trailing spaces are part of a password, and silently removing them changes the secret. */
 const PasswordSchema = string().min(12).max(128);
 const EmailAddressSchema = string().trim().toLowerCase().email().max(320);
@@ -7094,6 +7125,7 @@ const ErrorCodeSchema = _enum([
 	"RUNTIME_REGISTER_TIMEOUT",
 	"SESSION_CURSOR_INVALID",
 	"SESSION_PROOF_INVALID",
+	"TASK_NOT_QUEUED",
 	"INTERNAL_ERROR",
 	"RATE_LIMITED",
 	"RESOURCE_NOT_FOUND",
@@ -7173,6 +7205,7 @@ const HTTP_PATHS = {
 	authConnectExchange: `${API_V1_PREFIX}/auth/connect/exchange`,
 	computerConnectExchange: `${API_V1_PREFIX}/computer/connect/exchange`,
 	authBrowserLogout: `${API_V1_PREFIX}/auth/browser/logout`,
+	authBrowserSessionStatus: `${API_V1_PREFIX}/auth/browser/session-status`,
 	authDevCallback: `${API_V1_PREFIX}/auth/dev/callback`,
 	authEmailSignIn: `${API_V1_PREFIX}/auth/email/sign-in`,
 	authEmailSignUp: `${API_V1_PREFIX}/auth/email/sign-up`,
@@ -7457,7 +7490,7 @@ const RUNTIME_CLIENT_CAPABILITY_OFFERS = {
 	},
 	[RUNTIME_CAPABILITY.providerCliReconcile]: {
 		min: 1,
-		max: 1
+		max: 2
 	},
 	[RUNTIME_CAPABILITY.sessionCollaboration]: {
 		min: 2,
@@ -8343,6 +8376,7 @@ const TaskStatusSchema = _enum([
 	"running",
 	"completed",
 	"failed",
+	"cancelled",
 	"expired",
 	"ended",
 	"idle"
@@ -8382,6 +8416,7 @@ object({
 	nextCursor: string().min(1).nullable()
 }).strict();
 object({ task: TaskSummarySchema }).strict();
+object({ task: TaskSummarySchema }).strict();
 const TaskTurnSchema = object({
 	deliveryId: string().uuid(),
 	attention: ImAttentionSchema,
@@ -9307,8 +9342,15 @@ const ProviderCliArtifactStatusFrameSchema = object({
 		"checking",
 		"ready",
 		"unavailable"
-	])
-}).strict();
+	]),
+	reason: ProviderCliArtifactPublicReasonSchema.optional()
+}).strict().superRefine((frame, context) => {
+	if (frame.status !== "unavailable" && frame.reason !== void 0) context.addIssue({
+		code: "custom",
+		path: ["reason"],
+		message: "An artifact reason is only valid on unavailable"
+	});
+});
 const IntegrationCliValidationGrantMaterialSchema = discriminatedUnion("provider", [object({
 	provider: literal("feishu"),
 	appId: runtimeByteString(512, "Feishu App ID exceeds the 512-byte limit", 1),
@@ -19611,7 +19653,8 @@ var OpenTagApi = class {
 	listAccountComputers(accessToken, options) {
 		return this.#request(HTTP_PATHS.accountComputers, ListAccountComputersResponseSchema, { headers: {
 			authorization: `Bearer ${accessToken}`,
-			[PROVIDER_READINESS_V1_HEADER]: "1"
+			[PROVIDER_READINESS_V1_HEADER]: "1",
+			[PROVIDER_CLI_REASON_V2_HEADER]: "2"
 		} }, options);
 	}
 	createAgent(accessToken, input, options) {
@@ -19720,7 +19763,10 @@ var OpenTagApi = class {
 		}, options);
 	}
 	getImBindingDiagnostics(accessToken, imBindingId, options) {
-		return this.#request(imBindingDiagnosticsPath(imBindingId), ImBindingDiagnosticsSchema, { headers: { authorization: `Bearer ${accessToken}` } }, options);
+		return this.#request(imBindingDiagnosticsPath(imBindingId), ImBindingDiagnosticsSchema, { headers: {
+			authorization: `Bearer ${accessToken}`,
+			[PROVIDER_CLI_REASON_V2_HEADER]: "2"
+		} }, options);
 	}
 	disableImBinding(accessToken, imBindingId, options) {
 		return this.#requestNoContent(imBindingDisablePath(imBindingId), {
@@ -19887,7 +19933,8 @@ function resolveOpenTagHomeLayout(home = resolveOpenTagHome()) {
 	return {
 		config,
 		contextTreeBin: join(resolvedHome, "context-tree", "bin"),
-		contextTreeConfigFile: join(config, "context-tree.json"),
+		contextTreeConfigDir: join(config, "context-tree"),
+		contextTreeConfigFile: join(config, "context-tree", "config.json"),
 		contextTreePreparationFile: join(state, "context-tree-preparation.json"),
 		daemonState: join(state, "daemon"),
 		data,
@@ -20336,6 +20383,16 @@ async function checkServerHealth(serverUrl, fetchImpl = fetch, timeoutMs = SERVE
 		clearTimeout(timeout);
 	}
 }
+/** Compose all environment layers before giving Session tools first place on PATH. */
+function composeRuntimeEnvironment(environment, workspaceEnvironment, pathPrepend) {
+	const composed = {
+		...environment,
+		...workspaceEnvironment
+	};
+	const current = composed.PATH;
+	if (pathPrepend && current !== pathPrepend && !current?.startsWith(`${pathPrepend}${delimiter}`)) composed.PATH = current ? `${pathPrepend}${delimiter}${current}` : pathPrepend;
+	return composed;
+}
 /**
 * Spawn errnos that mean "the machine could not run the check right now", not
 * "the binary is broken or absent". These map to `temporarily_unavailable` and
@@ -21431,14 +21488,11 @@ var ClaudeCodeAgentRuntimeFactory = class {
 		const environment = claudeCodeAgentRuntimeEnvironment(options.process?.env);
 		const command = options.process?.command ?? "claude";
 		const prefix = options.process?.args ?? [];
-		this.#createProcess = options.createProcess ?? ((cwd, args, workspaceEnvironment) => new ClaudeCodeProcess({
+		this.#createProcess = options.createProcess ?? ((cwd, args, workspaceEnvironment, pathPrepend) => new ClaudeCodeProcess({
 			command,
 			args: [...prefix, ...args],
 			cwd,
-			env: {
-				...environment,
-				...workspaceEnvironment
-			},
+			env: composeRuntimeEnvironment(environment, workspaceEnvironment, pathPrepend),
 			maxLineBytes: options.process?.maxLineBytes,
 			maxStderrBytes: options.process?.maxStderrBytes,
 			spawnProcess: options.process?.spawnProcess
@@ -21508,7 +21562,7 @@ var ClaudeCodeAgentRuntimeFactory = class {
 			return new ClaudeCodeAgentRuntime({
 				binding,
 				configuration: request.configuration,
-				createProcess: (args) => this.#createProcess(request.workspace.cwd, args, request.workspace.environment),
+				createProcess: (args) => this.#createProcess(request.workspace.cwd, args, request.workspace.environment, request.workspace.pathPrepend),
 				emptyNativeToolAllowList: isEmptyNativeToolAllowList(request.policy),
 				eventSink: request.eventSink,
 				hostedTools: request.hostedTools,
@@ -22935,21 +22989,18 @@ var CodexAgentRuntimeFactory = class {
 		this.#clientVersion = options.clientVersion;
 		const environment = options.process?.env ?? codexAgentRuntimeEnvironment();
 		const command = options.process?.command ?? "codex";
-		const createDefaultClient = (cwd, workspaceEnvironment, expectedCodexHome = options.process?.expectedCodexHome) => new CodexAppServerProcess({
+		const createDefaultClient = (cwd, workspaceEnvironment, pathPrepend, expectedCodexHome = options.process?.expectedCodexHome) => new CodexAppServerProcess({
 			command,
 			args: options.process?.args ?? [...CODEX_AGENT_RUNTIME_APP_SERVER_ARGS],
 			cwd,
-			env: {
-				...environment,
-				...workspaceEnvironment
-			},
+			env: composeRuntimeEnvironment(environment, workspaceEnvironment, pathPrepend),
 			expectedCodexHome,
 			maxLineBytes: options.process?.maxLineBytes,
 			requestTimeoutMs: options.process?.requestTimeoutMs,
 			spawnProcess: options.process?.spawnProcess
 		});
 		this.#createClient = options.createClient ?? createDefaultClient;
-		const createProbeClient = options.createClient ?? ((cwd, probeEnvironment) => createDefaultClient(cwd, probeEnvironment, probeEnvironment?.CODEX_HOME));
+		const createProbeClient = options.createClient ?? ((cwd, probeEnvironment) => createDefaultClient(cwd, probeEnvironment, void 0, probeEnvironment?.CODEX_HOME));
 		this.#probeRunner = options.probeRunner ?? (async (signal) => {
 			const local = await probeCodex(command, environment, signal);
 			if (!local.credential) return {
@@ -23103,7 +23154,7 @@ var CodexAgentRuntimeFactory = class {
 		const expectedThreadId = parsedBinding?.threadId;
 		const requestedHostedToolsHash = request.hostedTools ? hostedToolsHash(request.hostedTools.definitions) : void 0;
 		if (mode === "resume" && parsedBinding?.hostedToolsHash !== requestedHostedToolsHash) throw new AgentRuntimeError("binding_incompatible", "Codex binding hosted tools cannot change during exact resume");
-		const client = this.#createClient(request.workspace.cwd, request.workspace.environment);
+		const client = this.#createClient(request.workspace.cwd, request.workspace.environment, request.workspace.pathPrepend);
 		try {
 			if (request.hostedTools && typeof client.setDynamicToolHandler !== "function") throw new AgentRuntimeError("configuration_invalid", "Codex App Server transport does not support hosted dynamic tools");
 			await client.initialize(this.#clientVersion);
@@ -26555,6 +26606,7 @@ function renderAgentHome(agentHome) {
 		"- `worktrees/<unique-task-key>/` — agent-managed checkouts for source access and code work. Concurrent code tasks each use a distinct worktree (and a distinct branch when editing). Keep later operations for the same task in its own worktree. No two code tasks edit one checkout.",
 		"- `files/<unique-task-key>/` — non-repository task artifacts, created only when needed.",
 		"",
+		"OpenTag provides the bundled `context-tree` command. If it cannot run, report a runtime setup problem; do not install it globally.",
 		"Context Tree stays the separately configured shared tree managed by its matching CLI and skills. When running Context Tree project commands from a task subdirectory, pass `--project-path \"<Agent Home>\"` to use the connected Home; do not create or reconnect a tree just because the task cwd changed. Follow the matching skill write protocol. Do not invent an independent Git policy for Tree writes.",
 		""
 	];
@@ -26611,6 +26663,17 @@ var ClientRuntimeProviderStartError = class extends Error {
 		this.name = "ClientRuntimeProviderStartError";
 	}
 };
+/**
+* The manager has no prepared runtime entry for a Session. The fixed code identifies this
+* local readiness failure in logs without including paths, credentials, or cause content.
+*/
+var SessionRuntimeNotPreparedError = class extends Error {
+	code = "session_runtime_not_prepared";
+	constructor() {
+		super("The Session Agent Runtime has not been prepared");
+		this.name = "SessionRuntimeNotPreparedError";
+	}
+};
 var SessionRuntimeManager = class {
 	#bindingStore;
 	#cliCommand;
@@ -26623,7 +26686,6 @@ var SessionRuntimeManager = class {
 	#proofManager;
 	#slackConfigWritableRoot;
 	#providerCliLaunchPath;
-	#inheritedPath;
 	#workspace;
 	#sessions = /* @__PURE__ */ new Map();
 	#prepares = /* @__PURE__ */ new Set();
@@ -26638,11 +26700,10 @@ var SessionRuntimeManager = class {
 		if (options.contextTree) this.#contextTree = options.contextTree;
 		this.#ensureProviderReady = options.ensureProviderReady;
 		this.#providers = options.providers;
-		this.#home = options.home ?? "";
+		this.#home = options.home;
 		this.#providerEnvironmentPath = options.providerEnvironmentPath;
 		this.#slackConfigWritableRoot = options.slackConfigWritableRoot;
 		this.#providerCliLaunchPath = options.providerCliLaunchPath;
-		this.#inheritedPath = options.inheritedPath ?? process.env.PATH;
 		this.#proofManager = options.proofManager ?? {
 			cleanup: async () => void 0,
 			materialize: async () => {
@@ -26665,7 +26726,7 @@ var SessionRuntimeManager = class {
 	}
 	requiresSessionPreparation(request) {
 		const current = this.#sessions.get(request.sessionId);
-		if (!current) return false;
+		if (!current) return true;
 		return current.proofId !== request.sessionCliProof?.proofId;
 	}
 	prepareSession(request, hashes) {
@@ -26731,7 +26792,7 @@ var SessionRuntimeManager = class {
 	async ensureRuntime(sessionId, signal) {
 		this.#assertOpen();
 		const managed = this.#sessions.get(sessionId);
-		if (!managed) throw new Error("The Session Agent Runtime has not been prepared");
+		if (!managed) throw new SessionRuntimeNotPreparedError();
 		await this.#ensureProviderReady(managed.providerId, signal);
 		this.#assertOpen();
 		if (managed.runtime && managed.runtime.state.phase !== "closed") return managed.runtime;
@@ -26753,7 +26814,7 @@ var SessionRuntimeManager = class {
 	}
 	sessionKind(sessionId) {
 		const managed = this.#sessions.get(sessionId);
-		if (!managed) throw new Error("The Session Agent Runtime has not been prepared");
+		if (!managed) throw new SessionRuntimeNotPreparedError();
 		return managed.sessionKind;
 	}
 	async #startRuntime(managed) {
@@ -26773,6 +26834,7 @@ var SessionRuntimeManager = class {
 			await managed.eventSink?.(event);
 		};
 		const contextTree = await prepareContextTree(this.#contextTree, managed.cwd);
+		const configurationRoots = await prepareConfigurationRoots(resolveOpenTagHomeLayout(this.#home));
 		const common = {
 			eventSink,
 			systemPrompt: renderManagedSystemPrompt(managed.snapshot, {
@@ -26786,15 +26848,17 @@ var SessionRuntimeManager = class {
 			}),
 			workspace: {
 				cwd: managed.cwd,
+				...visibleProviderCliPath(managed, this.#providerCliLaunchPath),
 				environment: {
 					...this.#home ? { OPENTAG_HOME: this.#home } : {},
 					...managed.proofPath ? { OPENTAG_SESSION_PROOF_FILE: managed.proofPath } : {},
-					...managed.sessionKind === "visible" ? {
-						OPENTAG_PROVIDER_ENV_FILE: this.#providerEnvironmentPath(managed.binding.sessionId),
-						...visibleProviderCliPath(managed.binding.sessionId, this.#providerCliLaunchPath, this.#inheritedPath)
-					} : {}
+					...managed.sessionKind === "visible" ? { OPENTAG_PROVIDER_ENV_FILE: this.#providerEnvironmentPath(managed.binding.sessionId) } : {}
 				},
-				writableRoots: [...visibleSlackWritableRoots(managed.sessionKind, managed.cwd, managed.binding.sessionId, this.#slackConfigWritableRoot), ...contextTree.writableRoots]
+				writableRoots: [
+					...visibleSlackWritableRoots(managed.sessionKind, managed.cwd, managed.binding.sessionId, this.#slackConfigWritableRoot),
+					...configurationRoots,
+					...contextTree.writableRoots
+				]
 			},
 			policy: provider.policy(managed.snapshot),
 			configuration: {
@@ -26867,7 +26931,7 @@ var SessionRuntimeManager = class {
 	cwd(sessionId) {
 		this.#assertOpen();
 		const managed = this.#sessions.get(sessionId);
-		if (!managed) throw new Error("The Session Agent Runtime has not been prepared");
+		if (!managed) throw new SessionRuntimeNotPreparedError();
 		return managed.cwd;
 	}
 	observe(sessionId, sink) {
@@ -26915,13 +26979,6 @@ var SessionRuntimeManager = class {
 		if (this.#closing) throw new Error("The Session Runtime manager is closing");
 	}
 };
-function visibleProviderCliPath(sessionId, resolveLaunchPath, inheritedPath, pathDelimiter = delimiter) {
-	const launchPath = resolveLaunchPath?.(sessionId);
-	if (!launchPath) return {};
-	if (!inheritedPath) return { PATH: launchPath };
-	if (inheritedPath === launchPath || inheritedPath.startsWith(`${launchPath}${pathDelimiter}`)) return { PATH: inheritedPath };
-	return { PATH: `${launchPath}${pathDelimiter}${inheritedPath}` };
-}
 /**
 * Resolve Context Tree for one Agent Workspace into the two things a Provider Runtime needs.
 *
@@ -26963,6 +27020,21 @@ async function waitForStart(start, signal) {
 		signal.removeEventListener("abort", onAbort);
 	}
 }
+function visibleProviderCliPath(managed, resolveLaunchPath) {
+	return managed.sessionKind === "visible" ? { pathPrepend: resolveLaunchPath?.(managed.binding.sessionId) } : {};
+}
+async function prepareConfigurationRoots(layout) {
+	try {
+		await mkdir(layout.contextTreeConfigDir, {
+			mode: 448,
+			recursive: true
+		});
+		return [layout.contextTreeConfigDir];
+	} catch (error) {
+		logger$13.warn({ code: error.code }, "Context Tree configuration directory could not be created");
+		return [];
+	}
+}
 var TurnTraceBuffer = class {
 	#id;
 	#maxBufferBytes;
@@ -27499,6 +27571,7 @@ function completionForResult(result, abortReason) {
 /** The specific pre-execution rejection code behind a typed Turn failure, for the Computer's log only. */
 function errorFieldsForLog(error) {
 	if (error instanceof ImCredentialEnvironmentError || error instanceof ProviderCliTurnPlanError) return { errorCode: error.code };
+	if (error instanceof SessionRuntimeNotPreparedError) return { errorCode: error.code };
 	return {};
 }
 function completionForError(error, abortReason) {
@@ -27527,6 +27600,11 @@ function completionForError(error, abortReason) {
 		executionEffects: "not_started",
 		errorReason: "provider_start_failed"
 	};
+	if (error instanceof SessionRuntimeNotPreparedError) return {
+		outcome: "failed",
+		executionEffects: "not_started",
+		errorReason: "provider_start_failed"
+	};
 	return {
 		outcome: "unknown",
 		executionEffects: "may_have_occurred",
@@ -28737,6 +28815,8 @@ var ContextTreeManager = class {
 	#cooldown = /* @__PURE__ */ new Map();
 	#inFlight = /* @__PURE__ */ new Map();
 	#observedTarget = /* @__PURE__ */ new Map();
+	#shimPreparation;
+	#shimRetryAt = 0;
 	#pending = Promise.resolve();
 	constructor(options) {
 		this.#home = resolve(options.home);
@@ -28762,8 +28842,15 @@ var ContextTreeManager = class {
 	* connection from writing into a workspace still mid-migration.
 	*/
 	async ensureAgent(cwd) {
+		return this.#withinSessionStartBudget(this.#prepareAgent(cwd));
+	}
+	async #prepareAgent(cwd) {
+		const executableFailure = !this.#package ? "PACKAGE_MISSING" : await this.#prepareShim() ? void 0 : "SHIM_UNAVAILABLE";
 		const config = await this.readConfig();
-		if (!config) return { status: "unconfigured" };
+		if (!config) return executableFailure ? {
+			status: "unavailable",
+			reason: executableFailure
+		} : { status: "unconfigured" };
 		const target = formatContextTreeTarget(config.target);
 		if (this.#observedTarget.get(cwd) !== target) {
 			this.#observedTarget.set(cwd, target);
@@ -28775,7 +28862,7 @@ var ContextTreeManager = class {
 		const cooling = this.#cooldown.get(cwd);
 		if (cooling?.target === target && cooling.until > Date.now()) return cooling.status;
 		if (cooling) this.#cooldown.delete(cwd);
-		return this.#withinSessionStartBudget(this.#joinPreparation(cwd, config, target));
+		return this.#joinPreparation(cwd, config, target, executableFailure);
 	}
 	async readConfig() {
 		try {
@@ -28788,10 +28875,6 @@ var ContextTreeManager = class {
 	async #ensureAgentOnce(cwd, config) {
 		if (!this.#package) return this.#unavailable("PACKAGE_MISSING", config);
 		if (!this.#codexHomeIsDefaultNamed) return this.#unavailable("CODEX_HOME_UNSUPPORTED", config);
-		if (!await this.#writeShim().catch((error) => {
-			this.#logger.warn({ err: describe(error) }, "Context Tree shim could not be created");
-			return false;
-		})) return this.#unavailable("SHIM_UNAVAILABLE", config);
 		try {
 			const treePath = (await this.#run(connectArguments(config.target, cwd), cwd, config.target.kind === "github")).tree?.path;
 			if (typeof treePath !== "string" || treePath.length === 0) return this.#unavailable("CONNECT_FAILED", config);
@@ -28847,6 +28930,19 @@ var ContextTreeManager = class {
 	* The shim pins the same Node.js runtime OpenTag uses, so a Session cannot resolve a different
 	* one from the user's shell configuration.
 	*/
+	#prepareShim() {
+		if (this.#shimPreparation && Date.now() < this.#shimRetryAt) return this.#shimPreparation;
+		if (this.#shimPreparation && this.#shimRetryAt === 0) return this.#shimPreparation;
+		this.#shimRetryAt = 0;
+		this.#shimPreparation = this.#writeShim().catch((error) => {
+			this.#logger.warn({ err: describe(error) }, "Context Tree shim could not be created");
+			return false;
+		}).then((success) => {
+			if (!success) this.#shimRetryAt = Date.now() + this.#failureCooldownMs;
+			return success;
+		});
+		return this.#shimPreparation;
+	}
 	async #writeShim() {
 		if (!this.#package) return false;
 		if (this.#platform === "win32") {
@@ -28869,10 +28965,10 @@ var ContextTreeManager = class {
 			reason
 		};
 	}
-	#joinPreparation(cwd, config, target) {
+	#joinPreparation(cwd, config, target, executableFailure) {
 		const current = this.#inFlight.get(cwd);
 		if (current?.target === target) return current.promise;
-		const prepared = this.#serialize(() => this.#ensureAgentOnce(cwd, config)).catch((error) => {
+		const prepared = this.#serialize(async () => executableFailure ? this.#unavailable(executableFailure, config) : this.#ensureAgentOnce(cwd, config)).catch((error) => {
 			this.#logger.error({ err: describe(error) }, "Context Tree preparation raised an unexpected failure");
 			return {
 				status: "unavailable",
@@ -31313,7 +31409,6 @@ function isStorageOrPermissionError(error) {
 	const code = error?.code;
 	return code === "EACCES" || code === "EPERM" || code === "EROFS";
 }
-const UNREPAIRABLE = /* @__PURE__ */ new Set(["unsupported_platform", "global_bin_unavailable"]);
 const GRANT_REPLAY_RETENTION_MS = 6e4;
 const logger$3 = createLogger("runtime-provider-cli-reconciler");
 /**
@@ -31360,10 +31455,11 @@ var ProviderCliReconciler = class {
 		this.#closePromise ??= this.#performClose();
 		return this.#closePromise;
 	}
-	/** Re-inspect each published CLI so heartbeat freshness reflects current local state. */
+	/** Re-inspect published CLIs and active requirement Providers without mutating repair state. */
 	async refreshPublishedImCliReadiness() {
 		if (this.#closed || this.#signal?.aborted) return;
-		await Promise.all([...this.#imCliPublished.keys()].map((provider) => this.#refreshImCli(provider)));
+		const providers = /* @__PURE__ */ new Set([...this.#imCliPublished.keys(), ...[...this.#current.values()].map((requirement) => requirement.provider)]);
+		await Promise.all([...providers].map((provider) => this.#refreshPassive(provider)));
 	}
 	async #performClose() {
 		this.#closed = true;
@@ -31385,12 +31481,11 @@ var ProviderCliReconciler = class {
 	* Return the exact selection already accepted by daemon readiness.
 	*
 	* An already-accepted selection that still matches the live CLI is admitted
-	* immediately. A never-accepted, already-healthy live CLI joins the in-flight
-	* provider reconcile and is admitted only when path, fingerprint, version, and
-	* generation stay identical across the wait. A provider that was accepted once
-	* and later failed or rotated is not treated as a fresh cold start. Caller
-	* cancellation interrupts inspect, reconcile wait, and publication wait without
-	* cancelling shared work or another waiter.
+	* immediately. A never-accepted, already-healthy live CLI joins in-flight owner
+	* work when present, otherwise confirms read-only if identity stays stable. A
+	* provider that was accepted once and later failed or rotated is not treated as
+	* a fresh cold start and does not start Run-triggered ensure. Caller cancellation
+	* interrupts inspect and shared-work wait without cancelling other waiters.
 	*/
 	async readySelectionForRun(provider, signal) {
 		try {
@@ -31409,14 +31504,26 @@ var ProviderCliReconciler = class {
 		if (this.#closed) return void 0;
 		const accepted = this.#readySelection.get(provider);
 		if (accepted && live && selectionsMatch(accepted, live)) return { ...live };
-		const initialConfirmation = accepted === void 0 && live !== void 0 && !this.#acceptedOnce.has(provider);
-		await this.#awaitReadiness(this.#publishCurrentProvider(provider, "checking"), signal);
-		const status = await this.#awaitReadiness(this.#reconcileProvider(provider), signal);
+		if (!(accepted === void 0 && live !== void 0 && !this.#acceptedOnce.has(provider)) || !live) return void 0;
+		const existing = this.#providerRepairJob(provider);
+		if (existing) {
+			const outcome = await this.#awaitReadiness(existing, signal);
+			this.#throwIfReadinessAborted(signal);
+			if (this.#closed || outcome.status !== "ready") return void 0;
+			return this.#admitUnchangedInitialSelection(provider, live, signal);
+		}
+		return this.#confirmInitialSelection(provider, live, signal);
+	}
+	async #confirmInitialSelection(provider, live, signal) {
+		const liveAfter = await this.#awaitReadiness(this.#inspectLiveSelection(provider), signal);
 		this.#throwIfReadinessAborted(signal);
 		if (this.#closed) return void 0;
-		await this.#awaitReadiness(this.#publishCurrentProvider(provider, status), signal);
-		if (!initialConfirmation || !live) return void 0;
-		return this.#admitUnchangedInitialSelection(provider, live, signal);
+		if (!liveAfter || !selectionsMatch(live, liveAfter)) return void 0;
+		const accepted = this.#readySelection.get(provider);
+		if (this.#acceptedOnce.has(provider)) return accepted && selectionsMatch(accepted, liveAfter) ? { ...liveAfter } : void 0;
+		this.#readySelection.set(provider, liveAfter);
+		this.#acceptedOnce.add(provider);
+		return { ...liveAfter };
 	}
 	async #admitUnchangedInitialSelection(provider, live, signal) {
 		const acceptedAfter = this.#readySelection.get(provider);
@@ -31503,22 +31610,77 @@ var ProviderCliReconciler = class {
 		});
 	}
 	async #prewarmProvider(provider, mode) {
-		if (mode === "inspect") return this.#refreshImCli(provider);
+		if (mode === "inspect") {
+			this.#publishImCli(provider, "checking");
+			const status = (await this.#inspectProvider(provider))?.readiness ?? "unavailable";
+			this.#publishImCli(provider, status);
+			return status;
+		}
 		this.#publishImCli(provider, "checking");
-		const status = await this.#reconcileProvider(provider, "auto");
-		this.#publishImCli(provider, status);
-		return status;
+		const outcome = await this.#reconcileProvider(provider, "auto");
+		this.#publishImCli(provider, outcome.status);
+		return outcome.status;
+	}
+	async #refreshPassive(provider) {
+		const published = this.#imCliPublished.has(provider);
+		const targets = [...this.#current.values()].filter((requirement) => requirement.provider === provider).map((requirement) => ({
+			integrationId: requirement.integrationId,
+			lastStatus: requirement.lastStatus,
+			requestId: requirement.requestId
+		}));
+		const repairAtStart = this.#providerRepairJob(provider);
+		const selectionAtStart = this.#readySelection.get(provider);
+		const inspection = await this.#inspectProvider(provider);
+		if (this.#closed || this.#signal?.aborted) return;
+		const readiness = inspection?.readiness ?? "unavailable";
+		if (published && this.#imCliPublished.has(provider)) this.#publishImCli(provider, readiness);
+		if (this.#passiveOverlappedRepair(provider, targets, repairAtStart, selectionAtStart)) return;
+		await this.#publishPassiveInspection(provider, inspection, targets, repairAtStart, selectionAtStart);
+	}
+	async #publishPassiveInspection(provider, inspection, targets, repairAtStart, selectionAtStart) {
+		const liveTargets = targets.flatMap((target) => {
+			const current = this.#current.get(target.integrationId);
+			return current?.requestId === target.requestId ? [current] : [];
+		});
+		if (liveTargets.length === 0) return;
+		if (inspection?.readiness === "ready") {
+			const ready = await readySelectionFromInspect(this.#manager.layout, provider, inspection);
+			if (this.#closed || this.#signal?.aborted) return;
+			if (this.#passiveOverlappedRepair(provider, targets, repairAtStart, selectionAtStart)) return;
+			const stillLive = liveTargets.filter((target) => this.#current.get(target.integrationId)?.requestId === target.requestId);
+			if (ready) {
+				this.#readySelection.set(provider, ready);
+				this.#acceptedOnce.add(provider);
+			} else this.#readySelection.delete(provider);
+			await Promise.all(stillLive.map((requirement) => this.#publishArtifact(requirement, ready ? "ready" : "unavailable")));
+			return;
+		}
+		const code = inspection?.diagnostic?.code;
+		const publicReason = publicProviderCliArtifactReason(code);
+		const inspectReason = providerCliArtifactFailureIsManual({
+			reason: code,
+			stage: "inspect"
+		}) ? publicReason : void 0;
+		await Promise.all(liveTargets.map((requirement) => {
+			if (this.#current.get(requirement.integrationId)?.requestId !== requirement.requestId) return Promise.resolve();
+			return this.#publishArtifact(requirement, "unavailable", requirement.lastStatus === "unavailable" ? requirement.lastReason ?? inspectReason : inspectReason);
+		}));
 	}
-	async #refreshImCli(provider) {
-		this.#publishImCli(provider, "checking");
-		const status = await this.#inspectImCli(provider);
-		this.#publishImCli(provider, status);
-		return status;
+	#providerRepairJob(provider) {
+		return this.#providerJobs.get(`${provider}:managed-only`) ?? this.#providerJobs.get(`${provider}:auto`);
+	}
+	#passiveOverlappedRepair(provider, targets, repairAtStart, selectionAtStart) {
+		if (repairAtStart || this.#providerRepairJob(provider)) return true;
+		if (this.#readySelection.get(provider) !== selectionAtStart) return true;
+		return targets.some((target) => {
+			const current = this.#current.get(target.integrationId);
+			return current?.requestId === target.requestId && current.lastStatus !== target.lastStatus;
+		});
 	}
-	#inspectImCli(provider) {
+	#inspectProvider(provider) {
 		const existing = this.#inspectionJobs.get(provider);
 		if (existing) return existing;
-		const job = this.#manager.inspect(provider).then((inspection) => inspection.readiness).catch(() => "unavailable").finally(() => {
+		const job = this.#manager.inspect(provider).catch(() => void 0).finally(() => {
 			if (this.#inspectionJobs.get(provider) === job) this.#inspectionJobs.delete(provider);
 		});
 		this.#inspectionJobs.set(provider, job);
@@ -31555,8 +31717,10 @@ var ProviderCliReconciler = class {
 		};
 		this.#current.set(frame.integrationId, tracked);
 		await this.#publishArtifact(tracked, "checking");
-		const status = await this.#reconcileProvider(frame.provider);
-		await this.#publishCurrentProvider(frame.provider, status);
+		const outcome = await this.#reconcileProvider(frame.provider);
+		const current = this.#current.get(frame.integrationId);
+		if (!current || current.requestId !== tracked.requestId) return;
+		await this.#publishArtifact(current, outcome.status, outcome.reason);
 	}
 	async #reconcileProvider(provider, mode = "managed-only") {
 		const key = `${provider}:${mode}`;
@@ -31572,22 +31736,32 @@ var ProviderCliReconciler = class {
 		try {
 			let inspection = await this.#manager.inspect(provider);
 			if (inspection.readiness !== "ready") {
-				if (inspection.diagnostic && UNREPAIRABLE.has(inspection.diagnostic.code)) return "unavailable";
-				await this.#ensureConverging(provider, mode);
+				if (providerCliArtifactFailureIsManual({
+					reason: inspection.diagnostic?.code,
+					stage: "inspect"
+				})) {
+					this.#readySelection.delete(provider);
+					return unavailableOutcome(inspection.diagnostic?.code, "inspect");
+				}
+				const ensured = await this.#ensureConverging(provider, mode);
 				inspection = await this.#manager.inspect(provider);
+				if (inspection.readiness !== "ready") {
+					this.#readySelection.delete(provider);
+					return unavailableOutcome(ensured.diagnostic?.code ?? inspection.diagnostic?.code, "ensure");
+				}
 			}
 			if (inspection.readiness === "ready") {
 				const ready = await readySelectionFromInspect(this.#manager.layout, provider, inspection);
 				if (!ready) {
 					this.#readySelection.delete(provider);
-					return "unavailable";
+					return { status: "unavailable" };
 				}
 				this.#readySelection.set(provider, ready);
 				this.#acceptedOnce.add(provider);
-				return "ready";
+				return { status: "ready" };
 			}
 			this.#readySelection.delete(provider);
-			return "unavailable";
+			return unavailableOutcome(inspection.diagnostic?.code, "ensure");
 		} catch (error) {
 			logger$3.debug({
 				code: "provider_reconcile_failed",
@@ -31595,7 +31769,7 @@ var ProviderCliReconciler = class {
 				error: String(error)
 			}, "Provider CLI reconciliation failed");
 			this.#readySelection.delete(provider);
-			return "unavailable";
+			return { status: "unavailable" };
 		}
 	}
 	/**
@@ -31635,10 +31809,6 @@ var ProviderCliReconciler = class {
 			wait.then(() => finish(), finish);
 		});
 	}
-	async #publishCurrentProvider(provider, status) {
-		const current = [...this.#current.values()].filter((requirement) => requirement.provider === provider);
-		await Promise.all(current.map((requirement) => this.#publishArtifact(requirement, status)));
-	}
 	async #handleGrant(frame) {
 		this.#pruneGrants();
 		if (!this.#acceptsGrant(frame)) return;
@@ -31740,9 +31910,12 @@ var ProviderCliReconciler = class {
 		this.#grants.clear();
 		this.#current.clear();
 	}
-	async #publishArtifact(frame, status) {
+	async #publishArtifact(frame, status, reason) {
 		const current = this.#current.get(frame.integrationId);
 		if (!current || current.requestId !== frame.requestId) return;
+		const publicReason = status === "unavailable" ? reason : void 0;
+		if (current.lastPublishOk !== false && current.lastStatus === status && current.lastReason === publicReason) return;
+		const includeReason = publicReason !== void 0 && this.#connection.capabilityVersion(RUNTIME_CAPABILITY.providerCliReconcile) === 2;
 		const payload = {
 			type: "provider-cli:artifact:status",
 			requestId: frame.requestId,
@@ -31750,9 +31923,17 @@ var ProviderCliReconciler = class {
 			agentId: frame.agentId,
 			integrationId: frame.integrationId,
 			credentialGeneration: frame.credentialGeneration,
-			status
+			status,
+			...includeReason ? { reason: publicReason } : {}
 		};
-		await this.#connection.send(payload, { priority: "result" });
+		try {
+			await this.#connection.send(payload, { priority: "result" });
+			current.lastStatus = status;
+			current.lastReason = publicReason;
+			current.lastPublishOk = true;
+		} catch {
+			current.lastPublishOk = false;
+		}
 	}
 	async #publishValidation(frame, result) {
 		const payload = {
@@ -31810,6 +31991,18 @@ async function readySelectionFromInspect(layout, provider, inspection) {
 function selectionsMatch(left, right) {
 	return left.fingerprint === right.fingerprint && left.generation === right.generation && left.path === right.path && left.version === right.version;
 }
+function unavailableOutcome(code, stage) {
+	const publicReason = publicProviderCliArtifactReason(code);
+	if (!publicReason) return { status: "unavailable" };
+	if (stage === "inspect" && !providerCliArtifactFailureIsManual({
+		reason: code,
+		stage
+	})) return { status: "unavailable" };
+	return {
+		status: "unavailable",
+		reason: publicReason
+	};
+}
 /**
 * Wait for shared work without cancelling it. One waiter's abort only stops that
 * waiter; the underlying job keeps running for everyone else.
@@ -36338,7 +36531,6 @@ async function createClientRuntime(connection, options) {
 		providers,
 		providerEnvironmentPath: (sessionId) => credentialEnvironment.pathForSession(sessionId),
 		providerCliLaunchPath: (sessionId) => providerCliTurnPlans.sessionDir(sessionId),
-		inheritedPath: sourceEnvironment.PATH,
 		slackConfigWritableRoot: (sessionId) => credentialEnvironment.activeSlackConfigDirForSession(sessionId),
 		proofManager,
 		workspace
@@ -37410,7 +37602,7 @@ function redactSecrets(value) {
 //#endregion
 //#region package.json
 var name = "open-tag";
-var version = "0.0.3";
+var version = "0.0.5";
 //#endregion
 //#region src/build-info.ts
 const CHANNEL = "prod";
@@ -40734,6 +40926,7 @@ function formatImBindingDiagnostics(value) {
 		`slackIdentityClosure\t${value.slackIdentityClosure ? `${value.slackIdentityClosure.status}${value.slackIdentityClosure.verifiedAt ? ` (${value.slackIdentityClosure.verifiedAt})` : ""}` : "-"}`,
 		`agentRuntimeReadiness\t${value.agentRuntimeReadiness}`,
 		`providerCliReadiness\t${value.providerCliReadiness}`,
+		`providerCliReason\t${value.providerCliReason ?? "-"}`,
 		`credentialExecutionReadiness\t${value.credentialExecutionReadiness}`,
 		`credentialExecutionReason\t${value.credentialExecutionReason ?? "-"}`,
 		`connection\t${value.connection ? `${value.connection.state} (observed ${value.connection.observedAt})` : "not applicable"}`,
@@ -42270,15 +42463,12 @@ function providerCliRepairCommand(provider) {
 	const flag = provider === "all" ? "all" : providerCliLabel(provider);
 	return `"$HOME/.local/bin/${channelConfig.binName}" provider-cli ensure --provider ${flag}`;
 }
-const PROVIDER_CLI_MANUAL_REASONS = /* @__PURE__ */ new Set([
-	"global_bin_unavailable",
-	"integrity_failed",
-	"unsupported_platform",
-	"version_incompatible"
-]);
 /** False when repeating ensure cannot change the local fact without a user or release change. */
-function providerCliCanAutoRepair(reason) {
-	return !PROVIDER_CLI_MANUAL_REASONS.has(reason);
+function providerCliCanAutoRepair(reason, stage = "ensure") {
+	return !providerCliArtifactFailureIsManual({
+		reason,
+		stage
+	});
 }
 /**
 * Failures that describe another OpenTag process holding the provider lock: transient, safe to
@@ -43390,7 +43580,7 @@ function resolveContextTreeAssets(deps = {}) {
 	return deps.contextTreePackage ?? resolveContextTreePackage();
 }
 function contextTreeConfigPath(home) {
-	return join(home, "config", "context-tree.json");
+	return join(home, "config", "context-tree", "config.json");
 }
 async function readContextTreeConfig(home) {
 	let content;
@@ -45329,7 +45519,7 @@ function renderInspectionLines(inspection, nextAction) {
 function nextActionFor(inspection) {
 	if (inspection.state === "ready") return void 0;
 	const reason = inspection.diagnostic?.code ?? (inspection.readiness === "install" ? "not_installed" : "unavailable");
-	if (!providerCliCanAutoRepair(reason)) return void 0;
+	if (!providerCliCanAutoRepair(reason, "inspect")) return void 0;
 	return {
 		provider: inspection.provider,
 		command: providerCliRepairCommand(inspection.provider),
@@ -45910,4 +46100,4 @@ function createProgram(options = {}) {
 //#endregion
 export { CLI_PACKAGE_NAME as A, resolveOpenTagHomeLayout as B, channelConfig as C, formatAgentList as D, formatAgentCreated as E, executeCommand as F, presentCommand as I, toCommandError as L, CommandError as M, EXIT_CODES as N, CommanderError as O, commandExitCode as P, configureClientLoggerForService as R, resolveChannelEnvironment as S, formatAgentBound as T, runAgentCreate as _, runSessionList as a, selectComputer as b, runLogin as c, runProviderCliEnsure as d, formatComputerList as f, runAgentBind as g, runAgentShow as h, runSessionCreate as i, CLI_VERSION as j, CHANNEL as k, runDoctor as l, runAgentList as m, formatSessionCommandResult as n, runSessionSend as o, buildChildEnvironment as p, formatSessionList as r, runProviderCliInspect as s, createProgram as t, listComputers as u, runAgentDelete as v, formatAgent as w, resolveCommandContext as x, runAgentUpdate as y, resolveOpenTagHome as z };
 
-//# sourceMappingURL=program-CY6rrPEk.mjs.map
+//# sourceMappingURL=program-CpPCcBDJ.mjs.map